FEDERAL MARITIME COMMISSION
800 North Capitol Street, N.W.
Washington, DC 20573

August 22, 2006

Tel.: (202) 523-5863
Office of Inspector General Fax: — (202) 566-0043
E-mail: oig@fme.gov

TO: Karon Douglass, Director
Office of Financial Management

FROM: Adam R. Trzecia! |e
Inspector Gener: a \3 1\

SUBJECT: Privacy Data on Leave Request Forms
OIG Operational Review OR-06-01

As I am sure you are well aware, privacy concerns in the Federal government have never
been greater. The OIG has received many recent mandates to examine agency controls to
safeguard personally identifiable information (PII) maintained on agency data bases. In a
majority of instances, PII is necessary to assist the agency in carrying out its programs or
managing its employees efficiently and effectively. In other instances, collecting PII is
simply an outgrowth of tradition or habit, with no current program or administrative basis.

On July 13, 2006, I sent you an email concerning the agency’s need to collect privacy
data, specifically the social security number on Form SF-71, Request for Leave or
Approved Absence, (a.k.a. leave slip). In a recent audit of payroll transactions', the OIG
learned that social security numbers are not used by FMC timekeepers to record leave or
by FMC supervisors to approve leave. As stated in my July 13" email, my concern was,
and continues to be, that the agency collets this sensitive information on leave slips for no
reason at all. This practice exposes FMC employees to identity theft should this
information fall into the wrong hands. I suggested that you inform staff that the social
security number is not needed to process leave slips and that staff discontinue providing
this information for their own protection.

In your response, you stated that you no longer use your social security number on leave

slips you submit and consider it (including the social security number) a personal
decision. You also stated that you know of no supervisors who require that the social

" See OIG 06-02, Audit of FMC Time and Attendance Transactions


security number be included on the leave slip. You concluded that no action was
necessary.

Based on this correspondence, I decided to test the extent to which staff is including
social security numbers on leave slips. The OIG selected 14 employees representing
most FMC offices and bureaus, documented leave taken by these employees for all of CY
2005 and the first nine pay periods of 2006 and examined accompanying leave slips. Of
the 14 employees reviewed, nine (64 percent) routinely included their social security
numbers on their leave slips. In total, the OIG identified 148 separate leave slips
(belonging to the nine employees) containing a social security number. All of these
forms are currently maintained by various agency timekeepers.

While including the social security number may indeed be a personal decision, I suspect
most staff is unaware that it is not needed to process leave transactions.

Approximately two years ago, I recommended that the Chief Financial Officer at the
Federal Trade Commission, the Federal agency responsible for enforcing many of the
government’s privacy statues and for issuing related guidance to businesses and the
public on privacy matters, discontinue the collection of social security numbers on forms
where they are no longer needed. In response, the FTC immediately blocked out the
social security data field on its “on-line” leave slip and instructed staff not to include such
information when completing the form manually. In light of the OIG survey results, I
recommend that you take the same steps to protect FMC staff's PII. Iam also
recommending that the Director, Office of Administration, review all other forms used by
the agency (e.g., training forms, travel documents, etc.) to identify instances where social
security numbers are collected but not used to process the specific transaction.

Responses to the two recommendations are due to the Office of Inspector General by
September 5, 2006. Results of this review and your responses will be included in the
OIG’s annual Federal Information Security Management Act report to Congress and
OMB for FY 2006.

ce: Director, Office of Administration
Chief Information Officer
Director, Office of Human Resources
FMC Privacy Act Officer