Public Comment Response Matrix

Status: Original and derived artifacts are available for this document.

Download: docx | pdf | html

Comment Submitted by Anonymous
Agency: U.S. Citizenship and Immigration Services (USCIS), Department of Homeland Security (DHS) Docket ID: USCIS-2014-0008 OMB Control Number: 1615-0121 Collection: Generic Clearance for the Collection of Qualitative Feedback on Agency Service Delivery To USCIS and the Office of Management and Budget: I recognize the legitimate value of obtaining voluntary feedback to improve government services. However, because USCIS administers immigration-related programs and interacts with people who may be vulnerable to adverse consequences from disclosure of personal information, this collection must have clear, enforceable safeguards against identification, unauthorized disclosure, secondary use, and misuse.

 The proposed collection encompasses approximately 56,000 annual responses and 28,000 annual burden hours. Its broad description as qualitative feedback about agency service delivery does not, by itself, adequately explain how anonymity will be preserved across every survey or feedback instrument authorized under the umbrella clearance. I request that approval of OMB Control Number 1615-0121 be expressly conditioned on the following safeguards. 

1. Make anonymity the default USCIS should design each feedback instrument to collect no directly identifying information unless it is demonstrably necessary for a specifically disclosed purpose. Feedback instruments should not request names, Alien Registration Numbers (A-numbers), immigration receipt numbers, passport numbers, dates of birth, home addresses, personal telephone numbers, personal email addresses, or other identifiers that are unnecessary to evaluate service quality. Questions should not encourage respondents to disclose identifiable details about their immigration histories, applications, family members, employers, sponsors, or individual cases. USCIS should avoid collecting combinations of demographic, geographic, employment, or case-related details that could allow an individual to be identified indirectly. Free-text fields should include clear instructions not to provide identifying or case-specific information. If follow-up contact is genuinely necessary, participation in that process should be separately optional. Contact information should be stored separately from substantive responses, connected only through a temporary mechanism where necessary, and deleted when no longer required. USCIS should not describe information as anonymous when direct or indirect identification remains reasonably possible. Where anonymity cannot be guaranteed, the agency must explain the limitations before participation. 

2. Prohibit use for immigration enforcement or individual case decisions Feedback collected under this clearance should be used exclusively for the clearly disclosed purpose of evaluating and improving agency services. USCIS should expressly prohibit using these responses to make or influence decisions concerning immigration status, applications, petitions, benefits, eligibility, admissibility, removal, investigation, fraud determinations, or other individual enforcement or adjudication matters. Responses should not be linked to A-files, immigration case-management records, E-Verify activity, SAVE verification transactions, or other individual-level government records for purposes of identifying respondents or evaluating their personal circumstances. USCIS should not use these responses to create individual risk scores, behavioral profiles, watchlists, or adverse inferences about respondents. Feedback should not be used to train or evaluate automated decision-making systems, artificial intelligence systems, or predictive profiling tools without a separately justified collection, appropriate legal review, and an additional public notice and opportunity to comment. Any exception legally compelled by an applicable law or binding legal process should be narrowly construed, documented, and disclosed to participants to the extent legally permissible. 

3. Protect respondents from retaliation or adverse consequences Participation must be genuinely voluntary. A person must be able to decline participation, skip questions, or end a survey without losing or jeopardizing any government service, immigration benefit, application, or other entitlement. USCIS should expressly prohibit retaliation, adverse treatment, or attempts to identify individuals because they provided critical feedback or declined to participate. This protection is particularly important where respondents may reasonably fear that criticizing an agency could affect their own immigration matters or those of family members. Survey invitations and introductory notices should clearly state that feedback is voluntary and is not used to decide individual cases. That statement must accurately reflect actual agency practices and must be supported by operational controls. 

4. Restrict collection of technical identifiers and third-party data The absence of questions requesting personally identifiable information does not necessarily guarantee anonymity. Online feedback systems may process IP addresses, cookies, device identifiers, account identifiers, location information, timestamps, or vendor-generated metadata. USCIS should inventory all information collected or generated by each instrument, including information processed by contractors and third-party survey platforms. Tracking, precise geolocation, cross-site identifiers, advertising technologies, and unnecessary analytics should be disabled. IP addresses and similar technical data should not be retained or linked to substantive feedback unless strictly necessary for a disclosed, legitimate purpose. Contractors should be prohibited from selling, sharing, reusing, profiling, or independently analyzing feedback and associated metadata. Their contracts should require data minimization, appropriate security, limited access, prompt incident reporting, and secure deletion. 

5. Prohibit unauthorized disclosure and secondary use Access to raw responses should be restricted to personnel who need the information for the expressly stated service-improvement purpose. USCIS should prohibit unrelated internal reuse and sharing with other DHS components, law enforcement agencies, outside organizations, or commercial entities unless specifically authorized by applicable law and consistent with the collection's disclosed purpose. Any legally required exception should be narrowly limited and documented. Public reports should use aggregated results and suppress small groups or combinations of characteristics that could permit identification. Direct quotations should not be published where their wording, context, or details could reasonably identify a respondent. The agency should conduct and document re-identification risk assessments before releasing results, especially when multiple datasets could be combined. 

6. Publish clear privacy notices and enforce retention limits Before a respondent begins a survey or other feedback activity, USCIS should provide a concise privacy notice identifying: The purpose and legal authority for collection. USCIS should complete and publish applicable privacy threshold analyses, Privacy Impact Assessments, and Privacy Act system-of-records documentation where required. The agency should not imply that the Privacy Act provides protections that do not legally apply to a particular collection. Information should be retained only for a documented, legally authorized period and securely destroyed when retention is no longer required.

 7. Require instrument-by-instrument review under the umbrella clearance A generic PRA clearance should not become a means of introducing materially different or more intrusive information collection practices without adequate public scrutiny. USCIS should make each proposed instrument-specific submission template and questionnaire available for public review before deployment, consistent with applicable OMB terms of clearance. Each submission should disclose its purpose, population, questions, data fields, collection method, estimated burden, privacy review, retention schedule, and planned uses. Any proposed instrument that introduces sensitive personal information, individual-level record linkage, new secondary uses, materially different populations, or elevated privacy risks should receive a separate assessment and any additional PRA approval or public notice required by law. USCIS should certify that every instrument covered by this clearance conforms to the same binding privacy and anti-misuse standards. Any instrument that cannot meet these standards should not be deployed under the generic clearance. 

8. Audit compliance and provide accountability USCIS should maintain written procedures to prevent unauthorized access, linking, disclosure, and use of survey data. It should periodically audit compliance, including contractor practices, technical metadata collection, retention, and access controls. The information collected, including relevant technical metadata. Whether participation is voluntary. Whether responses are anonymous, confidential, or potentially identifiable. Who may access the information and the circumstances in which it may be disclosed. Whether responses may be linked to other records. The retention period and how information is securely deleted. How respondents may raise privacy concerns or report suspected misuse. The agency should establish procedures for investigating suspected misuse, preserving evidence, correcting improper processing, and notifying affected individuals where appropriate and legally permissible. USCIS should also publish a summary of the safeguards in place and identify an office or official responsible for oversight. Privacy protections should be verified in actual system configurations and contracts rather than relying exclusively on policy statements. 

Requested action

 I request that USCIS and OMB make approval of OMB Control Number 1615-0121 conditional upon enforceable, instrument-wide requirements that: USCIS should not rely on the general description of this collection or on a declaration that personally identifiable information is not requested as a substitute for demonstrating how privacy will be protected throughout the information lifecycle. If USCIS cannot demonstrate that these protections are technically and operationally enforceable, I request that OMB withhold approval until the deficiencies are addressed and the revised safeguards are made available for public review. The public should be able to provide honest feedback about government services without reasonably fearing identification, surveillance, retaliation, or consequences for immigration matters. Meaningful feedback depends on public trust, and that trust requires strict limitations on the collection, disclosure, retention, and use of respondents' information. Thank you for considering this comment. Respectfully submitted, 1. Minimize collection of identifying information and preserve anonymity by design. 2. Prohibit using feedback to identify respondents or influence individual immigration, eligibility, enforcement, or adjudication decisions. 3. Protect participants against retaliation and adverse consequences. 4. Restrict technical tracking, secondary use, data sharing, retention, and contractor access. 5. Require clear participant notices, documented privacy reviews, re-identification safeguards, audits, and accountability. 6. Require instrument-specific transparency and further review whenever a proposed activity materially expands the collection's scope, sensitivity, or uses.
USCIS Response: 

USCIS acknowledges the commenter’s concern. This generic clearance is limited to voluntary, qualitative feedback regarding USCIS service delivery and customer or stakeholder experiences. Collections conducted under this clearance are not statistical surveys intended to produce results generalizable to the population, and participation is voluntary. USCIS does not use participation in, or responses to, these feedback collections to establish binding regulatory interpretations or to determine, condition, grant, or deny an immigration benefit. USCIS will ensure that any individual Generic Information Collection requests submitted under this umbrella clearance remain consistent with the approved scope and applicable requirements. Therefore, USCIS is not making changes to the information collection in response to this comment
 USCIS is seeking an extension without change of OMB Control Number 1615-0121. As a generic clearance, the information collected is generally, “voluntary, low-burden (based on a consideration of total burden, total respondents, or burden per respondent), and uncontroversial.” See OMB's memorandum, “Paperwork Reduction Act—Generic Clearances” dated May 28, 2010; available at: https://trumpwhitehouse.archives.gov/​sites/​whitehouse.gov/​files/​omb/​assets/​inforeg/​PRA_​Gen_​ICRs_​5-28-2010.pdf. The purpose of this collection remains to obtain qualitative customer and stakeholder feedback to support improvements in USCIS service delivery in alignment with OMB guidance for a generic collection.

Participation in collections conducted under this generic clearance is voluntary. USCIS will continue to ensure that individual feedback activities conducted under the clearance are consistent with the approved scope, including the collection’s purpose, target population, information-collection method, and estimated burden. USCIS will also continue to conduct applicable privacy, security, records-management, and other required reviews in accordance with governing requirements before implementing individual collection activities, as appropriate. USCIS has published a Privacy Impact Assessment (PIA) documenting privacy and security processes for, among other website functionality, surveys and will update this information as necessary. See DHS/USCIS/PIA-064 myUSCIS - December 2016 - Appendix Updated June 2019 available at https://www.dhs.gov/publication/dhsuscispia-064-myuscis. USCIS also already includes a warning, in free text box associated with voluntary website surveys that requests that users protect their privacy by not including any personal information in their response. The warning also includes a link to the USCIS website’s privacy policy which includes additional information on USCIS processes for handling inquiries and personally identifiable information voluntarily submitted by website users. 

USCIS also published a PIA addressing USCIS’ practices in customer outreach and engagement.  DHS/USCIS/PIA-089 USCIS Outreach and Engagement Program - September 2023 available at https://www.dhs.gov/sites/default/files/2023-09/privacy-pia-uscis089-outreachandengagementprogram-september2023.pdf.  An additional PIA is published that addresses customer scheduling and services.  See DHS/USCIS/PIA-046(a) Customer Scheduling and Services - December 2017. USCIS also receives coverage from a DHS/Departmental PIA, DHS/ALL/PIA-069 DHS Surveys, Interviews, and Focus Groups – September 2018 available at https://www.dhs.gov/sites/default/files/publications/privacy-pia-dhs-surveys-interviews-focus-groups-september2018.pdf.

The commenter requests a number of detailed, collection-wide conditions concerning technical metadata, contractor requirements, data retention, audits, disclosure restrictions, enforcement and adjudicative uses, automated systems, and public availability of instrument-specific materials which are inappropriate for a generic information clearance or an extension without change of a long-standing existing information collection.

USCIS is not making changes to this information collection in response to this comment.