DPCLO ABOUT THE OFFICE: The mission of the Defense Privacy and Civil Liberties Office (DPCLO) is to implement the Department of Defense’s Privacy and Civil Liberties programs through advice, monitoring, official reporting, and training. PACOM Conference 1
DPCLO STRUCTURE Michael L. Rhodes Senior Agency Official for Privacy Civil Liberties Officer Director A&M Michael E. Reheuser Director, DPCLO Deputy Civil Liberties Officer Samuel P. Jenkins Director for Privacy PACOM Conference 2
DPCLO The Program is based on the Privacy Act of 1974, as amended (5 U. S. C. 552 a), as implemented by Office of Management and Budget (OMB) (OMB Circular A-130) and Do. D regulatory authority (Do. D Directive 5400. 11 and Do. D 5400. 11 -R), and is intended to provide a comprehensive framework regulating how and when the Department collects, maintains, uses, or disseminates personal information on individuals. The purpose of the Program is to balance the information requirements and needs of the Department against the privacy interests and concerns of the individual. PACOM Conference 3
DPCLO Civil Liberties Program seeks to ensure the protection of Civil Liberties of Do. D personnel. Public Law 110 -53, “Implementing Recommendations of the 9/11 Commission Act of 2007” Civil Liberties defined: The right of individuals to exercise constitutionally guaranteed freedoms without government interference. They declare what the government cannot do. Examples of civil liberties: Freedom of speech, religion, press, assembly Right to a speedy and impartial jury trial Right to due process and equal protection under the law Freedom from unreasonable search and seizure Freedom to petition the government PACOM Conference 4
DPCLO PACOM Conference 5
PRIVACY ACT OVERVIEW The Basic Concepts of the Act Privacy Act Training presented by Samuel P. Jenkins, Director for Privacy Defense Privacy and Civil Liberties Office 11 January 2011
Presentation Outline • • History of the Privacy Act Overview of the Privacy Act o Policy Objectives o Safeguards o Applicability o Definitions Privacy Act 101 • Privacy Act Provisions o o o 7 Conditions of Disclosure Accounting of Disclosures Individual’s Rights of Access and Amendment Agency Requirements Civil and Criminal Penalties
History of the Privacy Act Intent • The Privacy Act of 1974, Public Law 93 -579, was created in response to concerns about how the use of computerized databases impacts individuals’ privacy rights. • The Act, which became effective 27 September 1975, and has been called a code of fair information practices, attempts to strike a balance between the Governments right to maintain information on individuals and the individuals right to have his or her privacy protected against unwarranted intrusions. Privacy Act 101 8
History of the Privacy Act Code of Fair Information Practice • Code of fair information practice for automated personal data systems o o o Privacy Act 101 Collection limitation. There must be no personal data record keeping systems whose very existence is secret. Disclosure. There must be a way for an individual to find out what information about him is in a record and how it is used. Secondary usage. There must be a way for an individual to prevent information about him that was obtained for one purpose from being used or made available for other purposes without his consent. Record correction. There must be a way for an individual to correct or amend a record of identifiable information about him. Security. Any organization creating, maintaining, using, or disseminating records of identifiable personal data must assure the reliability of the data for their intended use and must take precautions to prevent misuse of the data. 9
The Privacy Act of 1974 Policy Objectives • • To restrict disclosure of personally identifiable records maintained by agencies. To grant individuals increased rights of access to agency records maintained on themselves. To grant individuals the right to seek amendment of agency records maintained on themselves upon a showing that the records are not accurate, relevant, timely, or complete. To establish a code of "fair information practices" which requires agencies to comply with statutory norms for collection, maintenance, and dissemination of records. Privacy Act 101 10
The Privacy Act of 1974 Safeguards • Requires government agencies to show an individual any records kept on him or her • Requires agencies to follow “fair information practices” • Places restrictions on how agencies can share an individual’s data • Allows individuals to sue the government for violations of the Act Privacy Act 101 11
The Privacy Act of 1974 Applicability • U. S. citizens and aliens admitted for permanent residence. • Executive departments, military departments, independent regulatory agencies, and governmentcontrolled corporations • Systems of records, i. e. , any group of records where information is retrieved by the name of the individual or by an individual identifier. Privacy Act 101 12
Definitions (1 of 7) • Personally Identifiable Information which can be used to identify a person uniquely and reliably, including but not limited to name, date of birth, social security number, address, telephone number, e-mail address, mother’s maiden name, etc. Privacy Act 101 13
Definitions (2 of 7) • Agency. An agency that promulgates rules in accordance with notice and comment rulemaking. Privacy Act 101 14
Definitions (3 of 7) • Individual. A citizen of the United States or an alien lawfully admitted for permanent residence. Privacy Act 101 15
Definitions (4 of 7) • Maintain. Includes maintain, collect, use or disseminate. Privacy Act 101 16
Definitions (5 of 7) • Record. Any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual , such as a finger or voice print or photograph. Privacy Act 101 17
Definitions (6 of 7) • System of Records. A group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual. 5 U. S. C. § 552 a(a)(5). Privacy Act 101 18
Definitions (7 of 7) • Routine Use. With respect to the disclosure of a record, the use of each record for a purpose which is compatible with the purpose for which it was collected. 5 U. S. C. § 552 a (a)(7) Privacy Act 101 19
Exceptions to the No Disclosure to Third Parties Without Consent Rule 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. Need To Know Disclosure Required By The Freedom Of Information Act (FOIA) Routine Use Disclosure To Census Disclosure To An Individual Who Has Provided Adequate Written Assurance That The Record Will Be Used Solely For Statistical Research Disclosure To The National Archives And Records Administration Disclosure To Another Agency For Civil Or Criminal Law Enforcement Activity Disclosure Under Emergency Circumstances Disclosure To Either House Of Congress Disclosure To The General Accounting Office Disclosure Mandated By Court Order Of Competent Jurisdiction Disclosure To A Consumer Reporting Agency In Accordance With The Debt Collection Act Privacy Act 101 20
Consent Defined as: 1. To permit, approve, or agree; comply or yield. 2. Permission, approval, or agreement; compliance; acquiescence. 3. Agreement in sentiment, opinion, a course of action, etc. Privacy Act 101 21
Conditions of Disclosure (1 of 4) • General Disclosure Prohibition: o “No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains. ” Privacy Act 101 22
Conditions of Disclosure (2 of 4) • “Need to Know” Within Agency o This exception permits disclosure absent consent of the individual who is the subject of the record for: − The disclosure to officers and employees of the agency which maintains the record who have a need to know in the performance of their duties. 552 a(b)(1) PACOM Conference 23
Conditions of Disclosure (3 of 4) q o o o Disclosures made under the Freedom of Information Act. If information must be released under FOIA, it must also be released under the Privacy Act. No discretionary disclosures are allowed. Discretionary FOIA releases may not be made without an individual's consent, unless there is another applicable exception, such as "routine use. " Information that is protected under the Privacy Act is generally protected under FOIA cannot be used to deny an individual information about him/herself. The agency must be in receipt of an actual FOIA request for the information. Only information that is not subject to a FOIA exemption (usually (b)(6) or (b)(7)(C)) will be required to be released. PACOM Conference 24
Conditions of Disclosure (4 of 4) • Disclosure for a “Routine Use. ” o o o Disclosure is authorized pursuant to routine use published in the Federal Register, compatible with the purpose for which it is collected. Routine use must be published in the Federal Register and include categories of users and the purpose of the use and must be compatible with the purpose for which the information was collected. Agencies may always disclose records indicating a possible violation of law to law enforcement agencies for investigation/prosecution, regardless of the purpose for collection. Agencies cannot include responses to subpoenas as routine use, since there is an exception for court orders which has been interpreted to exclude subpoenas. Privacy Act 101 25
Accounting of Disclosures (1 of 2) • An agency must keep accurate accounts of when and to whom it has disclosed personal records, including o o Name and address of the person or agency to whom the disclosure is made, and Date, nature and purpose of each disclosure. • An accounting is not required for intra-agency (need -to-know) or FOIA disclosures. • The accounting of disclosures must be kept for five years or the life of the record, whichever is longer. Privacy Act 101 26
Accounting of Disclosures (2 of 2) • Unless the records were shared for law enforcement purposes, the accounts of the disclosure should be available to the data subject upon request. • If an agency makes corrections or notations of dispute to any record, the agency must inform any person or agency to whom it has disclosed the original information, if an accounting of disclosures was made. Privacy Act 101 27
Individual’s Right of Access (1 of 2) • The Privacy Act permits only an "individual" to seek access to only his own "record, " and only if that record is maintained by the agency within a "system of records • Upon request an individual may allow a person of his own choosing to accompany him, to review the record and have a copy made of all or any portion, except that the agency may require the individual to furnish a written statement authorizing discussion of that individual's record in the accompanying person's presence. Privacy Act 101 28
Individual’s Right of Access (2 of 2) • An individual's access request for his own record maintained in a system of records should be processed under both the Privacy Act and the FOIA, regardless of the statute(s) cited in the request. • The accounting of disclosures must be kept for five years or the life of the record, whichever is longer. • Unless the records were shared for law enforcement purposes, the accounts of the disclosure should be available to the data subject upon request. PACOM Conference 29
Individual’s Right of Amendment (1 of 2) • • An individual has the right to request amendment to his record. The agency must acknowledge receipt in writing, and promptly, i. e. , within 10 working days of receipt of the amendment request o o Privacy Act 101 Make the requested correction, or Inform the individual of refusal of the request and provide a reason for the refusal, the agency’s procedure for a review of the refusal by the head of the agency and the name and business address of that official 30
Individual’s Right of Amendment (2 of 2) • The agency must permit an individual who disagrees with its refusal to amend his record to request review of such refusal, and not later than 30 working days from the date the individual requests such review, the agency must complete it. • If the reviewing official also refuses to make the amendment, the individual must be permitted to file with the agency a concise statement setting forth the reasons for disagreement with the agency. The individual's statement of disagreement must be included with any subsequent disclosure of the record. Privacy Act 101 31
Agency Requirements (1 of 10) • Maintain only information about an individual that is relevant and necessary to accomplish a legal purpose of the agency. • Collect information to the greatest extent practicable directly from the subject individual if that information may have an adverse effect upon that individual. Privacy Act 101 32
Agency Requirements (2 of 10) • When collecting information from the individual, include the following on the collection form or on a separate form that can be retained by the individual (popularly referred to as the Privacy Act Statement) o o o Privacy Act 101 The authority which authorizes the solicitation of the information Whether disclosure of such information is mandatory or voluntary The principal purpose or purposes for which the information is intended to be used The routine uses which may be made of the information, and The effects on the individual, if any, of not providing all or any part of the requested information. 33
Agency Requirements (3 of 10) • Publish in the Federal Register upon establishment or revision a notice of the existence and character of the system of records. The system of records notice shall include 1. 2. 3. 4. 5. Privacy Act 101 The name and location of the system The categories of individuals on whom records are maintained in the system The categories of records maintained in the system Each routine use of the records contained in the system, including the categories of users and the purpose of such use The policies and practices of the agency regarding storage, retrievability, access controls, retention, and disposal of the records 34
Agency Requirements (4 of 10) 6. 7. 8. 9. Privacy Act 101 The title and business address of the agency official who is responsible for the system of records The agency procedures whereby an individual can be notified at his request if the system of records contains a record pertaining to him The agency procedures whereby an individual can be notified at his request how he can gain access to any record pertaining to him contained in the system of records, and how he can contest its contents; and The categories of sources of records in the system. 35
Agency Requirements (5 of 10) • Maintain all records which are used by the agency in making any determination about any individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the determination. • Except in the case of FOIA releases, make reasonable efforts to assure that records are accurate, complete, timely, and relevant for agency purposes prior to disseminating any record about an individual to any person other than an agency. Privacy Act 101 36
Agency Requirements (6 of 10) • Maintain no record describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual about whom the record is maintained or unless pertinent to and within the scope of an authorized law enforcement activity. • Make reasonable efforts to serve notice on an individual when any record on such individual is made available to any person under compulsory legal process when such process becomes a matter of public record. Privacy Act 101 37
Agency Requirements (7 of 10) • Establish rules of conduct for persons involved in the design, development, operation, or maintenance of any system of records, or in maintaining any record, and instruct each such person with respect to such rules and the requirements of this section, including any other rules and procedures adopted pursuant to this section and the penalties for noncompliance. • Establish appropriate administrative, technical and physical safeguards to insure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity which could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained. Privacy Act 101 38
Agency Requirements (8 of 10) • At least 30 days prior to publication of information under a routine use(s) from a system of records, publish in the Federal Register notice of any new use or intended use of the information in the system, and provide an opportunity for interested persons to submit written data, views, or arguments to the agency. Privacy Act 101 39
Agency Requirements (9 of 10) • An agency that maintains a system of records "shall promulgate rules, in accordance with notice and comment rulemaking. 1. 2. 3. Privacy Act 101 Establish procedures whereby an individual can be notified in response to his request if any system of records named by the individual contains a record pertaining to him. Define reasonable times, places, and requirements for identifying an individual who requests his record or information pertaining to him before the agency shall make the record or information available to the individual. Establish procedures for the disclosure to an individual upon his request of his record or information pertaining to him, including special procedures, if deemed necessary, for the disclosure to an individual of medical records, including psychological records pertaining to him. 40
Agency Requirements (10 of 10) 4. Establish procedures for reviewing a request from an individual concerning the amendment of any record or information pertaining to the individual, for making a determination on the request, for an appeal within the agency of an initial adverse agency determination, and for whatever additional means may be necessary for each individual to be able to exercise fully his rights under the Act. 5. Establish fees to be charged, if any, to any individual for making copies of his record, excluding the cost of any search for and review of the record. Privacy Act 101 41
Penalties for Non-compliance • Civil Remedies o o • The cost of actual damages suffered ($1000 minimum) Costs and reasonable attorney’s fees. Criminal Penalties o Charge of a misdemeanor o Maximum fine of $5, 000 Privacy Act 101 42
Resources Privacy Act of 1974 Federal Register July 9, 1975 Privacy Act Implementation-Guidelines and Responsibilities DOJ Overview of the Privacy Act of 1974, 2010 edition OMB Circular A-130 Various OMB Memoranda Section 208 – E-Gov Act Federal Acquisition Regulations Privacy Act 101 43
Questions Privacy Act 101 44
Safeguarding PII United States Pacific Command (USPACOM) FOIA & Privacy Act Conference Samuel P. Jenkins, Director for Privacy Defense Privacy and Civil Liberties Office January 11 -13, 2011
Safeguarding PII Agenda: Do. D 5400. 11 -R Appendix 1 OMB M-07 -16 Requirements Privacy Impact Assessments (PIA) Safeguarding PII 46
Safeguarding PII Do. D 5400. 11 -R Appendix 1 Safeguarding PII 47
Do. D 5400. 11 -R Appendix 1 – Safeguarding PII Risk Management and Safeguarding Standards • • The sensitivity of the data being processed, stored and accessed. The installation environment. The risk of exposure. The cost of the safeguard under consideration. Safeguarding PII 48
Do. D 5400. 11 -R Appendix 1 – Safeguarding PII (cont’d. ) Minimum Administrative Safeguards • • Label or designate media products. Mark and protect all computer products containing classified data. Mark and protect all computer products containing “For Official Use Only” material. Ensure that safeguards for protected information stored at secondary sites are appropriate. Safeguarding PII 49
Do. D 5400. 11 -R Appendix 1 – Safeguarding PII (cont’d. ) Physical Safeguards • For all unclassified facilities, areas, and devices that process information subject to this Regulation • Develop access procedures • Safeguard on-line devices • Dispose of paper records Safeguarding PII 50
Do. D 5400. 11 -R Appendix 1 – Safeguarding PII (cont’d) Technical Safeguards • Components are to ensure that all PII not explicitly cleared for public release is protected according to Confidentially Level Sensitive, as established in Do. D Instruction 8500. 2. • Encrypt unclassified personal information in accordance with current Information Assurance (IA) policies and procedures, as issued. • Ensure that personal information is not inadvertently disclosed as residue when transferring magnetic media between activities. Safeguarding PII 51
Do. D 5400. 11 -R Appendix 1 – Safeguarding PII (cont’d) Special Procedures • Prepare and submit for publication all system notices and amendments and alterations thereto. • Identify required controls and individuals authorized access to PII and maintain updates to the access authorizations. • When required, ensure Privacy Impact Assessments are prepared consistent with the requirements of Section 3501 of title 44, U. S. C. Safeguarding PII 52
Do. D 5400. 11 -R Appendix 1 – Safeguarding PII (cont’d) Record Disposal • Dispose of records subject to this Regulation so as to prevent compromise. • Magnetic tapes or other magnetic medium may be cleared by degaussing, overwriting, or erasing. • Do not use respliced waste computer products containing personal data. Safeguarding PII 53
Safeguarding PII OMB M-07 -16 Requirements Safeguarding PII 54
Safeguarding PII OMB M-07 -16 implemented new PII safeguarding requirements. These requirements were implemented throughout Do. D in the June 5, 2009 Memorandum “Safeguarding Against and Responding to the Breach of Personally Identifiable Information (PII)”. Safeguarding PII 55
OMB M-07 -16 Requirements Attachment 1. Safeguarding PII A. Current Requirements 1. Privacy Requirements a. Establish Rules of Conduct b. Establish Safeguards c. Maintain accurate, relevant, timely, and complete information Safeguarding PII 56
OMB M-07 -16 Requirements Attachment 1. Safeguarding PII (cont’d. ) 2. Security Requirements a. Assign an impact level to all information and information systems b. Implement minimum security requirements and controls c. Certify and accredit information systems d. Train employees Safeguarding PII 57
OMB M-07 -16 Requirements Attachment 1. Safeguarding PII (cont’d. ) B. Privacy Requirements 1. Review and Reduce the Volume of Personally Identifiable Information a. Review Current Holdings 2. Reduce the Use of Social Security Numbers a. Eliminate Unnecessary Use b. Explore Alternatives Safeguarding PII 58
OMB M-07 -16 Requirements Attachment 1. Safeguarding PII (cont’d. ) C. Security Requirements Encryption Control Remote Access Time-Out Function Log and Verify Ensure Understanding of Responsibilities Safeguarding PII 59
Safeguarding PII Privacy Impact Assessments (PIA) Safeguarding PII 60
Safeguarding PII Privacy Threshold Assessment (PTA) DHS uses Privacy Threshold Assessments (PTA) to determine if a PIA is necessary. Do. D practice is to perform a PIA. Safeguarding PII 61
Safeguarding PII What is a PIA? A “Privacy Impact Assessment (PIA)--is an analysis of how information is handled: to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy, to determine the risks and effects of collecting, maintaining and disseminating information in identifiable form in an electronic information system, and to examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks. ” OMB 03 -22 (9/26/2003), EGOV 208(b) Safeguarding PII 62
Safeguarding PII When is a PIA Required? When PII is collected, a PIA is required for: Existing information systems and electronic collections where a PIA has not previously been completed to include systems that collect PII about Federal personnel and contractors. New information systems or electronic collections: Prior to developing or purchasing, and when converting paper-based records to electronic systems. Safeguarding PII 63
Safeguarding PII When is a PIA not Required? When the information system or electronic collection: Does not collect, maintain or disseminate personal identifying information Is a National Security System (including systems that process classified information) Safeguarding PII 64
Safeguarding PII PIA/SORN Essential Elements Crosswalk Safeguarding PII 65
Safeguarding PII Privacy Impact Assessment (PIA)/ System of Record Notice (SORN) Essential Elements Crosswalk PIA SORN What privacy information is collected Categories of Records in the System Why the information is collected Authority/Purpose(s) What the intended uses are for the information Purposes(s) With whom the information is shared Routine Uses What opportunities individuals have to decline to provide PII Privacy Act Statement/Notification procedure How information is secured Safeguards What privacy risks need to be addressed Narrative Statement/Probable or potential effects on the privacy of individuals. Whether a System of Records Notice (SORN) exists (Not applicable) Safeguarding PII 66
Safeguarding PII PRIVACY IMPACT ASSESSMENT (PIA) Do. D Information System/Electronic Collection Name: Do. D Component Name: SECTION 4: REVIEW AND APPROVAL SIGNATURES Prior to the submission of the PIA for review and approval, the PIA must be coordinated by the Program Manager or designee through the Information Assurance Manager and Privacy Representative at the local level. Program Manager or Other Official Signature (to be used at Component discretion) Component Senior Information Assurance Officer Signature or Designee Component Privacy Officer Signature Component CIO Signature (Reviewing Official) Source: DD Form 2930 Safeguarding PII 67
Safeguarding PII Critical Privacy – Security Interface PRIVACY Focused on meeting the information requirements of the Agency while ensuring the protection of the rights of the individual in the collection, use and dissemination of PII. SECURITY Privacy’s success is dependent on establishment of basic foundation for information security. Focused on protecting the information and information systems supporting the operations and assets of an organization. NIST Draft Guide to Protecting the Confidentiality of (PII) (1/09) Safeguarding PII 68
Resources Do. D 5400. 11 -R, Department of Defense Privacy Program, May 14, 2007. OMB M-07 -16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007. Do. D Implementation: Safeguarding Against and Responding to the Breach of Personally Identifiable Information (PII), June 5, 2009. DD Form 2930, “Privacy Impact Assessment (PIA), ” 2008. Safeguarding PII 69
FISMA Privacy Reporting Requirements United States Pacific Command (USPACOM) FOIA & Privacy Act Conference Presented by Samuel P. Jenkins, Director for Privacy, Defense Privacy & Civil Liberties Office January 2011
FISMA and Privacy Reporting Requirements Agenda: Federal Information Security Management Act (FISMA) – Division of Responsibilities FISMA Purpose The Reporting Requirements as found in the OMB A-130, Appendix I The eleven questions that report on annual Agency Privacy Program Oversight FISMA Annual Report to Congress PACOM Conference 71
FISMA and Privacy Reporting Requirements Federal Information Security Management Act (FISMA) – Division of Responsibilities PACOM Conference 72
FISMA and Privacy Reporting Requirements From Report GAO-07 -837 INFORMATION SECURITY, “Despite Reported Progress, Federal Agencies Need to Address Persistent Weaknesses , “ July 2007. PACOM Conference 73
FISMA and Privacy Reporting Requirements Federal Information Security Management Act - Purpose PACOM Conference 74
FISMA and Privacy Reporting Requirements Origin of FISMA: The E-Government Act (Public Law 107 -347) passed by the 107 th Congress and signed into law by the President in December 2002. Recognized the importance of information security to the economic and national security interests of the United States. PACOM Conference 75
FISMA and Privacy Reporting Requirements Title III of the E-Government Act, entitled the Federal Information Security Management Act of 2002 (FISMA) requires: Each federal agency to develop, document, and implement an agency-wide program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. FISMA, along with the Paperwork Reduction Act of 1995 and the Information Technology Management Reform Act of 1996 (Clinger. Cohen Act), explicitly emphasizes a risk-based policy for costeffective security. PACOM Conference 76
FISMA and Privacy Reporting Requirements In support of and reinforcing this legislation, the Office of Management and Budget (OMB) through Circular A-130, Appendix III, Security of Federal Automated Information Resources, requires executive agencies within the federal government to: Plan for security Ensure that appropriate officials are assigned security responsibility Periodically review the security controls in their information systems Authorize system processing prior to operations and, periodically, thereafter PACOM Conference 77
FISMA and Privacy Reporting Requirements In June 2005, OMB issued memo M-05 -15, “FY 2005 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management” which: Initiated a number of questions regarding agency’s privacy program (Section D of the report) Senior Agency Official for Privacy. These questions related, in part, to agency implementation of the privacy provisions of the EGovernment Act of 2002. PACOM Conference 78
FISMA and Privacy Reporting Requirements In April 2010, OMB issued memo M-10 -15 “FY 2010 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management ” which formed a comprehensive context for security and privacy of Federal information across government to include: The number of each type of privacy reviews conducted during the last fiscal year; Information about the advice-formal written policies, procedures, guidance, or interpretations of privacy requirements. PACOM Conference 79
FISMA and Privacy Reporting Requirements OMB memo M-10 -15 “FY 2010 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management” (Continued) The number of written complaints for each type of privacy issue allegation received to include: q Process and procedural issues (consent, collection, and appropriate notice); q Redress issues (non-Privacy Act inquiries seeking resolution of difficulties or concerns about privacy matters); or q Operational issues (inquiries regarding Privacy Act matters not including Privacy Act requests for access and/or corrections); For each type of privacy issue received for alleged privacy violations, the number of complaints the agency referred to another agency with jurisdiction. PACOM Conference 80
FISMA and Privacy Reporting Requirements OMB and Annual FISMA Reporting: Senior Agency Official for Privacy (SAOP) Questions PACOM Conference 81
FISMA and Privacy Reporting Requirements Assignment of Responsibilities. OMB Circular No. A-130, “Management of Federal Information Resources, ” November 28, 2000, Appendix 1. 3. a. states: All Federal Agencies. In addition…the head of each agency shall ensure that the reviews are conducted as often as specified in the accompanying chart. (next slide) Prepare to report to the Director, OMB, the results of such reviews and the corrective action taken to resolve problems uncovered. PACOM Conference 82
FISMA and Privacy Reporting Requirements OMB Circular No. A-130 Appendix 1. , Privacy Reviews Requirement Periodicity 1. Matching Programs Review annually 2. Recordkeeping Practices. Biennially 3. Privacy Act Training Biennially 4. Violations Biennially 5. Systems of Records Notices. Biennially 6. Section (m) Contracts. Every two years a random sample of agency contracts. 7. Routine Use Disclosures Every four years 8. Exemption of Systems of Records Every four years PACOM Conference 83
FISMA and Privacy Reporting Requirements Question 1: Information Security Systems Identify the number of agency and contractors systems that contain Federal information in identifiable form The number of agency and contractor systems for which a Privacy Impact Assessment (PIA) is required under the E-Gov Act and; q Identify the number of agency and contractor systems covered by an existing PIA. Identify the number of systems for which a system of records notice (SORN) is required under the Privacy Act and; q Identify the number of systems for which a current SORN has been published in the Federal Register. PACOM Conference 84
FISMA and Privacy Reporting Requirements Question 2: Links to PIAs and SORNS Provide the URL of the centrally located page on the agency web site listing working links to agency PIAs. Provide the URL of the centrally located page on the agency web site listing working links to the published SORNs. PACOM Conference 85
FISMA and Privacy Reporting Requirements Question 3: Senior Agency Official for Privacy (SAOP) Responsibilities Can your agency demonstrate through documentation that the privacy official: (Yes or No) Participates in all agency information privacy compliance activities (i. e. , privacy policy as well as IT information policy); Participates in evaluating the privacy implications of legislative, regulatory, and other policy proposals, as well as testimony and comments under OMB Circular A-19; Participates in assessing the impact of the agency’s use of technology on privacy and the protection of personal information? PACOM Conference 86
FISMA and Privacy Reporting Requirements Question 4: Information Privacy Training and Awareness Does your agency have: A policy to ensure that all personnel (employees, contractors, etc. ) with access to Federal data are generally familiar with information privacy laws, regulations and policies, and understand the ramifications of inappropriate access and disclosure? A program for job-specific and comprehensive information privacy training for all personnel (employees, contractors, etc. ) directly involved in the administration of personal information or information technology systems, or with significant information security responsibilities? PACOM Conference 87
FISMA and Privacy Reporting Requirements Question 5: Does the agency have a written policy or process for each of the following? PIA Practices: Determining whether a PIA is needed Conducting a PIA Evaluating changes in technology or business practices that are identified during the PIA process Ensuring systems owners, privacy officials, and IT experts participate in conducting the PIA Making PIAs available to the public as required by law and OMB policy Monitoring the agency’s systems and practices to determine when and how PIAs should be updated Assessing the quality and thoroughness of each PIA and performing reviews to ensure that appropriate standards for PIA are maintained PACOM Conference 88
FISMA and Privacy Reporting Requirements Question 5: Does the agency have a written policy or process for each of the following? Web Privacy Practices: Determining circumstances where the agency’s webbased activities warrant additional consideration of privacy implications Making appropriate updates and ensuring continued compliance with stated web privacy policies Requiring machine-readability of public-facing agency web sites (i. e. use of P 3 P) PACOM Conference 89
FISMA and Privacy Reporting Requirements Question 6: Reviews Mandated by Privacy Act of 1974, the E-Government Act of 2002, and the Federal Agency Data Mining Reporting Act of 2007. Indicate which reviews were conducted in the last year for the following: Requires a Check Mark Requires a Number Section M Contracts Exemptions Records Practices Matching Programs Routine Uses System of Records Training Privacy Act, (e)(3) Statements Violations: Civil Action and Remedial Action Privacy Impact Assessments and Updates Data Mining Impact Assessment PACOM Conference 90
FISMA and Privacy Reporting Requirements Question 7: Written Privacy Complaints Indicate the number of written complaints for each type of privacy issue received by the SAOP or others at the agency Process and Procedural -- consent, collection, and appropriate notice Redress -- non-Privacy Act inquiries seeking resolution of difficulties or concerns about privacy matters Operational -- inquiries regarding Privacy Act matters not including Privacy Act requests for access and/or correction Referrals – complaints referred to another agency with jurisdiction PACOM Conference 91
FISMA and Privacy Reporting Requirements Question 8: Policy Compliance Review Does the agency have current documentation demonstrating review of compliance with information privacy laws, regulations, and policies? Can the agency provide documentation of planned, in progress, or completed corrective actions necessary to remedy deficiencies identified in compliance reviews? PACOM Conference 92
FISMA and Privacy Reporting Requirements Question 8: Policy Compliance Review (Continued) Does the agency: Use technologies that enable continuous auditing of compliance with stated privacy policies and practices? Coordinate with the agency's Inspector General on privacy program oversight? PACOM Conference 93
FISMA and Privacy Reporting Requirements Question 9: Information About Advice Provided by the SAOP (Yes or No) Indicate if the SAOP has provided formal written advice or guidance in each of the listed categories, and briefly describe the advice or guidance if applicable. The categories are: Agency policies, orders, directives, or guidance governing agency handling of personally identifiable information’ Written Agreements (either Interagency or with Non. Federal Entities) pertaining to information sharing, computer matching, and similar issues PACOM Conference 94
FISMA and Privacy Reporting Requirements Question 9: Information About Advice Provided by the SAOP (Yes or No) (Continued ) Categories continued: The agency’s practices for conducting, preparing, and releasing SORNs and PIAs Reviews or feedback outside of the SORN and PIA process (e. g. formal written advice in the context of budgetary or programmatic activities or planning) Privacy Training (either stand-alone or included with training on related issues) q Provide the number of employees (or contractors) who participated in the training. PACOM Conference 95
FISMA and Privacy Reporting Requirements Question 10: Agency Use of Persistent Tracking Technology Indicate Yes or No for each item below: Does the agency use web management and customization technologies on any web site or application? Does the agency annually review the use of web management and customization technologies to ensure compliance with all laws, regulations, and OMB guidance? Can the agency demonstrate, with documentation, the continued justification for, and approval to use, web management and customization technologies? Can the agency provide the notice language or citation for the web privacy policy that informs visitors about the use of web management and customization technologies? PACOM Conference 96
FISMA and Privacy Reporting Requirements Question 11: Privacy Points of Contact Information Please provide the names, phone numbers, and e-mail addresses of the following officials: Agency Head Chief Privacy Officer Chief Information Officer Privacy Advocate Agency Inspector General Privacy Act Officer Chief Information Security Officer Reviewing Official for PIAs Senior Agency Official for Privacy POC for URL links provided in question #2 PACOM Conference 97
FISMA and Privacy Reporting Requirements Federal Information Security Management Act (FISMA) Privacy Reporting at the Agency Level PACOM Conference 98
FISMA and Privacy Reporting Requirements Conclusion: Our Agency Annual FISMA Reporting to OMB. From Report GAO-07 -837 INFORMATION SECURITY, “Despite Reported Progress, Federal Agencies Need to Address Persistent Weaknesses , “ July 2007. PACOM Conference 99
Resources OMB Memorandum M-10 -15, of April 21, 2010 “FY 2010 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management. ” Office of Management and Budget Circular No. A-130, November 28, 2000 “Management of Federal Information Resources” Federal Information Security Management Act of 2002 (Pub. L. 107347). OMB Memorandum M-07 -16, of May 22, 2007 “Safeguarding Against and Responding to the Breach of Personally Identifiable Information. ” FY 2008 Report to Congress on Implementation of The Federal Information Security Management Act of 2002. GAO Report 07 -837: INFORMATION SECURITY, Despite Reported Progress, Federal Agencies Need to Address Persistent Weaknesses, July 2007. PACOM Conference 100
Questions? PACOM Conference 101
SSN Reduction United States Pacific Command (USPACOM) FOIA & Privacy Act Conference Samuel P. Jenkins, Director for Privacy Defense Privacy and Civil Liberties Office January 11 -13, 2011
SSN Reduction SSNs are ubiquitous, used in all aspects of an individual’s personal and professional life. q SSNs are often collected unnecessarily, q q q Its pervasiveness makes it dangerous if lost, stolen, or compromised The SSN is an ‘easy’ identifier System Managers often want to collect the SSN ‘in case it’s needed’ Systems sometimes collect the SSN in order to retrieve records from other systems which use the SSN. It’s Not All About Social Security Numbers (SSNs) q q q SSNs are high profile, but not the only concerns. Have to think about all Personally Identifiable Information and collect only what is REALLY needed! This is about protecting ourselves, the organization and reducing the liability for both. SSN Reduction 103
Authorities: OMB Memorandum 07 -16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007, Reduction of the Use of Social Security Numbers. Directive-Type Memorandum (DTM) 07 -015 -USD(P&R), March 28, 2008 - Do. D Social Security Number (SSN) Reduction Plan; q Do. D Instruction is in development Purpose: It is Do. D’s goal to reduce or eliminate the use of SSN wherever possible. SSN Reduction 104
Questions SSN Reduction 105
Compliance Reporting - FISMA - Section 803 - Component Quarterly Reports
Compliance Reporting Purpose: To periodically review agency’s implementation procedures, policies, and guidelines relating to efforts to protect the Nation against terrorism. Due Date: Quarterly - To DPO by the 15 th of the month following the end of quarter. If the 15 th falls on a weekend, submit by COB the next work day. PACOM Conference 107
Compliance Reporting The “Section 803 Report” Report shall include information on the discharge of each of the functions of the officer concerned, including: - Information on the number and types of reviews undertaken; - The type of advice provided and the response given to such advice; - The number and nature of the complaints received by the department, agency, or element concerned for alleged violations; and - A summary of the disposition of such complaints, the reviews and inquiries conducted, and the impact of the activities of such officer. PACOM Conference 108
Compliance Reporting PACOM Conference 109
Where Does It All Go FISMA Report – Do. D CIO, IG and DPO inputs are drafted into one Do. D Report submitted to Congress. Section 803 Report – To eight different committees of Congress. Public posting. Breach Report – Information provided to Do. D Senior Privacy Official weekly. May share breach report with the Secretary of Defense. PACOM Conference 110
Resources Authority: National Security Intelligence Reform Act (Public Law 110 -53, Section 803) PACOM Conference 111
Questions? PACOM Conference 112
Breach Management United States Pacific Command (USPACOM) FOIA & Privacy Act Conference Presented by Samuel P. Jenkins, Director for Privacy, Defense Privacy & Civil Liberties Office January 2011
Breach Reporting Use DPO Lost, Stolen, or Compromised Personally Identifiable Information Breach report form Timeline: q q q 1 hour to the United States Computer Emergency Readiness Team (US-CERT) 24 hours to Senior Component Privacy Official 48 hours to Defense Privacy & Civil Liberties Office (DPCLO) 10 working days for individual notification If individual notification is delayed, the Deputy Secretary of Defense is informed by DPCLO . PACOM Conference 114
Breach Reporting What happens when a Breach Report is submitted to DPCLO? DPCLO compiles all reports and submits summary to SAOP Component Privacy Official submits breach report (initial and/or follow-up) DPCLO enters report information into database to find root causes and problem areas PACOM Conference 115
OMB M-07 -16 Requirements Attachment 2. Incident Reporting Existing Requirements A. 1. FISMA Requirements 2. Incident Handling and Response Mechanism Modified Agency Reporting Requirements B. 1. US-CERT Modification 2. Develop and Publish a Routine Use a. Effective Response b. Disclosure of Information Safeguarding PII 116
OMB M-07 -16 Requirements Attachment 3. External Breach Notification Background A. 1. Harm 2. Requirement 3. Threshold Questions 4. Chilling Effects of Notices Safeguarding PII 117
OMB M-07 -16 Requirements Attachment 3. External Breach Notification (cont’d. ) New Requirement B. 1. Whether Breach Notification is Required 2. Timeliness of the Notification 3. Source of the Notification 4. Contents of the Notification Safeguarding PII 118
OMB M-07 -16 Requirements Attachment 3. External Breach Notification (cont’d. ) New Requirement (cont’d. ) B. 5. Means of Providing Notification 6. Who Receives Notification: Public Outreach in Response to a Breach Safeguarding PII 119
OMB M-07 -16 Requirements Attachment 4. Rules and Consequences New Requirement: Rules and Consequences Policy A. 1. Affected Individuals 2. Affected Actions 3. Consequences Safeguarding PII 120
Do. D Implementation Of OMB Requirements Part III. Review of PII Holdings As part of this year's instructions for FISMA privacy reporting, Do. D Components will be required to: Confirm that they have established, or are in the process of establishing, PII review plans; Provide a schedule by which they will periodically update their review of their holdings following the initial review. Safeguarding PII 121
Do. D Implementation Of OMB Requirements Part III. Review of PII Holdings (cont’d) It shall be Do. D policy that: A. DITPR identifies all Components' automated systems containing Pl. I. B. Updates to OMB designed so that: 1) IT systems with PII reviewed on same cycle as DIACAP. 2) PIA SORNs reviewed at least once every two years. C. Components shall report results to DPO on FISMA schedule. Safeguarding PII 122
Do. D Implementation Of OMB Requirements Part IV. Incident Reporting and Handling Requirements A. Agency Reporting Requirements B. External Breach Notification Requirements C. Timeliness of the Notification Safeguarding PII 123
Do. D Implementation Of OMB Requirements Part IV. Incident Reporting and Handling Requirements (cont’d. ) D. Source of the Notification E. Contents of the Notification F. Means of Providing Notification G. Who Receives Notification Safeguarding PII 124
Breach Management - Laptops Physical security Car break-ins Leaving laptops unattended in public locations Thefts at personal residences or offices Technical safeguards Encryption CAC-enabled Password protection PACOM Conference 125
Breach Management – Personal Equipment Breaches have involved the use of personal hard drives, laptops and thumb drives. Only the use of Do. D authorized equipment is permitted. Do. D issued equipment. Contractor furnished equipment where it has been certified that technical requirements have been met. Specific language must be in contract. Authorized for official business purposes only. PACOM Conference 126
Breach Management – Media Sanitation Ensure paper records containing PII are removed from file cabinets prior to disposal or warehousing. Work with your IT POC to ensure all computers and other devices (e. g. , blackberries, copiers and printers) that may contain PII are routinely wiped prior to disposal. To understand more about media sanitization read NIST SP 800 -88. PACOM Conference 127
Where Does It All Go Breach Report – Information provided to Do. D Senior Privacy Official weekly. May share breach report with the Secretary of Defense. FISMA Report – Do. D CIO, IG and DPO inputs are drafted into one Do. D Report submitted to Congress. SSN Reduction Report –Input into the annual FISMA Report submitted to Congress. SORNs/Training Report – To OMB Director (Do. D IG Interest item). Section 803 Report – To eight different committees of Congress. Public posting. PACOM Conference 128
Resources Authorities: OMB Memorandum 07 -16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 2, 2007; q Parts I and IV, of the Do. D Memorandum, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, June 5, 2009 q Do. D 5400. 11, Do. D Privacy Program, May 8, 2007; q Do. D 5400. 11 -R Chapter 10, Department of Defense Privacy Program, May 14, 2007 and; q DA&M Memorandum, Safeguarding Personally Identifiable Information, June 15, 2006 Purpose: To alert the appropriate authorities when a loss, theft, or compromise of information occurs in the Department Due Date: IAW the 1 -24 -48 (10) timeline… PACOM Conference 129
Questions? PACOM Conference 130
SYSTEMS OF RECORDS NOTICES (SORNS) Privacy Act Training presented by Samuel P. Jenkins, Director for Privacy Defense Privacy and Civil Liberties Office 11 January 2011
Agenda Definitions Responsibilities: q Privacy Officials q Privacy Offices Types of SORNS Guidelines Questions Handouts System of Records Notices 132
Definitions PERSONALLY IDENTIFIABLE INFORMATION (PII) q PII refers to information which can be used to distinguish or trace an individual’s identity, such as their name, Social Security Number (SSN), biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc. System of Records Notices 133
Definitions SYSTEM OF RECORDS: q q Record Group of Records Under the control of an Agency Retrieved by name, SSN, or other personal identifier. SYSTEM OF RECORDS NOTICE (SORN): q Serves to notify the public (i. e. individuals): Is published in the Federal Register Authorizes the collection and use of PII System of Records Notices 134
Responsibilities PRIVACY OFFICIALS: q Execute the organization’s Privacy Program Ensure: q q q Ensure that Privacy Act records are properly described Undeclared systems of records are identified Provide Privacy Act Statements Biennial SORN reviews and updates are completed Submit new SORNs and updates to the Defense Privacy and Civil Liberties Office System of Records Notices 135
Responsibilities (con’t) Privacy Offices: q Work in collaboration with System Managers Ensure: q q Component SORNs are submitted to Component Privacy Officials Implement appropriate procedures and safeguards for all systems maintained under their purview All personnel with access to each system are aware of their responsibilities under the Privacy Act. Coordination of biennial reviews on SORNs with system managers within their purview System of Records Notices 136
Types of SORNS Addition q New system of records Alteration q Significant changes to an existing system of records Amendment q Minor/administrative changes to a system of records Deletion q may be due to decommissioned system or covered under another notice System of Records Notices 137
SORN Categories 1. 2. 3. 4. 5. 6. 7. 8. 9. System identifier System name System location Categories of individuals covered by the system Categories of records in the system Authority for maintenance of the system Purpose(s) Routine uses Storage 10. 11. 12. 13. 14. 15. 16. 17. 18. Retrievability Safeguards Retention and disposal System manager(s) and address Notification procedures Record access procedures Contesting record procedures Record source categories Exemptions claimed for the system System of Records Notices 138
Privacy Act System of Records Notice System Identifier: “DHA 04” 1. The Component Privacy Office will assign the notice number. Example: “DHA” - The letters “DHA” indicate “Defense Human Resource Activity, ” records under the Office of the Secretary of Defense; The number “ 04” represents the publication series number related to the subject matter; and 2. System Name: If changes are needed please ensure that it identifies the system‘s general purpose. This field is limited to 55 characters. System of Records Notices 139
System of Records Notice (con’t) 3. System Location: q q The complete mailing address of each location where the record system is maintained must appear in this caption. Spell out office names. For geographically or organizationally decentralized system locations, “indicate that the official mailing addresses are published as an appendix to the Component's compilation of system of records notices”. Do not use office symbols, web links, or Post Office boxes. i. e. , Office of the Secretary of Defense, Director of Readiness, Programming and Assessment, 4000 Defense Pentagon, Washington, DC 20301 -4000. System of Records Notices 140
System of Records Notice (con’t) Categories of Individuals Covered by the System: Identify in clear, non-technical terms, individual’s records being maintained. 4. q q living person who is a citizen of the U. S. alien lawfully admitted for permanent residence. Avoid using broad descriptions like “all Do. D personnel” unless that is truly accurate. Corporations, partnerships, sole proprietorships, professional groups, businesses, and other commercial entities are not “individuals”. Example: “Department of Defense civilian employees; contractors; Active Duty services personnel; and civilian employees from other federal agencies. ” System of Records Notices 141
System of Records Notice (con’t) 5. Categories of Records in the System: Describe in clear plain language, all categories of records and items of PII in the system. q q Do not identify source documents used to collect data. Provide the public with detailed information about the PII contained in the SORN. If your system of records notice covers a database, print out the data elements to verify the PII and records maintained. Do not use overly broad terms or identify forms unless accompanied by a brief explanation. System of Records Notices 142
System of Records Notice (con’t) 6. Authority for Maintenance of the System: A Federal law or Executive Order of the President that must authorize the collection and maintenance of a system of records. Cite the specific law or Executive Order that authorizes the maintenance of the system. Cite the Do. D directive/instruction or Departmental Regulation(s) that authorizes the Privacy Act system of records. This is especially Important when using general statutory grants of authority statute (“internal housekeeping”) as the primary authority. Always include titles with the citations. System of Records Notices 143
System of Records Notice (con’t) 7. Purpose(s): List the specific purposes for establishing and maintaining the system of records by your activity. For example: The purpose of the system of records is to provide a single central facility within the Department of Defense to assess manpower trends, support personnel and readiness functions, to perform longitudinal statistical analyses, identify current and former Do. D civilian and military personnel for purposes of detecting fraud and abuse of pay and benefit programs. Also used as a management tool for statistical analysis, tracking, reporting, evaluating program effectiveness and conducting research. System of Records Notices 144
System of Records Notice (con’t) 8. Routine Use(s): Routine uses shall be written as follows: "To the user and what they do with the information (purpose/objective)”. List all non-Do. D agencies and entities including private sector entities that will routinely provide access to the data or be given the data upon request. List the specific activity or element within the agency/entity which the Record may be disclosed. For example: “To the Veterans Administration” or “To State and local health agencies”. For each routine use identified, include a statement as to the purpose or purposes for which the record is to be released. Do not use general statements, such as “To other federal agencies as required” or “To any other appropriate federal agency”. For example: To the Department of Veterans Affairs for the purpose of using the information in benefit determinations. System of Records Notices 145
System of Records Notice (con’t) 9. Storage: State the medium in which the records are maintained. Example: “Maintained in paper files and on electronic storage media”. 10. Retrievability: State how the agency retrieves the records Example: Name, Social Security Number (SSN), or by fingerprints. System of Records Notices 146
System of Records Notice (con’t) Safeguards: 11. Identify the system safeguards. Describe safeguards fully without compromising system security. Describe the facility/building safeguards, then the room, then the computer/file cabinet. Indicate the personnel getting access to the information. Example: “Records are maintained in a controlled facility. Physical entry is restricted by the use of locks, guards, and is accessible only to authorized personnel. Access to records is limited to person(s) with an official “need-to-know” who are responsible for servicing the record in performance of their official duties. Persons are properly screened and cleared for access. Access to computerized data is role-based and further restricted by passwords, which are changed periodically”. System of Records Notices 147
System of Records Notice (con’t) Retention and Disposal: 12. Use the National Archives and Records Administration (NARA) approved disposition. If records are eventually to be destroyed, state the method of destruction (e. g. , shredding, burning, pulping, etc. , ). If, and only if, your activity has sent for NARA approval of the disposition scheduled, the following can be used until the Agency receives an approved disposition: “Disposition pending (treat records as permanent until the National Archives and Records Administration has approved the retention and disposition schedule. “ - http: //www. archives. gov/ System of Records Notices 148
System of Records Notice (con’t) 13. System Manager(s) and Address: List the position title and duty address of the system manager. Please do not Include names or phone numbers. Example: “Policy Official, Commander, Military Service Base, 1234 Virginia Ave, Virginia Beach, VA XXXXX-XXXX. ” 14. Notification Procedures: The entry should read as follows: “Individuals seeking to determine whether this system of records contains information about themselves should address written inquiries to the Director, Office of Personnel, 1234 Virginia Ave, Virginia Beach, VA XXXXX-XXXX. Specify the information the requester must submit. Example: Written request must include full name, military status, Social Security Number (SSN), and date of birth. System of Records Notices 149
System of Records Notice (con’t) 15. Records Access Procedures: The entry should read as follows "Individuals seeking access to information about themselves contained in this system should address written inquiries to the Freedom of Information Act Office, Defense Component Agency, XXX Mac. Dill Lane, Washington DC XXXXX-XXXX. ” Individuals should provide their full name, current address, telephone number and Social Security Number (SSN). 16. Contesting Records Procedures: The standard language to use is “The Do. D Component Name rules for accessing records, and for contesting contents and appealing initial agency determinations are contained in Do. D Component Regulation ; XX CFR part 222; or may be obtained from the system manager. ” System of Records Notices 150
System of Records Notice (con’t) 17. Record Source Categories: Show categories of individuals or other information sources for the system. Describe where the information maintained in the system is obtained from (source documents and other agencies). Describe the record sources in general terms. Example: “From individual’s, Do. D records, law enforcement agencies, etc. ” System of Records Notices 151
System of Records Notice (con’t) 18. Exemptions Claimed for the System Types of Exemptions: q q q Access (subsection 552 a(d)(5) General (subsection 552 a(j)) Specific exemptions (subsection 552(k)) Exemptions: If no exemption has been established for the system indicate "None". System of Records Notices 152
Guidelines Remember the audience q Correct simple errors q Write in a manner the public understands Spell check Explain Acronyms q q Spell out acronyms the first time Cite Legal Authorities Statutes, Do. D Regulations, E. O. 9397 (SSN), as amended System of Records Notices 153
Resources Privacy Act of 1974 Do. DD 5400. 11, Do. D Privacy Program Do. D 5400. 11 -R, Do. D Privacy Program Various OMB Memoranda Section 208 - E-Gov Act Federal Acquisition Regulations System of Records Notices 154
Questions System of Records Notices 155
Privacy Act Implementation Challenges Social Security Number Use Reduction (2 of 2) Review existing and new forms Submit annual report with FISMA report Crosscheck system inventories and systems of records notices Reporting and Notification 156
Privacy Act Implementation Challenges Web 2. 0 "Web 2. 0 is fundamentally social, treating the individual at the center of the universe as opposed to groups or organizations, and then basing communication and information paths on social relationships between individuals. ” Roundtable Topics Stowe Boyd, Do. D Web 2. 0 Guidance Forum 157
Privacy Act Implementation Challenges Web 2. 0 Concerns Roundtable Topics Favorite target of hackers Posting inappropriate content Offensive language PII (posting own or someone else’s) National security Personnel must ensure information posted to official social networking site is approved for public use Continuous monitoring is imperative 158
Privacy Act Implementation Challenges Identity Theft Constant threat to our organization Enforce awareness among personnel Report all breaches to DPO Conduct risk analysis to determine next steps in individual notification FTC Identity Theft Site http: //www. ftc. gov/bcp/edu/microsites/idtheft/ Roundtable Topics 159
Privacy Act Implementation Challenges Contractor Oversight (1 of 2) When an agency provides by contract for the operation by or on behalf of the agency of a system of records to accomplish an agency function, the agency shall, consistent with its authority, cause the requirements of Section (m) to apply to such system, and Any such contractor and any employee of such contractor shall be considered to be employees of an agency. Roundtable Topics 160
Privacy Act Implementation Challenges Contractor Oversight (2 of 2) FAR 52. 224 -1 Privacy Act Notification http: //www. defenselink. mil/privacy/files/sites_of_interest/FAR _52_224_1. pdf FAR 52. 224 -2 Privacy Act http: //www. defenselink. mil/privacy/files/sites_of_interest/FAR _52_224_2. pdf DFAR Part 224 - Protection of Privacy and Freedom of Information http: //farsite. hill. af. mil/reghtml/regs/far 2 afmcfars/fardfars/dfars 224. htm Roundtable Topics 161
Resources Privacy Act of 1974 Federal Register July 9, 1975 Privacy Act Implementation-Guidelines and Responsibilities DOJ Overview of the Privacy Act of 1974, 2010 edition OMB Circular A-130 Various OMB Memoranda Section 208 – E-Gov Act Federal Acquisition Regulations Roundtable Topics 162
Questions Roundtable Topics 163
Скачать презентацию DPCLO ABOUT THE OFFICE The mission of the
f36c54c6d589334c366c64c068ad451b.ppt