2. Attachment 3.18 Privacy Fundamentals.pdf

M-1157 rev. 07/16

Fair Information Practice Principles

(FIPPs)

We follow the FIPPs. They provide the foundation of all privacy policy development and implementation at USCIS and must be considered whenever any activity raises privacy concerns or involves the collection of PII from individuals, regardless of their status:

Transparency

Individual Participation

Purpose Specification

Data Minimization

Use Limitation

Data Quality and Integrity

Security

Accountability and Auditing

Privacy is our business…Protecting it is our policy

For privacy policy questions, please contact the Office of Privacy at 202-272-8030 or via email: USCIS.PrivacyInquiries@uscis.dhs.gov

Personally Identifiable Information

PII

Any information that permits the identity of an individual to be directly or indirectly inferred, including any information that is linked or linkable to that individual, regardless of whether the individual is a U.S. citizen, lawful permanent resident, visitor to the U.S., or employee or contractor to the Department.

Examples: name, email, home address.

Sensitive PII Personally Identifiable Information, which if lost, compromised, or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

Examples: Full SSN, A-numbers, Passport number, Biometric identifiers, Driver’s license or state ID number.

*The context can change otherwise ordinary PII to Sensitive PII.

Examples: Name plus criminal history, medical information, full date of birth, last four of SSN, citizenship or immigration status, SEVIS ID number.

Always encrypt emails with full SSN regardless of recipient. Watch out for email attachments that include full SSN and never include the full SSN in the subject line of an email.

Privacy Incidents

A privacy incident is the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access of PII, or any similar term referring to situations where persons, other than authorized users and for an unauthorized purpose, have access or potential access to PII in usable form, whether physical or electronic. The term encompasses both suspected and confirmed incidents, whether intentional or inadvertent, involving PII.

What to do: Immediately report any suspected or confirmed privacy incident to the USCIS Service Desk at 1-888-220-5228 or USCIS.ServiceDesk@uscis.dhs.gov.

Privacy Fundamentals USCIS Office of Privacy

We do not disclose information about a person without their written consent unless a Privacy Act exception applies.