USA Hire PTA_032724_Final.pdf

OPM 5079

Rev. 9/2022

OPM Privacy Threshold Analysis OPIM will use this form to determine whether a new or updated Privacy Impact Assessment (PIA) is required and whether a new or updated System of Records Notice (SORN) is required under the Privacy Act of 1974. OPIM will also use it to document the continuous monitoring of privacy risk and mitigation for the project, program, or system.

Please complete the form and submit it to PIAMail@opm.gov. Upon receipt of this PTA, the Chief Privacy Officer, or designee, will adjudicate the PTA and return it to you. As appropriate, you will be provided with further guidance on completing a PIA and SORN.

Summary Information

Date of Completion:

Project or Program Name:

Office:

Branch/Group:

Type of Project or Program:

Project/ Program status:

Date first developed:

Pilot launch date: Pilot end date:

PTA last updated:

ATO Status (if applicable):

ATO expiration date (if applicable):

mailto:PIAMail@opm.gov

OPM PTA for

Rev. 9/2022

Project, Program, or System Manager

Name:

Office Acronym: Title:

Phone: Email:

Information System Security Officer (ISSO) (if applicable)

Name:

Phone: Email:

Specific PTA Questions

1. Overview:

Please provide a detailed description of the project, program or system and its purpose in a way a non-technical person could understand. The description should include the purpose of the project, which individuals are involved or impacted, a general lifecycle of the data, where the data is stored, and any collection instruments (e.g., forms, mobile application) used to collect information, as well as any other information needed to describe the project. If this is an updated PTA due to changes in a project, please describe the specific changes and/or upgrades that are triggering the update. If this is a renewal PTA due to an impending expiration, please state whether there were any changes since the last PTA approval.

Rev. 9/2022

2. From whom does the Project or Program collect, maintain, use, or disseminate information?

Please check all that apply.

This project does not collect, maintain, use, or disseminate any personally identifiable information

Members of the public

OPM employees

Contractors working on behalf of OPM

Employees of other federal agencies

3. Please identify all information that is collected, generated, or retained (such as names, addresses, emails, etc.) for each category of individual or population.

Name

Date of Birth

Place of Birth

Age

Citizenship

SSN

Home Address

Alias

Nicknames

Personal Email Address

Personal Cell Number

Resume or Curriculum

Business Financial Information

Tax Identification Number

Passport Number

Bank Account

Credit Card

Other Financial Account Number

Driver’s License/State ID Number

Social Media Handle/ID

Biometric Identifiers

Retirement

CSA/ CSF Number

Unique Entity Identifier

Nationality

Sexual Orientation

Race

Ethnicity

Mother’s Maiden Name

Protected Health Information

Other. Please list:

Rev. 9/2022

3(a) Does this Project, Program, or System collect, maintain, use, or disseminate Social Security numbers (SSN) or other types of stand-alone sensitive information?

No.

Yes.

3(b) Please provide the specific legal basis for collecting the SSN:

3(c) If the SSN is needed to carry out the functions and/or fulfill requirements of the Project, System, or Program, please explain why it is necessary and how it will be used.

3(d) If the Project, Program, or System requires the use of SSN, what actions are being taken to abide by Public Law No. 115-59, “Social Security Number Fraud Prevention Act of 2017,” 42 U.S.C. § 405, which requires the use of privacy-enhancing SSN alternatives when there are technological, legal, or regulatory limitations to eliminating the SSN? Note: even if you are properly authorized to collect SSNs, you are required to use an alternate unique identifier. If there are technological, legal, or regulatory limitations to eliminating the SSN, privacy-enhancing alternatives should be taken, such as masking, truncating, or encrypting the SSN, or blocking the display of SSNs in hard copy or digital formats.

Rev. 9/2022

4. How does the Project, Program, or System retrieve information?

By a unique identifier. Please list all unique identifiers used:

By a non-unique identifier or other means. Please describe:

5. What is the records retention schedule(s) for the information collected for each category type (include the records schedule number)? If no schedule has been approved, please provide proposed schedule, or plans to determine it.

Note: If no records schedule is in place or are unsure of the applicable records schedule, please reach out to the OPM Records Officer.

5(a) How does the Project, Program, or System ensure that records are disposed of or deleted in accordance with the retention schedule (e.g., technical/automatic purge, manual audit)?

6. Does this Project, Program, or System connect, receive, or share PII with any other Office, projects, programs, or systems?

No.

Yes. If yes, please list:

7. Does this Project, Program, or System connect, receive, or share PII with any external (non-OPM) government or non-government partners or systems?

No.

Yes. If yes, please list:

Rev. 9/2022

8. Is this sharing pursuant to new or existing information sharing agreement (MOU, MOA, etc.)? If applicable, please provide agreement as an attachment.

Please describe applicable information sharing governance in place:

9. Does the Project, Program, or System have a mechanism to track external disclosures of an individual’s PII?

No. What steps will be taken to develop and maintain the accounting:

Yes. In what format is the accounting maintained:

10. Does this Project, Program, or System use or collect data involving or from any of the following technologies:

Social Media

Advanced analytics

Live PII data for testing

No

11. Does the planned effort include any interaction or intervention with human subjects via pilot studies, exercises, focus groups, surveys, equipment or technology, observation of public behavior, review of data sets, etc. for research purposes?

No.

Yes.

12. Does the Project, Program, or System provide role-based or additional privacy training for personnel who have access, in addition to annual privacy training required of all OPM personnel?

No.

Yes. If yes, please list:

Rev. 9/2022

13. Is there a FIPS 199 determination? No.

Yes. Please indicate the determinations for each of the following:

Confidentiality:

Low Moderate High Undefined

Integrity:

Low Moderate High Undefined

Availability:

Low Moderate High Undefined

Completed by the OPM Chief Privacy Officer or Designee

Privacy Office Reviewer:

Date Review Completed:

PTA Expiration Date:

Designation

Privacy Sensitive System: Yes No

Category of System:

If “other” is selected, please describe:

Privacy compliance and assurance (PCA):

Privacy compliance documentation in progress

PTA sufficient at this time

PIA required

SORN required

Privacy Act Statement Required

PRA clearance required

Records Schedule Required

New information sharing arrangement required

Rev. 9/2022

PIA:

SORN:

Privacy Office Comments:

Please describe rationale for privacy compliance determination above, and any further action(s) that must be taken by Office.

Rev. 9/2022

Privacy Controls Privacy controls are the administrative, technical, and physical safeguards employed within organizations to protect and ensure the proper handling of PII. The privacy control families can be implemented at the organization, office, program, or information system level, under the leadership of the Senior Agency Official for Privacy (SAOP) or Chief Privacy Officer (CPO) and in coordination with the Chief Information Security Officer (CISO), Chief Information Officer (CIO), program officials, and legal counsel. NIST SP800-53 Rev.5 provides a summary of the privacy controls. Indicate, in the context of this PTA, whether the control is met (Y), not met (N), or Not Applicable (N/A).

Control Number

Privacy Controls (NIST SP800-53 Rev.5)

Control Status

PT Authority and Purpose

PT-2 Authority to Process Personally Identifiable Information

PT-3 Personally Identifiable Information Processing

PM-3 Information Security and Privacy Resources

PM-18 Privacy Program Plan

PM-19 Privacy Program Leadership Role

TR-3 Dissemination of Privacy Program Information

RA-3 Risk Assessment

RA-8 Privacy Impact Assessment

SA-1 Policies and Procedures

SA-4 Acquisition Process

SA-9 External System Services

CA-2 Control Assessments

AT-1 Policies and Procedures

AT-2 Literacy Training and Awareness

AT-3 Role-based Training

Rev. 9/2022

Control Number

Privacy Controls (NIST SP800-53 Rev.5)

Control Status

AT-3(5) Role-based Training / Processing Personally Identifiable Information

PL-4 Rules of Behavior

PM-27 Privacy Reporting

AR-7 Privacy-Enhanced System Design and Development

PM-20 Dissemination of Privacy Program Information

PM-21 Accounting of Disclosures

PM-22 Personally Identifiable Information Quality Management

PM-24 Data Integrity Board

SI-1 Policies and Procedures

SA-8(33) Security and Privacy Engineering Principles / Minimization

SI-12(1) Information Management and Retention / Limit PII Elements

MP-6 Media Sanitization

SI-12 Information Management and Retention

SI-12(3) Information Management and Retention / Information Disposal

SI-12(2) Information Management and Retention / Minimize PII in Testing, Training and Research

PT-4 Consent

AC-1 Policies and Procedures

AC-3(14) Access Enforcement / Individual Access

SI-18 Personally Identifiable Information Quality Operations

Rev. 9/2022

Control Number

Privacy Controls (NIST SP800-53 Rev.5)

Control Status

SI-18(4) Personally Identifiable Information Quality Operations / Individual Requests

SI-18(5) Personally Identifiable Information Quality Operations / Notice of Correction or Deletion

PM-25 Minimization of PII used in Testing, Training, and Research

PM-26 Complaint Management

PM-5(1) System Inventory / Inventory of Personally Identifiable Information

IR-8 Incident Response Plan

IR-8(1) Incident Response Plan / Breaches

PT-5 Privacy Notice

PT-5(1) Privacy Notice / Just-In-Time Notice

PT-5(2) Privacy Notice / Privacy Act Statements

PT-6 System of Records Notice

AC-21 Information Sharing

AU-2 Event Logging

Privacy Controls

Audio and video recording (only for on-demand online interviews)

OPM/GOVT-6 Personnel Research and Test Validation Records PrivacyOfficeComments: As the system contains and maintains PII, a PIA is required and was last updated in July 2020. The system also pulls information by a personal identifier, and is covered by two existing OPM SORNs.

The updated PIA is currently under review by the Privacy Office and will be completed no later than the end of 3rd quarter FY24.

The only change since the previous PTA is that USA Hire now collects video recording for on-demand interviews (previously it was only audio recording).