Enclosure (1) to COMDTINST 5260.4A
privacy, the document may be longer than new programs with existing PIAs that need only
update the PIA.
Under the E-Government Act, a PIA should accomplish two goals: (1) It should determine the
risks and effects of collecting, maintaining and disseminating information in identifiable form
via an electronic information system; and (2) It should evaluate protections and alternative
processes for handling information to mitigate potential privacy risks. The Office of
Management and Budget (OMB) oversees the implementation of these goals by requiring PIAs
to be submitted as part of the annual budget process for all new technologies or existing
technologies that are being updated.
Under the Homeland Security Act of 2002, the Chief Privacy Officer is charged with ensuring
that the Department uses technologies that sustain and do not erode privacy. Part of this charge is
fulfilled by requiring that agencies complete PIAs for all new technologies, new collections of
personal information, and new systems or existing systems that are being substantially updated.
The statute also requires that agencies conduct PIAs on all new rulemakings that could impact
privacy. By following this guidance, the PIA requirement will be fulfilled.
Information Covered by the PIA
A PIA should be completed for any system, program, technology or rulemaking that involves
personally identifiable information. Personally identifiable information is information in a
system, online collection, or technology: (i) that directly identifies an individual (e.g., name,
address, social security number or other identifying number or code, telephone number, email
address, etc.) or (ii) by which an agency intends to identify specific individuals in conjunction
with other data elements, i.e., indirect identification. As found in OMB Memorandum M-03-22,
these data elements may include a combination of gender, race, birth date, geographic indicator,
and other descriptors. In some cases a system or technology may only momentarily collect
information about an individual, such as a surveillance camera. A PIA is required for the
acquisition of such a new technology. In other cases, the technology may not be changing, but a
program decides to use data from a new source such as commercial aggregator of information.
Examples of personally identifiable information include: name, date of birth, mailing address,
telephone number, social security number, e-mail address, zip code, address, account numbers,
certificate/license numbers, vehicle identifiers including license plates, uniform resource locators
(URLs), internet protocol addresses, biometric identifiers, photographic facial images, any other
unique identifying number or characteristic, and any information where it is reasonably
foreseeable that the information will be linked with other information to identify an individual.
Examples of technology with privacy implications: In some cases the technology may only
collect personal information for a moment. For example, a body screening device may capture
the full scan of an individual, while the information may not be maintained for later use, the
initial scan may raise privacy concerns and a PIA would be required.
Examples of new data collections with privacy implications: Commercial data aggregators may
provide consolidated data bases of public information that a program uses to check the last
6
Previous Page
