PIA -Immigrant Military Members and Veterans Initiative (IMMVI)

Privacy Impact Assessment
for the

Immigrant Military Members and Veterans
Initiative (IMMVI)
DHS Reference No. DHS/ALL/PIA-092
January 26, 2022

Privacy Impact Assessment
DHS/ALL/PIA-092 IMMVI
Page 2

Abstract
On February 2, 2021, President Biden signed Executive Order 14012, Restoring Faith in
Our Legal Immigration Systems and Strengthening Integration and Inclusion Efforts for New
Americans.1 In support of Executive Order 14012, on July 2, 2021, the Secretaries of the
Department of Homeland Security (DHS) and Veterans Affairs (VA) announced a new joint
initiative, the Immigrant Military Members and Veterans Initiative (IMMVI).2 This initiative was
formed to support the Nation’s noncitizen service members, and their immediate family members,
and directed DHS and the VA to identify and prioritize the return of current and former U.S.
military members, and their immediate family members, who were removed from the United
States, to ensure they receive the benefits to which they may be entitled. This Privacy Impact
Assessment (PIA) analyzes the privacy risks associated with the personally identifiable
information (PII) collected as part of this effort and documents the mitigation strategies
implemented to ensure adequate protection of those individuals’ privacy.

Introduction
On July 2, 2021, the Secretary of the DHS, Alejandro N. Mayorkas, and the Secretary of
the VA, Denis R. McDonough, formally announced the IMMVI to enhance collaboration and
streamline processes to ensure the goals of the Executive Order were realized. Following the
announcement, U.S. Immigration and Customs Enforcement (ICE), U.S. Citizenship and
Immigration Services (USCIS), and U.S. Customs and Border Protection (CBP) provided a
memorandum to the DHS Secretary outlining their commitment to the IMMVI objectives. More
specifically, this included plans to:
1.

Establish internal mechanisms that ensure robust interagency coordination with
appropriate agencies to support current and former members of the U.S. military with
immigration related applications and to facilitate the receipt of VA benefits to which
they are entitled.

2.

Establish a DHS Military Resource Center to assist noncitizen current and former
service members and immediate family members with issues related to immigration
applications and benefits.

As part of this effort, IMMVI is developing a new website application (the IMMVI Veterans
Portal), which will allow for self-disclosure to the U.S. government of the necessary information
1

See Executive Order 14012, Restoring Faith in Our Legal Immigration Systems and Strengthening Integration and
Inclusion Efforts for New Americans, 86 Fed. Reg. 8277 (February 2, 2021), available at
https://www.federalregister.gov/documents/2021/02/05/2021-02563/restoring-faith-in-our-legal-immigrationsystems-and-strengthening-integration-and-inclusion-efforts.
2
See https://www.dhs.gov/news/2021/07/02/dhs-va-announce-initiative-support-noncitizen-service-membersveterans-and-immediate.

Privacy Impact Assessment
DHS/ALL/PIA-092 IMMVI
Page 3

to determine the type of assistance needed by the veteran. Individuals may submit information
directly through the IMMVI Veterans Portal. Submitters may include noncitizen current and
former U.S military members or their legal representatives. Information may include the veteran’s
name, A-number, date of birth, dates of military service, receipt numbers for applications filed
with DHS, contact information, and general description of the issue/concern to be addressed. This
information will allow IMMVI to direct the individual’s case to the appropriate entity (e.g., the
VA), along with providing better understanding of the number of noncitizen current and former
U.S. military members in need of support.
IMMVI will use a USCIS-hosted Salesforce customer relationship management (CRM)
platform that will function as both the front-end portal for collection and the back-end “case
management system.” The submissions received through the IMMVI Veterans Portal will be
maintained in a separate instance and only be accessible to the IMMVI team (and
technical/administrative personnel);3 other USCIS Salesforce platform users will not have access
to the information.
IMMVI Veterans Portal Workflow
The following is a simplified workflow description of the IMMVI process:
•

When individuals navigate to the IMMVI Veterans Portal, they are asked qualifying
questions to validate they are a noncitizen current or former U.S military member as
inquiries using this webform are limited to this group.
o If they do not qualify, they are redirected away from the application process to the
IMMVI Online Resource Center (https://dhs.gov/immvets) and no information
about that individual is maintained.

•

If the individual is a current or former U.S military member seeking to return to the United
States, they are routed to a webform where they are asked to complete several fields
pertaining to their biographic information, military service, and immigration
status/concerns.
o The individual validates the authenticity and accuracy of the data provided by
formally submitting the webform and then receives a confirmation regarding the
submission.

Once the information is formally submitted through the IMMVI Veterans Portal, it is automatically
routed to the Salesforce platform through a direct interconnection. A case record is created for
IMMVI analysts to review, route to the appropriate agency as necessary, and document the status

3

The IMMVI team consists of DHS Headquarters and appropriate Component personnel who have been assigned to
this initiative.

Privacy Impact Assessment
DHS/ALL/PIA-092 IMMVI
Page 4

and eventual outcome.4 The submitted information is checked automatically against USCIS’s
Person Centric Query Service (PCQS).5 The Person Centric Query Service allows users to submit
a single query and view all transactions involving a noncitizen across multiple DHS and external
systems. The system returns a consolidated view of the individual’s past interactions with DHS
Components and other U.S. agencies as the individual passed through the U.S. immigration
system. Although the Person Centric Query Service can pull data from numerous source systems,
the IMMVI effort is only pulling data from five USCIS source systems: Computer Linked
Application Information Management System (CLAIMS 4),6 Computer Linked Application
Information Management System (CLAIMS 3),7 Electronic Information System (ELIS),8 Central
Index System (CIS),9 and RAILS.10 IMMVI uses the data from the Person Centric Query Service
check to populate the case record of the individual.
An IMMVI analyst is assigned to the case to assist with routing the individual’s submission
to the appropriate agency based on the information provided through the IMMVI Veterans Portal
and the results and information from the Person Centric Query Service check. For example, the
IMMVI team can review the individual’s information and determine that they need to submit a
certain form to USCIS. The IMMVI team can communicate that back to the individual or route
the information directly to USCIS to assist.
•

4

If the individual’s information is inaccurate/incomplete or it is determined they are not a
noncitizen current or former U.S military member, they are notified and referred to the
IMMVI Online Resource Center.

No adjudicative decisions or determinations are made within the Salesforce platform. The system is only used to
track the dispositions made by the appropriate agency, as explained below.
5
See DEPARTMENT OF HOMELAND SECURITY, U.S. CITIZENSHIP AND IMMIGRATION SERVICES,
PRIVACY IMPACT ASSESSMENT FOR THE PERSON CENTRIC QUERY SERVICE (PCQS),
DHS/USCIS/PIA-010, available at https://www.dhs.gov/uscis-pias-and-sorns.
6
See DEPARTMENT OF HOMELAND SECURITY, U.S. CITIZENSHIP AND IMMIGRATION SERVICES,
PRIVACY IMPACT ASSESSMENT FOR THE COMPUTER LINKED APPLICATION INFORMATION
MANAGEMENT SYSTEM (CLAIMS 4), DHS/USCIS/PIA-015, available at https://www.dhs.gov/uscis-pias-andsorns.
7
See DEPARTMENT OF HOMELAND SECURITY, U.S. CITIZENSHIP AND IMMIGRATION SERVICES,
PRIVACY IMPACT ASSESSMENT FOR THE COMPUTER LINKED APPLICATION INFORMATION
MANAGEMENT SYSTEM (CLAIMS 3), DHS/USCIS/PIA-016, available at https://www.dhs.gov/uscis-pias-andsorns.
8
See DEPARTMENT OF HOMELAND SECURITY, U.S. CITIZENSHIP AND IMMIGRATION SERVICES,
PRIVACY IMPACT ASSESSMENT FOR THE USCIS ELECTRONIC INFORMATION SYSTEM (ELIS),
DHS/USCIS/PIA-056, available at https://www.dhs.gov/uscis-pias-and-sorns.
9
See DEPARTMENT OF HOMELAND SECURITY, U.S. CITIZENSHIP AND IMMIGRATION SERVICES,
PRIVACY IMPACT ASSESSMENT FOR THE CENTRAL INDEX SYSTEM (CIS), DHS/USCIS/PIA-009,
available at https://www.dhs.gov/uscis-pias-and-sorns.
10
See DEPARTMENT OF HOMELAND SECURITY, U.S. CITIZENSHIP AND IMMIGRATION SERVICES,
PRIVACY IMPACT ASSESSMENT FOR RAILS, DHS/USCIS/PIA-075, available at https://www.dhs.gov/uscispias-and-sorns. RAILS is not an acronym.

Privacy Impact Assessment
DHS/ALL/PIA-092 IMMVI
Page 5

•

If the individual is determined to be a noncitizen current or former member of the U.S.
military, the IMMVI analyst routes the case to the appropriate agency.11
o If the individual is seeking relief based on a non-DHS concern (e.g., Veterans Affairs
benefit), their case is routed to the appropriate agency, after any necessary consent
forms are completed and submitted. These non-DHS agencies undertake their own
established processes to consider individual applications that are outside of the IMMVI
purview and covered by their own privacy compliance documentation.
o If the individual is seeking relief based on a DHS concern (e.g., humanitarian parole),
their case is routed to the appropriate agency within DHS (e.g., USCIS, ICE, CBP).
These Components undertake their own established processes to consider individual
applications that are outside of the IMMVI purview and covered by Components’
privacy compliance documentation.

The IMMVI analyst will work to notify the applicant on next steps and outcomes throughout this
process. For example, the IMMVI analyst may contact the current and former U.S. military
members or their legal representatives to provide the information needed to pursue their case,
including information about application filing procedures with DHS. The individual’s case will be
tracked internally through the Salesforce platform, which utilizes a built-in “response builder”
allowing for all communications to be stored on the platform, rather than having to communicate
with the individual through DHS email accounts. If additional information is needed to properly
direct the veteran, it can be requested through the response builder.
Once the appropriate agency has made a determination about the individual’s case, that
disposition will be provided back to IMMVI to be added to the individual case record.

Fair Information Practice Principles (FIPPs)
The Privacy Act of 197412 articulates concepts of how the federal government should treat
individuals and their information and imposes duties upon federal agencies regarding the
collection, use, dissemination, and maintenance of personally identifiable information. The
Homeland Security Act of 2002 Section 222(2) states that the Chief Privacy Officer shall assure
that information is handled in full compliance with the fair information practices as set out in the
Privacy Act of 1974.13
In response to this obligation, the DHS Privacy Office developed a set of Fair Information
Practice Principles (FIPPs) from the underlying concepts of the Privacy Act to encompass the full

11

If there is an issue with data accuracy, the IMMVI analyst can work with the applicant (or their legal
representative) or the data available to them through the Salesforce platform to deconflict any issues.
12
5 U.S.C. § 552a.
13
6 U.S.C. § 142(a)(2).

Privacy Impact Assessment
DHS/ALL/PIA-092 IMMVI
Page 6

breadth and diversity of the information and interactions of DHS.14 The Fair Information Practice
Principles account for the nature and purpose of the information being collected in relation to
DHS’s mission to preserve, protect, and secure.
DHS conducts Privacy Impact Assessments on both programs and information technology
systems, pursuant to the E-Government Act of 2002, Section 20815 and the Homeland Security
Act of 2002, Section 222.16 Given that IMMVI is a program rather than a particular information
technology system, this Privacy Impact Assessment is conducted as it relates to the DHS construct
of the Fair Information Practice Principles. This Privacy Impact Assessment examines the privacy
impact of IMMVI as it relates to the Fair Information Practice Principles.

1. Principle of Transparency
Principle: DHS should be transparent and provide notice to the individual regarding its collection, use,
dissemination, and maintenance of PII. Technologies or systems using PII must be described in a SORN and PIA, as
appropriate.

The July 2, 2021, announcement by the Secretary of Homeland Security and Secretary of
Veterans Affairs established IMMVI to support the Nation’s noncitizen U.S. military members,
veterans, and their immediate families. In addition, the IMMVI team organized two engagements
and individual meetings with critical public stakeholders that also provided a significant amount
of information about the initiative. This Privacy Impact Assessment also provides notice of this
effort and the type of information that may be collected to fulfill the responsibilities laid out in the
July 2nd announcement.
The IMMVI team has also developed the IMMVI Online Resource Center
(https://dhs.gov/immvets) to assist noncitizen current and former U.S. military members, and their
family members, with issues related to immigration applications and benefits.
Privacy Risk: There is a risk that an individual will not understand that submitting their
information through the IMMVI Veterans Portal is not the same as filing an immigration related
request with a DHS Component to determine their eligibility.
Mitigation: This risk is mitigated. DHS provides a Privacy Act Statement on the portal
that applicants must acknowledge during the submission process. Specifically, the statement
indicates that, “By registering and submitting your information to this website you are not applying
for a visa, other documentation, admission into the United States, or any other immigration
benefit.” In addition, this Privacy Impact Assessment, associated System of Records Notice:
14

U.S. DEPARTMENT OF HOMELAND SECURITY, PRIVACY POLICY GUIDANCE MEMORANDUM 2008-01/PRIVACY
POLICY DIRECTIVE 140-06, THE FAIR INFORMATION PRACTICE PRINCIPLES: FRAMEWORK FOR PRIVACY POLICY AT
THE DEPARTMENT OF HOMELAND SECURITY (2008), available at https://www.dhs.gov/privacy-policy-guidance.
15
44 U.S.C. § 3501 note.
16
6 U.S.C. § 142.

Privacy Impact Assessment
DHS/ALL/PIA-092 IMMVI
Page 7

DHS/USCIS/ICE/CBP-001 Alien File, Index, and National File Tracking System of Records,17
and the numerous outreach efforts that the IMMVI team has conducted inform the public of the
purpose of this effort.

2. Principle of Individual Participation
Principle: DHS should involve the individual in the process of using PII. DHS should, to the extent practical,
seek individual consent for the collection, use, dissemination, and maintenance of PII and should provide mechanisms
for appropriate access, correction, and redress regarding DHS’s use of PII.

One of the main goals of IMMVI overall is to provide additional transparency into
processes to assist the Nation’s noncitizen current and former service members and their
immediate family members in seeking relief. The creation of the IMMVI Veterans Portal is one of
the key measures this effort is using to make those processes available. The portal explicitly asks
individual applicants (e.g., current and former U.S. military members or their immediate family
members) or their legal representatives for the information collected. Submitters are required to
validate the authenticity and accuracy of the data provided by formally submitting through the
portal.
Individuals are provided a Privacy Act Statement explaining how the information will be
used and consent to the Department’s collection of their personally identifiable information by
voluntarily providing it through the IMMVI Veterans Portal.
Further, any individual seeking access to or amendment of their records may submit a
request in writing to the DHS Chief Privacy and Chief Freedom of Information Act (FOIA) Officer
at the address below, or to the respective Component’s Freedom of Information Act officer, which
can be found at https://www.dhs.gov/foia-contact-information. DHS also accepts Privacy Act and
Freedom of Information Act requests submitted electronically at https://www.dhs.gov/dhs-foiaprivacy-act-request-submission-form.
Chief Privacy and Chief Freedom of Information Act Officer
Privacy Office, Department of Homeland Security
2707 Martin Luther King Jr. Avenue, SE
Washington, D.C. 20528
Privacy Risk: There is a risk that an individual does not understand that submitting their
information through the IMMVI Veterans Portal gives consent to DHS to share that information
to the appropriate Component (e.g., ICE, USCIS, CBP) for review.
Mitigation: This risk is mitigated. The Privacy Act Statement and accompanying consent
disclaimer on the portal, other IMMVI online materials and information, and this Privacy Impact
17

See DHS/USCIS/ICE/CBP-001 Alien File, Index, and National File Tracking System of Records, 82 Fed. Reg.
43556 (September 18, 2017), available at https://www.dhs.gov/system-records-notices-sorns.

Privacy Impact Assessment
DHS/ALL/PIA-092 IMMVI
Page 8

Assessment all provide notice to individuals about how DHS will use information as part of the
IMMVI process. The Privacy Act Statement specifically outlines that IMMVI may share the
information provided to authorized U.S. government agencies for the purpose of ensuring that the
service member can access and receive the benefits for which they may be entitled to or eligible.
Further, the notice indicates that this process itself is not applying for relief or an immigration
benefit through the appropriate agencies.

3. Principle of Purpose Specification
Principle: DHS should specifically articulate the authority which permits the collection of PII and
specifically articulate the purpose or purposes for which the PII is intended to be used.

The information collected, used, and maintained through the IMMVI Veterans Portal is
permitted in response to requirements listed in Executive Order 14012 and 8 U.S.C. §
1182(d)(5)(A). DHS is directed in the Executive Order to promote naturalization for military
members and ensure access to the process. In response, on July 2, 2021, the Secretaries of DHS
and the VA announced the IMMVI to identify and prioritize the return of current and former U.S.
military service members and their immediate family members who were removed from the United
States to ensure they receive any benefits to which they are entitled or eligible. The IMMVI
Veterans Portal serves as a mechanism for these individuals who cannot access U.S. immigration
benefits due to their prior removal from the United States to get assistance in resolving questions
related to their immigration status.

4. Principle of Data Minimization
Principle: DHS should only collect PII that is directly relevant and necessary to accomplish the specified
purpose(s) and only retain PII for as long as is necessary to fulfill the specified purpose(s). PII should be disposed of
in accordance with DHS records disposition schedules as approved by the National Archives and Records
Administration (NARA).

IMMVI developed a multi-step process as outlined above that requires initial data
collection directly from an individual to make a determination about that individual’s eligibility
for the IMMVI process. The IMMVI Veterans Portal collects the following information from
submitters:
•

Applicant Name;

•

Applicant Mailing Address;

•

Applicant Date of Birth;

•

Applicant Phone Number;

•

Applicant Email Address;

•

Best Way to Contact: Email or Phone;

Privacy Impact Assessment
DHS/ALL/PIA-092 IMMVI
Page 9

•

A-Number;

•

Country of Current Residence;

•

USCIS Receipt Numbers for any pending applications for immigration benefits;

•

Dates and Branch of Military Service;

•

Legal Representative (if applicable);

•

Legal Representative Name (if applicable);

•

Legal Representative Company (if applicable);

•

Legal Representative Contact Information (if applicable); and

•

Brief Explanation of Request.

Once the information is initially submitted through the portal, a check is conducted through the
Person Centric Query Service. IMMVI uses that information to populate the case record in the
Salesforce platform in order to initially determine the individual’s eligibility for this initiative. The
data elements from the Person Centric Query Service check used to populate the case record
include:
•

Name;

•

A-Number;

•

Date of Birth;

•

Contact Information (e.g., phone, email, mailing address);

•

Country of Birth;

•

Country of Citizenship;

•

Class of Admission (if applicable);

•

Permanent Residence Date (if applicable);

•

Gender;

•

Race;

•

Marital Status;

•

USCIS Receipt Numbers; and

•

Parents’ Names.

Privacy Impact Assessment
DHS/ALL/PIA-092 IMMVI
Page 10

The Salesforce platform is also integrated with the Person Centric Query Service source systems
being utilized for this initiative and may utilize data from these USCIS systems: Computer Linked
Application Information Management System (CLAIMS 4), Computer Linked Application
Information Management System (CLAIMS 3), Electronic Information System (ELIS), Central
Index System (CIS), and RAILS. The System of Records Notices that cover these systems are:
DHS/USCIS/ICE/CBP-001 Alien File, Index, and National File Tracking System of Records,18
DHS/USCIS-007 Benefits Information System,19 and DHS/USCIS-018 Immigration Biometric
and Background Check (IBBC) System of Records.20 The Salesforce platform integration with
these systems allows IMMVI analysts to view a snapshot of the individual’s record within these
source systems to better facilitate assisting the individual.
Additional information will be maintained as an individual’s case progresses. IMMVI will
track the status of a case (e.g., routed to appropriate agency, closed, adjudicated), as well as any
communications with the individual.
Privacy Risk: There is a risk that IMMVI will maintain more information than is
necessary, obtained from the Person Centric Query Service or through the snapshots of the source
systems.
Mitigation: This risk is partially mitigated. Due to the variety in nature of potential
submissions to the portal, IMMVI worked with the DHS Privacy Office to determine the necessary
data required to fulfill its responsibilities. In order to properly validate individuals’ eligibility for
the IMMVI process, the IMMVI Veterans Portal was developed to use a limited number of
identifiers (e.g., A-Number). Limited information is solicited to reduce the burden on the applicant
but also to ensure that inaccurate data would not be collected by asking for information for which
the individual may not readily have access (e.g., immigration records). The Person Centric Query
Service check, population of the case record, and snapshot view into source systems allow DHS
to use source system data, ensuring accuracy and providing all the necessary information so that
IMMVI analysts may perform their duties. Although the IMMVI analyst may not necessarily need
all the information or data elements available to them through the Salesforce platform for each
case, the IMMVI process does not create new access to data for personnel. All IMMVI analysts
already have access to this information as part of their normal job responsibilities.

18

See DHS/USCIS/ICE/CBP-001 Alien File, Index, and National File Tracking System of Records, 82 Fed. Reg.
43556 (September 18, 2017), available at https://www.dhs.gov/system-records-notices-sorns.
19
See DHS/USCIS-007 Benefits Information System, 84 Fed. Reg. 54622 (October 10, 2019), available at
https://www.dhs.gov/system-records-notices-sorns.
20
See DHS/USCIS-018 Immigration Biometric and Background Check (IBBC) System of Records, 83 Fed. Reg.
36950 (July 31, 2018), available at https://www.dhs.gov/system-records-notices-sorns.

Privacy Impact Assessment
DHS/ALL/PIA-092 IMMVI
Page 11

Privacy Risk: There is a risk that IMMVI will maintain received information for longer
than necessary.
Mitigation: This risk is not mitigated. IMMVI currently does not have an approved records
retention schedule from the National Archives and Records Administration (NARA). However,
the records will be maintained as “permanent” for at least two years. It is estimated that at that
time a key objective of the initiative, identifying the number of current and former U.S. military
members in need of services abroad, will be accomplished. The IMMVI team will coordinate with
DHS Records Management and the National Archives and Records Administration to gain
approval for a records retention schedule. Once the appropriate retention schedule is developed
and finalized, the IMMVI team will ensure that the requirements are followed to include purging
any information collected prior to the establishment of the retention schedule that exceeds the
approved retention period.

5. Principle of Use Limitation
Principle: DHS should use PII solely for the purpose(s) specified in the notice. Sharing PII outside the
Department should be for a purpose compatible with the purpose for which the PII was collected.

Information collected and maintained is only used for IMMVI purposes. These purposes
are specifically outlined in the IMMVI Announcement, this Privacy Impact Assessment, the
Privacy Act Statement that accompanies the portal, and other public-facing information about the
initiative.
DHS takes great care of the data it collects and will only share information when necessary.
Any information sharing is conducted to the appropriate DHS Component (e.g., ICE, USCIS,
CBP) based on a need-to-know or to another federal agency (e.g., the VA) in accordance with the
routine uses outlined in the Privacy Act Statement on the portal and as outlined above in this
Privacy Impact Assessment and in accordance with the consent provided by the current and former
U.S. military members by submitting their information. As an example, IMMVI uses the data it
collects from the applicant or their representative to better direct them to the appropriate DHS
Component or other federal agency for further assistance. When sharing information with another
federal agency, such as the VA, DHS will obtain any necessary and appropriate consents, in
addition to those already made through the IMMVI Veterans Portal, before sharing. Further, DHS
will only share the necessary information needed for the external federal agency to fulfill its
responsibilities; IMMVI does not share the entire case record or additional information available
from the source systems.
Privacy Risk: There is a risk that information collected will be used inappropriately.
Mitigation: This risk is mitigated. This Privacy Impact Assessment, the IMMVI
Announcement, the Privacy Act Statement that accompanies the portal, and other public-facing
information about the initiative document the types of the information being collected and the

Privacy Impact Assessment
DHS/ALL/PIA-092 IMMVI
Page 12

purposes for which it will be used. Only those individuals with a need-to-know will have access
to this information. All personnel will be trained on how to use and share the information as
necessary, in addition to receiving annual privacy and security awareness training that is required
for all DHS personnel.

6. Principle of Data Quality and Integrity
Principle: DHS should, to the extent practical, ensure that PII is accurate, relevant, timely, and complete,
within the context of each use of the PII.

One of the main goals of IMMVI is to identify the number of current and former U.S.
military members who reside outside of the United States that are in need of service from DHS,
the VA, or other federal agencies. Currently there is no system in place to capture this information
in a cohesive and uniform manner. IMMVI will use the collected and available information to
ensure the most accurate and up-to-date information is used to support these individuals who reside
outside the United States.
As part of the IMMVI Veterans Portal workflow, when an individual submits their
information, the information is checked against existing data in the Person Centric Query Service
to confirm eligibility for the initiative. This process ensures that the IMMVI team is using the most
accurate information to make a comprehensive analysis about the individual’s eligibility for the
initiative.
Privacy Risk: There is a risk that inaccurate information will be used during the
evaluation.
Mitigation: This risk is mitigated. IMMVI has developed a two-step workflow to ensure
that the most accurate information is used during this process. DHS collects information directly
from the submitter through the IMMVI Veterans Portal. After a successful submission, an
individual’s information is automatically checked against the Person Centric Query Service. This
permits DHS to use source system data, rather than information that has to be manually entered by
an individual. If there are continued issues with data entry/accuracy or the IMMVI Veterans Portal,
USCIS has a Salesforce helpdesk, available at https://my.uscis.gov/account/v1/needhelp.
Further, the purpose of the IMMVI is not to make adjudications, but to provide individuals
with additional information about how to seek relief. All adjudicative decisions and determinations
are still made by the appropriate DHS Component or other federal agency.

Privacy Impact Assessment
DHS/ALL/PIA-092 IMMVI
Page 13

7. Principle of Security
Principle: DHS should protect PII (in all forms) through appropriate security safeguards against risks such
as loss, unauthorized access or use, destruction, modification, or unintended or inappropriate disclosure.

All the information DHS uses as part of this effort is maintained on the DHS network and
all systems have been accredited in accordance with the requirements of DHS 4300A, Sensitive
Systems Policy Directive.21 DHS implements appropriate administrative and technical safeguards,
such as privileged or administrator accounts that restrict access to authorized personnel with a
valid need-to-know to perform official duties. The IMMVI instance on the Salesforce platform is
made available only to those IMMVI personnel with a need-to-know. System administrators set
user roles to ensure appropriate access and use.
DHS conducts regular audits of the Salesforce platform and its users and maintains audit
logs of activity in the system, in accordance with DHS 4300A. These logs provide information on
which records have been accessed, the date/time they were accessed, who accessed them, and
whether any records were updated or modified.
Privacy Risk: There is a risk of improper access to IMMVI data.
Mitigation: This risk is mitigated. All of the systems and processes that the IMMVI team
uses ensure that only those with a need-to-know will have access to the data. Only those individuals
involved in identifying current and former U.S. military members in need of assistance and
evaluating cases have access to the data through the provisioning of proper access controls. If there
is any need to share any IMMVI related emails that contain personally identifiable information,
they will be encrypted or password protected.

8. Principle of Accountability and Auditing
Principle: DHS should be accountable for complying with these principles, providing training to all
employees and contractors who use PII, and should audit the actual use of PII to demonstrate compliance with these
principles and all applicable privacy protection requirements.

All Salesforce platform users and those personnel that access the DHS network must
complete annual privacy and security training to include signing and acknowledging Rules of
Behavior, which outline appropriate uses of system data, uploading records, disclosure and
dissemination of records, and system security. System users receive a notice reminding them that
unauthorized or improper use or access may result in disciplinary action, as well as civil and
criminal penalties.
The Salesforce platform technical safeguards (e.g., role-based access controls) ensure that
only authorized users with a valid need-to-know have access to the information to accomplish their
21

See DEPARTMENT OF HOMELAND SECURITY, DHS SENSITIVE SYSTEMS POLICY DIRECTIVE 4300A (2017),
available at https://www.dhs.gov/privacy-policy-guidance.

Privacy Impact Assessment
DHS/ALL/PIA-092 IMMVI
Page 14

assigned tasks. The system accessibility and functionality restrictions are defined by user roles.
Each user role has defined and limited access authority to view and edit data set by a master
administrator. The user roles are determined on a need-to-know to perform official duties. The
master administrators also monitor all account and user activity to the information system. The
master administrators use automated tools to assist them in monitoring, analyzing, and reporting
activities in the system.

Responsible Official
Debra Rogers
Director
Immigrant Military Members and Veterans Initiative
Office of the Secretary
Department of Homeland Security
[email protected]
(202) 961-4203

Approval Signature
Original, signed version on file with the DHS Privacy Office.

________________________________
Lynn Parker Dupree
Chief Privacy Officer
Department of Homeland Security
(202) 343-1717