FARM CREDIT ADMINISTRATION

PRIVACY IMPACT ASSESSMENT 

SYSTEM, PROGRAM, OR PROJECT NAME 

Federal Complete Discovery Source (FCDS) Relativity

SYSTEM TYPE

Information Technology System or Capability

PURPOSE 

The Farm Credit Administration uses Federal Complete Discovery Source (FCDS) Relativity to support litigation and the 

production and analysis of documents. FCDS Relativity is a commercial off-the-shelf electronic discovery (e-discovery)

software application authorized by the Federal Risk and Authorization Management Program (FedRAMP). 

AUTHORITY 

12 U.S.C. 2252, 2254

INFORMATION OVERVIEW 

Full name ☒

Date of birth ☒

Place of birth ☒

Social Security number (SSN) ☒

Employment status, history, or information ☒

Mother’s maiden name ☐

Certificates (e.g., birth, death, naturalization, marriage) ☐

Medical information (medical record numbers, medical notes, or X-rays) ☒

Home address ☒

Phone number(s) (nonwork) ☒

Email address (nonwork) ☒

Employee identification number (EIN) ☒

Financial information ☒

Driver’s license/State identification number ☐

Vehicle identifiers (e.g., license plates) ☐

Legal documents, records, or notes (e.g., divorce decree, criminal records) ☐

Education records ☒

Covered Persons Included

Farm Credit institution employees ☒

Farm Credit institution customers ☒

FCA employees, contractors, interns ☒

Employees of other federal agencies ☒

Members of the public ☒

Personally Identifiable Information (PII) Included
Criminal information ☒

Military status and/or records ☒

Investigative report or database ☐

Biometric identifiers (e.g., fingerprint, voiceprint) ☐

Photographic identifiers (e.g., image, X-ray, video) ☒

Other (specify): Information pertaining to litigation, request(s) for information, or equal 

employment opportunity and inclusion matters.

☒

LIFE CYCLE NARRATIVE 

FCDS Relativity is a tool for e-discovery. E-discovery refers the identification and production of information in electronic 

format in legal proceedings, such as litigation, government investigations, or Freedom of Information Act (FOIA) request. 

FCA has a subscription to use this centrally hosted software (an arrangement commonly known as “software as a 

service”). FCDS Relativity has a FedRAMP authorization at the moderate level. FCDS Relativity enables the following data 

processing activities through the e-discovery process: 

• Tracking chain of custody 

• Staging and filtering data 

• Eliminating duplicate information

• Extracting metadata and full text 

• Handling exceptions

• Converting data 

• Reviewing documents and managing document review 

• Redacting and annotating text

• Producing load files (technical instructions the software uses to validate results of actions taken by the system).

FCA will use FCDS Relativity to process a wide range of data related to the following:

• Litigation involving FCA and other legal matters handled by the Office of General Counsel (OGC) and others

• Processing of FOIA requests

• Comment letters received in response to public notices requesting comments

• Equal employment opportunity and inclusion matters

FCDS Relativity will store and process personally identifiable information (PII) consisting of data about both current and 

former FCA employees and contractors; FCS institution employees and customers; and the public, when these data are 

related to a specific matter — for instance, pending litigation, a FOIA request, or a comment received about an agency 

regulatory project. PII includes but is not limited to the following:

• Names (first, last, middle)

• Contact information, including address, phone number, and email address

• Biographic information, such as date and place of birth

• Demographic information, including race, sex, and gender

• Social Security number

• Employment information

• Criminal referral information 

Other information associated with a specific matter may also be included. The system does not directly request or 

collect this information. The information kept in the system is included in documents and files uploaded into and

processed and managed by the system. In addition, the system collects and retains administrative and use data 

associated with FCA users who have access to the system.
Authorized users from the Office of Information Technology (OIT) or OGC upload electronic documents into the system 

using desktop software or, for large data transfers, a secure physical hard drive. Upon receipt, FCDS Relativity performs 

an inventory of the documents, then loads the documents and associated metadata into the system. The system

consists of a database, a storage area network for storing files and images, and several servers that enable

administration of the system and searching and analysis of data in a cloud environment. 

After the documents have been formatted and loaded, FCA users can view them through a secure web interface. FCA 

users access FCDS Relativity by logging into the web interface via a browser on their FCA-issued laptop while on the FCA

network. Users can search for a document and make legal determinations, as needed. They may also mark documents 

“privileged” or “not responsive,” redact terms, or comment on documents. Once the documents have been reviewed

and marked as ready for production, the system processes the documents for use by OGC or opposing counsel. Final 

documents may be produced as paper documents, PDF documents, or other electronic formats.

Various system of records notices (SORNs) cover the information included in FCDS Relativity. The system is not a Privacy 

Act system of records; however, documents included in the system may include copies of records subject to the Privacy 

Act. A list of applicable SORNs is included below.

As noted above, FCDS Relativity does not collect information directly from individuals. The system processes information 

collected prior to its inclusion in FCDS Relativity and, as such notice is provided by the individual, system, or form that 

originally collected the information at the original point of collection. If the information is part of a system of records, 

individuals to whom the information applies may be able to access, change, or update information that is erroneous, 

out-of-date, or no longer relevant in accordance with the Privacy Act and FCA’s Privacy Act regulations, as outlined in 12 

CFR Part 603. In addition to notice provided by applicable SORNs, FCA has published this PIA to provide notice to 

individuals whose PII is stored in FCDS Relativity.

Finally, information in the system may be shared internally to facilitate public and internal communications and 

operations and externally in accordance with the routine uses identified in applicable SORNs. Any external sharing of 

information must be within the scope of the agency’s authorities and regulations and facilitate a specific FCA business 

function.

COMPLIANCE WITH APPLICABLE STATUTES, REGULATIONS, AND REQUIREMENTS 

For each statute or regulatory requirement indicate applicable sections of statutes, regulations, or requirements and 

provide links to them, or provide a brief description of compliance. If a certain requirement is not applicable to FCDS 

Relativity, indicate with N/A.

SORNs

Various SORNs cover the information included in FCDS Relativity, including these: 

FCA-5 — Assignments and Communication Tracking System — FCA [85 FR 34436]

FCA-6 — Freedom of Information and Privacy Act Requests — FCA [85 FR 46624]

FCA-11 — Litigation and Administrative Adjudication Files — FCA [85 FR 52602]

FCA-13 — Correspondence Files — FCA [85 FR 49369]

Notice of computer 

matching agreement(s)

N/A — FCA does not have computer matching agreements that pertain to this system.

Office of Management and 

Budget (OMB) control 

number(s) or related 

form(s)

N/A — FCA does not have OMB control numbers or forms associated with this system.

Information captured in source documents and other records included in the system may be 

subject to specific forms or OMB control numbers at the original point of collection.

Record(s) control schedule 

name(s) and number(s)

Records are maintained in accordance with FCA’s comprehensive records schedule and the 

National Archives and Records Administration’s general records schedule. 

The Privacy Act of 1974 (As Amended)

Computer Matching and Privacy Protection Act of 1980

The Paperwork Reduction Act of 1995

The Federal Records Act of 1950 (As Amended)
N/A N/A

ADMINISTRATIVE AND TECHNOLOGICAL CONTROLS 

☒ All applicable controls for protecting PII as defined in the National Institute of Standards and Technology (NIST) Special 

Publication (SP) 800-53, Revision 4, Appendix J, and NIST SP 800-122 have been implemented and are functioning as 

intended, have compensating controls in place to mitigate residual risk, or have an approved plan of action and 

milestones.

☒ The system has been reviewed for and assigned a categorization level in accordance with NIST Federal Information 

Processing Standards (FIPS) Publication 199 and NIST SP 800-60, and the senior agency official for privacy has approved 

the categorization.

FIPS 199 Security Impact Category: Moderate

☒ A security assessment has been conducted for the system, and it has been determined that there are no additional privacy 

risks.

☒ The information system has been secured in accordance with Federal Information Security Modernization Act 

requirements.

Most recent assessment and authorization type: Authorization to Use (ATU) and date: 6/24/2019

☐ This is a new system, and the assessment and authorization date is pending.

☒ A comprehensive listing of data elements included in the system has been provided to the privacy officer, reviewed and 

approved, and included in the agencywide PII inventory.

☒ System users are subject to or have signed confidentiality or nondisclosure agreements, as applicable.

☒ System users are subject to background checks or investigations.

FCA employees undergo background checks. In addition, certain non-FCA personnel who work for FCDS Relativity and who 

have system access undergo background investigations part of FedRAMP authorization requirements.

☒ System access is limited to authorized personnel with a bona fide need to know in support of their duties.

☒ Notice is provided in the form of a Privacy Act statement, privacy notice, privacy policy, or similar, as applicable.

☒ Contract(s) or agreement(s) (e.g., memorandums of understanding, memorandums of agreement, and information 

security agreements) establish ownership rights over data, including PII.

☒ Acceptance of liability and responsibilities for exposure of PII are clearly defined in agreement(s) or contract(s).

☒ Access to and use of PII are monitored, tracked, and recorded.

☒ Training on PII, confidentiality, and information security policies and practices is provided to system users or those with 

access to information.

ADMINISTRATIVE AND TECHNOLOGICAL CONTROLS NARRATIVE 

FCDS Relativity is a solution authorized by FedRAMP that FCA uses to process a wide range of data and information 

pertaining to activities listed in the Life Cycle Narrative section above.

The solution is authorized for use at the moderate level. FCA reviewed system security documentation provided for 

FCDS Relativity, and FCA’s chief information officer (CIO) has granted the system an Authorization to Use. Because this 

system is a FedRAMP-authorized solution, the vendor is responsible for a selection of provider-managed security 

controls that allow for processing information at the moderate level. FCA is responsible for a selection of controls, 

including configuring and managing user access, managing permissions and roles within the system, and managing and 

handling data in the system in accordance with the sensitivity of that information, including requirements for records 

retention.

The agency secures information in the system using several means, including the following:

• Transport layer security connections and multifactor authentication

• Access controls and application of the principle of least privilege

Other
• Application, network, server, and database activity logs, which are reviewed when abnormalities are detected or 

when requested by the CIO or chief information security officer (CISO)

FCA has limited access to FCDS Relativity to representatives from OGC, the Office of Secondary Market Oversight

(OSMO), the Office of Examination (OE), the Office of Inspector General (OIG), the Office of Equal Employment 

Opportunity and Inclusion (EEO), and OIT.

Within each office, users are assigned to workspaces related to the matters that are part of their duties. Permissions 

within each workspace are generally determined by applying the principles of least privilege and need-to-know. For 

example, a user responsible for applying redactions as part of a discovery process would have the ability to redact but 

not to approve redactions, and only for those documents for which they have a need-to-know included information as 

part of their FCA duties. 

All FCA users receive annual IT security and privacy awareness training and are responsible for reviewing and attesting to 

the requirements described in FCA IT security and personal use policies, including the agency’s Rules of Behavior and 

personal use restrictions. Finally, OIT has worked with FCDS Relativity to provide end-user training for FCDS Relativity

users.

PRIVACY RISK ANALYSIS 

The following overview of the primary risks associated with FCA’s use of FCDS Relativity includes a description of 

mitigations the agency has put in place for each.

Data minimization: Because FCDS Relativity is used to process a wide range of data and information as part of ediscovery and similar functions, there is a risk of unnecessary or inadvertent data collection within the system. This risk 

is partially reduced by limiting the use of the system to FCA users with specific permissions, including restricting who can 

upload documents and create workspaces within the system. Workspaces are temporary and are deleted when they are 

no longer necessary (e.g., a workspace is deleted after a final file of redacted responsive documents has been output), 

which further reduces the risk of large volumes of PII being maintained in the system.

Data confidentiality: The variety of PII and the inherent sensitivity of the documents managed in FCDS Relativity create 

a risk of unauthorized access or disclosure. FCA limits access to the system to certain FCA users from OIT, OGC, OSMO, 

OE, OIG, and EEO. Users have access only to workspaces associated with matters they have been assigned or to 

workspaces for which they have a valid need-to-know access in support of their duties. 

Access is provided strictly based on approved authorizations, and roles are assigned based on the principle of least 

privilege. In addition, FCDS Relativity has implemented technical and administrative controls to protect information, 

including data encryption, event auditing and logging capability, and two-factor authentication. FCA users may only 

access FCDS Relativity when they are using an FCA-issued laptop connected to the FCA network. Finally, in addition to 

the required Rule of Behavior and annual training requirements applicable to all FCA users, FCDS Relativity users receive 

training specific to the system. 

Transparency: There is a risk that individuals may not receive notice that their information is being processed in FCDS

Relativity. As noted above, FCDS Relativity does not directly collect information from individuals; instead, information is 

derived from source documents and data in support of the e-discovery process. Notice is provided by the original 

collector via a privacy notice, a Privacy Act statement, or other type of notification, as applicable, when the data are first 

collected. In addition, FCA has published this PIA to provide notice to individuals whose PII is stored in FCDS Relativity.

Overall risk: Recognizing the risks presented to PII in using FCDS Relativity, FCA has employed technical and 

administrative controls to reduce this risk. As outlined above, as a FedRAMP-authorized solution, the tool implements 

multiple physical, technical, and administrative controls for processing information at a moderate level. FCA has 

supplemented these controls with additional technical and administrative controls, including processes and procedures 

for accessing and using the tool as well as training and awareness efforts to reduce overall risk.
DOCUMENT CONTROL 

Approval

 

/s/ Wesley Fravel______________

Wesley Fravel, FCA privacy officer

/s/ Elsie Shaffer________________________

Jeannie Shaffer, CISO

/s/ Ruth Surface______________

Ruth Surface, associate director, infrastructure 

division

/s/ Jerry Golley___________________

Jerry Golley, CIO and senior agency official for privacy

Change Control and Approval History

V 1.0 2/9/2021 Initial Version

Version Date Change Summary