APH Privacy Assessment

[INSERT CLASSIFICATION/CONTROL MARKINGS, IF APPROPRIATE]

United StatesDepartment of Justice
Office of Privacy and Civil Liberties (OPCL)

Information Collection Request–Privacy Assessment

Instructions& Template
(Revised3/30/2018)

What is an Information Collection Request–Privacy Act Statement Assessment? An Information
Collection Request–PrivacyAssessment(ICR–PA) assesseswhether your ICR1 contains a collection
instrument that requires privacy-related notices, either directly on the form, or on a separateform that can
be retained by the individual. Specifically, the ICR–PA is a tool used to assesswhether the ICR requests
personally identifiable information(PH);2 whether Privacy Act requirementsapply to the ICR; what
system of records notices, if any, apply to the ICR; what information is necessaryto prepare a legally
compliant Privacy Act Statement;and whether any other relevant privacy notices are required as part of a

component’sICR.
Why is an Information Collection Request–PrivacyAssessmentnecessary?The numerous
requirementsregarding the collection of PH and ICRs are distinct, but very much related.
1.

The Privacy Act of 1974
Under the Privacy Act of 1974, 5 U.S.C. g 552a, a “record”3 maintained in a “system of
records”4 establishes certain collection, use, maintenance, and dissemination requirements for

Federalagencies,while also providing certain rights to individuals on whom the record
pertains. Specifically, each agency must provide a “Privacy Act Statement”when requesting
individuals to provide information to the agencythat will be maintained as a record about the

1 For more information regarding the DOJ ICRs process, pleasereview !he Information Collection/Paperwork Reduction Her

Standards& Procedures.
2 The term “personally identi6able information” is de6ned as “information that can be used to distinguish or trace an individual’s
identity, either alone or when combined with other information that is linked or linkable to a specific individual.” OMB Circular
A-130, Managing Information as a Strategic Resource, 81 Fed. Reg. 49689 (July 28, 2016).
3 The term “recouP meansany item, collection, or grouping of information about an individual that is maintained by an agency,
including, but not limited to, his education, 6nancial transactions, medical history, and criminal or employment history and that
contains his name, or the identifying number, symbol, or other identifying particular assignedto the individual, such as a 6nger
or voice print or a photograph. 5 U.S.C. § 552a(a)(4).
4 The term “system of records” meansa group of any records under the control of any agency from which information is retrieved
by the name of the individual or by some identifying number, symbol, or other identifying particular assignedto the individual. 5
U.S.C. i 552a(a)(5).

[INSERT CLASSIFICATION/CONTROL MARiaNGS, IF APPROPRIATE]
1

[INSERT CLASSIFICATION/CONTROL MARKINGS, IF APPROPRIATE]
individual in a system of records.The Privacy Act Statementmust appearon the form used to
collect the information or on a separateform that can be retained by the individual, and must
contain the following:
(A) the authority (whether granted by statute, or by executive order of the President)

which authorizesthe solicitation of the information;
(B) whether disclosure of such information is mandatory or voluntary;

(C) the principal purpose or purposesfor which the information is intended to be used;
(D) the routine uses which may be made of the information, as published pursuant to

paragraph
(4)(D)of this subsection;
and
(E) the effects on him, if any, of not providing all or any part of the requested
information.5
The Privacy Act also places strict notice requirements when requesting Social Security
Numbers (SSNs). Specifically, if an agency requests an individual to disclose his/her SSN

(regardless of whether the number is part of a record maintained in a system of records), the

agencymustinformtheindividual:
(A) whether that disclosure is mandatory or voluntary;

(B) by what statutory or other authority such number is solicited; and
(C) what uses will be made of it.
11.

OMB Memorandum M-17-06: Collecting Personally Identifiable Information Using an
Online Interface
OMB Memorandum M-17-06, Policies for Federal Agency Public Websites and Digital

Services(Nov. 8, 2016),6placesadditional privacy requirementson information collections
that utilize an online interface (e.g., collecting information through a DOJ webpage). A
privacy notice must be provided, whenever feasible, where a Privacy Act Statement is not

required but members of the public could nonethelessprovide PH to the agencyusing an
online interface. The privacy notice should include a brief description of the agency’s
practiceswith respectto the PH that the agency is collecting, maintaining, using, or
disseminating.
111.

The PaperworkReductionAct
In an effort to avoid overburdeningthe public with federally sponsoreddata collections,
Congresspassedthe Paperwork Reduction Act of 1995, 44 U.S.C. gg 3501–3521,which
requires Federal agencies to obtain Office of Management and Budget (OMB) approval
before requesting or collecting many types ofinformation7 from the public. To comply with

the PaperworkReduction Act, Federalagenciesmust complete an ICR for submissionto
OMB, prior to engaging in the collection of information, which consistsof:
5 5 U.S.C. § 552a(e)(3)
6 Exec. Office of the PresidentMemorandum for the Heads of the Executive DeparLruentsand Agencies, M-17-06, Off. ofMgmt.
& Budget (Nov. 8, 2016), https://www. whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-06.pdf.
7 OMB regulations dUne “information” for purposes of the Paperwork Reduction Act as “any statementor estimate of fact or
opinion, regardlessof form or format, whether in numerical, graphic, or narrative form, and whether oral or maintained on paper,
electronic or other media.” 5 C.F.R. 1320.3(b). This includes: “(1) requests for information to be sentto the government, such as
forms . . . written reports . . . and surveys . . . ; (2) recordkeeping requirements . . . ; and (3) third-party or public disclosures . . .
.“ Office of Management and Budget Memorandum, Information Collection under the Paperwork Reduction Act” at 2 (Apr. 7,

2010)

[INSERT CLASSIFICATION/CONTROL MARIONGS, IF APPROPRIATEI
2

[INSERT CLASSIFICATION/CONTROL MARiaNGS, IF APPROPRIATE]

(A)
(B)
(C)
(D)

a description of the information sought;
the justification and authority for collecting the information sought;
the processfor carTyingout the collection; and
the estimatedburden of the collection on respondentsand the Government.

OMB requires each agencyto provide certain privacy-related information as part of all
agency ICR requests. Specifically, OMB requires agenciesto answertwo questions
regarding the ICR when reported to OMB:
(A) Does this ICR request any personally identifiable information?
(B) Does this ICR include a form that requires a Privacy Act Statement?
Overall, the ICR–PA will assist componentsin properly answering OMB’s privacy-related questions,and
complying with relevant privacy laws and policies.

When should an Information Collection Request–PrivacyAssessmentbe completed? An ICR–PA
should be completed as soon as a component determinesthat its ICR will utilize/develop an instrument
for the collection of information, or structured fields to collect information electronically. An ICR–PA
should be completed for any new information collections, or when seeking an extensionfor an existing
information collection that has not previously completed an ICR-PA. If the ICR contains multiple
collection instruments, a separateassessmentshould be completed for eachinstrument. Componentsmust
complete the ICR-PA, and any required notices, prior to uploading the ICR request into the RISC and
OIRA Consolidated Information System (ROCIS), as detailed in The United StatesDepartment of Justice,
Information Collection/Paperwork Reduction Act Standards & Procedures.

Who should prepare the Information Collection Request–Privacy Assessment? An ICR–PA should
be completed by the Component Program Manager, and should be coordinated with the component PRA

Coordinator, Senior Component Official for Privacy (SCOP) (or other appropriatecomponent privacy
representative),and the program-specific office responsiblefor the information collection.

Where should the prepared Information Collection Request–PrivacyAssessmentbe sent? A
completedICR-PA will certify to the Department ClearanceOfficer that the Program Manager has
accurately contemplated the new privacy-related questions, and can accurately answer the questions in its

ROCIS submissionto OMB OIRA. Components should retain the ICR-PA in their internal records, which
can be requestedat any time by the Department ClearanceOfficer or OPCL.

How is the ICR–PA related to a traditional Initial Privacy Assessment?An Initial Privacy
Assessments
(IPA) is the first stepin a processdevelopedby OPCL to assistDOJ componentsidentify
privacy compliance issues for DOJ information collections and systems. Specifically, the IPA is a tool
used to facilitate the identification of potential privacy issues,assesswhether additional privacy
documentation is required, and ultimately, ensure the Department’s compliance with applicable privacy

laws andpolicies.

It is likely that an information collectionsentthrough the ICR processthat collectsPn will be
required to meetadditional privacy-related requirements,beyondthosediscussedin the ICR-PA.
It is highly recommended that you discuss the full collection, use, maintenance, and dissemination
processes related to this ICR with your SCOP as soon as you contemplate a new collection of

information

[INSERT CLASSIFICATION/CONTROL MARKINGS, IF APPROPRIATEI
3

[INSERT CLASSIFICATION/CONTROL MARiaNGS, IF APPROPRIATE]
NAME

OF INFORMATION

COLLECTION

REQUEST:

Course Evaluation

ONB CONTROL NUMBER (IF APPLICABLE):
COMPONENT:

DOJ/FBI, USDA, OK State University, Ptivate Sector

COMPONENTPRA COORDINATOR
Name: JulianLopez
Office: Internal Policy Office
Phone: 202-324-6696
Bldg./RoomNumber: JEH/9798
Email: [email protected]

PROGRAM MANAGER (OR PROGRAM MANAGER
DELEGATE)
Name: HallemaMitchell
Office: WMDD - ChemicalBiological Countnneasure
Phone: 202-324-6117
Bldg./Room Number: JEH/6387
Email: [email protected]

SENIOR COMPONENT OFFICIAL FOR PRIVACY
(whereapplicable)OR COMPONENTPRIVACY
POINT OF CONTACT
Name: DouglasSteenhuisen
Offlce: Privacy and Civil Liberties Unit

Phone: 202-324-5345
Bldg./Room Number: JEH
Email

[email protected]

ICR-PA Certification& Signature
On behalf of my component, I certify that:

(1) 1 have reviewed all collection instruments associatedwith this ICR;
(2) 1 have completed the ICR-PA below for the collection instrument(s) associated with this ICR;
(3) 1 have coordinated closely with the component PRA Coordinator and SCOP (or other appropriate component

privacy representative)in assessingand answering each of the ICR-PA questionsbelow;
(4) To the extent the collection instrument(s) associatedwith this ICR require(s) a privacy-related notice(s), I have
coordinated internally to ensure that the appropriate notice(s) has/have been drafted; that the notice(s) is/are
conspicuous, salient, clearly labeled, and written in plain language; and that the notice(s) is/are appropriately
displayed as required by law or policy; and

(5) 1 will reassessthe information in this ICR-PA, in accordancewith the Department’s ICR process,should the
instrument(s) associatedwith this ICR materially change.

Program Manager Name:
Program Manager Signature:

Date signed:

HallemaMitchell

HA M
5 / /7/zs

Pleaseprepare the ICR–PA per the guidanceprovided in the questionson the template
below. If the ICR contains multiple collection instruments an assessmentshould be
completedfor eachinstrument

[INSERT CLASSIFICATION/CONTROL MARKINGS, IF APPROPRIATE]
4

[INSERT CLASSIFICATION/CONTROL MARiaNGS, IF APPROPRIATE]

I(HR Instrument

Name:

Animal-Plant Health Joint Criminal-Epidemiological Inv

OMB Control Number(if applicable):
1.

Which of the following describesthe collection.

P] Electroniconly.
[]

Paperonly.

LJ Combination paper/electronic.
2.

Does the ICR include a collection instrument (either physical or electronic)?
M Yes. [If you marked “Yes,” proceedto question 3].
LJ No. [1f you marked 'No,”

STOP here. Additional privacy statements are not

necessary
for this collection].
3. Pleaseindicate if any of the following characteristicsapply to the information collected:

(Check all that apply.)

[]

The information directly identifies specific individuals.

[] The information is intendedto be used,in conjunction with other data elements,to
indirectly identify specific individuals.
LJ The information can be usedto distinguish or trace an individual’s identity (i.e., it
is linked or linkable to specific individuals).
[If you marked any of the above,proceedto question 4.]

[/] None of the above
[If you checked'None of the above,” STOP here.Additional privacy statementsare not
necessaryfor this collection]
4

Is the componentrequesting an individual to disclosehis/her Social SecurityNumber (SSN)?
M No. [1f you marked 'No,” proceedto question 5].
H Yes. [A SSN Statement may be required, pursuant to the Privacy Act. Coordinate
with your SCOPto draft an appropriate statement. Proceedto the next questionsto
determine whether additional notifications are required]

[INSERT CLASSIFICATION/CONTROL MARKINGS, IF APPROPRIATE]
5

[INSERT CLASSIFICATION/CONTROL MARKINGS, IF APPROPRIATE]
5.

Is the componentcollecting the information using an online interface (e.g., a webpage)?

[]

No. [1f you marked'No,” proceedto question6].

M Yes. [A privacy notice may be required, pursuantto OMB M-17-06. Coordinate
with your SCOPto draft an appropriatestatement. Proceedto the next questionsto
determinewhether additional notifications are required].
6.

Will information about United Statescitizens or lawfully admitted permanentresidentaliens be
retrieved from the instrument by a personalidentifier (e.g., by name)?
LVJNo. [1f you marked 'No,” STOPh&e. Additional privacy statementsarenot
necessaryfor this collection,but you may have additional privacy-related
requirements beyond thosediscussedin this ICR-PA. Consult your SCOP to
identify additional privacy-related requirements, if any.]
LJ Yes, [If you marked “Yes,” proceedto question 7].

7.

Is there an existing Privacy Act Systemof RecordsNotice (SOW) that hasbeen published in
the Federal Register that will sufficiently cover this new collection? (Please consult with your
component’s SCOP,Privacy Act officer, General Counsel, or OPCL if assistanceis neededin
respondingto this question.)

LJ No. [1f you marked “No,” contact your SCOP/OPCL. An accurateSORNmust
be published before a componentmay collect this information] .
LJ Yes. [If you marked “Yes,” proceedto question 8].
8

Does the existing SORN properly reflect this new information to be collected? (Pleaseconsult
with your component’s SCOP,Privacy Act officer, General Counsel,or OPCL if assistanceis
neededin respondingto this question.)

LJ No. [1f you marked “No,” contact your SCOP/OPCL. An accurateSORNmust
be published before a component may collect this information] .

LJ Yes. [A Privacy Act Statementmay be required, pursuantto the Privacy Act.
Coordinate with your SCOP to draft an appropriate statement].

[INSERT CLASSIFICATION/CONTROL MARiaNGS, IF APPROPRIATE]
6