Consular Electronic Application Center (CEAC) - US Department of ...

More documents

Recommendations

Info

Privacy Impact Assessment: Consular Electronic Application Center (CEAC) With respect to passport applicants initial issuance and passport renewals, U.S. citizens who voluntarily apply for a U.S. Passport have the option of supplying all requested information and may decline to provide part or all of the information required if they wish to obtain a passport without penalty but with a possible delay in obtaining their passport with the exception of their SSN. If a individual has a SSN and does not supply it when the application is submitted they are clearly notified on the application that they are of risk of a fine and/or penalties from the IRS. c. Do individuals have the right to consent to limited, special, and/or specific uses of the information? If so, how does the individual exercise the right? Visa applications: By providing the information requested, visa applicants are consenting for the information to be used for its identified purpose. With respect to visa applications, individuals who apply for a visa are put on notice that the information may be used as consistent with INA section 222(f). They may not elect for more limited use of the information. U.S. Passport applications: By providing the information requested and signing the application, U.S. citizens are consenting for the information to be used for its identified purpose as it is clearly stated on the passport application and renewal forms. d. Privacy Impact Analysis: Describe how notice is provided to individuals and how the risks associated with individuals being unaware of the collection are mitigated. Visa applications: With respect to visa applications, the information provided on the form and in the SORN regarding visa records fully explain how the information may be used by the Department and how it is protected under INA 222 (f). U.S. Passport applications: An applicant voluntarily elects to complete a passport application. All forms at the time of data collection contain a Privacy Statement, which indicates what information is collected, (why, for what purpose the information will be routinely used, who the information will be shared with, and the consequences of not providing the data requested). These safeguard and notification procedures are reasonable and adequate in relation to the system’s purposes. 9. Notification and Redress a. What are the procedures to allow individuals to gain access to their information and to amend information they believe to be incorrect? CEAC CTRAC users’ access invoice data through shared data (data known to users and the system). These users will have unique user IDs and passwords assigned to them. These users will have information such as case ID and petitioner information or case ID and applicant ID or case ID and applicant name. The CEAC CTRAC, the immigrant fee payment component will allow a login based on petitioner number and case ID or case ID and applicant ID in order to access the on-line invoice for payment of applicant or AOS fees. The IVAGENT and IVAPP will use the same type of shared data access control. With respect to visa applications: The data submitted in the CEAC GENNIV (on-line DS- 160) and AGNATO (on-line DS-1648) can not be accessed once it is submitted, with the CEAC PIA December 2008 8
Privacy Impact Assessment: Consular Electronic Application Center (CEAC) exception of name, DOB, gender and passport number that CEAC RDC uses. RDC does not have the ability to modify this data. RDC uses PKI certificates to control access. Visa applicants may change their information at any time prior to submission of the application to the Consulate or Embassy. Once that is done, applicants may make changes only by filing a new application with the Department or correcting the information during the course of a visa interview. The Department will release the following information to a visa applicant upon request and this guidance is available to the public in 9 FAM 40.4: (1) Correspondence previously sent to or given to the applicant by the post; (2) Civil documents presented by the applicant and (3) Visa applications and any other documents, including sworn statements, submitted by the applicant to the consular officer in the form in which they were submitted, i.e., with any remarks or notations by U.S. Government employees deleted. Future releases will provide internet/public users with the means to create their own unique user IDs and password for access or access the system using knowledge-based data. Internet/public users will only have access to their own personal data. Internet/public users with accounts: A public user completing a visa application will create a user account that would allow them to save partially completed applications and come back later to login to their account and complete it. These users may also be able to track the status of their application. With respect to future U.S. passport applications: The procedures for notification and redress are published in the system of records notice identified in paragraph 8 above, and in rules published at 22 CFR 171.31. The procedures inform the individual about how to inquire about the existence of records about them, how to request access to their records, and how to request amendment of their record. Certain exemptions to Privacy Act provisions for notification and redress may exist for certain portions of a passport records on grounds pertaining to law enforcement, in the interest of national defense and foreign policy if the records have been properly classified, and to carry out protective responsibilities under 18 U.S.C. 3056. These exemptions are published as agency rules at 22 CFR 171.32. b. Privacy Impact Analysis: Discuss the privacy risks associated with notification and redress and how those risks are mitigated. To the extent information in CEAC may be Privacy Act-covered, the notification and redress mechanisms offered to individuals are reasonable and adequate in relation to the system’s purposes and uses and its applicable legal requirements. Therefore this category of privacy risk is appropriately mitigated in CEAC. Additionally, internet/public users will only have access to their own personal data, and this restriction is enforced automatically by the technical access controls inherent within CEAC. 10. Controls on Access a. What procedures are in place to determine which users may access the system and the extent of their access? What monitoring, recording, and auditing safeguards are in place to prevent misuse of data? CEAC supports several user groups: CEAC PIA December 2008 9
Page 1 and 2: Privacy Impact Assessment: Consular
Page 7: Privacy Impact Assessment: Consular

Consular Electronic Application Center (CEAC) - US Department of ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?