its-hbk-1382 06-01 privacy notice and redress...
TRANSCRIPT
PRIVACY(NOTICE(AND(REDRESS
(
(
(
(
(
(
(
(
(
(
WEB(PRIVACY(&(WRITTEN(
NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS( (CHAPTER(01(
HANDBOOK( ITS9HBK91382.06901(
EFFECTIVE(DATE:( 20120907(
EXPIRATION(DATE:( 20180831 (
RESPONSIBLE(OFFICE:( OCIO/(SENIOR(AGENCY(OFFICIAL(FOR(PRIVACY(
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 2!|!P a g e !(
Change'History'Version! Date! Change!Description!1.0(( 9/7/2012( Initial(draft(((
(1.1( 8/31/2015( (Signed(and(approved(by(the(Acting(IT(Security(
Division(Director(
( ( (
( ( (
( ( (
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 3!|!P a g e !(
Table!of!Contents!!
Change(History(............................................................................................................................................(2(
Index(............................................................................................................................................................(4(
Overview(......................................................................................................................................................(5(
1.( Introduction(.........................................................................................................................................(6(
2.( Privacy(Notice(–(Web(Privacy(Policy(....................................................................................................(6(
2.1.( Web(Privacy(Policy(Roles(and(Responsibilities(............................................................................(6(
2.2.( Web(Privacy(Policy(Notice(Language(–(Standard(.........................................................................(7(
2.3.( Web(Privacy(Policy(Notice(Language(–(Additional(Privacy(Notice(.............................................(12(
3.( Privacy(Notice(–(Third9Party(Social(Media(Website(or(Application(...................................................(13(
3.1.( Third9Party(Social(Media(Notice(Roles(and(Responsibilities(......................................................(13(
4.( Privacy(Notice(–(Written(Notice(........................................................................................................(13(
4.1.( Written(Notice(Roles(and(Responsibilities(.................................................................................(14(
5.( Web(Measurement(and(Customization(Technology((Persistent(Tracking/Cookies)(Use(...................(14(
5.1.( Web(Measurement(and(Customization((Persistent(Tracking)(Use(Roles(and(Responsibilities(..(14(
5.2.( Web(Measurement(and(Customization(Technology((Persistent(Tracking/Cookies)(Use(Process
( 16(
6.( COPPA(Notice(....................................................................................................................................(19(
6.1.( COPPA(Notice(Roles(and(Responsibilities(..................................................................................(19(
6.2.( Exceptions(to(Parental(Consent(.................................................................................................(19(
7.( Privacy(Complaints(............................................................................................................................(19(
7.1.( Privacy(Complaints(Notification(Roles(and(Responsibilities(......................................................(19(
7.2.( Privacy(Complaints(Notification(Process(....................................................................................(20(
8.( Privacy(Redress(and(Privacy(Act(Information(Requests(.....................................................................(20(
8.1.( Privacy(Redress(and(Privacy(Act(Information(Requests(Roles(and(Responsibilities(..................(20(
8.2.( Redress(Process(and(Timeline(....................................................................................................(21(
Appendix(A:(Definitions(.............................................................................................................................(22(
Appendix(B:((Acronyms(..............................................................................................................................(23(
Appendix(C:((Web(Measurement(and(Customization(Technology(Use(Approval(......................................(24(
Appendix(D:((Web(Measurement(and(Customization(Technology(Use(Waiver(.........................................(25(
Appendix(E:((Web(Measurement(and(Customization(Technology(Use(Waiver(Renewal(..........................(26(
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 4!|!P a g e !(
Index'(
C!
Center(Chief(Information(Officer((CIO)(...(5,(14,(15,(16,(
23(
Center(Privacy(Manager((CPM)(.(14,(15,(16,(19,(20,(22(
Children's(Online(Privacy(Protection(Act((COPPA)(5,(6,(
7,(9,(12,(13,(18,(22(
Complaint(......................................................(5,(18,(19(
Cookies(...(See(Web(Measurement(and(Customization(
Technology(
F!
Freedom(of(Information(Act((FOIA)(.....................(7,(22(
I!
Information(System(Owner((ISO)(.(5,(7,(13,(14,(15,(16,(
18,(19,(20,(22(
N!
NASA(Chief(Information(Officer((CIO)(........(5,(6,(24,(25(
NASA(Privacy(Programs(Manager7,(11,(14,(15,(16,(18,(
19,(20,(24,(25(
P!
Persistent(Tracking(.........(See(Web(Measurement(and(
Customization(Technology(
Personally(Identifiable(Information((PII)(.(5,(10,(12,(13,(
14,(15,(16,(18,(19,(20,(21,(22,(23,(24,(25(
Privacy(Act(.....................(5,(6,(7,(11,(12,(18,(19,(20,(21(
Privacy(Impact(Assessment((PIA)(.............(5,(11,(15,(22(
R!
Redress(......................................................(5,(6,(19,(20(
S!
Section(508(of(the(Rehabilitation(Act(.....................(11(
Senior(Agency(Official(for(Privacy((SAOP)(...(14,(15,(16,(
18,(19,(20,(22(
Social(Security(Number((SSN)(...................................(9(
System(Manager(.....................................................(20(
System(of(Records(Notice((SORN)(.....................(15,(22(
T!
Third9Party(Website(or(Application(..........................(5(
W!
Web(Measurement(and(Customization(Technology(5,(
7,(12,(14,(15,(16,(17,(21,(23,(24,(25(
(
(
(
(
(
(
(
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 5!|!P a g e !(
Overview!In(order(to(ensure(transparency(and(provide(public(notice,(the(National(Aeronautics(and(Space(
Administration((NASA)(has(developed(a(web(privacy(policy(that(outlines(NASA’s(privacy(obligations,(
responsibilities,(and(collection(practices.((The(NASA(Chief(Information(Officer((CIO)(is(responsible(for(
ensuring(that(the(general(privacy(policy(is(posted(on(all(externally(facing(websites.((However,(
Information(System(Owners((ISOs)(are(ultimately(responsible(for(including(Additional!Privacy!Notices(that(identify(specific(collection(practices(and(protections,(Web(Measurement(and(Customization(
Technology((Persistent(Tracking/Cookies)(use,(and(the(Children’s(Online(Privacy(Protection(Act((COPPA)(
practices.(
ISOs(should(be(aware(of(several(requirements(outlined(within(this(handbook(including:(
• Collections(from(Children(under(13:((While(collections(from(children(under(13(are(
permissible,(all(COPPA(requirements(outlined(within(this(handbook(for(notice(and(consent(
must(be(satisfied(prior(to(collection.(((
• Third9Party(Website(or(Application(Use:((An(ISO(may(use(Third9Party(Websites(and(
Applications(so(long(as(a(Privacy(Impact(Assessment((PIA)(is(completed((in(accordance(with(
ITS5HBK51382.03501)(and(the(notice(identified(in(this(handbook(is(included(on(the(Third9Party(Website(or(Application.((
• Web(Measurement(and(Customization(Technology((Persistent(Tracking/Cookies):((As(a(
general(rule,(ISOs(may(use(single(session(technology(without(needing(additional(approvals.((
However,(if(the(ISO(wants(to(use(multi9session(web(measurement(and(customization(
technology,(the(ISO(must(consider(whether(Personally(Identifiable(Information((PII)(is(
collected.((If(PII(is(not(collected,(the(Center(Chief(Information(Officer((CIO)(must(approve(the(
use(of(the(technology(prior(to(use.((If(PII(is(collected,(a(waiver(is(required(from(the(NASA(CIO(
following(a(mandated(public(comment(period.(
((
In(addition(to(the(notice(requirements(and(processes(provided(in(this(handbook,(this(handbook(outlines(
the(privacy(complaint(and(redress(process(–(identifying(a(timeframe(for(NASA(response.((Finally,(the(
handbook(addresses(Privacy(Act(information(requests.((
(
(
(
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 6!|!P a g e !(
1. Introduction''This(handbook(is(designated(by(NASA(Procedural(Requirement((NPR)(1382.1(NASA!Privacy!Procedural!Requirements,(as(providing(implementation(guidance(for(privacy(notice(and(redress(requirements.(((The(
handbook(is(designed(to(act(as(a(guide(to(ISOs(to(ensure(that(they(are(meeting(the(privacy(notice(and(
redress(requirements(outlined(in(the(NPR.(
Applicable!Documents!
• Privacy!Act!of!1974,!as!amended,!5!U.S.C.!§!552a.!• Children's!Online!Privacy!Protection!Act!of!1998!(COPPA),!15.!U.S.C.!§§6501!et!seq.,!16!C.F.R!
§!312.!• E!Government!Act!of!2002!(e5Gov),!as!amended,!44!U.S.C.!§§!101!et!seq.!• Office!of!Management!and!Budget!(OMB)!Memorandum!M506516,!Protection!of!Sensitive!
Agency!Information,!June!23,!2006!• OMB!Memorandum!M510522,!Guidance!for!Online!use!of!Web!Measurement!and!
Customization!Technologies,!June!25,!2010!!• OMB!Memorandum!M510523,!Guidance!for!Agency!Use!of!Third5Party!Websites!and!
Applications,!June!25,!2010!• NPD!1382.17,!NASA!Privacy!Policy!• NPR!1382.1,!NASA!Privacy!Procedural!Requirements!• ITS5HBK50001,!Format!and!Procedures!for!IT!Security!Policies!and!Handbooks!• ITS5HBK51382.03501,!Privacy!Risk!Management!and!Compliance:!!Collections,!PIAs,!&!SORNs!!
Cancellation!
• Update!of!NASA!Web!Site!Privacy!Policy!Memorandum,!dated!November!28,!2005!
2. Privacy'Notice'–'Web'Privacy'Policy''The(NASA(Web(Privacy(Policy(shall(be(posted(on(all(publically(facing(websites.((The(language(that(is(
required(for(the(NASA(Web(Privacy(Policy(is(outlined(within(this(section.(
2.1. Web'Privacy'Policy'Roles'and'Responsibilities'2.1.1. The!NASA!CIO!shall:1(
• Approve(of(the(Web(Privacy(Policy.(
• Ensure(that(the(policy(outlined(in(section(2(of(this(handbook(is(posted((or(a(link(is(
provided(within)(on(all(public(facing(NASA(websites(and(any(official(websites(and(
applications(hosted(through(third9party(websites(and(applications,(hosted(externally(or(
internally.2(
(
(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((1(The(terms(“shall”(and(“may”(within(this(handbook(are(used(as(defined(in(ITS5HBK50001,!Format!and!Procedures!for!IT!Security!Policies!and!Handbooks.(2(A(link(to(the(Web(Privacy(Policy(is(included(at(the(bottom(of(every(NASA(webpage(through(the(NASA(content(
management(system.((
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 7!|!P a g e !(
2.1.2. The!ISO!shall:(
• Ensure(that(the(Web(Privacy(Policy(Notice(outlined(in(Section(2(of(this(handbook(is(
incorporated(into(public(facing(NASA(websites,(as(appropriate.(
• Ensure(that(Additional(Privacy(Notices(are(incorporated(into(public(facing(NASA(
websites,(as(appropriate.((
2.2. Web'Privacy'Policy'Notice'Language'–'Standard''The(following(language(shall(be(included,(at(a(minimum,(in(each(publically(facing(website’s(Privacy(
Policy.3(No(re9creation,(modification,(or(additions(to(this(language(are(authorized(without(the(expressed(
concurrence(of(the(NASA(Privacy(Programs(Manager.((
Thank(you(for(visiting(the(National(Aeronautics(and(Space(Administration((NASA)(website(and(
reviewing(the(NASA(policy(notices.((We(have(integrated(these(statements(into(a(single(posting(
for(ease(of(use.((In(addition,(the(website(you(are(visiting(may(have(an(Additional(Privacy(Notices(
link.((If(so,(please(look(to(that(link(to(find(specific(information(on(Web(Measurement(and(
Customization(Technology((Persistent(Tracking/Cookies)(usage(and(Children’s(Online(Privacy(
Protection(Act((COPPA)(Notices.(((The(following(links(will(help(you(navigate(to(a(specific(section:(
• Privacy(Policy((
• Security(Notice(
• Accessibility(Statement(
• Linking(Policy(and(Disclaimer(of(Endorsement(
• NASA(Privacy(Impact(Assessments((PIAs)(
• NASA(Officials(for(Privacy(Related(Matters(
Privacy0Policy0
This(Notice(provides(NASA’s(policy(regarding(the(nature,(purpose,(use,(and(sharing(of(any(
information(collected(via(this(website.((The(information(you(provide(on(a(NASA(website(will(be(
used(only(for(its(intended(purpose.((NASA(will(protect(your(information(consistent(with(the(
principles(of(the(Privacy(Act,(the(e9Government(Act(of(2002,(the(Federal(Records(Act,(and(as(
applicable,(the(Freedom(of(Information(Act((FOIA).(
Submitting(information(to(NASA(is(strictly(voluntary.((By(doing(so,(you(are(giving(NASA(
permission(to(use(the(information(for(the(intended(purpose.((If(you(do(not(want(to(give(NASA(
permission(to(use(your(information,(simply(do(not(provide(it.((However,(not(providing(certain(
information(may(result(in(NASA’s(inability(to(provide(you(with(the(information(or(services(you(
desire.(
There(are(several(types(of(information(NASA(collects.((These(include:(
(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((3(This(Web(Privacy(Policy(is(required(to(be(posted(as(written(within(this(handbook.((While(additions(may(be(
required(in(specific(areas(as(identified(in(this(handbook,(any(other(deviations(from(what(is(prescribed(are(strictly(
prohibited.((
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 8!|!P a g e !(
1. Automatically(Collected(Information(
2. Information(Collected(for(Web(Measurement(and(Customization((Persistent(Tracking/(
Cookies)(
3. Personal(Information(
4. Information(from(Children(
(
NASA(does(not(collect(information(for(commercial(marketing(purposes.((NASA(never(creates(
individual(profiles(or(gives(your(information(to(any(private(organizations.((NASA(only(shares(your(
information(with(other(government(agencies(as(the(information(relates(to(that(agency,(or(as(
otherwise(required(by(law.(((
Inquiries(regarding(NASA’s(Privacy(policy(should(be(directed(to(the(NASA(Privacy(Programs(
Manager(at([email protected].(
Automatically!Collected!Information!
NASA(collects(and(temporarily(stores(certain(technical(information(about(your(visit(to(NASA(
websites.((This(information(is(used(for(site(management(and(security(purposes.((Information(
automatically(collected(includes:(
1. The(Internet(domain(from(which(you(access(the(NASA(website((e.g.(“xcompany.com”(if(
you(use(a(private(Internet(access(account,(or(“yourschool.edu”(if(you(connect(for(an(
educational(domain)(
2. The(IP(address((a(unique(number(for(each(computer(connected(to(the(Internet)(from(
which(you(access(the(NASA(website(
3. Type(of(browser((e.g.(Internet(Explorer,(Firefox)(used(to(access(the(NASA(website(
4. The(operating(System((e.g.(Windows,(Unix)(used(to(access(the(NASA(website(
5. The(date(and(time(you(access(the(NASA(website(
6. The(URLs(of(the(pages(you(visit(
7. Your(Username,(if(it(was(used(to(log(into(the(NASA(website(
8. If(you(visited(the(NASA(website(from(another(website,(the(URL(of(the(forwarding(site.(
(
NASA(collects(this(information(to(help(NASA(make(the(NASA(website(more(useful(for(you.((The(
data(allows(NASA(to(learn(about(the(number(of(visitors(to(the(NASA(website(and(the(types(of(
technology(that(visitors(use.(
Note:((Except(for(authorized(law(enforcement(investigations,(no(attempts(are(made(to(identify(
individual(users(or(their(usage(habits.((Raw(data(logs(are(retained(temporarily(as(required(for(
security(and(site(management(purposes(only.(
Information!Collected!for!Web!Measurement!and!Customization!(Persistent!Tracking/Cookies)!
A(cookie(is(a(small(file(that(a(website(transfers(to(your(computer(to(allow(it(to(remember(specific(
information(about(your(session(while(you(are(connected.((Your(computer(will(only(share(the(
information(in(the(cookie(with(the(website(that(provided(it,(and(no(other(website(can(request(it.((
There(are(two(types(of(cookies,(session(and(persistent.((Session(cookies(last(only(as(long(as(your(
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 9!|!P a g e !(
Web(browser(is(open.((Once(you(close(your(browser,(the(cookie(is(removed.((Persistent(cookies(
store(information(on(your(computer(for(longer(periods(of(time.((NASA(does(not(use(persistent(
cookies(without(explicitly(notifying(the(user.(((
This(NASA(website(uses(session(cookies(for(technical(purposes(such(as(to(enable(better(
navigation(through(the(NASA(website,(or(to(allow(you(to(customize(your(preferences(for(
interacting(with(the(website.(((
If(the(website(you(are(visiting(uses(persistent(cookies(the(Additional0Privacy0Notices(link(will(provide(additional(information.(
Personal!Information!
If(you(choose(to(provide(NASA(with(personal(information,(through(such(methods(as(completing(
a(form(or(sending(NASA(an(email,(NASA(will(use(that(information(to(respond(to(your(message(
and(to(help(NASA(get(you(the(information(or(services(that(you(have(requested(only.(((
Remember(that(e9mail(is(not(necessarily(secure.((You(should(never(send(sensitive(or(personal(
information(like(your(Social(Security(number(in(an(e9mail.(((
Some(of(the(NASA(websites(ask(visitors(who(request(specific(information(to(fill(out(a(registration(
form.((For(example,(vendors(looking(for(marketing(opportunities(by(visiting(the(NASA(Acquisition(
Internet(Service(site(may(be(asked(to(register(to(obtain(e9mail(notices(of(business(opportunities.((
Other(information(collected(at(websites(through(questionnaires,(feedback(forms,(or(other(
means,(enables(NASA(to(determine(visitors’(interests,(with(the(goal(of(providing(better(service(
to(NASA(customers.((
Note(that(privacy(is(not(guaranteed(for(unsolicited(e9mail(sent(to(NASA.(
Information!from!Children!
NASA(is(especially(concerned(about(protecting(children’s(privacy.(We(encourage(parents(and(
teachers(to(be(actively(engaged(in(children’s(Internet(explorations.(It(is(particularly(important(
for(parents(to(guide(their(children(when(children(are(asked(to(provide(information(online.((
In(accordance(with(the(Children’s(Online(Privacy(Protection(Act((COPPA)(of(1998,(no(personal(
information(is(collected(without(explicit(consent(from(a(parent(or(guardian(for(children(under(13(
years(of(age.((If(the(website(you(are(visiting(seeks(to(collect(information(from(children(under(13(
years(of(age,(there(is(an(Additional(Privacy(Notices(link(that(outlines(or(states(the(following(
information:(
• What(Information(is(being(collected(from(children(by(NASA.(
• How(the(information(will(be(used.(
• Who(will(see(the(information(NASA(collects.(
• How(long(the(information(will(be(retained(by(NASA.(
• What(NASA’s(disclosure(practices(include.(
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 10!|!P a g e !(
• Statement(that(NASA(does(not(collect(more(information(than(is(reasonably(necessary(to(
participate(in(a(site(activity.(
• Parental(notice(and(verifiable(consent(review(process.(
• Mechanism(for(parents(to(review(or(have(removed(the(personal(information(NASA(has(
collected(from(a(child(under(13(years(of(age.(
• An(opportunity(for(parental(refusal(to(allow(NASA(future(use(of(the(information,(or(
future(collection(of(the(information,(from(their(children.((
(
ThirdDParty!Website!Notice!
NASA(uses(Third9Party(Websites(and(Applications(such(as(Twitter(and(Facebook(for(a(number(of(
outreach(and(education(campaigns.((These(social(media(websites(are(not(government(websites(
or(applications(and(are(controlled(and(operated(by(a(third9party.((NASA’s(Web(Privacy(Policy(
does(not(always(apply(to(these(social(media(websites.((NASA(will(not(maintain,(use,(or(share(PII(
submitted(to(the(third9party(social(media(websites(or(applications(unless(expressly(stated(and(
consent(is(obtained(from(individuals(providing(the(information.(((
Note(that(by(using(the(third9party(social(media(website(or(application(to(communicate(with(
NASA,(you(may(be(providing(non9government(third(parties(access(to(your(PII(for(which(NASA(has(
no(responsibility.(
Privacy!Concerns!
If(you(have(a(concern(regarding(the(NASA(Privacy(policy(or(a(privacy(practice(of(a(NASA(website,(
contact(the(NASA(Privacy(Programs(Manager(at([email protected].((Please(include(the(
NASA(Privacy(policy(or(Website(involved(and(the(description(of(the(concern.((((
Security0Notice0
For(site(security(purposes(and(to(ensure(this(web(service(remains(available(to(all(users,(this(
Government(computer(system(employs(software(programs(that(monitor(network(traffic(to(
identify(unauthorized(attempts(to(upload(or(change(information.((Anyone(using(this(system(
expressly(consents(to(such(monitoring(and(is(advised(that(if(such(monitoring(reveals(evidence(of(
possible(abuse(or(criminal(activity,(such(evidence(may(be(provided(to(appropriate(law(
enforcement(officials.(
Unauthorized(attempts(to(upload(or(change(information(on(NASA(servers(are(strictly(prohibited(
and(may(be(punishable(by(Federal(law,(such(as(the(Computer(Fraud(and(Abuse(Act(of(1986(and(
the(National(Information(Infrastructure(Protection(Act(of(1996.(
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 11!|!P a g e !(
Accessibility0Statement0
NASA(continually(strives(to(ensure(the(pages(on(this(website(are(accessible(to(individuals(with(
disabilities(in(accordance(with(Section(508(of(the(Rehabilitation(Act([Link(the(Section(508(of(the(
Rehabilitation(Act(to(http:www.section508.gov].((If(you(have(any(difficulty(viewing(any(page(
with(adaptive(technology(please(contact(the(webmaster(for(this(site,(or(the(Center(Section(508(
Coordinator([use(link(hppt://www.section508.nasa.gov/coordinators.htm].(((
Documents(on(NASA(websites(are(presented(in(may(formats.((These(formats(are(generally(
accessible(to(users(using(screen(reading(software.((Some(files(on(the(NASA(website(may(be(
posed(as(Adobe(Acrobat(Portable(Document(Format((PDF)(files.((Adobe(provides(their(Acrobat(
Reader(software(as(a(free(download.(
Linking0Policy0and0Disclaimer0of0Endorsement0
NASA(links(to(many(websites(created(and(maintained(by(other(public(and/or(private(
organizations.((NASA(provides(links(to(these(websites(as(a(service(to(our(users.((The(presence(of(
a(link(is(not(a(NASA(endorsement(of(the(site.(
When(users(follow(a(link(to(an(outside(website,(they(are(leaving(NASA(and(are(subject(to(the(
privacy(and(security(policies(of(the(owners/sponsors(of(the(outside(website(s)(NASA(is(not(
responsible(for(the(information(collection(practices(of(non9NASA(sites.(
( NASA!Privacy!Impact!Assessments!(PIAs)!!
For(a(list(of(Approved(NASA(Privacy(Impact(Assessments((PIAs)(Click(here(
[http://www.nasa.gov/privacy/PIA.html(].(
( NASA!Officials!for!Privacy!Related!Matters!
NASA!Senior!Agency!Official!for!Privacy!Larry(N.(Sweet(
Chief(Information(Officer(
(
NASA!Privacy!Programs!Manager!Bryan(McCall(
NASA(Privacy(Programs(Manager(
NASA(Office(of(the(Chief(Information(Officer(
NASA(Headquarters(
Washington,(DC(2054690001(
Contact:(202935891767(
Email:([email protected](
( (
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 12!|!P a g e !(
NASA!Privacy!Act!Officer!Patti(F.(Stockman(
NASA(Privacy(Act(Officer(
NASA(Office(of(the(Chief(Information(Officer(
NASA(Headquarters(
Washington,(DC(2054690001(
Contact:(202935894787(
Email:([email protected](
(
2.3. Web'Privacy'Policy'Notice'Language'–'Additional'Privacy'Notice''The(following(language(may(be(required(depending(on(what(information(is(actually(being(collected(from(
the(public(and(from(whom(the(information(is(being(collected.((If(it(is(required,(it(shall(be(posted(or(linked(
to(on(each(applicable(public(facing(website.(
Additional0Privacy0Notice0
Web!Measurement!and!Customization!Technology!Usage!(Persistent!Tracking/Cookies)!Notice!(
Web(Measurement(and(Customization(Technology(is(used(by(this(website.((Specifically,(cookies(
have(been(engaged.((A(cookie(is(a(small(file(that(a(website(transfers(to(your(computer(to(allow(it(
to(remember(specific(information(about(your(session(while(you(are(connected.((Your(computer(
will(only(share(the(information(with(the(website(that(provide(the(information,(and(no(other(
website(can(request(it.(((
This(NASA(website(uses(persistent(cookies(to(remember(you(between(visits(so,(for(example,(you(
can(save(your(customized(preference(settings(for(future(visits.(Persistent(cookies(store(
information(on(your(computer(for(longer(periods(of(time.(((
[CHOOSE(THE(APPROPRIATE:(((
The(web(measurement(and(customization(technology(is(not(collecting(PII.(
The(web(measurement(and(customization(technology(is(collecting(PII.((The(PII(is(not(shared(with(
third(parties(as(they(have(no(right(to(that(information.](
If(you(do(not(wish(to(have(session(or(persistent(cookies(stored(on(your(machine,(you(can(turn(
them(off(in(your(browser.((However,(as(this(website(utilizes(them,(it(may(affect(how(this(website(
functions.((
Children’s!Online!Privacy!Protection!Act!of!1998!(COPPA)!Notice!(
The(Children’s(Online(Privacy(Protection(Act(of(1998((COPPA)(governs(information(gathered(
online(from(children(under(the(age(of(13.((NASA(requires(verifiable(consent(from(a(child’s(parent(
or(guardian(prior(to(the(collection,(use,(or(disclosure(of(personal(information(form(a(child(under(
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 13!|!P a g e !(
the(age(of(13.((The(website(your(child(is(accessing(seeks(to(collect(information(and(is(therefore(
subject(to(the(requirements(of(COPPA.(((Please(note(that(NASA(does(not(collect(more(
information(than(is(reasonably(necessary(to(participate(in(this(website’s(related(activity.(((
([INSERT(appropriate(language(for(the(collection(relating(to:((What(Information(is(being(collected(
from(children(by(NASA;(How(the(information(will(be(used;(Who(will(see(the(information(NASA(
collects;(How(long(the(information(will(be(retained(by(NASA;(What(NASA’s(disclosure(practices(
include;(What(the(parental(notice(and(consent(process(is;(and(what(mechanisms(exist(for(
parents(to(review(the(information(collected(and(to(refuse(to(allow(NASA(future(use(of(the(
information(or(future(collection(of(the(information.](
3. Privacy'Notice'–'ThirdEParty'Social'Media'Website'or'Application''NASA(is(permitted(to(use(authorized(third9party(social(media(websites(and(applications.((However,(NASA(
is(required(to(provide(appropriate(privacy(notice(to(users(to(ensure(that(the(public(is(aware(of(the(
related(NASA(privacy(protections.(
The(language(outlined(in(this(section(supports(the(requirements(outlined(in(OMB!Memorandum(M510523.((((
3.1. ThirdEParty'Social'Media'Notice'Roles'and'Responsibilities'(
3.1.1. The!ISO!shall(ensure(that(official(NASA(websites(and(applications(that(are(hosted(on(third9party(websites(or(applications(include(the(following(language(on(the(website(or(
application:(
(
(
(
(
(
(
(
(
(
(
(
(
(
4. Privacy'Notice'–'Written'Notice'As(PII(is(a(sub9set(of(sensitive(information,(certain(protection(and(notice(requirements(are(needed.((In(
order(to(satisfy(those(requirements(the(following(language(has(been(created.((This(is(interim(guidance(
(Privacy!Notice:((This(is(an(official(NASA([website/application](hosted(on([name(of(third(party(website/or(application].((This(is(not(a(government(
[website/application],(the([website/application](is(controlled(and(operated(
by(a(third(party.((NASA’s(Web(Privacy(Policy(does(not(apply(to(this(
[website/application].((NASA(will(not(maintain,(use,(or(share(Personally(
Identifiable(Information((PII)(that(becomes(available(through(the(use(of(this(
third(party(websites(or(applications(unless(expressly(stated(and(consent(is(
obtained(from(the(user.(([Insert(additional(language(as(appropriate(
pertaining(to(PII(use,(etc.](
For(additional(information(on(NASA’s(Third9Party(Privacy(Notice(please(go(to(
http://www.nasa.gov/about/highlights/HP_Privacy.html.(((((
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 14!|!P a g e !(
that(is(valid(until(the(implementation(of(Controlled(Unclassified(Information((CUI)(guidance(addresses(
how(to(deal(with(marking(PII.((((((
4.1. Written'Notice'Roles'and'Responsibilities'(
4.1.1. The!IO!shall!ensure(that(PII(is(properly(marked(and(includes(the(following(statement:(
(
(
(
(
(
(
(
(
(
(
(
(
5. Web'Measurement'and'Customization'Technology'(Persistent'Tracking/Cookies)'Use''
Web(measurement(and(customization(technology(is(permitted(for(single(session(and(multi9session(use(
so(long(as(no(PII(is(collected(and(the(requirements(outlined(in(NPR(1382.1(and(this(handbook(are(
satisfied.((Multi9session(use(that(involves(the(collection(of(PII(is(prohibited,(unless(a(waiver(is(obtained(
from(the(OCIO(by(an(ISO.((The(waiver(process(includes(a(public(comment(period(and(clear(and(concise(
notice(of(the(collection(within(the(associated(privacy(policy.((ISOs(should(work(with(Center(Privacy(
Managers((CPMs)(to(determine(what(tier((as(outlined(in(OMB!Memorandum!M510522)!the(use(of(the(Web(Measurement(and(Customization(falls(under(and(how(to(be(in(compliance(with(the(NPR(and(
handbook.((
The(process(outlined(below(supports(the(requirements(outlined(in(OMB!Memorandum!M510522.(((
5.1. Web'Measurement'and'Customization'(Persistent'Tracking)'Use'Roles'and'Responsibilities'
(
5.1.1. The!Senior!Agency!Official!for!Privacy!(SAOP)!shall:(
• Approve(waivers(to(permit(Tier(3(use(of(Web(Measurement(and(Customization(
Technology.(
• Ensure(privacy(policy(provides(clear(and(conspicuous(notice(of(the(use(of(Web(
Measurement(and(Customization(Technology.((
(
Sensitive!But!Unclassified/Personally!Identifiable!Information!(SBU/PII)!This(document/media,(etc.(((choose(as(appropriate)(contains(Personally(Identifiable(Information(and(is(
considered(to(be(Sensitive(But(Unclassified(Information,(subject(to(protection(and(controls(per(the(
Privacy(Act(of(1974,(e9Gov(Act(of(2002(and(OMB(Memorandum(M906916,(NASA(Privacy(Policy((NPR(
1382.1),(and(Safeguarding(Sensitive(But(Unclassified(Information((NID(1600955),(as(appropriate.((
Wrongful(mishandling,(dissemination(or(willful(unauthorized(use(or(access(to(this(information(may(
result(in(substantial(penalties(including(fines,(administrative(or(termination(of(employment.((Control,(
store,(handle,(transmit,(distribute(and(dispose(of(strictly(in(accordance(with(current(NASA(Privacy(
Policy.(
Violations!or!suspected!breaches!should!be!reported!immediately!to:!Security!Operations!Center!at!877DNASADSEC!(627D2732).!
(
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 15!|!P a g e !(
5.1.2. The!Center!CIO!shall!approve(Tier(2(use(of(Web(Measurement(and(Customization(
Technology.!
5.1.3. The!NASA!Privacy!Programs!Manager!shall:(
• Transmit(and(track(waivers(as(they(move(through(the(approval(process.(
• Review(the(NASA(Web(Measurement(and(Customization(Technology(use(annually(and(
post(the(results(of(the(review(to(www.NASA.gov/open(with(a(mechanism(for(the(public(
to(provide(feedback(on(NASA’s(results.((
• Submit(Tier(3(waivers(to(the(SAOP(for(authorization.((
(
5.1.4. The!CPM!shall:(
• Consult(with(the(ISO(to(determine(under/in(which(tier(the(Web(Measurement(and(
Customization(Technology(use(falls.(
• Submit(Tier(3(waivers(to(the(NASA(Privacy(Programs(Manager(for(SAOP(authorization.((
• Approve(Tier(2(uses.(
• Submit(Tier(2(approval(requests(to(the(Center(CIO.(
(
5.1.5. The!ISO!shall:!
• Determine(under(what(tier(the(Web(Measurement(and(Customization(Technology(use(
falls,(in(consultation(with(the(CPM,(utilizing(the(Tier(Designation(Decision(Chart((Figure(
1).4((
o Tier!1(–(permitted(without(additional(action(required.(
o Tier!2(–(permitted(with(approval(of(Center(CIO(and(notice(to(SAOP.(
o Tier!3(–(prohibition(may(be(waived(following(public(comment(period(NASA(SAOP(
authorization.((
• Submit(Tier(2(approval(through(the(CPM.(
• Submit(Tier(3(waiver(through(the(CPM.(
• Use(Opt9In(settings(for(Tier(3(Web(Measurement(and(Customization(Technology.(
• Ensure(that(the(PIA(and(System(of(Records(Notice((SORN)(is(cited(in(the(associated(
system’s(online(Privacy(Policy.(
• Retain(the(PII(collected(only(as(long(as(necessary(to(achieve(a(NASA(mission/objective.(
• Ensure(only(NASA(Users(with(a(need(to(know(the(information(are(provided(access.(
(
(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((4(The(Privacy(&(CUI(Assessment(Tool((PCAT)(shall(be(utilized(to(complete(this(designation/process.(
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 16!|!P a g e !(
5.2. Web'Measurement'and'Customization'Technology'(Persistent'Tracking/Cookies)'Use'Process'
The(following(outlines(the(steps(required(for(use(of(Web(Measurement(and(Customization(Technology:(
1( ISO(determines(that(the(use(of(the(technology(is(necessary(to(meet(a(NASA(program(and/or(its(
associated(mission.(
2( ISO(determines(whether(the(use(of(the(technology(is(Tier(1,(Tier(2,(or(Tier(3(using(the(Designation(
Decision(Chart((Figure(1)(and(in(consultation(with(the(CPM.5(
3( If(Tier(1,(use(is(
permitted.(
STOP:((No(additional(action(required(to(use(single(session(Web(
Measurement(and(Customization(Technology.(
If(Tier(2,(ISO(obtains(
approval(from(
Center(CIO.((((((((((((
ISO(obtains(approval(from(the(Center(CIO(using(the(form(provided(in(
Appendix!C.6(((
Go!to!Steps!455.!!If(Tier(3,(ISO(obtains(
a(waiver(from(the(
SAOP.(
ISO(seeks(a(waiver(from(the(SAOP(using(the(form(provided(in(Appendix!D.7((
Go!to!Step!659.!4( If(Tier(2,(ISO(submits(approval(request(form(to(the(Center(CIO.(((see!Appendix!C)8(5( If(Tier(2,(Center(CIO(approves(use(of(Web(Measurement(and(Customization(Technology.(
(
STOP:((Once(approved,(multi9session(Web(Measurement(and(Customization(Technology(use(is(
authorized.((ISO(provides(CPM(with(a(copy,(the(CPM(maintains(approval(on(file(and(provides(the(
NASA(Privacy(Programs(Manager(with(a(copy((if(requested).9(
6( If(Tier(3,(ISO(submits(waiver(request(to(the(CPM(for(SAOP(approval.(((see!Appendix!D)10(7( The(SAOP(solicits(comment(through(www.NASA.gov/open(for(30(days(regarding(the(new(or(
substantive(change(to(existing(use(of(Web(Measurement(and(Customization(Technology.(((The(
notice(and(comment(includes:11(
• Proposed(use(and(description(of(the(use(
• Purpose(of(the(Web(Measurement(and/or(Customization(Technology(
• Usage(Tier,(session(type,(and(technology(used(
• Nature(of(information(collected(
• Purpose(and(Use(of(the(Information((
• Whether(and(to(whom(the(Information(will(be(disclosed(
• Privacy(Safeguards(
• Data(Retention(Policy(
• Whether(technology(is(enabled(by(default(or(not(and(why(
• Mechanism(for(opting(out(
• Statement(that(opting(out(does(not(limit(users(ability(to(access(comparable(information(or(
services(
(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((5(The(Privacy(&(CUI(Assessment(Tool((PCAT)(shall(be(utilized(to(complete(this(process.!((
6(Id.!
7(Id.(
8(Id.!
9(Softcopies(of(the(documents(can(be(found(within(PCAT.(
10(PCAT(shall(be(utilized(to(complete(this(process.(
11(PACT(collects(the(required(information(for(the(notice(and(comment(period.((
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 17!|!P a g e !(
• Third9Party(vendors(involved,(if(applicable.(
8( The(SAOP(reviews(and(makes(changes(to(use(where(appropriate.12(
9( The(SAOP(approves(waiver(as(appropriate(and(notifies(the(ISO.13(
10( The(ISO(may(then(use(multi9session(Web(Measurement(and(Customization(Technology(that(
collects(PII.(
11( Yearly,(thereafter,(the(ISO(submits(a(renewal(of(waiver(request(to(the(SAOP.(((see!Appendix!E)14(
(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((12(Completed(within(PCAT.(
13(Id.!
14(PCAT(shall(be(utilized(to(complete(this(process.(Waiver(renewals(are(reviewed(during(Federal(Information(
Security(Management(Act((FISMA)(end(of(year(reporting.(The(SAOP(will(determine(whether(waiver(renewals(are(
required(during(this(period.(If(an(ISO(is(no(longer(using(Web(Measurement(and(Customization(Technology,(his(or(
her(waiver(will(not(be(renewed.((
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 18!|!P a g e !(
(
Is NASA using Web Measurement and
Customization Technology?
Is PII collected by the Web Measurement and
Customization Technology?
Is Multiple Session Web Measurement and
Customization Technology used?
Is a Third Party using it on behalf of NASA and is the PII
shared with NASA?NO
YES
YES
Tier 1 – single session: Permitted without requiring approval or waiver process
Tier 2 – multi-session without PII: Requires approval of Center CIO.
Tier 3 – multi-session with PII: Not permitted unless a waiver from the NASA CIO is obtained, federal requirements are met, and explicit “opt-in” consent for collection is obtained.
Note:&&In&accordance&with&M110122,&NASA&is¬&permitted&to&use&Web&Measurement&and&Customization&Technology&to:
1.&&Track&users&individual1level&activity&on&the&Internet&outside&of&the&website&or&application&form&which&the&technology&originates;
2.&&Share&data&obtained,&without&user’s&explicit&consent,&with&other&departments&or&agencies;&or,
3.&&Cross1reference,&without&user’s&explicit&consent,&any&data&gathered&against&PII&to&determine&individual1level&of&online&activity.
NO
NO
YES
No Action required.
NO
((
Figure!1:!!Web!Measurement!and!Customization!Technology!(Persistent!Tracking)!Use!Tier!Designation!Decision!Chart!
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 19!|!P a g e !(
6. COPPA'Notice'NASA(websites(that(target(children(and(collect(PII(from(children(under(the(age(of(13(are(required(to(
provide(COPPA(notice.((The(specific(language(related(to(a/the(COPPA(Notice(is(outlined(in(Section(2(
above.(
Factors(to(be(considered(in(determining(whether(a(website(is(directed(to(children(under(13(years(of(age(
include(the(subject(matter,(visual(or(audio(content,(the(age(of(models(on(the(site,(language,(whether(
advertising(on(the(website(is(directed(at(children,(information(regarding(the(age(of(the(actual(or(
intended(audience,(and(whether(a(website(uses(animated(characters(or(other(child9oriented(features.(
6.1. COPPA'Notice'Roles'and'Responsibilities'6.1.1. The!ISO!shall(ensure(that(an(additional(COPPA(Notice(is(posted,(or(linked(to,(on(each(
applicable(public(facing(website(when(COPPA(Notice(is(required.(
6.2. Exceptions'to'Parental'Consent'Exceptions(to(parental(consent(include(when(the(website(collects(information(from(a(child(under(the(
age(of(13(to:(
• Respond(to(a(one9time(request(from(the(child((e.g.,(providing(a(poster,(responding(to(a(
question)(after(which(the(PII(is(deleted.(
• Contact(the(parent.(
• Ensure(the(safety(of(the(child(or(the(website.(
• Fulfill(a(NASA(newsletter(request(for(a(single(use((note,(however,(that(a(continuation(of(a(
subscription(requires(consent).(
7. Privacy'Complaints'The(following(outlines(the(privacy(complaints(notification(process.((This(section(does(not(provide(
guidance(on(how(to(respond(to(individual(complaints;(rather,(the(section(outlines(the(privacy(complaints(
requirements.((For(assistance(on(addressing(specific(complaints,(contact(the(SAOP(or(the(NASA(Privacy(
Programs(Manager.15(
7.1. Privacy'Complaints'Notification'Roles'and'Responsibilities'(
7.1.1. The!SAOP!shall:(
• Provide(oversight(over(the(privacy(complaint(process.(
• Ensure(that(the(NASA(Web(Privacy(Policy(website(includes(information(on(the(complaint(
process.(
(
7.1.2. The!NASA!Privacy!Programs!Manager!shall:!
• Receive(privacy(complaints(from(Members(of(the(Public(and(NASA(Users.(
• Respond(to(privacy(complaints(in(a(timely(manner.(
(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((15(Note:((Privacy(Act(complaint(information(is(found(in(14(CFR(1212.((
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 20!|!P a g e !(
• Track(all(privacy(complaints(across(the(Agency.(
(
7.1.3. The!CPM!shall!:!
• Receive(Center(level(privacy(complaints(from(members(of(the(public(and(NASA(users.(
• Respond(to(Center(level(privacy(complaints(in(a(timely(manner.(
• Provide(the(NASA(Privacy(Programs(Manager(with(information(regarding(the(Center(
level(privacy(complaints.(
(
7.2. Privacy'Complaints'Notification'Process'The(following(outlines(the(steps(required(for(privacy(complaints(notification(to(the(NASA(Privacy(
Programs(Manager:(
1( Member(of(the(public(or(NASA(User(contacts(NASA(Privacy(Programs(Manger(or(CPM(to(file(a(
complaint.(
2( The(complaint(is(addressed(as(appropriate.(
3( If(the(CPM(receives(the(complaint,(the(CPM(shall(provide(the(Privacy(Programs(Manager(with(the(
following(information:(
1. Type(of(Complaint:((Process(and(Procedural(Complaint;(Redress(Complaint;(Operational(
Complaint;(or(Referrals(Complaint.(
2. Date(the(Complaint(was(Reported(
3. The(Status(of(the(Complaint((Open,(Resolved)(
4. Description(of(the(Complaint((
4( If(the(Privacy(Programs(Manager(receives(the(complaint(first9hand(or(from(the(CPM,(the(Privacy(
Programs(Manager(shall(update(the(complaints(log(as(appropriate.(
(
8. Privacy'Redress'and'Privacy'Act'Information'Requests'The(following(outlines(the(privacy(redress(roles(and(responsibilities.((Members(of(the(public(and(NASA(
users(have(a(right(to(redress(PII(issues.((Redress(relates(to(a(NASA(mechanism(for(redress(from(misuse(or(
mishandling(of(PII(and(for(correcting(any(inaccuracies.((This(section(does(not(provide(guidance(on(how(to(
respond(to(individual(redress(issues;(rather,(the(section(outlines(the(privacy(redress(requirements.((For(
assistance(on(addressing(specific(redress(issues,(contact(the(SAOP(or(the(NASA(Privacy(Programs(
Manager.((In(addition,(Privacy(Act(related(information(access(requests(shall(follow(the(procedures(
outlined(in(14(C.F.R.(1212.(((
8.1. Privacy'Redress'and'Privacy'Act'Information'Requests'Roles'and'Responsibilities'8.1.1. The!SAOP!shall!ensure(that(PII(issues(are(redressed(by(the(NASA(Privacy(Programs(
Manager,(CPM,(or(ISO(as(appropriate.(!
8.1.2. The!NASA!Privacy!Programs!Manager!shall!redress(PII(issues,(as(appropriate.(!
(
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 21!|!P a g e !(
8.1.3. The!CPM!shall:!
• Redress(PII(issues,(as(appropriate.(
• Upon(request,(review(adverse(access(requests.(
(
8.1.4. The!System!Manager!shall!process(Privacy(Act(record(access(requests(as(permitted(in(the(
Privacy(Act(in(accordance(with(the(procedures(outlined(in(14(C.F.R.(1212.(!
8.2. Redress'Process'and'Timeline''For(Privacy(Act(related(redress(issues,(14(C.F.R.(1212(shall(be(followed.((For(non9Privacy(Act(related(
privacy(redress(issues,(this(timeline(may(be(used.(This(timeline(is(not(mandatory;(however,(if(deviations(
are(necessary,(the(SAOP(should(be(notified.(
1( Member(of(the(public(or(NASA(user(contacts(SAOP,(NASA(Privacy(Programs(Manger,(CPM,(or(ISO,(
seeking(redress(from(misuse(or(mishandling(of(PII(and(for(correcting(inaccuracies.(
2( No(later(than(15(business(days(after(the(issue(is(brought(forward,(the(NASA(Privacy(Programs(
Manager,(CPM,(or(ISO(will(respond(to(the(member(of(the(public(or(NASA(user.(
3( No(later(than(45(business(days(after(the(issue(is(brought(forward,(the(NASA(Privacy(Programs(
Manager,(CPM,(or(ISO(will(provide(the(member(of(the(public(or(NASA(user(the(appropriate(
redress.(
'( '
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 22!|!P a g e !(
Appendix'A:'Definitions''Operational!Complaint! (Complaint(involving(inquiries(regarding(Privacy(Act(matters,(not(including(Privacy(Act(requests(for(access(and/or(
correction.(
Process!and!Procedural!Complaint!
Complaint(involving(consent,(collection,(and(appropriate(notice.(
Redress!Complaint! Complaint(involving(non9Privacy(Act(inquiries(seeking(resolution(of(difficulties(or(concerns(about(privacy(matters.(
Referrals!Complaint! Involving(complaints(referred(to(another(agency(with(jurisdiction.(
!Tier!1!–!single!session! Refers(to(any(use(of(single(session(Web(Measurement(and(Customization(Technology.((Single(Session(include(
technologies(“…(that(remember(a(user’s(online(interactions(within(a(single(session(or(visit.((Any(identifier(
correlated(to(a(particular(user(is(used(only(with(that(session,(is(not(later(reused,(and(is(deleted(immediately(after(
the(session(ends.”((OMB(Memorandum(M910922((
Tier!2!–!multiDsession!without!PII!
Refers(to(any(use(of(multi9session(Web(Measurement(and(Customization(Technology(when(no(PII(is(collected.((
Multiple(Session(include(technologies(that(“remember(a(user’s(online(interactions(through(multiple(sessions(…(
requires(the(use(of(a(persistent(identifier(for(each(user,(which(lasts(across(multiple(sessions(or(visits.”(OMB(
Memorandum(M910922((
!Tier!3!–!multiDsession!with!PII!
Refers(to(any(use(of(multi9session(Web(Measurement(and(Customization(Technology(when(PII(is(collected.((OMB(
Memorandum(M910922(
ThirdDparty!websites!or!applications!
“[w]eb9based(technologies(that(are(not(exclusively(operated(or(controlled(by(a(government(entity,(or(web9based(
technologies(that(involve(significant(participation(of(a(nongovernment(entity.((Often(these(technologies(are(
located(on(a(‘.com’(website(or(other(location(that(is(not(part(of(an(official(government(domain.((However,(third9
party(applications(can(also(be(embedded(or(incorporated(on(an(agency’s(official(website.”(OMB(Memorandum(
M910923(
Web!Measurement!and!Customization!Technology!
Technologies(that(“…(are(used(to(remember(a(user’s(online(interactions(with(a(website(or(online(application(in(
order(to(conduct(measurement(and(analysis(of(usage(or(to(customize(the(user’s(experience.”((OMB(
Memorandum(M910922(
(
( '
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 23!|!P a g e !(
Appendix'B:''Acronyms''CIO! Chief(Information(Officer(
COPPA! Children’s(Online(Privacy(Protection(Act(of(1998(
CPM! Center(Privacy(Manager(
CUI! Controlled(Unclassified(Information((
!e.g.! exempli(gratia([For(example](
eDGov! E(Government(Act(of(2002(
FOIA! Freedom(of(Information(Act(
HBK! Handbook(
IP! Internet(Protocol((
ISO! Information(System(Owner(
!ITS! Information(Technology(Security(
NASA! (National(Aeronautics(and(Space(Administration(
NPD! NASA(Policy(Directive(
NPR! (NASA(Procedural(Requirement((
OMB! Office(of(Management(and(Budget(
PCAT! Privacy(&(CUI(Assessment(Tool(
PDF! Portable(Document(Format(
PIA! Privacy(Impact(Assessment(
PII! Personally(Identifiable(Information(
SAOP! Senior(Agency(Official(for(Privacy(
SBU! Sensitive(But(Unclassified((
SORN! System(of(Records(Notice(
URL! Uniform(Resource(Locator(
(
( (
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 24!|!P a g e !(
Appendix'C:''Web'Measurement'and'Customization'Technology'Use'Approval'Date(
(
(
TO:( [Center](Chief(Information(Officer((
THRU:( Center(Privacy(Manager(
FROM:((( (
SUBJECT:((
((
Approval(of(use(of(multi9session(Web(Measurement(and(Customization(Technology(
without(PII(
Background(
( Proposed(use(and(description(of(the(use:( (
( Purpose(of(the(Web(Measurement(and/or(
Customization(Technology:(
(
( Usage(Tier,(session(type,(and(technology(used:( (
( Nature(of(information(collected:( (
( Whether(technology(is(enabled(by(default(or(not(and(
why:(
(
( Mechanism(for(opting(out:( (
( Statement(that(opting(out(does(not(limit(users(ability(
to(access(comparable(information(or(services:(
(
( Identify(Third9Party(vendors(involved:(
(
(
Justification((
[State(the(compelling(need(and(how(the(information(will(be(used,(the(benefits(to(NASA(of(its(use,(and(
the(consequences(of(not(employing(it]:(
(
Concurrences:!((
( ((
(
(
Center(Privacy(Manger( ((
(
Date( (
Approved:! ((
(
(
( ((
(
(
(Center(CIO(Name)(
[Center](Chief(Information(Officer(
((
(
Date( (
(
( (
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 25!|!P a g e !(
Appendix'D:''Web'Measurement'and'Customization'Technology'Use'Waiver'Date((
(
TO:( OCIO/NASA(Chief(Information(Officer/Senior(Agency(Official(for(Privacy(
THRU:( OCIO/NASA(Chief(Technology(Officer(
THRU:( OCIO/NASA(Privacy(Programs(Manager(
FROM:((( (
SUBJECT:((
((
Waiver(to(allow(multi9session(Web(Measurement(and(Customization(Technology(
that(collects(PII(
Background(
( Proposed(use(and(description(of(the(use:( (
( Purpose(of(the(Web(Measurement(and/or(
Customization(Technology:(
(
( Usage(Tier,(session(type,(and(technology(used:( (
( Nature(of(information(collected:( (
( (Purpose(and(Use(of(the(Information:( (
( (Whether(and(to(whom(the(Information(will(be(
disclosed:(
(
( Privacy(Safeguards:( (
( Data(Retention(Policy:( (
( Whether(technology(is(enabled(by(default(or(not(and(
why:(
(
( Mechanism(for(opting(out:( (
( Statement(that(opting(out(does(not(limit(users(ability(
to(access(comparable(information(or(services:(
(
( Identify(Third9Party(vendors(involved:((
(
Justification((
[State(the(compelling(need(and(how(the(information(will(be(used,(the(benefits(to(NASA(of(its(use,(and(
the(consequences(of(not(employing(it]:(
Concurrences:!((
( (( (
Program(Manager([NASA(Responsible(Official]( ((
(
Date( (
( ( (
NASA(Privacy(Programs(Manager( ((
(
Date( (
( (( (
NASA(Agency(Chief(Technology(Officer( ((
(
Date( (
Approved:! ( (
( (( (
(NASA(CIO(Name)(
NASA(Chief(Information(Officer(
Senior(Agency(Official(for(Privacy((
( Date( (
PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(
AND(REDRESS(
ITS9HBK91382.06901(
(
V.1.0( ( 26!|!P a g e !(
Appendix'E:''Web'Measurement'and'Customization'Technology'Use'Waiver'Renewal''Date(
(
(
TO:( OCIO/NASA(Chief(Information(Officer/Senior(Agency(Official(for(Privacy(
THRU:( OCIO/NASA(Chief(Technology(Officer(
THRU:( OCIO/NASA(Privacy(Programs(Manager(
FROM:((( (
SUBJECT:((
((
(
Waiver(Renewal(to(continue(to(allow(multi9session(Web(Measurement(and(
Customization(Technology(that(collects(PII(
Renewal(of(Waiver(requested(for:((((
(
Justification((
[State(the(continued(compelling(need(and(how(the(information(will(be(used,(the(benefits(to(NASA(of(its(
use,(and(the(consequences(of(not(employing(it]:(
(
(
(
Concurrences:!((
( ((
(
(
Program(Manager([NASA(Responsible(Official]( ((
(
Date( (
( ((
(
(
NASA(Privacy(Programs(Manager( ((
(
Date( (
( ((
(
(
NASA(Chief(Technology(Officer( ((
(
Date( (
( ((
(
(
Approved:! ((
(
(
( ((
(
(
(NASA(CIO(Name)(
NASA(Chief(Information(Officer(
Senior(Agency(Official(for(Privacy((
((
(
Date( (
(