Privacy Impact Assessment

MSPB Reasonable Accommodations System

January 3, 2022

Contact

D. Fon Muttamara

Chief Privacy Officer

Merit Systems Protection Board

1615 M Street, NW

Washington, D.C. 20419

privacy@mspb.gov
Privacy Impact Assessment

MSPB Reasonable Accommodations System

Page 2

Abstract

The U.S. Merit Systems Protection Board (MSPB) is implementing a limited system to collect, 

maintain, and use information concerning applicants for employment and employees who request 

or receive reasonable accommodations or other appropriate modifications from MSPB for medical 

or religious reasons. MSPB is publishing this Privacy Impact Assessment (PIA) because 

personally identifiable information (PII) is collected, used, and maintained by the agency through 

its implementation of the limited Reasonable Accommodations System (RAS).

Overview

MSPB is creating a RAS to encompass the lifecycle of all reasonable accommodation requests at 

MSPB. The purpose of this system of the records is to allow MSPB to collect, maintain, and use 

records on applicants for employment and employees who request or receive reasonable 

accommodations or other appropriate modifications from MSPB for medical or religious reasons; 

to process, evaluate, and make decisions on individual requests; and to track and report the 

processing of such requests MSPB-wide to comply with applicable requirements in law, 

regulation, and policy, and to maintain the confidentiality of the information provided in support 

of the accommodation.

To support this effort, MSPB applicants and employees who are requesting reasonable 

accommodations will provide information and documentation to their supervisors and/or MSPB’s 

Director of the Office of Equal Employment Opportunity (EEO). The records will be maintained 

in an access-restricted network drive, accessible only by the EEO Director. In certain 

circumstances, other MSPB employees may have limited access where there is a need-to-know to 

perform their duties, such as a supervisor or an Office Director.

The RAS will contain PII submitted by the individual when seeking a reasonable accommodation. 

Additionally, the RAS also will contain PII required to make the determination whether to grant 

the request and to implement an approved accommodation. For a full list of PII maintained in this 

system, please refer to MSPB’s System of Records Notice (SORN), MSPB-3 Reasonable 

Accommodations SORN, 86 Fed. Reg. 73001 (Dec. 23, 2021).

Section 1.0 Authorities and Other Requirements

1.1 What specific legal authorities and/or agreements permit 

and define the collection of information by the project in

question?

The Rehabilitation Act of 1973, 29 U.S.C. 701, 791, 794; Title VII of the Civil Rights Act of 1964, 

42 U.S.C. 2000e; 29 C.F.R. 1605 (Guidelines on Discrimination Because of Religion); 29 C.F.R. 

1614 (Federal Sector Equal Employment Opportunity); 29 C.F.R. 1630 (Regulations To 

Implement the Equal Employment Provisions of the Americans With Disabilities Act); Executive 

Order 13164, Requiring Federal Agencies to Establish Procedures to Facilitate the Provision of 
Privacy Impact Assessment

MSPB Reasonable Accommodations System

Page 3

Reasonable Accommodation (July 26, 2000); and Executive Order 13548, Increasing Federal 

Employment of Individuals with Disabilities (July 26, 2010).

1.2 What Privacy Act System of Records Notice(s) (SORN) applies

to the information?

MSPB maintains these reasonable accommodations records under MSPB-3 Reasonable 

Accommodations SORN, 86 Fed. Reg. 73001 (Dec. 23, 2021).

1.3 Has a system security plan been completed for the 

information system(s) supporting the project?

Authorized by MSPB’s Office of Information Resources Management, the agency’s General 

Support System (GSS) is secured in accordance with NIST 800-53 rev 4 requirements and had a 

conditional authority to operate or ATO effective October 1, 2019, which was renewed 

September 30, 2020. Although the system has not completed a full evaluation, it is audited for 

Federal Information Security Management Act or FISMA controls every year. MSPB’s GSS is 

authorized at the Fair Information Processing Standards or FIPS 199 Moderate Impact level.

1.4 Does a records retention schedule approved by the 

National Archives and Records Administration exist?

The records maintained in this system of records are subject to the National Archives and Records 

Administration’s (NARA) General Records Schedule (GRS) 2.3 (Employee Relations Records), 

Item 20 (Reasonable accommodation case files). NARA GRS 2.3, Item 20, instructs disposition 

three years after employee separation from the agency or all appeals are concluded, whichever is 

later, but longer retention is authorized if required for business use.

1.5 If the information is covered by the Paperwork Reduction Act 

(PRA), provide the OMB Control number and the agency

number for the collection. If there are multiple forms, include a 

list in an appendix.

While the PRA does not apply to the collection of information from MSPB employees, the PRA

does apply to prospective MSPB employees (applicants). Additionally, the PRA applies to nonMSPB employees providing information in support of a request for a reasonable accommodation 

for medical or religious reasons. A PRA Information Collection Request (ICR) package for 

reasonable accommodation requests is currently under agency review and pending submission to

Office of Management and Budget’s (OMB) Office of Information and Regulatory Affairs for 

PRA clearance and to obtain an OMB control number for this collection.
Privacy Impact Assessment

MSPB Reasonable Accommodations System

Page 4

Section 2.0 Characterization of the Information

2.1 Identify the information the project collects, uses, disseminates, 

or maintains.

The information collected includes:

1. Requester status (applicant or former or current employee);

2. Requester name;

3. Date of request;

4. Employee’s position title, grade, series, step, and agency component;

5. Position title, grade, series, step of the position, and agency component the 

requester is applying for (if applicable);

6. Requester’s contact information (addresses, phone numbers, and email addresses);

7. Name and contact information of medical professionals or religious or spiritual 

advisors or institutions;

8. Description of the requester’s medical condition or disability and any medical 

documentation provided in support of the request;

9. Requester’s statement of a sincerely held religious belief and any additional 

information provided concerning that religious belief and the need for an 

accommodation to exercise that belief;

10. Description of the accommodation being requested;

11. Description of previous requests for accommodation and dispositions;

12. Documentation by an MSPB official concerning whether the disability is obvious, 

and the accommodation is obvious and uncomplicated, whether medical 

documentation is required to evaluate the request, whether research is necessary 

regarding possible accommodations, and any extenuating circumstances that 

prevent the MSPB official from meeting the relevant timeframe;

13. Whether the request for reasonable accommodation was granted or denied, and if 

denied the reason(s) for denial;

14. The identity of the decision-maker for the request;

15. The number of days taken to process the request;

16. The sources of technical assistance consulted in trying to identify a possible 

reasonable accommodation;

17. Any reports or evaluations prepared in determining whether to grant or deny the 

request; and

18. Any other information collected or developed in connection with the request for a 

reasonable accommodation.

2.2 What are the sources of the information and how is

the information collected for the project?

Information is obtained from applicants for employment and employees who request and/or 

receive a reasonable accommodation or other modification from MSPB; directly or indirectly 
Privacy Impact Assessment

MSPB Reasonable Accommodations System

Page 5

from an individual’s medical provider or another medical professional who evaluates the request;

directly or indirectly from an individual’s religious or spiritual advisors or institutions; and from 

management officials.

2.3 Does the project use information from commercial sources 

or publicly available data? If so, explain why and how this 

information is used.

No.

2.4 Discuss how accuracy of the data is ensured.

The data is provided by the MSPB employee or applicant. Therefore, the accuracy is ensured by 

collecting the information from the source, who must attest to the truthfulness of the information 

they provide, including any documentation.

2.5 Privacy Impact Analysis: Related to Characterization of 

the Information

Privacy Risk: There is a privacy risk that the system will collect and maintain more information 

than is relevant and necessary to accomplish the agency’s mission.

Mitigation: This risk is mitigated. MSPB will only collect information to support the request for 

a reasonable accommodation for medical or religious reasons. Additionally, MSPB provides the 

statutory protections afforded under the Privacy Act, along with the privacy tenets in the Fair 

Information Practice Principles and strives to only collect personal information that is necessary 

to accomplish the purpose of this collection: to collect, maintain, and use records on applicants for 

employment and employees who request or receive reasonable accommodations or other 

appropriate modifications from MSPB for medical or religious reasons; to process, evaluate, and 

make decisions on individual requests; and to track and report the processing of such requests 

MSPB-wide to comply with applicable requirements in law, regulation, and policy, and to maintain 

the confidentiality of the information provided in support of the accommodation.

Section 3.0 Uses of the Information

3.1 Describe how and why the project uses the information.

MSPB will use the information collected to process, evaluate, and make decisions on requests for 

reasonable accommodation for medical or religious reasons from applicants for employment and 

MSPB employees. The information will also be used to track and report the processing of such 

requests to ensure compliance with applicable requirements in law, regulation, and policy. Finally, 

the information may also be used to facilitate the accommodation granted.
Privacy Impact Assessment

MSPB Reasonable Accommodations System

Page 6

3.2 Does the project use technology to conduct electronic searches, 

queries, or analyses in an electronic database to discover or 

locate a predictive pattern or an anomaly? If so, state how 

MSPB plans to use such results.

No.

3.3 Are there other offices with assigned roles and 

responsibilities within the system?

No.

3.4 Privacy Impact Analysis: Related to the Uses ofInformation

Privacy Risk: There is a risk that information collected will be used inappropriately.

Mitigation: This risk is mitigated. MSPB has implemented several measures to ensure that the 

information is protected and handled in accordance with the uses described above. Authorized 

access to the information collected is restricted to the EEO Director. Any internal disclosures 

within MSPB will be on a need-to-know basis in accordance with the Privacy Act.

Section 4.0 Notice

4.1 How does the project provide individuals notice prior to the 

collection of information? If notice is not provided, explain 

why not.

The collection instruments for certain reasonable accommodation requests provide a Privacy Act 

Statement (5 U.S.C. § 552a(e)(3)) providing information regarding the purpose of the collection, 

the routine uses of the disclosure of information, and the consequences for a failure to provide the 

information. Additionally, MSPB has published in the Federal Register and posted on our public 

facing website a SORN, MSPB – 3, Reasonable Accommodations, to provide notice to individuals 

regarding the collection of information.

4.2 What opportunities are available for individuals to consent 

to uses, decline to provide information, or opt out of the

project?

The collection is voluntary, and individuals may decline to provide information. However, failure 

to provide information may delay or impede the processing of a reasonable accommodation 

request.
Privacy Impact Assessment

MSPB Reasonable Accommodations System

Page 7

4.3 Privacy Impact Analysis: Related to Notice

Privacy Risk: There is a risk that MSPB employees will not be given appropriate notice prior to 

the collection of their information.

Mitigation: This risk is mitigated. The collection instruments provide notice at the outset of the 

collection process regarding the purpose of the collection, the routine uses of the disclosure of 

information, and the consequences for a failure to provide the information. 

Section 5.0 Data Retention by the project

The following questions are intended to outline how long the project retains the 

information after the initial collection.

5.1 Explain how long and for what reason the information isretained.

The information is subject to NARA GRS 2.3 (Employee Relations Records), Item 20 (Reasonable 

accommodation case files), and will be retained to document employee exception requests,

approvals, and denials; notice of procedures for informal dispute resolution or appeal processes; 

forms, correspondence, and records of oral conversations; policy guidance documents; medical 

records; and supporting notes and documentation. NARA GRS 2.3, Item 20, instructs disposition 

three years after employee separation from the agency or all appeals are concluded, whichever is 

later, but longer retention is authorized if required for business use.

5.2 Privacy Impact Analysis: Related to Retention

Privacy Risk: There is a risk that information collected by the system may be retained longer 

than necessary.

Mitigation: This risk is mitigated. MSPB applies a NARA-approved records retention schedule 

to the information collected. Once the records meet the destruction date designated in GRS 2.3, 

Item 20, MSPB will destroy the records by fiscal year unless there is a business need for the record.

Section 6.0 Information Sharing

6.1 Is information shared outside of MSPB as part of the normal 

agency operations? If so, identify the organization(s) and how 

the information is accessed and how it is to be used.

MSPB – 3 governs the collection of information and provides the circumstances for the sharing of 

the information. It is not anticipated that this information will be shared outside of MSPB as part 

of normal agency operations. 
Privacy Impact Assessment

MSPB Reasonable Accommodations System

Page 8

6.2 Describe how the external sharing noted in 6.1 is compatible 

with the SORN noted in 1.2.

It is not anticipated that this information will be shared outside of MSPB as part of normal agency 

operations.

6.3 Does the project place limitations on re-dissemination?

The location of the information collected is access-restricted. The EEO Director will inform 

MSPB’s Chief Privacy Officer (CPO) of any requests for disclosure of the information other than 

to supervisors on a “need to know” basis. Once the CPO, or designated disclosure staff, determines

that disclosure is appropriate under MSPB – 3, the provisions of the Privacy Act, or the Freedom 

of Information Act (FOIA), the EEO Director will provide the requested information to the CPO, 

or designated disclosure staff, to process the disclosure request. This includes releases under the 

routine uses of MSPB – 3, and MSPB only authorizes the disclosure of this information if the 

stated use is compatible with the purpose of the collection, as outlined in the applicable SORN. 

Records released pursuant to a FOIA request constitute public information and MSPB has no 

authority to limit its re-dissemination.

6.4 Describe how the project maintains a record of any

disclosures outside of the Agency.

MSPB utilizes FOIAonline to track requests for all information disclosure pursuant to FOIA, the 

Privacy Act, the routine uses in applicable SORNs, and statutes and regulations. FOIAonline is a 

web-based application and assists MSPB in tracking and recording requests received for the 

disclosure of information. This includes requests subject to the accounting provisions of the 

Privacy Act. The information retained as part of this accounting requirement includes the agency 

or individual requesting the information, a description of the requested information, the reason for 

the request, the date of the request, the date of the release, the authority for the release, and the 

limitations and obligations on the requesting agency or individual regarding use and further 

dissemination.

6.5 Privacy Impact Analysis: Related to InformationSharing

Privacy Risk: There is a risk that the information will be shared outside the scope of the 

applicable SORN or without the proper authority or accounting.

Mitigation: This risk is mitigated. All MSPB employees are required to complete annual privacy 

awareness training, which informs users of their Federal information privacy obligations, including 

the proper handling of PII. Additionally, the location of the records is access-restricted, thus 

limiting the amount of personnel able to access and share the records.
Privacy Impact Assessment

MSPB Reasonable Accommodations System

Page 9

External parties who are provided PII under a routine use are subject to Privacy Act limitations on 

disclosures. Any use of the records must be compatible with the purpose of the collection, as 

outlined in the applicable SORN. Records released pursuant to a FOIA request constitute public 

information and MSPB has no authority to limit its re-dissemination.

Section 7.0 Redress

7.1 What are the procedures that allow individuals to access 

their information?

Individuals seeking notification of and access to their records in this system of records may submit 

a request in writing to the Merit Systems Protection Board, Office of the Clerk of the Board, 1615 

M Street, NW, Washington, DC 20419. This request may also be sent to the agency by email at

privacy@mspb.gov. Individuals requesting access must comply with MSPB’s Privacy Act 

regulations regarding verification of identity and access to records (5 C.F.R. Part 1205).

7.2 What procedures are in place to allow the subject individual 

to correct inaccurate or erroneousinformation?

Individuals seeking amendment of their records in this system of records may submit a request in 

writing to the Merit Systems Protection Board, Office of the Clerk of the Board, 1615 M Street,

NW, Washington, DC 20419. This request may also be sent to the agency by email at

privacy@mspb.gov. Individuals requesting amendment must follow MSPB’s Privacy Act 

regulations regarding verification of identity and amendment to records (5 C.F.R. Part 1205).

7.3 How does the project notify individuals about the procedures 

for correcting their information?

This PIA provides notice to individuals on how to correct their information. Additionally, MSPB’s 

Privacy Act regulations(5 C.F.R. Part 1205) and SORN, MSPB – 3, Reasonable Accommodations,

provide notice to the individual.

7.4 Privacy Impact Analysis: Related to Redress

Privacy Risk: There is a risk that individuals will not be able to correct inaccurate or erroneous 

information collected about them.

Mitigation: This risk is mitigated. The information is collected from the source, i.e., the 

individual. Should an individual seek amendment of any records they assert is not accurate, 

relevant, timely, or complete, information on how to submit an amendment request is outlined in

MSPB’s Privacy Act regulations (5 C.F.R. Part 1205).
Privacy Impact Assessment

MSPB Reasonable Accommodations System

Page 10

Section 8.0 Auditing and Accountability

The following questions are intended to describe technical and policy-based safeguards 

and security measures.

8.1 How does the project ensure that the information is used 

in accordance with stated practices in this PIA?

Records in the system are protected from unauthorized access and misuse through various 

administrative, technical, and physical security measures, such as access controls, mandatory 

security and privacy training, encryption, multi-factor authentication, security guards, and locked 

offices. MSPB ensures that the practices stated in this PIA are followed by leveraging employee 

training, Information Technology (IT) Rules of Behavior (RoB), role-based access, and other 

standard operating procures and policies. See Section 1.3 for additional security and privacy

safeguards.

8.2 Describe what privacy training is provided to users 

either generally or specifically relevant to the project.

All MSPB users must complete privacy awareness training and information security awareness 

training annually, as well as read and agree to comply with MSPB’s IT RoB and annually 

thereafter.

8.3 What procedures are in place to determine which users may 

access the information and how does the project determine

who has access?

MSPB deploys role-based access controls and enforces a separation of duties throughout all MSPB

operations to limit access to records and ensures that only MSPB employees who have an official 

need to know will have access to the information. The need to know is determined by the 

respective responsibilities of the employee and the needs of the office. MSPB employees who do 

not have a need to know do not have access to the Reasonable Accommodations System. The 

EEO Director will have primary responsibility for the management of this system and may only 

share information with designated personnel on a need-to-know basis. This ensures that access to 

the information is restricted to a limited number of MSPB personnel. 

8.4 How does the project review and approve information sharing 

agreements, Memoranda of Understanding (MOUs), new uses of 

the information, new access tothe system by organizations within 

MSPB and outside?

This Reasonable Accommodations System does not require information sharing agreements or 

MOUs. New uses of information are not permissible without review and authorization by MSPB 

stakeholders, including MSPB’s CPO and Chief Information Officer, and the Office of Personnel 
Privacy Impact Assessment

MSPB Reasonable Accommodations System

Page 11

Management. If new uses of the information are approved, they will only be utilized once 

appropriate notice has been provided, including updating the PIA and, if applicable, revising 

applicable SORNs. Within MSPB, access to records in this Reasonable Accommodations system

is determined at the agency level.

Responsible Officials

D. Fon Muttamara

Chief Privacy Officer

U.S. Merit Systems Protection Board

Approval Signature & Date

William D. Spencer

Acting Executive Director

& Senior Agency Official for Privacy

U.S. Merit Systems Protection Board