FEDERAL BUREAU OF INVESTIGATION
PRIVACY IMPACT ASSESSMENT
Something For Every Child (SOFEC) Database
10/31/2005
I. BACKGROUND
This PIA is conducted pursuant to the E-Government Act of 2002, P.L. 107-347, the accompanying guidelines issued by the Office of Management and Budget (OMB) on September 26, 2003, and the FBI's own PIA guidelines. The PIA provides information regarding the collection of personally identifiable information for the purpose of purchasing Christmas gifts for underprivileged children.
The SOFEC program is a community outreach partnership the FBI formed with a local elementary school in Washington, D.C., to provide gifts to underprivileged children during the holiday season. Under the SOFEC program, FBIHQ employees may select a child and purchase gifts consistent with the child's age, gender and wish list. Staff at the elementary school obtain the consent of the parents/guardians of the selected children. The school staff then provides the children's names, gender, ages, grades, clothing size, etc., to FBI SOFEC program administrators. FBI program administrators make the information about the children available to FBI employees - less the child's name - for the purposes of purchasing a holiday gift.
II. ASSESSMENT
A. What information is to be collected?
The SOFEC database contains personally identifiable information such as the child's first name, last name, age, grade, clothing sizes, favorite color, favorite activities, and a "wish list."
B. Why is the information being collected?
The information is being collected so that FBI employees can purchase and disseminate gifts for underprivileged children during the holiday season.
C. What is the intended use of the information?
Information is used to purchase and disseminate gifts for underprivileged children from a local elementary school. The information is used by the FBI office that administers the program to track gifts and ensure that each child receives a gift. The information also assists employees in selecting children to sponsor and purchasing gifts for those children.
D. With whom will the information be shared?
Information is shared with FBI employees accessing the database via the FBI Intranet. However, the child's name will not generally be available to FBI employees. FBI employees are given access to a child's gender, age, grade, clothing size, etc. The full information is available to FBI personnel administering the program. All of the information is purged each year at the program's conclusion.
E. What notice or opportunities for consent would be provided to individuals regarding what information is collected and how that information is shared?
Participation in the program is strictly voluntary. Prior to providing the names of the children to the FBI, staff at the elementary school obtain parental consent.
F. How will the information be secured?
The information is secured using the FBI's internal network which is password protected. All records are maintained in a secure government facility with access limited to only authorized personnel or authorized and escorted visitors. Physical security protections include guards and locked facilities requiring badges and passwords for access. Records are accessed only by authorized government personnel and are protected by appropriate physical and technological safeguards to prevent unauthorized access.
The program administrator has access to the child's first and last name, as well as other SOFEC program information. Employees participating in the program are only able to view the child's gender, age, gift selection, etc. and are not provided with a child's name.
G. Is a system of records being created under section 552a of title 5, United States Code, (commonly referred to as the "Privacy Act")?
Yes. The database contains identifiable information about individuals and information will be retrieved by name or a personal identifier. However, the records are part of the FBI Central Records System (Justice/FBI-002) and no new Privacy Act system notice is required.
H. What choices did the FBI make regarding an IT system or collection of information as a result of performing the PIA?
The FBI has taken several steps to protect the privacy of the individuals involved in the SOFEC program. First, children's names are only available to a limited number of individuals who administer the program in order to limit the impact on the privacy of the program participants. The FBI determined that a child's name is not needed to purchase gifts and children will be identified to FBI employees with a number substituted for their name. Second, to further protect the personal privacy of the participants in the program, the FBI purges the database each year at the program's conclusion. Finally, the school staff is required to obtain consent from the parents of participating children.
III. APPROVAL
The FBI's Senior Privacy Official has reviewed the proposed SOFEC database and, taking into account the need for this database and the privacy risks and protections discussed herein, approves the FBI's use of this database.
