Privacy and Civil Liberties Impact Assessments (PCLIAs)

Section 208 of the E-Government Act of 2002 created the requirement to conduct Privacy and Civil Liberties Impact Assessments (PCLIAs) for systems that process Personally Identifiable Information (PII). A PCLIA is required for new systems, those systems undergoing modification or enhancement and Paperwork Reduction Act electronic collections of information. OMB Memorandum 03-22, dated September 26, 2003, contains guidance for conducting PCLIAs as well as procedures for processing and posting completed assessments.

WHAT IS A PCLIA?

A decision tool used by the Bureau of Engraving and Printing (BEP) to identify and mitigate privacy risks that notifies the public:

What PII BEP is collecting;
Why the PII is being collected; and
How the PII will be collected, used, accessed, shared, safeguarded and stored.

A PCLIA SHOULD ACCOMPLISH THREE GOALS:

Ensure conformance with applicable legal, regulatory, and policy requirements for privacy;
Determine the risks and effects; and
Evaluate protections and alternative processes to mitigate potential privacy risks.

BEP CONDUCTS A PCLIA WHEN:

Developing or procuring any new technologies or systems that handle or collect PII;
Creating a new program, system, technology or information collection that may have privacy implications;
Updating a system that results in new privacy risks; and
Issuing a new or updated rulemaking that entails the collection of PII.

PCLIAs have been conducted on the following systems and are available in PDF format: