PIA, DHS/ALL/PIA-069 - DHS Surveys, Interviews and Focus Groups

Privacy Impact Assessment
for the

DHS Surveys, Interviews, and Focus Groups
DHS/ALL/PIA-069
September 28, 2018

Reviewing Official
Philip S. Kaplan
Chief Privacy Officer
Department of Homeland Security
(202) 343-1717

Privacy Impact Assessment
DHS/ALL/PIA-069
DHS Surveys, Interviews, and Focus Groups
Page 1

Abstract
The U.S. Department of Homeland Security (DHS) and its Components periodically solicit
voluntary feedback from its employees, contractors, external stakeholders, and the general public
through the use of surveys, interviews, and focus groups (hereinafter referred to as customer
research) to improve DHS services and operations. Individuals who provide information during
customer research do so voluntarily with the understanding that their responses will be kept
confidential. This PIA covers DHS’s collection, maintenance, and use of limited personally
identifiable information (PII) in order to recruit individuals, facilitate correspondence, and perform
trend analyses from results derived from customer research.

Overview
In its ongoing effort to continuously improve its operations and services, DHS and its
Components solicit feedback from employees, contractors, external stakeholders, and the general
public through surveys, interviews, and focus groups. This customer research collects information,
opinions, and experiences from those interacting with and on behalf of DHS. The goal of this
research is to identify opportunities to improve customer service, employee morale, and
stakeholder relationships. This PIA only addresses DHS or Component-initiated research
(collectively referred herein as DHS) on tool usability, general satisfaction, or service needs. Any
customer research covered by this PIA will not collect more than contact information or
demographic information that could be linkable to an individual. This PIA does not assess inquiries
pertaining to investigations, individual complaints, or administrative actions.1
Although the customer research assessed in this PIA is generally anonymous, DHS
sometimes collects a limited amount of contact information in order to solicit participation in the
research or facilitate future communications with participants. Demographic information (e.g.,
age, gender, race, country of origin, or languages spoken) may be collected and aggregated to
perform trend analyses. Trend analyses measure changes in data over time in an attempt to predict
future outcomes or needs. These trend analyses are used to identify areas for improvement in
Department processes and operations.
DHS’s customer research is collected from three categories of participants: (1) DHS
employees and contractors; (2) DHS public stakeholders;2 and (3) the general public.3 DHS may
1

For more information on inquires pertaining to investigations, complaints, and administrative actions, please see
https://www.dhs.gov/how-do-i/provide-feedback-dhs.
2
DHS public stakeholders are officials employed by federal, state, local, tribal, or foreign governments who work
with DHS to fulfill a shared mission. Examples include law enforcement officers in border areas, state and local
emergency management personnel at disaster sites, and foreign aviation personnel at airports outside the United
States.
3
Members of the general public consist of people who are significantly impacted by DHS activities (e.g.,
immigration benefits applicants, disaster relief recipients, and pre-screened airline passengers).

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 2

either rely on federal employees and contractors dedicated to research and statistical analysis to
conduct this customer research, or it may enter into contractual relationships with third-party
vendors to conduct the research on its behalf. As described below, DHS may recruit participants
directly or indirectly and uses three different research methods to collect information: surveys,
interviews, and focus groups.
Recruiting Participants
DHS recruits participants for its customer research using both direct and indirect
recruitment. Direct methods of recruitment include contacting potential participants in person at a
DHS field office or DHS-sponsored event, or contacting them by email, phone, or direct mail.
DHS uses contact information that was voluntarily provided on official DHS forms submitted
previously for other purposes (e.g., a benefit request). The notice of DHS’s ability to use
information previously supplied on a form must be contained in that form’s Privacy Act Statement
or Privacy Notice before it can be used for recruitment purposes.4 Indirect recruitment requires the
participant to volunteer for customer research advertised by DHS. This includes DHS public
announcements and advertisements in industry trade journals, mailing lists, flyers, or the internet.
DHS also publicizes opportunities to participate in customer research through community-based
organizations and professional associations. DHS does not receive PII from associations or
organizations, but rather individuals recruited by those organizations must contact DHS or a
Component directly to express their interest in participating in a customer research initiative.
All recruitment of participants for customer research is conducted only by DHS and
Component outreach units, research units, or third-party vendors, and not by those responsible for
management, benefits, services, or enforcement decisions within the Department. Participation in
all customer research for members of the public is completely voluntary and has no positive or
negative impact on an individual’s status or interaction with the Department. DHS employees may
be required to participate in certain customer research in an effort to gather specific feedback on
tools and processes within the Department, rather than on employee satisfaction. Responses in this
regard will not be handled by DHS management until it has been anonymized. Any contact
information collected during DHS’s customer research is optional and used only for follow-up. PII
collected from participants is separated from their responses to avoid identifying individual
participants.
Surveys
Surveys are an efficient and cost-effective way to collect information and experiences from
a large number of participants. Surveys are particularly useful for collecting and processing
4

Specifically, the Privacy Act requires all public-facing sites or forms that request PII to prominently and
conspicuously display a privacy notice that identifies: 1) legal authority to collect information about a person; 2)
purpose for which the information will be used; 3) routine uses for disclosure of information outside of DHS; 4)
whether providing the information is voluntary or mandatory under law; and 5) effects if the person chooses to not
provide the requested information.

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 3

quantifiable data because they primarily use closed-ended questions (i.e., must be answered using
a pre-defined answer, like “yes or no” or reflecting a range of agreement or disagreement with a
particular question) that make it easier to compare responses and limits the risk of participants
disclosing unsolicited PII. Surveys may be administered by using DHS generated surveys or thirdparty survey tools.
DHS Administered Surveys
DHS conducts its surveys by phone, online, or on paper. Surveys conducted by phone are
sometimes audio recorded, which requires participants to provide verbal consent to proceed. No
PII other than general demographic information is solicited during a recorded survey. Paper
surveys are completed either by mail or in-person, typically at DHS-sponsored conferences and
trainings, DHS worksites, or other DHS locations. DHS provides potential survey participants with
a notice about the purpose of the survey, instructions on how to complete the survey - including
an admonition not to provide any unsolicited PII - and how to opt-out of future surveys.
Completed surveys, regardless of venue, are destroyed after one year or when no longer
needed or in accordance National Archives and Records Administration (NARA) records retention
schedules.5
Third Party Vendor Survey Tools
DHS uses survey tools developed by third party vendors. Some of these are commercial
off-the-shelf (COTS) products, while others are developed specifically for one or more DHS
surveys. The DHS Privacy Office and Office of Public Affairs must approve any third-party survey
tool prior to its use to ensure the vendor has incorporated the appropriate privacy safeguards.6
Many third-party survey tools contain recruitment features, such as the ability to email a link to
prospective survey participants, or to make surveys available on DHS or third party websites.
Although some commercial survey tools can automatically collect participants’ Internet Protocol
(IP) addresses and email addresses, DHS advises survey developers to disable IP address and email
collection whenever possible. DHS will not request IP address or email data from third party
developers.
Wave Surveys (Longitudinal Studies)
In a minority of cases, some DHS surveys will not dissociate PII from responses when
there are going to be multiple waves of data collection. Wave surveys are used to monitor changes
in attitude over time. Researchers must ensure that a response to a survey can be linked to responses
5

See NARA General Record Schedule (GRS) 6.5, Item 010, available at https://www.archives.gov/files/recordsmgmt/grs/grs06-5.pdf.
6
The DHS Privacy office uses the Privacy Threshold Analysis (PTA) process to determine privacy safeguards for
third party vendor survey tools. A more thorough explanation of the PTA process can be found at
https://www.dhs.gov/compliance.

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 4

from a previous survey to ensure that different responses between surveys reflect a change in
attitude or behavior, rather than a change in participants.
In wave surveys procedural safeguards are in place to protect participant PII. When
responses and contact information of a participant is collected, they are stored in separate files,
and each are assigned an anonymized unique identifier. This allows the PII to be “linkable” to
responses, but in practice the PII will not be linked. Subsequent survey waves are associated with
the unique identifier, instead of PII. The contact information can be destroyed as soon as the final
wave of surveys is complete, making responses un-linkable to PII, without altering DHS’s ability
to gauge personal change over time.
Interviews
DHS conducts one-on-one interviews by phone or in-person. Participants are advised that
their responses are anonymous. Interviews gather information on a specific set of topics and
typically allow for more open-ended questions than surveys.7 The interaction between the
interviewer and participant lends itself to follow-up questions enabling a more in-depth
understanding of participants’ experiences and perspectives. Interviews also tend to be more
effective means of eliciting information on matters participants may not feel comfortable
discussing in a group setting.
Phone interviews are sometimes audio recorded, and in-person interviews are sometimes
video or audio recorded. Recording allows interviewers to collect direct quotes, verify the
information recorded in field notes, and drastically improves the efficiency of note-taking.
Participants are asked for their affirmative consent prior to recording (audio or video) and are
advised not to disclose any PII when being recorded. Any PII associated with a participant’s
consent is destroyed when the underlying recording is destroyed. As with surveys, any recordings
of interviews are destroyed after 1 year or when no longer needed in accordance with NARA
records retention schedules.8
Ethnographic-based Interviews
Ethnographic research combines interviewer observation with participant answers that
allows an interviewer to immerse themselves in the lives, culture, or situation of the participant.
Ethnography is a type of social research that allows an interviewer to immerse themselves in the
lives, culture, or situation of the participant. Ethnographic-based interviews are conducted in the
field, with the subject’s consent, and allows the interviewer to observe real-world behaviors and
interactions with products and services taking place. Ethnographic research is generally used by
Open-ended questions are designed to encourage a full, meaningful answer using the subject’s own knowledge and
feelings. Unlike closed-ended questions, few if any restrictions are placed on the length of the response.
8
See NARA General Record Schedule (GRS) 6.5, Item 010, available at https://www.archives.gov/files/recordsmgmt/grs/grs06-5.pdf.
7

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 5

DHS’s Components in usability studies, such as field testing mobile applications or websites, to
make DHS programs and systems more accessible to the public.9 Through ethnographic research,
DHS is able to understand how history and context (i.e., issues, settings, environment, and
relationships) play an important role in the lives of participants and may design DHS programs to
better meet the public’s needs. Ethnography is considered a method of interaction and observation,
and would not collect additional PII beyond a participant’s demographic information or what the
interviewer has observed. Any additional PII collection would be considered outside the scope of
this PIA.
Focus Groups
Focus groups are dynamic group discussions designed to collect information, gather
feedback, and conduct observations from a large number of participants at the same time. Like
interviews, focus groups allow for more open-ended questions and discussion than surveys and
permit greater insight into individual experiences and perspectives.
DHS conducts focus groups online or in-person. Individuals who volunteer to participate
in a focus group session are advised that their responses are anonymous. In some focus groups,
Subject Matter Experts agree to be quoted and to have their comments disseminated to the industry.
Participation in this type of focus group is voluntary and the experts are allowed to decline to have
their responses recorded or disseminated. Responses to focus group questions from individuals are
collected and retained through transcription services, audio, and video recording. Transcription
documents are redacted to exclude participant names or any other identifying information but may
include information about DHS employees, not to include any PII, who may have interacted with
the participant in the past. If a focus group is being recorded, participants are advised against
disclosing PII. As with interviews, DHS seeks affirmative consent from participants prior to
recording.
Interviewers and facilitators are trained to not solicit PII from a participant during the
research, and participants are advised not to give any unsolicited PII during the inquiry. Recordings
are stored either in DHS outreach or research unit systems or with a third-party contractor that
DHS has retained to conduct the research. Access to these systems is restricted to those users with
a verified business need. No recording is used for any purpose other than ensuring the accuracy of
the responses. Recordings are only retained until its contents are transcribed or the accuracy of an
interviewer’s or facilitator’s notes are confirmed. Once the business need for maintaining a
recording is met, the recording is immediately purged. Recordings, transcripts, and any

For an example of Ethnographic research see DHS/USCIS/PIA-064 myUSCIS, Appendix H, “myUSCIS Usability
Testing and Ethnographic Research,” available at www.dhs.gov/privacy.
9

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 6

corresponding evidence of participant consent, are destroyed when no longer needed or after one
year in accordance with the approved NARA retention schedule.10
Usability Testing
Usability testing is a type of focus group that examines the uses and convenience of a
particular product that DHS is interested in deploying. DHS uses usability tests to determine if
nascent programs or IT systems will achieve their desired purpose when deployed. Usability
testing evaluates a system or program by eliciting participants to complete typical program tasks
while facilitators observe, collect qualitative and quantitative data, and takes notes. Participants
are generally video recorded completing the prescribed tasks. Participants are required to give
affirmative consent prior to any recording taking place. Usability testing does not require the
provision of PII. If necessary, mock data will be used by a participant to test the ease and usability
of a particular system. The goal is to identify potential problems that may only be apparent in real
world interactions.
Audio and Video Recordings
DHS and its Components may augment their note-taking with audio or video recording of
interviews or focus groups. All participants are informed of the recording prior to engaging the
customer research. A participant must give affirmative, informed consent prior to an interviewer
or facilitator initiating a recording. Interviewers and facilitators are trained to not solicit PII from
a participant during customer research, and participants are advised not to give any PII during the
inquiry. Recordings are stored either in DHS outreach or research unit IT systems or with the third
party contractors DHS contracted to conduct the customer research. Access to these systems is
restricted to those users with a verified business need. No recording is used for any purpose other
than ensuring the accuracy of customer research responses. Recordings are only retained until its
contents are transcribed or the accuracy of an interviewer’s or facilitator’s notes are confirmed.
Once the business need for maintaining a recording is met, the recording is immediately purged.
Survey, Interview, and Focus Group Analysis and Outputs
At the conclusion of the customer research, DHS and Component statistical or research
experts aggregate and anonymize the data collected from participants because the goal is to identify
trends among groups and not individuals within those groups.11 The aggregated data is then
analyzed, trends are documented, and recommendations may be made. A report is then distributed

10

See NARA General Record Schedule (GRS) 6.5, Item 010 available at https://www.archives.gov/files/recordsmgmt/grs/grs06-5.pdf.
11
The aggregated data is typically presented in the form of charts and graphs that reflect certain demographic
breakdowns, which are then analyzed to produce recommendations in furtherance of improving departmental
processes and operations.

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 7

to appropriate DHS stakeholders and the general public, when appropriate. There is no PII included
in the published reports- only aggregated data is distributed in the published reports.
Oversight of Information Collections
The Paperwork Reduction Act of 1995 (PRA) requires agencies to seek OMB approval
prior to collecting information from the public.12 These PRA submissions to OMB are commonly
known as Information Collection Requests (ICR) or “OMB-clearance packages.” ICRs should be
submitted for OMB approval prior to conducting surveys, interviews, or focus groups. Submission
for OMB approval is required when data from 10 or more respondents from the public is collected
within a 12-month period. It is DHS policy to conduct a Privacy Threshold Analysis (PTA) for
every PRA submission. A PTA is a preliminary determination by the DHS Privacy Office
regarding the privacy implications of a program, system, or information collection. 13 Although
information collections from federal employees are often exempt from the PRA, information
collected from government contractors and those that target members of the public generally are
not. Moreover, any unit or agency that choses to collect information, whether that information
requires PRA submission, is required to conduct a PTA. The DHS Privacy Office tracks and
accounts for all customer research efforts by the Department or its Components through the PTA
process. Any customer research effort conducted by DHS or its components must go through the
PTA process to be covered by this PIA.
The ICRs submitted to OMB must specify all information collection materials that will
be used, such as consent forms and brochures explaining the purpose of the survey, interview, or
focus group. The ICR must describe how the collected information will be used in a way
consistent with OMB and DHS information quality guidelines and the retention periods for that
information. Upon OMB approval, DHS must conduct the information collection in a manner
consistent with the quality and retention guidelines contained in the ICR.14

Section 1.0 Authorities and Other Requirements
1.1

What specific legal authorities and/or agreements permit and
define the collection of information by the project in question?

The following legal authorities and executive orders permit DHS to conduct surveys,
interviews, and focus groups:
12

Paperwork Reduction Act of 1995, as amended, 44 U.S.C. §3501 et seq. The purpose of the PRA is to ensure that
federal agencies do not overburden the public with federally-sponsored data collections. When determining whether
to approve a particular data collection, OMB considers a range of issues from policy considerations to statistical
design and methodology.
13
More information regarding the PTA process is available at https://www.dhs.gov/compliance
14
ICRs are required to adhere to the OMB Memorandum, “Guidance on Agency Survey and Statistical Information
Collections,” January 2006, available at: www.whitehouse.gov.

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 8

Public Law 103-62 “Government Performance and Results Act of 1993 (GPRA)” –
required federal agencies to engage in performance management tasks such as setting goals,
measuring results, and reporting their progress based on objective criteria.15
Public Law 111-352 “Government Performance and Results Modernization Act of 2010”
– Revised the GPRA to require agencies to implement a more fact-based decision-making
framework and to be more results-oriented.16
Public Law 107-347 “E-Government Act of 2002” – established a broad framework of
measures that require using Internet-based technology to enhance citizen access to Government
information and services. Section 202(b) encourages all agencies to measure performance with a
special consideration toward customer service.17
Executive Order no. 12862, “Setting Customer Service Standards” – established standards
for customer service for Executive agencies that included surveying customers to determine the
kind and quality of services they want and their level of satisfaction with existing services.18
Executive Order no. 13571, ‘Streamlining Service Delivery and Improving Customer
Service” – required agencies that provided significant services to the public to identify and survey
their customers, establish service standards, track performance against those standards, and
benchmark customer service performance against the best in business.19
31 U.S. Code § 1115, “Federal Government and agency performance plans” – mandates
that each Executive agency create performance goals, to include customer service, and to use data
to measure progress toward its goals.20

1.2

What Privacy Act System of Records Notice(s) (SORN(s)) apply
to the information?

Limited contact information may be collected from participants during customer research
to facilitate recruitment and future correspondence. This collection of information is covered by
DHS/ALL-002 DHS Mailing and Other Lists System.21 The use of contact information from
source systems to recruit potential participants for customer research will be covered by the source
15

P.L. No. 103-62, available at: http://www.whitehouse.gov/omb/mgmt-gpra/gplaw2m.html.
P.L. No. 111-352, available at: https://www.gpo.gov/fdsys/pkg/PLAW-111publ352/pdf/PLAW-111publ352.pdf.
17
P.L. No. 107-347, available at: https://www.gpo.gov/fdsys/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf.
18
E.O. 12862, September 11, 1993, available at https://www.archives.gov/files/federal-register/executiveorders/pdf/12862.pdf.
19
E.O. 13571, April 27, 2011, available at https://www.gpo.gov/fdsys/pkg/CFR-2012-title3-vol1/pdf/CFR-2012title3-vol1-eo13571.pdf.
20
31 U.S.C. 1115, available at https://www.gpo.gov/fdsys/pkg/USCODE-2011-title31/pdf/USCODE-2011-title31subtitleII-chap11-sec1115.pdf.
21
DHS/ALL-002 Department of Homeland Security (DHS) Mailing and Other Lists System, 73 FR 71659 (Nov.25,
2008).
16

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 9

system SORN. Any other information collected during customer research is aggregated and is not
retrievable by personal identifier.

1.3

Has a system security plan been completed for the information
system(s) supporting the project?

There is not one specific system used by the Department for customer research, as data
are collected by different research and outreach units. Data collected by a survey, interview, or
focus group is anonymized and aggregated prior to its storage on DHS data systems whenever
possible. If raw data22 is maintained on DHS systems, it is DHS policy that a system security plan
be completed.23

1.4

Does a records retention schedule approved by the National
Archives and Records Administration (NARA) exist?

DHS maintains information related to focus groups, surveys, and interviews in accordance
with the retention schedule stated in the OMB-approved ICR for that specific customer research.
NARA’s General Record Schedule (GRS) 6.5, Item 010, Public Customer Service Operations
Records. Public Customer Service Records state that records are destroyed after one year or when
no longer needed for business use.

1.5

If the information is covered by the Paperwork Reduction Act
(PRA), provide the OMB Control number and the agency number
for the collection. If there are multiple forms, include a list in an
appendix.

OMB approval and the PRA applies to surveys, interviews, and focus groups that collect
data from ten or more members of the public. Surveys, interviews, and focus groups that collect
information from federal employees are exempt from the PRA. Each DHS Component is
responsible for its own compliance with federal PRA requirements.

Section 2.0 Characterization of the Information
2.1

Identify the information the project collects, uses, disseminates, or
maintains.

DHS and its Components conduct customer research to gather experiences and opinions
from DHS customers, employees, and other stakeholders about a particular DHS program or
22

Raw data refers to any data object that has not undergone thorough processing, either manually or through
automated computer software.
23
See Policy ID 3.2.f, DHS 4300A Sensitive Systems Handbook v12.0 (November 15, 2015), 6. Available at
https://www.dhs.gov/publication/dhs-4300a-sensitive-systems-handbook.

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 10

service. The type of information collected varies depending on the particular subject of the survey,
interview, or focus group. However, DHS may collect on an optional basis limited contact
information such as name, phone number, and email address from participants for initial and future
recruitment efforts or correspondence. The participants’ contact information is not in any way
linked to their responses to surveys, interviews, or focus groups.
Participants may also be asked to provide optional demographic information such as age,
gender, race, country of origin, or personal occupation. This information may be collected using
pre-determined questions or through an open-ended discussion. All demographic information
provided by participants is aggregated so as not to identify individual participants. Audio or video
recordings of a participant may be collected during interviews or focus groups to aid a facilitator’s
note taking. A consent form that may contain a participant’s name and signature may be collected
prior to the recording.

2.2

What are the sources of the information and how is the
information collected for the project?

Personal information is collected directly from the participants either by DHS or through
contracted third parties, such as public opinion polling consultants. DHS may also extract contact
information from DHS systems (e.g., case management systems, human resources system,
directories) to directly recruit potential participants for customer research.

2.3

Does the project use information from commercial sources or
publicly available data? If so, explain why and how this
information is used.

In some instances, DHS may use publicly available or commercial sources to solicit
participation in customer research. For example, DHS may contract with a firm to support direct
and indirect recruitment activities, such as providing telephone numbers, ages, and other
demographic data to supplement the recruiting sample. Neither DHS nor the contracted firm will
incorporate contact information collected from commercial or publicly available sources into its
surveys, interviews, or focus group files, or in the final reports and analyses that contain aggregated
data from participants. DHS does not collect, maintain, or store any PII obtained through
commercial data services used to recruit participants for customer research. When third-party
commercial research companies are used to conduct surveys, interviews, or focus groups, DHS
only receives aggregated summarized reports from these companies.

2.4

Discuss how accuracy of the data is ensured.

DHS, or a third party acting on its behalf, collects contact information, opinions, and
experiences directly from participants in the focus groups, surveys, and interviews; therefore,
responses are dependent upon the accuracy of the information provided by each participant.

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 11

Contact information gathered from DHS databases for purposes of recruitment are verified by the
original program that collected the information prior to its use in customer research. In cases in
which DHS relies on a third-party vendor to recruit participants, all vendors used are trusted and
vetted to ensure DHS only uses accurate information. Contact information used by a vendor is
publicly available and assumed to be accurate.

2.5

Privacy Impact Analysis: Related to Characterization of the
Information

Privacy Risk: There is a risk that DHS will collect more information than necessary for
purposes of future recruitment, correspondence, or for its reports and analyses.
Mitigation: The risk is partially mitigated. The purpose of DHS customer research is the
collection of opinions and experiences of participants, not to collect PII. Although personal contact
and demographic information is sometimes collected from participants, this information is
aggregated and does not identify individuals. Survey, interview, and focus group questions are
reviewed in advance by component privacy offices and approved by the DHS Privacy Office. If
DHS collects information about more than 10 members of the public, the questions are submitted
to OMB for approval. DHS and OMB reviews ensure only information necessary for the purpose
of the research is collected. DHS may also give participants the option to voluntarily provide
limited contact information to facilitate future correspondence (e.g., future wave surveys,
informational pamphlets, email notifications), but participants are informed that they are not
required to provide this information and their PII is not linked to the answers they provided during
the customer research. If they choose to provide this information, DHS only uses it for follow-up
and future recruitment purposes.
Privacy Risk: There is a privacy risk that interviewers or focus group facilitators will fail
to protect the anonymity of participants during the collection of information.
Mitigation: The risk is partially mitigated. DHS interviewers and facilitators, including
contracted third party vendors, are trained in how to conduct customer research and advised to
focus on collecting feedback from participants rather than collecting PII. Interviewers and
facilitators follow a uniform process to ensure the continuity of operations. At the end of each
interview, the team de-briefs and reviews their notes to ensure all insights are captured,
anonymized, and communicated across the team. Based on the findings, the team may revise the
interview guide and research approach accordingly.
Privacy Risk: There is a privacy risk that collecting certain types of information (e.g.,
demographic information) or collecting information in an open-ended manner may allow for reidentification of a participant if the sample size is small and a specific participant’s response is
unique.

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 12

Mitigation: This risk must be mitigated on a separate basis for each individual customer
research effort. DHS has instituted procedural safeguards to ensure the confidentiality of survey
takers is protected, including through the PTA process. Questions that are deemed unnecessary or
too specific to an individual during customer research are considered to be “over-collections” of
information and are dropped from the questionnaire prior to distribution of the customer research
or additional steps must be taken to remove the identifying information. Additionally, programs
must work with their respective privacy office to determine appropriate thresholds to ensure that
individuals cannot be re-identified.

Section 3.0 Uses of the Information
3.1

Describe how and why the project uses the information.

The DHS mission necessitates that the Department interact with and provide services to a
large population of individuals (e.g., adjudicating benefit requests, assisting individuals recover
from disasters, and inspecting carriers entering and exiting U.S. transportation systems). DHS, as
a multi-faceted organization with over twenty component agencies, is responsible for thousands
of employees and numerous stakeholders. DHS and its Components must always endeavor to
improve its operations and the outcomes for individuals with whom they interact. DHS customer
research efforts are developed to better understand the opinions and experiences from DHS
stakeholders, the public, and employees. By analyzing large datasets of information regarding
interactions with its operations, DHS can focus funding and effort to improving perceived
shortcomings or predictable shortfalls in operations. DHS uses information gathered from
customer research to improve customer service, employee morale, and stakeholder relationships.
Generally, DHS tries to recruit a specific population of individuals for customer research
(e.g., recipients of a specific benefit, employees of a specific agency, or asylum seekers from a
particular region).
Occasionally, DHS may extract contact information from a DHS system to solicit
participation in customer research (e.g., from a system that maintains data about individuals who
were granted a specific benefit from a particular DHS Component). DHS will only use names,
telephone numbers, email addresses, and mailing addresses for this purpose.
DHS primarily collects the experiences and opinions of participants during its customer
research, but may also collect certain demographic information (e.g., age, country of birth, income,
state, county) for purposes of aggregating the information into management reports and analyses.
These reports, for example, may identify long wait times or greater needs for certain types of
foreign language speakers at different locations. All of the demographic information contained in
these management reports and analyses is aggregated so the individual cannot be identified.

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 13

Also, as discussed, DHS may ask participants if they would like to voluntarily provide
limited contact information to facilitate future correspondence (e.g., future survey waves,
informational pamphlets, email notifications). Participants are informed beforehand that they are
not required to provide this information and their PII will not be linked to the answers they provide
during the customer research.

3.2

Does the project use technology to conduct electronic searches,
queries, or analyses in an electronic database to discover or locate
a predictive pattern or an anomaly? If so, state how DHS plans to
use such results.

Yes. DHS may use electronic databases to analyze data collected in focus groups, surveys,
and interviews in order to reveal patterns of behaviors and opinions among specific demographic
groups in order to tailor process improvements to those groups.
At the conclusion of the collection of customer research, DHS and Component statistical
or research experts aggregate and anonymize raw data collected from participants. The data is
aggregated and anonymized because the goal of the research is to identify trends among groups
and not individuals within those groups.24 The aggregated data is then analyzed, trends
documented, and recommendations may be made. A report can then be distributed to appropriate
DHS stakeholders and the general public, when appropriate. There is no PII, only aggregated data
in the published reports

3.3

Are there other components with assigned roles and
responsibilities within the system?

Not applicable. This PIA is written to assess the privacy implications of information
collection and analysis. IT systems related to storage of raw data from customer research will be
covered under separate PIAs or PTAs.

3.4

Privacy Impact Analysis: Related to the Uses of Information

Privacy Risk: There is a risk that PII collected from participants will be used
inappropriately prior to it being aggregated into management reports or analyses.
Mitigation: All customer research with more than 10 participants must comply with the
PRA and all OMB requirements described in OMB Memorandum, “Guidance on Agency Survey
and Statistical Information Collections.”25 Any PII collected by DHS must be stored on a secured
24

The aggregated data is typically presented in the form of charts and graphs that reflect certain demographic
breakdowns, which are then analyzed to produce recommendations in furtherance of improving departmental
processes and operations.
25
OMB Memorandum, “Guidance on Agency Survey and Statistical Information Collections,” January 2006,
available at www.whitehouse.gov.

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 14

IT system. Access to participant contact information or raw customer research data is limited to
DHS employees who have a justifiable business need and appropriate training to access the
information. Any demographics research conducted by a third party contracted by DHS are
required to aggregate data before supplying it to DHS. It is standard operating procedure within
DHS to separate information collected from customer research from an individual participant’s
personal information. Once DHS confirms a participant is the individual DHS originally solicited
to participate in the customer research, it no longer uses the PII and does not include PII as part of
any report.
Privacy Risk: There is a risk that DHS could use the information collected for purposes
other than that for which the information was collected, including for operational uses.
Mitigation: DHS only collects information that is directly related to the survey, interview,
or focus group. All recruitment of participants for customer research is conducted only by DHS
and Component outreach units, research units, or third-party vendors, and not by those responsible
for management, benefits, services, or enforcement decisions within the Department. All PII
collected is destroyed once it is aggregated into the reports and any contact information collected
for the purpose of future correspondence is separated from the answers provided by each
participant. Information collected during the customer research resides within a Component’s
statistical or research unit of a DHS office, Component, or contractor that is responsible for
producing statistical and demographic analysis. Operational units do not receive PII or any other
information collected for these purposes that could be used for an operational decision or action
related to a specific individual. Furthermore, all DHS employees are required to take annual
privacy training and are subject to discipline for inappropriately using PII.

Section 4.0 Notice
4.1

How does the project provide individuals notice prior to the
collection of information? If notice is not provided, explain why
not.

The information collected in customer research is provided directly by the individual. DHS
provides notice to individuals through a Privacy Notice or a Privacy Act Statement. Facilitators of
customer research that occurs in-person or over the phone verbally informs participants that
providing information is strictly voluntary DHS is required to publish a notice in the Federal
Register when collecting information from 10 or more individuals of the public, which includes a
30 day public comment period, prior to commencing the research. When DHS extracts previously
collected contact information from its systems to recruit potential participants, notice is provided
through a Privacy Act Statement on the initial collection form.

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 15

4.2

What opportunities are available for individuals to consent to
uses, decline to provide information, or opt out of the project?

All of DHS’s customer research is consensual. Participants are informed that their
involvement is voluntary, and failure to provide any information will not impact their eligibility
for, or provision of, DHS services. OMB requires agencies to obtain consent from prospective
participants prior to the collection of information from 10 or more members of the public.
Therefore, individuals are notified prior to any collection (either on paper or verbally) that they
may decline to provide information or opt-out of participating at any time.

4.3

Privacy Impact Analysis: Related to Notice

Privacy Risk: There is a risk that federal employees participating in customer research
may not be properly protected since the Paperwork Reduction Act only applies to collections from
the 10 or more members of the public.
Mitigation: The Privacy Act requires that an agency supply notice to federal employees
any time PII is collected that could later be retrieved. DHS requires potential participants have
express “informed consent” for any information collection regarding its employees. Customer
research activities must be vetted by the Component and DHS Privacy Office to ensure that there
is proper notice given to employees regarding the purpose, authority, and voluntariness of the
information collection. For customer research facilitated by a person, the facilitator must explicitly
verbally state the purpose of the research and how the data will be used, that participation is
completely voluntary, failure to participate will not affect his or her relationship with DHS or the
Component, and that responses will be kept confidential. Participants provide consent either
verbally or by signing a consent form.
Privacy Risk: There is a risk that participants may not realize that the information they
initially provide to DHS (e.g., to seek a benefit) may later be used to contact participants to engage
in future customer research.
Mitigation: This risk is partially mitigated by publishing this PIA and the DHS/ALL-002
DHS Mailing and Other Lists System SORN, which states that mailing lists may be maintained of
persons who attend or have an interest in DHS programs to be used in furtherance of DHS’s
duties.26 DHS gives all potential participants the opportunity to decline or to discontinue
participation at any point, minimizing any potential harm resulting from an individual’s lack of
notice.

26

DHS/ALL-002 Department of Homeland Security (DHS) Mailing and Other Lists System, (November 25, 2008,
73 FR 71659) available at: https://www.dhs.gov/system-records-notices-sorns.

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 16

Section 5.0 Data Retention by the project
5.1

Explain how long and for what reason the information is retained.

DHS maintains information related to surveys, interviews, and focus groups in accordance
with the research’s OMB-approved ICR as appropriate, or NARA’s General Record Schedule
(GRS) 6.5, Item 010, Public Customer Service Operations Records. Customer Service Operations
records are destroyed after one year or when no longer needed for business use, whichever is
appropriate. This includes all recordings, notes, contact information, and raw data collected during
the course of the customer research.
Data retention for surveys created and distributed via third-party vendor tools varies from
tool to tool. Generally, participant responses and email addresses are deleted when no longer
needed for a valid business purpose.
5.2

Privacy Impact Analysis: Related to Retention

Privacy Risk: There is a risk that contact information collected for future correspondence
may be retained for a period longer than necessary.
Mitigation: DHS mitigates this risk by deleting the data when no longer necessary, as
required by the research’s OMB-approved ICR or General Record Schedule 6.5, Item 010. Any
PII, especially demographic data received from customer research is aggregated and is not linked
to any particular participant. Contact information used to initially contact prospective participants
is typically taken from other DHS systems and is deleted after completion of the customer research
or any subsequent follow up.
Privacy Risk: There are risks associated with the fact that DHS may not be able to control
third parties’ retention of contact information and responses.
Mitigation: This risk is partially mitigated. If DHS contracts a third party vendor to assist
in customer research that involves the collection of PII, then the Department ensures that DHS is
the owner of all data collected. The vendor is required contractually to destroy all information
associated with the information collection at the end of the contract. DHS also contracts for the
right to investigate and audit a vendor’s systems to ensure they are complying with DHS policies,
procedures, and retention schedules. Any egregious or potentially illegal conduct could be referred
to the Office of the Inspector General27 or investigated by the DHS Privacy Office under its
statutory authority.28 DHS and Component Privacy offices are consulted by their respective
contracting offices and have the ability to review contracts to ensure that appropriate language is
included to protect participant PII.
27
28

See 6 U.S.C. § 371 et seq.
See 6 U.S.C, § 142(a)2

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 17

Section 6.0 Information Sharing
6.1 Is information shared outside of DHS as part of the normal
agency operations? If so, identify the organization(s) and how the
information is accessed and how it is to be used.
DHS may share reports containing aggregated information with external agencies,
Congress, or the public. These reports are distributed for both business-related and informational
purposes. All information regarding persons in these reports is aggregated, so individuals are not
identified.

6.2

Describe how the external sharing noted in 6.1 is compatible with
the SORN noted in 1.2.

DHS shares limited contact information with third-party contractors and vendors to assist
DHS in recruiting for, and conducting, customer research. This sharing is compatible with
“Routine Use F” of the DHS/ALL-002 Mailing Lists SORN, and similar routine uses found in
DHS source systems. This routine use permits the disclosure of PII to DHS contractors when
necessary to accomplish an agency function. Contractors and vendors provided PII under “Routine
Use F” are subject to the same Privacy Act limitations on disclosures as DHS employees. The
reports issued following customer research contains only aggregated information (no PII), so
SORN compatibility is not needed for such disclosures.

6.3

Does the project place limitations on re-dissemination?

PII provided to contractors and vendors for purposes of facilitating customer research are
contractually limited to the same Privacy Act limitations as DHS employees. As discussed, reports
following customer research only contain aggregate data, therefore external parties may redisseminate statistical data without limitations.

6.4

Describe how the project maintains a record of any disclosures
outside of the Department.

PII disclosed to third party contractors is recorded by DHS in accordance with the terms
and conditions of the contract. Reports generated by customer research do not contain PII, and as
such, a disclosure record is not maintained when shared externally.

6.5

Privacy Impact Analysis: Related to Information Sharing

Privacy Risk: There is a risk that third-party vendors or contractors could use participant
PII for purposes other than facilitating a customer research.

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 18

Mitigation: This risk is partially mitigated. DHS requires all third-party vendors to
comply with applicable DHS privacy policies and the provisions of the Privacy Act. Third-party
vendors are required to delete or destroy any data collected from DHS or customer research
participants at the end of its contract. DHS and component privacy offices ensure that all PII
handling and storage processes comply with DHS Privacy standards through PTAs and contract
review. The DHS Privacy Office must provide prior approval of a third party vendor’s privacy
policies prior to beginning to work.
Privacy Risk: There is a risk of unauthorized disclosure of information.
Mitigation: This risk is partially mitigated. Access to customer research responses in the
relevant system is limited to those DHS employees with a need to know this information to perform
their duties. Privacy Offices at the Component and Department level ensure that any question
asked during customer research would not result in answers that could be linkable to an individual
participant prior to distribution of the customer research. If DHS or a Component chooses to
distribute a report externally, the reports contain only aggregate data that demonstrates a trend or
pattern and is analyzed by component outreach or research units prior to disclosure to ensure the
information cannot be used to identify an individual.

Section 7.0 Redress
7.1

What are the procedures that allow individuals to access their
information?

DHS and Component privacy offices ensure that controls are in place so that customer
research activities cannot be used in any way that affects any current or future interaction DHS
may have with a participant. No access or redress can occur regarding participant responses
because responses given during customer research are by design not linkable to a participant. In
general customer research responses are anonymous and are not unique enough to allow for
identification of an individual. DHS outreach or research units or third party contractors aggregate
all information they collect from customer research such that it cannot be linked to individuals.
Because customer research responses are anonymized, individuals may not be able to access the
information they provided. If participants are interested in accessing information they previously
provided to DHS for future contact or for the purposes of a benefit or other request, individuals
are encouraged to contact the respective Component or DHS Freedom of Information Act (FOIA)
Office. Additional information about FOIA is available at http://www.dhs.gov/foia.
However, each specific focus group, survey, or interview may have its own redress
opportunities related to the contact information collected for future correspondence. Participants
may contact the facilitator to learn about specific redress opportunities, if they believe their contact
information is inaccurate.

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 19

7.2

What procedures are in place to allow the subject individual to
correct inaccurate or erroneous information?

DHS may collect contact information from DHS systems to identify and contact potential
customer research participants. If participants are interested in accessing information they
previously provided to DHS for the purposes of a benefit or other request, individuals are
encouraged to contact the respective Component or DHS Freedom of Information Act (FOIA)
office. Additional information about FOIA is available at http://www.dhs.gov/foia.
If DHS uses a third-party vendor or contractor to facilitate customer research, the
participant should review the organization’s respective privacy policy for specific instructions on
how to access, correct, or update inaccurate or erroneous information.

7.3 How does the project notify individuals about the procedures for
correcting their information?
Individuals who wish to request correction to their personal information may submit that
request in writing directly to the DHS or Component point of contact, as each survey, interview, and
focus group will have its own redress procedures. Contact information can be found at
http://www.dhs.gov/foia under “Contact Information.”

7.4

Privacy Impact Analysis: Related to Redress

Privacy Risk: There is a risk that individuals will not be able to correct any incorrect
information that DHS collected during customer research.
Mitigation: The risk is partially mitigated. DHS refrains from collecting PII from
participants whenever possible and immediately aggregates any demographic information
collected during customer research. Information given during customer research, therefore, will
be difficult to access or amend. As discussed, PII and participant responses are provided directly
from the individual, and then the PII is separated from a participant’s responses. Therefore, any
potential privacy harm to an individual would be minimized. DHS ensures that all information,
incorrect or not, is not associated to a single participant. DHS collects a sufficient amount of
responses during customer research to ensure that one participant’s erroneous information will not
adversely affect the statistics and analysis generated from its research, or have any adverse or
operational impacts on the participant.

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 20

Section 8.0 Auditing and Accountability
8.1

How does the project ensure that the information is used in
accordance with stated practices in this PIA?

DHS ensures that the practices stated in this PIA are followed by leveraging training,
standard operating procedures, policies, rules of behavior, and role-based access. Only employees
and contractors with a valid need-to-know may collect and use information obtained from
customer research. Moreover, any DHS unit or agency that chooses to collect information,
regardless of whether that information requires PRA submission, is required to conduct a PTA.
The DHS Privacy Office tracks and accounts for all customer research efforts by the Department
or its Components through the PTA process.

8.2

Describe what privacy training is provided to users either
generally or specifically relevant to the project.

All DHS employees and contractors receive annual security and privacy training. DHS
interviewers and facilitators are trained in user research and how to avoid soliciting PII from
participants. Each Component may supplement this training with system specific privacy training
depending on the IT systems involved and data used.

8.3

What procedures are in place to determine which users may
access the information and how does the project determine who
has access?

DHS deploys role-based access controls and enforces a separation of duties throughout all
DHS operations to limit access to only those persons who have a need-to-know in order to perform
their duties. This need-to-know is determined by the respective responsibilities of the employee.

8.4

How does the project review and approve information sharing
agreements, MOUs, new uses of the information, new access to the
system by organizations within DHS and outside?

This PIA does not require information sharing agreements or MOUs; however, there is a
process to review such agreements if it becomes necessary. This process involves review by the
DHS IT Security, DHS Privacy Office, and DHS Office of General Counsel prior to sending to the
DHS Privacy Office for formal review and clearance. Similarly, each Component will leverage its

Privacy Impact Assessment
DHS/ALL/PIA-0xx DHS Surveys, Interviews, and Focus Groups
Page 21

stakeholders in the process of reviewing and approving any new uses for the surveys and/or focus
groups.

Approval Signature
Original, signed copy on file with the DHS Privacy Office
Philip S. Kaplan
Chief Privacy Officer
Department of Homeland Security