AFI 33-332.pdf

BY ORDER OF THE

SECRETARY OF THE AIR FORCE

AIR FORCE INSTRUCTION 33-332

10 MARCH 2020

Corrective Actions applied on 12 May 2020

Communication and Information

AIR FORCE PRIVACY AND CIVIL

LIBERTIES PROGRAM

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

ACCESSIBILITY: Publications and forms are available on the e- Publishing website at www.e-Publishing.af.mil for downloading or ordering.

RELEASABILITY: There are no releasability restrictions on this publication.

OPR: SAF/CNZA

Supersedes: AFI33-332, 12 January 2015

Certified by: SAF/CNZ

(Ms. Wanda Jones-Heath)

Pages: 62

This instruction implements Air Force Policy Directive (AFPD) 33-3, Information Management.

This instruction applies to all Regular Air Force, Air Force Reserve, Air National Guard, civilian employees, contractors in the performance of their duties to an Air Force contract, and the Civil

Air Patrol when performing functions for the Air Force. Failure to observe the prohibitions and mandatory provisions in paragraphs 3.1.2 and 4.2.12.4, of this publication by military members is a violation of Article 92 of the Uniform Code of Military Justice (UCMJ). Air National Guard members not serving in a federal status who violate the mandatory provisions in paragraphs

3.1.2 and 4.2.12.4 may be punished under their respective state military codes or applicable administrative action may be taken, as appropriate. Personnel not in a federal status are subject to their respective state military code or applicable administrative actions, as appropriate. Civilians who violate information security policy may be disciplined in accordance with AFI 36-704, Discipline and Adverse Actions of Civilian Employees or AFI 34-301, Nonappropriated Funds

Personnel Management and Administration. In addition to this instruction, Air Force medical organizations that meet the definition of a covered entity must also comply with DoDI 6025.18, Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance In DoD

Health Care Programs, DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs; and Air Force Manual (AFMAN) 41-210, TRICARE Operations and Patient Administration, which covers Protected Health Information (PHI) held by them. The authorities to waive wing/unit level requirements in this publication are identified with a Tier

(“T-0, T-1, T-2, T-3”) number following the compliance statement. See AFI 33-360, Publications and Forms Management, for a description of the authorities associated with the Tier http://www.e-publishing.af.mil/

2 AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020

numbers. Submit requests for waivers through the chain of command to the appropriate Tier waiver approval authority, or alternately, to the requestor’s commander for non-tiered compliance items. Ensure all records generated as a result of processes prescribed in this publication adhere to Air Force Instruction 33-322, Records Management and Information

Governance Program and are disposed in accordance with the Air Force Records Disposition

Schedule which is located in the Air Force Records Information Management System. Use of the term “Major Command” (MAJCOM) throughout this AFI includes Headquarters AF (HAF), MAJCOMs, Field Operating Agencies (FOAs), Direct Reporting Units (DRUs), and the Air

Force Installation Mission Support Center (AFIMSC). Refer recommended changes and questions about this instruction to the Office of Primary Responsibility (OPR) using the AF

Form 847, Recommendation for Change of Publication; route through the appropriate functional chain of command. Send supplements and implementing publications of this instruction to the

Deputy Chief Information Officer, Compliance Division (SAF/CNZA), 1800 Air Force

Pentagon, Washington, DC 20330-1800 for review and coordination prior to publication. The use of the name or mark of any specific manufacturer, commercial product, commodity, or service in this publication does not imply endorsement by the Air Force. This instruction includes reference to trade name and trademarks such as SharePoint®.

SUMMARY OF CORRECTIVE ACTIONS

This document was corrected last on 12 May 2020 to update the training requirements published in 5 May 2020 corrective action related to the rewrite published on 10 March 2020. Changes to paragraphs 2.8.6 Annual training; 2.8.6.1. Awareness Training and 2.8.6.2. Specialized

Training language revised. Replaced 2.8.7.4. Training title and added link to “Identifying and

Safeguarding Personally Identifiable Information (PII),” https://public.cyber.mil//. All references to “Cyber Awareness Challenge” removed previously cited in earlier editions. This correction supersedes previous corrective actions published 5 May 2020 on paragraphs 2.8.6, 2.8.6.1, 2.8.6.2; 2.8.7.4 and 3.2.5. Training changed to Cyber Awareness Challenge and annual requirement were updated. Deleted paragraphs 2.8.6.3, 2.8.6.4 and 2.8.6.5 The Newcomers orientation requirement deleted.

SUMMARY OF CHANGES

This document has been substantially revised and needs to be completely reviewed. Major changes include revising guidance to comply with the E-Government Act of 2002, Office of

Management and Budget Circulars No. A-130, Managing Information as a Strategic Resource and A-108, Federal Agency Responsibilities for Review, Reporting, and Publication under the

Privacy Act and Office of Management and Budget Memorandum Circular No. 17-12, Preparing for and Responding to a Breach of Personally Identifiable Information.

Chapter 1—PRIVACY OVERVIEW 6

1.1. Privacy Overview

1.2. Civil Liberties Overview

1.3. Personally Identifiable Information (PII)

https://public.cyber.mil/

AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020 3

Chapter 2—ROLES AND RESPONSIBILITIES 8

2.1. The Deputy Chief Information Officer (SAF/CN) shall:

2.2. SAF/IG and AF/A1 shall:

2.3. The Senior Component Official for Privacy (SCOP) shall:

2.4. The AF Privacy Officer shall:

2.5. The Office of The Judge Advocate General (AF/JA)

2.6. Assistant Secretary of the Air Force, General Counsel of the Air Force

(SAF/GC)

2.7. AF Departmental Forms Management Officer shall:

2.8. MAJCOM and Wing Commanders shall:

2.9. MAJCOM and Base Privacy Managers/Monitors shall:

2.10. MAJCOM and base legal offices shall:

2.11. MAJCOM and base Civil Liberties POCs shall:

2.12. Unit Privacy Monitor shall:

2.13. Functional Level Information System Owner (ISO), Program Manager/Project

Manager

2.14. Records Professionals shall:

Chapter 3—BREACH REPORTING 16

3.1. PII Breach Reporting

3.2. Guidelines for conducting an inquiry of a PII Incident

Chapter 4—THE PRIVACY ACT OF 1974 19

4.1. Overview of the Privacy Act of 1974

4.2. Privacy Act Responsibilities

4.3. Privacy Act Complaints and Violations

4.4. Maintaining Privacy Act Information

4.5. Privacy Act Statements

4.6. Publishing System of Records Notices (SORNs)

4.7. Privacy Act Records Request

4.8. Amending a Privacy Act Record

4 AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020

4.9. Approving or Denying a Record to be Amended

4.10. Contents of Privacy Act Processing Case Files

4.11. First Party Appeal Process for Denial to Access or Amendment of a Privacy Act

Record

4.12. Disclosing Information

4.13. Computer Matching

4.14. Privacy Act Exemptions

Chapter 5—E-GOVERNMENT ACT 32

5.1. Overview of the E-Government Act of 2002, 44 USC § 3601

5.2. Privacy Impact Assessments (PIA)

Chapter 6—SOCIAL SECURITY NUMBER (SSN) REDUCTION PLAN 35

6.1. Social Security Number (SSN) Reduction Plan

6.2. The Specific Requirement for Use of the SSN

6.3. Alternative Means of Identifying Records

6.4. Protection of SSN

6.5. Reporting Results of Social Security Number Reduction

Chapter 7—PROTECTING RECORDS 38

7.1. Protecting Records

7.2. Protecting Personal information or PII Maintained in an Electronic System

7.3. Maintain a paper or electronic System of Records (SOR) only under the authority of an approved SORN published in the Federal Register (T-0)

7.4. Storing of controlled unclassified information

Chapter 8—CIVIL LIBERTIES 42

8.1. Amendments

8.2. Basic Guidelines

8.3. Civil Liberties Semi-Annual Report

8.4. Reprisal For Making Complaint:

8.5. Civil Liberties Training Tools

AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020 5

Attachment 1—GLOSSARY OF REFERENCES AND SUPPORTING INFORMATION 44

Attachment 2—EXAMPLES OF PRIVACY ACT STATEMENT AND ADVISORY

STATEMENT 52

Attachment 3—RISK ASSESSMENT 53

Attachment 4—EXAMPLE PRIVACY BREACH NOTIFICATION LETTER OFFICIAL

LETTERHEAD 54

Attachment 5—PREPARING A DOD SSN JUSTIFICATION MEMORANDUM 55

Attachment 6—APPROVED DOD TRAINING WEBSITES 56

Attachment 7—NOTIONAL COMPLAINT VIGNETTES 57

Attachment 8—CIVIL LIBERTIES COMPLAINT REPORT INSTRUCTIONS 60

Attachment 9—EXAMPLE COMPONENT PRIVACY AND CIVIL LIBERTIES REPORT

(DD FORM 2984) 62

6 AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020

Chapter 1

PRIVACY OVERVIEW

1.1. Privacy Overview.

1.1.1. What is privacy? Although there is not an official government definition of privacy, it generally refers to the notion of individuals maintaining control over their own information.

For the Air Force, the framework of privacy requirements includes the Privacy Act of 1974, Title 5 United States Code (USC) Section 552a, Public Law 107-347, Section 208, The E-

Government Act of 2002, Office of Management and Budget policy, Department of Defense

(DoD) policy, and Air Force policy. Failure to protect privacy can bring about risks to the individual, such as identity theft, and risks to the Air Force, such as lawsuits for inappropriate disclosure that divert critical resources away from our mission.

1.1.2. What information must be protected? The information protected by the various components of the privacy framework is discussed using multiple terms.

1.2. Civil Liberties Overview.

1.2.1. Civil liberties are fundamental rights and freedoms protected by The Constitution of the United States. These freedoms, which include the right to privacy, are concentrated primarily in the Bill of Rights.

1.2.2. Individuals who feel any of the following provided examples (the list is not exhaustive) has been violated shall seek direction through their servicing Inspector General office; (See AFI 90-301, Inspector General Complaints Resolution).

1.3. Personally Identifiable Information (PII).

1.3.1. Office of Management and Budget Memorandum M-17-12, Preparing for and

Responding to a Breach of Personally Identifiable Information – “The term PII refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. PII may range from common data elements such as names, addresses, dates of birth, and places of employment, to identity documents, Social Security numbers (SSN) or other government-issued identity, precise location information, medical history, and biometrics. Because there are many different types of information that can be used to distinguish or trace an individual’s identity the term PII is necessarily broad..

1.3.2. Office of Management and Budget Memorandum 10-22, Guidance for Online Use of

Web Measurement and Customization Technologies - The definition of PII is not anchored to any single category of information or technology. Rather, it demands a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-PII can become PII whenever additional information is made publicly available – in any medium and from any source – that, when combined with other available information, could be used to identify an individual.

1.3.3. For safeguarding of Personal Identifiable Information, please refer to DoD 5400.11-R, Department of Defense Privacy Program (C1.4, C4 and Appendix 1).

AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020 7

1.3.4. PII maintained in a System of Record accessed or handled by contractors. It is imperative that contractors, required to access or handle PII on behalf of the Air Force, follow this instruction. For this reason, organizations with contractors that access and handle

PII will coordinate with contracting officials to ensure that contract require compliance with this instruction. (T-1). Additionally, organizations will coordinate with contracting officers to ensure contracts contain the proper Privacy Act clauses: 52.224-1, Privacy Act

Notification, and 52.224-2, Privacy Act as required by the Federal Acquisition Regulation

(See website at: https://www.acquisition.gov/browse/index/far .) Contracting Officers will also require non-disclosure agreements for contractors who will have access to sensitive PII.

(T-0). Note: All contracts either need the Network Penetration or Cloud DFAR clauses to comply with the requirements for contractors protecting PII in OMB Memo 17-12.

1.3.5. Contracts will be reviewed annually by the Contracting Officer Representative to ensure compliance with this instruction. (T-0).

1.3.6. Disclosure of PII maintained in a System of Records to contractors for use in the performance of an Air Force contract is considered an official use disclosure within the agency under exception (b)(1) of the Privacy Act and protected as an inter/intra-Agency disclosure per Freedom of Information Act exemption (b)(5).

https://www.acquisition.gov/browse/index/far

8 AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020

Chapter 2

ROLES AND RESPONSIBILITIES

2.1. The Deputy Chief Information Officer (SAF/CN) shall:

2.1.1. Establish procedures to ensure compliance with the Privacy Act and the DoD privacy program. (T-0).

2.1.2. Appoint a Senior Component Official for Privacy (SCOP) with overall responsibility for the AF privacy program. (T-0).

2.1.3. Appoint an AF Privacy Officer with responsibility for implementing the AF privacy program. (T-0).

2.2. SAF/IG and AF/A1 shall:

2.2.1. Coordinate with SAF/GC and AF/JA on any Privacy or Civil Liberty matter, review, or investigation, that does any of the following: affect or involve the Secretariat; represent a significant litigation risk; impact major AF programs; materially impact the rights or benefits of an AF organization; affect ownership or use of AF property; attract Congressional interest;

attract widespread media interest; raise a matter of first impression for the legal community;

or otherwise affect the legal basis for an AF program or activity. (T-0).

2.2.2. Identify and report Civil Liberties complaint allegations received and processed by

Inspector General or Equal Employment Opportunity and Military Equal Opportunity offices on a semi-annual basis. (T-1).

2.2.3. Submit complaint(s) with Civil Liberties implications to the AF Civil Liberties POC using the DD Form 2984, Component Privacy and Civil Liberties Report. (See Attachment

9). Reports are forwarded directly by unencrypted e-mail without identifying PII to the AF

Privacy and Civil Liberties workflow e-mail at usaf.pentagon.saf-cn.mbx.af-privacy@mail.mil. (T-1).

2.2.4. Provide Civil Liberties reporting requirements to the MAJCOM IG offices. (T-1).

2.3. The Senior Component Official for Privacy (SCOP) shall:

2.3.1. Ensure DoD and AF proposals, policies, or programs having privacy implications are evaluated to ensure consistency with privacy principles. (T-0).

2.3.2. Ensure the AF privacy program is periodically reviewed by the Inspector General or other officials who have specialized knowledge of the privacy policies. (T-0).

2.3.3. Supervise and oversee management of the AF Privacy Program as administered by the

AF Privacy Officer. (T-0).

2.3.4. The SCOP or the AF Privacy Officer will serve as the AF representative on the

Defense Privacy Board and the Defense Data Integrity Board, which are administered through the Defense Privacy, Civil Liberties, and Transparency Division. (T-0).

2.3.5. Designated as the AF Civil Liberties Officer. (T-0).

2.3.6. Oversee the AF Civil Liberties program with execution by the AF Civil Liberties point of contact (POC). (T-0).

mailto:usaf.pentagon.saf-cn.mbx.af-privacy@mail.mil

AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020 9

2.3.7. Review and approve AF Civil Liberties reports prior to submission to Defense

Privacy, Civil Liberties, and Transparency Division. (T-0).

2.4. The AF Privacy Officer shall:

2.4.1. Administer guidance and procedures prescribed in this instruction and DoD policies, develop Air Force policy to ensure protection of PII, and provide guidance and assistance to

Privacy Managers. (T-1).

2.4.2. Conduct mandatory reviews of publications and forms for compliance with this instruction. (T-1).

2.4.3. Review and approve Privacy Impact Assessments (PIA) for submission to SAF/CN for approval (see paragraph 5.2). (T-1)

2.4.4. Review and submit proposed new, modified, and deleted System of Records Notice

(SORN) to Defense Privacy, Civil Liberties, and Transparency Division. (T-1).

2.4.5. Review and approve SSN justification memos for continued use of SSN. (T-1).

2.4.6. Report Privacy Breaches to the Defense Privacy, Civil Liberties, and Transparency

Division within the prescribed timelines and track and monitor breach trends to improve guidance and procedures. (T-1).

2.4.7. Prepare and submit reports as required to Defense Privacy, Civil Liberties, and

Transparency Division. (T-1).

2.4.8. Provide guidance and support to the field to ensure information systems which are developed to collect, maintain, process, or disseminate personal information conform to the

Privacy Act, Office of Management and Budget, DoD, and AF requirements. (T-1).

2.4.9. Coordinate with SAF/CNZ, Information System Security Office, to ensure appropriate

Information Assurance (IA) Control procedures are applied by Information System Owners, Program/Project Managers and Portfolio Managers during the Certification and Accreditation

(C&A) process to protect Privacy Act information throughout the IT system life cycle. (T-1).

2.4.10. Serve as the AF representative on the Defense Privacy Board and the Defense Data

Integrity Board, which are administered through the Defense Privacy, Civil Liberties and

Transparency Division. (T-1).

2.4.11. Designated as the AF Civil Liberties POC. (T-1).

2.4.12. Serve as the AF member on the Defense Civil Liberties board. (T-1).

2.4.13. Provide policy and direction for the AF Civil Liberties program. (T-1).

2.4.14. Review AF publications and policies to support the proper protection of Civil

Liberties. (T-1).

2.4.15. Compile and submit the AF semi-annual Civil Liberties report to the Defense

Privacy and Civil Liberties Office. (T-1).

2.4.16. Provide Secretary of the Air Force (SAF)/General Counsel (GC) and AF/JA with copies of the AF semi-annual Civil Liberties report for situational awareness. (T-1).

2.4.17. Provide training and training materials to MAJCOM Privacy and Civil Liberties points of contact (POC). (T-1).

10 AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020

2.4.18. Approve the computer matching request. (T-1).

2.5. The Office of The Judge Advocate General (AF/JA).

2.5.1. AF/JA, primarily through the Administrative Law Directorate (AF/JAA) and the Air

Force Legal Operations Agency Civil Law and Litigation Directorate (AFLOA/JAC) shall:

2.5.1.1. Provide legal advice on Civil Liberties and Privacy matters to the Department of the Air Force Staff, AF Civil Liberties Officer, Privacy Officer/Civil Liberties POC. (T-

1).

2.5.1.2. Provide Civil Liberties reporting requirements to MAJCOM Equal Opportunity offices. (T-1).

2.5.1.3. Review Civil Liberties semi-annual Reports for legal sufficiency. (T-1).

2.5.1.4. Provide lead litigation support as necessary. (T-1).

2.5.1.5. Coordinate with SAF/GC as appropriate. (T-1).

2.5.2. Nothing in paragraph 2.5 or its subparagraphs is inconsistent with Headquarters Air

Force Mission Directive (HAFMD) 1-14, General Counsel and The Judge Advocate

General.

2.6. Assistant Secretary of the Air Force, General Counsel of the Air Force (SAF/GC).

2.6.1. SAF/GC shall:

2.6.1.1. Provide coordination on any Civil Liberty matters, reviews, investigations, or legal opinions that represent a significant litigation risk, impact major AF programs, materially impact the rights or benefits of an AF organization, effect ownership or use of

AF property, engender Congressional interest, attract widespread media interest, raise a matter of first impression for the legal community, or otherwise affect the legal basis for an AF program or activity. (T-1).

2.6.1.2. Coordinate with AF/JA as appropriate. (T-1).

2.6.2. Nothing in this paragraph is inconsistent with Headquarters Air Force Mission

Directive (HAFMD) 1-14, General Counsel and The Judge Advocate General. (T-1).

2.7. AF Departmental Forms Management Officer shall:

2.7.1. Maintain a database of both new and existing forms reviewed to produce an annual report every July 1. This report shall be submitted to the AF Privacy Officer as input into the

Privacy section of the annual Federal Information Security Management Act (FISMA) report as required by Title 44 United States Code Chapter 35, Subchapter III, Confidential

Information Protection and Statistical Efficiency. (T-1).

2.7.2. Ensure OPRs for new and revised forms that collect personal information have the appropriate notice as required in this instruction. Coordination is made with the supporting

Privacy Manager/Monitor before publishing. Final publishing packages must contain a completed AF Form 673, Air Force Publication/Form Action Request in accordance with

AFI 33-360; and if applicable, the associated SORN and AF Privacy Officer approved SSN justification memo. (T-0).

AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020 11

2.8. MAJCOM and Wing Commanders shall:

2.8.1. Establish a Privacy and Civil Liberties Office(s) and appoint in writing, a command

Privacy Manager/Monitor to execute command responsibilities as outlined in this instruction.

The same will apply at installation-level where the Wing Commander will appoint an installation Privacy Manager/Monitor and Civil Liberties POC and report to their respective command. (T-1).

2.8.2. Establish policies to notify MAJCOM/Wing Commanders of Privacy Act Violations, complaints and breaches. (T-1.

2.8.3. Establish policies to implement and enforce the AF Privacy and Civil Liberties

Programs to include directing organization SharePoint® site owners or Site Collection

Administrators to perform a monthly scan of SharePoint® sites. If unprotected PII data is discovered during the scan then delete and/or safeguard PII and submit a collective PII breach report (Department of Defense Form 2959). (T-1).

2.8.4. Ensure all assigned AF personnel are aware of and understand the requirements within this publication. (T-1).

2.8.5. Ensure all privacy and civil liberties related issues or concerns are brought to the attention of servicing Privacy Manager/Monitor, Civil Liberties POC or the AF Privacy

Officer. (T-0).

2.8.6. Ensure all assigned personnel have completed required annual privacy training;

2.8.6.1. Awareness Training is required by statute for all federal employees (civilian, military and contractor), which focuses on the individuals’ role and responsibilities of the

Privacy Act (See para 4.2) and safeguarding PII. (T-0).

2.8.6.2. Specialized Training focuses on the privacy requirements for individuals or managers who maintain a System of Records (SORs) or manage PII on a regular basis.

(T-0).

2.8.7. Privacy Act Training Tools. Helpful resources include:

2.8.7.1. The Privacy Act web page includes a Privacy Overview, Privacy Act training, Resources, AF SORNs, and links to the Defense Privacy Board Advisory Opinions, the

DoD and Department of Justice Privacy web pages. Go to https://www.privacy.af.mil/.

2.8.7.2. “The Privacy Act of 1974,” a 32-minute film developed by the Defense Privacy

Office. Contact the Joint Visual Information Services Distribution Activity at DSN 795-

6543 or commercial (570) 895-6543, and ask for #504432 “The Privacy Act of 1974.”

2.8.7.3. Training slides for use by Privacy Managers/Monitors are available in the

“Information Access SharePoint® Site.”

https://cs2.eis.af.mil/sites/10440/infoacc/privacy/forms/allitems.aspx.

2.8.7.4. DISA web based training “Identifying and Safeguarding Personally Identifiable

Information (PII),” https://public.cyber.mil//.

2.8.8. Ensure organizational Commanders and Equivalents have (examples of commander equivalents include MAJCOM Director, Director of Staff, Civilian Director of an organization, or a Commandant of a school).

https://www.privacy.af.mil/ https://cs2.eis.af.mil/sites/10440/infoacc/privacy/forms/allitems.aspx

12 AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020

2.8.8.1. Reinforce the importance of safeguarding PII and ensure personnel who fail to safeguard PII are counseled or disciplined as appropriate. (T-0).

2.8.8.2. Direct an inquiry to determine the circumstances and impact of privacy breaches in accordance with Chapter 3 of this instruction. (T-0).

2.8.8.3. Ensure coordination and teamwork is accomplished between Information System

Owner (ISO), Program (PM), Information System Security Manager (ISSM), Information

System Security Officer (ISSO), and Privacy Managers. (T-0).

2.8.8.4. Ensure assigned personnel are aware of and understand the requirements within this instruction. (T-1).

2.8.8.5. Ensure additional privacy training is incorporated into in-house training, as needed. (T-0).

2.9. MAJCOM and Base Privacy Managers/Monitors shall:

2.9.1. Provide direction and training to commanders and personnel implementing this instruction. (T-1).

2.9.2. Track assigned personnel privacy training. (T-1).

2.9.3. Provide specialized training to individuals who handle privacy information on a daily or routine basis. (T-1).

2.9.4. Promote privacy awareness throughout the organization and assist commanders with establishing procedures to reinforce the protection of personal information or PII. (T-1).

2.9.5. Report privacy breaches and provide direction to organizations where the breach occurred. (T-1).

2.9.6. Provide direction to assist with resolution of Privacy Act complaints or violations. (T-

1).

2.9.7. Review and process Privacy Act Request denial recommendations. (T-1).

2.9.8. Review all publications and forms drafted by staff OPRs for compliance with this instruction. (Note: Publications drafted for a higher level should be reviewed by the Privacy

Manager at the level of the OPR. Review organizational publications and forms for compliance with this instruction.) (T-1).

2.9.9. Provide updates of Privacy Managers name, office symbol, phone number, FAX number, unclassified e-mail address to the Privacy Manager in their chain of command who in turn shall forward a copy to the AF Privacy Officer for continuity. (T-1).

2.9.10. Submit semi-annual privacy reports and/or other required reports as directed by the

AF Privacy Officer. Semi-annual privacy reports may consist of the number of SORNs reviewed, privacy complaints, and training provided; complaints will be categorized as follows:

2.9.10.1. Process and Procedural: For actions concerning consent, collection, and appropriate notice (T-1).

2.9.10.2. Redress: Privacy Act inquiries seeking resolution of difficulties or concerns about Privacy matters. (T-1).

AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020 13

2.9.10.3. Operational: Inquiries regarding Privacy Act matters not including Privacy Act requests for access and/or correction. (T-1).

2.9.10.4. Referrals: Complaints received but referred to another office with jurisdiction over the complaint. (T-1).

2.9.11. Conduct Staff Assistance Visits (SAVs)/Command Unit Inspections if budget permits to ensure compliance and health of privacy programs. (T-1).

2.9.12. Base Privacy Managers provide direction to ISO, ISSM/ISSO, and Program

Manager/Project Manager for properly completing a SORN or PIA (to include signing off on the DD 2930). (T-1).

2.9.13. Assist ISO/Program Manager/Project Manager with reviewing SORNs and PIAs to coincide with their IT system review cycles. Coordination and teamwork are required between ISO, ISSM/ISSO, Program Manager/Project Manager and Privacy Manager. (T-1).

2.9.14. Maintain copies of approved inventories of records (formerly known as file plans) with System of Records for the purpose of identifying records protected under the Privacy

Act of 1974 to assist with inspections. (T-1).

2.9.15. Address all privacy and civil liberties complaints, issues or concerns with leadership and the Air Force Privacy Officer/Civil Liberties POC. (T-1).

2.9.16. Monitor/Track Annual SORNs Review. (T-1).

2.9.17. Monitor/Track Annual PIA Review. (T-1).

2.10. MAJCOM and base legal offices shall:

2.10.1. On a semi-annual basis, identify and report Civil Liberties complaint allegations addressed in Commander Directed Investigation reports and Article 138 complaints that have been reviewed for legal sufficiency. (T-0).

2.10.2. Submit Civil Liberties complaints contained in the Commander Directed

Investigations and Article 138 complaints to the Civil Liberties POC, through AF/JAA, using the DD Form 2984. (See Attachment 9). Reports are forwarded by unencrypted e-mail without identifying PII. (T-0).

2.10.3. Provide advice to the Civil Liberties POCs. (T-1).

2.10.4. Provide advice to the Privacy Officer/Manager/Monitor, commanders, and supervisors on requests made under the Privacy Act, the Freedom of Information Act, PII breaches, and other aspects of the AF Privacy and Civil Liberties program.

2.11. MAJCOM and base Civil Liberties POCs shall:

2.11.1. Administer direction and procedures prescribed in this instruction. (T-1).

2.11.2. Ensure training is available for their organizations. (T-1).

2.11.3. Provide updates regarding the Civil Liberties POCs’ names, office symbols, voice number, and unclassified e-mail addresses to the AF Civil Liberties POC. (T-1).

2.11.4. Promote Civil Liberties awareness throughout their organizations. (T-1).

14 AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020

2.11.5. Direct complaints that may have Civil Liberties implications to the appropriate investigative office, such as the IG, Equal Opportunity, or the appropriate commanding officer for commander directed investigations. (T-0).

2.12. Unit Privacy Monitor shall:

2.12.1. Provide direction and training to commanders and personnel implementing this instruction. (T-1).

2.12.2. Promote privacy awareness throughout the organization and assist commanders/equivalent with implementing procedures to reinforce the protection of PII. (T-

1).

2.12.3. Track assigned personnel privacy training. (T-1).

2.12.4. Provide specialized training to individuals who handle personal information or PII on a daily or routine basis. (T-1).

2.12.5. Review organizational publications and forms for privacy compliance with this instruction. (T-1).

2.12.6. Provide direction to the commander/equivalent to assist with resolution of privacy breaches, complaints, and violations. (T-1).

2.12.7. Submit semi-annual reports and/or other required reports as directed by their respective privacy manager. Semi-annual reports will consist of the number of SORNs reviewed, privacy complaints, and training provided; complaints should be categorized as follows:

2.12.7.1. Process and Procedural: For actions concerning consent, collection, and appropriate notice. (T-1).

2.12.7.2. Redress: Privacy Act inquiries seeking resolution of difficulties or concerns about Privacy matters. (T-1).

2.12.7.3. Operational: Inquiries regarding Privacy Act matters not including Privacy Act requests for access and/or correction. (T-1).

2.12.7.4. Referrals: Complaints received but referred to another office with jurisdiction over the complaint. (T-1).

2.12.8. Maintain copies of approved inventories of records (formerly known as file plans) with the System of Records for the purpose of identifying records protected under the

Privacy Act of 1974 to assist with conducting inspections or Privacy Act request. (T-1).

2.13. Functional Level Information System Owner (ISO), Program Manager/Project

Manager (PM), Information System Security Managers (ISSM) shall:

2.13.1. Implement privacy safeguards, complete PIAs and SORNs. Direction will be provided by supporting Privacy Manager (See Chapters 3 and 4 and DoDI 5400.16, DoD

Privacy Impact Assessment (PIA) Guidance). (T-0).

2.13.2. Determine early in the design phase of IT systems what personal information will be collected, used, processed, stored, or disseminated in the electronic systems of records. (T-0).

AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020 15

2.13.3. Formulate Privacy Act requirements in early stages of IT systems design, development, and data management to plan for and implement Information Assurance (IA) controls to safeguard PII. (T-0).

2.13.4. Ensure records containing PII are safeguarded or removed as required from all IT systems prior to disposal, replacement, or reuse of IT hardware storage components (hard drives) in accordance with IA directives. (T-0).

2.13.5. Review applicable SORN(s) for information systems concurrently with the FISMA annual review to validate whether changes to an existing SORN is required. (T-0).

2.13.6. Review IT systems registered in the Information Technology Investment Portfolio

Suite, addresses and updates responses to privacy questions. Failure to do so may risk system non-concurrence by the AF Privacy Officer during annual compliance review, certification, decertification, or request for funding. (T-0).

2.13.7. The ISO is responsible for calculating the PII Confidentiality Impact Level (PCIL) value with the MAJCOM Privacy Officer’s concurrence for all IT investments handling PII.

In cases of disagreement, the MAJCOM Privacy Officer or ISO may raise the PCIL determination to the AF Privacy Officer for review and final determination. Documentation of the PCIL calculation may be requested upon elevation. See paragraph 5.2.3.4 for a sample PCIL calculation worksheet. (T-0).

2.14. Records Professionals shall: Coordinate with Privacy Managers/Monitors to ensure records identified on inventories of records (formerly known as file plans) as a System of

Records have an approved SORN. (T-0).

16 AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020

Chapter 3

BREACH REPORTING

3.1. PII Breach Reporting. Refer to Office of Management and Budget (OMB) Memorandum

17-12 (3 January 2017), Preparing for and Responding to a Breach of Personally Identifiable

Information, Office of the Secretary of Defense Memorandum (2 August 2012), Use of Best

Judgement for Individual Personally Identifiable Information (PII) Breach Notification

Determinations, Office of the Secretary of Defense Memorandum (OSD 06227-09, dated 5 June

2009), Safeguarding Against and Responding to the Breach of Personally Identifiable

Information (T-0).

3.1.1. Per OMB Memorandum 17-12, “A PII breach is defined as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose.”

3.1.2. Potential or actual breaches must be reported to the servicing Privacy

Manager/Monitor by anyone discovering it. Failure by military members to obey the mandatory provision is this paragraph is a violation of Article 92(1) of the UCMJ. (T-0).

Civilians who violate information security policy may be disciplined in accordance with AFI

36-704, Discipline and Adverse Actions of Civilian Employees. (T-0).

3.1.3. AFIMSC must provide immediate notice to the servicing Base Privacy Manager for any breaches reported from Air Force Cyber, 68th Network Warfare Squadron. (T-1).

3.1.4. The servicing Privacy Manager/Monitor shall submit a Preliminary PII Breach Report by unencrypted e-mail according to the timeline below: (T-1).

3.1.5. PII Breach Reports shall be completed using Department of Defense Form 2959, Breach of Personally Identifiable Information (PII) Report provided by Defense Privacy and

Civil Liberties Office located on the AF Privacy Website: www.privacy.af.mil (T-0).

3.1.6. Use for preliminary, updates, and final reports.

3.1.6.1. Reports shall not include names of individuals involved or affected by the breach. Reports will be forward by unencrypted e-mail through the serving MAJCOM

Privacy Manager, who in turn shall notify the AF Privacy Office by official unencrypted e-mail (usaf.pentagon.saf-cn.mbx.af-privacy@mail.mil) attaching the written

Preliminary PII Breach Report. (T-0).

3.1.6.2. Notify the United States Computer Emergency Readiness Team within one hour of discovering that an electronic breach of personally identifiable information has occurred. (T-0).

3.1.6.3. The Wing Commander shall submit an initial Operational Report if it is determined the breach may have an impact on organizational operations, potential media attention and affects more than 5,000 individuals. (T-1).

3.1.6.4. Within 24 hours of the notification of a PII breach, the servicing Privacy

Manager where the incident occurred shall notify the senior official (O6/GS-15, or http://www.privacy.af.mil/

AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020 17

higher) in the chain of command and simultaneously notify the MAJCOM Privacy

Manager by official unencrypted e-mail (Non-Classified Internet Protocol Router

Network) attaching the Preliminary PII Breach Report. (T-1).

3.1.6.5. Within 24 hours of being notified of the PII breach, the MAJCOM Privacy

Manager shall notify the AF Privacy Office by official unencrypted e-mail

(usaf.pentagon.saf-cn.mbx.af-privacy@mail.mil) attaching the written Preliminary PII

Breach Report. (T-1).

3.1.6.6. Within 48 hours of the PII breach notification the AF Privacy Officer shall upload the report into the Defense Privacy, Civil Liberties and Transparency Division

Reporting Management Tool. (T-0).

3.1.6.7. Until resolved, the underlying issues that led to the breach shall continue to be reported as needed in an Update PII Breach Report by the serving Privacy

Manager/Monitor to the AF Privacy Office in accordance these reporting procedures. (T-

0).

3.1.6.8. The servicing Privacy Manager shall send the PII Breach Final Report when resolved in the same routing as previous notifications along with a final operational report (if applicable). (T-0).

3.2. Guidelines for conducting an inquiry of a PII Incident. The senior-level individual who is in the chain of command shall appoint an investigating official (recommend E-7 or above or equivalent civilian employee) for the organization where the actual or possible loss, theft or compromise of information occurred to conduct an inquiry of the incident to determine if it is an actual breach, the cause and if a there was any criminal intent that would warrant a criminal investigation. (T-1).

3.2.1. The servicing Privacy Manager or Privacy Monitor shall provide guidance to the appointed investigating official to properly complete the Final PII Breach Report and reference AFI and DoD Policies and the Privacy Act for use in completing the inquiry as required. (T-1).

3.2.2. The appointed investigating official shall review the initial Preliminary PII Breach

Report and independently assess the handling of the breach. They shall make clarifications and additions on the Final PII Breach Report as required, and submit to the appointing senior-level individual. The senior-level individual will determine if notification to affected individuals is required after a risk analysis has been completed. The senior-level individual will also determine if any corrective actions should be taken. (T-0).

3.2.3. Upon concurrence with Final PII Breach Report recommendations, the senior-level individual in the chain of command for the organization where the loss, theft or compromise occurred shall route the Final PII Breach Report to the appropriate level Privacy Manager within five days. (T-1).

3.2.4. Commanders/Directors shall ensure notifications are sent to individuals once a decision has been made as to whether there may be any impact towards the individual(s).

Notification will be sent to affected individual(s) within 10 working days after a breach is confirmed and the identities of the affected individual(s) ascertained by a senior official

18 AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020

(O6/GS-15 and higher) in the chain of command for the organization where the breach occurred. (T-0).

3.2.5. Commanders/Directors shall ensure that individuals who are responsible for causing the breach receive remedial training entitled, “Identifying and Safeguarding Personally

Identifiable Information (PII),” located at https://public.cyber.mil/.

3.2.5.1. Commanders may also take any appropriate disciplinary action. (T-1).

3.2.6. United States Computer Emergency Response Team Reported PII Incidents.

According to Chairman Joint Chiefs of Staff Manual 6510.01B, Cyber Incident Handling

Program, Enclosure C, “When a Computer Network Defense Service Provider discovers compromised or potentially compromised PII, they must notify the United States Computer

Emergency Response Team and their servicing Privacy Office.” United States Computer

Emergency Response Team is responsible for analyzing and reducing cyber threats, vulnerabilities, disseminating cyber threat warning information, and coordinating incident response activities. United States Computer Emergency Response Team shall follow through on Computer Network Defense Service Provider detections of PII Incidents by notifying the

Information Security Officer and Program/Project Manager of the web application and/or

Information Technology system cited. (T-0).

3.2.7. The information security officer and Program/Project Manager of the application or system from which the breach occurred, must notify the servicing privacy manager or monitor. That servicing privacy manager shall make appropriate breach notifications established by AF Policy and DoD reporting guidance. (T-0).

AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020 19

Chapter 4

THE PRIVACY ACT OF 1974

4.1. Overview of the Privacy Act of 1974.

4.1.1. Under the Privacy Act of 1974, The Congress finds the following:

4.1.1.1. The privacy of an individual is directly affected by the collection, maintenance, use, and dissemination of personal information by Federal agencies is protected under

The Constitution of the United States.

4.1.2. Provides certain safeguards for an individual against an invasion of personal privacy.

It does this by requiring Federal agencies, except as otherwise provided by law, to:

4.1.2.1. Permit an individual to determine what records pertaining to him/her are collected, maintained, used, or disseminated by such agencies or be made available without his/her consent.

4.1.2.2. Permit an individual to gain access to information pertaining to him/her in

Federal agency records, to have a copy made of all or any portion thereof, and to correct or amend such records.

4.1.2.3. Collect, maintain, use, or disseminate any record of identifiable personal information in a manner that assures that such action is for a necessary and lawful purpose, that the information is current for its intended use, and that adequate safeguards are provided to prevent misuse of such information.

4.1.2.4. Permit exemptions from the requirements with respect to records provided in the

Privacy Act only in those cases where there is an important public policy need for such exemption as has been determined by specific statutory authority.

4.2. Privacy Act Responsibilities.

4.2.1. Air Force personnel shall:

4.2.2. Collect, maintain, and use information only for purposes described in the published

SORN to support programs authorized by law or executive order and as implemented by

DoD and AF prescribing directives. (T-0).

4.2.3. Adequately safeguard records. (T-0). (See chapter 7, Protecting Records).

4.2.4. Maintain records in accordance with an approved Records Disposition Schedule, which defines the time period records should be maintained and how to properly disposition records, including destruction. (T-0).

4.2.5. Ensure records are timely, accurate, relevant, and complete. (T-0).

4.2.6. Amend and correct information in a SOR upon request, as appropriate by the owner of the SOR. (T-0).

4.2.7. Allow individuals to review and receive copies of record(s) that contain their personal information unless a statutory exemption applies. (T-0).

20 AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020

4.2.8. Provide personal information requested through the Privacy Act at the requester’s discretion. (e.g., personal e-mail (unencrypted), facsimile, first class mail). (T-0).

4.2.9. Use official forms and similar tools that have been approved and published in accordance with AFI 33-360, when collecting PII. (T-0).

4.2.10. Ensure individuals are provided a Privacy Act Statement whenever collected information is to be maintained in a System of Records (see paragraph 4.5, of this instruction). (T-0).

4.2.11. Request an OMB control number whenever information is being collected from ten or more members of the general public, in accordance with the Paperwork Reduction Act, Title 44 United States Code Section 3501. This requirement may apply to Military or

Government civilians whenever information is being collected outside the scope of their duty. (See AFI 33-324, The Air Force Information Collections And Reports Management

Program. (T-0).

4.2.12. Air Force personnel (to include contractors) shall not:

4.2.12.1. Maintain a System of Records on individuals without their knowledge and/or without a System of Records Notice published to the Federal Register. Doing so is known as maintaining a “Secret File” on an individual which is a violation of the Privacy Act.

Failure by military members or a civilian equivalent to obey the mandatory provision in this paragraph is a violation of Article 92(1) of the UCMJ. (T-0).

4.2.12.2. Keep records on how a person exercises First Amendment rights. First

Amendment rights include, but are not limited to, freedom of religion, freedom of political beliefs, freedom of speech, freedom of the press, the right to assemble, and the right to petition. EXCEPTIONS are when: the AF has the permission of that individual, the individual posts/sends the record directly to the AF, or is authorized by Federal statute; or the information pertains to and is within the scope of an authorized law enforcement activity. (T-0).

4.2.12.3. Penalize or harass an individual for exercising rights guaranteed under the

Privacy Act. (T-0).

4.2.12.4. Transmit informational materials or communications that contain personal information to or from personal or commercial e-mail accounts unless a written consent has been submitted by the individual who has requested their personal information to be sent to a personal or commercial e-mail account. In addition, the transmission of PHI is restricted, pursuant to guidance in AFMAN41-210 paragraph 6.16. Failure by military members to obey the mandatory provision in this paragraph is a violation of Article 92(1) of the UCMJ. (T-0). Civilians who violate information security policy may be disciplined in accordance with AFI 36-704, Discipline and Adverse Actions of Civilian Employees.

4.2.12.5. Use auto-forwarding through multiple user accounts to circumvent CAC-based authentication and DoD encryption requirements. (T-0).

4.2.12.6. File personal notes in a SOR, as personal notes will be considered part of the

SOR. (T-0).

4.2.12.7. Use personal information for any other reason not stated under the purpose within the published SORN. (T-0).

AFI33-332 10 MARCH 2020CORRECTIVEACTIONSAPPLIED12MAY2020 21

4.2.12.8. Pull data or information from an approved system of records to be added to an unapproved source for convenience or any other means. (Note: Doing so, the data is no longer in the location as prescribed in the SORN published in the federal register.) (T-0).

4.3. Privacy Act Complaints and Violations.

4.3.1. A privacy complaint is an allegation that an agency or its employees violated a specific provision of the Privacy Act of 1974, as amended, regarding the maintenance, amendment, or dissemination of personal information in a SOR. A privacy violation occurs when an agency or individual knowingly or willfully fails to comply with provisions of the

Privacy Act.

4.3.2. Privacy Act complaints and violations must be submitted in written form to the servicing privacy manager. (T-0).

4.3.3. Alleged Privacy Act complaints or violations are processed through the supporting

Privacy Manager. The Privacy Manager directs the process and provides guidance to the

SOR owner. Issues that cannot be resolved at the local level shall be elevated to MAJCOM

Privacy Manager, as appropriate. (T-1).

4.3.4. Penalties for Violation. An individual may file a civil law suit against the AF for failing to comply with the Privacy Act. An AF employee may be subject misdemeanor criminal charges and a fine of up to $5,000 may be imposed if he/she:

4.3.4.1. Maintains a SOR without publishing the required SORN in the Federal Register or;

4.3.4.2. Willfully discloses personal information from a SOR, knowing that dissemination is prohibited, to anyone not entitled to receive the information.

4.3.5. Privacy Act and Complaints Reporting Process.

4.3.5.1. The local Privacy Manager or SOR owner shall:

4.3.5.1.1. Conduct an inquiry to determine if a formal investigation of the complaint or allegation of a Privacy Act violation is warranted. (T-0).

4.3.5.1.2. Ensure a response is sent to the complainant through the Privacy Official.

(Note: For Privacy Act complaints filed in a U.S. District Court against the AF, an

AF activity, or an AF employee, AFLOA/JAC shall provide SAF/CNZA a litigation summary in accordance with the format in Appendix 8 of DoD 5400.11-R. When the court renders a formal opinion or judgment, the Office of The Judge Advocate’s

General Litigation Division will send SAF/CNZA a copy of the judgment and opinion. (T-1).

4.4. Maintaining Privacy Act Information. Each organization that maintains a SOR shall:

4.4.1. Maintain in its records only information about an individual that is relevant and…