(1 Other (e.g., commercial providers, colleges).

Specify.

Do individuals have the opportunity to object to the collection of their PII?

x Yes [Cl No

(1) If "Yes," describe method by which individuals can object to the collection of Pll.

Based on DOD 5400.11-R Department Of Defense Privacy Program: C2.1.2.5. Upon entrance into military
service or civilian employment with the Department of Defense, individuals are asked to provide their Pll.
The individual has the opportunity to object to collection at this stage. The Pl! is used to establish personnel,
financial, medical, and other official records. The military services provide the PII to ARN, and ARN only uses|
Pll to verify clothing records. If at any point an individual needs to supply Pll such as clothing size, they can
lobject, however they will be unable to receive their equipment issue.

(2) If"No," state the reason why individuals cannot object.

j. Do individuals have the opportunity to consent to the specific uses of their PII?

DD Ft

O Yes Xx] No

(1) If "Yes," describe the method by which individuals can give or withhold their consent.

(2) If"No,” state the reason why individuals cannot give or withhold their consent.

Pil resident in ARN is used to issue properly fitted clothing to the recruit for the basic training period. If the
recruit were given the opportunity to exclude Pll from ARN, it would prevent them from being provided a
critical component of their initial training and would preclude them from those training activities, necessitating
their discharge from their service components.

M2930 NOV 2008 Page Sorts


g. Summary of DoD information system or electronic collection. Answers to these questions
should be consistent with security guidelines for release of information to the public.

describe the types of personal information about individuals collected in the system.

To establish a database for the purpose of managing military recruit clothing inventories to forecast future
clothing needs; to reduce costs and lead times; to improve the quality of design and production of clothing;
land to improve the efficiency of clothing distribution for the participating military services. Records are also
used to record receipts, sales, exchanges, replacements, and returns of individual clothing items by the
recruit. Records collected and maintained include Individual's name, Social Security Number (SSN), gender,
rank, MOS, duty station, roster ID, Platoon/Company assigned, records of receipts, sales, exchanges,
replacements, and returns of individual clothing items, uniform sizes, quantities of clothing items ordered by
individuals and branch of military service cost center data.

|
(1) Describe the purpose of this DoD information system or electronic collection and briefly |

(2) Briefly describe the privacy risks associated with the PII collected and how these risks are
addressed to safeguard privacy.

The risks are exposure of Pll data to unauthorized personnel without a need to know. The risk is
mitigated through a combination of administrative, physical, and technical controls.

Administrative: Access to personal information is limited to those individuals who require the records to
perform their official assigned duties.

Physical: Records are maintained in secure, limited access, or monitored areas. Physical entry by
unauthorized persons is restricted through the use of locks, guards, PKI, passwords, or other administrative
procedures.

Technical: Database is monitored and access is PKI protected. Archived data is stored encrypted on
magnetic tapes, which are kept in a locked or controlled access areas, as well as stored remotely through a
DoD approved back up tape storage provider. With the exception of the secure encrypted remote stored
back ups and the exchange with the DoD components listed in section 2.h, recruit PII is not transmitted
outside of the recruit training center.

h. With whom will the Pll be shared through data exchange, both within your DoD Component and
outside your Component (e.g., other DoD Components, Federal Agencies)? Indicate all that apply.

Within the DoD Component.

Specify. DLA Integrated Data Environment (IDE)

|] Other DoD Components.

Specify. [Defense Finance and Accounting Services (DFAS) for Army only

(1 +Other Federal Agencies.

Specify. |
[State and Local Agencies. :
Specify.
(1 Contractor (Enter name and describe the language in the contract that safeguards PII.)
Specify. |

DD FORM 2930 NOV 2008 Page 4 of 15


k. What information is provided to an individual when asked to provide Pll data? Indicate all that
apply.

Privacy Act Statement oO Privacy Advisory
Other oO None

Describe {ARN receives the individuals Pll from the military components recruit training information system. All
each military service personnel and applicants for service sign their respective military component (Army,
applicable |Navy, Air Force, Marines) Privacy Act statements which are maintained in their Service Record
format. Books, and are covered by the collection of Pll in all DoD Automated Information Systems (AIS) to
manage their military training.

ARN does not have access to the service record books, but relies on the military services to provide
the Pll necessary for issue of equipment.

Other: Individual Social Security Numbers are used to identify new recruits and they provided as part
of each recruit's roster information, as provided by the Services’ personnel systems. New recruits are
not provided DoD ID numbers until sometime after clothing issue during basic training so there are no
alternatives to support this requirement. To mitigate the risk of PIl compromise, the ARN system runs
a weekly automated lookup/replacement process to substitute recruits’ DoD numbers for SSNs as
soon as they become available in the DoD personnel data system (DEERS) and encrypts the entire
database where the Pll is stored. DLA Troop Support, and the Clothing and Textile Chain have
worked hand-in-hand with the ARN Program Office and DLA Information Operations (J62) to
complete and validate the ARN PIA as accurate and complete.

NOTE:

Sections 1 and 2 above are to be posted to the Component's Web site. Posting of these
Sections indicates that the PIA has been reviewed to ensure that appropriate safeguards are in
place to protect privacy.

A Component may restrict the publication of Sections 1 and/or 2 if they contain information that
would reveal sensitive information or raise security concerns.

DD FORM 2930 NOV 2008 Page 6 of 15


PRIVACY IMPACT ASSESSMENT (PIA)
For the

Apparel Research Network Supply Chain Management System (ARN)

Defense Logistics Agency

SECTION 1: IS A PIA REQUIRED?

a. Will this Department of Defense (DoD) information system or electronic collection of
information (referred to as an "electronic collection” for the purpose of this form) collect,
maintain, use, and/or disseminate Pll about members of the public, Federal personnel,
contractors or foreign nationals employed at U.S. military facilities internationally? Choose
one option from the choices below. (Choose (3) for foreign nationals).

C1 (1) Yes, from members of the general public.
(2) Yes, from-Federal personnel* and/or Federal contractors.

[1 (3) Yes, from both members of the general public and Federal personnel and/or Federal contractors.
[J (4) No

* “Federal personnel" are referred to in the DoD IT Portfolio Repository (DITPR) as "Federal employees.”

b. If "No," ensure that DITPR or the authoritative database that updates DITPR is annotated
for the reason(s) why a PIA is not required. If the DoD information system or electronic
collection is not in DITPR, ensure that the reason(s) are recorded in appropriate
documentation.

c. If "Yes," then a PIA is required. Proceed to Section 2.

DD FORM 2930 NOV 2008 Page 1 of 15


SECTION 2: PIA SUMMARY INFORMATION

a. Why is this PIA being created or updated? Choose one:

C] New DoD Information System oO New Electronic Collection

x] Existing DoD Information System oO Existing Electronic Collection !

oO Significantly Modified DoD Information
System

b. Is this DoD information system registered in the DITPR or the DoD Secret Internet Protocol

Router Network (SIPRNET) IT Registry?

134] Yes, DITPR Enter DITPR System Identification Number {293

o Yes, SIPRNET Enter SIPRNET Identification Number

im No

¢, Does this DoD information system have an IT investment Unique Project Identifier (UPI), required
by section 53 of Office of Management and Budget (OMB) Circular A-11?

oO Yes No

If "Yes," enter UPI

If unsure, consult the Component IT Budget Point of Contact to obtain the UPI.

d. Does this DoD information system or electronic collection require a Privacy Act System of
Records Notice (SORN)?

A Privacy Act SORN is required if the information system or electronic collection contains information about U.S. citizens

or lawful permanent U.S. residents that is retrieved by name or other unique identifier. PIA and Privacy Act SORN
information should be consistent.

& Yes [I No

If "Yes," enter Privacy Act SORN Identifier $800.20, "Military Clothing Database" (October 26, 2012, 77 Fa

DoD Component-assigned designator, not the Federal Register number.
Consult the Component Privacy Office for additional information or
access DoD Privacy Act SORNs at: http:/Avww.defenselink.mil/privacy/notices/

or

Date of submission for approval to Defense Privacy Office
Consult the Component Privacy Office for this date.

DD FORM 2930 NOV 2008 Page 2 of 15


e. Does this DoD information system or electronic collection have an OMB Contro! Number?
Contact the Component Information Management Control Officer or DoD Clearance Officer for this information.

This number indicates OMB approval to collect data from 10 or more members of the public in a 12-month period
regardiess of form or format,

oO Yes

Enter OMB Control Number H

Enter Expiration Date

f. Authority to collect information. A Federal law, Executive Order of the President (EO), or DoD
requirement must authorize the collection and maintenance of a system of records.

(1) If this system has a Privacy Act SORN, the authorities in this PIA and the existing Privacy Act
SORN should be the same.

(2) Cite the authority for this DoD information system or electronic collection to collect, use, maintain
and/or disseminate Pll. (If multiple authorities are cited, provide all that apply.)

(a) Whenever possible, cite the specific provisions of the statute and/or EO that authorizes
the operation of the system and the collection of Pll.

(b) If a specific statute or EO does not exist, determine if an indirect statutory authority can
be cited. An indirect authority may be cited if the authority requires the operation or administration of
a program, the execution of which will require the collection and maintenance of a system of records.

(c) DoD Components can use their general statutory grants of authority (“internal
housekeeping”) as the primary authority. The requirement, directive, or instruction implementing the
statute within the DoD Component should be identified.

10 U.S.C. 136, Under Secretary of Defense for Personnel and Readiness;
DoD Directive 1338.5, Armed Forces Clothing Monetary Allowance Policy;
and E.O. 9397 (SSN).

DD FORM 2930 NOV 2008 Page 3 of 15