Privacy Impact Assessment Questionnaire
Veterans Investigative Preference and Employment Rights System (VIPERS) - FY 2015
The Uniformed Services Employment and Reemployment Rights Act of 1994 (USERRA) was signed into law on October 13, 1994. The USERRA law clarifies and strengthens the Veterans' Reemployment Rights (VRR) Statute. USERRA is intended to minimize the disadvantages to an individual's employment rights that may occur when that person needs to be absent from his or her civilian employment to serve in this country's uniformed services. USERRA makes major improvements in protecting service member rights and benefits by clarifying the law and improving enforcement mechanisms.
Congress passed USERRA to safeguard the employment rights and benefits of service members upon their return to civilian life. USERRA also prohibits employers from discriminating or retaliating against persons on the basis of their military service, obligations or intent to join a uniformed service or actions taken to enforce any person's rights under USERRA.
The Department of Labor has issued regulations that clarify its position on the rights of returning service members to family and medical leave under the Uniformed Services Employment and Reemployment Rights Act (USERRA). See 20 CFR Part 1002.210. USERRA is administered by the United States Department of Labor, through the Veterans' Employment and Training Service (VETS). VETS' provides assistance to those persons experiencing service connected problems with their civilian employment and provides information about the Act to employers.
Veterans Investigative Preference and Employment Rights System (VIPERS)was developed in 1996 and has been operational since October 1, 1996. The purpose was to establish an effective automated process for collecting, consolidating, and reporting USERRA data submitted by Veterans' Employment and Training Services (VETS) staff. The system provides the capability to interactively accept and manipulate data, then perform a roll up of information through Regional Offices to the Regional Lead Center (RLC) in Atlanta Ga.
USERRA Information Management System (UIMS), Veterans' Preference Information Management System (VPIMS), and Electronic 1010 (E-1010) systems were developed using Internet technologies. These subsystems reside under the VIPERS umbrella, and are available through the VETS' application servers hosted in the DOL ECN/DCN environment. Users in the national office (NO), regional office (RO) and state office (SO) have access, depending on security and permissions, to some or all of the functionality on the system. Data for this application is stored locally on the server hosted at the DOL ECN/DCN security center.
Veterans have two options for filing a claim; they may file a USERRA or Veterans' Preference (VP) claim manually by mailing, faxing, or bringing the paper form (VETS/USERRA/VP Form 1010) to the DOL/VETS Atlanta Regional Lead Center (ARLC) office. Or they may submit a claim electronically by accessing the E-1010 claims interface via a web browser such as Internet Explorer (IE). The E1010 gives an alternative interactive method for filing the paper form through the DOL/VETS USERRA Interface Management System (UIMS), now VIPERS.
VIPERS has undergone enhancements to include converting the UIMS application from Microsoft (MS) Access to MS SQL Server, in accordance with VETS targeted technology architecture in order to expand the existing UIMS systems' functionality. These enhancements:
- Allows VETS investigators the ability to update USERRA case data via the internet;
- Creates electronic 1063 and Memorandum of Agreement forms within the system;
- Expands existing workflow functionality and case status tracking capabilities to include stakeholder USERRA case management business processes; and
- Allows Department of Defense (DOD) Employer Support of the Guard and Reserve (ESGR), Office of the Solicitor (SOL), Office of Special Counsel (OSC), and the Department of Justice (DOJ), the ability to access and update USERRA case information via the Internet. This includes addressing stakeholder security concerns and establishing data exchange(s) between UIMS and other existing information systems (e.g., UVPCSS (USERRA/Veterans Preference Compliant Submission System) and ESGR system).
- The VIPERS module supports interactive input and update of current VIPERS case data. Data is maintained in such a way that the baseline data entered can be manipulated to provide both standard reports and flexible spreadsheet data exports for use in assisting in the analysis of VIPERS operations and outcomes. The system is accessible through the Internet. It provides information for use at several organizational and administrative levels, including: VETS field staff doing investigations, VETS supervisors and managers, VETS executive staff, and Congress. Data collected does not only include information on cases opened by investigators, but also provides output to support specified information requirements on other activities essential to the VIPERS program, such as outreach actions, employer contacts and technical assistance responses.
- Section 208 of the E-Government Act of 2002 requires Federal government agencies to conduct a Privacy Impact Assessment (PIA) for all new or substantially changed technology that collects, maintains, or disseminates personally identifiable information (PII) for members of the public or where information is collected, maintained, or disseminated using information technology.
Characterization of the Information
The following questions are intended to define the scope of the information requested and/or collected as well as reasons for its collection as part of the program, system, or technology being developed.
Specify whether the system collects personally identifiable information (PII) on DOL employees, other federal employees, contractors, members of the public (U.S. citizens), foreign citizens, or minor children.
VIPERS collect personally identifiable information (PII) on members of the public (U.S. citizens, service members and their employers).
What are the sources of the PII in the information system?
USERRA/Veterans' Preference (UVP) case data.
What is the PII being collected, used, disseminated, or maintained?
First and/or last name; Date of birth; SSN; Military, immigration, or other government-issued identifier, Residential address; Personal phone numbers (e.g., phone, fax, cell); Mailing address (e.g., P.O. Box); Personal e-mail address; Certificates (e.g., birth, death, marriage), Legal documents or notes (e.g., divorce decree, criminal records); Educational records; Employment Records.
How is the PII collected?
The information on the electronic VETS/USERRA/VP E-1010 Form is used by the Veteran's Employment and Training Service (VETS) to electronically collect the PII. The information is collected by the E-1010 then electronically transferred to VIPERS. Also, the information is collected manually when the claimant mails or faxes a 1010 form to the ARLC.
How will the information be checked for accuracy?
The claimant self-identifies the PII information on the e-1010 form. If the information is incorrect, the assigned investigator verifies the information and can make corrections as necessary.
What specific legal authorities, arrangements, and/or agreements defined the collection of information?
The information collected is essential to VETS in meeting its Congressional and statutory mandate to investigate 38 USC Ch. 4301 and 5 USC 3330.
Privacy Impact Analysis
Given the amount and type of data collected, discuss the privacy risks identified and how they were mitigated.
The VP and USERRA system of records contains data related to civil investigations which include: initial investigative complaint form, background, investigators' fact finding records, witness statements, supporting documents provided by claimants and employers, and other information relevant to a determination of veterans' reemployment rights.
All computer-readable data extracts from VIPERS do not include PII. The VIPERS system provides unique identification and authentication for all system users. Users and developers of VIPERS are aware that they share individual and collective responsibility for maintaining system security per the system's rules of behavior which requires signing and adherence by all VIPERS users.
VIPERS' user accounts are provided solely for the use of the individual for whom they are intended, and are created based on that individual's specific job responsibilities, access to cases other than assigned are limited to a need to know/need to share basis. The RLC Security Officer reviews audit logs on a monthly basis. The VIPERS auditing system functionality was enhanced to include email messages alerts of auditable events and system changes.
Uses of the PII
The following questions are intended to clearly delineate the use of information and the accuracy of the data being used.
Describe all the uses of the PII
PII information is used solely for the purpose of processing and tracking USERRA cases. Disclosure may also be necessary to the Department of Veterans Affairs, Department of Defense (ESGR), Department of Justice, and the Office of Special Counsel for further adjudication.
What types of tools are used to analyze data and what type of data may be produced?
Microsoft (MS) Excel is the primary tool used to analyze the data. Reports are normally produced that shows statistical information.
Will the system derive new data, or create previously unavailable data, about an individual through aggregation of the collected information?
Previously unavailable data may be derived through aggregation of the collected information.
If the system uses commercial or publicly available data, please explain why and how it is used.
Users are not precluded from using commercial or publicly available data to conduct research or verify information in order to manage each case.
Privacy Impact Analysis
Based on Federal requirements and mandates, the Department of Labor (DOL) Veterans Employment and Training Service (VETS) is responsible for ensuring that the VETERANS INVESTIGATIVE PREFERENCE AND EMPLOYMENT RIGHTS SYSTEM (VIPERS) meets the minimum security requirements defined in the Federal Information Processing Standards (FIPS) Publication (PUB) 200, Minimum Security Requirements for Federal Information and Information Systems. The Agency has developed access control procedures to ensure the integrity, confidentiality, and availability of its information and information systems.
The access control policy and procedures are consistent with applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance.
The following questions are intended to outline how long information will be retained after the initial collection.
How long is information retained in the system?
Information is destroyed in the 10th year. Pension cases are maintained for 50 years as mandated. Electronic data/case files are retained forever.
Has the retention schedule been approved by the DOL agency records officer and the National Archives and Records Administration (NARA)?
Yes, the retention schedule has been approved by the DOL agency records officer and NARA.
What efforts are being made to eliminate or reduce PII that is collected, stored or maintained by the system if it is no longer required?
The system is not configured to prompt users/administrator to review and purge PII data every 90 days. PII data remains required beyond 90 days because it is essential to accurately cross-reference VETS' data with other agencies' data (especially DOD/ESGR) for compilation of common claimant data required by the USERRA Annual Report to Congress.
How is it determined that PII is no longer required?
PII data is deemed no longer necessary per the mandates that govern USERRA data and the approved retention schedule as defined that information is destroyed in the 10th year. Pension cases are maintained for 50 years as mandated. Electronic data/case files are retained forever, including PII.
Privacy Impact Analysis
There is a possibility that the length of time data is retained in VIPERS could lead to unauthorized access or the release of PII information. To prevent this risk, all VIPERS users must have a supervisor's approved application for access, agree to the VIPERS Rules of Behavior, maintain an active account, and have a strong password to access the system. Supervisors are required to advise the VIPERS' System Administrator when an investigator is no longer assigned investigative responsibilities or no longer employed with the Agency or Federal Government.
The VIPERS user has the responsibility to protect data to which they are given access. Users must adhere to the Rules of Behavior as defined in the VIPERS System Security Plans, DOL and agency guidance. In addition, DOL conducts mandatory annual training with regards to Information Systems Security, Privacy Awareness and Personal Identifiable Information, ensuring that all Department of Labor staff members are educated regarding the proper methods for handling privacy information.
VIPERS system administrators review and analyze the audit logs on a monthly basis for any trends or anomalies in the system, any indication of suspicious activity is escalated in accordance with VETS incident handling procedures. Audit logs are currently configured to automatically alert the administrators when specific security alerts occur.
Internal Sharing and Disclosure
The following questions are intended to define the scope of sharing within the Department of Labor.
With which internal organization(s) is the PII shared, what information is shared, and for what purpose?
PII is shared with the DOL's Office of the Solicitor (SOL) attorneys' assigned USERRA cases.
How is the PII transmitted or disclosed?
Hardcopy case records are transmitted by Fed Ex. Electronic records remain in VIPERS.
Privacy Impact Analysis
Investigators and SOL's attorneys report PII information into VIPERS. The electronic information is not transferred to any other electronic systems. Hardcopy records are Fed- Ex between VETS and SOL.
External Sharing and Disclosure
The following questions are intended to define the content, scope, and authority for information sharing external to DOL which includes federal, state and local government, and the private sector.
With which external organization(s) is the PII shared, what information is shared, and for what purpose?
Disclosure may also be necessary with the Department of Justice (DOJ) and the Office of Special Counsel (OSC) when complaints have proceeded to an advanced stage. Both agencies are responsible for the litigation of meritorious claims. Also, disclosure is necessary with the Employer Support of the Guard and Reserve (ESGR) for verifying claimants/claims processed within their system.
Is the sharing of PII outside the Department compatible with the original collection?
If so, is it covered by an appropriate routine use in a SORN? If so, please describe. If not, please describe under what legal mechanism the program or system is allowed to share the PII outside of DOL.
System of Records Notice (Privacy Act Systems - DOL/VETS-1 and DOL/VETS-2)
How is the information shared outside the Department and what security measures safeguard its transmission?
DOJ and OSC receive only hardcopy case records. Both agencies have electronic access to VIPER for documenting case status and to review electronic records. ESGR access the information electronically through VIPERS.
Privacy Impact Analysis
Sharing of information outside of DOL can potentially expose PII to unauthorized individuals. To prevent risk, all non-DOL users of VIPERS must request VETS' Chief of Investigations approval for application access; annually agree to the Rules of Behavior, maintain an active account, and have a strong password. Non-DOL Federal employees are required to advise the Chief of Investigations when an authorized user is not assigned investigative responsibilities or no longer employed.
The following questions are directed at notice to the individual of the scope of PII collected, the right to consent to uses of said information, and the right to decline to provide information.
Was notice provided to the individual prior to collection of PII?
Yes, The Privacy Act Statement.
("The primary use of this information is by staff of the Veterans' Employment and Training Service in investigating cases under USERRA or laws/regulations relating to veterans' preference in Federal employment. Disclosure of this information may be made to: a Federal, state or local agency for appropriate reasons; in connection with litigation; and to an individual or contractor performing a Federal function. Furnishing the information on this form, including your Social Security Number, is voluntary. However, failure to provide this information may jeopardize the Department of Labor's ability to provide assistance on your claim.")
Do individuals have the opportunity and/or right to decline to provide information?
Yes, but the individuals are advised that in order to identify the merits of the claim, the information may be needed.
individuals have the right to consent to particular uses of the information? If so, how does the individual exercise the right?
Yes, an individual may limit use of the information and the release of the PII. In completing the form individuals are informed that some information is optional but desired for claim processing, giving them the option to divulge or withhold information as they deem necessary. The claimant is advised that the information may be needed in order to process and/or identify the merits of the claim.
Privacy Impact Analysis
Notices are provided to individuals by mail, fax or email depending on their initial contact preferences. There is a risk that an individual may not receive or read the notice; therefore the notice is relayed verbally by the investigator assigned to the individual's case during the initial contact. Individuals are also advised to read the Privacy Act statement that is provided on page 2 of the e-1010 form before signing and submitting the form. Each individual has the right under the privacy act of 1974 to request a copy of their investigative records to verify that information is divulged as requested.
(Excerpt from e-1010 Form: Please read the Privacy Act statement and certification on page two of Form 1010 before signing and submitting the form).
Access, Redress, and Correction
The following questions are directed at an individual's ability to ensure the accuracy of the information collected about them.
What are the procedures that allow individuals to gain access to their information?
VETS have developed an Internet-based system that will allow USERRA claimants to officially submit a claim via the VETS website using the electronic version of Form 1010 (e-1010). Individuals may gain access to their information post submission by:
- First registering for access to the VETS 1010 Form online submission tool and create a user ID and strong password.
- Individuals filing an electronic claim may access their information electronically with the self-created ID and password.
- Claimants filing a paper claim may request a record of the file if they did not retain a copy. Upon completion of the e-1010 form claimants are advised to print and retain a copy for reference.
- If the claimant did not retain a copy the individual may make a written request for information under the Privacy Act and the Freedom of Information Act.
What are the procedures for correcting inaccurate or erroneous information?
Electronic filers may self-verify the information prior to submitting the e-1010 form or update electronically if additional information or corrections are requested by the reviewing investigator.
If a paper claim is submitted the investigator will contact the claimant in writing to request additional information or to verify the accuracy of the submitted claim.
In cases where the hardcopy form is incomplete the ARLC will return the form to the claimant for completion via the contact information provided (e.g., postal mail, fax), or verified via telephone if provided.
How are individuals notified of the procedures for correcting their information?
The ARLC notify claimants in writing of the procedure for correcting their information in the same manner in which the claim was submitted (email, postage mail, etc.,) or by the contact preferences provided by the claimant (e.g. telephone).
If no formal redress is provided, what alternatives are available to the individual?
This question is not applicable as there is a formal process in place.
Privacy Impact Analysis
There is a risk that the information collected may not be accurate, however the claimant self-identifies the PII information on the e-1010 form prior to submitting. In cases where the information is still incorrect, the assigned investigator verifies the information with the claimant and can make authorized corrections as necessary. An individual may also request their records under the Privacy Act and the Freedom of Information Act to verify that the information collected is what was released.
Technical Access and Security
The following questions are intended to describe technical safeguards and security measures.
What procedures are in place to determine which users may access the system and are they documented?
VIPERS' utilizes an access request form to verify users' identity, what type of access is required, and who is authorizing access to the VIPERS system. Users' supervisor must verify and approve account requests, including access rights and privileges. Account requests (user authorization forms), are then forwarded to the Atlanta Regional Lead Center (ARLC) for final approval. The ARLC's Bo Wroble and Chris McClain are the system administrators responsible for user account management.
Will Department contractors have access to the system?
Contractors do not have access to the VIPERS application.
Describe what privacy training is provided to users, either generally or specifically relevant to the program or system?
Users as well as VIPERS system administrators must complete the computer security awareness role based training prior to receiving access to the system. When access is granted an unauthorized use banner on the VIPERS login page warns the user of legal repercussions for illegal use activities. Users must also review and acknowledge the ROB before accessing the system.
What auditing measures and technical safeguards are in place to prevent misuse of data?
All access (who, what, when and where) to VIPERS data is monitored and recorded by the system's administrative staff.
Privacy Impact Analysis
The VIPERS' access to case information is based on a "need-to-know/need-to-share" basis. Federal staff has access only to assigned cases. Management has access to the cases under their supervision. To prevent risk, all users of VIPER must have a supervisor's approved application for access, agree to the system's Rules of Behavior, maintain an active account, and have a strong password. Supervisors are required to advise the VIPERS' Administrator when an investigator is no longer assigned investigative responsibilities or no longer employed with the Federal government. Users requesting access to the system are validated through the web server to the forms authentication on dedicated web server login procedures. Transactions are encrypted in both directions using Secure Socket Layer/Transport Layer Security (SSL/TLS) data encryption. VIPERS also receive very secure protection from the ECN/DCN General Support System (GSS) which is composed of Firewalls, Intrusion Detection Systems, Intrusion Prevention Systems, Anti-Virus systems and data encryption.
The following questions are directed at critically analyzing the selection process for any technologies utilized by the system, including system hardware, RFID, biometrics, and other technology.
What stage of development is the system in, and what project development life cycle was used?
The system is in the Operations and Maintenance (O&M) stage.
Does the project employ technology which may raise privacy concerns? If so please discuss their implementation?
The technology currently used does not raise any known privacy concerns. VIPERS is based on the evaluation of the applicable laws and provides a framework by which individuals can ensure that they have complied with all relevant privacy policies, regulations, and guidance, both internal and external to DOL.
As a result of performing the PIA, what choices has the agency made regarding the information technology system and collection of information?
PMO Security in collaboration with VETS' System Owner and Information System Security Officer has completed the PIA for the VIPER System currently in operation. VETS have determined that the safeguards and controls currently in place for this moderate system effectively protects the information.
VETS have determined that it is collecting the minimum necessary information for the proper performance of a documented agency function.