U.S. DEPARTMENT OF TRANSPORTATION
Federal Motor Carrier Safety Administration
Privacy Impact Assessment (PIA)
June 15, 2009
Overview of FMCSA Privacy Management Process for FMCSA Service Centers
Personally Identifiable Information (PII) and FMCSA Service Centers
Why FMCSA Service Centers Collects Information
How FMCSA Service Centers Uses Information
How FMCSA Service Centers Shares Information
How FMCSA Service Centers Provides Notice and Consent
How FMCSA Service Centers Ensures Data Accuracy
How FMCSA Service Centers Provides Redress
How FMCSA Service Centers Secures Information
How Long FMCSA Service Centers Retains Information
System of Records
Overview of FMCSA Privacy Management Process for FMCSA Service Centers
The Federal Motor Carrier Safety Administration (FMCSA) within the U.S. Department of Transportation (DOT) has been given the mission of reducing crashes, injuries, and fatalities involving large trucks and buses (motor carriers). In carrying out its safety mandate, FMCSA:
To meet these goals, FMCSA partners with stakeholders—including federal, state, and local enforcement agencies; the motor carrier industry; safety groups; and organized labor—on efforts to reduce crashes involving motor carriers. Since the first step towards reducing accidents is to understand them, FMCSA collects and maintains commercial vehicle safety data as well as a national inventory of motor carriers and shippers subject to Federal Motor Carrier Safety Regulations (FMCSR) and Federal Hazardous Materials Regulations (FHMR). FMCSA Service Centers—a system consisting of the Eastern Service Center (ESC), Western Service Center (WSC), Midwestern Service Center (MWSC), and Southern Service Center (SSC)—is a general support system that helps FMCSA manage this data.
FMCSA Service Centers primarily processes FMCSA enforcement cases and stores enforcement reports. FMCSA Service Centers also hosts the SAFETYNET database management system.
Privacy management is an integral part of FMCSA Service Centers. DOT/FMCSA has retained the services of privacy experts to assess its Privacy Management Program through the use of proven technologies, sound policies and procedures, and established methodologies.
The DOT privacy management process is built upon a methodology that enables DOT/FMCSA has the information, tools, and technology necessary to effectively protect Personally Identifiable Information (PII) while allowing FMCSA to achieve its mission. The methodology includes the following:
Privacy is a significant consideration in the operation of FMCSA Service Centers.
Personally Identifiable Information (PII) and FMCSA Service Centers
This Privacy Impact Assessment (PIA) was conducted because FMCSA Service Centers processes and stores the following PII from commercial motor vehicle (CMV) drivers and motor carrier representatives. PII collected through different desktop applications are as described below:
Why FMCSA Service Centers Collects Information
FMCSA Service Centers performs safety compliance and enforcement activities on motor carriers, CMVs, and CMV drivers and provides direct oversight and management of FMCSA Division Offices. The information collected during safety compliance and enforcement activities is used to conduct trend analyses to ensure that enforcement actions are implemented consistently and appeals are processed efficiently. This information is also used to verify information related to medical waivers and vehicle registrations.
How FMCSA Service Centers Uses Information
Information collected by FMCSA Service Centers allows each regional service center to perform the following functions under the direction and supervision of designated FMCSA Field Administrators:
How FMCSA Service Centers Shares Information
FMCSA Service Centers is an environment consisting of four regional service centers, Field Offices and Southern Border Offices. FMCSA Service Centers is a General Support System that provides the infrastructure to support several FMCSA desktop applications. FMCSA Personnel such as -Attorneys, Safety Investigators and Enforcement Personnel have access to the information collected through the Service Centers system. FMCSA Service Centers does not interface or exchange data with any third-party systems. FMCSA Service Centers is interconnected with several FMCSA systems, including Motor Carrier Management Information System (MCMIS), Safety and Fitness Electronic Records (SAFER), Query Central (QC), and SAFETYNET. These systems require an internet connection. This interconnectivity allows Federal and State safety personnel to determine if motor carriers, CMVs, and CMV drivers are in violation of FMCSA safety regulations.
FMCSA Service Centers also collects PII and non-PII from the following FMCSA desktop applications that resides on the Service Centers. Each of the following applications are self-contained and exist as icons on computers:
How FMCSA Service Centers Provides Notice and Consent
CMV drivers and motor carrier representatives are required under 49 U.S.C. § 31106 to provide information as part of the inspection and crash data collection process. Since PII collected from CMV drivers and motor carrier representatives by FMCSA Service Centers is used to fulfill FMCSA statutory and regulatory mandates, these individuals cannot specify how their PII will be used or shared.
How FMCSA Service Centers Ensures Data Accuracy
Information entered into FMCSA Service Centers is compared with information in other FMCSA systems (MCMIS, SAFER, QC, ASPEN, CaseRite, ISS, PIQ, ProVu, UFA, SAFETYNET, and CDLIS) to ensure data accuracy. Information providers, such as state inspectors and other officials, are responsible for the accuracy and completeness of data entered into FMCSA Service Centers.
How FMCSA Service Centers Provides Redress
Individuals can electronically file concerns about Federal and State data released to the public by FMCSA via the FMCSA DataQs system (https://dataqs.fmcsa.dot.gov/login.asp). Individuals can use DataQs to challenge information included in their records. Motor carriers, State agencies, and FMCSA offices can use DataQs to challenge information concerning crashes, inspections, compliance reviews, safety audits, enforcement actions, vehicle registrations, operating authorities, insurance policies, and consumer complaints. After a challenge has been submitted, DataQs automatically forwards the challenge to the appropriate office for resolution and allows the party that submitted the challenge to monitor its status.
DataQs cannot be used to challenge safety ratings or civil actions managed under 49 CFR 385.15 (Administrative Review) or 49 CFR 385.17 (Change to Safety Rating Based upon Corrective Actions). Any challenges to information provided by state agencies must be resolved by the appropriate state agency.
How FMCSA Service Centers Secures Information
User access controls were developed to ensure that the number of individuals with access to restricted information in FMCSA Service Centers was kept to a minimum and was restricted to only those with a “need to know.” This strategy improves data confidentiality and integrity. These access controls were developed in accordance with Federal Information Processing Standards (FIPS) Publication 200, Minimum Security Requirements for Federal Information and Information Systems dated March 2006 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Rev. 2, Recommended Security Controls for Federal Information Systems dated December 2007. Audit provisions were also included to ensure that FMCSA Service Centers is used appropriately by authorized users and monitored for unauthorized usage.
Data access is determined by permission levels, and FMCSA Service Centers employs role-based access controls. All users are assigned applicant roles when user profiles are initially set up. User roles are modified to higher levels with additional system capabilities upon authorization by designated FMCSA Field Administrators. Users are required to authenticate with a valid user name and password in order to gain access to FMCSA Service Centers.
A certification and accreditation (C&A) is performed every three years to ensure that FMCSA Service Centers meets FMCSA and federal security requirements. FMCSA Service Centers also undergoes an additional C&A whenever a major change occurs to the system. FMCSA Service Centers is assessed in accordance with the Office of Management and Budget (OMB) Circular A-130 Appendix III, Security of Federal Automated Information Resources and the DOT Certification and Accreditation Guidance.
Additional activities are performed more frequently to ensure that FMCSA Service Centers complies with regulatory requirements. FMCSA Service Centers undergoes an annual risk assessment to identify threats and risks, and all unacceptable risks are documented in a Plan of Action and Milestones (POA&M) for remediation by the system owner. As open risk items are resolved, the FMCSA IT Security Team updates the appropriate security documents with the new information. Continuous monitoring activities are also performed at least annually to provide ongoing oversight of security controls and to detect misuse of information stored in FMCSA Service Centers. The FMCSA Continuous Monitoring Program involves the following activities:
How Long FMCSA Service Centers Retains Information
Electronic records are retained on backup media for at least one year. When the records are no longer required for safety compliance and enforcement activities, they are sent to the Electronic Document Management System (EDMS) to be archived in accordance with FMCSA retention procedures. Hardcopy records are retained and disposed of in accordance with applicable General Records Schedules published by the U.S. National Archives and Records Administration (http://www.archives.gov/records-mgmt/ardor/records-schedules.html).
System of Records
FMCSA Service Centers is subject to the Privacy Act of 1974. FMCSA is in the process of preparing a Privacy Act System of Records Notice (SORN) for publication in the Federal Register.