DEPARTMENT OF TRANSPORTATION
Office of the Secretary of Transportation (OST)
PRIVACY IMPACT ASSESSMENT
November 13, 2008
TABLE OF CONTENTS
Overview of Privacy Management Process
Personally Identifiable Information (PII) & CCMS
Why CCMS Collects Information
How CCMS uses information
How CCMS Shares Information
How CCMS Provides Notice and Consent
How CCMS Ensures Data Accuracy
How CCMS Provides Redress
How CCMS Secures Information
How Long CCMS Retains Information
System of Records
The Office of the Secretary (OST) oversees the formulation of national transportation policy and promotes intermodal transportation. Other responsibilities range from negotiation and implementation of international transportation agreements, assuring the fitness of US airlines, enforcing airline consumer protection regulations, issuance of regulations to prevent alcohol and illegal drug misuse in transportation systems and preparing transportation legislation.
Privacy management is an integral part of the Department of Transportation (DOT) Correspondence Control Management System (CCMS). The Office of the Secretary (OST) has retained the services of privacy experts to help assess its privacy management program, utilizing proven technology, sound policies and procedures, and established methodologies.
The privacy management process is built upon a methodology that has been developed and implemented in leading companies around the country and globally. The methodology is designed to help ensure that DOT and OST will have the information, tools and technology necessary to manage privacy effectively and employ the highest level of fair information practices while allowing OST to achieve its mission of protecting and enhancing the U.S. transportation system. The methodology is based upon the following steps:
CCMS is used to control and manage official correspondence to the Secretary, Deputy Secretary, Chief of Staff, and Executive Secretariat. As such, it contains information on individuals that includes names and addresses.
The CCMS modules will contain and publicly post the following information: CCMS does not publicly post any PII information.
CCMS collects the PII in order to effectively track case assignments.
CCMS collects the PII in order to effectively manage correspondence to high ranking DOT officials.
In accordance with Section 1.9 of the CCMS System Security Plan, CCMS is located on DOT�s Intranet. The system is not available on the Internet; however, access is possible through a VPN connection. The system does not share data with other systems.
CCMS displays the DOT approved system warning banner to alert users of notice and consent to monitoring prior to login.
CCMS employs the data accuracy checks inherit in MS SQL 2000 database software to ensure data validity and accuracy. The system has been reviewed to ensure, to the greatest extent possible, it is accurate, relevant, timely and complete via security testing and evaluation.
Validation checks are built into the application software that both prompt the user that an incorrect entry has been entered and must be corrected, and that a user has successfully input data.
CCMS takes appropriate security measures to safeguard PII and other sensitive data. CCMS applies DOT security standards, including but not limited to routine scans and monitoring, back-up activities, and background security checks of OST employees and contractors.
ROLE |
ACCESS |
SAFEGUARDS |
---|---|---|
STAFF |
|
|
ADMIN |
|
|
CCMS retains PII information for a minimum of one year.
CCMS contains information that is part of existing System of Records subject to the Privacy Act, because it can be searched by an individual�s name and address. In most instances, DOT/OST 41 applies and the Department of Transportation controls the data and maintains System of Records responsibilities.
OST has certified and accredited the security of CCMS in accordance with DOT information technology security standard requirements.