Privacy Impact Assessment (PIA) – ELS-Development

ELS Development System Overview

The primary function of the ELS-Development server will be to host development versions of ELS-Web1, ELS-Web2, ELS-DB and ELS-Content products. This will be a staging area for all new applications that are developed and courseware testing.  All products will be verified and tested before they are put into production.

System of Record Number(s)

Treasury/IRS 38.001 General Training Records
Treasury/IRS 34.037 Audit Trail & Security Records

Data in the System

1. Describe the information (data elements and fields) available in the system in the following categories:

A. Taxpayer - No taxpayer data will be maintained.
B. Employee - None
C. Audit Trail Information (including employee log-in info) - The Audit Trail information elements gathered are:Account Logon – Failed Attempts Logon – Failed Attempts
D. Other (Describe) - This server will contain developmental applications that require a user account to access.  

2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.

A. IRS - None
B. Taxpayer - None
C. Employee - Employee login accounts are required to gain access the developmental products.  Users log into Learningr domain.
D. Other Federal Agencies (List agency) - none
E. State and Local Agencies (List agency) - none
F. Other third party sources (Describe) - none

3.  Is each data item required for the business purpose of the system?  Explain.

Yes, the user accounts are required for audit rails of who accesses the system for testing.

4. How will each data item be verified for accuracy, timeliness, and completeness?

NA Only designated user will have access to the server.

5. Is there another source for the data?  Explain how that source is or is not used.

No. individual employees are responsible for the accuracy of their own data they must have an account in Learningrd domain.

6. Generally, how will data be retrieved by the user? 

Users will log into the system with their Learningrd account to review and testing development products.

7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier? 

To access the data a user must have an account in the Learningrd domain that includes name and password.

Access to the Data

8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?

System Administrators
Course Administrators
Web Masters
Interface Programmer
Database Administrator

9. How is access to the data by a user determined and by whom? 

Users complete a Form 5081 to have an account created in the Learningrd Domain.  The system administrators will create the account and assign the appropriate permissions.

10. Do other IRS systems provide, receive, or share data in the system?  If YES, list the system(s) and describe which data is shared.  If NO, continue to Question 12.

No.  Data from this system will be manually moved to productions servers when ready.

11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?

No, certification will be completed at the same time of this server.

12.  Will other agencies provide, receive, or share data in any form with this system? 
NO

Administrative Controls of Data

13.  What are the procedures for eliminating the data at the end of the retention period?

Products on this server will remain in place until all testing has been completed then they will be moved to a production server and deleted from this server.

14.  Will this system use technology in a new way?  If "YES" describe.  If "NO" go to Question 15.  No

15.  Will this system be used to identify or locate individuals or groups?  If so, describe the business purpose for this capability.  No

16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.  No

17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently?  Explain.  No.

18.  Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?  Not applicable.

19.  If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors?  No