PRIVACY IMPACT ASSESSSMENT QUESTIONNAIRE
Abstract
The Wage and Hour Division (WHD) is a Program Office of Employment Standards Administration (ESA), an agency of DOL. WHD operates The Back Wage Financial System (BWFS), which is a financial management system used by the WHD. The system is used to collect back wages due to employees from employers as a result of violations of laws enforced by the WHD and to disburse those wages to employees. This Privacy Impact Assessment is being conducted because BWFS contains Personal Identifiable Information (PII).
Overview
The BWFS is a financial management system used by the WHD to collect back wages from employers (under certain conditions), disburse those wages to employees, and, when the WHD is unable to locate employees after three years, transfer any remaining monies to the U.S. Treasury. Major functions of the system include accruing and assessing interest and penalties for delinquent debt, transferring debts to Treasury’s Debt Management Service (DMS) for debt collection, producing tax documentation for gross cases, and producing period reports for financial reporting.
In addition to the US Treasury, the system provides data to the U.S. Secure Payment System regarding the issuing of checks and to the Internal Revenue Service (IRS) and the Social Security Administration (SSA) regarding tax withholding information about individuals and businesses.
The data used by BWFS is part of the overall WHISARD database, which consists of a DB2 database and several executables that access parts of the database. The WHISARD database itself contains several hundred tables; some are used only by BWFS.
The BWFS supports DOL Strategic Plan 2006-2011, Strategic Goal 3 - Safe and Secure Workplaces, Performance Goal 3C - Ensure Workers Receive the Wages Due Them. The collection and distribution of back wages through the BWFS deters future violations and furthers the WHD mission of increased compliance to the statutes that the WHD is mandated to enforce, particularly in low-wage industries.
Introduction
The WHD is responsible for administering and enforcing some of our nation’s most comprehensive labor laws, including: the minimum wage, overtime, and child labor provisions of the Fair Labor Standards Act (FLSA); the Family and Medical Leave Act (FMLA); the Migrant and Seasonal Agricultural Worker Protection Act (MSPA); worker protections provided in several temporary visa programs; and the prevailing wage requirements of the Davis-Bacon and Related Acts (DBRA) and the Service Contract Act (SCA). BWFS supports WHD meeting its core business functions. This Privacy Impact Assessment will evaluate the effectiveness of the BWFS Application in protecting the privacy information during system operation. In addition, it will demonstrate the adequacy of the protection of the Personal Identifiable Information (PII) being collected within a system and the protection of integrity of the PII being collected by the WHISARD systems operation.
Characterization of the Information
The BWFS collects personally identifiable information (PII) on members of the public (U.S. citizens).
What are the sources of the PII in the information system?
BWFS consists of two components: the BWFS application and the Back Wage Follow-Up (BWFU) module hosted in the WHISARD application. Both components serve as the source of PII.
BWFU - The PII is received directly from the employer for employees for whom DOL will be disbursing funds, either due to the employer’s inability to locate the employee(s) or delinquency in providing proof of payment to DOL for the employees represented in the Back Wage case.
BWFS - The PII is received from two sources:
Directly from the employer for employees for whom DOL will be disbursing funds due to the employer’s failure to provide proof of payment or payment to DOL for the employees represented in the Back Wage case in a timely manner.
Directly from the employee when he/she is complete and provided form WH-60 to DOL to affirm that they are the employee for whom funds have been collected. The Social Security number portion of the information is used to report tax information to the Treasury.
What is the PII being collected, used, disseminated, or maintained?
The collection, dissemination, and maintenance of PII in BWFS and BWFU consist of the following:
Name
Phone numbers
Social Security numbers
Employer Identification Numbers
Residential address
Business address
Mailing address
Business phone number
Business e-mail address
Residential address
How is the PII collected?
PII is collected in two ways:
Directly from the employer for employees for whom DOL will be disbursing funds due to the employer’s failure to provide proof of payment or payment to DOL for the employees represented in the Back Wage case in a timely manner.
Directly from the employee when he/she is complete and provided form WH-60 to DOL to affirm that they are the employee for whom funds have been collected.
How will the information be checked for accuracy?
The BWFS verifies information received from BWFU from the employer and information received directly from the employee via the Form WH-60 provided to the employee by DOL. The employee completes the form and returns it to DOL thus verifying the employee's name, address, phone number, and Social Security number before the issuance of a check from DOL.
An employer’s Employer Identification Number (EIN) can be captured throughout the life of the case as long as the case is active. As part of the series of letters issued to the employer before the debt is sent for collection the EIN of file is provided in the letter for the employer to verify. The final letter is sent by certified mail to the addressee to verify the accuracy of information.
What specific legal authorities, arrangements, and/or agreements defined the collection of information?
The BWFS system is also required to adhere to a number of Federal Mandates, including the following:
The Privacy Act of 1974, PL 93-579, as amended
The Freedom of Information Act, PL 93-502
The Federal Managers' Financial Integrity Act (FMFIA), PL 97-255
OMB Circular A-130, Management of Federal Information Resources
OMB Circular A-123 Revised, Management’s Responsibility for Internal Control, December 2004
OMB Circular A-127, Financial Management Systems, July 23, 1993
OMB Circular A-130, Appendix III, Security of Federal Automated Information Resources
Clinger-Cohen Act (formerly The Information Technology Management Reform Act of 1996)
Computer Security Act of 1987
Federal Records Act
Freedom of Information Act (FOIA) with Electronic FOIA Amendments
of 1996
Government Information Security Reform Act (GISRA)
Government Paperwork Elimination Act of 1998
Government Performance and Results Act (GPRA) of 1993
Privacy Act of 1974 (Subchapter 552a of Title 5, United States Code)
Debt Collections Improvement Act (DCIA)
Privacy Impact Analysis
The implementations of security controls are safeguards that are inherited by the ESA GSS to protect PII data from unintentional and unauthorized disclosure.
Restricted use: After information has been received, it is entered directly into the system by an authorized user. Information in the system is not shared with any other system. The only time information is transmitted to an external system is to disburse funds and to withhold tax.
Access Controls: Only WHD employees and contractors who have been approved by their supervisors are authorized to have an account on the BWFS; accounts have high level controls that must be approved by the National Office. Security is further enforced through the use of roles. Each region has a Manager, Team Leader, and Specialist role. Depending on the role, each person receives different privileges on the system.
Technical Controls: User accounts are protected by passwords that must meet stringent requirements and must be changed frequently. Other technical controls, such as firewalls and encryption, are in place to defend against potential intruders; other controls such as Intrusion Detection Systems are in place to detect intrusion attempts.
Uses of the PII
Describe all the uses of the PII
Information being collected by BWFS is used to:
Disburse funds and withhold tax
Collect back wages fund due to employees as a result of violations of laws enforced by the WHD
Disburse collected back wages to employees
What types of tools are used to analyze data and what type of data may be produced?
There are no customized or specialized tools that are used to analyze data on Wage and Hour cases.
Will the system derive new data, or create previously unavailable data, about an individual through aggregation of the collected information?
No, BWFS is not currently designed to derive new information or create previously unavailable data about individuals.
If the system uses commercial or publicly available data, please explain why and how it is used.
The system data is not available for commercial or public use.
Privacy Impact Analysis
Although PII is collected by the system, only PII that is relevant to accomplish the mission is maintained. The implementations of security controls are enforced at the Major Application (MA) and GSS levels to limit access to information and unauthorized disclosure. These safeguards include the following:
Access Enforcement
WHD ensures that access to security functions and information is restricted to authorized personnel during account establishment and activation. Management approval is required for all account requests. There is also a bi-annual recertification of all system accounts and access privileges.
Separation of Duties
WHD ensures separation of duties during the process of account establishment and activation. There is also a bi-annual recertification of all system accounts and access privileges
Security Awareness
In accordance with the DOL Security Awareness procedures and training documentation (see DOL CSH Volume 2), all users complete the basic computer security awareness training before receiving access to information systems. Access is not granted until security awareness training certification verifies completion of the training. The procedures are reviewed annually as part of the system security self assessment.
Security Training
Personnel with significant information systems security roles and responsibilities are identified and must complete security role-based training annually. The completed role-based training hours are documented annually.
BWFS is a Major Application (MA) of the WHISARD application and is fully compliant with the Privacy Act of 1974. WHISARD meets all requirements of the Privacy Act listed under 5 U.S.C. 552a. (4) As amended, listed under “Records Maintained On Individuals.”
Retention
How long is information retained in the system?
As a result of the fact that BWFS accesses data from the WHISARD database, BWFS is governed by the SORN 33 and 42 requirements that states the WHISARD system will retain records based on the Records Disposal Schedule #NN-168-43, items 1a and 1b. As such, data will be captured on tape at the end of each fiscal year and retained for 25 years.
Has the retention schedule been approved by the DOL agency records officer and the National Archives and Records Administration (NARA)?
WHD retention of records is published with the DOL Record of Officers and in the agency’s System of Records. Usage have been approved by the DOL agency records officer and the National Archives and Records Administration (NARA).
These records are compliant with Title 44 of the U.S. Code and record schedules approved by NARA.
Privacy Impact Analysis
As previously stated, the BWFS application accesses data from the WHISARD database. The length of time data is retained within the WHISARD system is determined by Code of Federal Regulations Pertaining to Security of Labor (SOL) and the Protection of Individual Privacy and Access to Records Under the Privacy Act of 1974. The WHISARD system is an internal system that is not available for public access.
Integrity of the data within the WHISARD system is ensured by an internal audit that is performed every (2) two years. This audit is used to reduce redundancy of data and evaluate WHD case files within the system.
Safeguarding these records are based on DOL Destroy Recovery policy and procedures; only authorized users have access to information in printed form or on digital media that has been removed from the information system.
Internal Sharing and Disclosure
With which internal organization(s) is the PII shared, what information is shared, and for what purpose?
Information is not shared with any internal system. Information for BWFS is entered directly into the WHISARD database. That information is stored in tables that have been created for and used exclusively by BWFS. There is an internal connection between BWFS and WHISARD but only for the retrieval of this information.
How is the PII transmitted or disclosed?
BWFS application does not transmit or disclose PII information with any internal organizations.
Privacy Impact Analysis
There is no Privacy Impact of the BWFS application with internal organizations because it does not transmit, share or disclose PII.
External Sharing and Disclosure
With which external organization(s) is the PII shared, what information is shared, and for what purpose?
The external organization with which BWFS shares PII is the U.S Department of Treasury, Financial Management Service (FMS). BWFS has external connections with the following systems:
Debt Management System (DMS) - Used to refer debts over
180 days delinquent to Treasury
Secure Payment System (SPS) - Used to submit payment schedules to Treasury
Paper Check Conversion Over the Counter (PCC OTC) - Used to submit check information to Treasury for collection
Is the sharing of PII outside the Department compatible with the original collection? If so, is it covered by an appropriate routine use in a SORN? If so, please describe. If not, please describe under what legal mechanism the program or system is allowed to share the PII outside of DOL.
Yes, sharing of PII outside of DOL complies with SORN PARN DOL/OCFO-2. The WHD has developed a PARN for WHFAS that is published by the SOL. WH Financial systems (which would include CMP-2001) are covered under the existing PARN for DOLAR$.
How is the information shared outside the Department and what security measures safeguard its transmission?
BWFS does not have any external interconnections but shares data with the US Treasury. A manual processes is involved in transferring BWFS data to and from the external systems using the Secure Payment System (SPS), in accordance with an agreement that was established through a Memorandum Of Understand (MOU) and an Interconnection Security Agreement (ISA). These documents are currently being updated based on the new DOL Computer Security Handbook (CSH) v3.0 templates.
Privacy Impact Analysis
The DOL WHD uses a system interconnection for transferring debt information between the ESA General Support System (GSS) and the Treasury network, separate from BWFS. The information being passed through this two-way connection is protected by an encryption mechanism. The connections at each end are located in physical controlled access facilities, guarded 24 hours a day by security guards. Individual users do not have access to the data except through their systems security software inherent to the operating system. All access is controlled by authentication methods to validate the approved users.
The transfer of information between WHD and the external entities takes place through a manual process. This transfer of data is governed by an ISA/MOU, establishing the requirements for the protection of data during data transfer, which helps to reduce risk.
NOTICE
Was notice provided to the individual prior to collection of PII?
Not always. In some cases, PII is collected directly from the individual submitting a complaint. In other cases, PII may be collected as a result of a direct investigation that affects one or more individuals. Notice of the collection of PII information on individuals is provided by the publication of SORN DOL/ESA 42 in the Federal Register.
Do individuals have the opportunity and/or right to decline to provide information?
Information is collected as a result of an investigation. In some cases, this information is collected directly from the individual while in others, it may be collected from the employer. If information is collected from the employer the individual is not given the opportunity to decline the request to provide information. When information is collected directly from an individual, he or she is given the opportunity to decline to provide that information and will not be penalized.
Do individuals have the right to consent to particular uses of the information? If so, how does the individual exercise the right?
Information is collected as a result of an investigation. It is used only for disbursement of back wages depending on the outcome of the investigation. Due to the nature of the work, individuals are not provided an option for consenting to this use of the information.
In accordance, the SORN DOL/ESA 42 “Systems Exempted from Certain Provison of the Act” states the following:
5 U.S.C. 552a(k)(2), investigatory material in this system of records compiled for law enforcement purposes is exempt from subsections (c)(3); (d); (e)(1); (e)(4)(G), (H), and (I); and (f) of 5 U.S.C. 552a that if any individual is denied any right, privilege, or benefit that he or she would otherwise be entitled to by Federal law, or for which he or she would otherwise be eligible, as a result of the maintenance of these records, such material shall be provided to the individual, except to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence
Individuals have the right to consent to particular uses of the information by contacting:
Administrator, Wage and Hour Division,
Frances Perkins Building, 200 Constitution Avenue, NW,
Washington DC 20210
The request should clearly state the information being contested and reasons of contesting how particular information is being used. The letter should also contain a proposed amendment to the information that was collected.
Privacy Impact Analysis
If the employer provides the information, the individual may not be aware that their information is being disclosed because a Privacy Notice was not provided to the individual. However, the publication of the SORN PARN DOL/OCFO-2 and SORN DOL/ESA 33 and 42 for the system mitigates this risk.
BWFS uses a Wage & Hour Form WH-60 to verify an employee's name, address, phone, number, and Social Security number before the issuance of a check. A series of letters are issued to the employer before the debt is sent for collection. The final letter is sent by certified mail, addressee only to ensure that the addresses, etc. are accurate. In addition, the Employer will be requested to verify his Employer ID Number.
Access, Redress, and Correction
What are the procedures that allow individuals to gain access to their information?
There are no procedures to allow individuals to gain access to their information. The BWFS application is an integral part of the WHISARD database which is accessed by WHD employees or contractors. There is no public or Web access to the WHISARD application.
What are the procedures for correcting inaccurate or erroneous information?
Prior to disbursement of back wages, form WH-60 or WH-58 is provided to the individual for the purpose of verifying personal information and making any necessary corrections.
How are individuals notified of the procedures for correcting their information?
Prior to disbursement of back wages, form WH-60 is provided to the individual for the purpose of verifying personal information and making any necessary corrections. This is the same response as above. This response should include that the individual is notified of the procedures for correcting their information by WHD. Inherited WHISARD SORN/ESA 33 and 42 are published in the Federal Register provides individuals the procedures to correct information gathered by WHD.
If no formal redress is provided, what alternatives are available to the individual?
The publication of SORN DOL/ESA 33 and 42 addresses the procedure on the correcting or updating information that is gathered. Those individuals wanting to contest or amend nonexempt records must contact the disclosure officer at the following address:
Administrator, Wage and Hour Division,
Room S-3502, Frances Perkins Building
200 Constitution Avenue, NW, Washington, DC 20210
Privacy Impact Analysis
As a result of the PII information is used within WHISARD in support of an investigation and not used to take any specific action on behalf of WHD, individuals, to some extent, are provided access to and can change their information. Individuals seeking some form of redress or the means to correct their data could obtain some assistance from information published in SORN DOL/ESA 33 and 42 in the Federal Register.
TECHNICAL ACCESS AND SECURITY
What procedures are in place to determine which users may access the system and are they documented?
Privileges granted for accessing the system must comply with the principles of separation of duties and of least privilege.
Different roles have been defined for access control. A request for a user to have access to the system has to be signed by a supervisor; for certain levels of access, requests must be reviewed and approved at the National Office. In each region, there is a Manager, Team Leader, and Specialist role. Each person receives different privileges in the system depending on their role. For example, a Specialist can enter a write-off, but a Team Leader has to review it and a Manager has to approve it. The procedures and documentation of system access are as follows:
The WHD manager request use access by completing a Wage Hour Program Services and Application Request Form
The WHD Application form is faxed to DITMS .
DITMS Account Management verifies that the user account is in the appropriate groups and that PC name has appropriate software (DB2 Runtime and WHD Catalog file)
The Database team creates a DB2 account for access to the WHD databases.
The PDF form is forwarded to the appropriate WHD manager through public folder WHD_IT_RequestForms
The WHD managers then determine access control for the WHD user
A soft copy of the form is put in share folder WHD_IT_RequestForms and StarTeam>Capital Planning>Security>WHISARD Recertification as a backup for auditing purposes
Will Department contractors have access to the system?
The duties assigned to a WHD contractor determine whether they can have access to the WHISARD/BWFS application.
Describe what privacy training is provided to users, either generally or specifically relevant to the program or system?
WHD employees are trained to protect access to their information systems as part of the Computer Security Awareness Training (CSAT). In addition, the Basic Training of new WHD investigators and support staff includes information about protecting the information in their cases.
What auditing measures and technical safeguards are in place to prevent misuse of data?
WHD auditing measures comply with the following security control standards as a safeguard to protect the data during storage and transmission:
Audit and Accountability Policy and Procedures
The Access Control (AC) policy and procedures are developed and disseminated at a departmental level. The agency develops and facilitates the implementation of the AC policy and access controls. Existing account authorization forms and the AC policy and procedure documents are used by the agency. Procedures are modified whenever there are changes to the policy or whenever deemed necessary.
Auditable Events
WHISARD users must log on to ESA GSS before accessing and logging on to WHISARD. WHD manages establishing, activating, modifying, reviewing, disabling, and removing WHISARD accounts. WHISARD Regional Directors and District Directors authorize user access privileges on behalf of the system owner. Automated mechanisms that support account management are inherited through the GSS. Inactive accounts are automatically disabled after 60 days. Emergency accounts are not used. Accounts are recertified biannually.
BWFS event logs are reviewed monthly by management and each logged events is suffice to establish what events occurred.
Content of Audit Records
The Storage of the information is based on the highest FIPS 199 security category of the information.
WHD has an established Incident Response and Reporting procedure that requires users to promptly report known or suspected unauthorized use or disclosure of user-IDs and/or passwords, misuse of computer resources, security violations, or unusual occurrences to appropriate authorities.
ESA GSS has implemented managed firewall services that include hardware configuration control, firewall server update installation and configuration, and 24x7 monitoring and oversight of the National Office firewall.
Privacy Impact Analysis
PII information that is being collected comes directly from the individual who has not had a back wage claim settled in the District Office. WHISARD is an internal system that is accessed only by WHD employees or contractors; it is not for commercial or public access.
Administrative: Mitigation of this risk is performed at the Regional Office level where Form WH-60 is used to verify an employee's name, address, phone number, and Social Security number before the issuance of a check. In addition, 90 percent of the WHD back wage cases are resolved at the DO due to settlements paid directly from the employer to the employee.
Technical Controls: Mitigations of this risk is provided at the MA and GSS levels were the CMP-2001 application logs the details of every transaction entry and they are reviewed monthly by management.
TECHNOLOGY
What stage of development is the system in, and what project development life cycle was used?
All DOL major information systems are required to follow the computer security life cycle defined in the DOL System Development Life Cycle Management Manual (SDLCMM). Based on the SDLCMM, the system is in the following life cycle phase:
Operations & Maintenance Phase
Does the project employ technology which may raise privacy concerns? If so please discuss their implementation?
The WHISARD system does not raise privacy concern due to the release of
WHISARD 4.3.0 on December 19, 2007; Social Security Numbers (SSNs) for Back Wage Case Employees are no longer collected nor shown in WHISARD.
Determination
As a result of performing the PIA, what choices has the agency made regarding the information technology system and collection of information?
Wage and Hour Division (WHD) has completed the PIA for Back Wage Financial System (BWFS) which is currently in operation. WHD has determined that the safeguards and controls for this moderate system adequately protect the information referenced in Back Wage Financial System (BWFS) System Security Plan, v 3.0, dated February 2008.
Wage and Hour Division (WHD) has determined that it is collecting the minimum necessary information for the proper performance of a documented agency function.
|
