Download:
pdf |
pdfThe Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
703-235-0780, [email protected]
www.dhs.gov/privacy
Privacy Threshold Analysis
Version date: July 10, 2007
Page 1 of 6
PRIVACY THRESHOLD ANALYSIS (PTA)
CONTACT LISTS
This form is used to determine whether
a Privacy Impact Assessment is required.
Please use the attached form to determine whether a Privacy Impact Assessment (PIA) is required under
the E‐Government Act of 2002 and the Homeland Security Act of 2002.
Please complete this form and send it to the DHS Privacy Office:
Rebecca J. Richards
Director of Privacy Compliance
The Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
Tel: 703‐235‐0780
Fax: 703‐235‐0442
[email protected]
Upon receipt, the DHS Privacy Office will review this form. If a PIA is required, the DHS Privacy Office
will send you a copy of the Official Privacy Impact Assessment Guide and accompanying Template to
complete and return.
A copy of the Guide and Template is available on the DHS Privacy Office website, www.dhs.gov/privacy,
on DHSOnline and directly from the DHS Privacy Office via email: [email protected], phone: 703‐235‐0780,
and fax: 703‐235‐0442.
The Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
703-235-0780, [email protected]
www.dhs.gov/privacy
Privacy Threshold Analysis
Version date: July 10, 2007
Page 2 of 6
PRIVACY THRESHOLD ANALYSIS (PTA)
Please complete this form and send it to the DHS Privacy Office.
Upon receipt, the DHS Privacy Office will review this form
and may request additional information.
SUMMARY INFORMATION
DATE submitted for review: October 30, 2007
NAME of Project: DHS S&T BAA_SBIR
Name of Component: Science and Technology
Name of Project Manager: Elissa Sobolewski
Email for Project Manager: [email protected]
Phone number for Project Manger: 202‐254‐6768
TYPE of Project:
Information Technology and/or System ∗
A Notice of Proposed Rule Making or a Final Rule.
Other:
∗
The E‐Government Act of 2002 defines these terms by reference to the definition sections of Titles 40 and
44 of the United States Code. The following is a summary of those definitions:
•“Information Technology” means any equipment or interconnected system or subsystem of
equipment, used in the automatic acquisition, storage, manipulation, management, movement,
control, display, switching, interchange, transmission, or reception of data or information. See 40
U.S.C. § 11101(6).
•“Information System” means a discrete set of information resources organized for the collection,
processing, maintenance, use, sharing, dissemination, or disposition of information. See: 44. U.S.C. §
3502(8).
Note, for purposes of this form, there is no distinction made between national security systems or
technologies/systems managed by contractors. All technologies/systems should be initially reviewed
for potential privacy impact.
The Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
703-235-0780, [email protected]
www.dhs.gov/privacy
Privacy Threshold Analysis
Version date: July 10, 2007
Page 3 of 6
SPECIFIC QUESTIONS
1.
Describe the project and its purpose:
The DHS S&T BAA_SBIR is a web‐based system that is used to announce DHS
Science and Technology (S&T) Broad Agency Announcement (BAA) and Small
Business Innovation Research (SBIR) solicitations, allow companies to download
solicitation documentation, and allow companies to submit proposals on‐line in
response to those solicitations. For SBIR solicitations, the system also is used for on‐
line review and evaluation of proposals. System users include Companies, who
submit proposals; Reviewers, who review submitted whitepapers and proposals and
evaluate them for possible award, and System Administrators, who administer the
system on behalf of S&T program managers.
2.
Status of Project:
This is a new development effort.
This an existing project.
Date first developed: September 30, 2005
Date last updated:
3.
Could the project relate in any way to an individual?∗
No.
Yes. Please provide a general description, below.
The system requires that users of the system, Companies, Reviewers, and System
Administrators, be registered. Registration involves the collection of limited
identifying and contact information for individuals in each of these three categories.
4.
What information about individuals could be collected, generated or retained?
As part of the registration and proposal submission process, each Company is
required to provide (1) the name, address, and email address of the companyʹs
∗
Projects can relate to individuals in a number of ways. For example, a project may include a camera for
the purpose of watching a physical location. Individuals may walk past the camera and images of those
individuals may be recorded. Projects could also relate to individuals in more subtle ways. For example, a
project that is focused on detecting radioactivity levels may be sensitive enough to detect whether an
individual received chemotherapy.
The Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
703-235-0780, [email protected]
www.dhs.gov/privacy
Privacy Threshold Analysis
Version date: July 10, 2007
Page 4 of 6
president; the name, address, telephone number, FAX number, and email address of
an official point of contact within the company; and the name, address, telephone
number, FAX number, and email address of the principal investigator who will lead
the research effort if the company is awarded a contract. The system maintains a
record of the name, address, telephone number, email address, organization, and title
of all authorized Reviewers. The system also maintains a record of the email address
of all authorized System Administrators.
5.
Is the contact information limited to non‐sensitive personally identifiable information? An
example of sensitive personally identifiable information is the social security number or date of
birth.
The Contact information is non‐sensitive in nature. No Social Security Numbers or Date
of Birth are collected.
The Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
703-235-0780, [email protected]
www.dhs.gov/privacy
Privacy Threshold Analysis
Version date: July 10, 2007
Page 5 of 6
6.
Has an Authority to Operate from the Chief Information Security Officer been granted to the
program or project that the document or database which stores the contact information?
Yes.
No.
7.
Are program or project user access controls in place governing who may view or access the
contact information?
Yes.
8.
No. The contact information must not be universally accessible.
Is the contact information only being used for the purpose for which it originally was
collected, i.e., to contact individuals?
Yes.
No. Any additional sharing or use will require a separate PIA.
9.
Is there a Certification & Accreditation record within OCIO’s FISMA tracking system?
Unknown.
No.
Yes. Please indicate the determinations for each of the following:
Confidentiality:
Integrity:
Availability:
Low
Moderate
High
Undefined
Low
Moderate
High
Undefined
Low
Moderate
High
Undefined
The Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
703-235-0780, [email protected]
www.dhs.gov/privacy
Privacy Threshold Analysis
Version date: July 10, 2007
Page 6 of 6
PRIVACY THRESHOLD REVIEW
(To be Completed by the DHS Privacy Office)
DATE reviewed by the DHS Privacy Office: November 1, 2007
NAME of the DHS Privacy Office Reviewer: Rebecca J. Richards
DESIGNATION:
This is NOT a Privacy Sensitive System – the system contains no Personally Identifiable
Information.
This IS a Privacy Sensitive System
PTA sufficient at this time
A PIA is required
National Security System
Legacy System
HR System
DHS PRIVACY OFFICE COMMENTS
PIA required. System covered under the DHS Contact List PIA, and DHS/ALL‐002
SORN.
| File Type | application/pdf |
| File Title | DHS PRIVACY OFFICE |
| Author | pia |
| File Modified | 2007-11-01 |
| File Created | 2007-11-01 |