Privacy Impact Assessment – Integrated Training Evaluation and Measurement Services (ITEMS) Contract
ITEMS System Overview
Integrated Training Evaluation and Measurement Services (ITEMS) is a contract for training evaluation services. It is not a “system” per se. These services include capturing training evaluation data via scannable bubble sheets and online; compiling data into reports; providing online access to reports; providing wizards and algorithms to help analyze data; providing online tools for creating training evaluation/assessment surveys; and providing an online repository of training evaluation policy, procedures, and other information. These services are provided outside of the IRS firewall.
System of Records Number(s)
The ITEMS system is not a system of records and therefore reference to SORNs is not required.
Data in the System
1. Describe the information (data elements and fields) available in the system in the following categories:
A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)
No taxpayer data. No employee data. No audit trail information. All data are anonymous training evaluation data and comments.
2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)
Course, class, and business unit information (i.e., course owner) are obtained from IRS’s Enterprise Learning Management System (ELMS) via General Physics (GP) which runs a weekly script to extract a .csv file. This file is then downloaded by the ITEMS contractor. Training evaluation data are obtained anonymously from trainees and instructors via bubble sheets and online. There are no taxpayer, employee, other Federal, State, and Local data or third party sources.
3. Is each data item required for the business purpose of the system? Explain.
Yes. All data items relate to courses and classes and the evaluations of them by trainees and instructors.
4. How will each data item be verified for accuracy, timeliness, and completeness?
Course, class, and business unit information are checked for errors at the time the evaluation batch is received, prior to scanning and transcribing. Quantitative feedback from trainees and instructors is accepted prima facie. Comments are edited as necessary to remove any personal names, expletives, and gratuitously negative words.
5. Is there another source for the data? Explain how that source is or is not used. No.
6. Generally, how will data be retrieved by the user?
Online via the ITEMS Intranet website. The information is retrievable by category and not by use of personal identifiers.
7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier?
Only class and course data reports with comments require a password for access. Access to online survey-creation tools requires user name and password. No actual names, SSNs, or SEIDs are used.
Access to the Data
8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?
Training developers, training managers, or anybody else interested in viewing training evaluation data.
9. How is access to the data by a user determined and by whom?
Access to data is unrestricted except as noted in #7. The Contracting Officer’s Technical Representative (COTR) instructs the contractor to provide access to users where user name and/or password are required (i.e., online access to evaluation comments and survey-creation tools).
10. Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If NO, continue to Question 12.
ELMS via GP provides—one way—course, class, and business unit information for training. No data are shared back to GP or ELMS.
11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?
ELMS has a PIA. Other systems or services are contractor provided.
12. Will other agencies provide, receive, or share data in any form with this system? No.
Administrative Controls of Data
13. What are the procedures for eliminating the data at the end of the retention period?
COTR instructs contractor to delete data from contractor’s storage media.
14. Will this system use technology in a new way? If "YES" describe. If "NO" go to Question 15. No.
15. Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability. No.
16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring. No.
17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain. No.
18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?
N/A. In addition to #4 above, errors are corrected when brought to the attention of the contractor.
19. If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors?
The system is incapable of using tracking of any kind. It is accessed via the IRS Intranet site, whose use of tracking or monitoring falls outside the purview of this privacy assessment. Contractor site’s web privacy policies will be accessible to users of the system and are currently compatible with those of government web sites.
|
