Appendix 4 - NARA Directive 1608_NARAs Privacy Program and Supplement.pdf

This document is a NARA (National Archives and Records Administration) internal policy directive (NARA 1608) detailing the organization's Privacy Program. The policy establishes guidelines for protecting personally identifiable information (PII) for all NARA employees, contractors, foundation staff, interns, volunteers, and others with access to NARA IT systems or records. It defines PII as information that can distinguish or trace an individual's identity, including names, Social Security Numbers, biometric records, and other identifying details.

The directive outlines comprehensive responsibilities for various roles, including the General Counsel, Chief Privacy Officer, Chief Information Officer, and NARA Breach Response Team. Key responsibilities include conducting privacy risk assessments, managing privacy implications of agency activities, developing breach response policies, and ensuring compliance with federal privacy laws such as the Privacy Act of 1974 and E-Government Act of 2002. The policy emphasizes minimizing PII collection, protecting sensitive information, and holding users accountable for proper handling of personal data, with potential administrative or criminal penalties for non-compliance.