Air Force Pia

PRIVACY IMPACT ASSESSMENT (PIA)
For the
Air Force Recruiting Information Support System
United States Air Force

SECTION 1: IS A PIA REQUIRED?
a. Will this Department of Defense (DoD) information system or electronic collection of
information (referred to as an "electronic collection" for the purpose of this form) collect,
maintain, use, and/or disseminate PII about members of the public, Federal personnel,
contractors or foreign nationals employed at U.S. military facilities internationally? Choose
one option from the choices below. (Choose (3) for foreign nationals).
(1) Yes, from members of the general public.
(2) Yes, from Federal personnel* and/or Federal contractors.
(3) Yes, from both members of the general public and Federal personnel and/or Federal contractors.
(4) No
* "Federal personnel" are referred to in the DoD IT Portfolio Repository (DITPR) as "Federal employees."

b. If "No," ensure that DITPR or the authoritative database that updates DITPR is annotated
for the reason(s) why a PIA is not required. If the DoD information system or electronic
collection is not in DITPR, ensure that the reason(s) are recorded in appropriate
documentation.
c. If "Yes," then a PIA is required. Proceed to Section 2.

DD FORM 2930 NOV 2008

Page 1 of 17

SECTION 2: PIA SUMMARY INFORMATION
a. Why is this PIA being created or updated? Choose one:
New DoD Information System

New Electronic Collection

Existing DoD Information System

Existing Electronic Collection

Significantly Modified DoD Information
System

b. Is this DoD information system registered in the DITPR or the DoD Secret Internet Protocol
Router Network (SIPRNET) IT Registry?
Yes, DITPR

Enter DITPR System Identification Number

Yes, SIPRNET

Enter SIPRNET Identification Number

5040

No

c. Does this DoD information system have an IT investment Unique Project Identifier (UPI), required
by section 53 of Office of Management and Budget (OMB) Circular A-11?
No

Yes
If "Yes," enter UPI

If unsure, consult the Component IT Budget Point of Contact to obtain the UPI.

d. Does this DoD information system or electronic collection require a Privacy Act System of
Records Notice (SORN)?
A Privacy Act SORN is required if the information system or electronic collection contains information about U.S. citizens
or lawful permanent U.S. residents that is retrieved by name or other unique identifier. PIA and Privacy Act SORN
information should be consistent.

No

Yes
If "Yes," enter Privacy Act SORN Identifier

F036 AETC R

DoD Component-assigned designator, not the Federal Register number.
Consult the Component Privacy Office for additional information or
access DoD Privacy Act SORNs at: http://www.defenselink.mil/privacy/notices/

or
Date of submission for approval to Defense Privacy Office
Consult the Component Privacy Office for this date.

DD FORM 2930 NOV 2008

October 23, 2008

Page 2 of 17

e. Does this DoD information system or electronic collection have an OMB Control Number?
Contact the Component Information Management Control Officer or DoD Clearance Officer for this information.
This number indicates OMB approval to collect data from 10 or more members of the public in a 12-month period
regardless of form or format.

Yes
Enter OMB Control Number

0701-0150

Enter Expiration Date

09/30/2009

No
f. Authority to collect information. A Federal law, Executive Order of the President (EO), or DoD
requirement must authorize the collection and maintenance of a system of records.
(1) If this system has a Privacy Act SORN, the authorities in this PIA and the existing Privacy Act
SORN should be the same.
(2) Cite the authority for this DoD information system or electronic collection to collect, use, maintain
and/or disseminate PII. (If multiple authorities are cited, provide all that apply.)
(a) Whenever possible, cite the specific provisions of the statute and/or EO that authorizes
the operation of the system and the collection of PII.
(b) If a specific statute or EO does not exist, determine if an indirect statutory authority can
be cited. An indirect authority may be cited if the authority requires the operation or administration of
a program, the execution of which will require the collection and maintenance of a system of records.
(c) DoD Components can use their general statutory grants of authority (“internal
housekeeping”) as the primary authority. The requirement, directive, or instruction implementing the
statute within the DoD Component should be identified.
Title 10, United States Code (U.S.C.) Subtitle E Section 10202 - Armed Forces, Reserve
Components, Organization and Administration, Administration of Reserve Components,
Regulations
- Title 10, U.S.C. Subtitle E Section 10205 - Armed Forces, Reserve Components,
Organization and Administration, Administration of Reserve Components, Members of
Ready Reserve: requirement of notification of change of status
- Title 10, U.S.C. Subtitle E Section 10174 - Armed Forces, Reserve Components,
Organization and Administration, Reserve Component Commands, Air Force Reserve
Command
- Title 10, U.S.C. Subtitle E Section 10110 - Armed Forces, Reserve Components,
Organization and Administration, Reserve Components Generally, Air Force Reserve:
composition
- Air Force Policy Directive (AFPD) 36-20, Accession of Air Force Military Personnel
- Air Force Instruction (AFI) 36-2115, Assignments within the Reserve Components
- Executive Order (EO) 9397 (Social Security Number - SSN)

DD FORM 2930 NOV 2008

Page 3 of 17

g. Summary of DoD information system or electronic collection. Answers to these questions
should be consistent with security guidelines for release of information to the public.
(1) Describe the purpose of this DoD information system or electronic collection and briefly
describe the types of personal information about individuals collected in the system.
- To furnish Active, Guard, and Reserve field recruiters an automated tool to initially build prospective Air
Force enlistees for all recruiting accessions in officer, enlisted, and health professions. AFRISS provides
comprehensive integration, interface, and standardization of all programs that manage personnel resources
in support of Air Force Recruiting. The system extends automated capabilities out to the individual recruiter,
the flight, the squadron, and the groups. It provides an automated interface to the Military Entrance
Processing Station (MEPS) where applicants undergo physical, testing, verification interviews, and tentative
job reservation. It will provide an automated interface to the Modernized Military Personnel System (MilMod)
where only pertinent and required applicant information is placed in a permanent military system of record. It
also provides reporting capabilities at all levels of Air Force Recruiting management to make informed
decisions on recruiting business rules and practices to increase the number of accessions.
The categories of records contained in AFRISS are: Air Force applicant processing records containing,
name, SSN, scores on all qualification tests, physical job qualifications, job preferences, jobs offered, jobs
accepted, other personal data relevant to jobs offered, recruiting and processing locations, education data,
dates of processing, Airman trainee history records, and personnel data for assignment from basic military
training. The records are revised with job preferences, security clearance investigations, dependent data,
education, test scores, grades and promotions, biographical history, physical information, drug abuse history,
employment and criminal history, public record civil court actions, separation data, classification data, service
dates, technical school eliminations, separations, honor graduate data, and Article 15/courts-martial actions.
Records for high school seniors who are ASVAB tested and meet basic Air Force enlistment criteria showing
name, mailing address, test scores, and high school where tested, state and county of residence, ,
educational level, physical profile, processing date and location, prior service history, age, sex, race, marital
status, and number of dependents. Officer applicant records containing name, mailing address, educational
level, other educational and professional training data necessary for the processing of candidates for
commissioning as Air Force Officers. AFRISS allows the recruiter to process LEADS; a respondent's inquiry
record containing name, address, date of birth, sex, telephone number, advertising medium, recruiting
program in which interested, and source of referral, including name and Air Force base assigned. Recruiters
create contact records containing success of contact efforts, reasons for contacting and not contacting leads,
type of contact made, confirmation of educational level, pre-qualification and status of individual. Records
also contain data on previous military and civilian history for interviewing and tentatively qualifying a
prospect. Other records in AFRISS are records of individual recruiter and other system authorized users
data showing such items as SSN, name, office assigned, contact information, and date assigned to
Recruiting Service.

(2) Briefly describe the privacy risks associated with the PII collected and how these risks are
addressed to safeguard privacy.
There are two basic risks for AFRISS: (1) risk of unauthorized access to the system, and (2) loss of the database
which contains the privacy data. To control access to the system we use various controls: restrict access to
the .mil domain, only correspond with official e-mail addresses, require a user account that has right/permissions
limited to minimum required, require access via a government issues common access card (CAC), link
rights/permissions to the CAC identity, log activity of the CAC card, and review CAC activity for unusual activity.
We protect the database with various controls: use many of the controls listed above, as well as, encrypt the backup
files on the local hard drive. For off-site backup we encrypt the files prior to transfer and apply additional encryption
during the process of copying to tape.

h. With whom will the PII be shared through data exchange, both within your DoD Component and
outside your Component (e.g., other DoD Components, Federal Agencies)? Indicate all that apply.
DD FORM 2930 NOV 2008

Page 4 of 17

Within the DoD Component.
Specify.

Air Force Personnel Center
Air Force Recruiting Information Support Systems - Reserve
Technical Training Management System (TTMS)

Other DoD Components.

Specify.

United States Military Entrance Processing Command (MEPS)
Joint Personnel Adjudication System (JPAS)

Other Federal Agencies.

Specify.

Personnel Investigations Processing System (OPM PIPS)

State and Local Agencies.

Specify.
Contractor (Enter name and describe the language in the contract that safeguards PII.)

Specify.

Merkle Advertising - Provides initial leads (potential applicant) information to AFRISS.
Merkle sends potential applicant information known as lead, to AFRISS. The lead
data immediately is put into AFRISS behind the Randolph AFB network firewall as
well as our internal AFRISS firewall. This is a one way process after which the data is
reviewed by an AFRS operations personnel and then transmitted to the appropriate
AFRS recruiter in the applicant's local area.

Other (e.g., commercial providers, colleges).

Specify.
i. Do individuals have the opportunity to object to the collection of their PII?
Yes

No

(1) If "Yes," describe method by which individuals can object to the collection of PII.
The recruiter shows and, upon request, provides the individual a Privacy Act Statement for each form,
format, or form letter used to collect personal data before asking for the information. Individual signatures
grant consent. The individual, however, has the opportunity at this stage, to object to the collection of any/all
parts of information in identifiable form. The individual is advised that this could delay the application
process up to and including denial of consideration of enlistment in the Air Force.

(2) If "No," state the reason why individuals cannot object.

DD FORM 2930 NOV 2008

Page 5 of 17

j. Do individuals have the opportunity to consent to the specific uses of their PII?
Yes

No

(1) If "Yes," describe the method by which individuals can give or withhold their consent.
The recruiter shows and, upon request, provides the individual a Privacy Act Statement for each form,
format, or form letter used to collect personal data before asking for the information. Individual signatures
grant consent. The individual, however, has the opportunity at this stage, to object to the collection of any/all
parts of information in identifiable form. The individual is advised that this could delay the application
process up to and including denial of consideration of enlistment in the Air Force.

(2) If "No," state the reason why individuals cannot give or withhold their consent.

k. What information is provided to an individual when asked to provide PII data? Indicate all that
apply.
Privacy Act Statement

Privacy Advisory

Other

None

Describe Air Force Form 883, PRIVACY ACT STATEMENT -- US AIR FORCE APPLICATION RECORD
each
The form uses the following format:
applicable
AUTHORITY: 10 USC Sections 133, 265, 275, 504, 508, 510, 672(d), 678, 837, 1007, 1071 through
format.
1480, 1553, 2105, 2107, 3012, 5031, 8013, 8033, 8496, and 9411; 32 USC 708; 44 USC 3101; and
Executive Orders 9397, 10450, and 11652.
PURPOSE: To determine your mental, medical, and moral qualifications for entry into the US Air
Force. This data is FOR OFFICIAL USE ONLY and will be maintained in strict confidence within the
Department of Defense according to Federal law and regulation. If you are accepted and
subsequently enter into a component of the Air Force, the information becomes a part of your military
personnel records which is used to provide information for personnel management actions. If you are
not accepted or do not subsequently enter a component of the Air Force, your records will be
destroyed as specified by regulation.
ROUTINE USES: This information may be disclosed to the Social Security Administration and the
Department of Treasury to establish a record of income; to federal, state, local or foreign law
enforcement authorities for investigating or prosecuting a violation or potential violation of law; to
federal, state, or local agencies to obtain information concerning hiring or retention of an
employee, issuance of a security clearance, letting of a contract, or issuance of a license, grant or
other benefit; to a federal agency in response to its request in connection with the hiring or retention
Page 6 of 17
DD FORM 2930 NOV 2008

of an employee, issuance of a security clearance, reporting of an investigation of an employee,
letting of a contract, issuance of a license, grant, or other benefit by the requesting agency to the
extent that the information is relevant and necessary to the requesting agency's decision on the
matter; to a congressional office in response to their inquiry made at the request of the individual; to
the Office of Management and Budget (OMB) in connection with review of private relief legislation as
set forth in OMB Circular A19; to foreign law enforcement, security, investigatory, or administrative
authorities to comply with requirements of international agreements and arrangements; to state and
local taxing authorities in accordance with Treasury Fiscal Requirements Manual Bulletin 7607; to
the Office of Personnel Management (OPM) concerning information on pay and leave, benefits,
retirement deductions, and other information necessary for OPM to carry out its functions; to NARA
for records management functions; and to the Department of Justice for pending or potential litigation.
DISCLOSURE IS VOLUNTARY: However, failure to furnish information needed to determine your
mental, medical and moral qualifications for entry into the US Air Force will result in a denial of
application

NOTE:
Sections 1 and 2 above are to be posted to the Component's Web site. Posting of these
Sections indicates that the PIA has been reviewed to ensure that appropriate safeguards are in
place to protect privacy.
A Component may restrict the publication of Sections 1 and/or 2 if they contain information that
would reveal sensitive information or raise security concerns.

DD FORM 2930 NOV 2008

Page 7 of 17