DEPARTMENT OF TRANSPORTATION
Federal Motor Carrier Safety Administration
PRIVACY IMPACT ASSESSMENT
June 2006
Table of Contents
Overview of Federal Motor Carrier Safety Administration (FMCSA) privacy management process for EMIS
Personally-identifiable information (PII) and EMIS
Why EMIS collects information
How EMIS uses information
How EMIS shares information
How EMIS provides notice and consent
How EMIS ensures data accuracy
How EMIS provides redress
How EMIS secures information
System of records
FMCSA within the Department of Transportation (DOT) has been given the responsibility to reduce crashes, injuries, and fatalities involving large trucks and buses. In carrying out its safety mandate, FMCSA:
To meet these goals, FMCSA partners with stakeholders, including Federal, State, and local enforcement agencies, the motor carrier industry, safety groups, and organized labor on efforts to reduce bus and truck-related crashes. Since the first step to reduce accidents is to understand them, FMCSA collects and maintains commercial vehicle safety data, as well as a national inventory of motor carriers and shippers subject to the Federal Motor Carrier Safety Regulations (FMCSRs) and Federal Hazardous Materials Regulations (FHMRs). EMIS is a tool that helps FMCSA manage this data.
EMIS is a web-based computerized information system utilizing a centralized database to support FMCSA in meeting their responsibilities regarding enforcement of federal laws and regulations designed to insure the safety of commercial motor carriers and shippers engaged in interstate operations within the United States. This system maintains a comprehensive record of FMCSA enforcement actions taken against interstate carriers, hazardous materials shippers, and individuals subject to the FMCSRs or FHMRs.
Privacy management is an integral part of the EMIS project. DOT/FMCSA has retained the services of privacy experts to help assess its privacy management program, utilizing proven technology, sound policies and procedures, and proven methodologies.
The privacy management process is built upon a methodology that has been developed and implemented in leading companies around the country and globally. The methodology is designed to help ensure that DOT and FMCSA will have the information, tools, and technology necessary to manage privacy effectively and employ the highest level of fair information practices while allowing FMCSA to achieve its mission of protecting and enhancing a most important U.S. transportation system. The methodology is based upon the following:
EMIS records include information on enforcement cases initiated by FMCSA against companies and drivers of commercial motor vehicles (i.e. trucks with a gross combination weight of 10,001 pounds or more, buses used to transport more than 9 passengers, including the driver), and vehicles transporting hazardous materials. It also includes information on cases against shipping and freight forwarding companies registered with FMCSA. Specific information related to individuals is maintained on:
1. Drivers associated with enforcement actions resulting from vehicle inspections and crashes investigated by federal and state motor carrier enforcement officials;
2. Officials associated with the motor carrier companies and/or drivers who are the subject of enforcement actions recorded in the system; and
3. FMCSA and state officials authorized access to EMIS via personally assigned user accounts.
Records and reports in this system are referenced by a unique Enforcement Case Number. Each Enforcement Case Record may include:
1. Subject Identification Information: USDOT Number, subject’s name, address, and phone numbers, type of operation, Employer Identification or Social security number, etc. The subject of an enforcement action may be a company or an individual.
2. General Case Information: Information related to the persons and organizations initiating and managing the action. May include originating Division and/or Safety Investigator, managing Service Center and/or Enforcement Specialist, etc.
3. Contact Information: Names, addresses and phone numbers of persons with an interest in the case, including subject’s point of contact, legal advisor, etc.
4. Violation and Fine Information: Specific federal laws and regulations for which the subject is being prosecuted and the counts and fines being assessed for each.
5. Fine Payment Information: Data associated with the subject’s payment of fines assessed as a result of an enforcement action.
6. Actions Taken Information: Chronological list of activities associated with management of the case with comments and users inputting the data.
7. Document References: Link to electronic documents associated with management of the case.
EMIS collects PII in order to track safety-related data in the hopes of recognizing trends that can be useful when making policy and other changes.
Data is collected to identify individuals involved in enforcement actions, and to track and manage enforcement actions.
For individuals with direct access to EMIS, FMCSA also collects necessary PII to authenticate users and restrict permissions, and EMIS associates these individuals with user-created user IDs and passwords.
FMCSA's field and State enforcement personnel access EMIS to perform operations, analysis, and reporting in support of their responsibilities regarding the enforcement of motor carrier operations within the United States in accordance with the FMCSRs and FHMRS.
Designated and approved State and local compliance officials and data entry representatives have direct access to EMIS data. Different individuals receive different rights in EMIS according to their job role and State. Designated FMCSA staff members also have direct access to EMIS, with different individuals receiving different rights according to their job roles.
FMCSA may also share with other federal agencies PII in EMIS to assist with national security or other compliance activities. FMCSA evaluates each request on an individual basis and oversees the process to ensure all procedures are followed pursuant to the Privacy Act of 1974.
EMIS contains PII for only drivers of commercial vehicles, contacts for commercial carriers and shippers, and State and local officials requiring access to the system. Drivers and commercial carrier representatives are required by law to provide PII as part of the inspection and crash data collection process and EMIS does not provide additional notice or options for consent.
The EMIS system’s functionality provides internal data quality and completeness checks. Sources of information, such as State police departments or other officials, are responsible for inputting correct information.
Individuals who must submit PII in order to obtain direct access to EMIS submit this information directly. These individuals may contact their approving supervisor for any corrections to submitted information.
At any time, an individual, in writing or through email, may contact the EMIS office and request their information under the Privacy Act of 1974. Contact information is provided on the FMCSA website (http://www.fmcsa.dot.gov). The Privacy Policy is also posted visibly as a link at the bottom of the Web site home page.
Electronic records in EMIS are retained for six years and are securely destroyed in accordance with FMCSA policy.
Physical access to the EMIS system is limited to appropriate personnel through applicable physical security requirements of the agency. FMCSA and contract support personnel with physical access have all undergone and passed DOT background checks.
EMIS data is maintained in an Oracle database on physical systems located inside a secure computer center with limited access at the Volpe Center. Data is backed up regularly and stored both on site and at secure offsite locations.
EMIS information is accessible only to FMCSA federal and state enforcement personnel with specifically assigned user ID’s and passwords. Some limited personnel under contract to FMCSA or state agencies responsible for carrying our enforcement activities or supporting the EMIS system also have access via specifically assigned ID’s and passwords.
Physical security and access to the hosting facility is managed and maintained by the Volpe Center.
The following matrix describes the privileges and safeguards around each of these roles as they pertain to PII.
ROLE |
ACCESS |
SAFEGUARDS |
---|---|---|
All Users |
Variable, determined by job position and location. |
Access approved by higher authority. The following safeguards apply:
|
EMIS is a system of records subject to the Privacy Act, 5 U.S.C. 552(a) and can be located at DOT/FMCSA 002 Enforcement Management Information System (EMIS) Records.