1

Commodity Futures Trading Commission

Privacy Impact Assessment

System Name: Swaps and Derivatives Database (SDDB)

Office: Office of Data and Technology

Date: September 30, 2014

1. Overview

On July 22, 2011, the Commodity Futures Trading Commission (“Commission” or 

“CFTC”) published large trader reporting rules for physical commodity swaps and 

swaptions (76 FR 43851). The reporting rules became effective on September 20, 2011 

and are codified in Part 20 of the Commission’s regulations. The reporting rules provide 

the Commission with data regarding large positions in swaps and swaptions that are 

linked, directly or indirectly, to certain physical commodity futures contracts listed by 

Commission-registered exchanges.

The Swaps and Derivatives Database (SDDB) collects and maintains data and assists

CFTC staff as they monitor derivatives markets. SDDB is comprised of the Swaps 

Position Data Repository and data from the 102S filing (“102S form”) that is required 

under Section 20.5 of the CFTC’s Part 20 rules. SDDB houses daily swaps position data 

that, upon analysis, helps CFTC staff to assess a market participant’s exposure in the 

commodity swaps market. Data maintained in SDDB is often analyzed by CFTC staff in 

concert with data from other CFTC market oversight databases, including the large 

trader and trade capture report databases to match trading information for market 

surveillance purposes.

2. Data Collected and Stored Within the System

2.1. What information will be collected, used, disseminated or maintained in the 

system? 

The personally identifiable information (PII) stored in SDDB includes:

PII Categories

Collected, 

Generated 

or 

Maintained 

within the 

system

CFTC 

Employees

Members of 

the Public

Other

(e.g. 

Contractors, 

Other 

government 

employees)

Name (for purposes 

other than contacting 

federal employees)

X X

Date of Birth
2

Social Security Number 

(SSN)

Tax Identification 

Number (TIN)

Photographic 

Identifiers

Driver’s License

Mother’s Maiden Name

Vehicle Identifiers

Mailing Address X X

E-Mail Address X X

Phone Number X X

Medical Records 

Number

Medical Notes

Financial Account 

Information, specifically 

includes:

Trader Information X X

Options Account 

Number

Futures Account 

Number

Special Account 

Reporting Number

Certificates 

Legal Documents

Device Identifiers

Web Uniform Resource 

Locator(s)

Education Records

Military Status

Employment Status

Transactions with nonU.S. counterparties X X

102S Identifier X X

The SDDB handles positions data and 102S data. Positions data includes: 

(1) Long and short swap position information; 

(2) Swaption put/call, expiration date and strike price information; 

(3) Long and short non-delta adjusted swaption position information; 

(4) Long and short delta adjusted swaption position information; 

(5) Swap and swaption notional value information;

(6) The identity of the party reporting a position;

(7) If a counterparty position is being reported, the name of the counterparty and the 

102S identifier assigned to the counterparty by the reporting party; 

(8) The reporting day;

(9) An indicator of whether a reported position is cleared or uncleared, and, if 

cleared, the identifier for the cleared product assigned by the clearing organization;

(10) The commodity underlying a reportable position;
3

(11) The futures equivalent month; and

(12) The commodity reference price.

Pursuant to the CFTC’s Part 20 rules, swap dealers and clearing members (collectively, 

“reporting entities”) and clearing organizations are required to submit regular reports 

regarding positions in the physical commodity swaps and swaptions that are covered by 

Part 20. Clearing organizations must report certain positional information regarding their 

clearing members’ accounts. Reporting entities must report large principal positions, as 

well as large positions of their counterparties. Reporting entities submit the 102S form to 

identify counterparties in respect of which they are reporting positions. Data from the 

102S form includes the counterparty’s name, address and contact information, and the

102S identifier that the reporting entity has assigned to the counterparty. The 102S form 

contains free text fields, within which reporting entities can include information that could 

possibly include other forms of PII. However, any additional information provided 

outside of the 102S form fields is not uploaded to the SDDB. 

2.2. What will be the sources of the information in the system?

The sources of information in the system are clearing organizations, which send the 

CFTC data pursuant to Section 20.3 of the Part 20 rules, and swap dealers and clearing 

members, which send the CFTC data and 102S forms pursuant to Sections 20.4 and 

20.5 of the Part 20 rules.

2.3. Why will the information be collected, used, disseminated or maintained? 

Information is collected, used, disseminated or maintained to enable CFTC staff to 

monitor the derivatives markets so that the CFTC can protect market participants and 

the public from fraud, manipulation, abusive practices and systemic risk and foster 

transparent, open, competitive and financially sound markets. In addition, the data 

collected under Part 20 data will be used to support the CFTC’s position limits 

rulemaking.

2.4. How will the information be collected by the Commission?

Reporting parties send the data to the Commission using Secure File Transfer Protocol 

(SFTP). Once the CFTC receives the data, CFTC staff load the data into SDDB.

2.5. Is the system using technologies in ways that the CFTC has not previously 

employed (e.g., monitoring software)? 

No. All software and technologies used are common to the Commission’s current 

infrastructure.

2.6. What specific legal authorities authorize the collection of the information? 

The Commodity Exchange Act, 7 U.S.C. 1a, 2, 5, 6, 6a, 6c, 6f, 6g, 6t, 12a, 19 and 

related rules, including large trader reporting rules for physical commodity swaps and 

swaptions authorize the collection of this information.
4

3. Data and Records Retention

3.1. For what period of time will data collected by this system be maintained and in 

what form will the data be retained?

CFTC is revising the records disposition schedules that apply to records covered 

by this PIA.

3.2. What are the plans for destruction and/or disposition of the information? 

CFTC is revising the records disposition schedules that apply to records covered by this 

PIA. When it is determined that records are to be destroyed, paper records will be 

shredded and electronic records will be purged from systems.

4. Access to and Sharing of the Data

4.1. Who will have access to the information in the system (internal and external 

parties), and with whom will the data be shared? If contractors, are the Federal 

Acquisition Regulations (FAR) clauses included in the contract (24.104 Contract clauses; 

52.224-1 Privacy Act Notification; and 52.224-2 Privacy Act)?

Access to SDDB is granted to the Division of Market Oversight (DMO), Office of the 

Chief Economist (OCE), Division of Enforcement (ENF), and Office of Data and 

Technology (ODT) within CFTC. The system is not accessible outside of the CFTC 

network. Contractors and consultants may be granted access to SDDB to meet 

contractual obligations (e.g., managing the database or providing requested data 

analyses). CFTC’s Office of Financial Management (OFM) ensures that the contract 

between the CFTC and contractors contains the provisions necessary to protect and 

secure information to which they have access.

The information also may be shared in accordance with the applicable Privacy Act 

System of Records Notice, CFTC-15, Enterprise Surveillance, Oversight & Risk 

Monitoring System, 77 Fed. Reg. 58814 (September 24, 2012). 

4.2. If the data will be shared outside the Commission’s network, how will the data be 

transferred or shared?

Data from SDDB is not shared outside of the CFTC’s network, except in accordance with 

the CFTC-15 System of Records Notice, as described above. Such sharing may include, 

but is not limited to, other Federal or state law enforcement or regulatory agencies for 

use in meeting their statutory and regulatory requirements or with foreign law 

enforcement, investigatory, or administrative authorities in order to comply with 

requirements set forth in international arrangements, such as memoranda of 

understanding. If transferred or shared outside the CFTC’s network, the data will be 

transferred in a manner designed to prevent the unnecessary and/or unauthorized 

disclosure of sensitive information. Such methods may include encryption of electronic 

information or hand delivery of documentation.

The CFTC has assigned confidential reporting numbers to reporting firms and traders to 

help ensure privacy of the information they provide. The Commission is prohibited under 
5

Section 8 of the CEA, 7 USC 12, from publicly disclosing any person’s positions, 

transactions, or trade secrets, except under limited circumstances.

4.3. If the data will be released to the public, consultants, researchers or other third 

parties, will it be aggregated or otherwise de-identified (i.e. anonymized)? If yes, please 

also explain the steps that the Commission will take to aggregate or de-identify the data.

Other than contractors or consultants working within SDDB to fulfill their responsibilities, 

e.g., contactors responsible for managing the database or consultants providing 

requested data analyses, SDDB system data generally will not be released to the public 

or other third parties. Consultants are granted access to SDDB data only after signing 

an appropriate non-disclosure agreement (NDA) and undergoing other appropriate 

screening as determined by the OCE and the Office of General Counsel (OGC).

However, as described in Section 4.2, in the event that the CFTC receives lawful 

requests for the data from Congress or others, CFTC staff receiving the request will 

consult the OGC and/or the Privacy Office, as appropriate, with the goal of minimizing 

any release of identifiable information, and whenever possible, providing aggregated, 

anonymous data using strategies designed to prevent re-identification through other 

available information.

4.4 Do the third-party recipients of the aggregated or de-identified information have 

another dataset, or is there a publicly available dataset that could be used to re-identify 

Commission information? 

As explained above, the CFTC does not expect to release SDDB system data to the 

public or third parties. In the event such data needs to be released through a lawful 

request and may be released in aggregated form, the CFTC to the greatest extent 

possible will use aggregation or de-identification strategies designed to prevent reidentification of such information through other available information.

4.5. Describe how the CFTC will track disclosures of information that will be shared with 

outside entities. The Privacy Act requires that the CFTC record the date, nature, and 

purpose of each disclosure of a record to any person or to another agency.

Any disclosure in PII-form outside the CFTC is unlikely. In such case, CFTC staff would 

confirm the legal authority to release such information, track such disclosures to outside 

entities by documenting, among other things, which person or party/organization made 

the request, the date and nature of the request, the decision made to disclose or not 

disclose the data and by whom, and any restrictions on further dissemination of the 

requested information.

4.6. Do other systems share the information or have access to the information in this 

system? If yes, explain who will be responsible for protecting the privacy rights of the 

individuals affected by the interface (e.g., System Administrators, System Developers, 

System Managers)?

Yes, CFTC staff using SDDB can analyze SDDB data with large trader data stored in 

ISS under CFTC rules in Part 17 and with transactional data stored in TSS under CFTC 

rules in Part 16. Analysts look at the sets of data together to monitor and enforce any 
6

speculative position limits that have been established, and to conduct surveillance of 

physical commodity futures and swaps markets. 

The CFTC SDDB,ISS and TSS System Managers – specifically assigned staff in ODT –

are responsible for protecting the privacy rights of the individuals affected by the 

interface between SDDB,ISS and TSS, and do so by limiting access to the interface to 

those CFTC staff with a business need-to-know the information they are seeking. 

5. Notice, Consent and Access for Individuals 

5.1. What notice will be provided to individuals about the collection, use, sharing and 

other processing of their personal data?

The Commission’s rulemaking process and the rules themselves provide notice to 

individuals about the collection, and processing of personal data. To participate in the 

swaps market, entities are required by law to provide this type of information to the 

CFTC. For example, Section 20.3 of the Commission’s Part 20 rules directs clearing 

organizations to report clearing member positions. Section 20.4 directs swap dealers 

and clearing members to report both their principal positions, and the positions of their 

counterparties. Reporting entities are required to report large principal and counterparty 

positions, and to submit the 102S form to identify counterparties in respect of which they 

are submitting position data.

In addition, this PIA and SORN CFTC-15, Enterprise Surveillance, Oversight & Risk 

Monitoring System shall appear on the Privacy Office’s CFTC website.

5.2. What opportunities will exist for an individual to decline to provide information or to 

consent to particular uses of the information? If opportunities exist, how will this notice 

be given to the individual and how will an individual grant consent?

As noted in 5.1, entities that participate in the swaps market are required by law to 

provide this type of information to the CFTC. Clearing organizations and reporting 

entities are required to submit regular reports regarding positions in the physical 

commodity swaps and swaptions covered by Part 20 by Section 20.3 and 20.4, 

respectively. Clearing organizations are required to report certain positional information 

regarding their clearing members’ accounts. Reporting entities are required to report 

large principal and counterparty positions, and to submit the 102S form to identify 

counterparties in respect of which they are submitting position data. 

5.3. What procedures will exist to allow individuals to gain access to their information 

and request amendment/correction, and how will individuals be notified of these 

procedures? 

A reporting entity that has submitted a 102S form for a counterparty is required to update 

the 102S form if the information the form contains is no longer accurate. Individuals 

seeking access to records about themselves, or seeking amendment of records about 

themselves should address a written inquiry to the Office of General Counsel, Paralegal 

Specialist, Commodity Futures Trading Commission, Three Lafayette Centre, 1155 21st 

Street, NW, Washington, DC 20581.
7

6. Maintenance of Controls

6.1. What controls will be in place to prevent the misuse of the information by those 

having authorized access and to prevent unauthorized access, use or disclosure of the 

information?

Commission staff are trained to recognize the sensitive nature of SDDB information. 

Access to SDDB is protected through administrative, technical, and physical controls. 

Administrative controls, such as least privilege, are in place to only allow individuals with 

a direct business need to access the system. Access is controlled by the individual’s 

unique username and password which are monitored using audit logs that track access 

and record changes (e.g., print, edit, extract). Read-only access is the most commonly 

granted permission. Physical controls permit only specifically designated employees or 

contractors to be granted access to server rooms. 

6.2. While the information is retained in the system, what will the requirements be for 

determining if the information is still sufficiently accurate, relevant, timely, and complete 

to ensure fairness in making determinations?

The information comes in to the CFTC on a constant basis and is automatically historical 

once it enters SDDB. The information is time stamped. Parties with reporting obligations

under CFTC rules are responsible for ensuring that information provided to the CFTC is 

accurate and, therefore, for updating information as needed. If CFTC staff determine 

that data submitted by a reporting party is missing or incorrect, they contact the source 

to have the data re-submitted. Appropriate Commission personnel will routinely maintain 

and update the information in the system with any new information provided by a 102S

filing, or a 20.3 or 20.4 filing.

6.3. Will this system provide the capability to identify, locate, and monitor individuals? If 

yes, explain.

The information provided does not allow the CFTC to monitor an individual’s movement 

or actions. 

6.4 Does this system comply with FISMA requirements to help ensure that information 

is appropriately secured?

The Commission follows all applicable Federal Information Security Management Act 

(FISMA) requirements to ensure that information is appropriately secured. The system 

resides within the CFTC private infrastructure under the General Support System which 

is categorized as moderate using Federal Information Processing Standard 199.

6.5. Describe the privacy training provided to users either generally or specifically 

relevant to the program or system.

All CFTC staff receive detailed privacy training on an annual basis and are subject to 

agency-wide procedures for safeguarding PII. In addition, many staff receive additional 

training focused on their specific job duties, for example, Division of Enforcement staff 

regularly receive training concerning privacy rights of individuals and the importance of 

safeguarding information, and system administrators receive role-based training.
8

7. Privacy Act

7.1. Will the data in the system be retrieved by a personal identifier in the normal course 

of business? If yes, explain. If not, can it be retrieved by a personal identifier?

Yes, records can be retrieved by name and unique 102S Identifier. 

7.2 Is the system covered by an existing Privacy Act System of Records Notice 

(“SORN”)? Provide the name of the system and its SORN number, if applicable.

Yes, CFTC – 15 Enterprise Surveillance, Oversight & Risk Monitoring System.

8. Privacy Policy

8.1. Confirm that the collection, use and disclosure of the information in this system

have been reviewed to ensure consistency with the CFTC’s Privacy Policy 

on www.cftc.gov.

Yes, the following sub-header of the CFTC privacy policy includes language that is 

relevant to the SDDB:

• Sharing of Your Information

9. Privacy Risks and Mitigation

9.1. What privacy risks are associated with the collection, use, dissemination and 

maintenance of the data? How have those risks been mitigated? 

The CFTC has adopted the following protections, in addition to those stated in Section 6 

above and others, to appropriately safeguard SDDB information: 

• SDDB data is confidential; therefore, SDDB allows access to authorized users 

only. 

• The SDDB System Manager grants users access on a need-to-know basis using 

controls in the CFTC’s Microsoft Active Directory. 

• The electronic formatted records are transmitted to the Commission using 

Secure FTP (SFTP). 

• Access to any SDDB data provided to other systems (e.g., ISS) is role-based and 

the administrators of the connected systems have been vetted by ODT.