Privacy Impact Assessment (PIA) Flashcards

Under which U.S. federal law are agencies required to conduct a Privacy Impact Assessment (PIA) before developing or procuring information technology that collects, maintains, or disseminates personally identifiable information (PII)?

Answer: The E-Government Act of 2002

Section 208 of the E-Government Act of 2002 specifically mandates PIAs for federal IT systems that collect or use PII. The Privacy Act of 1974 governs records systems but does not require PIAs. FISMA addresses security programs, and the Clinger-Cohen Act addresses IT acquisition and management.

What is the MAIN difference between a Privacy Threshold Analysis (PTA) and a full Privacy Impact Assessment (PIA)?

Answer: A PTA determines whether a system collects PII and whether a full PIA is required, while a PIA provides the comprehensive privacy analysis

A PTA is a preliminary screening tool that identifies whether a system handles PII at a level that triggers the requirement for a full PIA. If the PTA determines that PII is collected and a PIA threshold is met, the organization proceeds to develop the comprehensive PIA. They are sequential, not interchangeable.

Which of the following scenarios would MOST likely require the agency to conduct a new or updated Privacy Impact Assessment?

Answer: A new module is added to an existing system that begins collecting Social Security Numbers from users

A new PIA (or update to an existing one) is required when a system undergoes a significant change that creates new privacy risks — such as collecting a new category of PII like Social Security Numbers. Routine patches, backup policy changes, and personnel changes do not constitute PIA-triggering system changes.

According to OMB guidance, which of the following must be TRUE about a completed PIA for a federal system?

Answer: It must be made publicly available on the agency's website unless the system is national security-related

OMB guidance requires agencies to make PIAs publicly available, typically on their official websites, to promote transparency about how the government handles personal information. Exceptions exist for national security systems or where disclosure would reveal sensitive information. PIAs are not classified, DHS-reviewed, or submitted to Congress.

A federal system that maintains a group of records about individuals retrievable by a personal identifier (such as name or SSN) is BEST described as which of the following?

Answer: A System of Records (SOR) subject to the Privacy Act

Under the Privacy Act of 1974, a System of Records (SOR) is defined as a group of records under agency control from which information is retrieved by the name of an individual or by an identifying number, symbol, or other identifier. Systems of Records require a System of Records Notice (SORN) published in the Federal Register.

During a PIA, an agency determines that a new web portal will collect users' home addresses and date of birth. Which analysis BEST demonstrates that the agency is applying fair information practice principles (FIPPs)?

Answer: Documenting the legal authority for collection, the purpose, and the planned retention and disposal schedule for the data

Fair Information Practice Principles (FIPPs) require agencies to document the legal authority for collection, limit collection to what is necessary (data minimization), state the purpose, and define retention and disposal. While encryption and ATOs are important security measures, they address confidentiality and authorization — not the privacy-specific FIPPs that PIAs are designed to analyze.