Draft PIA

�DRAFT

PRIVACY IMPACT ASSESSMENT (PIA)
PRESCRIBING AUTHORITY: DoD Instruction 5400.16, "DoD Privacy Impact Assessment (PIA) Guidance·. Complete this fonn for Department of Defense

(DoD) infonnation systems or electronic collections of infonnation (referred to as an "electronic collection" for the purpcse of this fonn) that collect, maintain, use,
and/or disseminate personally identifiable infonnation (PII) about members of the public, Federal employees, contractors, or foreign nationals employed at U.S.
military facilities internationally. In the case where no PII is collected, the PIA will serve as a conclusive determination that privacy requirements do not apply to
system.
1. DOD INFORMATION SYSTEM/ELECTRONIC COLLECTION NAME:

IUSMA Academy Management System (AMS)
3. PIA APPROVAL DATE:

11

2. DOD COMPONENT NAME:

Enited States Anny

I

United States Military Academy (USMA)
a. The PII is: (Check one. Note: foreign nationals are included in general public.)

�

From both members of the general public and Federal employees and/or
Federal contractors

b. The PII Is in a: (Check one)

□
□

�

New DoD Information System

Existing DoD lnfonnation System

Significantly Modified DoD lnfonnatlon System

□
□
□
□

From Federal employees and/or Federal contractors
Not Collected (if checked proceed to Section 4)
New Electronic Collection

Existing Electronic Collection

c. Describe the purpose of this DoD information system or electronic collection and describe the types of personal information about individuals
collected In the svstem.

USMA uses AMS (a system of systems) to evaluate candidates tor aam1ss1ons; to coordmate aam1ss1ons assessments with Congressional
Delegations and Admissions' Field Force; to conduct live and non-live data/management studies ofadmissions criteria and procedures; to
record performance ofUS citizen and international cadets/students across multiple dimensions (e.g., academic, physical, military, character);
to integrate with Cadet Treasurer and multiple business processes across the Military Academy Direcorates (MADs); to store, process, and
analyze end of course feedback; to store, process, and analyze peer and chain of command perfonnance counseling/assessment; to store
indicators ofcadet health and medical community recommended mitigations (though not PHI in accordance with guidance from MEDCOM
representative); to store information for staff, faculty, and coaches ofthe Directorate oflntercollegiate Athletics (ODIA) about potential
recruits, recruited athletes, and athletes in NCAA and club sports. The types of information USMA collects and stores in AMS include: full
social security numbers (SSN), citizenship data, drivers license data, employment information, home/cell phone number, mailing and home
address, barracks room assignment, military records, official duty address, passport information, place of birth, race/ethnicity, records, work
email address, birth date, disability information, education information, financial information, law enforcement infonnation, marital status,
mother's middle/maiden name, official duty telephone number, personal email address, position/title, rank/grade, security information, child
information, DoD ID Number, Emergency Contact information, Gender/Gender Identification, Legal Status, Medical Information, Name(s),
Other ID Number. Photo. and Relilwus Preference.
d. Why Is the PII collected and/or what is the intended use of the PII? (e.g., verification, identification, authentication, data matching, mission-related use,
administrative use)

To verify/validate candidates' identities and fitness for admission to USMA. To enable data matching (eg, commissioning, background
investigations) with Army and DoD Systems. To enable data matching with non-DoD systems (e.g., Internal Revenue Service, Department
ofHomeland Security, Department ofState). USMA mission-related tracking of performance of cadets. To disambiguate pennanent records
(e.g., transcripts), especially for graduates who left the academy before DoD established EDI-PI numbers.
e. Do lndivlduals have the opportunity to object to the collection of their PII?

(1) If "Yes," describe the method by which individuals can object to the collection of PII.

�

Yes

□

No

(2) If "No," state the reason why individuals cannot object to the collection of PII.

Applicants can choose to not provide data. Non-accepted applicants may opt m to keep their appllcat10n on ti.le to try tor a01mss10n tbe
following year. There is no ability to object to data capture and storage once cadets enroll: there will be permanent records containing PII
and other Privacy Act Protected data. Permanent records are necessary as part ofUSMA's maintenance ofits accreditation as an academic
institution (e.rz... transcriots).
f. Do individuals have the opportunity to consent to the specific uses of their PII?

(1) If "Yes," describe the method by which Individuals can give or withhold their consent.

DD FORM 2930, JUN 2017

D

Yes

PREVIOUS EDITION IS OBSOLETE.

IB:J

I

I

SECTION 1: PII DESCRIPTION SUMMARY (FOR PUBLIC RELEASE)

□ From members of the general public

I

No

AEM Designer

Page 1 of 11

�DRAFT

(2) If "No," state the reason why individuals cannot give or withhold their consent.

Appllcants can choose to not apply or apply with mcomplete appl1cat1ons. Academy users (eg. students, staff and faculty or contractors)
receive the appropriate Privacy Act advisory statement, but have no further ability to scope consent. Non-admitted applicants may opt in to
USMA maintaining their application packet on a yearly basis.
-----The Candidate Portal displays the following text------AGENCY DISCLOSURE NOTICE-The public reporting burden for this collection ofinformation is estimated to average 195 minutes per
response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and
completing and reviewing the collection ofinformation. Send comment regarding this burden estimate or any other aspect of this collection
of information, including suggestions for reducing the burden, to the Department of Defense Washington Headquarters Service, Executive
Services Directorate, Directives Division, 4800 Mark Center Drive, East Tower, Suite 02G09, Alexandria, VA 22350-3100 (0702-0061 ).
Respondents should be aware that notwithstanding any other provision of the law, no person shall be subject to any penalty for failing to
comply with a collection ofinformation ifit does not display a currently valid 0MB control number.
***PLEASE DO NOT RETURN YOUR REPSONSE TO THE ABOVE ADDRESS.*** Responses should be sent to West Point
Admissions, 606, Thayer Road, Building 606, West Point, NY 10996
PRIVACY ACT STATEMENT AUTHORITY: Title 5 United Sates Code, Government Organization and Employees, Ch 403, Sec 4346; Ch
505, Sec 5031; Ch 603, Sec 6958; Title 44, United States Code, Public Printing and Documents, Ch 31, Sec 3101; Executive Order 9397,
Numbering System for Federal Accounts Relating to Individual Persons. PRINCIPAL PURPOSE: Collection ofdata on Academy
candidates for opening a file. ROUTINE USE: To gather information on a candidate in order to open a file for admissions to the United
States Military. DISCLOSURE IS VOLUNTARY. However, failure to provide information could preclude appointment. In addition to those
disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act of 1974, these records contained therein may specifically be
disclosed outside the DoD as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows: Academic transcripts may be provided to educational
institutions for the purpose of admissions to further educational degree programs. The DoD Blanket Routine Uses set forth at the beginning
of the Army's compilation of systems of records notices also apply to this system.
-----The AMS Faculty Portal displays the following text-------By clicking log in below, you acknowledge and consent to the following rules of conduct and policies when accessing the United States
Military Academy (USMA) network, to include the Internet:
In Accordance With (IAW) Army Regulation (AR) 25-2 para 4-5m(7), "YOU ARE ACCESSING A U.S. GOVERNMENT(USG)
INFORMATION SYSTEM (IS) THAT IS PROVIDED FOR USG-AUTHORIZED USE ONLY. By using this IS (whichincludes any devict
attached to this IS), you consent to the following conditions: The USG routinely intercepts andmonitors communications on this IS for
purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct
(PM), law enforcement {LE), and counterintelligence (CI) investigations. At any time, the USG may inspect and seize data stored on this
IS.Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,and search, and may be
disclosed or used for any USG-authorized purpose. This IS includes security measures (e.g.,authentication and access controls) to protect
USG interests--not for your personal benefit or privacy.Notwithstanding the above, using this IS does not constitute consent to PM, LE, or
CI investigative searching ormonitoring ofthe content of privileged communications, or work product, related to personal representation
orservices by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and
confidential." See also United States Corps of Cadets (USCC) Regulations and policies, USMA Regulations and policies, Anny Regulation
(AR) 25-1, AR25-2, the Joint Ethics Regulation and the USMA Acceptable Use Addendum. In general these references remind users to do
nothing that is illegal, immoral, or unethical.
This paragraph applies to USMA's Cadets. Cadets' class-specific laptops, accessories, and tablets bought by cadets are personal equipment
that USMA authorizes to connect to USMA's Defense Research and Engineering Network(DREN). The authorization has several conditions:
USMA registers the device; where feasible (e.g., laptop), the device must use a USMA provided IS 'image,'; USMA retains remote
administrative rights and prerogatives to such systems while the cadet is enrolled at USMA; formal exceptions to Army policies regarding
personal equipment on USG networks.
Upon cadets' graduation or separation from USMA, cadets' laptops, tables, and accessories cease to have any permission to connect to the
USMA DREN. Cadets will receive an up-to-date non-government image for their laptop prior to their departure from West Point.
There is no blanket authorization to connect personal equipment (e.g., gaming systems, phones, computers, tablets) to the DREN. USMA
provides exceptions to policy and other authorizations when requested through chains ofcommand to the CIO/G6 and approved by the CIO/
G6 or Superintendent.
You acknowledge that in the event of a classified information spillage, the system(s) with the classified data are subject to seizure and, as
feasible, forensic wiping to remove the classified data and return, as feasible, of the sanitized device(s).
DD FORM 2930, JUN 2017

PREVIOUS EDITION IS OBSOLETE.

AEM Designer

Page 2 of 11