DEPARTMENT OF TRANSPORTATION
Federal Highway Administration
PRIVACY IMPACT ASSESSMENT
May 15, 2007
Table of Contents
Overview of FHWA Privacy Management Process for DDETFP
PII and DDETFP
Why DDETFP Collects Information
How DDETFP Will Share Information
How DDETFP Initialization Provides Notice and Consent
How DDETFP Ensures Data Accuracy
How DDETFP Provides Redress
How DDETFP Secures Information
How Long DDETFP retains Information
System of Records
The Federal Highway Administration (FHWA), within the Department of Transportation (DOT), has been given the responsibility for enhancing the movement of people and goods from one place to another, while also ensuring the safety of the traveling public, promoting the efficiency of the transportation system, and protecting the environment.
In support of FHWA’s mission, the Office of Professional and Corporate Development manages the Dwight David Eisenhower Transportation Fellowship Program (DDETFP). DDETFP aims to attract qualified students to the field of transportation education and research and advance transportation workforce development. The DDETFP includes seven fellowship categories including the Graduate Fellowships, Historically Black Colleges and Universities (HBCU) Fellowships, Hispanic Serving Institutions (HSI) Fellowships, Tribal Colleges (TC) Fellowships, People with Disabilities Fellowships, Grants for Research, and Intern Fellowships.
The DDETFP is supported by an automated system that allows for the collection and analysis of vital program information, including personally identifiable information (PII) and non-PII for all participating students. The DDETFP system serves as a management tool to measure program performance and evaluate effectiveness in meeting Federal intent and workforce development common goals and objectives. The system centralizes and integrates FHWA’s student education programs in order more effectively to track students through the education pipeline, identify gaps, evaluate performance, and document return on investments.
The protection of an individual’s privacy is a priority for FHWA. Therefore, privacy management is an integral part of DDETFP. Privacy management utilizes proven technology, sound policies and procedures, and proven methodologies. The FHWA and DOT Privacy Offices and FHWA Information System Security Officer (ISSO) have been involved in on-going privacy and security reviews of the current environment. This involves interviews with key individuals involved with DDETFP to ensure that all uses of PII, along with the risks involved with such use, are identified and documented.
The privacy management process is built upon a methodology that is designed to ensure that DOT and FHWA will have the information, tools, and technology necessary to manage privacy effectively and employ the highest level of fair information practices while allowing FHWA to achieve its mission of protecting and enhancing a most important U.S. transportation system. The methodology is based upon: establishing priority, authority, and responsibility; and using a cross-functional privacy management team to ensure input from systems architecture, technology, security, legal, and other disciplines necessary to ensure that an effective privacy management program is developed.
Internal DOT and FHWA resources will be involved in reviewing the technology, data uses, and associated risks. They will also be involved in developing the necessary redress systems and training programs as well as developing effective policy, practices, and procedures to ensure that fair information practices are complied with. The policies will effectively protect privacy while allowing DOT and FHWA to achieve its mission.
Once the policy, practices, and procedures are developed, they must be implemented. This involves training of all individuals who will have access to process personally identifiable information. Due to changes in technology, personnel, and other aspects of any program, effective privacy management requires that technology and information be available to the privacy management team to ensure that privacy policies, practices, and procedures continue to reflect actual practices. Regular monitoring of compliance with privacy policies, practices, and procedures will be required. This step involves the development and implementation of an effective redress and audit system to ensure that any complaints can be effectively addressed and corrections made if necessary.
The DDETFP system contains both PII and non-PII on participating students. The PII includes name, home mailing address, email address, education records, race (optional), gender (optional), U.S. Citizenship, and home telephone number. FHWA collects this PII directly from the students or from their schools. The DDETFP system also contains the Social Security Numbers (SSN) and dates of birth (DOBs) of previous program participants. These data elements are no longer collected or required by FHWA and will be deleted from affected student records.
For most DDETFP programs, the students download, complete and mail the applications directly to FHWA. Students applying for the HBCU, HSI, or TC Fellowships must send applications to the university’s Campus Program Manager, who in turn mails the applications to FHWA. Student PII is then manually entered by FHWA program staff into the DDETFP system.
DDETFP collects PII and non-PII to allow for analysis and evaluation by FHWA managers to determine program performance and effectiveness. DDETFP does not use PII for any secondary purposes that might require consent unless otherwise authorized by law.
DDETFP information is used solely for analysis and program evaluation. Only FHWA program staff and contractors directly involved in the administration of the program and system have regular access to the information. FHWA does not normally disseminate the data to other agencies nor does it normally release the data to outside parties. However, in cases in which other Federal agencies records or interests are involved, consultation with or referral to those agencies may require transfer of the request-specific PII.
DDETFP does not share PII in any way with external agencies or entities, except as described above. Only approved FHWA staff and contractors have regular access to the system. Also, the records contained in the DDETFP system are subject to the Privacy Act. As such, DDETFP will share information only as permitted under the Privacy Act System of Records Notice for this system. FHWA is in the process of preparing a Privacy Act System of Records Notice that will be published in the Federal Register.
For an individual’s PII to be included in the DDETFP system, the individual must first apply for one of the seven fellowships. Participation in the fellowships is voluntary. Notice is provided to student applicants through this document and the privacy statement that appears on the application form. DDETFP does not collect any application information online. However, the DDETFP web site has an online privacy policy to advise participants of all protections and advisories required by the E-Government Act. DDETFP does not use PII for any secondary purposes that might require consent unless otherwise authorized by law.
Applicants are responsible for the accuracy of the information provided on the forms. Once the form is received by FHWA, the information is entered into DDETFP manually by authorized program staff. Program officials run reports periodically on all data to ensure accuracy. The DDETFP system also has an email notification process on expired applications that advises program officials to review and make updates if necessary.
At any time an individual may contact the FHWA Privacy Office through the public Website and ask questions on privacy. This contact information is provided in the Privacy Policy posted visibly on www.fhwa.dot.gov.
Physical access to the server that houses DDETFP is limited to appropriate personnel through building key cards and room-access key pads. Personnel with physical access have all passed DOT security checks. Access to PII in the system is limited according to job function.
DDETFP has taken all required security measures to safeguard PII and other sensitive data. DDETFP has applied all DOT security standards, including, but not limited to, routine scans and monitoring, back-up activities, and background security checks. DDETFP controls access privileges according to the “minimum necessary” rule. DDETFP is covered under FHWA’s general support system (GSS) certification and accreditation (C&A).
Access to the DDETFP module is controlled from the DDETFP Access Rights page in the FHWA User Profile and Access Control System (UPACS) database. A Privacy Impact Assessment for UPACS may be found at http://www.dot.gov/pia/fhwa_upacs.htm.
ROLE |
ACCESS |
SAFEGUARDS |
|---|---|---|
Admin User |
|
|
Update User |
|
|
Read-Only User |
|
|
In order to analyze historical information on students to determine program effectiveness, the DDETFP will retain information for the life of the program on all participants. Hard copy records are retained and disposed in compliance with the General Records Schedules, National Archives and Records Administration, Washington, DC.
DDETFP is subject to the Privacy Act. FHWA is in the process of preparing a Privacy Act System of Records Notice that will be published in the Federal Register.