Return to Home PageThe following laws and regulations establish specific requirements for the confidentiality, integrity, and availability of the data processed, stored, and transmitted by the EEO-1 Survey System:
EEOC Directives Transmittal (EEOC Order 240.005)
EEOC LAN/WAN Guide Book, 2000
Information Security Responsibilities of EEOC Employees
The individual's right to privacy must be protected in Federal Government information activities involving personal information (OMB Circular A-130,7.g). This assessment addresses the EEO-1 Survey privacy impact.
1. Generally describe the information to be used in the system in each of the following categories: Complainant, Company, EEOC Employee, Other.
Response: The annual Employer Information Report EEO-1 survey and analysis system collects employment statistics by race/ethnicity, gender and occupational groups from employers in private industry. The EEO-1 data collection program was implemented pursuant to federal statute and regulations, i.e. Title VII of the Civil Rights Act of 1964; and 29CFR, Subpart B, Chapter XIV, .1602.7 .1602.14, to measure the hiring practices of women and minorities and eliminate employment discrimination based on race, color, religion, sex or national origin in private industry. EEO-1 data are used in investigations of Title VII violations, litigation, research, comparative analyses, class action suits, affirmative active plans, etc.
2. What are the sources of the information in the system?
Response: All employers who meet the following criteria are required to file the EEO-1 report annually:
Only those establishment located in the District of Columbia and the 50 states are required to submit the EEO-1 report. EEO-1 reports should not be submitted for establishments located in Puerto Rico, Guam, Virgin Islands or other American Protectorates. State and local governments, primary and secondary school systems, institutions of higher education, Indian tribes and tax-exempt private memberships clubs other than labor organizations are not subject to the EEO-1 reporting requirements.
2.a. What EEOC files and databases are used?
Response: The data are collected and used in the following files and reports:
2.b. What Federal Agencies are providing data for use in the system?
Response: No federal agencies actually provide data to the system.
2.c. What State and Local Agencies are providing data for use in the system?
Response: No State & local agencies provide data for use in the EEO-1 system.
2.d. What other third party sources will data be collected from?
Response: No other third party sources will be required to file.
2.e What information will be collected from the complainant or company?
Response: Employee demographics by race/ethnicity, gender and nine job categories.
3.a. How will data collected from sources other than EEOC records and the complainant or company be verified for accuracy?
Response: Data will be verified for accuracy by specific computer edits during data submission and by manual and computer edits of all EEO-1 reports submitted on the paper form. Comparisons and anomalies against previous year submissions will also be used as a checkpoint for accuracy.
3.b. How will data be checked for completeness?
Response: Automated checking of all surveys and manual sampling will be used to check for completeness of data.
3.c. Is the data current? How do you know?
Response: Employers are required to use employment data from payroll period during the third quarter (July, August or September) of the current survey year. Penalties for submission of erroneous data assure compliance.
4. Are the data elements described in detail and documented? If yes, what is the name of the document?
Response: The EEO-1 Instruction Booklet details the filing requirements and the data that needs to be collected.
1. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Other)?
Response: Access to the system is limited to the following:
2. How is access to the data by a user determined? Are criteria, procedures, controls, and responsibilities regarding access documented?
Response: Users can only access information using a pin/password. Access to identifiable data is limited to EEOC employees and FEPA employees. All others only get access to aggregate data.
3. Will users have access to all data on the system or will the users access be restricted? Explain.
Response: Companies will only have access to their own data and aggregated non-identifiable data. FEPAs will have access to company data for their locality. EEOC investigators and selected EEOC employees will have access to all data.
4. What controls are in place to prevent the misuse (e.g. browsing) of data by those having access?
Response: Controls in place are limited to EEOC ORIP verifying the need to disseminate the data. Once information is provided to a requestor, to State & Local FEPAs and other EEOC offices, it is the responsibility of the requestor to assure the data is used on a need-to-know basis and only data for their jurisdiction is available to them.
5.a. Do other systems share data or have access to data in this system? If yes, explain. Who will be responsible for protecting the privacy rights of the taxpayers and employees affected by the interface?
Response: No other systems currently have access to the data in this system. The data is used to update the EEO-1 historical file which is a component of the EEO-1 Application System. EEOC ORIP has the responsibility to protect the privacy rights of the employers who provide the EEO-1 Survey data. Future interface is being considered for the Integrated Mission System (IMS), data-warehouse, and a new PC-based System being developed by the Office of General Council (OGC).
6.a. Will other agencies share data or have access to data in this system (International, Federal, State, Local, Other)?
Response: State and local government Fair Employment Practices Agencies are provided system access to their locality. On an as needed basis, ORIP also provides the CD-ROM, reports, and/or files to some federal agencies.
6.b. How will the data be used by the agency? Who is responsible for assuring proper use of the data?
Response: Data will be used for research, class action suits, investigative and litigation support, and comparative analyses.
6.c. How will the system ensure that agencies only get the information they are entitled to under applicable statutes or regulations?
Response: EEOC ORIP manages the EEO-1 Survey and all federal compliance guidelines for collection and use of the data collected. As statutes and regulations are modified or added that impact the EEO-1, EEOC ORIP will make the required modifications to the EEO-1 Survey and survey processes.
1. Is the use of the data both relevant and necessary to the purpose for which the system is being designed?
Response: Yes.
2.a. Will the system derive new data or create previously unavailable data about an individual through aggregation from the information collected?
Response: No, the EEO-1 Survey only collects employer data and aggregate data based on the company's employee population.
2.b. Will the new data be placed in the individuals record (complainant or company)?
Response: Not applicable. The EEO-1 Survey only collects aggregate employer data.
2.c. Can the system make determinations about complainants or companies that would not be possible without the new data?
Response: The system cannot make determinations about complainants; but can make determinations about companies based on the data submitted.
2.d. How will the new data be verified for relevance and accuracy?
Response: Companies are responsible for validating the accuracy of the data as a part of their web-based input. In addition, EEOC Data Quality and Integrity team will validate data using automated edit checks, random manual checks, random sampling of actual survey results, and comparisons to previous survey submissions.
3.a. If data is being consolidated, what controls are in place to protect the data from unauthorized access or use?
Response: The application will be hosted in a secure environment protected by the appropriate fire walls and IT infrastructure, application controls and internal controls.
3.b. If processes are being consolidated, are the proper controls remaining in place to protect the data and prevent unauthorized access? Explain.
Response: As the EEO-1 Web application is developed and becomes operational, all processes will be modified to assure data protections and prevention of unauthorized access. Processes are currently being re-structured, refined and modified.
4. How will the data be retrieved? Can it be retrieved by personal identifier? If yes, explain. What are the potential effects on the due process rights of complainants or companies of: consolidation and linkage of files and systems; derivation of data; accelerated information processing and decision making; use of new technologies. How are the effects to be mitigated?
Response: The data will be retrievable by password. Once EEOC ORIP establishes access specifications for the EEO-1 Survey System, the EEO-1 Survey Systems Administrator will control access using automated tools. Access will be permitted by password for EEOC personnel on a need-to-know basis. Periodic review of the access specifications will be performed to assure adequate protection of all data. Individual employers will only have access to the survey information they submit.
1.a. Explain how the system and its use will ensure equitable treatment of complainants or companies If the system is operated in more than one site, how will consistent use of the system and data be maintained in all sites?
Response: The system will be used at EEOC Headquarters only. Since most investigators are not at headquarters, subsets of data will be disseminated by ORIP to users on a periodic basis and ad-hoc requests will be managed by EEOC ORIP.
1.b. Explain any possibility of disparate treatment of individuals or groups.
Response: Aggregate data has virtually no chance of negatively impacting individuals or groups. The system does store unaggregated company data but not on specific individuals.
2.a. What are the retention periods of data in this system?
Response: Survey data is maintained in the historical file for a minimum of 10 years for comparative purposes. Thereafter, it is stored offline in a secure facility until it is destroyed per EEOC records management guidelines.
2.b. What are the procedures for eliminating the data at the end of the retention period?
Where are the procedures documented?
Response: Source documents such as survey forms, diskettes, and tapes are destroyed after one year; burned or/and shredded. Microfilm and image files are destroyed under controlled conditions.
2.c. While the data is retained in the system, what are the requirements for determining if the data is still sufficiently accurate, relevant, timely, and complete to ensure fairness in making determinations?
Response: The EEO-1 Survey Data is constantly being used. The Statistical Files are used for comparative analyses, data verification and research to assure data accuracy. EEOC ORIP also performs periodic random sampling of data to insure data integrity.
3.a. Is the system using technologies in ways that the EEOC has not previously employed (e.g. Caller-ID)?
Response: Yes, EEOC will be implementing a Web Survey for the 2003 EEO-1 Survey submission.
3.b. How does the use of this technology affect taxpayer/employee privacy?
Response: The new survey should have no impact on taxpayer/employee privacy. The application will ensure privacy of all employer submissions. There is no impact to individuals.
4.a. Will this system provide the capability to identify, locate, and monitor individuals? If yes, explain.
Response: No, the EEO-1 Survey only collects aggregate data from employers.
4.b. Will this system provide the capability to identify, locate, and monitor groups of people? If yes, explain.
Response: No, the system will not have the capability to identify, locate or monitor groups.
4.c. What controls will be used to prevent unauthorized monitoring?
Response: EEOC ORIP will monitor and document the release of data to prevent unauthorized use.
5.a. Under which Systems of Record notice (SOR) does the system operate? Provide number and name.
Response: The Privacy Act does not apply because the system does not contain data on individuals. It collects employer data and aggregated data based on the company's employee population.
5.b. If the system is being modified, will the SOR require amendment or revision? Explain.
Response: Not applicable. The new web-based system will continue to collect employer data and aggregated data based on the company's employee population.
This page was last modified on Febuary 3, 2003.