+PT Personally Identifiable Information Processing and Transparency
---+PT-01 Policy and Procedures
---+PT-02 Authority to Process Personally Identifiable Information
------+PT-02(01) Data Tagging
------+PT-02(02) Automation
---+PT-03 Personally Identifiable Information Processing Purposes
------+PT-03(01) Data Tagging
------+PT-03(02) Automation
---+PT-04 Consent
------+PT-04(01) Tailored Consent
------+PT-04(02) Just-in-time Consent
------+PT-04(03) Revocation
---+PT-05 Privacy Notice
------+PT-05(01) Just-in-time Notice
------+PT-05(02) Privacy Act Statements
---+PT-06 System of Records Notice
------+PT-06(01) Routine Uses
------+PT-06(02) Exemption Rules
---+PT-07 Specific Categories of Personally Identifiable Information
------+PT-07(01) Social Security Numbers
------+PT-07(02) First Amendment Information
---+PT-08 Computer Matching Requirements

PT Personally Identifiable Information Processing and Transparency

Personally Identifiable Information Processing and Transparency

1. Ħarsa ġenerali

PT-01 Policy and Procedures

Control

  1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
    1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
    2. Procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and the associated personally identifiable information processing and transparency controls;
  2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures; and
  3. Review and update the current personally identifiable information processing and transparency:
    1. Policy [Assignement: frequency] and following [Assignement: events] ; and
    2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Personally identifiable information processing and transparency policy and procedures address the controls in the PT family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of personally identifiable information processing and transparency policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to personally identifiable information processing and transparency policy and procedures include assessment or audit findings, breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.

Assessment Objective

    1. a personally identifiable information processing and transparency policy is developed and documented;
    2. the personally identifiable information processing and transparency policy is disseminated to [Assignement: personnel or roles];
    3. personally identifiable information processing and transparency procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and associated personally identifiable information processing and transparency controls are developed and documented;
    4. the personally identifiable information processing and transparency procedures are disseminated to [Assignement: personnel or roles];
        1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses purpose;
        2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses scope;
        3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses roles;
        4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses responsibilities;
        5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses management commitment;
        6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses coordination among organizational entities;
        7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses compliance;
      2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
  2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures;
      1. the current personally identifiable information processing and transparency policy is reviewed and updated [Assignement: frequency];
      2. the current personally identifiable information processing and transparency policy is reviewed and updated following [Assignement: events];
      1. the current personally identifiable information processing and transparency procedures are reviewed and updated [Assignement: frequency];
      2. the current personally identifiable information processing and transparency procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

Personally identifiable information processing and transparency policy and procedures privacy plan privacy program plan other relevant documents or records

Interview

Organizational personnel with personally identifiable information processing and transparency responsibilities organizational personnel with information security and privacy responsibilities
PT-02 Authority to Process Personally Identifiable Information

Control

  1. Determine and document the [Assignement: authority] that permits the [Assignement: processing] of personally identifiable information; and
  2. Restrict the [Assignement: processing] of personally identifiable information to only that which is authorized.

Discussion

The processing of personally identifiable information is an operation or set of operations that the information system or organization performs with respect to personally identifiable information across the information life cycle. Processing includes but is not limited to creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal. Processing operations also include logging, generation, and transformation, as well as analysis techniques, such as data mining. Organizations may be subject to laws, executive orders, directives, regulations, or policies that establish the organization’s authority and thereby limit certain types of processing of personally identifiable information or establish other requirements related to the processing. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such authority, particularly if the organization is subject to multiple jurisdictions or sources of authority. For organizations whose processing is not determined according to legal authorities, the organization’s policies and determinations govern how they process personally identifiable information. While processing of personally identifiable information may be legally permissible, privacy risks may still arise. Privacy risk assessments can identify the privacy risks associated with the authorized processing of personally identifiable information and support solutions to manage such risks. Organizations consider applicable requirements and organizational policies to determine how to document this authority. For federal agencies, the authority to process personally identifiable information is documented in privacy policies and notices, system of records notices, privacy impact assessments, [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) statements, computer matching agreements and notices, contracts, information sharing agreements, memoranda of understanding, and other documentation. Organizations take steps to ensure that personally identifiable information is only processed for authorized purposes, including training organizational personnel on the authorized processing of personally identifiable information and monitoring and auditing organizational use of personally identifiable information.

Assessment Objective

  1. the [Assignement: authority] that permits the [Assignement: processing] of personally identifiable information is determined and documented;
  2. the [Assignement: processing] of personally identifiable information is restricted to only that which is authorized.

Assessment Method

Examine

Personally identifiable information processing and transparency policy and procedures privacy plan other relevant documents or records

Interview

Organizational personnel with personally identifiable information processing and transparency responsibilities organizational personnel with information security and privacy responsibilities
PT-03 Personally Identifiable Information Processing Purposes

Control

  1. Identify and document the [Assignement: purpose(s)] for processing personally identifiable information;
  2. Describe the purpose(s) in the public privacy notices and policies of the organization;
  3. Restrict the [Assignement: processing] of personally identifiable information to only that which is compatible with the identified purpose(s); and
  4. Monitor changes in processing personally identifiable information and implement [Assignement: mechanisms] to ensure that any changes are made in accordance with [Assignement: requirements].

Discussion

Identifying and documenting the purpose for processing provides organizations with a basis for understanding why personally identifiable information may be processed. The term "process" includes every step of the information life cycle, including creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal. Identifying and documenting the purpose of processing is a prerequisite to enabling owners and operators of the system and individuals whose information is processed by the system to understand how the information will be processed. This enables individuals to make informed decisions about their engagement with information systems and organizations and to manage their privacy interests. Once the specific processing purpose has been identified, the purpose is described in the organization’s privacy notices, policies, and any related privacy compliance documentation, including privacy impact assessments, system of records notices, [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) statements, computer matching notices, and other applicable Federal Register notices. Organizations take steps to help ensure that personally identifiable information is processed only for identified purposes, including training organizational personnel and monitoring and auditing organizational processing of personally identifiable information. Organizations monitor for changes in personally identifiable information processing. Organizational personnel consult with the senior agency official for privacy and legal counsel to ensure that any new purposes that arise from changes in processing are compatible with the purpose for which the information was collected, or if the new purpose is not compatible, implement mechanisms in accordance with defined requirements to allow for the new processing, if appropriate. Mechanisms may include obtaining consent from individuals, revising privacy policies, or other measures to manage privacy risks that arise from changes in personally identifiable information processing purposes.

Assessment Objective

  1. the [Assignement: purpose(s)] for processing personally identifiable information is/are identified and documented;
    1. the purpose(s) is/are described in the public privacy notices of the organization;
    2. the purpose(s) is/are described in the policies of the organization;
  3. the [Assignement: processing] of personally identifiable information are restricted to only that which is compatible with the identified purpose(s);
    1. changes in the processing of personally identifiable information are monitored;
    2. [Assignement: mechanisms] are implemented to ensure that any changes are made in accordance with [Assignement: requirements].

Assessment Method

Examine

Personally identifiable information processing and transparency policy and procedures configuration management plan organizational privacy notices organizational policies Privacy Act statements computer matching notices applicable Federal Register notices documented requirements for enforcing and monitoring the processing of personally identifiable information privacy plan other relevant documents or records

Interview

Organizational personnel with personally identifiable information processing and transparency responsibilities organizational personnel with information security and privacy responsibilities
PT-04 Consent

Control

Implement [Assignement: tools or mechanisms] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.

Discussion

Consent allows individuals to participate in making decisions about the processing of their information and transfers some of the risk that arises from the processing of personally identifiable information from the organization to an individual. Consent may be required by applicable laws, executive orders, directives, regulations, policies, standards, or guidelines. Otherwise, when selecting consent as a control, organizations consider whether individuals can be reasonably expected to understand and accept the privacy risks that arise from their authorization. Organizations consider whether other controls may more effectively mitigate privacy risk either alone or in conjunction with consent. Organizations also consider any demographic or contextual factors that may influence the understanding or behavior of individuals with respect to the processing carried out by the system or organization. When soliciting consent from individuals, organizations consider the appropriate mechanism for obtaining consent, including the type of consent (e.g., opt-in, opt-out), how to properly authenticate and identity proof individuals and how to obtain consent through electronic means. In addition, organizations consider providing a mechanism for individuals to revoke consent once it has been provided, as appropriate. Finally, organizations consider usability factors to help individuals understand the risks being accepted when providing consent, including the use of plain language and avoiding technical jargon.

Assessment Objective

the [Assignement: tools or mechanisms] are implemented for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.

Assessment Method

Examine

Personally identifiable information processing and transparency policy and procedures consent policies and procedures consent tools and mechanisms consent presentation or display (user interface) evidence of individuals’ consent privacy plan other relevant documents or records

Interview

Organizational personnel with personally identifiable information processing and transparency responsibilities organizational personnel with information security and privacy responsibilities
PT-05 Privacy Notice

Control

Provide notice to individuals about the processing of personally identifiable information that:
  1. Is available to individuals upon first interacting with an organization, and subsequently at [Assignement: frequency];
  2. Is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language;
  3. Identifies the authority that authorizes the processing of personally identifiable information;
  4. Identifies the purposes for which personally identifiable information is to be processed; and
  5. Includes [Assignement: information].

Discussion

Privacy notices help inform individuals about how their personally identifiable information is being processed by the system or organization. Organizations use privacy notices to inform individuals about how, under what authority, and for what purpose their personally identifiable information is processed, as well as other information such as choices individuals might have with respect to that processing and other parties with whom information is shared. Laws, executive orders, directives, regulations, or policies may require that privacy notices include specific elements or be provided in specific formats. Federal agency personnel consult with the senior agency official for privacy and legal counsel regarding when and where to provide privacy notices, as well as elements to include in privacy notices and required formats. In circumstances where laws or government-wide policies do not require privacy notices, organizational policies and determinations may require privacy notices and may serve as a source of the elements to include in privacy notices. Privacy risk assessments identify the privacy risks associated with the processing of personally identifiable information and may help organizations determine appropriate elements to include in a privacy notice to manage such risks. To help individuals understand how their information is being processed, organizations write materials in plain language and avoid technical jargon.

Assessment Objective

    1. a notice to individuals about the processing of personally identifiable information is provided such that the notice is available to individuals upon first interacting with an organization;
    2. a notice to individuals about the processing of personally identifiable information is provided such that the notice is subsequently available to individuals [Assignement: frequency];
  2. a notice to individuals about the processing of personally identifiable information is provided that is clear, easy-to-understand, and expresses information about personally identifiable information processing in plain language;
  3. a notice to individuals about the processing of personally identifiable information that identifies the authority that authorizes the processing of personally identifiable information is provided;
  4. a notice to individuals about the processing of personally identifiable information that identifies the purpose for which personally identifiable information is to be processed is provided;
  5. a notice to individuals about the processing of personally identifiable information which includes [Assignement: information] is provided.

Assessment Method

Examine

Personally identifiable information processing and transparency policy and procedures privacy notice Privacy Act statements privacy plan other relevant documents or records

Interview

Organizational personnel with personally identifiable information processing and transparency responsibilities organizational personnel with user interface or user experience responsibilities organizational personnel with information security and privacy responsibilities
PT-06 System of Records Notice

Control

For systems that process information that will be maintained in a Privacy Act system of records:
  1. Draft system of records notices in accordance with OMB guidance and submit new and significantly modified system of records notices to the OMB and appropriate congressional committees for advance review;
  2. Publish system of records notices in the Federal Register; and
  3. Keep system of records notices accurate, up-to-date, and scoped in accordance with policy.

Discussion

The [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) requires that federal agencies publish a system of records notice in the Federal Register upon the establishment and/or modification of a [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) system of records. As a general matter, a system of records notice is required when an agency maintains a group of any records under the control of the agency from which information is retrieved by the name of an individual or by some identifying number, symbol, or other identifier. The notice describes the existence and character of the system and identifies the system of records, the purpose(s) of the system, the authority for maintenance of the records, the categories of records maintained in the system, the categories of individuals about whom records are maintained, the routine uses to which the records are subject, and additional details about the system as described in [OMB A-108](#3671ff20-c17c-44d6-8a88-7de203fa74aa).

Assessment Objective

    1. system of records notices are drafted in accordance with OMB guidance for systems that process information that will be maintained in a Privacy Act system of records;
    2. new and significantly modified system of records notices are submitted to the OMB and appropriate congressional committees for advance review for systems that process information that will be maintained in a Privacy Act system of records;
  2. system of records notices are published in the Federal Register for systems that process information that will be maintained in a Privacy Act system of records;
  3. system of records notices are kept accurate, up-to-date, and scoped in accordance with policy for systems that process information that will be maintained in a Privacy Act system of records.

Assessment Method

Examine

Personally identifiable information processing and transparency policy and procedures privacy notice Privacy Act system of records Federal Register notices privacy plan other relevant documents or records

Interview

Organizational personnel with personally identifiable information processing and transparency responsibilities organizational personnel with information security and privacy responsibilities
PT-07 Specific Categories of Personally Identifiable Information

Control

Apply [Assignement: processing conditions] for specific categories of personally identifiable information.

Discussion

Organizations apply any conditions or protections that may be necessary for specific categories of personally identifiable information. These conditions may be required by laws, executive orders, directives, regulations, policies, standards, or guidelines. The requirements may also come from the results of privacy risk assessments that factor in contextual changes that may result in an organizational determination that a particular category of personally identifiable information is particularly sensitive or raises particular privacy risks. Organizations consult with the senior agency official for privacy and legal counsel regarding any protections that may be necessary.

Assessment Objective

[Assignement: processing conditions] are applied for specific categories of personally identifiable information.

Assessment Method

Examine

Personally identifiable information processing and transparency policy and procedures privacy notice Privacy Act system of records computer matching agreements and notices contracts privacy information sharing agreements memoranda of understanding governing requirements privacy plan other relevant documents or records

Interview

Organizational personnel with personally identifiable information processing and transparency responsibilities organizational personnel with information security and privacy responsibilities
PT-08 Computer Matching Requirements

Control

When a system or organization processes information for the purpose of conducting a matching program:
  1. Obtain approval from the Data Integrity Board to conduct the matching program;
  2. Develop and enter into a computer matching agreement;
  3. Publish a matching notice in the Federal Register;
  4. Independently verify the information produced by the matching program before taking adverse action against an individual, if required; and
  5. Provide individuals with notice and an opportunity to contest the findings before taking adverse action against an individual.

Discussion

The [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) establishes requirements for federal and non-federal agencies if they engage in a matching program. In general, a matching program is a computerized comparison of records from two or more automated [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) systems of records or an automated system of records and automated records maintained by a non-federal agency (or agent thereof). A matching program either pertains to federal benefit programs or federal personnel or payroll records. A federal benefit match is performed to determine or verify eligibility for payments under federal benefit programs or to recoup payments or delinquent debts under federal benefit programs. A matching program involves not just the matching activity itself but also the investigative follow-up and ultimate action, if any.

Assessment Objective

  1. approval to conduct the matching program is obtained from the Data Integrity Board when a system or organization processes information for the purpose of conducting a matching program;
    1. a computer matching agreement is developed when a system or organization processes information for the purpose of conducting a matching program;
    2. a computer matching agreement is entered into when a system or organization processes information for the purpose of conducting a matching program;
  3. a matching notice is published in the Federal Register when a system or organization processes information for the purpose of conducting a matching program;
  4. the information produced by the matching program is independently verified before taking adverse action against an individual, if required, when a system or organization processes information for the purpose of conducting a matching program;
    1. individuals are provided with notice when a system or organization processes information for the purpose of conducting a matching program;
    2. individuals are provided with an opportunity to contest the findings before adverse action is taken against them when a system or organization processes information for the purpose of conducting a matching program.

Assessment Method

Examine

Personally identifiable information processing and transparency policy and procedures privacy notice Privacy Act system of records Federal Register notices Data Integrity Board determinations contracts information sharing agreements memoranda of understanding governing requirements privacy plan other relevant documents or records

Interview

Organizational personnel with personally identifiable information processing and transparency responsibilities organizational personnel with information security and privacy responsibilities

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti