1. Is the use of the data both relevant Yes. The TIN is used by the IRS to identify a business entity and necessary to the purpose for wishing to do business with the Federal Government. which the system is being designed? 2.a. Will the system derive new data No or create previously unavailable data about an individual through aggregation from the information collected? 2.b. Will the new data be placed in N/A There is no new data. – the individual's record (client or employee)? 2.c. Can the system make N/A There is no new data. – determinations about individuals that would not be possible without the new data? 2.d. How will the new data be verified N/A There is no new data. – for relevance and accuracy? 3.a. If the data is being consolidated, N/A what controls are in place to protect the data and prevent unauthorized access? Explain. 3.b. If processes are being N/A consolidated, are the proper controls remaining in place to protect the data and prevent unauthorized access? Explain. 4. How will the data be retrieved? The data is retrieved either through a record search by an Can it be retrieved by personal authorized user which displays the record results, to include identifier? If yes, explain. the TIN for FOUO users, or through an extract to authorized data access users. A record search cannot be conducted by an unauthorized user using the TIN alone. 5. What are the potential effects on A. There is no system consolidation in this context. Systems the privacy rights of individuals of: that connect to SAM receive data extracts that are preformatted. a. Consolidation and linkage of files and systems; B. There are no data derivations done on SAM.
1. Is the use of the data both relevant and necessary to the purpose for which the system is being designed? Yes. The TIN is used by the IRS to identify a business entity wishing to do business with the Federal Government. 2.a. Will the system derive new data or create previously unavailable data about an individual through aggregation from the information collected? No 2.b. Will the new data be placed in the individual's record (client or employee)? N/A – There is no new data. 2.c. Can the system make determinations about individuals that would not be possible without the new data? N/A – There is no new data. 2.d. How will the new data be verified for relevance and accuracy? N/A – There is no new data. 3.a. If the data is being consolidated, what controls are in place to protect the data and prevent unauthorized access? Explain. N/A 3.b. If processes are being consolidated, are the proper controls remaining in place to protect the data and prevent unauthorized access? Explain. N/A 4. How will the data be retrieved? Can it be retrieved by personal identifier? If yes, explain. The data is retrieved either through a record search by an authorized user which displays the record results, to include the TIN for FOUO users, or through an extract to authorized data access users. A record search cannot be conducted by an unauthorized user using the TIN alone. 5. What are the potential effects on the privacy rights of individuals of: a. Consolidation and linkage of files and systems; A. There is no system consolidation in this context. Systems that connect to SAM receive data extracts that are preformatted. B. There are no data derivations done on SAM.
privacyimpactSAM.docx