AFI_33-332.pdf

BY ORDER OF THE

SECRETARY OF THE AIR FORCE

AIR FORCE INSTRUCTION 33-332

12 JANUARY 2015

Incorporating Change 1, 17 November 2016

Corrective Actions applied on 17 November 2016

Communications and Information

AIR FORCE PRIVACY AND CIVIL

LIBERTIES PROGRAM

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

ACCESSIBILITY: Publications and forms are available on the e- Publishing website at www.e-Publishing.af.mil for downloading or ordering.

RELEASABILITY: There are no releasability restrictions on this publication.

OPR: SAF CIO/A6XA

Information Access Policy and Compliance Branch

Supersedes: AFI33-332, 5 June 2013

Certified by: SAF/A6X

(Col Suzanne S. Kumashiro)

Pages: 80

This Instruction implements Public Law 110-53 (42 U.S.C. § 2000ee-1) Section 803; Air Force

Policy Directive (AFPD) 33-3, Information Management; Department of Defense Directive

(DoDD) 5400.11, Department of Defense Privacy Program; Department of Defense Regulation

(DoDR) 5400.11-R, Department of Defense Privacy Program; Department of Defense Instruction

(DoDI) 5400.16, DoD Privacy Impact Assessment (PIA) Guidance; DoDI 1000.30, Reduction of

Social Security Number (SSN) Use Within DoD; and DoDI 1000.29, DoD Civil Liberties Program.

The Instruction provides direction on the Privacy Act of 1974, 5 U.S.C. § 552a, E-Government

Act of 2002, 44 U.S.C. §3601, Safeguarding and Responding to Personally Identifiable

Information (PII) breaches, Reduction of Social Security Number (SSN) and Civil Liberties. In addition to this instruction, Air Force medical organizations that meet the definition of a covered entity must also comply with the Health Insurance Portability and Accountability Act (HIPAA), as required by DoD 6025.18-R, DoD Health Information Privacy Regulation; DoD 8580.02-R, DoD Health Information Security Regulation; and Air Force Instruction (AFI) 41-210, TRICARE

Operations and Patient Administration Functions, which covers Protected Health Information

(PHI) held by them. This Instruction applies to Air Force Active Duty, Air Reserve Command

(AFRC) and Air National Guard (ANG) units, government civilians, contractors and Civil Air

Patrol when performing functions for the Air Force, and in accordance with (IAW) DoDD 5100.03, Support of the Headquarters of Combatant and Subordinate Joint Commands. Air National Guard personnel not in a federal status are subject to their respective state military code or applicable http://www.e-publishing.af.mil/

2 AFI33-332 12 JANUARY 2015

administrative actions, as appropriate. Ensure all records created as a result of processes prescribed in this Instruction are maintained in accordance with Air Force Manual (AFI) 33-363, Management of Records, and disposed of in accordance with the Air Force Records Disposition Schedule (RDS) maintained in the Air Force Records Information Management System (AFRIMS). Use of the term “MAJCOM” throughout this AFI includes MAJCOMs, FOAs, DRUs, and the Air Force

Installation Mission Support Center (AFIMSC). Refer recommended changes and questions about this Instruction to the Office of Primary Responsibility (OPR) using the AF Form 847, Recommendation for Change of Publication; route through the appropriate functional chain of command. Send supplements and implementing publications of this Instruction to the Chief

Information Dominance and Chief Information Officer (SAF/CIO A6XA), 1800 Air Force

Pentagon, Washington, DC 20330-1800 for review and coordination prior to publication.

SUMMARY OF CORRECIVE ACTIONS

Recent changes include correcting currently published IC-1 to include the implementation of

SECAF Memorandum, Reducing Ancillary and Computer-Based Training that was not processed in the IC. A margin bar (|) indicates changed material.

SUMMARY OF CHANGES

This interim change (IC) revises AFI 33-332 by (1) revising PII safeguarding (2) updating PII

Breach Reporting (3) updating PII Breach Reporting to US CERT (4) updating privacy statement

(5) updating privacy act notices and markings (5) updating the guidance regarding periodic review of published SORNS, (7) providing clarification on deletion of SORNs, (8) updating Privacy

Impact Assessment processing procedures, (9) updating approved PIAs submission, (10) updating

Privacy managers PIA responsibilities, (11) updating records professionals responsibilities regarding PIAs, and (12) replacing “quarterly” with “semi-annual” for all Privacy and Civil

Liberties reports previously referred to as “quarterly”, by(13) updating Attachment 11 and (14) adding Attachment 13, Air Force Biennial System of Records Notice (SORN) Accuracy Review

Checklist . A margin bar (|) indicates changed material.

Chapter 1— UNDERSTANDING PRIVACY AND HOW IT APPLIES TO THE AIR

FORCE 6

1.1. Privacy Overview

1.2. Privacy Act Notices

1.3. Privacy Act Information

Chapter 2— PRIVACY ACT 11

2.1. Overview of the Privacy Act of 1974, 5 U

2.2. Privacy Act Responsibilities

2.3. Privacy Act Complaints and Violations

AFI33-332 12 JANUARY 2015 3

2.4. Maintaining Personal Information

2.5. Privacy Act Statements

2.6. Publishing System of Records Notices (SORNs)

2.7. Privacy Act Records Request

2.8. Amending a Privacy Act Record

2.9. Approving or Denying a Record to be Amended

2.10. Contents of Privacy Act Processing Case Files

2.11. First Party Appeal Process For Denial to Access or Amendment of a Privacy Act

Record

2.12. Disclosing Information

2.13. Computer Matching

2.14. Privacy Act Exemptions

2.15. The Federal Records Act, 44 U

Chapter 3— E-GOVERNMENT ACT 27

3.1. Overview of the E-Government Act of 2002, 44 U

3.2. The Purposes of the E-Government Act are the Following:

3.3. Privacy Impact Assessments (PIA)

Chapter 4— ROLES AND RESPONSIBILITIES. 31

4.1. The Chief, Information Officer (SAF/CIO A6) shall:

4.2. The CSOP shall:

4.3. The AF Privacy Officer shall:

4.4. The Office of The Judge Advocate General, Administrative Law Directorate

(AF/JAA), and Judge Advocate legal offices

4.5. AF Departmental Forms Management Officer shall:

4.6. MAJCOM/A6s or Responsible Directorate and Wing Commanders shall:

4.7. HAF/MAJCOM/FOA/DRU/Base Privacy Managers/Monitors shall:

4.8. Unit Privacy Monitors shall:

4.9. Functional Level ISOs, PMs, and IAMs shall:

4.10. Records Professionals shall

4 AFI33-332 12 JANUARY 2015

Chapter 5— SOCIAL SECURITY NUMBER (SSN) REDUCTION PLAN 37

5.1. Overview

5.2. The Specific Requirement for Use of the SSN

5.3. Alternative Means of Identifying Records:

5.4. Protection of SSN

5.5. Reporting Results of Social Security Number Reduction

Chapter 6— PROTECTING RECORDS 40

6.1. Protecting Records

6.2. Protecting Personal information or PII Maintained in an Electronic System

6.3. Risk Based Management

6.4. Disposing of Records

Chapter 7— CIVIL LIBERTIES 43

7.1. Overview

7.2. Basic Guidelines

7.3. Civil Liberties Responsibilities

7.4. Civil Liberties Semi-Annual Report

7.5. Reprisal For Making Complaint:

7.6. Civil Liberties Training Tools

AFI33-332 12 JANUARY 2015 5

Attachment 1— GLOSSARY OF REFERENCES AND SUPPORTING INFORMATION 47

Attachment 2— PREPARING A SYSTEM OF RECORDS NOTICE (SORN) 55

Attachment 3— DOD BLANKET ROUTINE USE 57

Attachment 4— EXAMPLES OF PRIVACY ACT STATEMENT/ADVISORY AND

PRIVACY STATEMENT 60

Attachment 5— ALTERING A SYSTEM OF RECORD NOTICE 61

Attachment 6— RISK ASSESSMENT 64

Attachment 7— EXAMPLE PRIVACY BREACH NOTIFICATION LETTER OFFICIAL

LETTERHEAD 65

Attachment 8— PREPARING A DOD SSN JUSTIFICATION MEMORANDUM 66

Attachment 9— APPROVED DOD TRAINING WEBSITES APPROVED DOD PRIVACY

TRAINING WEBSITES 67

Attachment 10— NOTIONAL COMPLAINT VIGNETTES 68

Attachment 11— CIVIL LIBERTIES COMPLAINT REPORT INSTRUCTIONS 71

Attachment 12— EXAMPLE CIVIL LIBERTIES REPORT 72

Attachment 13— EXAMPLE AIR FORCE BIENNIAL SYSTEM OF RECORDS NOTICE

(SORN) ACCURACY REVIEW CHECKLIST Error!

Bookmark not defined.

_TocATTACHMENT13 _TocATTACHMENT13

6 AFI33-332 12 JANUARY 2015

Chapter 1

UNDERSTANDING PRIVACY AND HOW IT APPLIES TO THE AIR FORCE

1.1. Privacy Overview.

1.1.1. What is privacy? Although there is not an official government definition of privacy, it generally refers to the notion of individuals maintaining control over information about them.

For the Air Force, the framework of privacy requirements includes the Privacy Act of 1974, the E-Government Act of 2002 (specifically section 208), Office of Management and Budget

(OMB) policy, DoD policy, and Air Force policy. Failure to protect privacy can bring about risks to the individual, such as identity theft and risks to the Air Force, such as lawsuits for inappropriate disclosure that divert critical resources away from our mission.

1.1.2. What information must be protected? The information protected by the various components of the privacy framework is discussed using multiple terms. For the purposes of this Instruction, there are two key definitions to understand:

1.1.2.1. Personal Information (Personally Identifiable Information (PII))

1.1.2.1.1. Office of Management and Budget Memorandum 07-16, Safeguarding

Against and Responding to PII Breach - Personally Identifiable Information is defined as information which can be used to distinguish or trace an individual’s identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

1.1.2.1.2. Office of Management and Budget Memorandum10-22, Online Use of Web

Measurement and Customization Technologies - The definition of PII is not anchored to any single category of information or technology. Rather, it demands a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-PII can become PII whenever additional information is made publicly available – in any medium and from any source – that, when combined with other available information, could be used to identify an individual.

1.1.2.2. For safeguarding of Personal Information, please refer to DoD 5400.11-R, Department of Defense Privacy Program (C1.4, C4 and Appendix 1).

1.1.2.2.1. DELETED

1.1.2.2.1.1. DELETED

1.1.2.2.1.1.1. DELETED

1.1.2.2.1.1.2. DELETED

1.1.2.2.1.1.3. DELETED

1.1.2.2.1.1.4. DELETED

1.1.2.2.1.1.5. DELETED

1.1.2.2.1.1.6. DELETED

AFI33-332 12 JANUARY 2015 7

1.1.2.2.1.1.7. DELETED

1.1.2.2.1.1.8. DELETED

1.1.2.2.1.1.9. DELETED

1.1.2.2.1.2. DELETED

1.1.2.2.1.2.1. DELETED

1.1.2.2.1.2.2. DELETED

1.1.2.2.1.2.3. DELETED

1.1.2.2.1.2.4. DELETED

1.1.2.2.1.2.5. DELETED

1.1.2.2.1.2.6. DELETED

1.1.2.2.1.2.7. DELETED

1.1.2.2.1.3. DELETED

1.1.2.2.1.3.1. DELETED

1.1.2.2.2. DELETED

1.1.2.2.3. DELETED

1.1.2.2.3.1. DELETED

1.1.2.2.4. DELETED

1.1.2.2.5. DELETED

1.1.2.3. PII maintained in a SOR accessed or handled by contractors. Contractors required to access or handle PII on behalf of the Air Force, will follow this Instruction.

Organizations with contractors that access and handle PII will coordinate with contracting officials to ensure that contracts contain the proper Privacy Act clauses: 52.224-1, Privacy

Act Notification; and 52.224-2, Privacy Act as required by the Federal Acquisition

Regulation (FAR) (see FAR website at: http://www.acquisition.gov/far/) Contracting

Officers should also require non-disclosure agreements for contractors who will have access to sensitive PII. (T-0)

1.1.2.3.1. Contracts will be reviewed annually by the Contracting Office

Representative (COR) to ensure compliance with this Instruction. (T-0)

1.1.2.3.2. Disclosure of PII maintained in a SOR to contractors for use in the performance of an Air Force contract is considered an official use disclosure within the agency under exception (b)(1) of the Privacy Act and protected as an inter/intra Agency disclosure per Freedom of Information Act (FOIA) exemption (b)(5).

1.1.2.4. PII Breach Reporting. Refer to Office of the Secretary of Defense Memorandum

(OSD 06227-09, dated 5 June 2009), Safeguarding Against and Responding to theictectBreach of Personally Identifiable Information, and Office of the Secretary of

Defense Memorandum (2 August 2012), Use of Best Judgement for Individual Personally

Identifiable Information (PII) Breach Notification Determinations.(T-0) http://www.acquisition.gov/far/

8 AFI33-332 12 JANUARY 2015

1.1.2.4.1. A PII breach is defined as “actual or possible loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users and for an other than authorized purpose have access or potential access to PII, whether physical or electronic.”

1.1.2.4.2. Actual or possible breaches must be reported to the servicing Privacy

Manager/Monitor by anyone discovering it.

1.1.2.4.3. The servicing Privacy Manager/Monitor shall assist with the submission of a Preliminary PII Breach Report by unencrypted e-mail according to the timeline below: (T-1)

1.1.2.4.4. PII Breach Reports shall be completed using DD Form 2959, Breach of

Personally Identifiable Information (PII) Report provided by Defense Privacy and

Civil Liberties Office located on the AF Privacy Website: www.privacy.af.mil.(T-0)

1.1.2.4.5. Use for Preliminary, updates, and Final reports.

1.1.2.4.5.1. Reports shall not include names of individuals involved or affected by the breach. Reports are forwarded by unencrypted e-mail through the

MAJCOM/FOA/DRU Privacy Manager who in turn shall notify the AF Privacy

Office by official unencrypted e-mail (usaf.pentagon.saf-cio-a6.mbx.af-privacy@mail.mil) attaching the written PII Breach Preliminary Report.

1.1.2.4.5.2. Notify the United States Computer Emergency Readiness Team (US

CERT) within one hour of discovering that an electronic breach of personally identifiable information has occurred.

1.1.2.4.5.3. The Wing Commander shall submit an initial Operational Report

(OPREP) if it is determined the breach may have an impact on organizational operation and or potential media attention.

1.1.2.4.5.4. Within 24 hours of the PII breach, the Privacy official where the incident occurred shall notify the senior official (O6/GS-15, or higher) in the chain of command and simultaneously notify the MAJCOM/FOA/DRU Privacy Manager by official unencrypted e-mail (NIPR) attaching the PII Breach Preliminary Report.

1.1.2.4.5.5. Within 24 hours of being notified of the PII breach, the appropriate level Privacy Manager shall notify the AF Privacy Office by official unencrypted e-mail (usaf.pentagon.saf-cio-a6.mbx.af-privacy@mail.mil) attaching the written PII Breach Preliminary Report.

1.1.2.4.5.6. Within 48 hours of the PII breach notification the AF Privacy Officer shall upload the report into the DPCLO Reporting Management Tool.

1.1.2.4.5.7. Until resolved, the underlying issues that led to the breach shall continue to be reported to the AF Privacy Office IAW these reporting procedures.

1.1.2.4.5.8. The servicing Privacy Manager shall send the PII Breach Final Report when resolved in the same routing as previous notifications along with a final

OPREP (if applicable).

AFI33-332 12 JANUARY 2015 9

1.1.2.5. Guidelines for conducting an inquiry of a PII Incident. The senior-level individual who is in the chain of command for the organization where the actual or possible loss, theft or compromise of information occurred shall appoint an Investigating Official (IO) to conduct an inquiry (recommend E7/above or civil equivalent) of the incident to determine if it is an actual breach, the cause and if a there was any criminal intent that would warrant a criminal investigation.(T-1)

1.1.2.5.1. The servicing Privacy Manager/Monitor shall provide guidance to the individual appointed to properly complete the PII Breach Final Report and reference

AFI and DoD Policies and the Privacy Act for use in completing the inquiry as required.

1.1.2.5.2. The appointed official shall review the initial Preliminary PII Breach Report and independently assess the handling of the breach. They shall make clarifications and additions on the Final PII Breach Report as required, and submit to the appointing senior-level individual who will determine whether notification to affected individuals is required after a risk assessment (see attachment 6) analysis has been completed, along with any corrective actions that should be taken. (T-0)

1.1.2.5.3. Upon concurrence with Final PII Breach Report recommendations, the senior individual in the chain of command for the organization where the loss, theft or compromise occurred shall route the Final PII Breach Report to the appropriate level

Privacy Manager within five days. (T-0)

1.1.2.5.4. Commanders/Directors shall ensure notifications are sent to individuals once a decision has been made as to whether there may be any impact towards the individual(s). Once a decision has been made to notify; notification will be sent to affected individuals within 10 working days after a breach is confirmed and the identities of the affected individuals ascertained by a senior official (O6/GS-15 and higher) in the chain of command for the organization where the breach occurred. (T-0)

1.1.2.5.5. Commanders/Directors shall ensure individual(s) responsible for cause of the breach receive the DISA Identifying and Safeguarding Personally Identifiable

Information refresher training, http://iase.disa.mil/eta/Pages/index.aspx. (T-0)

1.1.2.6. Air Force Computer Emergency Response Team (AFCERT) Reported PII

Incidents. According to CJCSM 6510.01B, Enclosure C, Paragraph 7.b, “when a Computer

Network Defense Service Provider (CNDSP) discovers compromised or potentially compromised PII, they must notify the US CERT and their servicing Privacy Office.”

(T-0)

1.1.2.6.1. AFCERT shall follow through on CNDSP detections of PII Incidents by notifying the Information Security Officer (ISO) and Program Manager (PM of the web application and/or IT system cited.

1.1.2.7. ISO and PM of web application and/or IT system responsible for the breach must notify the servicing Privacy Manager or Monitor who shall ensure Breach notifications are accomplished as established by AF policy and DoD reporting guidance.

10 AFI33-332 12 JANUARY 2015

1.1.3. Cover Sheet: AF Form 3227, Privacy Act Cover Sheet or DD Form 2923, Privacy Act

Data Cover Sheet. Use is mandatory to protect PII from being viewed by unauthorized personnel when Privacy Act materials are removed from their system of record or approved storage location. (T-0)

1.1.4. Label: AFVA 33-276, Air ForceictectPrivacy Act Label. Use is mandatory to assist in identifying Privacy Act information by placing the label on the covers of removable electronic storage media such as Laptops, Government Hard drives, DVDs, CDs, diskettes, tapes and may be used for deployment folders. The label is not authorized for use on file drawers file cabinets, mailing envelopes, or other stationary equipment or materials IAW with AFI 33-322, Records Management Program. (T-1)

1.2. Privacy Act Notices. (T-0)

1.2.1. Whenever an individual is requested to provide personal information that will not be maintained in a SOR, the individual shall be provided the authority, purpose, routine use(s), whether disclosure of the information is voluntary or not. This is known as a “Privacy

Statement.” (T-0)

1.2.1.1. Authority: the legal authority that authorizes the solicitation of the personal information.

1.2.1.2. Purpose: the principal purpose or purposes for which the information is intended to be used.

1.2.1.3. Routine Uses: who or what agency will the personal information be shared with on a routine basis outside the DoD.

1.2.1.4. Disclosure: Voluntary or Mandatory. (Use mandatory only when disclosure is required by law and the individual will be penalized for not providing information. All mandatory disclosure requirements must first be reviewed by the servicing legal office).

Include any consequences of nondisclosure in nonthreatening language.

1.3. Privacy Act Information.

1.3.1. Privacy Act Information is PII which is referred to as personal information that is maintained in a System of Records (SOR) as defined by the Privacy Act, which means the information is retrievable by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

1.3.2. Understanding Which Definition Applies. PII is a very broad definition and generally refers to any type of personal information that is linked or linkable to a person. PII may or may not be maintained in a SOR, which means it may or may not also be Privacy Act

Information. When PII is maintained in a SOR, it is also Privacy Act Information. Both the

Privacy Act requirements and other privacy requirements that protect PII in the privacy framework apply to Privacy Act Information. When PII is not maintained in a SOR, and therefore is not Privacy Act Information, the E-Government Act and many OMB, DoD, and

AF policies that protect PII still apply to the information.

AFI33-332 12 JANUARY 2015 11

Chapter 2

PRIVACY ACT

2.1. Overview of the Privacy Act of 1974, 5 U. S.C. § 552a.

2.1.1. Under the Privacy Act of 1974, 5 U.S.C. § 552a, The Congress finds the following:

2.1.1.1. The privacy of an individual is directly affected by the collection, maintenance, use, and dissemination of personal information by Federal agencies;

2.1.1.2. The increasing use of computers and sophisticated information technology, while essential to the efficient operations of the Government, has greatly magnified the harm to individual privacy that can occur from any collection, maintenance, use, or dissemination of personal information;

2.1.1.3. The opportunities for an individual to secure employment, insurance, and credit, and his/her right to due process, and other legal protections are endangered by the misuse of certain information systems;

2.1.1.4. The right to privacy is a personal and fundamental right protected by the

Constitution of the United States; and

2.1.1.5. In order to protect the privacy of individuals identified in information systems maintained by Federal agencies, it is necessary and proper for the Congress to regulate the collection, maintenance, use, and dissemination of information by such agencies.

2.1.2. The purpose of the Privacy Act is to provide certain safeguards for an individual against an invasion of personal privacy by requiring Federal agencies, except as otherwise provided by law, to:

2.1.2.1. Permit an individual to determine what records pertaining to him/her are collected, maintained, used, or disseminated by such agencies;

2.1.2.2. Permit an individual to prevent records pertaining to him/her obtained by such agencies for a particular purpose from being used or made available for another purpose without his/her consent;

2.1.2.3. Permit an individual to gain access to information pertaining to him/her in Federal agency records, to have a copy made of all or any portion thereof, and to correct or amend such records;

2.1.2.4. Collect, maintain, use, or disseminate any record of identifiable personal information in a manner that assures that such action is for a necessary and lawful purpose, that the information is current for its intended use, and that adequate safeguards are provided to prevent misuse of such information;

2.1.2.5. Permit exemptions from the requirements with respect to records provided in this

Act only in those cases where there is an important public policy need for such exemption as has been determined by specific statutory authority; and

2.1.2.6. Criminal Penalties

2.1.2.6.1. Any officer or employee of an agency, who by virtue of his employment or official position, has possession of, or access to, agency records which contain

12 AFI33-332 12 JANUARY 2015

individually identifiable information the disclosure of which is prohibited by this section or by rules or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

2.1.2.6.2. Any officer or employee of any agency who willfully maintains a system of records without meeting the notice requirements shall be guilty of a misdemeanor and fined not more than $5,000.

2.1.2.6.3. Any person who knowingly and willfully requests or obtains any record concerning an individual from an agency under false pretenses shall be guilty of a misdemeanor and fined not more than $5,000.

2.1.3. For the purpose of this chapter the following terms are provided;

2.1.3.1. The term “individual” means a citizen of the United States or an alien lawfully admitted for permanent residence’;

2.1.3.2. The term “record” means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his/her education, financial transactions, medical history, and criminal or employment history and that contains his/her name, or the identifying number, symbol or other identifying particular assigned to the individual, such as a finger or voice print or a photograph;

2.1.3.3. The term “System of Records” (SOR) means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual;

2.1.3.4. The term “maintain” includes maintain, collect, use or disseminate;

2.1.3.5. The term “routine use” means, with respect to the disclosure of a record, the use of such record for a purpose that is compatible with the purpose for which it was collected;

2.1.3.6. The term “System of Records Notice” (SORN), refers to a legal document that describes the kinds of personal data collected and maintained in a SOR, on whom it is maintained, what the records are used for, and how an individual may access or contest the records in the system. (Note:A SORN must be published in the Federal Register to allow the general public a 30 day opportunity to comment before implementing a SOR.);

2.1.3.7. The term “Personal Information” means all information that describes, locates or indexes anything about an individual including his/her education, financial transaction, medical history, criminal or employment record, or that affords a basis for inferring personal characteristics, such as biometric data including finger and voice prints, photographs, or things done by or to such individual; and the record of his/her presence, registration, or membership in an organization or activity, or admission to an institution;

2.1.3.8. The term “data subject” means an individual about whom personal information is indexed or may be located under his/her names, personal number, or other identifiable data, in an information system.

AFI33-332 12 JANUARY 2015 13

2.1.3.9. The term “Privacy Act Violation” means an agency has failed to notify an individual of a system of record(s) being maintained on them; allow an individual access to their record (unless an exemption applies); failure to have a system of record notice published to the federal register; unauthorized access; and obtain access to records under false pretenses.

2.1.3.10. The term “Privacy Act Request” means an individual has requested access to a specific record being maintained on them by an agency.

2.2. Privacy Act Responsibilities.

2.2.1. Air Force personnel or supporting contractors shall: (T-0)

2.2.1.1. Maintain a paper or electronic SOR only under the authority of an approved SORN published in the Federal Register.

2.2.1.2. Collect, maintain, and use information only for purposes described in the published SORN to support programs authorized by law or executive order and as implemented by DoD and AF prescribing directives.

2.2.1.3. Adequately safeguard records

2.2.1.4. Maintain records in accordance with (IAW) an approved Records Disposition

Schedule (RDS), which defines the time period records should be maintained and how to properly disposition records, including destruction.

2.2.1.5. Ensure records are timely, accurate, relevant, and complete.

2.2.1.6. Amend and correct information in a SOR upon request, as appropriate by the owner of the SOR.

2.2.1.7. Allow individuals to review and receive copies of record(s) that contain their personal information unless a statutory exemption applies.

(http://dpclo.defense.gov/Privacy/SORNs.aspx)

2.2.1.8. Ensure personal information which is accessible or viewable through SharePoint or similar web base applications are properly safeguarded to where only individuals who have an official need-to-know to conduct daily operations may gain access or view.

2.2.1.9. Remove personal information which is accessible through the use of SharePoint or similar web base applications, when no longer needed for daily operations and properly file IAW AF RDS.

2.2.1.10. Ensure personal information stored on shared drives, folders, and directories are accessible only to individuals whose official duties provide them a valid need-to-know.

2.2.1.11. Use Army Missile Research Development and Engineering Center Safe Access

File Exchange (AMRDEC SAFE) https://safe.amrdec.army.mil/safe/ or DoD

Encryption Wizard as alternate means of safeguarding personal information. (see AFI 41-

210, TRICARE Operations and Patient Administration Functions, for protecting HIPAA information)

2.2.1.12. Digitally sign and encrypt e-mail messages, or password protect any attachments containing personal information.

14 AFI33-332 12 JANUARY 2015

2.2.1.13. Provide personal information requested thru the Privacy Act at the requesters discretion. (e.g. personal e-mail (unencrypted), facsimile, first class mail, etc.)

2.2.1.14. Use official forms and similar tools that have been approved and published IAW

AFI 33-360, Publications and Forms Management, when collecting PII.

2.2.1.15. In Accordance With the Paper Reduction Act, an Office of Management and

Budget (OMB) control number shall be requested whenever information is being collected from ten or more members of the general public. This requirement may apply to Military or Government civilians whenever information is being collected outside their scope of their duty. (see AFI 33-324, The Air Force Information Collections And Reports

Management Program)

2.2.1.16. Ensure individuals are provided a Privacy Act Statement (PAS) whenever collected information is to be maintained in a System of Records. (see para 2.5., of this

Instruction)

2.2.2. Air Force personnel or supporting contractors shall not: (T-0)

2.2.2.1. Maintain a System of Records on individuals without their knowledge and/or without a SORN published to the Federal Register. Doing so is known as maintaining a

“Secret File” on an individual which is a violation of the Privacy Act. Personnel who fail to adhere to this paragraph may be punished under UCMJ Article 92(1) or a civil equivalent.

2.2.2.2. Keep records on how a person exercises First Amendment rights. First

Amendment rights include, but are not limited to, freedom of religion, freedom of political beliefs, freedom of speech, freedom of the press, the right to assemble, and the right to petition. EXCEPTIONS are when: the AF has the permission of that individual, the individual posts/sends the record directly to the AF, or is authorized by Federal statute; or the information pertains to and is within the scope of an authorized law enforcement activity.

2.2.2.3. Penalize or harass an individual for exercising rights guaranteed under the Privacy

Act.

2.2.2.4. Transmit informational materials or communications that contain personal information to or from personal or commercial e-mail accounts unless a written consent has been submitted by the individual who has requested their personal information to be sent to a personal or commercial e-mail account. In addition, the transmission of PHI is restricted, pursuant to guidance in AFI 41-210, Tricare Operations and Patient

Administration Functions, paragraph 6.16. Personnel who fail to adhere to this paragraph may be punished under UCMJ Article 92(1) or a civil equivalent.

2.2.2.5. Use auto-forwarding through multiple user accounts to circumvent CAC-based authentication and DoD encryption requirements.

2.2.2.6. Mail or courier sensitive electronic personal information on any removable media

(i.e. CDs, DVDs, hard drives, flash drives, or floppy disks) unless the data is encrypted

(see AFI 33-200, Information Assurance (IA) Management). (see para 6.2.2.5.2., 6.2.3.4.

or 6.2.4.4., of this publication)

AFI33-332 12 JANUARY 2015 15

2.2.2.7. Return failed hard drives to include copiers with internal hard drives, to a vendor for service if the device was ever used to store Personal Information, without ensuring all data has been permanently removed.

2.2.2.8. Leave personal information in unsecured vehicles, unattended workspaces, unsecured file drawers, or in checked baggage.

2.2.2.9. File personal notes in a SOR, as personal notes will be considered part of the SOR.

2.2.2.10. Use personal information for any other reason not stated under the purpose within the published SORN.

2.2.2.11. Pull data or information from an approved system of records to be added to an unapproved source for convenience or any other means. (Note: Doing so, the data is no longer in the location as prescribed in the SORN published in the federal register)

2.3. Privacy Act Complaints and Violations.

2.3.1. A privacy complaint is an allegation that an agency or its employees violated a specific provision of the Privacy Act of 1974, as amended regarding to the maintenance, amendment, or dissemination of personal information in a SOR. A privacy violation occurs when an agency or individual knowingly or willfully fails to comply with provisions of the Privacy Act.

2.3.2. Privacy Act complaints and violations must be submitted in written form to the servicing privacy manager.

2.3.3. Alleged Privacy Act complaints or violations are processed through the supporting

Privacy Manager. The Privacy Manager directs the process and provides guidance to the SOR owner. Issues that cannot be resolved at the local level shall be elevated to the

HAF/MAJCOM/FOA/DRU Privacy Manager, as appropriate.

2.3.4. Penalties for Violation. An individual may file a civil law suit against the AF for failing to comply with the Privacy Act. In addition to specific remedial actions, civil remedies include payment of damages, court costs, attorney fees in some cases against an AF employee. In addition to potential UCMJ actions, an AF employee may be subject misdemeanor criminal charges and a fine of up to $5,000 may be imposed if he/she;

2.3.4.1. Maintains a SOR without publishing the required SORN in the Federal Register or;

2.3.4.2. Willfully discloses personal information from a SOR, knowing that dissemination is prohibited, to anyone not entitled to receive the information.

2.3.5. Privacy Acts and Complaints Reporting Process:

2.3.5.1. The local Privacy Manager or SOR owner shall: (T-0)

2.3.5.1.1. Conduct an inquiry to determine if a formal investigation of the complaint or allegation of a Privacy Act violation is warranted.

2.3.5.1.2. Ensure a response is sent to the complainant through the Privacy Official.

(Note: for Privacy Act complaints filed in a U.S. District Court against the AF, an AF activity, or an AF employee, the Office of The Judge Advocate’s General Litigation

Division (AFLOA/JACL) shall provide SAF/A6XA a litigation summary in accordance with the format in Appendix 8 of DoD 5400.11-R, Department of Defense

16 AFI33-332 12 JANUARY 2015

Privacy Program.) When the court renders a formal opinion or judgment, AFLOA/JACL will send SAF/A6XA a copy of the judgment and opinion.

2.4. Maintaining Personal Information.

2.4.1. Each agency that maintains a SOR shall: (T-0)

2.4.2. Maintain in its records only information about an individual that is relevant and necessary to accomplish a purpose of the agency as required by a statute or executive order or their implementing regulations.

2.4.3. To the greatest extent practicable, collect personal information only directly from the subject individual when the information may result in adverse determinations about an individual's rights, benefits, and privileges under Federal programs.

2.4.3.1. Examples of when it is more practical to collect information from a third party instead of the subject individual include but are not limited to, the following:

2.4.3.1.1. Verification of information through third-party sources for security or employment suitability determinations.

2.4.3.1.2. Seeking third-party opinions such as supervisor comments as to job knowledge, duty performance, or other opinion-type evaluations.

2.4.3.1.3. Obtaining information first from the individual may impede rather than advance an investigative inquiry into the actions of the individual.

2.4.3.1.4. Contacting a third party at the request of the individual to furnish certain information, such as exact periods of employment, termination dates, copies of records, or similar information.

2.4.3.1.5. Implementing and enforcing safeguards to ensure protection of personal information.

2.4.4. Ensuring required Privacy Act Statement is provided to individuals when personal information is collected.

2.4.5. In Accordance With the Paper Reduction Act, an Office of Management and Budget

(OMB) control number shall be requested whenever information is being collected from ten or more members of the general public. This requirement may apply to Military or Government civilians whenever information is being collected outside their scope of their duty. (see AFI

33-324, The Information Collections and Reports Management Program: Controlling Internal, Public, and Interagency Air Force Information Collections)

2.5. Privacy Act Statements. (T-0)

2.5.1. Whenever an individual is requested to provide personal information that will be maintained in a SOR or collected on an official AF Form, the individual shall be provided the authority, purpose, routine use(s), whether disclosure of the information is voluntary or not;

and the applicable SORN. This is known as a Privacy Act Statement (PAS).

2.5.1.1. Authority: the legal authority that authorizes the solicitation of the personal information.

AFI33-332 12 JANUARY 2015 17

2.5.1.2. Purpose: the principal purpose or purposes for which the information is intended to be used.

2.5.1.3. Routine Uses: who will the personal information be shared with on a routine basis outside the DoD.

2.5.1.4. Disclosure: Voluntary or Mandatory. (Use mandatory only when disclosure is required by law and the individual will be penalized for not providing information. All mandatory disclosure requirements must first be reviewed by the servicing legal office).

Include any consequences of nondisclosure in nonthreatening language.

2.5.1.5. AF SORN(s), are searchable by number and title, and are available at:

http://dpclo.defense.gov/Privacy/SORNs.aspx (If applicable)

2.5.2. Privacy Act Advisory Statements in Publications. Include a Privacy Act Advisory

Statement in each AF publication that requires collecting or keeping personal information in a

SOR. Also include a statement when publications direct collection from the individual of any part or form of the Social Security Number (SSN). The statement shall refer to the legal authority for collecting the information and SORN number and title as follows: “This

Instruction requires the collection and or maintenance of information protected by the Privacy

Act of 1974 authorized by [set forth the legal authority such as the federal statute, executive order, and regulation]. The applicable SORN(s) [number and title] is (are) available at:

http://dpclo.defense.gov/Privacy/SORNs.aspx

2.5.3. Paper or electronic documents and/or materials that contain personal information such as a recall rosters, personnel rosters, lists or spreadsheets shall be marked “FOR OFFICIAL

USE ONLY” (see DoDM 5200.01, Volume 4, DoD Information Security Program: Controlled

Unclassified Information (CUI)) as follows:

2.5.3.1. “The information herein is FOR OFFICIAL USE ONLY (FOUO) information which must be protected under the Freedom of Information Act (5 U.S.C 552) and/or the

Privacy Act of 1974 (5 U.S.C. 552a). Unauthorized disclosure or misuse of this

PERSONAL INFORMATION may result in disciplinary action, criminal and/or civil penalties.”

2.5.4. All paper documents and printed materials that contain personal information shall be covered with the AF Form 3227, Privacy Act Cover Sheet or DD Form 2923, Privacy Act Data

Cover Sheet when removed from its approved storage area.

2.5.5. The Privacy Act requires agencies to provide safeguards to ensure the security and confidentiality of SOR and to protect individuals against an invasion of personal privacy.

2.5.6. Exercise caution before transmitting personal information via e-mail to ensure the message is adequately safeguarded. Some information may be so sensitive and personal that e-mail may not be the appropriate means of transmitting. (see DoDI 8500.01, Cybersecurity, ECCT-1 (Encryption for Confidentiality (Data at Transmit)).

2.5.7. When transmitting personal information over e-mail, encrypt and add “For Official Use

Only” (“FOUO”) to the beginning of the subject line and apply the following statement at the beginning of the e-mail: "This e-mail contains FOR OFFICIAL USE ONLY (FOUO) information which must be protected under the Freedom of Information Act (5 U.S.C 552) and/or the Privacy Act of 1974 (5 U.S.C. 552a). Unauthorized disclosure or misuse of this

18 AFI33-332 12 JANUARY 2015

PERSONAL INFORMATION may result in disciplinary action, criminal and/or civil penalties. Further distribution is prohibited without the approval of the author of this message unless the recipient has a need-to-know in the performance of official duties. If you have received this message in error, please notify the sender and delete all copies of this message.”

(Note: Do not indiscriminately apply this statement to all e-mails. Use it only in situations when you are actually transmitting personal information required to be protected For Official Use Only purposes. (see DoDM 5200.01, Volume 4 DoD Information Security Program: Controlled

Unclassified Information (CUI)) . The guidance in this paragraph does not apply to appropriate releases of personal information to members of the public via e-mail, such as pursuant to the

Freedom of Information Act, or with the consent of the subject of the personal information.)

2.6. Publishing System of Records Notices (SORNs). Records that are retrieved by a personal and/or a unique identifier are subject to the Privacy Act of 1974 requirements and are referred to as a system of records (SOR). The AF Privacy Officer will submit SORNs to the Defense Privacy and Civil Liberties Office (DPCLO) to be published in the Federal Register for new, changed or deleted SOR. When published, the public will be allowed 30 days to comment. Collection of this information is not authorized until the SORN is final, including during this 30 day review period.

If comments are received that result in a contrary determination, this could further delay the time until a final SORN is published and collection may occur. Any collection conducted prior to finalizing the SORN is an illegal collection and can result in civil penalties under the Privacy Act

Of 1974 5 U.S.C. § 552a as amended, (i)(1) Criminal Penalties.

2.6.1. When is a SORN required? A SORN is required when personal information is maintained on an individual and is regularly retrieved by a name, number, symbol, or other identifying particular (i.e. data) assigned to the individual. The Privacy Act requires submission of new or significantly changed SORNs to the Office of Management and Budget

(OMB) and both houses of Congress before publication in the Federal Register. This applies when:

2.6.1.1. Starting a new system. (Add).

2.6.1.1.1. Preamble.

2.6.1.1.2. Narrative.

2.6.1.1.3. Final SORN write up.

2.6.1.2. Instituting significant changes to an existing system. (Alter).

2.6.1.2.1. Preamble.

2.6.1.2.2. Narrative.

2.6.1.2.3. Changes.

2.6.1.2.4. Final write-up with changes.

2.6.1.3. Minor changes to an existing system. (Admin).

2.6.1.3.1. Changes.

2.6.1.3.2. Final write-up with changes.

AFI33-332 12 JANUARY 2015 19

2.6.2. Other Systems. National Security SORs require a SORN. While some or many of these systems may be classified, the SORN is written in an unclassified manner describing the nature of the collection of PII. (see DoD 5400.11-R, for the use and establishment of exemptions that may apply to these systems).

2.6.3. Adopting Existing SORN. A new or existing SOR may be incorporated into an existing

SORN published in the Federal Register:

2.6.3.1. First, research current SORNs, including those that cover systems of records government-wide and DoD-wide on the Defense Privacy Notices website at http://dpclo.defense.gov/Privacy/SORNs.aspx for one that matches well with the new

SOR at all points, i.e., Category of Individuals Covered, Category of Records, Authority, Purposes, Routine Uses, Policies, etc.

2.6.3.2. Second, if necessary, contact the current SORN owner through the POC information on the SORN to discuss altering or amending their SORN to include the new

AF SOR and POC information.

2.6.3.3. Provide the system owner the altered or amended SORN for their review and processing.

2.6.4. Updating SORNs. Examples for Adding, Altering, Amending, and Deleting a SORN are available on the AF Information Access SharePoint and the AF Privacy Website.

2.6.5. Submitting SORNs for Publication in the Federal Register. The PM must submit the proposed SORN through their MAJCOM/FOA/DRU Privacy Manager at a minimum of 120 days before the planned implementation date of a new SOR or a change to an existing SOR subject to this Instruction. The Privacy Manager shall review for accuracy and completeness and send electronically to the AF Privacy Office usaf.pentagon.saf-cio-a6.mbx.af-privacy@mail.mil. The AF Privacy Office shall review and forward to DPCLO for review and publishing in the Federal Register, as appropriate. (T-1)

2.6.6. Requirement for periodic review of published SORNs. PMs use the Air Force Biennial

SORN Accuracy Review Checklist (Attachment 13) to document the validity, accuracy, relevance, timeliness and necessity of their published SORNs, coinciding with Appendix I to

OMB Circular A-130, (Federal Agency Responsibilities for Maintaining Records about

Individuals). PMs review and submit any changes through the process described in this chapter and promptly update appropriate answers to EITDR questions.

2.6.7. Deletion of SORNs. If your IT system is being decommissioned or closed and has a published SORN that is no longer required, comply with DoD 5400.11-R, Department of

Defense Privacy Program, subpar C6.5.3., Deletion of System of Records Notices and submit appropriate amendment or deletion request to the AF Privacy Office, usaf.pentagon.saf-cio-a6.mbx.af-privacy@mail.mil to be forwarded to DPCLO to have the SORN deleted from the

Federal Register.

2.7. Privacy Act Records Request. Persons or their designated representatives may ask for a copy of their records maintained in a SOR. Requesters need not state why they want access to their records. Personnel that receive requests must verify the identity of the requester to avoid unauthorized disclosures. How their identity is verified will depend on the sensitivity of the requested records. Identity can be verified in a number of ways, to include visually, personal

20 AFI33-332 12 JANUARY 2015

knowledge of the requester, a signed letter, or a request via telephone as appropriate or e-mail, a notarized statement, or an unsworn statement. An unsworn declaration or notarized statement should be obtained in the following format:

2.7.1. Requesting Access to Records in a SOR.

2.7.1.1. Contents of Request. “I declare under penalty of perjury (if outside the United

States, add “under the laws of the United States of America”) that the foregoing is true and correct. Executed on (date)(Signature).”

2.7.1.1.1. Description of Records. The requester must adequately describe the records they want. The requester is not required to name a SOR, but they should at least name a type of record or functional area. For requests that ask for “all records about me,” the requester should be asked for more information about the types of records they are seeking and informed as to how their input can help the AF respond as quickly as possible. If the requester needs help identifying types of systems or records, provide them information to review the government-wide systems of records published in the

Federal Register and AF specific SORNs published at http://dpclo.defense.gov/Privacy/SORNs.aspx. Ensure they understand that identifying the relevant SORN(s) will make the AF review more efficient. If the requester is truly requesting all records pertaining to themselves or an individual, inform the requester they must make a FOIA request.

2.7.1.1.2. Provide Verification of Identity.

2.7.1.2. Use of a Government Resource to Make a Request is prohibited.

2.7.2. Processing a Request for Access to Records in a SOR. Immediately consult the local

Privacy Manager, if necessary, to ensure timely response to the request. When individuals request information about themselves, they are not required to cite either the Privacy Act or

Freedom of Information Act (FOIA). The individual who processes the request will apply the

Privacy Act when records are contained in a SOR and will apply the FOIA to all other records.

2.7.2.1. Acknowledge Request. As a good practice SOR owner should send the requester an acknowledgement letter within 10 workdays informing them of an approximate completion date.

2.7.2.2. Required Response. As a good practice SOR owner should provide a copy of the record(s) to the requester within 20 workdays of receiving the request. If the SOR has an exemption, inform the requestor of those exemptions in a format the requester can understand. If the system is exempt from disclosure under the Privacy Act, follow the procedures addressed in paragraph 2.11.

2.7.3. Denying or Limiting Access. When information protected under the Privacy Act may not be…