Privacy Impact Assessment – National Performance Award Program (NPAP)
NPAP System Overview
The National Performance Awards Agreement (NPAA) between the Internal Revenue Service (IRS) and the National Treasury Employees Union (NTEU) establishes policies and procedures for implementing a National Performance Awards Program (NPAP) to recognize and reward high employee performance during each fiscal year. This application is used to ensure performance awards covered by the NPAA shall be paid out in September of each year consistent with the provisions of the NPAP. The application receives data file inputs from the Treasury Integrated Management Information System, completes all required calculations with zero error rate, and provides data file outputs to Agency-Wide Shared Services for payment of awards.
System of Records Number(s)
IRS 34.037, IRS Audit Trail and Security Records System
IRS 36.003, General Personnel and Payroll Records
Treasury .001, Treasury Payroll and Personnel System
Treasury 009, Treasury Financial Management Systems
Data in the System
1. Describe the information (data elements and fields) available in the system in the following categories:
A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)
A. NPAP does not contain Taxpayer data.
B. Tables: NPAP_TIMIS; NPAP_AWD_INFO; NPAP_AUTH; NPAP_AUDIT_TABLE; NPAP_CLNUP; NPAP_TIMIS_POOL_INFO; NPAP_TIMIS_POOL_HOLD; NPAP_TIMIS_POOL_SERIES; NPAP_TIMIS_FINAL_POOL; and NPAP_UNION_CNT.
C. The system the application resides on collects the NPAP user log-in information. Tables: NPAP_AUTH; NPAP_AUDIT_TABLE; and NPAP_CLNUP). The following tables contain payment information and other pool tracking items (Tables: NPAP_ALLOC; NPAP_POOL_TOT; and NPAP_APNDXA_TOTS.
D. Not applicable.
2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)
A. See attached NPAP Data Dictionary dated October 27, 2005. Tables: NPAP_ALLOC; NPAP_POOL_TOT; AND NPAP_APNDXA_TOTS contain data from the National Performance Awards Agreement.
B. NPAP does not contain data collected from the Taxpayer.
C. NPAP does not contain data collected directly from the Employee. However, the NPAP does contain employee information that is obtained from the Treasury Integrated Management Information System (TIMIS).
D. See attached NPAP Data Dictionary dated October 27, 2005. Tables: NPAP_TIMIS; NPAP_AWD_INFO; NPAP_CLNUP; and NPAO-TIMIS_POOL_INFO.
E. No State or Local Agencies provide data for NPAP.
F. See attached NPAP Data Dictionary dated October 27, 2005. Tables NPAP_AUTH; and NPAP_AUDIT_TABLE. Contains NPAP user’s logon information and any user updates made to NPAP_AWD_INFO table. See item 8 for a further description of NPAP User.
3. Is each data item required for the business purpose of the system? Explain.
The data items are required to complete all required calculations with a zero error rate consistent with the provisions of the National Performance Awards Agreement.
4. How will each data item be verified for accuracy, timeliness, and completeness?
NPAP accepts the data downloaded from TIMIS, which has been checked for accuracy, timeliness, and completeness. All other data is manually input and verified at the time of input.
5. Is there another source for the data? Explain how that source is or is not used. No.
6. Generally, how will data be retrieved by the user?
The data is generally retrieved by Social Security Number (SSN), Series, and Union Chapter.
7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier?
Yes, data is retrievable by Employee Name and SSN.
Access to the Data
8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?
IRS NPAP Division and Function Users will have access to the data in the system. Access is granted on a need to know requirement. Access will be restricted by organization code and level of access.
9. How is access to the data by a user determined and by whom?
Only IRS NPAP Division and Function Users, with a need to know, will gain access to the data. A Form 5081, Information System User Registration/Change Request is submitted, reviewed, and the user is added. A user’s access to the application is terminated when it is no longer required. Access will be restricted by organization code and level of access.
10. Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If NO, continue to Question 12. No.
11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment? N/A
12. Will other agencies provide, receive, or share data in any form with this system?
Yes, the Department of Agriculture, which is the payroll system used by IRS.
Administrative Controls of Data
13. What are the procedures for eliminating the data at the end of the retention period?
Data will be maintained until December 15th of each year to provide research for post-payout resolutions and then deleted.
14. Will this system use technology in a new way? If "YES" describe. If "NO" go to Question 15. No.
15. Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability. No.
16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.
No, the system is not used to monitor individuals or groups.
17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain.
No. The system treats all employees who are eligible for consideration of an award equally. All awards will be calculated in the same manner consistent with the provisions of the National Performance Awards Agreement.
The system does not contain any taxpayer data.
18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?
Yes. The employee rating and other data is discussed and agreed upon with the employee before being input to TIMIS. Thus, the employee is provided “due process” prior to the TIMIS download.
In addition, a User’s Correction Period is conducted during which time IRS NPAP User’s access the system, review the data, and make any necessary changes to the data prior to the final award calculation process.
19. If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors?
The system is not web-based.
| 
