Assistance System (GLAAS) Privacy UNITED STATES · PDF fileUNITED STATES AGENCY FOR...

Global Acquisition and Assistance System (GLAAS) Privacy Impact Assessment (PIA)

UNITED STATES AGENCY FOR INTERNATIONAL DEVELOPMENT

Office of the Chief Information Officer (M/CIO) Information Assurance Division

Global Acquisition and Assistance System (GLAAS) Approved Date: November 19, 2014

Additional Privacy Compliance Documentation Required:

☐ None

☐ System of Records Notice (SORN)

☐ Open Data Privacy Analysis (ODPA)

☐ Privacy Act Section (e)(3) Statement or Notice (PA Notice)

☐ USAID Web Site Privacy Policy

☐ Privacy Protection Language in Contracts and Other Acquisition‐Related Documents

☐ Role‐Based Privacy Training Confirmation Possible Additional Compliance Documentation Required:

☐ USAID Forms Management. ADS 505

☐ Information Collection Request (ICR). ADS 505, ADS 506, and ADS 508 Privacy Program

☐ Records Schedule Approved by the National Archives and Records Administration. ADS 502

Global Acquisition and Assistance System (GLAAS) Privacy Impact Assessment Date Approved: November 19, 2014

ii

TableofContents

1 Introduction.............................................................................................................................................1

2 Information..............................................................................................................................................1

2.1 Program and System Information ....................................................................................... 1

2.2 Information Collection, Use, Maintenance, and Dissemination ......................................... 4

3 PrivacyRisksandControls................................................................................................................6

3.1 Authority and Purpose (AP) ................................................................................................ 6

3.2 Accountability, Audit, and Risk Management (AR) ............................................................. 7

3.3 Data Quality and Integrity (DI) ............................................................................................ 8

3.4 Data Minimization and Retention (DM) ............................................................................. 8

3.5 Individual Participation and Redress (IP) ............................................................................ 9

3.7 Transparency (TR) ............................................................................................................. 10

3.8 Use Limitation (UL) ........................................................................................................... 11

3.9 Third‐Party Web Sites and Applications ........................................................................... 12


1

1 IntroductionThe USAID Privacy Office is using this Privacy Impact Assessment (PIA) Template to gather information from program managers, system owners, and information system security officers in order to analyze USAID information technology and information collections (systems) that collect, use, maintain, or disseminate personally identifiable information (PII). See ADS 508 Privacy Program Section 503.3.5.2 Privacy Impact Assessments.

2 Information

2.1 ProgramandSystemInformation

2.1.1 DescribethePROGRAManditsPURPOSE.

The Global Acquisition and Assistance System (GLAAS) primary objective is to provide a solution that supports acquisition and assistance management activities and the management of procurement documents that are generated by USAID. Acquisition and assistance management includes all aspects of the procurement life cycle (i.e., procurement planning, requisition , solicitation /funding opportunity, award, and closeout) and secure integration with Phoenix, USAID's financial management system.

The GLAAS and Phoenix Financial Integration is designed to process requests and awards as commitments and obligations in Phoenix in real time. GLAAS requests and awards as well as modifications must be initiated in GLAAS.

2.1.2 DescribetheSYSTEManditsPURPOSE.

The Global Acquisition and Assistance System (GLAAS) supports the Agency's acquisition and assistance (A&A) management life cycle. GLAAS provides support for the end‐to‐end A&A business processes performed by a wide variety of Agency staff, from the development of the Advance Procurement Plan (APP) through requisition, solicitation or funding opportunity, award, and award closeout. GLAAS supports an acquisition and assistance workflow that involves many people in numerous roles throughout the Agency, and around the world to create and manage contracts, grants, and cooperative agreements. GLAAS users include requestors, Program Officers, Agreement Officers, Contracting Officers, Contracting Officers Representative/Agreement Officers Representative, Negotiators, Program Managers, Obligation Recorders, Financial Management Officers, and others.


2

2.1.3 WhatistheSYSTEMSTATUS?

☐ New System Development or Procurement

☐ Pilot Project for New System Development or Procurement

☒ Existing System Being Updated

☐ Existing Information Collection Form or Survey OMB Control Number:

☐ New Information Collection Form or Survey

☐ Request for Dataset to be Published on an External Website

☐ Other:

2.1.4 WhattypesofINFORMATIONFORMATSareinvolvedwiththeprogram?☐ Physical only

☐ Electronic only

☒ Physical and electronic combined

2.1.5 Doesyourprogram participateinPUBLICENGAGEMENT?

☒ No.

☐ Yes:

☐ Information Collection Forms or Surveys

☐ Third Party Web Site or Application

☐ Collaboration Tool

2.1.6 Whattypeofsystemand/orTECHNOLOGYisinvolved?

☒ Infrastructure System (Local Area Network, Wide Area Network, General Support System, etc.)

☐ Network

☒ Database

☒ Software

☒ Hardware

☐ Mobile Application or Platform

☐ Mobile Device Hardware (cameras, microphones, etc.)

☐ Quick Response (QR) Code (matrix geometric barcodes scanned by mobile devices)

☐ Wireless Network

☐ Social Media


3

2.1.6 Whattypeofsystemand/orTECHNOLOGYisinvolved?

☐ Web Site or Application Used for Collaboration with the Public

☐ Advertising Platform

☐ Website or Webserver

☒ Web Application

☐ Third‐Party Website or Application

☐ Geotagging (locational data embedded in photos and videos)

☐ Near Field Communications (NFC) (wireless communication where mobile devices connect without contact)

☐ Augmented Reality Devices (wearable computers, such as glasses or mobile devices, that augment perception)

☐ Facial Recognition

☐ Identity Authentication and Management

☐ Smart Grid

☐ Biometric Devices

☐ Bring Your Own Device (BYOD)

☐ Remote, Shared Data Storage and Processing (cloud computing services)

☒ Other: IaaS at Terremark.

☐ None

2.1.7 Aboutwhattypesofpeopledoyoucollect,use,maintain,ordisseminatepersonalinformation?

☐ Citizens of the United States

☐ Aliens lawfully admitted to the United States for permanent residence

☐ USAID employees and personal services contractors

☐ Employees of USAID contractors and/or services providers

☐ Aliens

☐ Business Owners or Executives

☒ Others: Vendors (whether businesses or people)

☐ None


4

2.2 InformationCollection,Use,Maintenance,andDissemination

2.2.1 Whattypesofpersonalinformationdoyoucollect,use,maintain,ordisseminate?

☒ Name, Former Name, or Alias

☐ Mother’s Maiden Name

☐ Social Security Number or Truncated SSN

☐ Date of Birth

☐ Place of Birth

☐ Home Address

☐ Home Phone Number

☒ Personal Cell Phone Number

☐ Personal E‐Mail Address

☒ Work Phone Number

☐ Work E‐Mail Address

☐ Driver’s License Number

☐ Passport Number or Green Card Number

☐ Employee Number or Other Employee Identifier

☐ Tax Identification Number

☐ Credit Card Number or Other Financial Account Number

☐ Patient Identification Number

☐ Employment or Salary Record

☐ Medical Record

☐ Criminal Record

☐ Military Record

☐ Financial Record

☐ Education Record

☐ Biometric Record (signature, fingerprint, photo, voice print, physical movement, DNA marker, retinal scan, etc.)

☐ Sex or Gender

☐ Age


5

2.2.1 Whattypesofpersonalinformationdoyoucollect,use,maintain,ordisseminate?

☐ Other Physical Characteristic (eye color, hair color, height, tattoo)

☐ Sexual Orientation

☐ Marital status or Family Information

☐ Race or Ethnicity

☐ Religion

☐ Citizenship

☐ Other:

☐ No PII is collected, used, maintained, or disseminated

2.2.2 Whattypesofdigitalormobiledatadoyoucollect,use,maintain,ordisseminate?

☒ Log Data (IP address, time, date, referrer site, browser type)

☐ Tracking Data (single‐ or multi‐session cookies, beacons)

☐ Form Data

☒ User Names

☒ Passwords

☐ Unique Device Identifier

☐ Location or GPS Data

☐ Camera Controls (photo, video, videoconference)

☐ Microphone Controls

☐ Other Hardware or Software Controls

☐ Photo Data

☐ Audio or Sound Data

☐ Other Device Sensor Controls or Data

☐ On/Off Status and Controls

☐ Cell Tower Records (logs, user location, time, date)

☐ Data Collected by Apps (itemize)

☐ Contact List and Directories

☐ Biometric Data or Related Data


6

2.2.2 Whattypesofdigitalormobiledatadoyoucollect,use,maintain,ordisseminate?

☐ SD Card or Other Stored Data

☐ Network Status

☐ Network Communications Data

☐ Device Settings or Preferences (security, sharing, status)

☐ Other:

☐ None

2.2.4 Whoownsand/orcontrolsthesysteminvolved?

☒ USAID Office: M/OAA

☐ Another Federal Agency:

☐ Contractor:

☐ Cloud Computing Services Provider:

☐ Third‐Party Website or Application Services Provider:

☐ Mobile Services Provider:

☐ Digital Collaboration Tools or Services Provider:

☐ Other:

3 PrivacyRisksandControls

3.1 AuthorityandPurpose(AP)

3.1.1 WhatarethestatutesorotherLEGALAUTHORITIESthatpermityoutocollect,use,maintain,ordisseminatepersonalinformation?

Personal cell phone is collected, but as personnel are not acting as an individual there is no legal authority required for the collection of this information. Information is for vendors.


7

3.1.2 WhyisthePIIcollectedandhowdoyouuseit?

GLAAS collects financial/procurement information (purchase orders, contracts and grants) as

well as name of personal service contractor. This would include vendor data, shipping data,

items/services purchased, and costs.

The information is used in a business capacity to identify the vendor that has been awarded a purchase order or contractor grant, and then to process payment. The information is initially collected by Phoenix (Financial Management Systems) and then pushed to GLAAS. GLAAS doesn't pull Social Security Numbers (SSN) or Taxpayer Identification (TIM) from the Phoenix vendor table.

3.1.3 HowwillyouidentifyandevaluateanypossiblenewusesofthePII?

Release notes from the vendor and any changes to the system or use of its data are reviewed by the application O&M CCB to ensure that there is no unacceptable impact.

3.2 Accountability,Audit,andRiskManagement(AR)

3.2.1 Doyouuseanydatacollectionformsorsurveys?

☒ No:

☐ Yes:

☐ Form or Survey (Please attach)

☐ OMB Number, if applicable:

☐ Privacy Act Statement (Please provide link or attach PA Statement)

3.2.3 Whoownsand/orcontrolsthepersonalinformation?

☐ USAID Office:

☐ Another Federal Agency:

☐ Contractor:

☐ Cloud Computing Services Provider:

☐ Third‐Party Web Services Provider:

☐ Mobile Services Provider:

☐ Digital Collaboration Tools or Services Provider:

☒ Other: Compusearch – COTS Vendor


8

3.2.8 DoyoucollectPIIforanexclusivelystatisticalpurpose?Ifyoudo,howdoyouensurethatthePIIisnotdisclosedorusedinappropriately?

☒ No. All users go through security training and Contractors must sign a nondisclosure agreement. Role based access provided to only those who need it to do their work.

☐ Yes:

3.3 DataQualityandIntegrity(DI)

3.3.1 HowdoyouensurethatyoucollectPIItothegreatestextentpossibledirectlyfromthesubjectindividual?

GLAAS collects PII through a feed from Phoenix or SAMS electronically.

3.3.2 Howdoyouensure,tothegreatestextentpossible,thatthePIIisaccurate,relevant,timely,andcompleteatthetimeofcollection?

PII comes from Phoenix and SAMS, which both validate the information that is collected.

3.3.3 Howdoyoucheckfor,andcorrectasnecessary,anyinaccurateoroutdatedPIIinthesystem?

The PII data is inputted through interconnections with Phoenix and SAM. This information is from standard vendor information or information from contracts.

3.4 DataMinimizationandRetention(DM)

3.4.1 WhatistheminimumPIIrelevantandnecessarytoaccomplishthelegalpurposeoftheprogram?

Name, cell phone, work phone, work email. This information is used to contact the recipient/vendor when issuing an award in GLAAS.

3.4.3 Doesthesystemderivenewdataorcreatepreviouslyunavailabledataaboutanindividualthroughaggregationorderivationoftheinformationcollected?IsthePIIrelevantandnecessarytothespecifiedpurposesandhowisitmaintained?

☒ No.

☐ Yes:


9

3.4.4 Whattypesofreportsaboutindividualscanyouproducefromthesystem?GLASS reports involve all aspects for the procurement lifecycle (procurement planning, requisition, solicitation/funding opportunity, award, and closeout). Reports may include vendor name and contact information (business address, work phone, cell phone, business email) in addition to status information on the procurement. Individuals would only be listed if they were a Vendor to USAID. Admin reports are only accessible to the seven system administrators. The other reports are controlled by user role. The reports are for internal USAID use only and not for distribution outside USAID. Each report is marked with a SBU marking.

3.4.6 Doesthesystemmonitorortrackindividuals?

(If you choose Yes, please explain the monitoring capability.)

☐ No.

☒ Yes: Audit logs of who has accessed the system and their access capabilities. Also, conflicting role and other

reports are used to ensure that users have the correct access rights.

3.5 IndividualParticipationandRedress(IP)

3.5.1 DoyoucontactindividualstoallowthemtoconsenttoyourcollectionandsharingofPII?

In order to perform business with USAID, vendors are required to provide this information. They can choose not to do business with USAID. However, if they choose to do business, there is no opportunity to decline.

USAID contracting officers and the Chief Financial Officer (CFO) have access to the vendor information in the contract document. System administrators have access to vendor information in the vendor table. Procurement information, which includes vendor name, address, and DUNS number is exported per executive branch regulations to FPDS‐MG and manually to FAADS.

3.5.2 Whatmechanismdoyouprovideforanindividualtogainaccesstoand/orto

amendthePIIpertainingtothatindividual?

All access within the system is role based. Each user must fill out an access request form which needs to be approved by a supervisor based on their position and other qualifying factors as specified in the GLAAS User Management Plan and GLAAS Operations SOP. Only Contracting Officers and the System Administrators would have access to the vendor table.


10

3.5.3 IfyoursysteminvolvescloudcomputingservicesandthePIIislocatedoutsideofUSAID,howdoyouensurethatthePIIwillbeavailabletoindividualswhorequestaccesstoandamendmentoftheirPII?

All access within the system is role based. Each user must fill out an access request form which needs to be approved by a supervisor based on their position and other qualifying factors as specified in the GLAAS User Management Plan and GLAAS Operations SOP. Only Contracting Officers and the System Administrators would have access to the vendor table.

3.7 Transparency(TR)

3.7.1 Doyouretrieveinformationbypersonalidentifiers,suchasnameornumber?

(If you choose Yes, please provide the types of personal identifiers that are used.)

☐ No.

☒ Yes: Vendor information can be retrieved by name, DUNS number, etc.

3.7.2 Howdoyouprovidenoticetoindividualsregarding?

1) The authority to collect PII:

2) The principal purposes for which the PII will be used:

3) The routine uses of the PII:

4) The effects on the individual, if any, of not providing all or any part of the PII:

A Privacy Impact Assessment Summary is posted on the USAID Public website: http://www.usaid.gov/privacy‐ policy/pia‐summaries

3.7.3 IsthereaPrivacyActSystemofRecordsNotice(SORN)thatcoversthissystem?

☒ No. All personal information in the system is provided by the individual acting in a business capacity and, for

that reason, is not protected under the Privacy Act of 1974. Therefore, a system of records notice (SORN) is not required for this information system.

☐ Yes:


11

3.7.4 Ifyoursysteminvolvescloudcomputingservices,howdoyouensurethatyouknowthelocationofthePIIandthattheSORNSystemLocation(s)sectionprovidesappropriatenoticeofthePIIlocation?

GLAAS is currently in the Terremark cloud environment. Plans to move to a Managed

Services Cloud are underway . In this case, Terremark would have no visibility into the GLAAS servers or data. This is managed by AidNet monitoring and by the contract with Terremark.

3.8 UseLimitation(UL)

3.8.1 WhohasaccesstothePIIatUSAID?

(A) GLAAS System Administrators (B) Contracting Officers (C) GLAAS users within the originating Bureau or Mission (Requestors, Program Officers,

Agreement Officers, Contracting Officers Representative (CORs) and Agreement Officers Representative (AORs), Negotiators, Program Manager and Financial Management Officers (FMOs)). All roles (except System Administrators and Contracting Officers) are restricted to the office in which they belong. This is validated by the user's supervisor.

The GLAAS Customer Care Team is responsible for reviewing end‐user access request forms, their approvals, and then setting up the user accounts. Users that lock out their accounts can obtain assistance from the GLAAS support group or their regional SME. Washington users can request that their Bureau Transition Coordinator (BTC) unlock their accounts. Accounts should be reviewed by the Mission SMEs and Washington BTCs. The system automatically locks accounts after 90 days of nonuse. An annual review process is conducted to verify Mission and Bureau users with their organization. Accounts are disabled by the GLAAS Customer Care Team, as needed. In addition, the Operations Group reviews accounts on an as needed basis to ensure the need for System Administrator accounts. System Administrators meet on a weekly basis. Accounts are removed or updated when a System Administrator leaves the organization. In addition to the GLAAS Customer Care Team, the GLAAS/Phoenix Interface Support Team also has access to GLAAS. All contractors with access to GLAAS must sign Non‐Disclosure Agreements.

3.8.3 WithwhomdoyousharethePIIoutsideofUSAID?Andwhether(andhow,if

applicable)youwillbeusingthesystemorrelatedwebsiteorapplicationtoengagewiththepublic?

No PII is shared externally. GLAAS sends a DUNS number to FPDS‐NG to obtain a status for a vendor.


12

3.8.4 DoyousharePIIoutsideofUSAID?Ifso,howdoyouensuretheprotectionofthePII1)asitmovesfromUSAIDtotheoutsideentityand2)whenitisused,maintained,ordisseminatedbytheoutsideentity?

☒ No. No PII is shared externally. GLAAS sends a DUNS number to PFDS‐NG to obtain a status for the vendor.

☐ Yes:

3.9 Third‐PartyWebSitesandApplications

3.9.1 WhatPIIcouldbemadeavailable(eventhoughnotrequested)toUSAIDoritscontractorsandserviceproviderswhenengagingwiththepublic?

GLAAS does obtain vendor information from SAM and FedBizOpps. This information is not considered to be PII for Privacy Act purposes.


13

AppendixA. LinksandArtifacts

PrivacyComplianceDocumentsorLinksA.1

☐ None. There are no documents or links that I need to provide.

☐ Privacy Threshold Analysis (PTA)

☐ Privacy Impact Assessment (PIA)

☐ System of Records Notice (SORN)

☐ Open Data Privacy Analysis for Posting Datasets to the Public (ODPA)

☐ Data Collection Forms or Surveys

☐ Privacy Act Section (e)(3) Statements or Notices

☐ USAID Web Site Privacy Policy

☐ Privacy Policy of Third‐Party Web Site or Application

☐ Privacy Protection Language in Contracts and Other Acquisition‐Related Documents

Assistance System (GLAAS) Privacy UNITED STATES · PDF fileUNITED STATES AGENCY FOR...

Documents

Transcript of Assistance System (GLAAS) Privacy UNITED STATES · PDF fileUNITED STATES AGENCY FOR...