DEPARTMENT OF TRANSPORTATION
Research & Innovative Technology Administration

 PRIVACY IMPACT ASSESSMENT 

Volpe Local Area Network (LAN) GSS

June 22, 2009

TABLE OF CONTENTS

System Overview
Information, Including Personally Identifiable Information (PII), in the System
Why LAN Collects Information
How the LAN Uses Information
How the LAN Shares Information
How the LAN Provides Notice and Consent
How the LAN Ensures Data Accuracy
How the LAN Provides Redress
How the LAN Secures Information
How Long the LAN Retains Information
System of Records Notice

 
System Overview

The Volpe LAN GSS system provides access to required local systems and Wide Area Network (WAN) access to both the Internet and other Government Agencies. The LAN is used by Volpe Center employees and contractors.  

The Volpe LAN is defined as the infrastructure required to support mission functionality including network and security devices, electronic mail resources, and intranet resources to include file servers, workstations, printers, etc. The Volpe LAN is managed by Federal Employees within the Information Technology Division (ITD), and Contractor Support Staff. The ITD is responsible for LAN oversight, while contractor staff provides day to day support under guidance of ITD. 

Information, Including Personally Identifiable Information (PII), in the System

There is the potential for PII to reside within the LAN, as the result of being typed into the text of an email message or attached to an email message sent or received by a Volpe Center employee or contractor, or by being downloaded from another system and saved by that system's user to his or her DOT-issued personal computer. Examples of records containing PII that could be stored or transmitted using the LAN include travel, payroll, time and attendance, and other agency personnel records containing PII pertaining to employees and contractors; agency program records containing PII pertaining to members of the public; and employees and contractors personal records (non-agency records). 

Why LAN Collects Information

The Volpe LAN is a communications system, not a system of records. The Volpe LAN does not actively collect information; it is used by Volpe Center employees and contractors in the course of conducting official DOT business to store and communicate information that they receive from, or generate for inclusion in, other systems that constitute systems of record. Volpe personnel may also make limited, incidental personal use of the Volpe LAN to store and communicate personal information about themselves, their family members and their friends. 

How the LAN Uses Information

See Why LAN Collects Information.

How the LAN Shares Information

Personally identifiable information is shared outside the agency when a Volpe Center employee or contractor sends an email message or email attachment containing PII to another agency or member of the public in the course of conducting official DOT business (or when making personal use of the LAN). 

How the LAN Provides Notice and Consent

Because the LAN is not a system of records, it is not subject to the requirements of 5 U.S.C. 552a(e)(3). 

How the LAN Ensures Data Accuracy

Because the LAN is not a system of records (and therefore not a source system), the LAN does not ensure data accuracy. 

How the LAN Provides Redress

Because the LAN is not a system of records, it is not subject to the requirements of 5 U.S.C. 552a(e)(4)(H).

How the LAN Secures Information

Critical components of the LAN are accessed by the system administration group which manages user IDs and passwords, security settings, and patching/upgrades. Each Volpe Center employee and contractor is allowed access to his or her LAN account only. Physical access to the system is restricted through security guards and access badges required to enter the Volpe facility. All Volpe Center employees and contractors are subject to the Information Systems Rules of Behavior and receive annual security awareness training.  

The LAN is secured by a combination of firewalls, anti-virus controls, intrusion detection and prevention systems, network controls, access lists and account creation, policing and termination processes. 

How Long the LAN Retains Information

Each LAN account holder (i.e., Volpe Center employee or contractor) controls the retention and deletion of information in his or her account while the account is active. A user's account(s) on the LAN are disabled immediately after the employee or contractor leaves the Volpe Center. 

System of Records Notice

Because the LAN is not a system of records for purposes of the Privacy Act, a SORN is not required to be published.