Privacy Impact Assessment

for

iComplaints

April 23, 2020

System/Business Owner

Sarah Summerville

Reviewing Official

Charles Cutshall

Chief Privacy Officer

Commodity Futures Trading Commission
     

										

            

                           

                       

                         

                               

                 

           

                              

                             

                             

        

                           

   

                             

                           

                     

                         

                           

                         

       

                       

complainants 

and related 

parties 

(counselors, 

mediators, etc.) 

1. 

OMWIStaff 

2. 

iComplaints 

Application 

I. SYSTEM OVERVIEW

1) Describe the purpose of the system/collection:

The Office of Minority and Women Inclusion (OMWI) provides a neutral and impartial forum

for employees, former employees, and applicants for employment to file complaints of

discrimination based on one or more of the protected equal employment opportunity (EEO)

bases. To carry out its functions, OMWI uses the ETK EEO system (iComplaints) to track

deadlines and store information relating to cases of alleged employment discrimination,

retaliation, and alternative dispute resolution matters.

Only OMWI staff is permitted to access and use iComplaints. When an individual wishes to

make an EEO complaint, OMWI staff enters or uploads information into the system as part

of the dispute resolution process. The information collected varies based on the type of

complaint or process undertaken.

iComplaints is hosted by an off‐site vendor, MicroPact Global, Inc., now part of Tyler

Technologies, Inc.

2) Provide a data map or model illustrating how information is structured or is processed by

the system throughout its life cycle. Include a brief description of the data flows.

1. EEO complainants provide information relating to EEO matters to OMWI staff orally

or in written form, including via EEO forms. Information and documents relating to

the EEO matter may also be prepared by third party participants in the dispute

resolution process such as mediators and counselors and submitted in part via the

EEO Counselor’s Report form.

2. OMWI staff enters information and uploads case documents relating to the dispute

to iComplaints.

Page 1 of 9
     

										 	 	 	

                             

                           

                             

                 

	 	

                       

  

                           

                   

             

   

                     

               

               

                 

     

               

               

             

                                 

           

           

                   

               

   

           

                 

             

           

       

II. AUTHORITY AND PURPOSE

1) What is the legal authority to collect, use, maintain, and share information in the system?

Pursuant to 42 U.S.C. §§ 2000e‐5(b), 16(a)‐(c) and 29 CFR 1614.102, this information is

collected to create a factual record to adjudicate EEO complaints in a timely manner, order

relief if appropriate, and prepare reports mandated by the EEOC.

III. INFORMATION TYPES

1) What information relating to EEO complainants will be collected, maintained, used, and/or

disseminated?

Note: Information in iComplaints is necessarily contextual and will depend on the nature of

each EEO complaint. iComplaints may therefore contain data elements and information

types that are not specifically identified below.

Identifying Numbers

☐ Social Security Number ☐ Truncated or Partial Social Security Number

☐ Driver’s License Number ☐ License Plate Number

☐ Patient ID Number ☒ File/Case ID Number

☐ Student ID Number ☐ Health Plan Beneficiary Number

☐ Passport Number ☐ Federal Student Aid Number

☒ Employee Identification Number ☐ Taxpayer Identification Number

☐ Professional License Number ☐ Legal Entity Identifier

☐ Credit/Debit Card Number ☐ National Futures Association ID

☐ Personal Bank Account Number ☐ Other ID if it can be traced back to an individual

☐ Personal Device Identifiers or Serial

Numbers

Contact Information

☒ Personal Mobile Number ☒ Business Phone Number

☒ Personal E‐mail Address ☐ Business E‐mail Address

☒ Home Phone Number ☐ Personal or Business Fax Number

☒ Home Mailing Address ☐ Business Mailing Address

Sole Proprietors

☐ Business Taxpayer Identification

Number

☐ Business Mailing Address

☐ Business Credit Card Number ☐ Business Phone or Fax Number

☐ Business Bank Account Number ☐ Business Mobile Numbers

☐ Business Device identifiers or Serial

Numbers

Biographical Information

☒ Name ☒ Gender

Page 2 of 9
     

                   

             

           

           

             

             

         

             

   

         

           

         

       

     

                       

  

         

               

           

										

               

                       

                     

                   

                          

                       

                           

                               

                           

      

       

☒ Date of Birth ☐ City or County of Birth

☒ Country of Birth ☒ Zip Code

☐ Citizenship ☐ Military Service Information

☐ Spouse Information ☐ Academic Transcript

☒ Group/Org. Membership ☐ Resume or Curriculum Vitae

☐ Location Data (e.g., GPS) ☒ Nationality

☒ Employment Information ☐ Marital Status

☐ Mother’s Maiden Name ☐ Children Information

☒ Religion

Biometrics/Distinguishing Features/Characteristics

☐ Fingerprints ☐ Height

☐ Retina/Iris Scans ☐ Voice/Audio Recording

☐ Hair Color ☐ Eye Color

☐ Video Recording ☐ Photos

☐ Weight ☒ Signatures

☒ Race/Ethnicity ☒ Genetic information

2) What information relating to iComplaints users will be collected, maintained, used, and/or

disseminated?

Active Directory/Device Information

☒ IP Address ☐ MAC Address

☐ CFTC Asset Number ☐ Device Identifiers or Serial Numbers

☒ User Name ☒ Log data

IV. COLLECTING INFORMATION

1) How is the information in this system collected?

Information relating to EEO complainants is collected by a combination of Equal

Employment Opportunity Commission (EEOC) forms, notes taken by OMWI staff during oral

conversations, statements drafted by complainants, and documentation produced by EEO

counselors and mediators. This information is either manually entered by OMWI staff into

iComplaints or uploaded into the system and associated with a particular case.

Information relating to OMWI staff is generated by the system’s logging function as they

use iComplaints.

2) If any forms are used to collect information that resides in the system, please include the

name of such form(s) and any applicable control number (i.e. issued by CFTC, OMB, etc.).

Form Control No. (If applicable)

Notice of Rights and Responsibilities

Page 3 of 9
     

           

         

     

                   

   

             

               

																																																																																																																																													

                                 

   

                         

             

                         

         

                                 

             

                   

                 

                         

  

	 	 	

                              

                 

                         

                         

                           

                         

                         

              

Certification of Receipt of Rights and Responsibilities

Agreement to Mediate EEO Matter

Formal Complaint of Discrimination

Counselor’s Request for an Extension of the Complaint Process

Counselor’s Report

Notice of Final Interview with EEO Counselor

Notice of Right to File a Discrimination Complaint

V. INFORMATION USE

1) Will information in the system be retrieved using one or more of the data elements listed in

Section III?

Information relating to EEO cases can be retrieved and filtered by various elements

including name, gender, date, and case status.

Log information relating to OMWI users of iComplaints can be retrieved and filtered by

various elements including username and date.

2) If the information in the system is retrieved using one or more of the identifiers, what CFTC

System of Records Notice (SORN) covers the information?

Retrieval of information relating to EEO complainants is covered by EEOC/GOVT‐1, Equal

Employment Opportunity in the Federal Government Complaint and Appeals Records.

Retrieval of information relating to OMWI staff is covered by CFTC‐35, General Information

Technology Records.

VI. ACCESS AND SHARING

1) With which internal CFTC Offices or Divisions is the information shared? For each Office or

Division, what information is shared and for what purpose?

Information relating to individual matters may be shared with internal stakeholders such as

the Chairman, designated agency Resolving Official, and the Office of the General Counsel

(“OGC”). No other CFTC offices have access to iComplaints besides OMWI. Any information

provided to these internal organizations is approved for release by the OMWI Director.

All OMWI staff have full administrator permissions in iComplaints and therefore have access

to all information residing in the system.

Page 4 of 9
     

           

                     

                       

             

               

                         

                           

                            

                       

              

   

   

   

         

                     

           

                      

                            

                       

                       

                           

                       

             

                           

        

                       

                           

2) How is the information shared internally?

Information cannot be directly shared with internal stakeholders using iComplaints. If

approved for release by the OMWI Director, information must be downloaded and

transmitted by email or in hard copy.

3) With which external organization(s) is the information shared?

Information relating to EEO complaints may be shared with (i) mediators if the complainant

requests to use alternative dispute resolution (ADR), (ii) EEO counselors if ADR is not

requested, and (iii) the EEOC when a complainant requests a hearing with the EEOC.

Mediation and counseling services may be provided by contractors subject to required

confidentiality obligations. Information shared with these parties includes:

• Complainant’s allegations

• Counselor’s report

• Report of Investigation

• Address

• Name

• Date of birth (if applicable)

• Signature

OMWI also uses information maintained in iComplaints to prepare reports containing

aggregated, non‐identifiable information.

4) How is the information shared externally?

Information cannot be directly shared with an external organization using iComplaints. It

must be downloaded and transmitted by email or in hard copy. Any information provided

to these external organizations is approved for release by the OMWI Director.

A team from MicroPact Global, Inc. will provide routine server‐level support and

maintenance functions but will not have access to data residing within OMWI’s instance of

iComplaints unless approved by OMWI and only in exceptional cases where MicroPact

Global’s assistance is needed to remediate system vulnerabilities.

VII. TRANSPARENCY

1) How are individuals notified as to how their information will be collected, used, and/or

shared within this system?

EEO complainants are provided with Privacy Act statements on EEO forms notifying them

that personal information will be collected during the course of their EEO complaints and

Page 5 of 9
     

                           

                      

                                     

             

           

                       

                      

                   

               

                       

                     

                       

  

                         

           

                         

                               

      

                                

               

                           

                             

                             

                               

           

										 		

                       

their information will be included in an agency system of records. OMWI users of

iComplaints are notified that their activity in the system is monitored.

2) Is a SORN is required? If so, explain how the use of the information in this system is limited

to the use specified in the SORN?

Yes. EEOC/GOVT‐1, Equal Employment Opportunity in the Federal Government Complaint

and Appeals Records covers collection and processing of personal information for resolution

of EEO disputes. CFTC‐35, General Information Technology Records covers creation of logs

relating to activity by CFTC staff on CFTC IT systems.

VIII. INDIVIDUAL PARTICIPATION

1) Is the information collected directly from the individual?

Information is collected directly from complainants and other individuals participating in the

EEO process such as counselors but entered into iComplaints by OMWI staff. Information

about other types of individuals, such as the complainant’s representative, may be collected

indirectly.

2) Is the collection mandatory or voluntary? If voluntary, what opportunities do the

individuals have to decline to provide information?

Individuals who contact OMWI may decline to provide requested information, but doing so

may result in the dismissal of their allegation(s) because of failure to respond or proceed in

a timely fashion.

3) Do individuals have an opportunity to consent to a particular use of the information? If so,

how do they provide consent for a particular use?

Complainants are presented with Privacy Act statements on EEOC forms at various points of

the dispute resolution process, and consent to the use of the personal information for the

purposes set out therein by exercising the choices available to them at each step. Other

individuals such as the subject of EEO complaints do not have an opportunity to consent to

use of their personal information.

IX. DATA MINIMIZATION

1) What steps were taken to minimize the collection of PII in the system?

Page 6 of 9
     

                             

                       

	 	 	

                       

           

               

         

           

             

                             

                           

                       

                         

                       

                

OMWI staff do not collect personal information unrelated to the EEO complaint (e.g., if the

complaint relates to reasonable accommodation, there is no need for information relating

to race).

X. DATA QUALITY AND INTEGRITY

1) How is data quality ensured throughout the information lifecycle and business processes

associated with the use of the information?

☐ Cross referencing data entries with other systems

☐ Third party data verification

☐ Data taken directly from individuals

☐ Character limits on text submissions

☐ Numerical restrictions in text boxes

☒ Other: Restriction on creating duplicate cases.

XI. RETENTION

1) What are the retention periods for the information?

Information related to formal complaint case tracking will be retained for 7 years after the

resolution of the case in accordance with General Records Schedule 2.3, Item 111, EEO

Discrimination Complaint Case Files – Formal Process. Information related to compliance

reporting to external oversight entities will be maintained for 6 years after report

submission or oversight, in accordance with General Records Schedule 5.7, Item 050,

Mandatory Reports to External Federal Entities Regarding Administrative Matters.

Page 7 of 9
     

             

   

           

       

         

   

             

   

  

   

   

                 

  

             

      

   

   

  

                         

             

                        

                    

                        

                   

                   

XII. SECURITY

1) What types of administrative safeguards protect the information?

☐ Contingency Plan

☒ User manuals for the system

☐ Rules of Behavior

☐ Non‐Disclosure or other contractual agreement

☐ Other:

2) What types of physical safeguards protect the information?

☐ Guards

☐ Identification Badges

☐ Biometric

☐ Cameras

☐ Physically secured space with need to know access

☐ Other:

3) What types of technical safeguards protect the information?

☒ User Identification

☒ Firewall  

☒ Virtual Private Network (VPN)

☐ Multi‐factor Authentication (MFA)

☐ Passwords

☐ Encryption

☐ De‐Identification

☐ Anonymization

☐ Other:

4) What monitoring, recording, and auditing safeguards are in place to prevent or detect

unauthorized access or inappropriate use of the information?

All events and actions in iComplaints are logged. Logs are viewable by administrators.

5) Is this system hosted by a Cloud Service Provider (CSP)? Yes

a. If yes, which one? MicroPact Global, Inc., now part of Tyler Technologies, Inc.

b. If yes, has the system obtained a FedRAMP Authorization? Yes

XIII. TRAINING

1) What privacy training is provided to users of the system?

Page 8 of 9
     

                             

              

OMWI staff receive training on use of iComplaints from MicroPact Global, Inc. or the OMWI

Director. All EEO materials are kept strictly confidential.

Page 9 of 9