1 / 21

Safeguarding PII

Safeguarding PII . Agenda. Why Privacy is Important Personally Identifiable Information Sensitive PII Handling PII in a DHS System Handling PII Extracted from a DHS System Handling PII Outside of a DHS System Privacy Incident Reporting. Why is Privacy Important?.

nara
Download Presentation

Safeguarding PII

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Safeguarding PII

  2. Agenda • Why Privacy is Important • Personally Identifiable Information • Sensitive PII • Handling PII in a DHS System • Handling PII Extracted from a DHS System • Handling PII Outside of a DHS System • Privacy Incident Reporting The DHS Privacy OfficeApril 2, 2014: slide 2

  3. Why is Privacy Important? • To earn and keep public trust • If the public no longer trusts DHS to protect their PII, we may find public support for DHS programs will erode. • To prevent identity theft • Identity thieves do not discriminate based on a person’s immigration status, and neither does DHS when protecting the PII it collects and maintains. • To prevent privacy incidents • Incidents are reported in national news, which erodes the public’s trust in those agencies, and are expensive to mitigate. • It’s the law. • Failure to follow these laws may result in civil or criminal penalties for you, your supervisors, and/or colleagues. The DHS Privacy OfficeApril 2, 2014: slide 3

  4. Personally Identifiable Information The DHS Privacy OfficeApril 2, 2014: slide 4

  5. Sensitive PII • Potential for substantial harm, embarrassment, inconvenience, or unfairness to an individual • Single data elements • social security, driver's license, or financial account number • Combinations of data • citizenship or immigration status; medical information; ethnic, religious, sexual orientation; in conjunction with the identity of an individual • Context of data • a list of names of employees with poor performance ratings. The DHS Privacy OfficeApril 2, 2014: slide 5

  6. Handling PII in a DHS System • Only access what you need-to-know. • Do not browse • Only use PII for approved purposes. • Use should be compatible with purpose of the system • Protect against “shoulder surfing” and eavesdropping. • Only access systems using DHS equipment. • Including teleworkers The DHS Privacy OfficeApril 2, 2014: slide 6

  7. Handling SPII Extracts • Obtain approval before extracting PII from a DHS system. • Secure portable media containing SPII. Carry on laptops when flying instead of checking and do not leave unattended in hotel room. • Encrypt SPII when transferred outside of DHS, such as to a non-DHS email address. • If extract is not part of system SOP, log and track the extract to ensure it is not lost. The DHS Privacy OfficeApril 2, 2014: slide 7

  8. Handling PII Outside of a System • Check with the DHS Privacy Office and I&A counsel. • You may inadvertently create a privacy sensitive system that is out of compliance with law and policy. • Subject to civil, criminal, administrative penalties • Do not create duplicate, ancillary, “shadow,” or “under the radar” files with PII. • Only use DHS-approved forms (paper or electronic) to collect PII from 10 or more individuals. The DHS Privacy OfficeApril 2, 2014: slide 8

  9. Privacy Incidents and Your Responsibilities

  10. TJX Says Customer Data was Stolen TSA Suffers Data Loss; Lawmakers Watch Closely Think Your SSN is Secure? Think Again… VA Sets Aside $20 Million to Handle Latest Data Breach Cost of Privacy Incident: $90 to $130 Per Record Compromised The DHS Privacy OfficeApril 2, 2014: slide 10

  11. Privacy Incidents Report any loss, theft, or unauthorized disclosures of PII to the Program Manager, Privacy POC, or ISSM. • Report as soon as suspected or confirmed. • Report whether intentional or inadvertent. • Report regardless of perceived risk. Do not further compromise the information by forwarding or replying “to all.” The DHS Privacy OfficeApril 2, 2014: slide 11

  12. What is a Privacy Incident? A suspected or confirmed: • loss of control • compromise • unauthorized disclosure • unauthorized acquisition • unauthorized access • or any other situation where persons other than authorized users and for an unauthorized purpose have access or potential access To PII whether in hard copy or electronic form

  13. Harm to Component/Department Harm to individuals Privacy Act – Ensure the security and confidentiality of records to protect against Substantial harm Embarrassment Inconvenience Unfairness Risk of economic harm, identity theft, or fraud Risk of harm to the security or integrity of the information system Potential for blackmail, mental pain, or emotional distress Disclosure of private facts (OMB Memorandum 07-16) Privacy Incident Harms

  14. Examples of Privacy Incidents • Theft of a laptop containing rosters of emergency responders • Lost or stolen thumb drive or portable hard drive of PII • Shipper loses a package of employee applications • Loss of a hard drive with current and former DHS employee SSNs • Unauthorized access to personnel files • Employee roster posted on agency website, disclosing name, personal cell phone number, and home address • Email containing payroll information transmitted from government email account to a personal email account • Key logger gains access to a computer and its accounts

  15. Your examples ?

  16. Obligation to Safeguard Sensitive PII • Apply “Need to know” principle before disclosing PII to other personnel • Challenge requested need for PII before sharing • Limit PII to official use only • PII may only be collected for an authorized purpose

  17. You Must Report Privacy Incidents Employees and Contractors Must • Report all incidents involving PII, both suspected and confirmed, to your DHS Program Manager upon detection • If DHS Program Manager is not available, report to DHS Help Desk

  18. Why Do Privacy Incidents Occur? • Loss of control • PII data is emailed to unauthorized individuals • Physical equipment containing PII is lost or stolen • Paper records are mishandled either in mail or through incorrect disposal methods • Unauthorized access to sensitive systems • Hacker gains access to secure data system • Access permission is given to individuals without a “Need to Know” • Human Error

  19. Possible Consequences Disciplinary action for failure to comply with DHS security and privacy policies Any person who knowingly and willfully discloses protected Privacy Act information in any manner to any person or agency not entitled to receive it, is subject to criminal and civil penalties under the Privacy Act

  20. The Privacy Office U.S. Department of Homeland SecurityWashington, DC 20528t: 703-235-0780; f: 703-235-0442privacy@dhs.gov; www.dhs.gov/privacy The DHS Privacy OfficeApril 2, 2014: slide 21

More Related