Guidance for Preparing Privacy Impact Assessments

Introduction

The Environmental Protection Agency recognizes the importance of protecting the privacy of individuals, especially as it modernizes and develops its systems and desktop applications. Privacy issues must be addressed when systems are being developed and privacy protections must be integrated into the development life cycle of automated systems. The Privacy Impact Assessment (PIA) is the tool for addressing privacy issues. The PIA process provides a means to assure compliance with applicable laws and regulations governing the privacy of individuals.

Purpose

The purpose of this guidance is to establish the requirements and approval processes for completing Privacy Impact Assessments (PIAs).

Background

The Environmental Protection Agency (EPA), Office of Environmental Information (OEI), Office of Information Collection (OIC) is responsible for ensuring the privacy, confidentiality and integrity of individual's information. The Agency recognizes that privacy protection is both a personal and fundamental right of all individuals. Individuals have the right to expect that the Agency will collect, maintain, use, and disseminate identifiable personal information and data only as authorized by law and as necessary to carry out agency responsibilities. Individuals' information is protected by the following statutes:

Privacy Act of 1974 (5 USC 552a) http://www.nara.gov/fedreg/legal/apa/552a.html
Freedom of Information Act, as amended (5 USC 552)
Computer Security Act of 1987 (Public Law 100-235)
Computer Matching & Privacy Protection Act (Public Law 100-503)
OMB Circular A-130
E-Government Act of 2002
Federal Information Security Management Act

Privacy and System Development

Rapid advancements in computer technology make it possible to store and retrieve vast amounts of all kinds of data quickly and efficiently. These advancements have raised concerns about the impact of large computerized information systems on the privacy of data subjects. Public concerns about highly integrated information systems operated by the government make it imperative to commit to a positive and aggressive approach to protecting individuals' privacy.

EPA is committed to formulating, developing, implementing, and promoting effective individual privacy protection strategies and programs. These strategies and programs will enhance the efforts of the Agency to earn the highest degree of public confidence in its integrity, efficiency, and fairness.

What is a Privacy Impact Assessment?

The PIA is a process for examining the risks and ramifications of collecting, maintaining and disseminating information in identifiable form in an electronic system, and for identifying and evaluating protections and alternative processes to mitigate the impact to privacy of collecting information in identifiable form. Identifiable form refers to data within the system or online collection that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means.

The PIA provides a framework for considering the privacy implications of information collected on individuals and where potential disclosure risks may lie. Informed decision making and the ability to design a system which addresses actual or potential privacy concerns are dependent on early identification of privacy issues. Privacy concerns should always be considered when requirements are being analyzed and decisions are being made about data collection, usage, storage and system design.

The Privacy Impact Assessment helps ensure that the systems developed by the Agency protect individuals' privacy. The PIA incorporates privacy into the development life cycle so that all system development initiatives can appropriately consider privacy issues from the earliest stages of development.

When is a PIA Performed?

The PIA is to be initiated in the early stages of the development of a system and completed as part of the required System Life Cycle reviews. Privacy must be considered when requirements are being analyzed and decisions are being made about data usage and system design.

What Systems Need to Complete the PIA?

New Systems: Any new system that collects maintains or disseminates personal identifiable information from or about members of the public as required by the E-Government Act of 2002. OMB Memorandum M-07-16 recommends that agencies provide the same privacy protections to information about its employees. Accordingly, EPA may require PIAs on certain systems that collect PII on Agency employees.
Existing Systems: When there is a significant modification or where changes have been made to the system that may create a new privacy risk, an updated PIA is required.
Information Collection Requests: If the information collection is both a new collection and automated and collects information from ten or more members of the public.

Review of the PIA

The PIA review is to identify privacy risks in the system. OEI will work with the PIA preparer to help mitigate the risks identified.

Submitting the PIA

The PIA should be submitted electronically, in Word format (MS Word, 2 pp, 71K), to Judy E. Hutt (hutt.judy@epa.gov), Office of Environmental Information, Office of Information Collection.

Questions Regarding this Guidance

Please direct any questions regarding this guidance or the Privacy Act to Judy Hutt, Agency Privacy Act Officer, on 202-566-1668.