FEDERAL BUREAU OF INVESTIGATION
PRIVACY IMPACT ASSESSMENT (PIA)
ELECTRONIC QUESTIONNAIRE
FOR INVESTIGATIONS PROCESSING (E-QIP)
September 12, 2005
I. BACKGROUND
This PIA is conducted pursuant to the E-Government Act of 2002, P.L. 107-347, and the accompanying guidelines issued by the Office of Management and Budget (OMB) on September 26, 2003. The PIA provides information regarding the collection of personally identifiable information for the purpose of accepting and analyzing applications for employment with the FBI.
The FBI's Senior Privacy Official has reviewed both this privacy impact assessment (PIA) and the Office of Personnel Management's (OPM's) PIA for the Electronic Questionnaire for Investigations Processing (e-QIP). The e-QIP system is an E-Government solution. Instead of distributing paper forms to prospective applicants and subjects of investigation, applicants will be authorized to use the e-QIP system to complete investigative forms on-line. The e-QIP system automates the Federal Government's hiring process, so that applicants fill out the Standard Form 86 (SF-86) on OPM's website and submit the information to OPM's server, where it remains. Meanwhile, as described in detail below, the applications are transferred from OPM to the relevant Federal agencies. Although the FBI could develop a similar system and keep all applications internally, SecD's analysis of time and resource allocation indicate that it would be more cost-effective to use OPM's already-developed e-QIP system.
II. ASSESSMENT
A. What information is to be collected?
The information contained within the SF-86 will be collected. This information can be extremely sensitive and includes an applicant's name, date of birth, social security number, mother's maiden name, mailing address, phone numbers, medical notes, financial account information, legal information (e.g. divorce decree docket number, information about civil court actions or criminal history), education record information, military status, employment history and status, foreign activities, and drug and alcohol use history. It also includes the name, date of birth, and address of all close relatives, as well as the names and telephone numbers of three people who know the applicant well.
B. Why is the information being collected?
The information is being collected so that the FBI can analyze an applicant for hiring and security purposes. The same information has been collected prior to this system; however, it was previously filled out by hand or printed out of a computer and then mailed to the agency. This system alters the application process in that applications will be filled out electronically, sent to OPM over a secure internet connection, and sent by OPM to the FBI over a secure internet connection. The information will remain on OPM's server for fifteen years in case the applicant reapplies to another Federal agency; however, once sent to the FBI, the applicant's information will be purged of any electronic "tags" identifying the applicant as an FBI candidate.
C. What is the intended use of the information?
The information will be used to assess whether an offer of employment will be extended to the applicant. The FBI is considering using the system for the reinvestigation process as well.
D. With whom will the information be shared?
Appropriate FBI employees with a need for the information in order to initiate, review, and approve or reject applications for employment will have access to the information as needed. If the applicant is conditionally accepted for employment, the information will be shared with the FBI employee(s) or contractor(s) involved in the background investigation. The information may also be shared as noted in the "Disclosure of Information" and "Privacy Act Routine Uses" sections of the SF-86, both of which are found on page 2 of the form. The SF-86 will remain on the OPM system and will be available to another agency if the individual applies to that agency in the future.
E. What notice or opportunities for consent would be provided to individuals regarding what information is collected and how that information is shared?
The applicant is provided with notice as to what information is collected as he or she voluntarily supplies the information by filling out the SF-86. The applicant effectively consents to the information collection by voluntarily sending it to OPM. The applicant is provided notice regarding how that information is shared in the "Disclosure of Information" and "Privacy Act Routine Uses" sections of the SF-86, both of which are found on page 2 of the form. Providing all information on the SF-86 is a prerequisite for consideration during the background investigation process.
F. How will the information be secured?
The e-QIP system has been certified and accredited through both OPM and the FBI's Security Division. All transmissions will take place on secure servers. The system will maintain audit logs of user activity.
G. Is a system of records being created under section 552a of title 5, United States Code, (commonly referred to as the "Privacy Act")?
No. This is a system operated by OPM. OPM's Privacy Act System of Records Notice for the Personnel Investigations Records is located in the Federal Register at Vol. 60, No. 236, December 8, 1995, page 63075, an update from the prior Federal Register notice at Vol. 58, No. 68, April 12, 1993. This notice was published prior to the use of electronic applications. FBI application records are contained in the FBI Central Records System (CRS), published on February 20, 1998, in the Federal Register at Vol. 63, No. 34, page 8671.
H. What choices the did the FBI make regarding an IT system or collection of information as a result of performing the PIA?
The FBI's use of this system means that applicant information, including those applicants accepted by the FBI, will be stored on a server outside of FBI control. Historically, the FBI has been very wary about doing this, not only for IT security reasons, but also for personnel security/protection reasons. Based on the FBI Security Division's assessment of the security of OPM's system and of the FBI's connectivity to the system, relevant divisions within the FBI were assured that the security requirements of this system are sufficient for protecting the privacy of the individuals and the security of the FBI.
As a result of performing this PIA, relevant FBI divisions entered into a dialogue regarding OPM's desire to retain the application for fifteen years. SecD consulted with OPM, reviewed the security requirements, and determined that the levels of security at OPM and inherent in the transfer systems were sufficient to protect the personally-identifiable information as it resides at OPM and as it is transferred. This system is part of a government-wide initiative to use electronic forms and to save time for applicants to the Federal government. As such, OPM plans to keep applicant records available to applicants for future use. However, any identification of the record as having been requested by the FBI will be removed within fifteen days.
Another consideration to using this system is that some applicants may not wish to disclose such personal information over the internet, and may decide to forego applying to the FBI. As a result of these concerns, the FBI set up a telephone number for applicants to call if they do not want to submit their applications online, cannot submit them online, or have any other problems transmitting applications.
III. APPROVAL
Based on the foregoing, the FBI Senior Privacy Official has determined that the system developers have addressed any privacy concerns. Taking into account the need for this system and the privacy risks and protections discussed herein, the FBI's Senior Privacy Official approves the FBI's use of this system.
