Privacy Impact Assessment – Project Engineering Analysis and Reporting System
PEARS System Overview:
PEARS is an internal application that houses engineering analysis and assessment of IRS’s IT investment projects. It is used to support our commitment to provide effective architecture/engineering and integration support for critical modernization initiatives.
System of Records Number(s):
Treasury/IRS 36.003 General Personnel and Payroll Records
Treasury/IRS 34.037 Audit Trail and Security Records
Data in the System
1. Describe the information (data elements and fields) available in the system in the following categories:
A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)
A. Taxpayer – None. PEARS does not collect or contain taxpayer information.
B. Employee – SE&I Division analysts are populated in PEARS for authentication and authorization purposes. Data elements used are: First Name, Last Name, Title, Phone, Email, SEID of the employees. The employee information is used to keep track of task assignments and workflow progress.
C. Audit Trail Information – Audit trails are only captured to keep track of employees’ task assignments and the workflow progress.
D. Other – Prominent data in PEARS include: Projects, Project Engineering Analysis, Project Engineering Assessment, Project mappings to the Enterprise Architecture, Project mappings to the As-Built Architecture (ABA), and Project mappings to the Release Architecture (RA).
2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)
A. IRS – Projects and related engineering information are obtained from the Modernization Vision and Strategy (MV&S) initiative.
B. Taxpayer – None.
C. Employee – Project Engineering Assessment and Analysis are done by divisional employees.
D. Other Federal Agencies – None.
E. State and Local Agencies – None.
F. Other third party sources – None.
3. Is each data item required for the business purpose of the system? Explain.
Yes, PEARS is an internal knowledge-base system to collect engineering analysis and assessment information thus all data items are essential to the business purpose of the system.
4. How will each data item be verified for accuracy, timeliness, and completeness?
A custom-developed workflow process is implemented in PEARS. The workflow process ensures the data items are inspected by our Technical Leads for accuracy, timeliness, and completeness.
5. Is there another source for the data? Explain how that source is or is not used. No.
6. Generally, how will data be retrieved by the user?
The data are consumed by our division through PEARS’s web-based interface developed using Microsoft’s ASP.NET technology.
7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier?
No. PEARS does not contain any Taxpayer information. Basic employee information (first name, last name, contact information, etc.) can be retrieved uniquely by employee SEIDs.
Access to the Data
8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?
Access to the data is limited to SE&I divisional employees.
9. How is access to the data by a user determined and by whom?
Access to data is determined by the system administrator and access is usually granted when an employee joins the division. User administration is performed by the system administrator.
10. Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If NO, continue to Question 12.
Yes. PEARS receives IT investment proposal data from ProSight. As-built Architecture (ABA) receives application systems information from PEARS.
11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment? Yes.
12. Will other agencies provide, receive, or share data in any form with this system? No.
Administrative Controls of Data
13. What are the procedures for eliminating the data at the end of the retention period?
We plan to retain all project-related system and architecture data for historical purposes. In the event that system and architecture data are no longer applicable, we maintain a flag associated with each project to indicate its lifecycle status. The out-of-date system and architecture data are often used for references when analyzing new projects. This is in accordance with IRM 1.15.17, Item 9
14. Will this system use technology in a new way? If "YES" describe. If "NO" go to Question 15. No.
15. Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability. No.
16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring. No.
17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain. No.
18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action? Not applicable.
19. If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors? No.
| 
