Privacy Threshold Analysis

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 1 of 11

PRIVACY THRESHOLD ANALYSIS (PTA)
This form is used to determine whether
a Privacy Impact Assessment is required.

Please use the attached form to determine whether a Privacy Impact Assessment (PIA) is required under
the E-Government Act of 2002 and the Homeland Security Act of 2002.
Please complete this form and send it to your component Privacy Office. If you do not have a component
Privacy Office, please send the PTA to the DHS Privacy Office:
Senior Director, Privacy Compliance
The Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
Tel: 202-343-1717
[email protected]

Upon receipt from your component Privacy Office, the DHS Privacy Office will review this form. If a
PIA is required, the DHS Privacy Office will send you a copy of the Official Privacy Impact Assessment
Guide and accompanying Template to complete and return.
A copy of the Guide and Template is available on the DHS Privacy Office website,
www.dhs.gov/privacy, on DHSConnect and directly from the DHS Privacy Office via email:
[email protected], phone: 202-343-1717.

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 2 of 11

PRIVACY THRESHOLD ANALYSIS (PTA)
SUMMARY INFORMATION
Project or
Program Name:

Form I-140, Immigrant Petition for Alien Worker

Component:

U.S. Citizenship and
Immigration Services (USCIS)

Office or
Program:

Service Center Operations

Xacta FISMA
Name (if
applicable):

N/A

Xacta FISMA
Number (if
applicable):

N/A

Type of Project or
Program:

Form or other Information
Collection

Project or
program
status:

Existing

Date first
developed:
Date of last PTA
update

Click here to enter a date.

Pilot launch
date:

N/A

December 17, 2012

Pilot end date:

ATO Status (if
applicable)

Choose an item.

ATO
expiration date
(if applicable):

N/A

PROJECT OR PROGRAM MANAGER
Name:

Alexander King

Office:

Service Center Operations

Title:

Adjudications Officer

Phone:

202-272-8162

Email:

[email protected].
gov

INFORMATION SYSTEM SECURITY OFFICER (ISSO) (IF APPLICABLE)
Name:

Click here to enter text.

Phone:

Click here to enter text.

Email:

Click here to enter text.

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 3 of 11

SPECIFIC PTA QUESTIONS
1. Reason for submitting the PTA: Renewal PTA
Form I-140, Immigrant Petition for Alien Worker
Form I-140 is used to petition USCIS for an immigrant visa based on employment. A United States
employer may file this petition for:
• An outstanding professor or researcher with at least three year of experience in teaching or research in
the academic area who is internationally recognized as outstanding.
• An alien, who in the 3 years preceding the filing of this petition, has been employed in a primarily
managerial or executive capacity for at least 1 year by a firm or corporation or other legal entity and
who seeks to enter the United States to continue to render service to the same employer, or to
subsidiary or affiliate, in a capacity that is managerial or executive.
• A member of the professions holding an advanced degree or an alien with exceptional ability in the
sciences, arts, or business who will substantially benefit the national economy, cultural or educational
interests, or welfare of the United States.
• A member of the professions with a baccalaureate degree.
• An unskilled worker to preform labor for which qualifies workers are not available in the United
states.
In addition, any employer, person, or third party may file this petition, including the alien beneficiary of
the petition if the person is being filed for:



An alien of extraordinary ability in the sciences, arts, education, business, or athletics
demonstrated by sustained national or international acclaim and whose achievements have been
recognized in the field.
A member of the profession holding an advanced degree or is claiming exceptional ability in the
sciences, arts, or business, and is seeking an exemption of the requirements of a job offer in the
national interest generally known as a national interest waiver.

A complete Form I-140 application package includes the completed form, Department of Labor (DOL)approved Labor certification, a financial statement proving that the employer's financial position,
employee's experience letters at the previous employments from the concerned employers, degree
certificates, qualification certificates and other documents proving the educational qualification, and the
filing fee. Data from Form I-140 is entered into CLAIMS 3. The completed form and its supplemental
documentation are consolidated into an A-File.
This is a renewal PTA and there have not been any updates to the Form I-140 as of 2/3/2016.

2. Does this system employ any of the
following technologies:

Closed Circuit Television (CCTV)
Social Media

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 4 of 11

If you are using any of these technologies and
want coverage under the respective PIA for that
technology please stop here and contact the DHS
Privacy Office for further guidance.

3. From whom does the Project or
Program collect, maintain, use, or
disseminate information?
Please check all that apply.

Web portal1 (e.g., SharePoint)
Contact Lists
None of these

This program does not collect any personally
identifiable information2
Members of the public
DHS employees/contractors (list components):
Contractors working on behalf of DHS
Employees of other federal agencies

4. What specific information about individuals is collected, generated or retained?
Form I-140, Immigrant Petition for Alien Worker, collects information about the petitioner, beneficiary,
the dependents of the beneficiary, and preparer.
Information about the petitioner includes:
 Full name
 Company name
 Mailing address
 IRS Tax number
 SSN
 Email address
 Type of business
 Income
 Number of employees
 NAICS Codes
 Labor certification number and expiration date, signature.
Information about the beneficiary includes:
1

Informational and collaboration-based portals in operation at DHS and its components that collect, use, maintain, and share
limited personally identifiable information (PII) about individuals who are “members” of the portal or “potential members” who
seek to gain access to the portal.
2
DHS defines personal information as “Personally Identifiable Information” or PII, which is any information that permits the
identity of an individual to be directly or indirectly inferred, including any information that is linked or linkable to that individual,
regardless of whether the individual is a U.S. citizen, lawful permanent resident, visitor to the U.S., or employee or contractor to
the Department. “Sensitive PII” is PII, which if lost, compromised, or disclosed without authorization, could result in substantial
harm, embarrassment, inconvenience, or unfairness to an individual. For the purposes of this PTA, SPII and PII are treated the
same.

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 5 of 11

















Full name
Mailing address
Email address
Phone number,
Country and date of birth
Country of citizenship/nationality
A-number
SSN
Passport Number
Travel Document Number
Country of Issuance for Passport or Travel Document and Expiration Date for Passport or Travel
Document
I-94 Number
Date of Arrival
Current nonimmigrant status and expiration date
Immigration history Signature

Information on the spouse and all children of the beneficiary:
 Full name
 Relationship to beneficiary
 Date of birth
 Country of birth.
Information on the preparer includes:
 Name
 Signature
 Firm name
 Mailing address
 Phone number
 Email address
The authority to collect information in this form is set forth in the Immigration and Nationality Act, 8
U.S.C. §§ 1103, 1158, 1225, 1228, and Title II of Public Law 105-100 and in the implementing
regulations found in volume 8 of the Code of Federal Regulations (CFR). The SSN information collected
within the form I-539 application is used to assist the DHS in enforcing the immigration laws of the
United States by providing timely and accurate information about persons who are subject to those laws.

4(a) Does the project, program, or system
retrieve information by personal identifier?

No. Please continue to next question.
Yes. If yes, please list all personal identifiers
used:
The Form I-140 collects the following personal
identifiers: A-number; petitioner’s name; ; company

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 6 of 11

IRS Tax Number;; beneficiary’s name; date-ofbirth; social security number. Personal identifying
data collected on the Form I-140 is entered into
CLAIMS3. Immigration Services Officers may
retrieve specific I-140 records in CLAIMS 3 by
entering the I-140 receipt number, the petitioner’s
name, or the beneficiary’s full name.
4(b) Does the project, program, or system
use Social Security Numbers (SSN)?
4(c) If yes, please provide the specific legal
basis and purpose for the collection of
SSNs:
4(d) If yes, please describe the uses of the
SSNs within the project, program, or
system:
4(e) If this project, program, or system is
an information technology/system, does it
relate solely to infrastructure?

No.
Yes.
The authorities for this collection are Section 222 of
the Immigration and Nationality 8 USC §1202 and 8
Section 103.2 of Code of Federal Regulations.
The Social Security Number in conjunction with
other information is used to verify the eligibility of
the applicant.

No. Please continue to next question.
Yes. If a log kept of communication traffic,
please answer the following question.

For example, is the system a Local Area Network
(LAN) or Wide Area Network (WAN)?
4(f) If header or payload data3 is stored in the communication traffic log, please detail the data
elements stored.
Click here to enter text.

No.
5. Does this project, program, or system
connect, receive, or share PII with any
other DHS programs or systems4?

3

Yes. If yes, please list:
CLAIMS 3 – for processing/adjudication purposes;
EDMS Receipt File- for storage/electronic A-file
purposes

When data is sent over the Internet, each unit transmitted includes both header information and the actual data being sent. The
header identifies the source and destination of the packet, while the actual data is referred to as the payload. Because header
information, or overhead data, is only used in the transmission process, it is stripped from the packet when it reaches its destination.
Therefore, the payload is the only data received by the destination system.
4
PII may be shared, received, or connected to other DHS systems directly, automatically, or by manual processes. Often, these
systems are listed as “interconnected systems” in Xacta.

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 7 of 11

Validation Instrument Business Tool. (VIBE) – to
perform a VIBE check to validate or check the
business information provided on Form I-140
against public business information maintained by
Dunn And Bradstreet.
No.
Yes. If yes, please list:

6. Does this project, program, or system
connect, receive, or share PII with any
external (non-DHS) partners or
systems?

Department of State receives approved I-140s from
USCIS when the beneficiary elects to apply for an
immigrant visa abroad. Information is shared via
secure mail. Upon receipt, DOS enters relevant
information into the Consular Consolidated
Database.
The physical I-140 petition and supporting evidence
is shipped directly to DOS when the beneficiary is
applying for an Immigrant Visa abroad as opposed
to adjustment of status in the United States, which
USCIS handles.

6(a) Is this external sharing pursuant to
new or existing information sharing
access agreement (MOU, MOA, LOI,
etc.)?

Choose an item.
MOA between DHS and DOS Regarding the
Sharing of Visa and Passport Records and
Immigration and Naturalization and Citizenship
Records – signed 11/18/2008.
No.

7. Does the project, program, or system
provide role-based training for
personnel who have access in addition
to annual privacy training required of
all DHS personnel?

8. Per NIST SP 800-53 Rev. 4, Appendix
J, does the project, program, or system
maintain an accounting of disclosures
of PII to individuals who have
requested access to their PII?

Yes. If yes, please list:
USCIS personnel with access to Form I-140
information receive role-based training on CLAIMS
3, and local CLAIMS based case processing
systems.
Not applicable.
No. What steps will be taken to develop and
maintain the accounting:
Yes. In what format is the accounting
maintained:

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 8 of 11

9. Is there a FIPS 199 determination?4

Not applicable.
Unknown.
No.
Yes. Please indicate the determinations for each
of the following:

4

Confidentiality:
Low
Moderate

High

Undefined

Integrity:
Low

Moderate

High

Undefined

Availability:
Low
Moderate

High

Undefined

FIPS 199 is the Federal Information Processing Standard Publication 199, Standards for Security Categorization of Federal
Information and Information Systems and is used to establish security categories of information systems.

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 9 of 11

PRIVACY THRESHOLD REVIEW
(TO BE COMPLETED BY COMPONENT PRIVACY OFFICE)
Component Privacy Office Reviewer:

Catherine Catanzaro Shorten

Date submitted to Component Privacy
Office:

February 17, 2016

Date submitted to DHS Privacy Office:

February 3, 2016

Component Privacy Office Recommendation:
Please include recommendation below, including what new privacy compliance documentation is needed.
The Office of Privacy has recommends that the Form I-140, Immigrant Petition for Alien Worker be
designated as privacy sensitive with coverage under the following existing compliance documentations:
PIAs:
-

-

Forthcoming Benefit Intake PIA currently under review at DHS PRIV, which covers the intake
and initial processing of the Form I-140;
DHS/USCIS/PIA-016 USCIS Benefits Processing of Applicants other than Petitions for
Naturalization, Refugee Status, and Asylum (CLAIMS 3), which covers, the review and
adjudication of the Form I-140;
DHS/USCIS/PIA-003(a) – Integrated Digitization Document Management Program (IDDMP) which covers the digitization of the Form I-140 in EDMS; and
DHS-USCIS-PIA-004 Validation Instrument for Business Enterprises (VIBE) – which provides
coverage for the VIBE check against D&B to validate or check the business information provided
on Form I-140.

SORN:
-

DHS-USCIS-007 - Benefits Information System September, 29, 2008 (73 FR 56596)
DHS/USCIS-001 - Alien File, Index, and National File Tracking System of Records, June 13,
2011, (76 FR 34233)
(TO BE COMPLETED BY THE DHS PRIVACY OFFICE)

DHS Privacy Office Reviewer:

Riley Dean

PCTS Workflow Number:

1119251

Date approved by DHS Privacy Office:

March 31, 2016

PTA Expiration Date

March 31, 2019
DESIGNATION

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 10 of 11

Privacy Sensitive System:
Category of System:
Determination:

Yes

If “no” PTA adjudication is complete.

Form/Information Collection
If “other” is selected, please describe: Click here to enter text.
PTA sufficient at this time.
Privacy compliance documentation determination in progress.
New information sharing arrangement is required.
DHS Policy for Computer-Readable Extracts Containing Sensitive PII
applies.
Privacy Act Statement required.
Privacy Impact Assessment (PIA) required.
System of Records Notice (SORN) required.
Paperwork Reduction Act (PRA) Clearance may be required. Contact
your component PRA Officer.
A Records Schedule may be required. Contact your component Records
Officer.

System covered by existing PIA

PIA:

If covered by existing PIA, please list: DHS/USCIS/PIA-003(a) Integrated Digitization
Document Management Program (IDDMP)
DHS/USCIS/PIA-016(a) Computer Linked Application Information Management System
(CLAIMS 3) and Associated Systems
DHS/USCIS/PIA-044 Validation Instrument for Business Enterprises (VIBE)
DHS/USCIS/PIA-061 Benefit Request Intake Process
System covered by existing SORN

If covered by existing SORN, please list:
DHS/USCIS/ICE/CBP-001 Alien File, Index, and National File Tracking System of
Records, November 21, 2013, 78 FR 69864
DHS/USCIS-007 Benefits Information System September 29, 2008 73 FR 56596
DHS Privacy Office Comments:
Please describe rationale for privacy compliance determination above.
USCIS is submitting a PTA renewal for the Form I-140. There have not been any updates to the types of
data collected on the form since the last PTA completed in 2012. The DHS Privacy Office finds that
USCIS Form I-140 is privacy sensitive because it collects and maintains PII of foreign nationals seeking
Immigrant Visas based on U.S. employment. The types of PII collected from petitioners include name,
address, and Social Security numbers (SSN). The types of PII collected on behalf of beneficiaries include
name, address, date and place of birth, gender, citizenship status, Alien File number, Passport Number,
and SSN. This form also collects PII from the beneficiaries’ spouses and/or dependents.
SORN:

Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
202-343-1717, [email protected]
www.dhs.gov/privacy

Privacy Threshold Analysis
Version number: 01-2014
Page 11 of 11

The DHS Privacy Office concurs with the USCIS recommendation of coverage under multiple existing
PIAs. DHS/USCIS/PIA-003(a) Integrated Digitization Document Management Program (IDDMP) covers
the digitization and processing of Form I-140. DHS/USCIS/PIA-016(a) Computer Linked Application
Information Management System (CLAIMS 3) and Associated Systems covers processing of immigrants’
applications and petitions. DHS-USCIS-PIA-044 Validation Instrument for Business Enterprises (VIBE)
covers pre-screening employment-based benefits and other benefit applications that may carry an elevated
fraud risk. Furthermore, DHS/USCIS/PIA-061 Benefit Request Intake Process has just been approved to
cover the intake and initial processing of the Form I-140.
USCIS Form I-140 is covered under the following two SORNs: DHS/USCIS/ICE/CBP-001 Alien File,
Index, and National File Tracking System of Records and DHS/USCIS-007 Benefits Information System
(BIS).