Return to Home PageThe following laws and regulations establish specific requirements for the confidentiality, integrity, and availability of the data processed, stored, and transmitted by the EEOC Integrated Mission System (IMS):
Computer Fraud and Abuse Act of 1984
Federal Information Security Management Act of 2002
OMB February 1996 Circular A-130, Appendix III
Paperwork Reduction Act of 1980
Privacy Act of 1974
Title VII of the Civil Rights Act of 1964, as amended
Equal Pay Act of 1963, as amended
Age Discrimination in Employment Act of 1967, as amended
Sections 501 and 505 of the Rehabilitation Act of 1973
Title I and Title V of the Americans with Disabilities Act of 1990, as amended
The Civil Rights Act of 1991
EEOC Order 240.005, EEOC Information Security Program
EEOC Order 240.005, Appendix A, Information Security Responsibilities of EEOC Employees
EEOC Order 150.003, Privacy Act of 1974, as amended
Public laws and regulations applicable to all federal agencies
The individual’s right to privacy must be protected in Federal Government information activities involving personal information. This assessment addresses the privacy impact of the EEOC Assessment System.
1. Generally describe the information to be used in the system in each of the following categories: Complainant, Company, EEOC Employee, Other.
The IMS provides users with five different support capabilities as follows:
Due to the risk associated with maintaining an individual’s Social Security Number, this data is no longer maintained or stored within the IMS.
2. What are the sources of the information in the system?
Sources of information are defined by jurisdictional definitions originating in statute and regulation. Primary sources of information are from the charging party/complainant, respondent/agency, and EEOC/FEPA staff.
2.1. What EEOC files and databases are used?
All data is stored within the structure of the IMS database, housed within EEOC headquarters.
2.2. What Federal Agencies are providing data for use in the system?
Only within the data stored for IMS Federal Hearings and Federal Appeals would data from other Federal Agencies appear in the complaint or Appeal record. The data provided by the Federal Agency in this situation is information included in the case file filed with the Federal Agency’s EEO office.
2.3. What State and Local Agencies are providing data for use in the system?
EEOC’s Fair Employment Practices Agency (FEPA) State and local government partners use the IMS system to enter and maintain their charges of employment discrimination. FEPAs may also create and maintain information on State and local charges that are outside of EEOC’s federal jurisdiction.
2.4. What other third party sources will data be collected from?
None.
2.5. What information will be collected from the complainant or company?
The complainant, also referred to as the charging party or appellant, can provide the following information:
The company, also referred to as the respondent or agency, can provide the following information:
3. How will data collected from sources other than EEOC records and the complainant or company be verified for accuracy?
All data is provided by the complainant, charging party, or appellant and is verified by an EEOC employee through direct communication as a part of the follow-up and investigation process.
3.1. How will data be checked for completeness?
Certain data fields are monitored as a part of the data entry functionality to ensure completeness of required fields.
3.2. Is the data current? How do you know?
Data currency is dependent on the status of the charge. It is validated and updated throughout the life cycle of the charge/complaint/case, however is no longer updated once the charge/case/complaint is resolved or closed. Charging party records may be updated after closure, if the individual files an additional charge/case/complaint with the EEOC or FEPA.
4. Are the data elements described in detail and documented? If yes, what is the name of the document?
Data elements are described in the module specifications for each application of the IMS.
5. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Other)?
Each application has a system owner who controls access authorization for individuals under their purview. Should these individuals need access, a request is forwarded to the EEOC’s Office of Information Technology (OIT) and processed. In addition to EEOC/FEPA staff users, IMS database administrators, IMS system administrators, IMS developers, and help desk support personnel have access to the IMS system.
6. How is access to the data by a user determined? Are criteria, procedures, controls, and responsibilities regarding access documented?
Each application has profile elements determined to control access within the system, down to particular elements of a charge, case, or complaint record. Each user is granted an independent profile per application which controls access to IMS data at the application and form level. Access level is determined by the EEOC/FEPA office director, for field employees. For HQ employees, access level is determined by their office director, in conjunction with the specific application’s system owner, thereby ensuring even greater restriction of access to IMS data.
7. Will users have access to all data on the system or will the users’ access be restricted?
Access to data in the IMS database is first restricted by each application in the system and then by the access profile established for the user. Degree of access is controlled and monitored at the office director level. Whereas some users have access to read, but not modify all data contained within the IMS database, most are restricted in their access and abilities to viewing a limited scope of data and modifying only data sets pertaining to their own investigations/cases.
8. What controls are in place to prevent the misuse (e.g. browsing) of data by those having access?
Applications (with the exception of Federal Appeals) do not allow deletion of any data, and also log the name of the individual that last updated a record. Federal Appeals does allow deletion of records, but a log file records every transaction. All users within the IMS must agree to and accept the IMS Rules of Behavior prior to being granted any access to data within the applications.
9. Do other systems share data or have access to data in this system? If yes, explain. Who will be responsible for protecting the privacy rights of the taxpayers and employees affected by the interface?
EEOC’s Document Management System (DMS) has access to IMS data for the purposes of relating appeal record information to stored files within DMS. EEOC is responsible for protecting the privacy rights of the taxpayers and employees affected by the interface.
10. Will other agencies share data or have access to data in this system (International, Federal, State, Local, Other)?
The only agencies that have direct access to data within the IMS database are the FEPAs, which conduct investigations of employment discrimination via contract with the EEOC. Part of their contract includes stipulations that they will abide by EEOC’s rules and regulations. These offices are limited to the data “accountable” to their office. Other research agencies contracted with EEOC also receive extracted information for the purposes of conducting their research. All extracted data is requested through appropriate channels and output content is controlled by EEOC.
11. How will the data be used by the agency? Who is responsible for assuring proper use of the data?
EEOC and FEPA offices use this data for the purposes of intake and investigation of charges of employment discrimination. EEOC and FEPA staff are responsible for assuring proper use of the data, which is enforced by EEOC policies and laws.
12. How will the system ensure that agencies only get the information they are entitled to under applicable statutes or regulations?
IMS security controls tightly restrict any FEPA access to only those charge records “accountable” to their respective office. Although EEOC’s offices may view records within the entire database, their ability to modify or write to those records is greatly restricted.
13. Is the use of the data both relevant and necessary to the purpose for which the system is being designed?
Yes.
14. Will the system derive new data or create previously unavailable data about an individual through aggregation from the information collected?
No.
14.1. Will the new data be placed in the individual’s record (complainant or company)?
Not applicable.
14.2. Can the system make determinations about complainants or companies that would not be possible without the new data?
Not applicable.
14.3. How will the new data be verified for relevance and accuracy?
Not applicable.
15. If data is being consolidated, what controls are in place to protect the data from unauthorized access or use?
The application is hosted in a secure environment protected by the appropriate fire walls, security certificates, encryption, IT infrastructure, and internal operational and managerial controls. Intrusion detection, as well as other security controls, is implemented. Physical security to the room that houses the IMS servers is tightly restricted. A third-party IT security risk assessment was conducted on the application and infrastructure prior to release.
15.1. If processes are being consolidated, are the proper controls remaining in place to protect the data and prevent unauthorized access? Explain.
Access to the IMS data is granted by EEOC Office Directors, based on business needs. The appropriate security controls are in place to protect the data and prevent unauthorized access. These controls have been verified through a third party risk assessment.
16. How will the data be retrieved? Can it be retrieved by personal identifier? If yes, explain. What are the potential effects on the due process rights of complainants or companies of: consolidation and linkage of files and systems; derivation of data; accelerated information processing and decision making; use of new technologies. How are the effects to be mitigated?
Outside individuals, including charging parties and respondents, are not allowed access to the IMS data. Data retrieval is only allowed to authorized EEOC and FEPA staff via correct entry of the login/password combination. EEOC and FEPA staff may retrieve data by using search parameters that typically include an individual’s name or company/agency name. Addresses and charge/complaint/case numbers can also be used to search for specific data.
There is no effect on due process rights when individual data is retrieved by staff. When aggregate data is retrieved and analyzed by research staff, the effect may be at a macro level in terms of agency-wide policy development. Decision-making at an individual or macro level is not controlled by technology tools. Rather, technology tools are utilized to enhance decision-making. Decision-making is controlled by agency-wide policy and regulations, as well as applicable laws and statutes through which the agency operates. Programmatic and managerial controls are in place to ensure due process rights for all individuals and companies/defendant agencies.
17. Explain how the system and its use will ensure equitable treatment of complainants or companies. If the system is operated in more than one site, how will consistent use of the system and data be maintained in all sites?
The IMS uses system-wide business rules based on agency work processes and laws governing discrimination, thereby ensuring equitable treatment of all individuals and entities. It is a web-based, centrally located system, with functions and rules centrally controlled and managed.
17.1. Explain any possibility of disparate treatment of individuals or groups.
To our knowledge, there is no possibility of disparate treatment of individuals or groups due to the use of IMS data.
18. What are the retention periods of data in this system?
At present, the IMS database contains historical records for the past 15 years.
18.1. What are the procedures for eliminating the data at the end of the retention period? Where are the procedures documented?
Data within the IMS database is not eliminated; it is archived to a new database, removing that record as needed from the currently used production database. These procedures are system functions described in the system documentation.
18.2. While the data is retained in the system, what are the requirements for determining if the data is still sufficiently accurate, relevant, timely, and complete to ensure fairness in making determinations?
The life cycle processes internal to all EEOC and FEPA offices ensure “open” cases are updated throughout their lifetime.
19. Is the system using technologies in ways that the EEOC has not previously employed?
No.
19.1. How does the use of this technology affect taxpayer/employee privacy?
Transmission of information employs secure technologies. Persistent cookies or tracking mechanisms are not employed. IMS data is handled in accordance with EEOC's policies and laws.
20. Will this system provide the capability to identify, locate, and monitor individuals? If yes, explain.
Voluntarily submitted information contains identifying and contact information. That information is used by agency staff to send official correspondence required for the proper processing of charges/complaints/cases or to contact specific individuals and respondent companies/agencies on official business. The IMS, however, cannot be used to monitor an individual.
20.1. Will this system provide the capability to identify, locate, and monitor groups of people? If yes, explain.
IMS maintains demographic information such as to Race/National Origin/Sex, etc. and charge allegation information. Therefore, IMS could be used to identify groups of individuals who have filed charges with the EEOC/FEPAs that match certain demographic profiles.
20.2. What controls will be used to prevent unauthorized monitoring?
The EEOC has established managerial and operational controls to ensure that IMS users do not engage in unauthorized monitoring.
21. Under which Systems of Record notice (SOR) does the system operate? Provide number and name.
EEOC-1, Age and Equal Pay Act Discrimination Case Files
EEOC-3, Title VII and Americans with Disabilities Act Discrimination Case Files
<Updated: 10/2006>
This page was last modified on January 10, 2007.