55007r11.pdf

UNCLASSIFIED

NI 5500.7R11 Approved: 8 September 2009

NGA Instruction for Privacy Program Implementation

1. References.

a. Primary. NGA Instruction NI5500.7R10, DoD Privacy Program Implementation, 7 August 2007.

b. Secondary References. Secondary references are listed in appendix 1.

2. Purpose. The National Geospatial-Intelligence Agency (NGA) privacy program provides governance, policy, outreach, reporting, and operational structure for the agency to adequately adhere to federal, Department of Defense (DoD), and Intelligence Community (IC) privacy requirements. This instruction supersedes NI 5500.7R10, same title, 7 August 2007.

3. Policy. NGA implements information privacy protections required by federal laws, regulations, and policies relating to information privacy within the context of the IC to safeguard information it maintains about the public, including federal employees and mission partners who serve alongside NGA in its mission.

4. Applicability and Scope. This instruction applies to all NGA organizations and directorates. This instruction provides the construct of the NGA Privacy Program and outlines key roles and responsibilities.

5. Definitions. Definitions are located in appendix 2.

6. Responsibilities.

a. Director of NGA (D/NGA).

(1) Oversees implementation of the NGA privacy program.

(2) Designates the Senior Agency Official for Privacy (SAOP) in accordance with Office of Management and Budget (OMB) Memorandum M-05-08, “Designation of Senior Agency Officials for Privacy” as a role of the NGA Chief Information Officer (CIO).

b. Senior Agency Official for Privacy (SAOP).

(1) Oversees the NGA Privacy Program Office (PPO).

(2) Maintains overall responsibility and accountability for ensuring the NGA privacy program is effective and complies with appropriate federal laws, regulations, and policies.

NI 5500.7R11

(3) Designates, as appropriate, an agency employee as the Chief Privacy Officer (CPO) to oversee daily performance and implementation of privacy responsibilities within NGA.

(4) Ensures that privacy protections are integrated into the NGA governance and security processes.

(5) Directs NGA offices to implement measures to protect the personally identifiable information (PII) that NGA collects, stores, or transmits from unauthorized access, use, or disclosure.

(6) Conducts regular self-reviews of NGA’s privacy program to promptly identify and mitigate deficiencies, weaknesses, or risks.

(7) Directs NGA office(s) to implement measures to mitigate or remediate identified privacy risks and issues.

(8) Administers NGA’s compliance efforts, including review of NGA’s information privacy policies and procedures and performance reporting to external oversight authorities.

(9) Administers privacy training and education programs for all NGA employees and contractors.

(10) Develops and implements privacy policies, instructions, and directives within NGA to protect PII from unauthorized use, access, disclosure.

(11) Oversees development and implementation of required privacy documentation.

(12) Makes unclassified NGA privacy documentation available to the public according to federal requirements.

(13) Maintains a record of NGA unclassified and classified privacy documentation.

c. General Counsel. The General Counsel serves as the primary point of contact for legal review and advice with respect to the agency’s privacy program.

d. Office of General Counsel (OGC).

(1) Processes Privacy Act and Freedom of Information Act (FOIA) requests received by NGA. For further guidance, see NI 5500.8 Privacy Act Records Handling.

(2) Provides legal review and determination regarding disclosure of records covered under the Privacy Act by NGA, such as disclosures made pursuant to routine uses.

(3) Provides legal review and approval of NGA privacy documentation and training in coordination with the PPO.

e. Office of the Inspector General (OIG).

(1) Receives allegation of unlawful maintenance, disclosure, or destruction of records that fall under the Privacy Act and conducts investigations if necessary.

(2) Responds to requests by individuals for access, correction, or amendments to OIG records.

f. Directorate and Office Directors.

(1) Ensures privacy controls such as, but not limited to, business processes, privacy risk mitigation and technical safeguards, and privacy documentation are implemented at the system level.

(2) Ensures participation in the privacy documentation development and revision processes for systems owned by key components (KC), including appointment of a Program Manager or System Owner to serve as the point of contact to whom the PPO can direct system-specific questions. This POC serves as a direct liaison with the PPO and OGC for system information and development of privacy documentation.

(3) Ensures required privacy documentation is maintained for all applicable systems within the respective directorate.

(4) Ensures all federal employees and contractors within the directorate complete the required privacy training and education programs.

g. Program Managers / System Owners.

(1) Implements privacy controls at the system level.

(2) Coordinates with the PPO regarding the development and implementation of applicable privacy requirements at the system level.

(3) Ensures required privacy documentation is completed for all systems within their responsibility.

7. Procedures. Detailed procedures for implementing the NGA Privacy Program are addressed in the materials located in the privacy section of the Privacy Program Office

(PPO) Web site on Intellipedia at http://www.intelink.ic.gov/wiki/NGA_Privacy_Program_Office. These procedures provide additional guidance on privacy-related issues, such as the Privacy Act, System of Records Notice (SORN) and Privacy Impact Assessment (PIA), reporting for Federal Information System Management Act (FISMA) and Agency Privacy Management, and the employee rules and responsibilities relating to privacy. Office of General Counsel will be responsible for providing procedures for Freedom of Information Act (FOIA) requests and procedures for disclosure of records covered under the Privacy Act.

http://www.intelink.ic.gov/wiki/NGA_Privacy_Program_Office

NI xxxx.x Appendix

XXXXXX

Appendix 1 References

1. NCD 8000-022, Senior Agency Official for Privacy (SAOP), 8 January 2009.

2. NI 5500.8, Privacy Act Records Handling, [insert date here].

3. DoD Directive 5400.11, DoD Privacy Program, 8 May 2007.

4. DoD Memorandum, Safeguarding Against and Responding to the Breach of

Personally Identifiable Information, 05 June 2009.

5. Office of Management and Budget (OMB) Memorandum M-05-08, Designation of

Senior Agency Officials for Privacy, 11 February 2005.

6. E-Government Act of 2002, Section 208, Pub. L. No. 107-347.

7. Privacy Act of 1974, as amended, 5 USC 552a.

Comment [N1]: Add date when NI is published.

Appendix 2 Definitions

1. Federal Personnel. Officers and employees of the Government of the United States, members of the uniformed services (including members of the Reserve Components).

Individuals entitled to receive immediate or deferred retirement benefits under any retirement program of the Government of the United States.

2. Federal Register. The official daily publication for rules, proposed rules, and notices of federal agencies and organizations as well as executive orders and other presidential documents. The Federal Register is published by the Office of the Federal Register, National Archives and Records Administration (NARA).

3. Privacy Documentation. Privacy-related documents required by federal privacy laws or policies and agency regulations. Privacy documentation reduces the privacy risk for the agency and facilitates greater understanding of NGA data inventory and data flows.

Examples of privacy documentation include system of records notices (SORN) as required by the Privacy Act of 1974 (5 U.S.C. 552a); privacy impact assessments (PIA) as required by Section 208 of the E-Gov Act of 2002 (P.L. 107-347); and the Information System Identification Questionnaire and Information System Comprehensive Questionnaire as required by NCP 8000-XX, “Privacy Impact Assessment (PIA) and System of Records Notice (SORN) Process.” Privacy Documentation does not include privacy-related materials that fall under the purview of the OGC. Examples of privacy-related materials under the purview of the OGC include privacy reports submitted on behalf of NGA to the Office of Management and Budget (OMB) or Congress.

4. Personally Identifiable Information (PII). Information about an individual that identifies, links, relates, or is unique to, or describes him or her, e.g., a Social Security Number; age; military rank; civilian grade; medical, and financial information, etc. and includes information which can be used to distinguish or trace an individual’s identity, such as date and place of birth, mother’s maiden name, and biometric records, including any other personal information which is linked or linkable to a specific individual.

Biometric records include photographic image, voice print, finger print, etc.

5. Privacy Impact Assessment (PIA). Process for examining the risks and ramifications of using information technology to collect, maintain, and disseminate information in identifiable form and for identifying and evaluating protections and alternative processes to mitigate the impact to privacy of collecting such information.

6. Record. Any item, collection, or grouping of information about individuals that is maintained by an agency, including, but not limited to, their education, financial transactions, and/or medical, criminal, or employment history and that contains their name; or it contains the identifying number, symbol, or other identifying information assigned to the individual, such as a finger or voice print or a photograph.

7. System of Records (SOR). Group of records about individuals that is maintained by a federal agency, or by an organization on behalf of a federal agency, in which information is retrieved by name or other identifier assigned to a particular individual.

8. System of Records Notice (SORN). Statement providing to the public notice of the existence and character of a system of records.