Privacy Impact Assessment - Procurement Background Investigation Process (PBIP)

PBIP System Overview

The purpose of the application is to identify and track contractor’s employees who require BIs, and the status of each.

PBIP allows designated users to monitor a contractor’s progress through the BI process, and to identify those who have been approved for, or denied, ID badges and access to IRS systems.  Users are restricted to only those contractor records pertaining to the contracts for which they are responsible.

One of PBIP’s main uses is to identify contractors who have been approved for work on IRS contracts.  Conversely, PBIP identifies those contractors who have been denied approval for IRS contract work, to help ensure that ID badges and systems access are not provided to those individuals.

System of Records Number(s)

Treasury .009 – System Name: Treasury Financial Management
Treasury/IRS 34.037 IRS Audit Trail and Security Records System

Data in the System

1. Describe the information (data elements and fields) available in the system in the following categories:

A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)

A.  None

B. PBIP users (employees performing their duties by using the system), consisting of COTRs (Contracting Officer’s Technical Representatives) and POCs (Points of Contact), are tracked by first and last name only (no SSN).

C. Each contractor record is logged with the Windows NT network ID (and timestamp) of the user who created the record, as well as the network ID (and timestamp) of the user who most recently updated the record.

D. Contractors are tracked by first name, last name, and Social Security Number (SSN).  This data is obtained from the SF-85P form the contractor is required to submit to initiate the background investigation (BI) process.  Contractor address and phone number information is optional for inclusion in the contractor’s record within PBIP.

2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.

A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)

A.  The contractor’s name & SSN are obtained from the SF-85P “Questionnaire for Public Trust Position” which the contractor submits to the COTR/POC to begin the investigation process. 

B.  None

C. Employee (COTR/POC) first name, last name, login, and office phone are collected from the employee when adding a user record to PBIP.

D.  N/A

E.  N/A

F.  N/A

3.  Is each data item required for the business purpose of the system?  Explain.

Yes.  The pertinent data items are first name, last name, and SSN.   Storing the SSN in PBIP allows for unique contractor identification (e.g., in case there are two “Joe Smith”s on the same contract ).  Storing this data allows the contractor’s first name, last name, and SSN to be automatically filled in on the Request Letter which is generated from PBIP, and which the COTR sends to NBIC to initiate a contractor investigation.

4. How will each data item be verified for accuracy, timeliness, and completeness?

The original source for the data is the contractor.  The contractor’s data can be updated by the user if necessary. Responsibility for accuracy, timeliness, and completeness rests with the contractor who submits the information and PBIP user responsible for the data.

5. Is there another source for the data?  Explain how that source is or is not used.

No. The original source for the contractor’s first name, last name, and SSN is the contractor.  This information is entered in the SF-85P and other documents that make up the BI package submitted to NBIC by the COTR/POC to initiate a contractor investigation.

6. Generally, how will data be retrieved by the user? 

Data is accessed through the existing PBIP web forms and reports.

7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier? 

Yes. PBIP users can search for and retrieve contractor records by name or SSN.  This data is restricted to those users given specific access authorization to assigned contracts.

Access to the Data

8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?

Systems administrators, contractor developers, and designated IRS employees have access to PBIP data.  All contractor developers have signed non-disclosure agreements as appropriate, and had background investigations, and safeguards reviews.

9. How is access to the data by a user determined and by whom? 

Data access is determined by the PBIP Project Manager, the COTR involved with specific contracts, and the COTR’s manager.  Users can be assigned read or write privileges to a contract.  COTRs may designate POCs (Points of Contact) to perform data entry and tracking for them.

10. Do other IRS systems provide, receive, or share data in the system?  If YES, list the system(s) and describe which data is shared.  If NO, continue to Question 12.  No.

11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?   n/a

12.  Will other agencies provide, receive, or share data in any form with this system? 
No.

Administrative Controls of Data

13.  What are the procedures for eliminating the data at the end of the retention period?

Records maintenance & disposal is in accordance with National Archives and Records Administration retention schedules, and any supplemental guidance issued by individual components.  IRS systems do not keep data on file of employees or contactors who are no longer engaged in IRS work.

14.  Will this system use technology in a new way?  If "YES" describe.  If "NO" go to Question 15.   No.

15.  Will this system be used to identify or locate individuals or groups?  If so, describe the business purpose for this capability.

Yes.  The purpose of the application is to identify and track contractor’s employees who require BIs, and the status of each.

16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.

Yes.  PBIP allows designated users to monitor a contractor’s progress through the BI process, and to identify those who have been approved for, or denied, ID badges and access to IRS systems.  Users are restricted to only those contractor records pertaining to the contracts for which they are responsible.

17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently?  Explain.

No.  One of PBIP’s main uses is to identify contractors who have been approved for work on IRS contracts.  Conversely, PBIP identifies those contractors who have been denied approval for IRS contract work, to help ensure that ID badges and systems access are not provided to those individuals.

18.  Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?

Yes. PBIP  records the results of contractor BIs, which are conducted by NBIC.  The BI process itself includes “due process” considerations such as a 15-day period in which the contractor can provide additional information regarding a pending decision to deny approval for IRS contract work.

19.  If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors?

No persistent cookies are used in PBIP.