Skip to page content
Office of the Chief Information Officer
Bookmark and Share

Privacy Impact Assessment Questionnaire
OSHA Web Services FY 2013

Overview

OSHA Web Services is a General Support System including 13 minor applications and is owned by OSHA's Directorate of Information Technology. The purpose is to provide access to materials and interactive resources that support the OSHA mission. In addition the site provides public access to more than 3.2 million inspection records and a number of online services for the public. OWS is an OSHA Major Information System (MIS). OWS was developed in 1994 and has been operational since 1995. OWS hosts the OSHA Public Web Site; the OSHA Intranet, (intranet.osha.gov); the OSHA Extranet; the joint US / European Union web site; the joint Tri-National web site; and several minor applications. The OSHA Public Web Site includes over 400,000 pages and more than 2 million hypertext links on enforcement, standards, training, outreach, education, alliances, and workplace hazards by industry or process. The Public Site receives more than 12 million visitor sessions monthly. OWS includes web page development services, including dynamic database driven content and database management, application development, operating system management, and server hardware management. OWS primarily displays static content to users of the web sites.

However, there are a few applications that require public interaction such as ordering OSHA publications and filing a workplace complaint online. While non-sensitive personally identifiable information, (PII), is collected and maintained from the public it is not displayed. OWS modules include hardware procurement and maintenance, database administration, application administration, document creation and management, and overall security. OWS received its Authority to Operate on May 23, 2007.

Characterization of the Information

What are the sources of the PII in the information system?

Users of OSHA Web Services voluntarily submit non-sensitive PII in order to use specific services.

What is the PII being collected, used, disseminated, or maintained?

Typical contact information is collected, used, and maintained. Only the OSHA 800 number application displays non-sensitive DOL employee information, and only to the OSHA 800 number call center staff.

How is the PII collected?

Web-based forms.

How will the information be checked for accuracy?

Some technical controls are in place and data is checked during submission on the form. The contact information is verified or rejected as the minor applications attempt to provide the requested services, some applications use automated means and some require human intervention.

What specific legal authorities, arrangements, and/or agreements defined the collection of information?

The standard DOL web privacy policy is posted on the site. Users of OSHA Web Services voluntarily submit non-sensitive PII in order to use specific services.

What is the purpose or use of the PII collection for the third-party website or application?

No third-party website is used. The purpose of any voluntary PII collected is to provide contact or mailing information for requested follow-up from a compliance assistance specialist or online ordering of a publication.

Will PII become available to the agency through public use of a third-party website or application?

No. No protected PII is collected.

Is the PII collection from a 3rd party website or application voluntary?

No 3rd party website is used. Any PII in the application is provided voluntarily. No protected PII is collected.

Privacy Impact Analysis

Risks are very low since the data is only used for contact purposes and is not displayed. While database administrators have direct access they are governed by DOL and OSHA policy regarding disclosure and separation of duties. The OSHA 800 number application displays non-sensitive DOL employee information only to the OSHA 800 number call center staff using IP restricted access to the actual call center.

Uses of the PII

Describe all the uses of the PII

The non-sensitive PII is used for contacting users of some OSHA minor applications such as mailing OSHA publications and responding to online complaints.

What types of tools are used to analyze data and what type of data may be produced?

No analysis tools are used other that basic automated data checking during submission. No data is reused, produced in another form, or displayed.

Will the system derive new data, or create previously unavailable data, about an individual through aggregation of the collected information?

No.

If the system uses commercial or publicly available data, please explain why and how it is used.

OWS considers all collected non sensitive PII to be commercially or publicly available and is therefore non-sensitive. Data is used only for the purpose of contacting the requesting web users.

Will the use of PII create or modify a "system of records notification" under the Privacy Act?

No.

Is the agencies use of PII regarding third-party website or application consistent with all applicable laws, regulations and policies?

Yes.

Privacy Impact Analysis

Risks are very low since the data is only used for contact purposes and is not displayed. While database administrators have direct access they are governed by DOL and OSHA policy regarding disclosure and separation of duties.

Retention

How long is information retained in the system?

Information is retained in the database and through automated emails for some applications. All information is maintained in the database for auditing purposes. There are currently no plans for deletion. Emails are retained according to DOL, OSHA, and minor application owner policy.

Is a retention period established to minimize privacy risk?

Yes

Has the retention schedule been approved by the DOL agency records officer and the National Archives and Records Administration (NARA)?

No.

What efforts are being made to eliminate or reduce PII that is collected, stored or maintained by the system if it is no longer required?

PII is purged from minor applications using it, every six months and deleted permanently if the application is no longer being used.

How is it determined that PII is no longer required?

Policy and procedural guidance as well as life cycle operations and maintenance analysis with program offices responsible for the minor applications collecting the data

Privacy Impact Analysis

Possible low level risks are:

  • Running out of storage space on the database server; not an issue in the foreseeable future.
  • Failure of staff to comply with DOL, OSHA, and minor application owner policy.

Internal Sharing and Disclosure

With which internal organization(s) is the PII shared, what information is shared, and for what purpose?

Information is only shared with the owners of some minor applications or a gatekeeper through automated emails.

How is the PII transmitted or disclosed?

Information in the database is not transmitted or disclosed. Automated emails are directed only to the system owners or a gatekeeper.

Privacy Impact Analysis

Possible low level risks are:

  • The emails are not encrypted and could be intercepted. However, they are sent only to specific system owners or gatekeepers that are all internal to DOL. The OSHA online complaint form is an exception and emails are sent externally to OSHA state gatekeepers. Also, PII contained in these emails is non-sensitive and publicly available.
  • A database administrator, (DBA) could access the information using SQL statements. However, DBAs are governed by DOL and OSHA policy regarding disclosure and separation of duties. PII contained in these emails is non-sensitive and publicly available. Also, the standard DOL email disclaimer gets attached to the emails as they go out of the DOL email bridgehead server.

External Sharing and Disclosure

With which external organization(s) is the PII shared, what information is shared, and for what purpose?

The only information shared is related to the OSHA online complaint form minor application. Complaints submitted that are in the jurisdiction of a state OSH plan are sent to the state's gatekeeper via email.

Is the sharing of PII outside the Department compatible with the original collection? If so, is it covered by an appropriate routine use in a SORN? If so, please describe. If not, please describe under what legal mechanism the program or system is allowed to share the PII outside of DOL.

Yes. States with their own OSH enforcement programs are required to at least meet all Federal regulations and receive 50% funding from OSHA and states with consultation programs receive 90% federal funding from OSHA.

How is the information shared outside the Department and what security measures safeguard its transmission?

Sent via email. Emails are sent directly to a specific state OSH gatekeeper. Also, PII contained in these emails is non-sensitive and publicly available.

Privacy Impact Analysis

Possible low level risks are:

  • The emails are not encrypted and could be intercepted. However, they are sent only to specific system owners or gatekeepers that are all internal to DOL. The OSHA online complaint form is an exception and emails are sent externally to OSHA state gatekeepers. PII contained in these emails is non-sensitive and publicly available. Also, the standard DOL email disclaimer gets attached to the emails as they go out of the DOL exchange bridgehead server.

Notice

Was notice provided to the individual prior to collection of PII?

Yes.

Do individuals have the opportunity and/or right to decline to provide information?

Yes.

Do individuals have the right to consent to particular uses of the information? If so, how does the individual exercise the right?

By submitting their information they automatically consent to its use according to the DOL web Privacy and Security Statement

Privacy Impact Analysis

Possible low level risks are:

  • The Privacy and Security Statement" link is on the bottom of all OWS pages. It's possible that users won't click on the link and view the policy. However, the individuals are fully aware of the information collection since they are specifically entering their information in the minor applications.

Access, Redress and Correction

What are the procedures that allow individuals to gain access to their information?

Generally, they cannot access their information. Help desk support is available for some minor applications in which they would talk directly to an OWS DBA who could access their information.

What are the procedures for correcting inaccurate or erroneous information?

If an individual enters incorrect information they will not receive the services of the minor application collecting it. They will have to reenter their information again to obtain access to those services.

How are individuals notified of the procedures for correcting their information?

If their contact information is entered incorrectly there is no way to contact them.

If no formal redress is provided, what alternatives are available to the individual?

They will have to reenter their information again to obtain access to those services.

Privacy Impact Analysis

Information access and redress is not available so there is no risk. Correction is accomplished by the individual submitting correct information to access the specific service.

Technical Access and Security

What procedures are in place to determine which users may access the system and are they documented?

System administrators and database administrators are required to sign Rules of Behavior and are officially appointed by the Directorate of Information Technology Director with a Letter of Appointment. This process is documented in an OWS Standard Operating Procedure.

Will Department contractors have access to the system?

Yes, OSHA contractors have access.

Describe what privacy training is provided to users, either generally or specifically relevant to the program or system?

OWS staff is trained by the OWS project manager and security lead on privacy issues and requirements during the employment boarding process. Also, annual security training is required per FISMA which also contains general privacy training.

What auditing measures and technical safeguards are in place to prevent misuse of data?

Database auditing is in use.

Privacy Impact Analysis

Possible low level risks are: Those possibly associated with DOL only addressing selected NIST 800-53 requirements this fiscal year.

Technology

What stage of development is the system in, and what project development life cycle was used?

OWS is in the Operations and Maintenance Phase according to DOL policy.

Does the project employ technology which may raise privacy concerns? If so please discuss their implementation?

OWS utilizes DOL approved and evaluated technology. There are no known privacy concerns related to utilized technology.

Determination

OSHA has completed the PIA for OSHA Web Services which is currently in operation. OSHA has determined that the safeguards and controls for this moderate system adequately protect the information.

OSHA has determined that it is collecting the minimum necessary information for the proper performance of a documented agency function.