U.S. Department of the Interior Privacy Program

Links to Guidelines and References on Privacy

Click on Link Below:

Reference Materials

(Privacy Act, E-Government Act, Regulations, Circulars, Manuals and Memos)

1. Department of the Interior
2. Government

Specific Topics

• Budget Processes and Privacy Requirements
• Contracts and Privacy Requirements
• GAO Reports on Government Privacy
• GIS and Privacy Provisions
• Information Collection and Privacy
• Interagency Data Sharing
• Privacy and Homeland Security Presidential Directive (HSPD-12)  
• Privacy Act System of Records Notices and Preparing Notices
• Privacy Impact Assessments
• Privacy Program Reviews
• Privacy Protection Tips
• Safeguarding and Disposing of Privacy Act Information
• Safeguarding Personally Identifiable Information (PII) and Social Security Numbers
• Training Materials
• Web Privacy Policy
• Websites Related to Privacy

References

1.  Department of the Interior

• Subject Index for Department of the Interior (DOI) Privacy Act Regulations and the Privacy Act Manaul Sections (see below for links to the documents).
• DOI regulations for implementing the Privacy Act (43 CFR Part 2 (2.45-2.79): http://www.doi.gov/foia/43cfrsub.html.
• The DOI manual sections on the Privacy Act can be found at 383 DM Ch. 1-13 http://www.doi.gov/ocio/privacy/manual/index.html
• The DOI Privacy Program Homepage:  http://www.doi.gov/ocio/privacy/index.html
• DOI Privacy Act system of records notices and Government-wide notices: http://www.doi.gov/ocio/privacy/List_doipa_notices_9.03.htm
• Departmental employees for additional information may access http://www.mydoi.doi.net/

2. Government
The E-Government Act of 2002

• Privacy Provisions of the E-government Act of 2002
• OMB Memo dated September 26, 2003 (M-03-22) on implementation of the section 208 privacy provisions of the E-Government Act of 2002: http://www.whitehouse.gov/omb/memoranda/m03-22.html
• Department of Justice Guide on "Legal Considerations in Designing and Implementing Electronic Processes (implementation of GPEA) (see C. Assessing the Significance of Risk, and II. Legal Issues to Consider in "Going Paperless" at http://www.cybercrime.gov/eprocess.htm
• Congressional Internet Caucus Advisory Committee Briefing Book on E-Government issues dated March 22, 2001 at http://www.netcaucus.org/books/egov2001/.  See Section on Privacy at http://www.netcaucus.org/books/egov2001/pdf/key.pdf

i. The Privacy Act (5 U.S.C. 552a)

• The Privacy Act of 1974, as amended (5 U.S.C. 552a): http://www4.law.cornell.edu/uscode/5/552a.html
• Office of Management and Budget (OMB) regulations on the Privacy Act.  Privacy Act Implementation, Guidelines and Responsibilities, 40 FR 28948 (July 9, 1975) (4.62mb)
• M-99-05, Instructions on Complying with President's Memorandum of May 14, 1998, "Privacy and Personal Information in Federal Records" (January 7, 1999)
• OMB Circular A-130:  Management of Federal Information Resources.  See Appendix I for implementing the Privacy Act and transmittal memorandum:
  • (Transmittal) http://www.whitehouse.gov/omb/circulars/a130/a130trans4.html
  • Appendix I, Federal Agency Responsibilities for Maintaining Records About Individuals
  • Appendix II, Implementation of the Government Paperwork Elimination Act
  • Appendix III, Security of Federal Automated Information Resources
  • Appendix IV, Analysis of Key Sections 
• OMB Privacy Policy Page: http://www.whitehouse.gov/omb/privacy/index.html
• OPM Privacy Act regulations on personnel records (5 CFR 297): http://www.opm.gov/feddata/cfr297.txt
• Department of Justice Privacy Act Overview http://www.usdoj.gov/04foia/04_7_1.html
• A Citizens Guide to the FOIA and Privacy Act http://www.fas.org/sgp/foia/citizen.html

Budget Processes and Privacy Requirements

• Tips in Responding to Privacy Sections of the Exhibit 300s
• See privacy requirements for Exhibit 300s at Office of Management and Budget (OMB) Circular A-11, Preparation and Submission of Budget Estimates, July 2000 (see Sections 31.8, 50.1, 50.2 & 58.3 and 300.1 at http://www.whitehouse.gov/omb/circulars/a11/02toc.html

Contracts and Privacy Requirements

• The Privacy Act, Section (m) addresses accountability for Privacy Act systems of records maintained by persons other than agency personnel: http://www4.law.cornell.edu/uscode/5/552a.html
• The Federal Acquisition Regulations (FAR) requires that when an agency contracts for the design, development, or operation of a system of records on individuals on behalf of the agency to accomplish an agency function, the agency must apply the requirements of the Privacy Act to the contractor and its employees working on the contract (FAR 48 CFR 24.102(a) http://www.arnet.gov/far/).  FAR Contracting Officer and System Manager responsibilities (See FAR at 48 CFR 24.103 http://www.arnet.gov/far/). Privacy clauses at 52.224-1 & 2 (http://www.arnet.gov/far/farqueryframe.html).
• DOI Acquisition Regulations (DIAR) 1452.224-1: http://www.doi.gov/pam/1452-3.html#244-1%20
• DOI Privacy Act regulations on contracts (43 CFR 2.53): http://www.doi.gov/foia/43cfrsub.html

GAO Reports on Government Privacy

• [GAO-03-304 ] Privacy Act: OMB Leadership Needed to Improve Agency Compliance dated June 2003 at http://frwebgate.access.gpo.gov/cgi-bin/useftp.cgi?IPaddress=162.140.64.88&filename=d03304.pdf&directory=/diskb/wais/data/gao
• [GGD-00-191] Internet Privacy: Agencies' Efforts to Implement OMB's Privacy Policy at http://frwebgate.access.gpo.gov/cgi-bin/useftp.cgi?IPaddress=162.140.64.21&filename=gg00191.pdf&directory=/diskb/wais/data/gao
• List of GAO reports on E-Government: http://www.gao.gov/index.htm

Geographic Information Systems (GIS) and Privacy Policy

• Federal Geographic Data Committee Privacy Policy established in 1999 at http://www.fgdc.gov/fgdc/policies/privacypolicy.pdf
• Urban Regional Information Systems Association “Code of Ethics” (see section IV on Privacy) at http://www.urisa.org/ethics/code_of_ethics.htm

Information Collection and Privacy

• OMB memo of January 20, 2006 on “Guidance on Agency Surveys and Information Collection.”  See Pgs. 51-55 on Confidentiality of Data.  http://www.whitehouse.gov/omb/inforeg/pmc_survey_guidance_2006.pdf
• On collecting information on individuals see Departmental Privacy Act manual section 383 DM 4.7 http://206.131.241.18/app_DM/act_getfiles.cfm?relnum=3450

Interagency Data Sharing

• OMB memo on Interagency Sharing of Personal Data, December 20, 2000: http://www.whitehouse.gov/omb/memoranda/m01-05.html
• IRM Bulleting 2001-002 on “Interagency Sharing of Personal Data and Privacy Protection Measures”
• General Accounting Office (GAO) Report of April 2001 (GAO-01-12SP) on Data Linkage and Privacy: http://www.gao.gov/new.items/d01126sp.pdf.
• General Accounting Office Report of December 2000 on the Challenge of Data Sharing (see privacy deficiencies) http://www.gao.gov/new.items/d0167.pdf

Privacy and Homeland Security Presidential Directive (HSPD-12)

• Link to the Department of the Interior “Personal Identification Verification Guide” dated December 2005.  For privacy see Sec. 2.2, Attachments C, I, and J. http://www.test.myinterior.doi.net/HSPD12/Documents/PIV_Guide_v1_final.pdf link to the OMB memo on implementation of HSPD-12 (M-05-24) (For privacy see Section 6 of Attachment A) http://www.whitehouse.gov/omb/memoranda/fy2005/m05-24.pdf )
• Link Federal Information Processing Standards Publication - 201  (For privacy see section 2.4) http://csrc.nist.gov/publications/fips/fips201/FIPS-201-022505.pdf

Privacy Act System of Records Notices and Preparing Notices

• DOI Privacy Act system of records notices and Government-wide notices: http://www.doi.gov/ocio/privacy/List_doipa_notices_9.03.htm
• Government Printing Office Drafting Handbook (see Ch. 3 on guidelines for Privacy Act System of Records Notices): http://www.archives.gov/federal-register/write/handbook/
• Chapter 5 on “Privacy Act System of Records Notices” of the Department of the Interior Manual Section on the Privacy Act (see 383 DM 5 at http://www.doi.gov/ocio/privacy/manual/383DM5.htm)

Privacy Impact Assessments

• DOI University will soon offer a new computer-based training developed by the Office of the Chief Information Officer on "Understanding the Privacy Impact Assessment" by January 2006. Go to the DOI University On-line Course Catalog at http://www.doiu.nbc.gov/matrix.cfm?type=c&id=O.
• OCIO Bulletin 2002-015:  Privacy Impact Assessments for Department of the Interior Information Systems. http://www.doi.gov/ocio/privacy/PIA Memo_CIO 2002-015.pdf
• DOI “Privacy Impact Assessment and Guide” at http://www.doi.gov/ocio/privacy/DOI PIA_03.01.04.doc
• OMB Memo dated September 26, 2003 (M-03-22) on implementation of the section 208 privacy provisions of the E-Government Act of 2002 (see Appendix A) http://www.whitehouse.gov/omb/memoranda/m03-22.html
• Privacy Provisions of the E-government Act of 2002
• Federal Chief Information Officer Council Model Information Technology Privacy Impact Assessment (PIA) (see Section. V. Checklist) at http://www.cio.gov/Documents/pia_for_it_irs_model.pdf.

Privacy Program Reviews

• OMB Memo M-05-15 on the annual privacy reporting (Section D) of the Federal Information Security Management Act reporting (2005) http://www.whitehouse.gov/omb/memoranda/fy2005/m05-15.html
• Sec. 3 of OMB Circular A-130: “Assignment of Responsibilities” for Federal Offices.  (See required cyclical program reviews at http://www.whitehouse.gov/omb/circulars/a130/a130appendix_i.html)
• DOI Bureau Program Responsibilities (383 DM 3) http://www.doi.gov/ocio/privacy/manual/383DM3.htm

Privacy Protection Tips

• Federal Trade Commission (FTC) Website on Privacy Safeguards http://www.ftc.gov/privacy/privacyinitiatives/promises_educ.html
• What to do if your identity is stolen.  (See FTC website at http://www.consumer.gov/idtheft/)

Safeguarding Personally Identifiable Information (PII) and Social Security Numbers

• OCIO Directive 2006-16 on "Safeguarding Personally Identifiable Information" - DOI Employee Access Only
• OMB Paper on "Common Risks Impeding the Adequate Protection of Government Information" dated July 2007
• Office of Personnel Management memorandum on "Guidance on Protecting Federal Employee Social Security Numbers and Combating Identity Theft" dated June 18, 2007
• OMB Memorandum M-07-16 on "Safeguarding Against and Responding to the Breach of Personally Identifiable Information" dated May 22, 2007
• OMB Memorandum September 20, 2006 on "Recommendation for Identity Theft Data Breaches Which Could Result in Identity Theft"
• OMB Memorandum M-06-19 on "Reporting Incidents Involving Personally Identifiable Information"
• OMB Memorandum M-06-16 on "Protection of Sensitive Agency Information"
• OMB Memorandum M-06-15 on "Safeguarding Personally Identifiable Information"

Safeguarding and Disposing of Privacy Act Records

• See IRM Bulletin 2001-004 on “Protecting Sensitive Data when transferring Donating or Disposing of Computer Equipment.”
• See DOI Manual Section on the Privacy Act at 383 DM 8 http://www.doi.gov/ocio/privacy/manual/383DM8.htm
• See DOI Records Disposal guidelines at 384 DM 1 at http://elips.doi.gov/elips/release/3431.htm
• Federal Trade Commission (FTC) Website on Privacy Safeguards http://www.ftc.gov/privacy/privacyinitiatives/promises_educ.html

Training Materials

1. DOI Online Training and PowerPoints
   • DOI New Employee Orientation Page on Privacy
2. PowerPoint Training
   • Information Management and System Development Life Cycle Training
   • Privacy Training for IT Professionals and Project Managers
   • Privacy Toolbox
   • Overview of the Privacy Act
3. Privacy Act Training Classes
   • American Society of Access Professionals FOIA/Privacy Conferences http://www.accesspro.org
   • Department of Justice Office of Legal Education (See Privacy and FOIA training in catalog) http://www.usdoj.gov/usao/eousa/ole/index.html

Web Privacy Policy

1. Interior Web Privacy Policy
   • New DOI Web Handbook (See web privacy requirements in 386 DM 3) (Private)
   • IRM Bulletin 2001-001 on “Persistent Cookies” on Interior Web Sites.
   • OCIO Bulletin 2005-009 on “Implementing the Platform for Privacy Preferences”
   • The official Departmental web privacy policy statement: http://www.doi.gov/privacy.html
   • For websites directed at children 13 years or under:  http://www.doi.gov/kids/
   • For websites that collect information from the public a specific notice must address the reason for the information collection, etc.  See sample notices at:  https://www.volunteer.gov/gov/privacy.cfm and http://training.fws.gov/Documents/privacyactstmnt.htm
   • The official Departmental web disclaimer statement: http://www.doi.gov/disclaimer.html
   • DOI Webmaster/Pagemaster Checklist: http://www.doi.gov/ocio/privacy/Webmaster_Checklist_12.03.doc
2. Children’s Online Privacy Protection Act Requirements
   • For pages directed at Children 13 years or under see the Federal Trade Commission guidance on complying with the Children's On-Line Privacy Protection Act at http://www.ftc.gov/bcp/conline/pubs/buspubs/coppa.htm
   • Also see Section III of Attachment A, and Attachment C of the OMB memorandum M-03-22 below.
3. Government Web Privacy
   • OMB Memo dated September 26, 2003 (M-03-22) on implementation of the section 208 privacy provisions of the E-Government Act of 2002.  (See Appendix A, Section III on web requirements at: http://www.whitehouse.gov/omb/memoranda/m03-22.html)
   • See OMB Privacy Guidance on Government web pages at:  http://www.whitehouse.gov/omb/inforeg/infopoltech.html#pg
   • Letter from John Spotila to Roger Baker, clarification of OMB Cookies Policy (September 5, 2000)
   • Letter from Roger Baker to John Spotila on Federal agency use of Web cookies (July 28, 2000)
   • M-00-13, Privacy Policies and Data Collection on Federal Web Sites (June 22, 2000)
   • M-99-18, Privacy Policies on Federal Web Sites (June 2, 1999)

Websites Related to Privacy

• OMB Webpage for Information Privacy, IT, and E-Government http://www.whitehouse.gov/omb/inforeg/infopoltech.html
• OMB Privacy Page: http://www.whitehouse.gov/omb/privacy/index.html
• DOI Information Technology Security Homepage: http://www.doi.gov/ocio/security/
• DOI Capital Planning Homepage (see tips on preparing privacy sections of the Exhibit 300) http://www.doi.gov/ocio/cp/index.html
• DOI Freedom of Information Act Homepage: http://www.doi.gov/foia/
• Federal Trade Commission privacy initiatives: http://www.ftc.gov/privacy/index.html