U.S. DEPARTMENT OF TRANSPORTATION
Federal Motor Carrier Safety Administration
Privacy Impact Assessment (PIA)
FMCSA Service Centers
June 15, 2009
Table of Contents
Overview of FMCSA Privacy Management Process for FMCSA Service Centers
Personally Identifiable Information (PII) and FMCSA Service Centers
Why FMCSA Service Centers Collects Information
How FMCSA Service Centers Uses Information
How FMCSA Service Centers Shares Information
How FMCSA Service Centers Provides Notice and Consent
How FMCSA Service Centers Ensures Data Accuracy
How FMCSA Service Centers Provides Redress
How FMCSA Service Centers Secures Information
How Long FMCSA Service Centers Retains Information
System of Records
Overview of FMCSA Privacy Management Process for FMCSA Service Centers
The Federal Motor Carrier Safety Administration (FMCSA) within the U.S. Department of Transportation (DOT) has been given the mission of reducing crashes, injuries, and fatalities involving large trucks and buses (motor carriers). In carrying out its safety mandate, FMCSA:
- Develops and enforces data-driven regulations that balance motor carrier safety with industry efficiency
- Employs safety information systems to focus on higher risk motor carriers in enforcing safety regulations
- Targets educational messages to motor carriers, commercial drivers, and the public
To meet these goals, FMCSA partners with stakeholders—including federal, state, and local enforcement agencies; the motor carrier industry; safety groups; and organized labor—on efforts to reduce crashes involving motor carriers. Since the first step towards reducing accidents is to understand them, FMCSA collects and maintains commercial vehicle safety data as well as a national inventory of motor carriers and shippers subject to Federal Motor Carrier Safety Regulations (FMCSR) and Federal Hazardous Materials Regulations (FHMR). FMCSA Service Centers—a system consisting of the Eastern Service Center (ESC), Western Service Center (WSC), Midwestern Service Center (MWSC), and Southern Service Center (SSC)—is a general support system that helps FMCSA manage this data.
FMCSA Service Centers primarily processes FMCSA enforcement cases and stores enforcement reports. FMCSA Service Centers also hosts the SAFETYNET database management system.
Privacy management is an integral part of FMCSA Service Centers. DOT/FMCSA has retained the services of privacy experts to assess its Privacy Management Program through the use of proven technologies, sound policies and procedures, and established methodologies.
The DOT privacy management process is built upon a methodology that enables DOT/FMCSA has the information, tools, and technology necessary to effectively protect Personally Identifiable Information (PII) while allowing FMCSA to achieve its mission. The methodology includes the following:
- Establishing appropriate authorities, responsibilities, and controls for information management with input from systems architecture, technology, security, legal, and other disciplines
- Identifying, documenting, and addressing privacy risks
- Developing and implementing appropriate policies and procedures and updating them when necessary
- Monitoring compliance with applicable laws, regulations, policies, and procedures
- Providing training to all DOT employees and contractors with access to PII
- Effectively maintaining the privacy protection principles of:
- Openness
- Individual Participation
- Purpose Specification
- Collection Limitation
- Use Limitation
- Data Quality and Integrity
- Security Safeguards
- Accountability and Auditing
Privacy is a significant consideration in the operation of FMCSA Service Centers.
Personally Identifiable Information (PII) and FMCSA Service Centers
This Privacy Impact Assessment (PIA) was conducted because FMCSA Service Centers processes and stores the following PII from commercial motor vehicle (CMV) drivers and motor carrier representatives. PII collected through different desktop applications are as described below:
- Name
- Home address
- Home phone number and/or cell phone number
- Social Security Number
- Date of Birth
- Driver’s license number
- Mother’s maiden name
- Medical Information
Why FMCSA Service Centers Collects Information
FMCSA Service Centers performs safety compliance and enforcement activities on motor carriers, CMVs, and CMV drivers and provides direct oversight and management of FMCSA Division Offices. The information collected during safety compliance and enforcement activities is used to conduct trend analyses to ensure that enforcement actions are implemented consistently and appeals are processed efficiently. This information is also used to verify information related to medical waivers and vehicle registrations.
How FMCSA Service Centers Uses Information
Information collected by FMCSA Service Centers allows each regional service center to perform the following functions under the direction and supervision of designated FMCSA Field Administrators:
- Ensure that enforcement actions are justifiable and uniformly applied to all motor carriers, CMVs, and CMV drivers
- Respond promptly to appeals submitted by motor carriers and CMV drivers related to enforcement actions ordered by FMCSA division offices
- Evaluate the legitimacy of enforcement actions during the appeals process
- Identify process improvements and implement regulatory and program initiatives
- Recommend additional training for FMCSA employees and contractors when needed
- Identify educational opportunities for FMCSA customers
- Provide oversight of the Commercial Driver’s License (CDL) Program and various grant programs in FMCSA division offices
- Provide technical advice and assistance to FMCSA division offices concerning hazardous materials, Intelligent Transportation Systems (ITS) and Commercial Vehicle Operations (CVO), etc.
- Prepare responses to Congressional correspondence, including comments on proposed rulemaking and legislation related to FMCSA field operations
How FMCSA Service Centers Shares Information
FMCSA Service Centers is an environment consisting of four regional service centers, Field Offices and Southern Border Offices. FMCSA Service Centers is a General Support System that provides the infrastructure to support several FMCSA desktop applications. FMCSA Personnel such as -Attorneys, Safety Investigators and Enforcement Personnel have access to the information collected through the Service Centers system. FMCSA Service Centers does not interface or exchange data with any third-party systems. FMCSA Service Centers is interconnected with several FMCSA systems, including Motor Carrier Management Information System (MCMIS), Safety and Fitness Electronic Records (SAFER), Query Central (QC), and SAFETYNET. These systems require an internet connection. This interconnectivity allows Federal and State safety personnel to determine if motor carriers, CMVs, and CMV drivers are in violation of FMCSA safety regulations.
FMCSA Service Centers also collects PII and non-PII from the following FMCSA desktop applications that resides on the Service Centers. Each of the following applications are self-contained and exist as icons on computers:
- ASPEN -- Allows federal and state safety personnel to collect CMV and CMV driver information from roadside safety inspections and other FMCSA applications. Records and reports in this system may include inspection related to the driver which may include (name, date of birth, and driver’s CDL number) and violation information (section, violation description, out of service (OOS), and citation information).
- CaseRite -- Assists federal prosecutors in creating legal cases for FMCSR and FHMR violations. CASERITE does collect Personal Identifier Information on truck drivers including names, social security numbers, vehicle identifications, mailing addresses and telephone numbers. The purpose of this program is to gather violation data that has been collected from roadside inspections and compliance review investigations. This information is then collated and used to produce legal case documents for prosecution and subsequently uploaded into the Enforcement Management Information System (EMIS).
- ISS -- Screens CMVs to determine if an inspection should be conducted.
- PIQ -- Provides access to inspection reports from previous sixty days.
- ProVu -- Allows federal, state, and private industry users to view and analyze standard FMCSA motor carrier profiles.
- UFA -- Calculates fines according to the nature of the safety violation and various criteria included in the FMCSR.
- SAFETYNET -- Allows federal and state safety personnel to access, report, and analyze data obtained from inspections, crashes, compliance reviews, motor carrier complaints, and the motor carrier census.
- CDLIS -- Allows qualified law enforcement personnel to determine CDL status and obtain safety violation conviction histories for CMV drivers.
- Compliance Analysis and Performance Review Information (CAPRI) -- Provides federal and state safety personnel with information needed to conduct compliance reviews, safety audits, specialized cargo tank facility reviews, and hazardous material shipper reviews. CAPRI collects Personal Identifier Information (PII) on truck drivers including names, Dates of Birth, Driver License numbers, and Social Security Numbers for identifying drivers. The CAPRI system is used in preparing compliance reviews and safety audits conducted by Federal and State personnel, as well as specialized cargo tank facility reviews, hazardous material shipper reviews and security contact reviews. It electronically transfers data through the CAPRI Web Service to MCMIS (and optionally to SAFETYNET).
- Electronic Document Management Systems (EDMS) -- A web-based commercial off-the-shelf software program that was customized for the Federal Motor Carrier Safety Administration. This system allows for the storage and retrieval of documents, including compliance reviews, enforcement cases, and safety audit documents, in a paperless environment. EDMS is the central repository for FMCSA documents. Inputs include both scanned and electronically generated documents.
- Mobile Client Application (MCA) -- The MCA is an evolutionary application framework that will, over several iterations spanning two years, provide the functionality required by federal, state, and local enforcement field staff to monitor and enforce Motor Carrier Safety Regulations. The MCA will, with each release, subsume and extend the functionality of the existing FMCSA desktop applications listed above targeted for retirement. The December 2009 release of MCA may include the following information on drivers:
- SSN
- Name
- Address
- Email address
- Telephone
- Commercial Driver's License (CDL) data
How FMCSA Service Centers Provides Notice and Consent
CMV drivers and motor carrier representatives are required under 49 U.S.C. § 31106 to provide information as part of the inspection and crash data collection process. Since PII collected from CMV drivers and motor carrier representatives by FMCSA Service Centers is used to fulfill FMCSA statutory and regulatory mandates, these individuals cannot specify how their PII will be used or shared.
How FMCSA Service Centers Ensures Data Accuracy
Information entered into FMCSA Service Centers is compared with information in other FMCSA systems (MCMIS, SAFER, QC, ASPEN, CaseRite, ISS, PIQ, ProVu, UFA, SAFETYNET, and CDLIS) to ensure data accuracy. Information providers, such as state inspectors and other officials, are responsible for the accuracy and completeness of data entered into FMCSA Service Centers.
How FMCSA Service Centers Provides Redress
Individuals can electronically file concerns about Federal and State data released to the public by FMCSA via the FMCSA DataQs system (https://dataqs.fmcsa.dot.gov/login.asp). Individuals can use DataQs to challenge information included in their records. Motor carriers, State agencies, and FMCSA offices can use DataQs to challenge information concerning crashes, inspections, compliance reviews, safety audits, enforcement actions, vehicle registrations, operating authorities, insurance policies, and consumer complaints. After a challenge has been submitted, DataQs automatically forwards the challenge to the appropriate office for resolution and allows the party that submitted the challenge to monitor its status.
DataQs cannot be used to challenge safety ratings or civil actions managed under 49 CFR 385.15 (Administrative Review) or 49 CFR 385.17 (Change to Safety Rating Based upon Corrective Actions). Any challenges to information provided by state agencies must be resolved by the appropriate state agency.
How FMCSA Service Centers Secures Information
User access controls were developed to ensure that the number of individuals with access to restricted information in FMCSA Service Centers was kept to a minimum and was restricted to only those with a “need to know.” This strategy improves data confidentiality and integrity. These access controls were developed in accordance with Federal Information Processing Standards (FIPS) Publication 200, Minimum Security Requirements for Federal Information and Information Systems dated March 2006 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Rev. 2, Recommended Security Controls for Federal Information Systems dated December 2007. Audit provisions were also included to ensure that FMCSA Service Centers is used appropriately by authorized users and monitored for unauthorized usage.
Data access is determined by permission levels, and FMCSA Service Centers employs role-based access controls. All users are assigned applicant roles when user profiles are initially set up. User roles are modified to higher levels with additional system capabilities upon authorization by designated FMCSA Field Administrators. Users are required to authenticate with a valid user name and password in order to gain access to FMCSA Service Centers.
A certification and accreditation (C&A) is performed every three years to ensure that FMCSA Service Centers meets FMCSA and federal security requirements. FMCSA Service Centers also undergoes an additional C&A whenever a major change occurs to the system. FMCSA Service Centers is assessed in accordance with the Office of Management and Budget (OMB) Circular A-130 Appendix III, Security of Federal Automated Information Resources and the DOT Certification and Accreditation Guidance.
Additional activities are performed more frequently to ensure that FMCSA Service Centers complies with regulatory requirements. FMCSA Service Centers undergoes an annual risk assessment to identify threats and risks, and all unacceptable risks are documented in a Plan of Action and Milestones (POA&M) for remediation by the system owner. As open risk items are resolved, the FMCSA IT Security Team updates the appropriate security documents with the new information. Continuous monitoring activities are also performed at least annually to provide ongoing oversight of security controls and to detect misuse of information stored in FMCSA Service Centers. The FMCSA Continuous Monitoring Program involves the following activities:
- Configuration management and configuration control processes
- Security impact analyses on changes to the information system
- Regular assessments of select security controls in the information system
- Security status reports to appropriate agency officials
How Long FMCSA Service Centers Retains Information
Electronic records are retained on backup media for at least one year. When the records are no longer required for safety compliance and enforcement activities, they are sent to the Electronic Document Management System (EDMS) to be archived in accordance with FMCSA retention procedures. Hardcopy records are retained and disposed of in accordance with applicable General Records Schedules published by the U.S. National Archives and Records Administration (http://www.archives.gov/records-mgmt/ardor/records-schedules.html).
System of Records
FMCSA Service Centers is subject to the Privacy Act of 1974. FMCSA is in the process of preparing a Privacy Act System of Records Notice (SORN) for publication in the Federal Register.