U.S. Government Privacy Certification - International Association of ...

copyright © 2011, IAPPiii. Key Office of Management and Budget (“OMB”) Memoranda1. OMB M-03-22: Guidance for Implementing the Privacy Provisionsof the E-Government Act2. Modifications under M-03-022a. OMB M-99-05: Privacy Responsibilitiesb. OMB M-99-18: Privacy Policies on Federal Web sitesc. OMB M-00-13: Privacy Policies and Data Collection onFederal Web sitesiv. Privacy Impact Assessments (“PIA”)1. When required2. Timing3. Content4. Exceptionsa. National security systemsb. Systems previously assessed under a PIAc. Internal government operationsd. Systems collecting non-PIIi. Government Websites5. PIAs versus SORNs6. Publication requirements7. Reporting requirements8. Relationship to The Privacy Act of 1974d. Consolidated Appropriations Act of 2005i. Chief Privacy Officer and Audit provisionse. The Data Quality Act of 2002i. OMB guidanceii. Agency requirementsiii. Administrative mechanismsiv. Periodic reportingf. The Federal Information Security Management Act of 2002 (“FISMA”)i. Federal agency responsibilities1. Agency program2. Agency reporting3. Performance programii. System vs. Enterprise compliance1. PIA versus security certification and accreditation (“C&A”)2. National Institute of Standards and Technology (“NIST”) riskmanagement frameworka. SP 800-122: Guide to Protecting the Confidentiality ofPersonally Identifiable Information (PII)iii. OMB reporting instructions for FISMAg. Requirements under Section 803 of the Implementing Recommendations of the9/11 Commission Act of 2007h. The Federal Agency Data Mining Reporting Act of 2007i. Federal open meetings lawsi. Federal Advisory Committee Act (“FACA”)ii. Government in the Sunshine Actj. Open Government Directivei. OMB M-10-06Pease International Tradeport ∙ 75 Rochester Avenue. Suite 4 ∙ Portsmouth, NH 03801 USA ∙+1 603.427.9200 ∙ certification@privacyassociation.org6