Privacy Impact Assessment 

for the 

Office of Legislative and Intergovernmental 

Affairs (OLIA) & FiscalNote 

October 6, 2020

System/Business Owner

Office of Legislative and Intergovernmental Affairs

Reviewing Official 

Charles Cutshall

Chief Privacy Officer
Page 1 of 8

 SYSTEM OVERVIEW 

1) Describe the purpose of the system/collection:

The Commodity Futures and Trading Commission’s (“Commission” or “CFTC”) Office of 

Legislative and Intergovernmental Affairs (OLIA) is the chief advisor to the CFTC Chairman on 

matters before the U.S. Congress and serves as the Commission’s official liaison with 

Members of Congress, federal agencies, and the Administration. Among other things, OLIA 

provides counsel and professional support to the Chairman and Commission with the goal of 

building and maintaining relationships with Members of Congress and their staffs and in 

doing so, furthering the goals and agenda of the Chairman and the Commission.

To track developments in legislation of relevance to the CFTC’s mission, such as new versions 

of bills or committee meeting notes, OLIA uses FiscalNote. FiscalNote provides a softwareas-a-service platform that aggregates information from legislative, agency, and media 

sources to provide up-to-date information on policy issues across international, federal, and 

state governments. FiscalNote maintains up-to-date contact information for legislators and 

their staff, statistics regarding their voting record, committee memberships, and bill 

sponsorships, and feeds of their official social media accounts. OLIA uses this information to 

develop and execute legislative strategy on behalf of the Chairman and to facilitate 

communication with legislators.

2) Provide a data map or model illustrating how information is structured or is processed by the 

system throughout its life cycle. Include a brief description of the data flows.
Page 2 of 8

a. OLIA users access the FiscalNote service using single sign-on, which is authenticated using 

Active Directory and a SAML server. 

b. OLIA uses the FiscalNote services to access up-to-date contact information for legislators 

and their staff, create custom distribution lists, and to track developments in legislation 

of interest. 

c. OLIA saves information extracted from the FiscalNote service to a network folder or 

SharePoint site maintained by OLIA. OLIA does not upload any contact or biographical 

information to FiscalNote.

 AUTHORITY AND PURPOSE 

1) What is the legal authority to collect, use, maintain, and share information in the system?

7 U.S.C. 22(a)(2)-(3).

INFORMATION TYPES 

1) What information will be collected, maintained, used, and/or disseminated about public 

officials and their staff? 

Identifying Numbers

☐ Social Security Number ☐ Truncated or Partial Social Security Number

☐ Driver’s License Number ☐ License Plate Number

☐ Patient ID Number ☐ File/Case ID Number

☐ Student ID Number ☐ Health Plan Beneficiary Number

☐ Passport Number ☐ Federal Student Aid Number

☐ Employee Identification Number ☐ Taxpayer Identification Number

☐ Professional License Number ☐ Legal Entity Identifier

☐ Credit/Debit Card Number ☐ National Futures Association ID

☐ Personal Bank Account Number ☐ Other ID if it can be traced back to an 

individual

☐ Personal Device Identifiers or Serial 

Numbers

Contact Information

☐ Personal Mobile Number ☒ Business Phone Number

☐ Personal E-mail Address ☒ Business E-mail Address

☐ Home Phone Number ☒ Personal or Business Fax Number

☐ Home Mailing Address ☒ Business Mailing Address

Sole Proprietors

☐ Business Taxpayer Identification Number ☐ Business Mailing Address

☐ Business Credit Card Number ☐ Business Phone or Fax Number
Page 3 of 8

☐ Business Bank Account Number ☐ Business Mobile Numbers

☐ Business Device identifiers or Serial 

Numbers

☐ Business Email

Biographical Information

☒ Name ☒ Gender

☒ Date of Birth ☒ City or County of Birth

☒ Country of Birth ☒ Zip Code

☐ Citizenship ☒ Military Service Information

☒ Spouse Information ☐ Academic Transcript

☒ Group/Org. Membership ☐ Resume or Curriculum Vitae

☐ Location Data (e.g., GPS) ☐ Nationality

☒ Employment Information ☒ Marital Status

☐ Mother’s Maiden Name ☒ Children Information

Biometrics/Distinguishing Features/Characteristics

☐ Fingerprints ☐ Height

☐ Retina/Iris Scans ☐ Voice/Audio Recording

☐ Hair Color ☐ Eye Color

☐ Video Recording ☒ Photos

☐ Weight ☐ Signatures

2) What information will be collected, maintained, used, and/or disseminated about CFTC 

users of FiscalNote?

Active Directory/Device Information

☐ IP Address ☐ MAC Address

☐ CFTC Asset Number ☐ Device Identifiers or Serial Numbers

☒ User Name

 COLLECTING INFORMATION

1) How is the information in this system collected?

FiscalNote collects publicly available contact and biographical information related to 

legislators and their staff from public sources. The information made available through 

FiscalNote is available to the general public through various resources, including public 

officials’ official websites and media outlets. In the course of conducting interviews with 

media outlets, staffers’ biographical information may also be shared. This information is 

collected and made available to the CFTC through Fiscal Note. To learn more about 

FiscalNote’s privacy policies, visit: https://fiscalnote.com/privacy. 

2) If any forms are used to collect information that resides in the system, please include the 

name of such form(s) and any applicable control number (i.e. issued by CFTC, OMB, etc.).

No forms are used to collect information that resides in the system. 
Page 4 of 8

INFORMATION USE 

1) Will information in the system be retrieved using one or more of the data elements listed in

Section III?

Information in FiscalNote is searchable by name, address, organizational membership, title, 

and other personally identifiable information. 

2) If the information in the system is retrieved using one or more of the identifiers, what CFTC 

System of Records Notice (SORN) covers the information?

Retrieval of information pertaining to legislators and their staff is covered by CFTC-53, 

Mailing, Event, and General Contact Lists.

ACCESS AND SHARING

1) With which internal CFTC Offices or Divisions is the information shared? For each Office or 

Division, what information is shared and for what purpose?

Information such as contact information, articles, and metrics may be exported from 

FiscalNote and used to create distribution lists, reports, and briefings. Exported information 

will be saved in a network folder or SharePoint site maintained by OLIA on the CFTC network. 

Contact information and distributions lists are not shared with any other CFTC Offices or 

Divisions. Biographical information may be shared with CFTC staff in advance of any meetings 

or interactions with public officials or their staff.

2) Approximately how many users have access to the system? 

Three (3) OLIA staff members will have access to FiscalNote. A SAML server and Active 

Directory are used to permit single sign-on and to limit access to OLIA staff. 

Access to OLIA’s network folder and SharePoint site is limited to OLIA staff.

3) How is the information shared internally?

Information exported from FiscalNote will be shared internally by email. 

4) With which external organization(s) is the information shared?

No information residing in or exported from FiscalNote or OLIA’s network drive and 

SharePoint site is shared with external organizations.
Page 5 of 8

5) How is the information shared externally?

Information is not shared externally.

TRANSPARENCY

1) How are individuals notified as to how their information will be collected, used, and/or

shared within this system?

FiscalNote collects and processes information about public officials from publicly-available 

sources, such as government websites, a public official’s individual website, and other similar 

resources. The information gathered, which includes personally identifiable information, is 

used by FiscalNote to produce summaries or compilations of data related to legislative and 

regulatory activity and to provide its customers with a tool by which they can gain and 

understanding of legislation, regulations and their status, as well as the methods for 

contacting public officials. FiscalNote provides notice of its collection of this information in its 

privacy notice, available at https://fiscalnote.com/privacy.

This assessment serves as notice to legislators and their staff that their information collected 

and maintained by FiscalNote is also collected, used, and disseminated by the CFTC. 

2) Is a SORN required? If so, explain how the use of the information in this system is limited to 

the use specified in the SORN?

Yes, a SORN is required to maintain information exported from FiscalNote. Information 

pertaining to legislators and their staff is only used in consistent with CFTC-53, Mailing, Event, 

and General Contact Lists, namely to facilitate CFTC communication with public officials.

INDIVIDUAL PARTICIPATION 

1) Is the information collected directly from the individual?

Information collected by FiscalNote and used by OLIA is collected both directly and indirectly. 

For example, personal information relating to legislators and their staff who release press 

statements, participate in media interviews, or that appears in official documents such as 

transcripts may be collected and made available to OLIA by FiscalNote. FiscalNote also 

communicates directly with legislators and their staff to ensure that integrity of the 

information provided through their service. 

2) Is the collection mandatory or voluntary? If voluntary, what opportunities do the 

individuals have to decline to provide information?
Page 6 of 8

Collection and disclosure of personal information relating to legislators and their staff is both

voluntary (e.g., when speaking to the press or directly with FiscalNote) or involuntary (e.g., 

when participate in media interviews or appearing in official documents). 

3) Do individuals have an opportunity to consent to a particular use of the information? If so, 

how do they provide consent for a particular use?

Public officials and their staff whose information OLIA access through FiscalNote do not have 

an opportunity to consent to a particular use of their information. However, it is CFTC’s policy 

that, once collected, this information will only be used for the purposes outlined in this notice 

and in the applicable SORN.

 DATA MINIMIZATION

1) What steps were taken to minimize the collection of PII in the system?

FiscalNote offers products and services that link to feeds on social media such as Twitter, 

relating to official accounts of public officials. In addition, FiscalNote provides a platform to 

connect with and build relationships with potential supporters of political causes. In 

accordance with Section (e)7 of 5 U.S.C 552a and OMB Memorandum M-10-22, Guidance for 

Online Use of Web Measurement and Customization Technologies (Jun. 25, 2010), OLIA will 

not use these products and services to the extent they (i) could potentially collect information 

from private citizens protected by the First Amendment or (ii) track user individual-level 

activity on the Internet outside the FiscalNote platform.

DATA QUALITY AND INTEGRITY 

1) How is data quality ensured throughout the information lifecycle and business processes 

associated with the use of the information?

☒ Cross referencing data entries with other systems

☒ Third party data verification

☒ Data taken directly from individuals

☐ Character limits on text submissions

☐ Numerical restrictions in text boxes

☐ Other:

RETENTION 

1) What are the retention periods for the information?

Contact information exported from FiscalNote and notes relating to draft legislation prepared 

by OLIA and stored in FiscalNote are maintained in accordance with records schedule
Page 7 of 8

Inquiries and Records schedule (DAA-0180-2018-0007-0001). Records are destroyed 6 years 

after the end of the calendar year in which they were created.

SECURITY

1) What types of administrative safeguards protect the information?

☐ Contingency Plan

☒ User manuals for the system

☐ Rules of Behavior

☒ Non-Disclosure or other contractual agreement

☐ Other:

2) What types of physical safeguards protect the information?

☐ Guards

☐ Identification Badges 

☐ Biometric

☐ Cameras

☐ Physically secured space with need to know access

☐ Other: 

3) What types of technical safeguards protect the information?

☒ User Identification

☒ Firewall 

☐ Virtual Private Network (VPN)

☒ Multi-factor Authentication (MFA)

☒ Passwords

☐ Encryption

☐ De-Identification

☐ Anonymization

☐ Other: 

4) What monitoring, recording, and auditing safeguards are in place to prevent or detect 

unauthorized access or inappropriate use of the information?

Internal CFTC systems such as email servers, SharePoint and network drives are continuously 

monitored to detect unauthorized access as part of CFTC’s security program. Access is limited 

to those with a need to know who understand their responsibilities in handling this 

information to prevent inappropriate use of the information.

Information about FiscalNote’s policies to prevent or detect unauthorized access can be 

found here.
Page 8 of 8

5) Is this system hosted by a Cloud Service Provider (CSP)? Yes

a. If yes, which one? FiscalNote is a software-as-a-service platform.

b. If yes, has the system obtained a FedRAMP Authorization? FiscalNote is not FedRAMP 

Authorized. The Office of Data and Technology (ODT) has determined that use of the 

FiscalNote platform does not require FedRAMP authorization.

TRAINING 

1) What privacy training is provided to users of the system?

All CFTC personnel are subject to CFTC agency-wide procedures for safeguarding personally 

identifiable information and receive annual privacy and security training.