Privacy Impact Assessment 

for 

Cision 

October 6, 2020

System/Business Owner 

Michael Short

Chief Communications Officer and Director

of Public Affairs

Reviewing Official 

Charles Cutshall

Chief Privacy Officer
Page 1 of 9

SYSTEM OVERVIEW 

1) Describe the purpose of the system/collection:

Cision provides a software-as-a-service communications and public relations platform that 

enables its customers to identify influencers, craft and distribute meaningful stories, and 

measure the impact. The Cision platform consists of multiple products that customers may 

access through the Cision Communications Cloud.

The Commodity Future Trading Commission’s (“CFTC” or “Commission”) Office of Public 

Affairs (OPA) uses Cision to tailor communications with press outlets according to need, 

gauge and create marketing campaigns, and track earned mentions. Specifically, OPA uses 

the following Cision products:

Media Contact Database: A product that provides access to over 1.4 million contacts and 

outlets across the globe. OPA uses the database to build media distribution lists. Press 

contacts can be searched and filtered by multiple criteria, including by name, outlet, bureau, 

region, and topic. 

Media Monitoring: A product that monitors online, social, print, and broadcast channels. 

OPA uses media monitoring to track mentions of the CFTC in the press and produce daily 

news clips.

Analytics: A product that provides additional tools to create and track metrics of how 

effectively the CFTC is communicating its messages to various audiences, such as the 

American taxpayer and regulated markets.

2) Provide a data map or model illustrating how information is structured or is processed by the 

system throughout its life cycle. Include a brief description of the data flows. 
Page 2 of 9

a) The Cision platform can be accessed from any web browser or device using a username 

and password. As a matter of policy, OPA staff will only access the Cision platform using 

CFTC-issued devices. Once logged in, OPA staff may upload press statements for 

distribution, export information residing on the Cision cloud, and view analytics 

information relating to campaign performance. Data exported from Cision may be 

included in reports and will be saved in a SharePoint site maintained by OPA on the CFTC 

network. 

b) OPA uses the Media Database and Analytics modules to distribute press releases to 

reporters and other media contacts and track engagement.

c) OPA uses the Media Monitoring and Analytics modules to track mentions of the CFTC in 

media outlets, compile news clips, and generate aggregate reports. 

d) OPA staff circulates information exported from the Cision platform to other CFTC divisions 

or personnel, as necessary. 

AUTHORITY AND PURPOSE 

1) What is the legal authority to collect, use, maintain, and share information in the system?

Commodity Exchange Act, 7 U.S.C. § 12.
Page 3 of 9

INFORMATION TYPES 

1) What information pertaining to members of the press and the public will be collected, 

maintained, used, and/or disseminated? 

Identifying Numbers

☐ Social Security Number ☐ Truncated or Partial Social Security Number

☐ Driver’s License Number ☐ License Plate Number

☐ Patient ID Number ☐ File/Case ID Number

☐ Student ID Number ☐ Health Plan Beneficiary Number

☐ Passport Number ☐ Federal Student Aid Number

☐ Employee Identification Number ☐ Taxpayer Identification Number

☐ Professional License Number ☐ Legal Entity Identifier

☐ Credit/Debit Card Number ☐ National Futures Association ID

☐ Personal Bank Account Number ☐ Other ID if it can be traced back to an 

individual

☐ Personal Device Identifiers or Serial 

Numbers

Contact Information

☒ Personal Mobile Number ☒ Business Phone Number

☒ Personal E-mail Address ☒ Business E-mail Address

☐ Home Phone Number ☒ Personal or Business Fax Number

☐ Home Mailing Address ☒ Business Mailing Address

Sole Proprietors

☐ Business Taxpayer Identification Number ☐ Business Mailing Address

☐ Business Credit Card Number ☐ Business Phone or Fax Number

☐ Business Bank Account Number ☐ Business Mobile Numbers

☐ Business Device identifiers or Serial

Numbers

☐ Business Email

Biographical Information

☒ Name ☐ Gender

☐ Date of Birth ☐ City or County of Birth

☐ Country of Birth ☒ Zip Code

☐ Citizenship ☐ Military Service Information

☐ Spouse Information ☐ Academic Transcript

☒ Group/Org. Membership ☐ Resume or Curriculum Vitae

☐ Location Data (e.g., GPS) ☐ Nationality

☒ Employment Information ☐ Marital Status

☐ Mother’s Maiden Name ☐ Children Information

Biometrics/Distinguishing Features/Characteristics

☐ Fingerprints ☐ Height

☐ Retina/Iris Scans ☐ Voice/Audio Recording

☐ Hair Color ☐ Eye Color
Page 4 of 9

☐ Video Recording ☐ Photos

☐ Weight ☐ Signatures

2) What information relating to OPA users of the Cision Platform will be collected, maintained, 

used, and/or disseminated? 

Active Directory/Device Information

☒ IP Address ☒ MAC Address

☐ CFTC Asset Number ☒ Device Identifiers or Serial Numbers

☒ User Name / Password ☒ Log data

 COLLECTING INFORMATION 

1) How is the information in this system collected?

Contact information pertaining to members of the press is collected by Cision to facilitate 

communication with entities of public interest such as the CFTC. To learn more about Cision’s 

privacy policies, visit: https://gdpr.cision.com.

Press releases prepared by OPA are uploaded to the Cision platform for distribution to media 

contacts and press outlets. CFTC Press Releases may contain personal information pertaining 

to members of the public (e.g., when announcing an enforcement action) and CFTC staff 

members (e.g., OPA, Division of Enforcement staff, and the Chairman and Commissioners). 

OPA maintains an official version of each press release in a SharePoint site maintained by OPA 

on the CFTC network.

INFORMATION USE 

1) Will information in the system be retrieved using one or more of the data elements listed in

Section III?

Information in the Cision platform is searchable by title or content, reporters’ names, 

pictures, videos, and keyword.

2) If the information in the system is retrieved using one or more of the identifiers, what CFTC 

System of Records Notice (SORN) covers the information?

Retrieval of information pertaining to members of the press is covered by CFTC-53, Mailing, 

Event, and General Contact Lists.
Page 5 of 9

ACCESS AND SHARING

1) With which internal CFTC Offices or Divisions is the information shared? For each Office or 

Division, what information is shared and for what purpose?

OPA circulates an organization-wide daily newsletter featuring media coverage of the CFTC 

and other current events. OPA may also share pertinent articles and mentions of the CFTC 

with specific CFTC offices and divisions, as necessary.

2) Approximately how many users have access to the system? 

Between five and ten members of the OPA management team will have credentials to access 

to the Cision platform.

3) How is the information shared internally?

Information derived from Cision, such as articles and metrics, may be used to draft reports 

and create daily press briefings. Reports and briefings will be saved in a SharePoint site 

maintained by OPA on the CFTC network and will be emailed to CFTC staff. 

4) With which external organization(s) is the information shared?

CFTC press releases are shared with Cision for further distribution to other external 

organizations (e.g., news outlets). News articles and press contacts available in the Cision 

platform may be shared with other federal agencies on a case-by-case basis.

5) How is the information shared externally?

OPA uploads CFTC press releases to the Cision platform, which are then distributed 

electronically to third parties. In order to share press contact information or news articles 

residing in the Cision platform with other federal agencies, OPA staff may export such 

information and transmit it by email.

TRANSPARENCY

1) How are individuals notified as to how their information will be collected, used, and/or shared 

within this system?

Media outlets and members of the press are in direct contact with Cision and are aware that 

their personal information is being collected and will be shared with other entities, such as 

the CFTC. This assessment serves as notice to the Media Outlets and members of the press, 

as well as industry participants and experts who agree to be interviewed on the record, that 

their information is collected, used, and disseminated within the CFTC.
Page 6 of 9

CFTC staff members are informed that their personal information may be included in CFTC 

communication prior to its release. 

2) Is a SORN required? If so, explain how the use of the information in this system is limited to 

the use specified in the SORN?

Retrieval of information pertaining to members of the press is covered by CFTC-53, Mailing, 

Event, and General Contact Lists, 84 FR 17814. Additional information about the SORNs 

maintained by the CFTC is available here.

INDIVIDUAL PARTICIPATION

1) Is the information collected directly from the individual?

Personal information relating to members of the press and individuals (e.g., industry 

participants and experts) who agree to be interviewed on the record is collected, maintained, 

and updated by Cision, and may be collected directly or indirectly. 

Personal information relating to members of the public mentioned in CFTC communications 

is collected by the CFTC in the context of its regulatory activities, such as enforcement actions, 

and is collected from other CFTC systems or public documents such as court filings. 

Personal information relating to CFTC staff members mentioned in CFTC communications is 

collected from other CFTC IT systems. 

2) Is the collection mandatory or voluntary? If voluntary, what opportunities do the individuals 

have to decline to provide information?

The collection of information about individuals whose personal information appears in news 

articles, such as members of the press and individuals (e.g., industry participants and experts) 

who agree to be interviewed on the record is involuntary. Members of the press and 

individuals who agree to be interviewed understand that they may be identified in articles 

and publications. In certain circumstances, individuals who agree to be interviewed may be 

interviewed off-the-record or their comments may appear without attribution. The CFTC 

does not make any attempt to identify or identify unnamed sources. 

The collection of personal information relating to members of the public who are mentioned 

in CFTC communications may be involuntary. For example, in the in the context of 

enforcement actions certain information may be collected from other CFTC systems or public 

documents such as court filings.

The collection and use of personal information relating to CFTC staff members in CFTC 

communications is involuntary. However, the content of CFTC communications is 

coordinated with multiple stakeholders, including the individuals concerned, heads of CFTC 
Page 7 of 9

operating divisions, the Office of General Counsel, and the Office of the Chairman and CFTC 

staff named in CFTC Communications may request anonymity. 

3) Do individuals have an opportunity to consent to a particular use of the information? If so, 

how do they provide consent for a particular use?

CFTC does not determine whether members of the press are presented with an opportunity 

to consent to the collection of their personal information by Cision. 

Members of the public mentioned in CFTC communications in the context of enforcement 

actions do not have an opportunity to consent to use of their personal information. 

CFTC staff members may not have the opportunity to consent to use of their personal 

information when publication thereof is mandatory (e.g., statements released by the 

Chairman or Commissioners). 

 DATA MINIMIZATION 

1) What steps were taken to minimize the collection of PII in the system?

Cision offers products and services that monitor blogs and posts on social media such as 

Twitter, Facebook, and YouTube. In addition, Cision provides a platform to connect with and 

build relationships with “new media influencers”. In accordance with Section (e)7 of 5 U.S.C 

552a and OMB Memorandum M-10-22 Guidance for Online Use of Web Measurement and 

Customization Technologies (Jun. 25, 2010), OPA will not use these products and services 

because they could potentially collect information protected by the First Amendment and 

track user individual-level activity on the Internet outside the Cision platform.

DATA QUALITY AND INTEGRITY 

1) How is data quality ensured throughout the information lifecycle and business processes 

associated with the use of the information?

☐ Cross referencing data entries with other systems

☒ Third party data verification

☐ Data taken directly from individuals

☐ Character limits on text submissions

☐ Numerical restrictions in text boxes

☐ Other:

RETENTION 

1) What are the retention periods for the information?
Page 8 of 9

Press releases saved to the Cision platform are copies of the Official Press Releases. Copies of 

press releases are considered Transitory Records. Such records fall under General Records 

Schedule (GRS) 5.2, item 010, “Transitory Records” and can be destroyed when no longer 

needed for business use, or according to agency predetermined time period or business rule. 

Official Press Releases are permanent records and are saved to an internal CFTC repository 

for eventual transfer to the National Archives and Records Administration.

SECURITY 

1) What types of administrative safeguards protect the information?

☒ Contingency Plan

☒ User manuals for the system

☒ Rules of Behavior

☒ Non-Disclosure or other contractual agreement

☐ Other:

2) What types of physical safeguards protect the information?

☐ Guards

☐ Identification Badges 

☐ Biometric

☐ Cameras

☐ Physically secured space with need to know access

☐ Other: 

3) What types of technical safeguards protect the information?

☒ User Identification

☐ Firewall 

☐ Virtual Private Network (VPN)

☐ Multi-factor Authentication (MFA)

☒ Passwords

☒ Encryption

☐ De-Identification

☐ Anonymization

☐ Other: 

4) What monitoring, recording, and auditing safeguards are in place to prevent or detect 

unauthorized access or inappropriate use of the information?

Information about what information Cision collects to prevent or detect unauthorized access 

can be found here.
Page 9 of 9

5) Is this system hosted by a Cloud Service Provider (CSP)? Yes.

a. If yes, which one? Cision

b. If yes, has the system obtained a FedRAMP Authorization? No. The Office of Data and 

Technology has determined that use of the Cision platform does not require FedRAMP 

authorization. 

TRAINING 

1) What privacy training is provided to users of the system?

OPA staff members receive training before gaining access to Cision for the first time in order 

to ensure that all information resides in approved locations. In addition, annual privacy and 

cybersecurity training is mandatory for all CFTC staff.