Privacy Impact Assessment 

for 

Commission and Staff Letters (CSL) 

2/28/2020

System/Business Owner

Howard Rosen

Associate Director

Market and Financial System

Reviewing Official 

Charles Cutshall

Chief Privacy Officer

Commodity Futures Trading Commission 
Page 2 of 9 

I. SYSTEM OVERVIEW 

1) Describe the purpose of the system/collection: 

Commission and Staff Letters (“CSL”) has been developed to receive, manage, report, and 

publish requests for No-Action, Exemption, Interpretation, Advisory, and other written 

communications (“Request Letters”) and responses by the CFTC (“Response Letters”). 

CSL is used by multiple divisions across the Commission. While the Division of Swap Dealer 

and Intermediary Oversight (“DSIO”), Division of Clearing and Risk (DCR), and Division of 

Market Oversight (“DMO”) receive the majority of Request Letters and develop the majority 

of Response Letters, the Office of General Counsel (“OGC”), Office of Executive Director 

(“OED”), Chairman and Commissioners (“COM”), Office of Data and Technology (“ODT”) and 

other divisions use information contained in CSL for purposes of research and metrics 

creation. 

CSL is comprised of software, a database, and a SharePoint site that CFTC staff use jointly to 

manage Request Letters and Response Letters. The CSL software is used to enter and track 

information relating to Request Letters and Response Letters. The SharePoint site is used to 

store the original Request Letters and completed Response Letters. All information entered 

into or generated by usage of the CSL software (except the original Request Letters and 

Response Letters) is stored in the database. 

CSL stores limited amounts and types of personal information. Personal information 

collected includes the name, employment information, and contact details of individuals 

submitting Request Letters, and the name of CFTC staff handling individual Request Letters.
Page 3 of 9 

2) Provide a data map or model illustrating how information is structured or is processed by 

the system throughout its life cycle.

1. Request author sends a Request Letter to one of the CFTC email addresses specified in 

17 CFR § 140.99. 

2. CFTC Staff enters relevant data using the CSL software; original Request Letters are 

uploaded via the CSL software and stored in the CSL SharePoint site. 

3. Assigned CFTC staff track request progress and develop Response Letters, which are also 

stored in the CSL SharePoint site. 

4. Upon completion, CFTC staff use CSL to transmit Request Letters, Response Letters and 

additional regulatory data to the Office of Public Affairs (“OPA”) for publication to the 

CFTC Staff Letters page on CFTC.gov. CFTC staff may also decide of their own initiative 

to publish interpretive guidance on CFTC.gov. Request Letters and Response Letters 

made public may be redacted for a maximum of 120 days, after which complete 

versions (except for any material which remains redacted in accordance with 7 USC § 

12) will be published on CFTC.gov. 

5. CFTC Staff send the Response Letter to the Request Letter author directly via the email 

address provided. 
Page 4 of 9 

II. AUTHORITY AND PURPOSE 

1) What is the legal authority to collect, use, maintain, and share information in the system? 

17 CFR § 140.98-99 permits the submission of Requests and publication of Letters. 

III. INFORMATION TYPES

1) What information will be collected, maintained, used, and/or disseminated? 

Identifying Numbers

☐ Social Security Number ☐ Truncated or Partial Social Security Number

☐ Driver’s License Number ☐ License Plate Number

☐ Patient ID Number ☐ File/Case ID Number

☐ Student ID Number ☐ Health Plan Beneficiary Number

☐ Passport Number ☐ Federal Student Aid Number

☐ Employee Identification Number ☐ Taxpayer Identification Number

☐ Professional License Number ☐ Legal Entity Identifier

☐ Credit/Debit Card Number ☐ National Futures Association ID

☐ Personal Bank Account Number ☐ Other ID if it can be traced back to an individual

☐ Personal Device Identifiers or Serial Numbers

Contact Information

☐ Personal Mobile Number ☒ Business Phone Number

☐ Personal E-mail Address ☒ Business E-mail Address

☐ Home Phone Number ☒ Personal or Business Fax Number

☐ Home Mailing Address ☒ Business Mailing Address

Sole Proprietors

☐ Business Taxpayer Identification Number ☒ Business Mailing Address

☐ Business Credit Card Number ☒ Business Phone or Fax Number

☐ Business Bank Account Number ☒ Business Mobile Numbers

☐ Business Device identifiers or Serial Numbers ☒ Business E-mail Address

Biographical Information

☒ Name ☐ Gender

☐ Date of Birth ☐ City or County of Birth

☐ Country of Birth ☐ Zip Code

☐ Citizenship ☐ Military Service Information

☐ Spouse Information ☐ Academic Transcript

☐ Group/Org. Membership ☐ Resume or Curriculum Vitae

☐ Location Data (e.g., GPS) ☐ Nationality

☒ Employment Information ☐ Marital Status

☐ Mother’s Maiden Name ☐ Children Information

Biometrics/Distinguishing Features/Characteristics

☐ Fingerprints ☐ Height
Page 5 of 9 

☐ Retina/Iris Scans ☐ Voice/Audio Recording

☐ Hair Color ☐ Eye Color

☐ Video Recording ☐ Photos

☐ Weight ☐ Signatures

Active Directory/Device Information

☐ IP Address ☐ MAC Address

☐ CFTC Asset Number ☐ Device Identifiers or Serial Numbers

☐ User Name

IV. COLLECTING INFORMATION 

1) How is the information in this system collected? 

Per 17 CFR § 140.99, Requests must be in writing, signed, and sent to one of three CFTC 

business email addresses (dmoletters@cftc.gov, dcrletters@cftc.gov, and 

dsioletters@cftc.gov). Access to these inboxes is determined by the respective director or 

deputy director(s) of DMO, DCR, and DISO. On occasion CFTC staff will receive Requests 

directly to their work email, and forward such Requests to the appropriate account. CFTC 

staff upload the Request document and enter pertinent information, such as Request 

author, date, status, subject, and relevant CFTC rule, into the CSL software. Accompanying 

emails from entities submitting Requests are not entered into CSL. 

Each Request and Response in CSL is associated with one or more CFTC staff responsible for 

the case file, meaning that information about staff is generated as they use CSL. 

V. INFORMATION USE 

1) Will information in the system be retrieved using one or more of the data elements listed in 

Section III? 

Information in CSL is retrieved by multiple elements, such as date, completion status, 

Request type, Letter type, responsible CFTC division, and Request author. The Request 

author is usually a legal entity; however if an individual submits a Request in his or her own 

name it is possible that the Request could be retrieved using that element of personal 

information. Requests can also be filtered by associated staff. 

2) If the information in the system is retrieved using one or more of the identifiers, what CFTC 

System of Records Notice (SORN) covers the information? 

Retrieval of information relating to Request authors is covered by CFTC-15, Enterprise 

Surveillance, Oversight & Risk Monitoring System. Retrieval of information relating to CFTC 

staff is covered by CFTC-35, General Information Technology Records. 
Page 6 of 9 

VI. ACCESS AND SHARING 

1) With which internal CFTC Offices or Divisions is the information shared? For each Office or 

Division, what information is shared and for what purpose? 

Users across 9 divisions (DCR, DMO, DSIO, ODT, OED, OGC, COM, ENF, and Office of 

International Affairs (“OIA”)) have some form of access to the CSL software. Increasing 

levels of access (read, contribute, manage) are granted to staff with a business need to 

review Requests, prepare Letters, and maintain CSL records, depending on their particular 

role. Access to the CSL software and SharePoint site is granted simultaneously to new users 

and managed by ODT. Ownership access to the CSL database is restricted to a small 

number of staff within ODT. 

2) How is the information shared internally? 

Documents uploaded to CSL and case status information are viewable by CFTC staff with 

access to the CSL software. Request Letters and draft Response Letters may also be shared 

internally via email in the context of obtaining final review and approval. When the Request 

Letter and Response Letter are ready for publication, CSL has a built-in feature that sends 

them and additional metadata to OPA for publication on CFTC.gov. 

3) With which external organization(s) is the information shared? 

Information is not shared directly with other federal, state, or local government agencies, 

law enforcement, international regulator or agency, self-regulatory organizations, or private 

entities. Request Letters and Response Letters are published by OPA on CFTC.gov and 

available to the public. The primary staff person responsible for drafting the Response 

Letter also generally sends it directly via email to the Request Letter author, but this task 

may on occasion also be delegated to administrative staff. 

4) How is the information shared externally? 

Unless otherwise requested, unredacted Request Letters and Response Letters are 

published on CFTC.gov. 

VII. TRANSPARENCY

1) How are individuals notified as to how their information will be collected, used, and/or 

shared within this system? 

Individuals understand that they are providing personal information to the CFTC when they 

submit a Request Letter to CFTC. In addition, to ensure Request Letter authors understand 

how the CFTC uses and protects their information, CFTC has conducted and published this 
Page 7 of 9 

PIA on the CFTC.gov privacy program page and included a link to the PIA on the Staff Letters 

page. 

2) Is a SORN required? If so, explain how the use of the information in this system is limited to 

the use specified in the SORN? 

Yes. CFTC-15, Enterprise Surveillance, Oversight & Risk Monitoring System covers exchanges 

of correspondence between individuals and the CFTC relating to official business concerning 

the covered individual. CFTC-35, General Information Technology Records covers creation 

of logs relating to activity by CFTC staff on CFTC IT systems. 

VIII. INDIVIDUAL PARTICIPATION

1) Is the information collected directly from the individual? 

Yes, information is collected directly from the individual submitting the Request Letter, 

unless the person who signs the Request Letter is not the same person who submits it to 

the CFTC. This might be the case, for example, where an attorney files the Request Letter 

on behalf of his or her client. 

2) Is the collection mandatory or voluntary? If voluntary, what opportunities do the 

individuals have to decline to provide information? 

The collection is voluntary. There is no obligation to seek any type of regulatory relief 

through submission of a Request Letter. 

3) Do individuals have an opportunity to consent to a particular use of the information? If so, 

how do they provide consent for a particular use?

Publication of Response Letters on the CFTC website is mandatory; however, individuals 

may request that their Request Letter and Response Letter be given confidential treatment 

for a maximum of 120 days in accordance with 17 CFR § 140.98 , after which complete 

versions (except for any material which remains redacted in accordance with 7 USC § 12) 

will be published. 

IX. DATA MINIMIZATION 

1) What steps were taken to minimize the collection of PII in the system?

CFTC requires individuals to provide the minimum amount of contact information necessary 

when submitting a Request Letter. In addition, CFTC staff only enter personal information 

that is directly relevant to a request into CSL. 
Page 8 of 9 

X. DATA QUALITY AND INTEGRITY 

1) How is data quality ensured throughout the information lifecycle and business processes 

associated with the use of the information?

☐ Cross referencing data entries with other systems 

☐ Third party data verification 

☒ Data taken directly from individuals 

☒ Character limits on text submissions 

☒ Numerical restrictions in text boxes 

☐ Other: 

XI. RETENTION 

1) What are the retention periods for the information? 

CFTC is revising the records disposition schedule for CSL records. All CFTC records retention 

schedules are available on CFTC.gov. 

XII. SECURITY 

1) What types of administrative safeguards protect the information? 

☒ Contingency Plan 

☒ User manuals for the system 

☒ Rules of Behavior 

☒ Non-Disclosure or other contractual agreement 

☐ Other: 

2) What types of physical safeguards protect the information? 

☐ Guards 

☒ Identification Badges 

☐ Biometric 

☐ Cameras 

☒ Physically secured space with need to know access 

☐ Other: 
Page 9 of 9 

3) What types of technical safeguards protect the information? 

☒ User Identification 

☒ Firewall 

☒ Virtual Private Network (VPN) 

☐ Multi-factor Authentication (MFA) 

☒ Passwords 

☐ Encryption 

☐ De-Identification 

☐ Anonymization 

☐ Other: Click here to enter text.

4) What monitoring, recording, and auditing safeguards are in place to prevent or detect 

unauthorized access or inappropriate use of the information? 

Scans of the machines housing the database and the software are performed on a regular 

basis. Logs are maintained regarding which CFTC users have accessed the database and 

when, but not actions taken. These logs are visible to system administrators only. 

XIII. TRAINING

1) What privacy training is provided to users of the system? 

CFTC staff receives training before gaining access to CSL for the first time in order to ensure 

that all information resides in approved locations. In addition, annual privacy and 

cybersecurity training is mandatory for all CFTC staff.