Microsoft Word - NOAA4000 PIA 2023-0705 CRB Updates Final

Status: Original and derived artifacts are available for this document.

Download: pdf

Version Number: 01-2021

U.S. Department of Commerce
National Oceanic & Atmospheric Administration

Privacy Impact Assessment for the
NOAA4000
Fisheries WAN and Enterprise Services

Reviewed by:

5RELQ%XUUHVVIRUMark Graff%XUHDX&KLHI3ULYDF\2IILFHU

‫ ܆‬Concurrence of Senior Agency Official for Privacy/DOC Chief Privacy Officer
‫ ܆‬Non-concurrence of Senior Agency Official for Privacy/DOC Chief Privacy Officer
Digitally signed by BRIAN ANDERSON
Date: 2025.10.29 09:39:08 -04'00'

Signature of Senior Agency Official for Privacy/DOC Chief Privacy Officer

Date

Version Number: 01-2021

U.S. Department of Commerce Privacy Impact Assessment
NOAA/NMFS/Fisheries WAN and Enterprise Services
Unique Project Identifier: NOAA4000
Introduction: System Description
Provide a brief description of the information system.

The National Marine Fisheries Services (NMFS) Headquarters Wide Area Network (WAN) and
Enterprise Services System (NOAA4000) is a general support system (GSS) comprising three
cloud subsystems: Oracle Cloud Infrastructure (OCI), Google Cloud Platform (GCP), and the
Appian Cloud Platform. The system hosts several applications that collect, store, and/or
disseminate information on members of the public, including foreign national guests, and in
some cases, National Oceanic and Atmospheric Administration (NOAA) staff and/or
contractors.
Address the following elements:

(a) Whether it is a general support system, major application, or other type of system
NOAA4000 is a general support system (GSS).

(b) System location
This system has three geographical locations: Ashburn, VA; Seattle, WA; and Silver Spring, MD.

(c) Whether it is a standalone system or interconnects with other systems (identifying and describing any
other systems to which it interconnects)
The updates to the PIA have been made to ensure that the Cyber Security Assessment and Management
(CSAM) system and the PTA and PIA match.
The NMFS WAN NOAA4000 connects to the Seattle Disaster Recovery site via NWAVE NOAA0550
and have interconnections with the following entities:
 U.S. Coast Guard (USCG)
 Pacific States Marine Fisheries Commission (PSMFC)
 U.S. Custom and Border Protection (CBP)
 Atlantic Coastal Fisheries Information Network (ACFIN)
 1901 NSOC
 Naval Research Lab MDA
 'HSDUWPHWQRI+RPHODQG6HFXULW\ '+6
 2WKHU12$$6\VWHPV

Version Number: 01-2021
D NOAA0100 – NOAA Cyber Security Center
E NOAA0550 – NOAA Enterprise Network (N-WAVE)
F NOAA1101 – Information Technology Center (ITC)
G NOAA4011 – National Fishing Permit and Landings Reporting System (NFPLRS)
H NOAA4100 – Greater Atlantic Regional Office (GARFO) Network
I NOAA4200 – Northeast Fisheries Science Center (NEFSC) Network
J NOAA4300 – Southeast Regional Office (SERO) Network
K NOAA4400 – Southeast Fisheries Science Center (SEFSC) Network
L NOAA4500 – West Coast Region (WCR) Network
M NOAA4600 – Northwest Fisheries Science Center (NWFSC) Network
N NOAA4700 – Alaska Regional Office (AKRO) Network
O NOAA4800 – Alaska Fisheries Science Center (AKFSC) Network
P NOAA4920 – Pacific Islands Regional Office (PIRO) Network
Q NOAA4930 – Southwest Fisheries Science Center (SWFSC) Network
R 12$$±3DFLILF,VODQGV)LVKHULHV6FLHQFH&HQWHU 3,)6& 1HWZRUN
The interconnections between NOAA4000 and the entities listed above are established through
encrypted interfaces (virtual private networks (VPN)) or the Verizon MultiProtocol Label Switching
(MPLS) (which is internal NMFS). Authentication methods are in place to validate authorized users.
Virus and malicious code prevention is employed to protect the integrity of the software and the data.

(d) The way the system operates to achieve the purpose(s) identified in Section 4
NOAA4000 provides information technology (IT) support by providing IT infrastructure for Fisheries
applications, providing enterprise security services, network connectivity (WAN/local area network
(LAN)), enterprise resource access (local/remote), database management, and enterprise IT helpdesk
support. The NMFS WAN services are through N-WAVE.

(e) How information in the system is retrieved by the user
There are two primary ways users can retrieve information from NOAA4000. The first is to be locally
connected to the NOAA4000 network or via remote access through NMFS VPN, which is within the
Federal Information Security Modernization Act (FISMA) boundary of NOAA4000. The second way to
retrieve data is via general internet, but this is limited based on the application or support being accessed.

(f) How information is transmitted to and from the system
NOAA4000 information is transmitted via VPN, Internet, and dedicated network connections that
makeup NMFS Verizon MPLS (WAN) network.
For GCP, all information is coming through the trusted internet connection (TIC) externally to N-Wave
and then to GCP through a partner interconnect. The partner interconnect is controlled through a single
Google Project, which is managed by the NMFS networking team. Those networking connections are
then provided to the different partners within NMFS. Firewalls are managed through the same network
connection described above. The default firewall configuration is to deny all, and allow through
exception.

Version Number: 01-2021
Firewall configurations are managed only by the networking team. Any communication ports that go
through the firewall have to be opened by the firewall team, through an internal approval process.

(g) Any information sharing
SISP - The Seafood Inspection Services Portal (SISP) is a web-based application that captures
information pertaining to the scheduling, tracking, and fee collections for seafood inspection activities.
The SISP allows Seafood Inspection Program participants (seafood companies, seafood inspection
personnel, system administrative staff, and NOAA Finance (billing data)) to: 1) create an account; 2)
update company information including multiple locations; 3) request certificates, inspections and
contracts; and 4) review and pay invoices. NOAA collects the information under the authority of the
Agriculture and Marketing Act of 1946 and Fish & Wildlife Act of 1956. Name, work email address,
work address, and financial transaction are collected. The information is shared only with the business
entity for invoicing and bill payment. This application collects PII and BII.

VMS - The National Vessel Monitoring System (VMS) program provides near-real time fishing vessel
monitoring, control, and surveillance throughout the U.S. Exclusive Economic Zone (EEZ). Continuous
24/7/365 monitoring supports compliance with marine and fishing regulations regarding open and closed
seasons, closed areas, international boundaries and obligations, and overfishing. The onboard-enhanced
mobile transceiver units (EMTUs) send position location information to NMFS, which is stored in a
database and displayed on an electronic surveillance software, which is currently vTrack. The
information obtained through VMS is evidentiary in nature and used to prosecute violations of fishery
regulations in administrative and civil proceedings. The overall authority for federal fishery management
is the Magnuson-Stevens Conservation and Management Act (MSA)(16 U.S. Code 1801 et. seq.).
Names, home telephone numbers, home email addresses and addresses for vessel operators are collected.
Fisheries shares the information with the USCG, many coastal states' marine enforcement offices, the
Navy, Immigration and Customs Enforcement (ICE), NMFS science centers, and NMFS fishery
managers. This application collects BII.
NEIS - The NOAA Enforcement Information System (NEIS) is a cloud-based case management system
to support Office of Law Enforcement (OLE) and General Council Enforcement Section (GCES) agent,
officer, and attorney needs for the entry, case management, and reporting of law enforcement data. The
authority for federal fishery management is the MSA. Vessel operator name, contact information and

Version Number: 01-2021
vessel ID are collected along with applicable law enforcement data such as case files and a list of seized
property. The case files include, in addition to vessel operator name, contact information and vessel ID,
information collected by authorized law enforcement officers or agents, such as approved fishing
licenses, type of fishing gear being used, and information on the catch. The case files also contain
substantiating evidence such as sworn witness accounts, photographs, documents, and voice recordings.
The case files support the collection of fines and/or the prosecution of these cases. This information is
collected under the authority of the MSA and other laws under the purview of NOAA. This application
collects PII and BII.
NRDA - The Natural Resources Damage Assessment (NRDA) database collects information about
restoration projects suggested by the public in response to an incident, such as an oil spill. The public
(which could include companies or other business entities) submits all restoration activity information.
Statutes such as 15 U.S.C. 1151 authorize programs to collect information from the public in the form of
contact information for receipt of data generated by programs “to make the results of technological
research and development more readily available to industry and business, and to the general public.”
Along with project information, the database collects individual contact information (name,
organization, work email address, home address, and home phone number). Personal information is used
internally and not disseminated. Data, including PII, is exported and shared with NRDA trustee agencies
coordinating with NOAA in the development of restoration plans. Organizational names are publicly
accessible as the submitting organization, as project partners, or in association with research information.
This application collects PII.
RCDB - The Restoration and Conservation Database (RCDB) collects information related to fisheries
habitat restoration projects implemented by the NOAA Office of Habitat Conservation. The Restoration
Center often works with private companies and members of the public to implement projects and
collects, but does not disseminate, contact information for individuals who have worked on the projects.
Contact information includes name, work phone number, work email address, work address and
organization name. An authorizing statute is 15 U.S.C. 1151. Company names can be disseminated
publicly and listed as “project partners” or “funding recipients” depending on their relationship to the
project. There is no "research information" captured by the database or made available to the public. This
application collects PII.
eAOP – The Electronic Annual Operating Plan (eAOP) application provides NMFS managers and
employees with the ability to plan, monitor, and report on organizational and program information. This
includes the planning and reporting of milestones and performance measures, arraying milestones by key
subject areas, and assisting program managers and staff in producing program annual operating plans.
Contact names and phone numbers are included in the milestone and performance measure information.
Only NMFS employees with password access, granted by the Database Administrator, may retrieve
information from the system. The organization uses the information internally for assembling annual
operating plans and for reporting strategic progress to NOAA and the Department of Commerce (DOC).
This application collects PII.
NPS – The National Permits System (NPS) accepts and maintains all Sustainable Fisheries permit
applications and related data. Some of the West Coast and Pacific Islands Region permits information is

Version Number: 01-2021
housed in NPS, as well as Antarctic Marine Living Resources and High Seas permits. All other permit
information is in other NMFS FISMA systems and is addressed in their PIAs. Authorities that apply to
this application and its data are:
The Magnuson-Stevens Fishery Conservation and Management Act (MSA) (16 U.S.C. 1801 et seq.)
The High Seas Fishing Compliance Act
The Tuna Conventions Act of 1950
The Antarctic Marine Living Resources Convention Act (AMLRCA)
The Western and Central Pacific Fisheries Convention Implementation Act (WCPFCIA; 16 U.S.C.
6901 et seq)
The Marine Mammal Protection Act (MMPA)
The Endangered Species Act (ESA)
The Fur Seal Act
The authority for the mandatory collection of the TIN is 31 U.S.C. 7701 This application collects PII and
BII.
ECO – The Environmental Consultation Organizer (ECO) is a web-based case management application
on Appian PaaS using Amazon Web Services (AWS) to support NMFS consultations under the ESA and
under the MSA sections 305(b)(2) & 305(b)(4) Essential Fish Habitat (EFH). This database is used for
documenting and tracking consultation status and key internal process requirements throughout the
consultation, including quality assurance review and status, in meeting statutory timelines. ECO collects
the project lead’s name and business telephone number. Some fields are for internal use while some
fields are available to the public through the public interface on the application. ECO utilizes the Public
Portal by which external users can search and view public information related to Consultations. But no
data is collected. Also, no internal ECO app user account contact information is available via the Public
Portal. This application collects PII.
FishFinS - The FishFinS system is a major application that acts as the system of record for financial and
customer data for multiple business lines (i.e., Fisheries Finance Program (FFP), Fishery Capacity
Reduction Program (Buyback), Capital Construction Fund (CCF), and Fishermen's Contingency Fund
(FCF)). The system is located in the OCI Cloud and will reside on the NMFS Oracle Multi-Tenancy
Cloud Instance. FishFinS provides various types of information to the following groups:
x

NOAA Internal - Provides financial/accounting information to another core accounting NOAA
System (Commerce Business System (CBS)). Entries in CBS must match the FishFinS system.
Two groups within NOAA Finance are involved here: Accounts Receivable (AR) and the Credit
Reform Branch (CRB). The AR group enters payments into FishFinS on a loan-by-loan basis,
based on the Collections Information Repository (CIR) report received from the U.S. Treasury.
Payment amounts are broken out between principal, late charges, and any late charges that may
apply. Transactions are then manually entered into the CBS system based on the information
generated from FishFinS, via a Summary Collections Report. The CRB group then performs a
reconciliation process on a monthly basis to ensure the two systems match.

Version Number: 01-2021
x

NOAA Senior Management - Provides reporting and financial portfolio management information to
senior management, congressional delegates, and other special purpose groups regarding the status
of loans and any additional questions for constituent/loan holder community.

x

DOC Management - Provides reporting and financial portfolio management information to senior
management, other agencies, congressional delegates, and other special purpose groups.

x

Congressional and Special Interest Groups - Provides metrics and business line data points to fulfill
the approved inquiry. For example, the number of FFP loans by state.

x

Stakeholders (FFP, Buybacks, FCF, and CCF) - Provides application paperwork, invoices, annual
reports, and interest statements to borrowers, buyers, agreement holders, and claimants of the
program. Each business line internally maintains data and reports and may provide information to
senior NOAA management and the external constituent community.

x

External Government Stakeholders - Provides annual reports to the Internal Revenue Service (IRS)
and can turn over default accounts to the U.S. Treasury Department. Some stakeholders provide
reports and information to other government agencies if and when asked. No formal connection
exists between other government agency systems and FishFinS, nor the legacy systems. The
connections may exist in the future if and when the second phase of development commences. The
Buyback Program is part of the MSA that authorizes NMFS to conduct a fishing capacity reduction
program. The CCF is part of the Merchant Marine Act of 1936 as amended (46 U.S.C. 1177),
United States tax code (26 U.S.C. Part 7518). The CCF is implemented by regulations under CFR
Title 50, Part 259.

The FCF regulation is (50 CFR part 296, 11/01/1982).
The FFP is part of the Merchant Marine Act and MSA, Chapter 537 of Title 46 of the United States
Code, 46 U.S.C. 53701, 46 U.S.C. 53702(b)(4)(B). This application collects PII and BII.
UAS – The Unmanned Aircraft System (UAS) is a standalone system used for civil and criminal
enforcement activities and fisheries intelligence. The UAS collects pictures and videos of vehicles,
vehicle tags, vessel IDs, and persons. The information in the system will be retrieved either by live feed
to an external hard drive, directly to the computer, or to a flash drive. A camera is mounted on the UAS,
which broadcasts the information to the person(s) on the ground. Some UAS use radio signals to transmit
and receive the information. Some UAS have a multi-band wireless transmitter built in along with an
antenna. Depending on the UAS, the receiver of the information signals can be either the remote-control
unit, a computer, tablet or smartphone device. Some UAS use 4G / LTE networks to transmit the
information. This consists of a camera module, a data module and a 4G / LTE modem. The only
information sharing conducted by the system will be with state and federal partners such as the USCG
and Joint Enforcement Agreement (JEA) partners. NOAA collects information under the authority of
Presidential Memorandum: Promoting Economic Competitiveness While Safeguarding Privacy, Civil
Rights, and Civil Liberties in Domestic Use of Unmanned Aircraft Systems (Feb. 15, 2015). This system
collects PII/BII.
GCLD – The General Counsel Litigation Database (GCLD) is an application to assist NOAA’s legal

Version Number: 01-2021
counsel manage and respond to various inquiries on NOAA/NMFS litigation from Congress, the White
House, Fisheries councils, and other government agencies. PII/BII is not collected.
MMHSRP – The Marine Mammal Health and Stranding Response Program (MMHSRP) system is a
centralized database that is accessible via a restricted web connection that collects and disseminates
reference (Level A) data (i.e., genus, species, common name, etc.) on stranded marine mammals and
tracks the animal's rehabilitation disposition when deemed non- releasable. The system is for the purpose
of scientific research. Users are federal agencies, their non-federal partners, private organizations (i.e.,
aquariums), researchers, and educational institutions. PII/BII is not collected.
FWS - The NMFS Federal Web Service (FWS) is a public facing responsive web service implemented
with a Drupal 8 instance provisioned on an Acquia Drupal PaaS multi-tier medium environment fronted
by Akamai Kona Site Defender web application firewall (WAF) and Akamai Content Delivery Network
edge caching services. This consolidation improves information architecture, web content, and search
functions, as well as providing a responsive design to accommodate increasing number of customers
using mobile devices. PII/BII is not collected.
NATS – The NMFS Agreement Tracking System (NATS) was created to reduce the time and effort
required to approve agreements by NMFS Financial Management Centers (FMCs) and Budget
Execution Division (BEX) personnel. Additionally, NATS will reduce the number of physical folders
and paperwork that need to be printed for routing and approval. The NATS does not store
SSN/Employee Identification Numbers (EIN), financial account type data in any variables. This
information is not collected in attached documents. This application collects BII.
GSDS - The primary purpose of the NMFS Global Seafood Data System (GSDS) is to fulfill
congressional directives to curtail the U.S. import and consumption of fisheries products that are a
product of Illegal, Unreported, and Unregulated (IUU) fishing. Information derived from this system will
be used to direct NMFS personnel in the monitoring, management, and enforcement of fisheries imports.
The Seafood Import Monitoring Program (SIMP), will be the first of four NMFS trade monitoring
programs that GSDS will focus on.
GSDS will utilize data analytics, machine learning, and artificial intelligence to process fisheries trade
data from various sources to structure data and create reports. This information will be utilized to
establish a more comprehensive approach to counter the flow of IUU fishing products into the U.S. It
will help NMFS to establish management measures, within the scope of other U.S. fisheries trade
management roles, to provide a well-informed awareness and understanding in support of the initiative to
assure legitimate trade and combat IUU fishing.
ITDS - ST6 International Trade Data System (ITDS) is used to support a number of NMFS
offices/programs to monitor imports of fisheries products. Types of BII data collected are name of
business, address, contact information, and product information. The data is collected by CBP and
provided to NMFS via Secure File Transfer Protocol (SFTP) for inclusion in the ITDS database. The
ITDS serves two primary purposes:

Version Number: 01-2021

(1) The ITDS is an inter-agency distributed system that allows businesses to submit trade data to a single
agency (CBP). CBP then makes these data available to participating ITDS agencies via secure system
integration.

(2) The NMFS component of the ITDS is an import monitoring system designed to improve the
efficiency and accuracy of NMFS trade monitoring programs by utilizing the data and services
provided by CBP via the national ITDS architecture. NMFS trade monitoring programs supported by
the NMFS ITDS include the Antarctic Marine Living Resources (AMLR) program, the Highly
Migratory Species (HMS) program, the SIMP, and the Tuna Tracking Verification Program (TTVP).
The NMFS ITDS is also integrated with the NMFS NPS to provide international trade permit data to
NMFS trade monitoring programs and to CBP.
MRIP - The Marine Recreational Information Program (MRIP) Extract, Transform, and Load (ETL)
system is a tool to collect and process recreational saltwater fishing license and registration data from the
Atlantic and Gulf of America coastal states. This data is entered in the National Saltwater Angler
Registry (NSAR). Types of PII collected include fishing license information, name, address, driver’s
license number, phone, email, and date of birth (DOB). Only federal employees and contractors have
access to NSAR PII. Requests can be made to access PII for research outreach purposes. A dedicated
point of contact (POC) has been designated to review these requests and audit control has been
implemented.
NSAR – The NSAR system serves as a consolidated phone book of the nation’s recreational saltwater
anglers. NSAR data is used to furnish frames for the MRIP surveys. Types of PII collected include
fishing license information, name, address, driver’s license number, phone, email, and date of birth.
Only federal employees and contractors have access to NSAR PII. Requests can be made to access PII,
for research outreach purposes. A dedicated POC has been designated to review these requests and audit
control has been implemented.
NFCSS - The NOAA Fisheries Committee on Scientific Stature (NFCSS) is a national-level
Performance Management Advisory Committee (PMAC) established to review the contributions, impact,
and stature of NOAA Fisheries pay band IV and V non-supervisory research scientists. The NFCSS
evaluates scientists whose primary responsibility is to conduct research and develop scientific products
for resource management advice, other scientific advice, publications, and reports that represent new or
more comprehensive understanding of a subject. The NFCSS members are pay band V scientists who are
subject matter experts from the regional science centers appointed to three-year terms by the respective
regional Science Director. There is a website and database to manage and record the results of NFCSS
member reviews conducted for the purpose of evaluating a scientist's credentials and contributions to
allow them to be assigned to a higher pay band without being a supervisor and to produce a standard
report for the committee chair (Office of Science and Technology (OST) Science Director). In 2014,
OST upgraded the NFCSS website and database to enable password protected, role-based secure storage
and retrieval of review package documents.
Access to the database is restricted to the OST Science Director, the six regional Deputy Science
Directors, one pay band V research scientist from each regional science center, the NOAA Fisheries

Version Number: 01-2021
Human Resources (HR) Business Partner, and the NFCSS database administrator and is provided by the
NFCSS database administrator only at the request of the NFCSS Chair. Information collected include
name, work contact information, letters of reference and curricula vitae, performance plans, science
director memoranda, and name of immediate supervisor. The administrator uploads copies of a
memorandum from the NFCSS Chair to the Science Center Director of staff being reviewed. The data
(name, email, documents) for staff being reviewed are entered by their Deputy Science Director. The
review comments are entered by the NFCSS members.
National Inventory of Marine Mammals (NIMM) System - The NIMM system maintains current
and past data (it replaced previous inventory databases maintained by NMFS since the 1970s) on
marine mammals under NMFS’ jurisdiction (dolphins, porpoises, whales, seals, and sea lions) held in
permanent captivity for public display. In addition, NIMM includes information on marine mammals
held in permanent captivity for scientific research, enhancement, and national defense purposes. NIMM
includes beached/stranded marine mammals only if they have been deemed non-releasable and cannot
be returned to the wild. NIMM allows marine mammal owners and facilities to enter inventory data
directly into the online system. NIMM will eventually provide the public with real-time access to the
national inventory. Types of BII collected include institution name, address, email, phone, and fax.
NOAA Emergency Contact List - The Emergency Contact List (ECL) stores contact information for
OST staff and staff emergency contacts to be used in case of emergency. This is PII data. Branch Chiefs
have access to all OST employee information. Individuals only have access to their own emergency
contact information.
HawkEye 360 (HE360) Collection – Radio Frequency (RF) geo-location data buoy to be
delivered/stored and shared with USCG.

(h) The specific programmatic authorities (statutes or Executive Orders) for collecting, maintaining, using,
and disseminating the information

*Refer to the table at the end of this PIA for programmatic authorities and additional details.

(i) The Federal Information Processing Standards (FIPS) 199 security impact category for the system
NOAA4000 has a high watermark of Moderate with a Moderate Confidentiality; Moderate Integrity; and
Moderate Availability rating.

Version Number: 01-2021

Section 1: Status of the Information System
1.1

Indicate whether the information system is a new or existing system.
This is a new information system.

X
This is an existing information system with changes that create new privacy risks.
(Check all that apply.)
Changes That Create New Privacy Risks (CTCNPR)
a. Conversions
d. Significant Merging
Anonymous to Non- Anonymous
e. New Public Access
Significant System Management
f. Commercial Sources
Changes
j. Other changes that create new privacy risks (specify):

g. New Interagency Uses
Internal Flow or
Collection
Alteration in Character of
Data

Interconnection with DOJ removed as this interconnection was disconnected prior to 2021, but never
removed from CSAM or the PIA.
An interconnection with the Department of Homeland Security (DHS) Homeland Security
Investigations (HIS) was added to NOAA4000 via interconnection security agreement (ISA). This

interconnection security agreement addresses the interconnection between DHS HSI and
NOAA VMS by way of the Homeland Security Enterprise Network (HSEN) internet
infrastructure to the Windward Intelligence System (WIS). The connection is established
through a secure hypertext transfer protocol secure (HTTPS) connection and facilitates the
secure transfer of vessel monitoring data. Additionally, the ISA covers application and/or
control data traversing the networks. This is a one-way connection through DBLink (an Oracle
product used in the connection). The interconnection between the two systems is for the
express purpose of exchanging vessel monitoring data between the NOAA VMS owned by
NOAA to HSI via WIS owned by Windward, Inc.

_ This is an existing information system in which changes do not create new privacy risks,
and there is not a SAOP approved Privacy Impact Assessment.
_ This is an existing information system in which changes do not create new privacy risks,
and there is a SAOP approved Privacy Impact Assessment.
Section 2: Information in the System

2.1

Indicate what personally identifiable information (PII)/business identifiable information (BII) is
collected, maintained, or disseminated. (Check all that apply.)
Identifying Numbers (IN)

Version Number: 01-2021
a. Social Security*
X f. Driver’s License
b. Taxpayer ID
X g. Passport
c. Employer ID
X h. Alien Registration
d. Employee ID
X i. Credit Card
e. File/Case ID
X
n. Other identifying numbers (specify): Vessel Identifier

X
X

j. Financial Account
k. Financial Transaction
l. Vehicle Identifier
m. Medical Record

X
X
X

*Explanation for the business need to collect, maintain, or disseminate the Social Security number,
including truncated form:
භ NPS – A TIN is required on all permit applications other than research or exempted fishing
permits, under the authority of 31 U.S.C. 7701 for purposes of administering the various
NMFS fisheries permit and registration programs. A person shall be considered to be doing
business with a Federal agency including, but not limited to, if the person is an applicant for, or
recipient of, a federal license, permit, right-of way, grant, or benefit payment administered by
the agency or insurance administered by the agency pursuant to subsection (c) (2) (B) of this
statute.
භ

SISP/FishFinS – An SSN is used for verification of financial information to determine
qualifications for Fisheries Loans, CCF accounts and other projects.

භ

NATS – Budget and business information, which may include a TIN or SSN, is needed to
approve an agreement package.

General Personal Data (GPD)
a. Name
X h. Date of Birth
b. Maiden Name
X i. Place of Birth
c. Alias
X j. Home Address
d. Sex
X k. Telephone Number
e. Age
X l. Email Address
f. Race/Ethnicity
X m. Education
g. Citizenship
X n. Religion
u. Other general personal data (specify):

Work-Related Data (WRD)
a. Occupation
X
b. Job Title
X

e. Work Email Address
f. Salary

c.

g. Work History

Work Address

Work Telephone Number

X

X Employment Performance
Ratings or other
Performance Information

X
X
X
X
X
X

o. Financial Information
p. Medical Information
q. Military Service
r. Criminal Record
s. Marital Status
t. Mother’s Maiden Name

i. Business Associates
Proprietary or Business
Information
Procurement/
contracting
X
records
X
X
X

X
X
X
X

X
X

Version Number: 01-2021
l.

Other work-related data (specify):

Approved fishing licenses, type of fishing fear being used, vessel location (VMS, NEIS); file/case ID
and information on the catch (NEIS); and sworn witness accounts (NEIS).
Fisheries Committee on Scientific Stature:
Performance Plan Supervisor Justification
Science Director Memoranda Letters of Reference Curriculum Vitae (CV)
Position Description

Distinguishing Features/Biometrics (DFB)
a. Fingerprints
f. Scars, Marks, Tattoos
b. Palm Prints
g. Hair Color
c. Voice/Audio Recording
X h. Eye Color
d. Video Recording
X i. Height
e. Photographs
X j. Weight
p. Other distinguishing features/biometrics (specify):
System Administration/Audit Data (SAAD)
a. User ID
X c. Date/Time of Access
b. IP Address
X d. Queries Run
g. Other system administration/audit data (specify):

X

k. Signatures
l. Vascular Scans
m. DNA Sample or Profile
n. Retina/Iris Scans
o. Dental Profile

X

X
X

e. ID Files Accessed
f. Contents of Files

X
X

Other Information (specify)
SISP – Products produced and seafood inspection data
NEIS / GCLD – Case files, Seized Property
NPS – quota share balance, quota pound balance, quota pound limits, listings of endorsements
and designations (i.e., gear endorsement, size endorsement, sector endorsement, permit tier)
associated with the permit
Exemptions (i.e., Owner on Board – Grandfathered Exemption, Owner on Board, as stated code
of federal regulations) and exemption status, contact persons, Business Operation Information
(Business Processes, Procedures, Physical Maps).
UAS is used by law enforcement for area safety surveillance, detection, and avoidance while
inspecting and marking remote crime scene areas and for crime scene reporting. Use will follow
the NOAA Unmanned Aircraft Systems policy in regards to PII and BII collection.

2.2

Indicate sources of the PII/BII in the system. (Check all that apply.)
Directly from Individual about Whom the Information Pertains
In Person
X Hard Copy: Mail/Fax
X
Telephone
X Email
X

Online

X

Version Number: 01-2021
Other (specify):
Government Sources
Within the Bureau
State, Local, Tribal
Other (specify):

X
X

Other DOC Bureaus
Foreign

Non-government Sources
Public Organizations
X Private Sector
Third Party Website or Application

X

Other Federal Agencies

X

X
X

Commercial Data Brokers

X

OpenFox – A SaaS that is run by contractor CPI in support of
Criminal Justice Information Services (CJIS)
Other (specify):

2.3

Describe how the accuracy of the information in the system is ensured.

Most data is captured electronically through website page visits. Processes in the System Development
Life Cycle (SDLC) ensure there are data integrity checks to ensure valid data is entered into the system.
Database constraints include Primary and Foreign Keys, Referential Integrity Constraints, and Check
Constraints.
In-person information provided to NMFS OLE is sworn testimony corroborated by observation and other
evidence.
NOAA4000 utilizes enterprise-wide services to aid in security monitoring, vulnerability scanning, and
secure baseline management. The system also uses a NOAA enterprise service application for audit log
management.
The web applications used to collect information contain various front-end and back-end validations to
check for accuracy. Data that are not collected directly from the subject of the investigation are run
through various quality control procedures, including format and content validation and standardization.
In some cases, data are reconciled against other data sets to check for data errors or updates.
In addition, various controls are in place to ensure that only those who are authorized and have a need to
modify the data are able to so.
The general controls used to protect the PII involve controlled physical and logical access, role-based
access control, proper data segmentation, protection via encryption at rest, and proper audit logging of
events. Adequate media marking, transport, storage, incident monitoring, and response are also used.
The levels of implementation for these technologies meet the criteria required by NIST 800-53, Rev 5
under the following controls: Access Enforcement (AC-3), Separation of Duties (AC-5), Least Privilege
(AC-6), Remote Access (AC-17), User-Based Collaboration and Information Sharing (AC- 21),
Auditable Events (AU-2), Audit Review, Analysis, and Reporting (AU-6), Identification and
Authentication (Organizational Users) (IA-2), Media Access (MP-2), Media Marking (MP-3), Media
Storage (MP-4), Media Transport (MP-5), Media Sanitization (MP-6), Transmission Confidentiality
(SC-9), Protection of Information at Rest (SC-28), Information System Monitoring (SI-4).
In addition to following database Center for Internet Security (CIS) benchmarks and best practices, all

Version Number: 01-2021
Oracle tables that contain PII/BII data are stored in an encrypted table space.

2.4 Is the information covered by the Paperwork Reduction Act?

X

Yes, the information is covered by the Paperwork Reduction Act.
Provide the OMB control number and the agency number for the collection.
Ɣ 0648-0012, FFP Loans
Ɣ 0648-0018, Processed Products Family of Forms
Ɣ 0648-0040, Highly Migratory Species Dealer Reporting Family of Forms
Ɣ 0648-0041, Capital Construction Fund Agreement, Certificate Family of Forms, and
Deposit/withdrawal Report
Ɣ 0648-0082, Fishermen’s Contingency Fund
Ɣ 0648-0178, Marine Mammal Health and Stranding Response Program
Ɣ 0648-0192, Statement of Financial Interests, Regional Fishery Management Councils
Ɣ 0648-0204, West Coast Permit Family of Forms
Ɣ 0648-0230, Permits for Incidental Taking of Endangered or Threatened Species
Ɣ 0648-0266, Seafood Inspection and Certification Requirements
Ɣ 0648-0283, NOAA's Teacher at Sea Program
Ɣ 0648-0292, Reporting Requirements for Commercial Fisheries Authorization under
Section 118 of the Marine Mammal Protection Act
Ɣ 0648-0293, Application for Commercial Fisheries Authorization under Section 118 of the
Marine Mammal Protection Act (MMPA)
Ɣ 0648-0335, Fisheries Certificate of Origin
Ɣ 0648-0376, Buybacks - and includes all fee collection reports
Ɣ 0648-0380, Large Pelagic Fishing Survey
Ɣ 0648-0468, Protocol for Access to Tissue Specimen Samples from the National Marine
Mammal Tissue Bank
Ɣ 0648-0471, Highly Migratory Species (HMS) Scientific Research Permits, Exempted
Fishing Permits, Letters of Acknowledgement, Display Permits, and Shark Research
Fishery Permits
Ɣ 0648-0544, Southeast Region VMS and related requirements
Ɣ 0648-0573, Expanded VMS Requirement for Pacific Groundfish Fishery
Ɣ 0648-0578, National Saltwater Angler Registry and State Exemption Program
Ɣ 0648-0593, Observer Programs’ Information That Can Be Gathered Only Through
Questions
Ɣ 0648-0651, Fishery Products Subject to Trade Restrictions Pursuant to Certification Under
the High Seas Driftnet Fishing (HSDF) moratorium Protection Act
Ɣ 0648-0652, Marine Recreational Information Program (MRIP) Fishing Effort Survey
Ɣ 0648-0659, Marine Recreational Information Program Access-Point Angler Intercept
Survey
Ɣ 0648-0693, Marine Recreational Fishing Expenditure Survey (MRFE)
Ɣ 0648-0709, For Hire Telephone Survey
Ɣ 0648-0732, NMFS Implementation of International Trade Data System
Ɣ 0648-0789, Type-Approval Requirements for Vessel Monitoring Systems (VMS)
Ɣ 0648-XXXX, Generic Clearance for Marine Recreational Information Program: Design &
Field Test Studies (new collection awaiting OMB approval)
No, the information is not covered by the Paperwork Reduction Act.

Version Number: 01-2021

2.5

Indicate the technologies used that contain PII/BII in ways that have not been previously deployed.
(Check all that apply.)
Technologies Used Containing PII/BII Not Previously Deployed (TUCPBNPD)
Smart Cards
Biometrics
Caller-ID
Personal Identity Verification (PIV) Cards
Other (specify):

X

There are not any technologies used that contain PII/BII in ways that have not been previously
deployed.

Section 3: System Supported Activities
3.1

Indicate IT system supported activities which raise privacy risks/concerns. (Check all that apply.)
Activities
Audio recordings
Building entry readers
Video surveillance
X* Electronic purchase transactions
Other (specify):
* UAS is used by law enforcement for area safety surveillance, detection, and avoidance while
inspecting and marking remote crime scene areas and crime scene reporting. Use will follow the NOAA
UAS policy in regard to PII and BII collection.
HE360 RF geo-location data is collected.
There are not any IT system supported activities which raise privacy risks/concerns.

Section 4: Purpose of the System
4.1
Indicate why the PII/BII in the IT system is being collected, maintained, or disseminated.
(Check all that apply.)
Purpose
For a Computer Matching Program
For administrative matters
For litigation
For civil enforcement activities
To improve Federal services online
For web measurement and customization
technologies (single- session)

X
X
X
X
X

For administering human resources programs

X

To promote information sharing initiatives
For criminal law enforcement activities
For intelligence activities
For employee or customer satisfaction
For web measurement and customization
technologies (multi- session)

X
X
X
X

Version Number: 01-2021
Other (specify):
UAS is used by law enforcement for apex predator surveillance, detection, and avoidance for officer safety
while inspecting, locating, and marking crime scene areas and for creating crime scene reports.
Information is used to maintain databases for tracking international seafood trading tracking and angler
registration, for use in reviewing scientists’ research products, and for maintaining a Protected Resources
marine mammal inventory.

Section 5: Use of the Information
5.1

In the context of functional areas (business processes, missions, operations, etc.) supported by the
IT system, describe how the PII/BII that is collected, maintained, or disseminated will be used.
Indicate if the PII/BII identified in Section 2.1 of this document is in reference to a federal
employee/contractor, member of the public, foreign national, visitor or other (specify).

SISP is used to track seafood inspection activities and scheduling and to generate invoices for payment.
The data collected refers to members of the public. Payments are made through Pay.gov. No credit card
information is collected.
VMS helps to ensure individual vessel compliance with regional and federal fishing regulations through
transmitted position reports at given intervals. The data is heavily used by fishery managers, as well.
Vessel tracks, locations, and densities can be analyzed to indicate vessel location as well as trends and
patterns of activity. VMS data is also used by the USCG, coastal states’ marine enforcement offices, the
Navy, ICR, NMFS science centers, and NMFS fishery managers. VMS data is also used to enforce other
federal laws and international treaties related to the prevention of overfishing: The High Seas Fishing
Compliance Act, the American Fisheries Act (AFA), the Atlantic Coastal Fisheries Cooperative
Management Act, the Atlantic Tunas Convention Authorization Act, the Northern Pacific Halibut Act
and the AMLRCA. The data collected refers to members of the public.
NEIS information is used to (1) detect instances in which the U.S. fisheries laws as well as other U.S.
laws have been violated; and (2) develop case files that support fining and/or prosecuting these violators.
The case files support the collection of fines and/or the prosecution of these cases. The data collected
refers to members of the public.
NRDA information is used to manage information collected about restoration projects in response to
incidents and to receive information from and share information with the interested public. The data
collected refer to members of the public.
RCDB information is used to manage information related to fisheries habitat restoration projects
implemented by the NOAA Restoration Center. The data collected refers to members of the public.
eAOP provides NMFS managers and employees with the ability to plan, monitor, and report on agency
programmatic performance. This includes the planning and reporting of milestones and performance
measures. Information included contains PII for some employees and contractors (names and phone
numbers only) who are contacts for the milestones and performance measures. This information is used
internally, as needed, to answer questions relating to progress on the milestones or performance
measures.

Version Number: 01-2021
MMHSRP provides the ability to track any mammals that die or are killed that come to shore (strand).
The data is for scientific research and does not contain PII.
GCLD assists NOAA’s legal counsel, manages and responds to various inquiries on NMFS/NOAA
litigation from Congress, the White House, Fisheries councils, and government agencies. Information
includes names and phone numbers of legal counsel involved in a given case, which is public data.
Other data entered into the database is public information regarding litigation involving NOAA.
NPS is used by NMFS to identify owners and holders of permits and non-permit registrations and vessel
owners and operators for both civil and criminal enforcement activities, evaluate permit applications, and
document agency actions relating to the issuance, renewal, transfer, revocation, suspension, or
modification of a permit or registration. NMFS may use lists of permit holders or registrants as sample
frames for the conduct of surveys to collect information necessary to the administration of the applicable
statutes. NMFS may post non-sensitive permit holders, vessel-related, and/or individual fishing quota
(IFQ) information for the public, via web sites and web services, per notice given on permit applications.
This information is considered part of the public domain. TINs allow positive identification for cost
recovery billing of IFQ holders. In addition, as stated in SORNs NOAA-12 and NOAA-19 routine uses,
a TIN is required on all permit applications other than research or exempted fishing permits, under the
authority 31 U.S.C. 7701 in order to administer the various NMFS fisheries permit and registration
programs. All PII/BII are in reference to members of the public.
ECO is used to document and track consultation status ECO collects project lead’s name and phone.
FISHFINS collects loan application information from members of the public in order to assess and
monitor the loan applicant’s financial condition.
FWS is a public facing collection of NMFS websites.
UAS - PII/BII collected, maintained or disseminated will be used for civil enforcement investigations,
criminal enforcement investigation, and intelligence to identify persons, fishing activity, vessels,
vehicles, and fishing gear. For example, vessel or vehicle identifiers will be used to show the name of the
vessel and the activity the vessel is conducting for compliance or, if a violation is detected, for an
administrative court or a court of law.
NATS - NATS has been created to reduce the time and effort required to approve agreements by NMFS
FMCs and BEX personnel. Additionally, NATS intends to reduce the number of physical folders and
paperwork that need to be printed for routing and approval. This application collects BII.
ECL stores store contact information for OST staff to be used in case of emergency. PII collected
includes name, relationship, address, and phone. This information is collected from employees and
contractors.
ITDS is used to support a number of NMFS offices/programs to monitor imports of fisheries products.
Types of BII data collected include name of business, address, contact information, and product
information. The data is collected from CBP.
MRIP ETL is a tool to collect and process recreational saltwater fishing license and registration data
from Atlantic and Gulf of America coastal states for inclusion in the NSAR. Types of PII collected
include fishing license information, name, address, driver’s license number, phone, email, and date of
birth of the angler. The MRIP ETL collects data from the NSAR, below.

Version Number: 01-2021
NSAR serves as a consolidated phone book of the nation’s recreational saltwater anglers. NSAR data is
used to furnish frames for the MRIP surveys. Types of PII collected include fishing license information,
name, address, driver’s license number, phone, email, and date of birth. The NSAR is only applicable to
anglers ages 16 and older. The date of birth is used for validation of this requirement.
NFCSS is a national-level PMAC established to review the contributions, impact and stature of NOAA
Fisheries pay band IV and V non-supervisory research scientists. The NFCSS evaluates scientists whose
primary responsibility is to conduct research and develop scientific products for resource management
advice, other scientific advice, publications, and reports that represent new or more comprehensive
understanding of a subject. The NFCSS members are pay band V scientists who are subject matter
experts from the regional science centers appointed to three-year terms by the respective regional
Science Director. There is a website and database to manage and record the results of NFCSS member
reviews conducted for the purpose of evaluating a scientist's credentials and contributions to allow them
to be assigned to a higher pay band without being a supervisor and to produce a standard report for the
committee chair (OST Science Director). Access to the database is restricted to the OST Science
Director, the six regional Deputy Science Directors, one pay band V research scientist from each
regional science center, the NOAA Fisheries HR Business Partner, and the NFCSS database
administrator and is provided by the NFCSS database administrator only at the request of the NFCSS
Chair. Information collected is name, work contact information, letters of reference and CV,
performance plan, science director memoranda, and name of immediate supervisor. The administrator
uploads copies of a memorandum from the NFCSS Chair to the Science Center director of staff being
reviewed. The data (name, email, documents) for staff being reviewed are entered by their Deputy
Science Director. The review comments are entered by the NFCSS members.
NIMM System maintains current and past data on marine mammals under NMFS’ jurisdiction
(dolphins, porpoises, whales, seals, and sea lions) held in permanent captivity for public display. In
addition, NIMM includes information on marine mammals held in permanent captivity for scientific
research, enhancement, and national defense purposes. NIMM includes beached/stranded marine
mammals only if they have been deemed non-releasable and cannot be returned to the wild. NIMM
allows marine mammal owners and facilities to enter inventory data directly into the online system.
NIMM will eventually provide the public with real-time access to the national inventory. Types of BII
collected include institution name, address, email, phone, and fax.
HawkEye 360 Collection –RF geo-location data is a repository.

5.2

Describe any potential threats to privacy, such as insider threat, as a result of the
bureau’s/operating unit’s use of the information, and controls that the bureau/operating unit has
put into place to ensure that the information is handled, retained, and disposed appropriately. (For
example: mandatory training for system users regarding appropriate handling of information,
automatic purging of information in accordance with the retention schedule, etc.)

There is mandatory security awareness training for all system users. All data is encrypted and rolebased access control to data is restricted to authorized, authenticated, users. Potential threats include
insider threat and an increased threat of attack considering the law enforcement material stored on the
system. Controls for protection include the standard 2FA log in, VPN access for Clearwell, and
statutory protections for MSA data.
NOAA4000 utilizes enterprise-wide services to aid in security monitoring, vulnerability scanning,

Version Number: 01-2021
and secure baseline management. The system also uses a NOAA enterprise service application for
audit log management.
Dissemination of PII/BII is subject to controls in place to restrict access to only those who need access
to the data. Everyone who has access to the data must provide signed copies of the NOAA
Administrative Order (NAO) 216-100 Data Confidentiality form, including the Statement of
Nondisclosure. If the data is to be shared with an external organization (e.g., contracting company or
university) then a representative of the external organization must complete the Agreement of Access
form (Appendix D to NAO 216-100) and each representative of the external organization who will be
accessing the data will have to provide a signed Certificate (final attachment to NAO 216-100).
There are also various controls in place to ensure that only those who are authorized and have a need to
modify the data are able to so.
The general controls used to protect the PII involve controlled physical and logical access, role-based
access control, proper data segmentation and protection via encryption at rest, and proper audit logging
of events. Adequate media marking, transport and storage, and incident monitoring and response are
also used.
The levels of implementation for these technologies meet the criteria required by NIST 800-53, Rev 5
under the following controls: Access Enforcement (AC-3), Separation of Duties (AC-5), Least Privilege
(AC-6), Remote Access (AC-17), User-Based Collaboration and Information Sharing (AC-21),
Auditable Events (AU-2), Audit Review, Analysis, and Reporting (AU-6), Identification and
Authentication (Organizational Users) (IA-2), Media Access (MP-2), Media Marking (MP-3), Media
Storage (MP-4), Media Transport (MP-5), Media Sanitization (MP-6), Transmission Confidentiality
(SC-9), Protection of Information at Rest (SC-28), Information System Monitoring (SI-4).
In addition to following database CIS benchmarks and best practices, all Oracle tables that contain
PII/BII data are stored in an encrypted tablespace.

Section 6: Information Sharing and Access

6.1

Indicate with whom the bureau intends to share the PII/BII in the IT system and how the PII/BII
will be shared. (Check all that apply.)
Recipient

How Information will be Shared
Case-by-Case
Bulk Transfer
X
X
X
X*
X
X
X
X**
X

Direct Access
X
X
X*

Within the bureau
DOC bureaus
Federal agencies
State, local, tribal gov’t agencies
Public
X
Private sector
X
Foreign governments
Foreign entities
Other (specify): FOIA Online
X
* USCG, CBP, and other agencies described in the Introduction have Information Sharing
Agreements (ISAs) in place.
** SISP information (email addresses, mailing addresses, and users’ names) is shared for invoicing

Version Number: 01-2021
and billing purposes. Only account holders have access to their TINs.
භ
භ
භ

NPS: non-sensitive information may be posted on public web sites.
NEIS information will be shared with law enforcement.
FishFinS: Credit, Financial, and Tax information.
The PII/BII in the system will not be shared.

6.2

Does the DOC bureau/operating unit place a limitation on re-dissemination of PII/BII shared with
external agencies/entities?
X

6.3

Yes, the external agency/entity is required to verify with the DOC bureau/operating unit before
re- dissemination of PII/BII.
No, the external agency/entity is not required to verify with the DOC bureau/operating unit before
re- dissemination of PII/BII.
No, the bureau/operating unit does not share PII/BII with external agencies/entities.

Indicate whether the IT system connects with or receives information from any other IT systems
authorized to process PII and/or BII.

Version Number: 01-2021
X

Yes, this IT system connects with or receives information from another IT system(s) authorized to
process PII and/or BII.
Provide the name of the IT system and describe the technical controls which prevent PII/BII
leakage:
i)
ii)
iii)
iv)
v)
vi)
vii)

U.S. Coast Guard
Pacific States Marine Fisheries Commission
U.S. Custom and Border Protection
Atlantic Coastal Fisheries Information Network (ACFIN)
1901 NSOC
Department of Homeland Security (DHS)
Other NOAA Systems:
a. NOAA0100 (NCSC)
b. NOAA0550 (NWAVE)
c. NOAA1101 (ITC)
d. NOAA4011 (NFPLRS)
e. NOAA4100 (GARFO)
f. NOAA4200 (NEFSC)
g. NOAA4300 (SERO)
h. NOAA4400 (SEFSC)
i. NOAA4500 (WCR)
j. NOAA4600 (NWFSC)
k. NOAA4700 (AKRO)
l. NOAA4800 (AKFSC)
m. NOAA4920 (PIRO)
n. NOAA4930 (SWFSC)
o. NOAA4960 (PIFSC)

The interconnections between NOAA4000/VMS and the entities listed above is established
through encrypted interfaces (VPN). The connections on each end are located within controlled
access facilities, guarded 24 hours a day. Authentication methods are in place to validate
authorized users. Virus and malicious code prevention is employed to protect the integrity of the
software and the data.
No, this IT system does not connect with or receive information from another IT system(s)
authorized to process PII and/or BII.

6.4

Identify the class of users who will have access to the IT system and the PII/BII. (Check all that
apply.)
Class of Users
General Public
X* Government Employees
X
Contractors
X
Other (specify):
* Individuals have access to their own sensitive PII when they log into applications; however, they only
have access to non-sensitive public data otherwise. The public also has access to NIMM.

Section 7: Notice and Consent

Version Number: 01-2021

7.1

Indicate whether individuals will be notified if their PII/BII is collected, maintained, or
disseminated by the system. (Check all that apply.)
X Yes, notice is provided pursuant to a system of records notice published in the Federal Register
and discussed in Section 9.
X Yes, notice is provided by a Privacy Act statement and/or privacy policy. The Privacy Act
statement and/or privacy policy can be found at:
https://www.fisheries.noaa.gov/privacy-policy (SISP; eAOP; NPS; ECO; NATS; NSAR)
https://fisheriespermits.noaa.gov/npspub/pub_cmn_login/index_live.jsp (NPS) (see attached)
https://www.noaa.gov/protecting-your-privacy (NRDA, RCDB; GCLD)
https://www.noaa.gov/sites/default/files/legacy/docume04/nt/2021/Mar/Signed_UAS_PrivacyP
olicy.pdf (UAS)

X Yes, notice is provided by other
means.

Specify how:
VMS: Notice is provided in a user nondisclosure
agreement. For any BII release, the affected fishermen
would be notified via email.
NEIS: Notification is provided face to face by OLE
officers. Users have NDAs.
FISHFINS: The FFP loan application contains the privacy
statement.

X No, notice is not provided.

The ECL has a Privacy Act Statement (PAS): This
information collection is voluntary. The purpose is to
maintain an emergency contact list. The personally
identifiable information will not be shared outside the
OST.
Specify why not:
The UAS is an actual drone that is operated remotely
capturing images of location under surveillance.
Therefore, no notice is provided to the individuals.
ITDS: ITDS does not provide any notice because ITDS
does not collect data from individuals and therefore there
is no way to provide notice. Any notice would be provided
when the data is collected by the CBP.
RF geo-location receives vessel radio frequency signals
and does not collect information from individuals.

Version Number: 01-2021

7.2

Indicate whether and how individuals have an opportunity to decline to provide PII/BII.
X

Yes, individuals have an opportunity Specify how:
to decline to provide PII/BII.
SISP: The requestor may decline, face-to-face or in
writing, to provide information to the application owner
but then would not receive the service/user account/be in
compliance.
VMS: The requestor may decline, face-to-face or in
writing, to provide information in the account request
form but then would not receive the service/user
account/be in compliance.
NRDA: The requestor may decline, face-to-face or in
writing, to provide information to the application owner
but then would not receive the service/user account/be in
compliance.
RCDB: The requestor may decline, face to face or in
writing, to provide information to the application owner
but would not then receive the service/user account/be in
compliance.
NPS: The personal information is collected when the
individual completes the appropriate application. On the
application, the individual is advised that NMFS will not
be able to issue a permit if the individual does not
provide each item of information requested. The
individual may choose to decline to provide the required
personal information at that time, but will not be able to
receive a permit.
eAOP: Managers’ contact information is part of the
program information. However, if any individual objects
to their information being posted, it will be removed
upon written or verbal request.
NEIS: An individual may decline to provide voluntary
information in the course of an investigation.
ECO: The project lead may decline, face-to-face or in
writing, to provide information to the application owner
but then would not receive the service/user account.
FISHFINS: The loan applicant may decline, face-to-face
or in writing, to provide information but would not then
receive the service/user account/be in compliance.
ECL: Employees and contractors may decline to provide
contact information to their supervisors in writing, but

Version Number: 01-2021
then they may not be notified in case of emergencies.
NIMM: An individual can decline to be the responsible
official or the primary contact.
NSAR: The individual will not register if he wishes to
decline.

X

No, individuals do not have an
opportunity to decline to provide
PII/BII.

Specify why not:
The UAS is an actual drone that is operated remotely
capturing images of location under surveillance.
Individuals do not have the opportunity to decline to
provide PII.
NEIS: Individuals do not have the opportunity to decline
to provide information collected through surveillance,
pursuant to a warrant, court order, or other investigatory
actions where consent is not possible within the constraints
of properly investigating potential violations of Fisheries
laws and regulations.
ITDS: ITDS does not provide an opportunity to decline
because ITDS does not collect data from individuals and
therefore there is no way to provide the opportunity to
decline. Any opportunity to decline would be provided
when the data is collected by the CBP.
MRIP ETL: No data collected directly by the system.
RF geo-location receives vessel radio frequency signals
and does not collect information from individuals.

7.3

Indicate whether and how individuals have an opportunity to consent to particular uses of their
PII/BII.

Version Number: 01-2021
X

Yes, individuals have an opportunity Specify how:
to consent to particular uses of their
There is only one purpose for each information
PII/BII.
collection. Those who provide information via web pages
have a link to the NOAA Privacy Policy, which states
that provision of the information implies consent to the
stated use(s). For provision of information in person, the
purpose of the information is stated by the NOAA staff
person.
NPS: The individual consents by completion of the
application. On the application, the individual is advised
that NMFS will not be able to issue a permit if the
individual does not provide each item of information
requested. The individual may choose to decline to
provide the required personal information at that time,
but will not be able to receive a permit.
FISHFINS: Consent for the specified use is implied by
completing and signing the loan application.
SISP: The requestor has the opportunity to consent to
specific uses of their PII/BII either face-to-face or in
writing. However, failure to consent to all uses could
negatively impact their ability to obtain services.
VMS: There is only one use for the information collected.
By installing a VMS unit, the individual is consenting to
the use of their PII/BII to conduct business.
NRDA: There is only one use for the individual’s contact
information. By providing their contact information, the
individual is consenting to receive research updates. If
they decide they no longer want to receive these updates,
they may request that their account be deleted.
RCDB: There is only one use of the contact information.
By providing their contact information, the individual is
consenting to its use for the implementation of restoration
projects.
eAOP: There is only one use for the contact information
in this application. Staff consent to the use of the contact
information by including it in the planning documents.
NEIS: An individual may voluntarily consent to particular
uses of their PII during an investigation.
ECO: By agreeing to serve as a project lead, the individual
is consenting to the use of their PII for this one purpose.
There is no other use of this information.

Version Number: 01-2021

ECL: By providing their contact information, employees
consent to the use of this information for emergencies only.
NSAR: Anglers may choose not to register. There is no
option to register and opt out of the survey. An angler
may decline respond to the survey if contacted.

X

No, individuals do not have an
opportunity to consent to particular
uses of their PII/BII.

Specify why not: Specify why not:
The UAS is an actual drone that is operated remotely
capturing images of location under surveillance.
Therefore, no notice is provided to the individuals.
ITDS: ITDS does not provide an opportunity to consent to
particular uses because ITDS does not collect data from
individuals and therefore there is no way to provide the
opportunity to consent to particular uses. Any opportunity
to consent to particular uses would be provided when the
data is collected by the CBP.
MRIP ETL: No data collected directly by the system.
RF geo-location receives vessel radio frequency signals
and does not collect information from individuals.

7.4

Indicate whether and how individuals have an opportunity to review/update PII/BII pertaining to
them.
X

Yes, individuals have an opportunity Specify how:
to review/update PII/BII pertaining
SISP: Users establish accounts and have access to their
to them.
own profile.
VMS: Users have limited access. Only users with a need
to access the system as part of their duties and as
approved by the appropriate authorizing official may
directly access their data. Individuals with no access to
the applicable database may request to review
information and submit updates through secure means,
with the person and office who collected their
information originally.
NEIS: Users may request to review information and
submit updates through secure means, with the person
and office who collected their information originally.
NRDA: Users may request to review information and

Version Number: 01-2021
submit updates through secure means, with the person
and office who collected their information originally.
RCDB: Users may request to review information and
submit updates through secure means, with the person
and office who collected their information originally.
NPS: Information may be reviewed/updated when
completing or renewing a permit application or
supporting documents, or by calling or emailing the
applicable NMFS office at any time.
eAOP: Contact information may be reviewed and
updated at any time by contacting the Program Manager.
ECO: Users establish accounts and have access to their
own profile.
FISHFINS: Users establish accounts and have access to
their own profile.
FWS: Users establish accounts and have access to their
own profile.
UAS: Individuals can seek to update/delete their video
image via a Privacy Act amendment request.
ECL: Users may log on to the application and update the
information at any time.
NIMM: Those with NIMM user accounts have access
rights to review and update their data.

X

No, individuals do not have an
opportunity to review/update PII/BII
pertaining to them.

NSAR: Information may be updated at the time of
registration renewal.
Specify why not:
ITDS: ITDS does not provide an opportunity to
review/update information because ITDS does not collect
data from individuals and therefore there is no way to
provide the opportunity to review/update information.
Any opportunity to review/update information would be
provided by the CBP.
MRIP ETL: No data is collected directly by the system.

Section 8: Administrative and Technological Controls

Version Number: 01-2021

8.1

Indicate the administrative and technological controls for the system. (Check all that apply.)
X All users signed a confidentiality agreement or non-disclosure agreement.
X All users are subject to a Code of Conduct that includes the requirement for confidentiality.
X Staff (employees and contractors) received training on privacy and confidentiality policies and
practices.
X Access to the PII/BII is restricted to authorized personnel only.
X Access to the PII/BII is being monitored, tracked, or recorded.
Explanation: Activities of users are tracked through audit logs and monitoring.
X The information is secured in accordance with the Federal Information Security Modernization
Act (FISMA) requirements.
Provide date of most recent Assessment and Authorization (A&A): 04/14/2025
This is a new system. The A&A date will be provided when the A&A package is approved.
X The Federal Information Processing Standard (FIPS) 199 security impact category for this system
is a moderate or higher.
X NIST Special Publication (SP) 800-122 and NIST SP 800-53 Revision 4 Appendix J
recommended security controls for protecting PII/BII are in place and functioning as intended;
or have an approved Plan of Action and Milestones (POA&M).
X A security assessment report has been reviewed for the information system and it has been
determined that there are no additional privacy risks.
X Contractors that have access to the system are subject to information security provisions in their
contracts required by DOC policy.
X Contracts with customers establish DOC ownership rights over data including PII/BII.
X Acceptance of liability for exposure of PII/BII is clearly defined in agreements with customers.
X Other (specify): All employees/contractors are required to sign a confidentiality agreement for
VMS.

8.2

Provide a general description of the technologies used to protect PII/BII on the IT system.
(Include data encryption in transit and/or at rest, if applicable).
Encryption at rest - Data is encrypted (storage, laptops and backup media).
Access management control - Only users with authorization may access the data.
The activities of users are tracked through audit logs and monitoring.
Transmission - certificate used to access the web interface.
UMS files are shared via Google Drive (https:)
Any files shared with non-NOAA federal recipients are shared via Kiteworks.
The levels of implementation for these technologies meet the criteria required by NIST 800-53, Rev 5
under the following controls:
Access Enforcement
Separation of Duties
Least Privilege
Remote Access
User-Based Collaboration and Information Sharing
Auditable Events
Audit Review, Analysis, and Reporting
Identification and Authentication (Organizational Users)
Media Access
Media Marking

Version Number: 01-2021
Media Storage
Media Transport
Media Sanitization
Transmission Confidentiality
Protection of Information at Rest
Information System Monitoring

Section 9: Privacy Act
9.1

Is the PII/BII searchable by a personal identifier (e.g., name or Social Security number)?
X Yes, the PII/BII is searchable by a personal identifier.
No, the PII/BII is not searchable by a personal identifier.

9.2

Indicate whether a system of records is being created under the Privacy Act, 5 U.S.C. § 552a. (A
new system of records notice (SORN) is required if the system is not covered by an existing
SORN).
As per the Privacy Act of 1974, “the term ‘system of records’ means a group of any records under the
control of any agency from which information is retrieved by the name of the individual or by some
identifying number, symbol, or other identifying particular assigned to the individual.”

Version Number: 01-2021
X

Yes, this system is covered by an existing system of records notice (SORN). Provide the SORN
name, number, and link. (list all that apply):
NOAA-5: Fisheries Law Enforcement Case Files NOAA-6: Fishermen's Statistical Data
NOAA-11: Contact Information for Members of the Public Requesting or Providing Information
Related to NOAA's Mission
NOAA-12: Marine Mammals, Endangered and Threatened Species, Permits and Authorizations
Applicants
NOAA-14: Dr. Nancy Foster Scholarship Program; Office of Education, Educational Partnership
Program (EPP); Ernest F. Hollings Undergraduate Scholarship Program and National Marine
Fisheries Service Recruitment, Training, and Research Program
NOAA-15: Monitoring of National Marine Fisheries Service Observers
NOAA-16: Economic Data Reports forhttps://www.commerce.gov/node/4990 Alaska Federally
Regulated Fisheries off the coast of Alaska
NOAA-19: Permits and Registrations for United States Federally Regulated Fisheries NOAA-21:
Financial Services Division
NOAA-23: Economic Data Collection (EDC) Program for West Coast Groundfish Trawl Catch
Share Program off the coast of Washington, Oregon, and California
COMMERCE/DEPT-2: Accounts Receivable
COMMERCE/DEPT-5: Freedom https://www.commerce.gov/node/4965of Information Act and
Privacy Act Request Records
COMMERCE/DEPT-13: Investigative and Security Records
COMMERCE/DEPT-14: Litigation, Claims, and Administrative Proceeding Records
COMMERCE/DEPT-18: Employees Personnel Files Not Covered by Notices of Other Agencies
COMMERCE/DEPT-20: Biographical Files and Social Networks
COMMERCE/DEPT-25: Access Control and Identity Management System
COMMERCE/ DEPT-27: Investigation and Threat Management Records
COMMERCE/DEPT-29: Unmanned Aircraft Systems
COMMERCE/DEPT-31: Public Health Emergency Records of Employees, Visitors, and Other
Individuals at Department Locations.
OPM/GOVT-2: Employee Performance File System Records

X

*Refer to the table at the end of this PIA for additional details.
Yes, a SORN has been submitted to the Department for approval on:
NOAA is in the process of amending NOAA-5 to add body worn camera data as a category of record,
use of AI algorithms on video recordings of catch/bycatch, and radio-frequency data.
No, this system is not a system of records and a SORN is not applicable.

Section 10: Retention of Information

Version Number: 01-2021

10.1 Indicate whether these records are covered by an approved records control schedule and monitored
for compliance. (Check all that apply.)
X

There is an approved record control schedule. Provide the name of the record control schedule:
Chapter 100 – General, Enterprise-wide Functions
These records are official NOAA program and mission records that may be located throughout
all NMFS Offices, laboratories, divisions, branches, sections or other organizational units, and
in all NOAA regional and field offices. The records in this chapter are unique program records
in NOAA, and many of the records listed are permanently valuable such as photographs and
certain program correspondence subject files.
Chapter 200 - Administrative and Housekeeping Records
This schedule covers the most common administrative and housekeeping records that are
maintained in all levels of NOAA offices. These records include routine and facilitative
records that many or all government agencies create and maintain for day-to-day
administrative and management functions.
This includes ECLs, Budget and Finance, HR, FOIA, NDAs, eMail, and compliance reporting
records.
Chapter 300 – Employee Management Records
This schedule covers records Federal agencies create while carrying out the work of employee
management: supervising employees, processing personnel actions, managing employee
performance, and creating and maintaining personnel and volunteer service records.
NFCSS records are scheduled under 301-09, Supervisors’ Personnel Files
Chapter 1500 - Fishery and Living Marine Resource Functional Files
These records are related to fisheries and living marine resources. Specifically: 1502 Resource
Assessment, Distribution, and Classification Files
1503 Environmental Impact Analysis Files
1504 Fisheries Management and Coordination Files 1505 Regional Fisheries Development
Files
1507 Fisheries Statistics and Marketing News Reporting Files 1509 Economic Analysis Files
1510 Vessel Financial Services Files 1511 Fishery Protection and Claims Files
1512 Fishery Product Quality and Safety Inspection Files 1513 Fishery Law Enforcement and
Surveillance Files
1514 Marine Mammal and Endangered Species Protection Files
1515 Marine Recreational Fisheries Program Files
1516 Natural Resource Damage Assessment (NRDA) Post-Settlement and Administrative
Record Files
1518 Coastal Wetlands, Planning, Protection and Restoration Act File
Chapter 2403 – Information System Security Records, System Access Records

Version Number: 01-2021
No, there is not an approved record control schedule.
Provide the stage in which the project is in developing and submitting a records control schedule:
X Yes, retention is monitored for compliance to the schedule.
X No, retention is not monitored for compliance to the schedule. Provide explanation:
VMS, and NEIS records are not authorized for disposal and must be retained indefinitely.

10.2 Indicate the disposal method of the PII/BII. (Check all that apply.)
Disposal
Shredding
Degaussing
Other (specify):

X
X

Overwriting
Deleting

Section 11: NIST Special Publication 800-122 PII Confidentiality Impact Level
11.1 Indicate the potential impact that could result to the subject individuals and/or the organization if
PII were inappropriately accessed, used, or disclosed. (The PII Confidentiality Impact Level is not
the same, and does not have to be the same, as the Federal Information Processing Standards
(FIPS) 199 security impact category.)

X

Low – the loss of confidentiality, integrity, or availability could be expected to have a limited
adverse effect on organizational operations, organizational assets, or individuals.
Moderate – the loss of confidentiality, integrity, or availability could be expected to have a
serious adverse effect on organizational operations, organizational assets, or individuals.
High – the loss of confidentiality, integrity, or availability could be expected to have a severe or
catastrophic adverse effect on organizational operations, organizational assets, or individuals.

11.2 Indicate which factors were used to determine the above PII confidentiality impact level.
(Check all that apply.)
X Identifiability
X Quantity of PII
X Data Field Sensitivity

X Context of Use

Provide explanation: The data collected is enough to
identify an individual.
Provide explanation: There is a significant quantity of PII
due to loan data.
Provide explanation: Some of the data requested contains
information such as SSN, TIN, and DOB that could be
exploited for financial gain (this includes permit and loan
applications).
Provide explanation: Context sensitive information is
contained in law enforcement and FOIA files.

X
X

Version Number: 01-2021
X Obligation to Protect
Confidentiality

Provide explanation: The Privacy Act of 1974 requires us to
safeguard the collection, access, use, dissemination and
storage of BII and PII.
MSA, Section 402b.

X Access to and Location of PII
X Other:

Provide explanation: Data is encrypted at rest and access is
restricted.
Provide explanation: Public visibility/concerns about the
potential collection of PII associated with UAS use.

Section 12: Analysis
12.1 Identify and evaluate any potential threats to privacy that exist in light of the information collected
or the sources from which the information is collected. Also, describe the choices that the
bureau/operating unit made with regard to the type or quantity of information collected and the
sources providing the information in order to prevent or mitigate threats to privacy. (For example:
If a decision was made to collect less data, include a discussion of this decision; if it is necessary to
obtain information from sources other than the individual, explain why.)

The BII/PII is collected as part of conducting business. Data collected in each instance is housed
behind the network firewall for the system in which the instance resides with endpoint protection in
place. The data OLE collects, if used for evidence or investigation, will be stored according to the
OLE policy in a secure location. The type of information collected will be used for law enforcement
purposes and will not be accessible to the public.
NOAA collects PII from states for inclusion in the NSAR. NOAA collects the information from the
states because it is more efficient, cost-effective, and less burdensome to the public than collecting
the information from the individuals. There is some potential risk in collecting the data from the
states, but this risk is greatly mitigated by the controls we have in place.
Submission is controlled via authenticated, role-based, access to a web application using secure
socket layer (SSL) certificates or via SFTP using private/public key pairs.
PII is encrypted at all time during transmission and while at rest.

12.2 Indicate whether the conduct of this PIA results in any required business process changes.
Yes, the conduct of this PIA results in required business process changes. Explanation:

X

No, the conduct of this PIA does not result in any required business process changes.

Version Number: 01-2021

12.3 Indicate whether the conduct of this PIA results in any required technology changes.
Yes, the conduct of this PIA results in required technology changes. Explanation:

X

No, the conduct of this PIA does not result in any required technology changes.

Version Number: 01-2021

Programmatic Authorities

Type of Information
Collected

Applicable SORNS

44 U.S.C. 3101

Personnel

COMMERCE/DEPT-18

Employee Performance Info

OPM/GOVT-2

Education Activities

NOAA-14

FOIA & Privacy Act
Requests

COMMERCE/DEPT-5

UAS

COMMERCE/DEPT-29

Executive Orders 12107, 13164,
41 U.S.C. 433(d)
5 U.S.C. 5379
5 CFR Part 537
Executive Order 12564
Public Law 100-71
Executive Order 11246
26 U.S.C. 3402
5 U.S.C. 1302
Executive Order 12107
5 U.S.C. Sections 1104, 3321, 4305, and 5405
Section 4002 of the America Creating Opportunities to Meaningfully
Promote Excellence in Technology, Education, and Science
(COMPETES) Act, Public Law 110-69
America Creating Opportunities to Meaningfully Promote Excellence
in Technology, Education, and Science (COMPETES) Act (Public
Law 110-69, Section 4002)
5 U.S.C. 552, Freedom of Information Act
5 U.S.C. 552a, Privacy Act of 1974 as amended
5 U.S.C. 301
44 U.S.C. 3101
Presidential Memorandum: Promoting Economic Competitiveness
While Safeguarding Privacy, Civil Rights, and Civil Liberties in
Domestic Use of Unmanned Aircraft Systems (Feb. 15, 2015)
47 CFR parts 80, 87, and 95
Office of Management & Budget (OMB) Circular A-130
Magnuson-Stevens Fishery Conservation and Management Act, 16
U.S.C. 1801 et seq
High Seas Fishing Compliance Act of 1995, 16 U.S.C. 5501 et seq
International Fisheries Regulations: Vessels of the United States
Fishing in Colombian Treaty Waters: 50 CFR 300.120
FAA Modernization and Reform Act of 2012 (Pub. L. 112-95)
American Fisheries Act, Title II, Public Law 105-277
Atlantic Coastal Fisheries Cooperative Management Act of 1993, 16
U.S.C. 5101-5108, as amended 1996

Version Number: 01-2021
Tuna Conventions Act of 1950, 16 U.S.C. 951-961
Atlantic Tunas Convention Authorization Act, 16 U.S.C. Chapter 16A
Northern Pacific Halibut Act of 1982, 16 U.S.C. 773 et seq. (Halibut
Act)
Antarctic Marine Living Resources Convention Act of 1984, 16 U.S.C.
2431-2444
Marine Mammal Protection Act, 16 U.S.C. 1361
Executive Orders 10450, 11478

Security Investigations

COMMERCE/DEPT-13

System
Administration/Audit Data
(SAAD)

COMMERCE/DEPT-25

Emergency Preparedness

COMMERCE/DEPT-18

5 U.S.C. 7531-332
28 U.S.C. 533-535
5 USC 301

Homeland Security Presidential Directive 12, Policy for a Common
Identification Standard for Federal Employees and Contractors
Electronic Signatures in Global and National Commerce Act, Public
Law 106-229
28 U.S.C. 533-535
Executive Order 12656
Federal Preparedness Circular (FPC) 65, July 26, 1999
28 U.S.C. 533-535

Foreign National Information COMMERCE/DEPT-27

44 U.S.C. 3101
5 U.S.C. 301
Executive Orders 13526, 12968, 13356, 13587
Public Law 108-458 (Intelligence Reform and Terrorism Prevention
Act of 2004)
Intelligence Authorization Act for FY 2010, Public Law 111-259
31 U.S.C. 951-953
8 U.S.C. 1324a
15 Code of Federal Regulations (CFR) Parts 730-774, Export
Administration Regulations
NOAA Administrative Order (NAO) 207-12 “Technology Controls and
Foreign National Access”
Department Administrative Order (DAO) 207-12 Version Number: 012017 “Foreign National Visitor and Guest Access Program
28 U.S.C. 3101-3105

Financial Information

COMMERCE/DEPT-2

Debt Collection Act of 1982 (PL 97-365)

Fisheries Financial Services

NOAA-21

Version Number: 01-2021
26 U.S.C. 6402(d)
31 U.S.C. 3711
Federal Financial Assistance Management Improvement Act of 1999
Public Works and Economic Development Act of 1965, as amended by
the Economic Development Administration Reauthorization Act of
2004 (Pub. L. 108-373)
4 CFR 102.4
Chief Financial Officers Act (CFOs Act) of 1990, P.L. 101-576
Federal Managers' Financial Integrity Act of 1982, P.L. 97-255 (31
U.S.C. 3512 et seq.);
Office of Management and Budget (OMB) Circular A-127, Financial
Management Systems
Title XI of the Merchant Marine Act of 1936 as amended and codified,
46 U.S.C. 1177 and 46 U.S.C. 53701 et seq.
Magnuson-Stevens Fishery Conservation and Management Act, 16
U.S.C. 1801 et seq.
Debt Collection Improvement Act as codified at 31 U.S.C. 7701
5 U.S.C. 301, Departmental Regulations

Contact Information for the
Public

NOAA-11

Reorganization Plan No. 4 of 1970

Law Enforcement Case Files

NOAA-5

5 U.S.C. 301

Litigation

COMMERCE/DEPT-14

Marine Mammal /
Endangered Species Permits

NOAA-5

15 U.S.C. 1512, Powers and duties of Department

28 U.S.C. 533-535
44 U.S.C. 3101
Certain sections of Titles 15, 16, 18, and 22 of the United States Code
Relevant treaty, international convention, and/or agreements of which
there are approximately 20
Reorganization Plan No. 4 of 1970
5 U.S.C. 301
28 U.S.C. 533-535
44 U.S.C. 3101
Certain sections of Titles 15, 16, 18, and 22 of the United States Code
Relevant treaty, international convention, and/or agreements of which
there are approximately 20
The Marine Mammal Protection Act, 16 U.S.C. 1361 et seq
Fur Seal Act, 16 U.S.C. 1151 et seq
Endangered Species Act, 16 U.S.C. 1531 et seq.
31 U.S.C. 7701.

NOAA-12

Version Number: 01-2021
Fish and Wildlife Act as amended (16 U.S.C. 742 et seq.)

Fishermen's Statistical Data

NOAA-6

NMFS Observers

NOAA-15

Economic Data Reports

NOAA-16

Fishery Conservation and Management Act of 1976 as amended (16
U.S.C. 1852)
Magnuson-Stevens Fishery Conservation and Management Act, as
amended, Public Law 109-479
16 U.S.C. 1853
Magnuson-Stevens Fishery Conservation and Management Act, 16
U.S.C. 1801 et seq
16 U.S.C. 1862

NOAA-23

16 U.S.C. 1853
American Fisheries Act, Title II, Public Law 105-277
50 CFR 660.114
Magnuson-Stevens Fishery Conservation and Management Act, 16
U.S.C. 1801 et seq.
High Seas Fishing Compliance Act of 1995, 16 U.S.C 5501 et seq.
International Fisheries Regulations: Vessels of the United States
Fishing in Colombian Treaty Waters, 50 CFR 300.120
American Fisheries Act, Title II, Public Law No. 105–277
Atlantic Coastal Fisheries Cooperative Management Act of 1993, 16
U.S.C. 5101-5108, as amended 1996
Tuna Conventions Act of 1950, 16 U.S.C. 951-961
Atlantic Tunas Convention Authorization Act, 16 U.S.C., Chapter 16A
Northern Pacific Halibut Act of 1982, 16 U.S.C. 773 et seq.
Antarctic Marine Living Resources Convention Act of 1984, 16 U.S.C.
2431-2444
Western and Central Pacific Fisheries Convention Implementation Act,
16 U.S.C. 6901 et seq.
Dolphin Protection Consumer Information Act, 16 U.S.C. 1385
Marine Mammal Protection Act, 16 U.S.C. 1361 et seq
Commerce, Justice, Science and Related Agencies Act, 2018, Division
B, Section 539 (Pub. L. 115-141)
Taxpayer Identifying Number, 31 U.S.C. 7701

Fisheries Permits &
Registrations

NOAA-19

Version Number: 01-2021
5 U.S.C. 301
Biographical Files and Social
Networks
5 U.S.C. App.--Inspector General Act of 1978, section 2
5 U.S.C. App.--Reorganization Plan of 1970, section 2
13 U.S.C. section 2
13 U.S.C. section 131
15 U.S.C. section 272
15 U.S.C. section 1151
15 U.S.C. section 1501
15 U.S.C. section 1512
15 U.S.C. section 1516
15 U.S.C. section 3704b
16 U.S.C. section 1431
35 U.S.C. section 2
42 U.S.C. section 3121 et seq.
44 U.S.C. 3101 and Reorganization Plan No. 5 of 1950
47 U.S.C. section 902; 50 U.S.C. App. section 2401 et seq.
E.O. 11625
77 FR 49699
Presidential Memorandum to the Heads of Executive Departments and
Agencies on Transparency and Open Government, January 21, 2009
OMB Open Government Directive, M-10-06, December 8, 2009 OMB
Guidance for Online Use of Web Measurement and Customization
Technologies, M-10-22, June 25, 2010
OMB Guidance for Agency Use of Third-Party Web sites and
Applications, M-10-23, June 25, 2010

COMMERCE/DEPT-20

Rehabilitation Act, 29 U.S.C. 701 et. seq
Americans with Disabilities Act of 1990, as amended, 102(d), 42
U.S.C. 12112(d)
29 CFR parts 1602, 1630, 1904, 1910, and 1960
29 USC chapter 15 (e.g., 29 U.S.C. 668)
Executive Order 12196
5 U.S.C. 7902

COMMERCE/DEPT-31

Public Health Emergency
Info & Reasonable
Accommodation

Version Number: 01-2021

Privacy Act Statement – National Permit System (NPS)
Authority: The collection of this information is authorized under the Magnuson-Stevens Fishery
Conservation and Management Act, 16 U.S.C 1801 et seq., the High Seas Fishing Compliance Act, the
Tuna Conventions Act of 1950, the Antarctic Marine Living Resources Convention Act, the Western and
Central Pacific Fisheries Convention Implementation Act (WCPFCIA; 16 U.S.C. 6901 et seq), the
Marine Mammal Protection Act, the Endangered Species Act and the Fur Seal Act. The authority for the
mandatory collection of the Tax Identification Number (TIN) is 31 U.S.C. 7701.
Purpose: In order to manage U.S. fisheries, the NOAA National Marine Fisheries Service (NMFS)
requires the use of permits or registrations by participants in the United States. Information on NOAA
Fisheries permit applicants and renewing holders includes vessel owner contact information, date of
birth, TIN and vessel descriptive information.
Routine Uses: The Department will use this information to determine permit eligibility and to identify
fishery participants. Disclosure of this information is permitted under the Privacy Act of 1974 (5 U.S.C.
Section 552a), to be shared within NMFS offices, in order to coordinate monitoring and management of
sustainability of fisheries and protected resources, as well as with the applicable State or Regional
Marine Fisheries Commissions and International Organizations.
Disclosure of this information is also subject to all of the published routine uses as identified in the Privacy
Act System of Records Notice COMMERCE/NOAA-19, Permits and Registrations for the United States
Federally Regulated Fisheries.
Disclosure: Furnishing this information is voluntary; however, failure to provide complete and accurate
information will prevent the determination of eligibility for a permit.

Version Number: 01-2021

NOAA Privacy Act Statement (FOIA)
Authority: The collection of this information is authorized under 5 U.S.C. 552, the Freedom of
information Act (FOIA), which allows for the full or partial disclosure of previously unreleased
information and documents controlled by the United States government. Additional authorities: 15
C.F.R: Commerce and Foreign Trade, Part 4 - Disclosure of Government Information; Executive Order
13392, Improving Agency Disclosure of information; Executive Memo, Memorandum on Transparency
and Open Government; and NOAA Administrative Order (205-14).
Purpose: NOAA collects the FOIA requestor's name and contact information as part of processing the
FOIA request. In addition, contact information is collected from individuals working on a request,
including administrators processing FOIA information for submission to FOIA Online, the Office of the
General Counsel, the Depaifa1ent of Commerce, and to the Department of Justice if the FOIA case
advances to litigation. Also included a.re administrators may also review materials for work on
litigations and administrative records.
Routine Uses: NOAA will use this information as part of reviewing and processing the FOIA,
administrative or litigation request. Disclosure of this information is permitted under the Privacy Act of
1974 (5 U.S.C. Section 552a) to be shared among NOAA staff for work-related purposes. Disclosure of
this information is also subject to all of the published routine uses as identified in the Privacy Act System
of Records Notices Commerce/DEPT-5, Freedom of Information Act and Privacy Act Request Records,
Commerce/DEPT-14, Litigation, Claims, and Administrative Proceeding Records, and
Commerce/DEPT-25, Access Control and Identity Management System.
Disclosure: The FOIA requester's identity (name/organization) is recorded in NOAA's FOIA Logs,
which are publicly available. NOAA also discloses all contact information with individuals working on a
request, including the Office of the General Counsel, the Department of Commerce, and to the
Department of Justice if the FOIA case advances to litigation. Failure to provide sufficient identifying
information, including but not limited to PII, may result in the FOIA, administrative or litigation request
not being processed, and/or for disclosures to be delayed due to inability to respond to the request
through FOIAonline.