1

Commodity Futures Trading Commission

Adapted Privacy Impact Assessment for Use of Third-Party 

Websites or Applications

System Name: Twitter

Office(s): Office of Public Affairs and Office of Information Technology Services

Date: 1/19/2011

1. Overview and Purpose

The Commodity Futures Trading Commission (CFTC or the Commission) will use Twitter, a thirdparty website located at www.twitter.com, to disseminate information to the public. Twitter allows 

any individual who has subscribed to Twitter to widely disseminate microblogs known as “tweets”; 

tweets are text-based posts of up to 140 characters. A subscriber types a “tweet” into his or her 

profile page on www.twitter.com, or through his or her mobile phone or other Internet-enabled 

device. The tweet is displayed on the subscriber’s Twitter profile page and is also electronically 

disseminated to other Twitter subscribers who had previously elected to “follow” the posting 

subscriber’s tweets. The subscribers who sign up to receive other subscribers’ tweets are known 

as “followers.” Only registered subscribers may post tweets on Twitter.

The CFTC will create a primary CFTC account (“@CFTC”), in addition to other accounts by 

specifically designated CFTC staff members. These accounts will be coordinated by the CFTC’s 

Office of Public Affairs and/or by the Chief Privacy Officer and Chief Information Officer. 

The CFTC Twitter profiles will be public, allowing anyone to visit the profile pages and read the 

CFTC's tweets, including visitors to the Twitter website who are not registered Twitter users. 

The CFTC Twitter accounts will provide an additional means for the CFTC to notify the public 

about CFTC upcoming events, press releases, newsworthy stories, CFTC reports, enforcement 

actions or comments on Commission related issues. CFTC tweets will either be content that exists 

on www.cftc.gov, or non-substantive content that is time-sensitive, for example, a notice that a 

press release will be posted on the website at a particular time. To understand the attention that 

the CFTC generates and to improve the CFTC’s understanding of the issues it regulates, the 

CFTC also will use Twitter to review tweets that are available to the public on the Internet or that 

are made available to the CFTC by its followers. 

The CFTC generally does not intend to collect, maintain, or disseminate personally identifiable 

information (“PII”) from individuals who follow CFTC tweets, with two exceptions. One, the tweets 

of reporters may be included in internally-circulated daily news clips with the reporter’s name and 

affiliated organization. Two, in unusual circumstances, for example, a threat of violence against the 

Commission or tweets that suggest a violation of the Commodity Exchange Act (“the Act”), in 

accordance with the Privacy Act and other applicable laws, for purposes of investigation, the 

CFTC may collect, maintain or disseminate tweets and the name and profile information of an 

individual that such individual has voluntarily published about him or herself on Twitter or has 

voluntarily made available to the CFTC by following the CFTC.1

 

1

Nothing herein shall be construed to limit the CFTC’s ability to use all applicable legal authorities 

and powers to investigate and prosecute violations of the Commodity Exchange Act.
2

2. Data Collected and Stored 

2.1. What information will be collected, used, disseminated, or maintained or will become 

accessible to the CFTC through the new or modified use? Specifically describe any 

personally identifiable information (“PII”) to be collected, used, disseminated or 

maintained.

Twitter requires that its registered subscribers provide their first name, last name, a valid email 

address, and a password, with the option to provide a photograph and additional biographical or 

other information in their profiles. If a Twitter user voluntarily “follows” CFTC tweets, designated 

CFTC staff members will have access to information in the followers’ profiles that the followers 

have made accessible to the public or to those they choose to follow. Despite this access, the 

CFTC generally will not collect, maintain or disseminate any PII from followers, except that a 

reporter’s name and organization may be used with internally-circulated news clips and, except 

that, if needed for investigative purposes as explained above, the CFTC would collect, maintain or 

disseminate PII that the individual being investigated has posted on his or her Twitter account and 

made accessible to the public or to those that he or she follows, such as his or her name, email 

address or biographical information.

2.2. What will be the sources of the information in any new or modified use of third-party 

websites or applications?

Twitter collects PII from individuals who register with Twitter and who may ultimately visit or 

indicate that they "follow" the CFTC Twitter account. The sources of information collected by 

Twitter are the individuals who provide such information. To the extent the CFTC accesses or uses 

information by other Twitter users for the limited purposes stated herein, the sources of information 

are other Twitter users. Note: Information in a CFTC investigation of a violation of the Act becomes 

part of the CFTC Investigatory Records System, described under System of Record Notice 

(“SORN”) CFTC-10, Investigatory Records (Exempted); such records are exempted by the 

Commission from certain provisions of the Privacy Act of 1974 pursuant to the terms of the Privacy 

Act, 5 U.S.C. 552a(k)(2), and the Commission’s rules promulgated thereunder, 17 CFR 146.12, 

including the requirement that the sources of records in the system be described.

The sources of information posted by the CFTC will be the CFTC staff members specifically 

authorized to use Twitter, for example, Office of Public Affairs personnel.

2.3. Why will the information be collected, used, disseminated or maintained? 

The CFTC generally will not collect, maintain or disseminate PII from other Twitter users, with two 

exceptions. One, the CFTC may collect, maintain and disseminate internally the name and 

organization of a reporter of a tweet, for the purpose of attribution in internally-circulated news 

clips, just as the CFTC would identify the name of a reporter for a printed news article used in 

news clips. Two, in unusual circumstances, for example, a threat of violence against the 

Commission or tweets that suggest a violation of the Act, in accordance with the Privacy Act and 

other applicable laws, for purposes of investigation, the CFTC may collect, maintain or 

disseminate tweets and the name and profile information of an individual that such individual has 

voluntarily published about him or herself on Twitter or has voluntarily made available to the CFTC 

by following the CFTC.

2.4. How will the information be collected and used by the Commission?

In the two exceptions noted above, the information will be collected electronically through Twitter 

on the Internet and generally stored in electronic and paper form. The names and organizations of 

reporters will be used by the CFTC in an electronic news clip service by posting the reporter’s 
3

name and organization along with his or her tweet. This information is posted on the CFTC intranet, printed for record-keeping purposes, and emailed to CFTC staff. If a possible violation of law 

arises, the records collected from Twitter – i.e., the information posted publicly on Twitter or made 

accessible to the CFTC by its followers – would be used for investigative purposes. The records 

could lead to enforcement action by the CFTC or other governmental authorities, including 

possible civil, criminal or administrative penalties. The records would become part of SORN 

CFTC-10, Investigatory Records (Exempted), used as stated in CFTC-10, and exempted by the 

Commission from certain provisions of the Privacy Act of 1974 pursuant to the terms of the Privacy 

Act, 5 U.S.C. 552a(k)(2), and the Commission’s rules promulgated thereunder, 17 CFR 146.12. 

Such records are exempt from the notification procedures, records access procedures, and record 

contest procedures set forth in the system notices of other systems of records, and from the 

requirement that the sources of records in the system be described.

2.5. Is the third-party website or application being used in ways that the CFTC has not 

previously employed (e.g., monitoring software)? 

Creation of CFTC Twitter accounts will not require the CFTC to use new technologies.

Administrators of the account will access it by visiting Twitter.com using a standard

Web browser and logging in with an email address and a password.

2.6. What specific legal authorities authorize the collection of the information? 

The legal authority for the limited collection of PII described in this PIA is the Commodity 

Exchange Act, 7 U.S.C. 1 et seq., and the rules and regulations promulgated thereunder.

3. Data and Records Retention

3.1. How will the information maintained through this new or modified use be managed 

throughout its lifecycle? For what period of time will data collected be maintained and in 

what form will it be retained? What are the plans for destruction and/or disposition of the 

information?

The name and organization of a reporter will be maintained in electronic and paper form as part of 

daily files of news clips, which are retained for five (5) years or longer if needed for research 

purposes. When the news clips are no longer needed, electronic and paper copies will be 

destroyed.

In the unusual situation requiring an investigation of a possible violation of law, the information 

would be handled and retained in accordance with SORN CFTC-10, Investigatory Records 

(Exempted). PII would be collected from Twitter in electronic form through tools that facilitate 

copying of Internet/Web pages. PII would be maintained in electronic and paper form. Paper 

records would be stored in file folders, binders, computer files (such as the Commission’s “eLaw” 

system) and computer disks. Electronic records, including computer files, would be stored on the 

Commission’s network and on various other electronic media as needed, such as encrypted hard 

drives.

As explained in SORN CFTC-10, if an investigatory matter is closed without institution of a case, 

the files are maintained in off site storage for five (5) years, and then destroyed. When the 

Commission moves forward from an investigation to litigation: 

(a) investigatory records that are disclosed by the Commission in the administrative, court or 

other proceedings become part of non-exempt SORN CFTC-16, Enforcement Case Files 

and/or SORN CFTC-17, Litigation Files-OGC, and are retained and disposed of pursuant 

to CFTC-16 and/or CFTC-17; and
4

(b) Investigatory records not disclosed in such proceedings are retained in exempt SORN 

CFTC-10, Investigatory Records, and disposed of on the same schedule as the related 

non-exempt records under CFTC-16 or CFTC-17. 

All Investigatory Records remain exempt from disclosure under the Privacy Act. 

4. Access to and Sharing of the Data

4.1. Who will have access to the information in the system (internal and external parties), 

and with whom will the data be shared? If contractors will have access to the information, 

are Federal Acquisition Regulations (FAR) clauses 24.104 (Contract clauses), 52.224-1

(Privacy Act Notification), and 52.224-2 (Privacy Act), included in the contract?

Individuals who seek information about how Twitter uses their PII should review Twitter's

Terms, http://twitter.com/tos, and Privacy Policy, http://twitter.com/privacy. 

For the narrow situations in which PII may be collected, all CFTC employees and many 

contractors have access to reporters names and organizations through the news clips posted on 

the intranet. Because the reporters’ names and organizations are publicly available information, no 

confidentiality restrictions apply. In the unusual situation of an investigation of a violation of law, 

information in the SORN CFTC-10 Investigatory Records (Exempted) system may be disclosed in 

accordance with the blanket routine uses that appear at the beginning of the Commission’s 

compilation of its systems of records notices, Federal Register notice 66 Fed. Reg. 41842 (2001), 

and any other specific routine uses identified for this SORN, as they may be amended.

4.2. If the data will be shared outside the Commission’s network, how will the data be 

transferred or shared?

Individuals who seek information about how Twitter uses their PII should review Twitter's

Terms, http://twitter.com/tos, and Privacy Policy, http://twitter.com/privacy. 

In the only situations in which PII may be collected, maintained or disseminated by the CFTC, the 

names and organizations of reporters are publicly available and not subject to confidentiality 

restrictions. It may be shared with others by paper or electronic means, as publicly available news 

stories and tweets are generally shared. Any records used for purposes of an investigation of a 

violation of law would be subject to SORN CFTC-10, Investigatory Records (Exempted), which is 

exempt from certain provisions of the Privacy Act, as noted above.

4.3. Do other systems share the information or have access to the information? If yes, 

explain who will be responsible for protecting the privacy rights of the individuals affected 

by the interface (e.g., System Administrators, System Developers, or System Managers)?

Individuals who seek information about how Twitter uses their PII should review Twitter's

Terms, http://twitter.com/tos, and Privacy Policy, http://twitter.com/privacy. 

In the only situations in which PII may be collected, maintained or disseminated by the CFTC, the 

names and organizations of reporters are publicly available and not subject to confidentiality 

restrictions. Other CFTC systems may access the news clips posted on the intranet. This 

information is available to CFTC employees and contractors on the CFTC intranet and through 

CFTC-wide email. Any records used for purposes of an investigation of a violation of law would be 

subject to SORN CFTC-10, Investigatory Records (Exempted), which is exempt from certain 

provisions of the Privacy Act, as noted above. 
5

5. Notice, Consent and Access for Individuals 

5.1. What notice will be provided to individuals about the collection, use, sharing and other 

processing of their personal data?

Individuals who seek information about how Twitter uses their PII should review Twitter's Terms, 

http://twitter.com/tos, and Privacy Policy, http://twitter.com/privacy. 

The CFTC’s profiles for its Twitter accounts will refer users to www.cftc.gov which posts a privacy 

policy that explains the Commission’s collection, use, sharing and other processing of personal 

data. 

5.2. What opportunities will exist for an individual to decline to provide information or to 

consent to particular uses of the information? If opportunities exist, how will this notice be 

given to the individual and how will an individual grant consent?

Twitter determines what information Twitter collects from an individual, and whether there is an 

opportunity or right not to provide that information, in order to obtain an account and become a 

registered user. By contrast, Twitter does not request or require any personal information from an 

individual who simply visits Twitter and views the CFTC's public Twitter profile or Tweets.

CFTC generally does not collect, use, disseminate or maintain PII on Twitter users, except the 

names and organizations of reporters, and as needed to investigate possible violations of law. In 

either case, individuals could not use Twitter or Twitter users could elect not to make available to 

the public or to the CFTC, by following the CFTC, any information that may relate to the CFTC or 

matters it regulates.

5.3. What procedures will exist to allow individuals to gain access to their information and 

request amendment/correction, and how will individuals be notified of these procedures? 

Twitter requires registered users to enter their login ID (i.e., Twitter handle or email address) and 

password at the Twitter home page to gain access to their Twitter account and change or update 

their account information. Twitter explains on www.twitter.com in its privacy policy and screen 

language how users may access and update their accounts. 

CFTC does not generally collect, use, disseminate or maintain PII on a follower of CFTC’s tweets, 

except as noted above. Reporters may contact the CFTC’s Chief Privacy Officer at 

privacy@cftc.gov to attempt to gain access and request amendment to news clips that are 

attributed to them; however, the news clips are not retrieved by an individual identifier, which 

would complicate access or amendment requests. For any investigation being conducted using 

information obtained on or through Twitter, the records in the CFTC Investigatory Record system 

have been exempted by the Commission from certain provisions of the Privacy Act of 1974 

pursuant to the terms of the Privacy Act, 5 U.S.C. 552a(k)(2), and the Commission’s rules 

promulgated thereunder, 17 CFR 146.12.

6. Maintenance of Controls

6.1. What controls will be in place to prevent the misuse of the information by those having 

authorized access and to prevent unauthorized access, use or disclosure of the 

information?

To ensure that only approved content is disseminated through the CFTC Twitter account, only a 

select group of OPA staff or other specifically designated staff will have login credentials 

(username and password) that allow them to access any CFTC account and make content edits.
6

In the unusual situation where PII is collected and maintained as stated herein, the records would 

be protected from unauthorized access and misuse through various administrative, technical and 

physical security measures. Technical security measures within CFTC include restrictions on 

computer access to authorized individuals, required use of strong passwords that are frequently 

changed, use of encryption for certain data types and transfers, and regular review of security 

procedures and best practices to enhance security. Physical measures include restrictions on 

building access to authorized individuals only and maintaining records in lockable offices and filing 

cabinets. Also, all employees are made aware of the sensitive nature of investigatory information.

6.2. While the information is retained, what will the requirements be for determining if the 

information is still sufficiently accurate, relevant, timely, and complete to ensure fairness in 

making determinations?

The news clips are not maintained in a Privacy Act “system of records” and are not retrieved by a 

reporter’s name, therefore, no requirements exist for determining continued accuracy of the 

information. No determinations affecting individuals are made by the CFTC based solely on news 

clips. 

In the unusual situation where CFTC conducts an investigation based on Twitter information, the 

records involved in such investigation would become part of the Investigatory Record system and 

therefore, have been exempted by the Commission from certain provisions of the Privacy Act of 

1974 pursuant to the terms of the Privacy Act, 5 U.S.C. 552a(k)(2), and the Commission’s rules 

promulgated thereunder, 17 CFR 146.12.

6.3. Will this system provide the capability to identify, locate, and monitor individuals? If 

yes, explain.

No.

6.4. Are all IT security requirements and procedures required by Federal law being followed 

to ensure that information is appropriately secured?

The CFTC follows all applicable Federal Information Security Management Act (FISMA) 

requirements to ensure that the information maintained is appropriately secured.

6.5. Describe the privacy training provided to users either generally or specifically relevant 

to the program or system.

All CFTC personnel are subject to CFTC agency-wide procedures for safeguarding PII. They

receive annual privacy and security training, in addition to periodic training specific to roles and 

responsibilities. 

7. Privacy Act

7.1. Will the data in the system be retrieved by a personal identifier in the normal course of 

business? If yes, explain. If not, can it be retrieved by a personal identifier?

No, news clips are not retrieved by a personal identifier in the normal course of business. In the 

unusual situation where CFTC conducts an investigation using Twitter, the investigation records 

may be retrieved by personal identifiers. See CFTC-10, Investigatory Records (Exempted). 

7.2 Is the system covered by an existing Privacy Act System of Records Notice (“SORN”)?

Provide the name of the system and its SORN number, if applicable.
7

The reporters names are not covered in a “system of records” as defined under the Privacy Act 

and therefore, no System of Records Notice applies. Investigation related records are covered 

under SORN CFTC-10, Investigatory Records (Exempted). 

8. Privacy Policy

8.1. Confirm that the collection, use and disclosure of the information in this system have 

been reviewed to ensure consistency with the CFTC’s Privacy Policy on CFTC.gov.

The www.cftc.gov privacy policy has been updated to reflect the CFTC’s use of Twitter.

9. Privacy Risks and Mitigation

9.1. What privacy risks are associated with the collection, use, dissemination and 

maintenance of the data? How have those risks been mitigated? 

By its nature, the information posted by Twitter users is generally available publicly on the Internet 

to not only Twitter subscribers, but to any non-subscriber visitors to the Twitter website. In an 

unusual situation where information is not available to the public but is available to the CFTC 

because a person is following the CFTC, the information accessible to the CFTC will be protected 

and used only as stated herein. To mitigate the risk of unauthorized access to the profiles of CFTC 

followers on Twitter, only a select number of staff in the Office of Public Affairs or others 

specifically designated by OPA, or by the Chief Privacy Officer and Chief Information Officer,

generally will have access to the CFTC Twitter accounts. If an investigation is needed, only a

select number of staff with a true “need to know” the information to perform their job duties would 

be allowed to access information. Such staff will have received training concerning the sensitive 

nature of investigatory information.

PIA Publication Date: January 19, 2011