DEPARTMENT OF TRANSPORTATION
Federal Motor Carrier Safety Administration (FMCSA)
PRIVACY IMPACT ASSESSMENT
For
June 2009
TABLE OF CONTENTS
Overview of FMCSA privacy management process for A&I Online
Personally Identifiable Information (PII) and A&I Online
Why A&I Online collects information
How A&I Online uses information
How A&I Online shares information
How A&I Online provides notice and consent
How A&I Online ensures data accuracy
How A&I Online provides redress
How A&I Online secures information
How Long A&I Online Retains Information
System of Records
The Federal Motor Carrier Safety Administration (FMCSA) within the U.S. Department of Transportation (DOT) has been given the mission of reducing crashes, injuries, and fatalities involving large trucks and buses (motor carriers). In carrying out its safety mandate, FMCSA:
The U.S. Department of Transportation (DOT) privacy management process is built upon a methodology that enables DOT/FMCSA to have the information, tools, and technology necessary to effectively protect PII while allowing FMCSA to achieve its mission. The methodology includes the following:
The A&I Online contains both Personally Identifiable Information and non-personally Identifiable from commercial motor vehicle (CMV) drivers:
A&I Online collects PII to provide motor carrier safety information including statistical and analytical resources for FMCSA and State enforcement personnel. A&I contains the data for the performance of compliance reviews and inspections on motor carrier operations and inspections of commercials motor vehicles, and other data elements which may results in enforcement actions being taken against a motor carrier for failure to adhere to motor carrier and laws and regulations.
The A&I Online information is used to provide quick and efficient access to descriptive statistics and analyses regarding commercial vehicle, driver, and carrier safety information. It is used by Federal and State and local law enforcement personnel as well as the motor carrier industry, insurance companies, and the general public.
The A&I Online system does not share PII data with any other systems. A&I Online is not the authoritative source for the PII data, PII data is collected from other FMCSA systems for statistical analysis of historical data. It is used by Federal and State enforcement personnel, as well as the motor carrier industry, insurance companies, and the general public.
The following groups have access to A&I:
The A&I Online does not collect PII directly from individuals. The A&I Online only stores PII that has been collected through other FMCSA systems for statistical analysis of historical data. It is not the authoritative source for the PII data. The A&I Online has a link to DOT Privacy Policy that contains all requirements by the E-Government Act of 2002.
A&I ONLINE does not collect PII directly from individuals. MCMIS is the authoritative source for the data in A&I Online. The MCMIS system provides internal data edit checks on all data submitted to MCMIS. FMCSA data entry contractors have a verification process to ensure that accurate information is entered in MCMIS. The Federal and State system where the crash, inspection and compliance review data are entered contains data quality edit checks before the data is submitted to MCMIS.
Individuals who provide PII through mail-in forms to request MCMIS reports provide that PII directly and are responsible for its accuracy. FMCSA staff reviewing and approving submitted forms check for completeness on required fields, and verify requirements when there is a question of whether a requestor has the right to a PII-containing report.
Individuals who must submit PII in order to obtain direct access to MCMIS submit this information directly. These individuals may contact their approving supervisor for any corrections to submitted information.
MCMIS is the authoritative source for the data in A&I Online. The A&I Online includes links to the DOT Privacy Policy and the DataQs system (https://dataqs.fmcsa.dot.gov/login.asp). The Privacy Policy describes DOT information practices related to the online collection and the use of PII. DataQs is an electronic means for filing concerns about federal and state data released to the public by FMCSA. Individuals can use DataQs to challenge information included in their records. Motor carriers, state agencies, and FMCSA offices can use DataQs to challenge information concerning crashes, inspections, compliance reviews, safety audits, enforcement actions, vehicle registrations, operating authorities, insurance policies, and consumer complaints. After a challenge has been submitted, DataQs automatically forwards the challenge to the appropriate office for resolution and allows the party that submitted the challenge to monitor its status.
DataQs cannot be used to challenge safety ratings or civil actions managed under 49 CFR 385.15 (Administrative Review) or 49 CFR 385.17 (Change to Safety Rating Based upon Corrective Actions). Any challenges to information provided by state agencies must be resolved by the appropriate state agency.
User access controls were developed to ensure that the number of individuals with access to restricted information in A&I Online was kept to a minimum and was restricted to only those with a “need to know.” This strategy improves data confidentiality and integrity. These access controls were developed in accordance with Federal Information Processing Standards (FIPS) Publication 200, Minimum Security Requirements for Federal Information and Information Systems dated March 2006 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Rev. 2, Recommended Security Controls for Federal Information Systems dated December 2007. Audit provisions were also included to ensure that A&I Online is used appropriately by authorized users and monitored for unauthorized usage.
The data center in which A&I Online operates is a restricted access facility. Except for a small list of personnel with trusted access privileges, DOT personnel and contractors are required to sign in and sign out, give the purpose and estimated time of their visit, and be escorted by someone with trusted access privileges. A&I Online requires FMCSA and State enforcement personnel to be authenticated with a valid user name and password, except for users of the public web application. The general public access is unrestricted via http://ai.fmcsa.dot.gov.
A certification and accreditation (C&A) is performed every three years to ensure that A&I Online meets FMCSA and federal security requirements. A&I Online also undergoes an additional C&A whenever a major change occurs to the system. A&I Online is assessed in accordance with the Office of Management and Budget (OMB) Circular A-130 Appendix III, Security of Federal Automated Information Resources and the DOT Certification and Accreditation Guidance.
Additional activities are performed more frequently to ensure that A&I Online complies with regulatory requirements. Continuous monitoring activities are also performed annually to provide ongoing oversight of security controls and to detect misuse of information stored in A&I. The FMCSA Continuous Monitoring Program includes the following activities:
A&I Online retains and disposes of information in accordance with the approved records retention schedule as required by the National Archives and Records Administration (NARA).
The master files are logged and backed up. The master tape is retained in a secure offsite storage facility and then destroyed in accordance with applicable NARA retention schedule N1-557-05-07 Item #1. The master tape is designated for deletion under this retention schedule when 5 years old, when no longer needed, or when information is superseded or becomes obsolete, whichever is sooner.
FMCSA and State enforcement personnel can retrieve reports by Driver’s name and Driver’s License Number. FMCSA is in the process of preparing a Privacy Act System of Records Notice for A&I Online that will be published in the Federal Register and posted at http://www.dot.gov/privacy/privacyactnotices.