Privacy: Technology Implementation Guide

The Privacy Technology Implementation Guide (PTIG) offers assistance to technology managers and developers in understanding privacy protections as they design, build, and deploy operational systems. The guide is offered pursuant to the DHS Chief Privacy Officer?s responsibilities under Section 222(1) of the Homeland Security Act of 2002, as amended, to assure that the use of technologies sustain privacy protections related to the use, collection, and disclosure of personally identifiable information. The PTIG is designed to allow each Component the flexibility to adapt privacy considerations to the way that Component does business while retaining a common DHS approach. The PTIG is not prescriptive. The guide does not mandate the development of any new system requirements. All required privacy protections are governed through the Privacy Office?s existing privacy compliance process and the Office of the General Counsel?s (OGC) existing legal review process. While this guide makes general recommendations, concerns regarding specific compliance and legal requirements should be addressed directly to the Privacy Office and OGC in order to ensure that all obligations and exemptions from those obligations are properly followed. In addition, this guide does not address the unique nature of technology related to research efforts that are qualitatively different from deployed, operational systems. The Privacy Office and the Science and Technology Directorate are currently discussing a coordinated effort to create a separate PTIG for research. The PTIG is descriptive. It combines the elements of privacy protection that appear in disparate privacy compliance assessments, documents, and administrative policies and procedures into a single document, contextualized for managers and developers of operational systems. The result is a new orientation guide that provides early awareness of privacy issues and the aspects of systems that can be managed and developed to address privacy issues and streamline the process of complying with existing privacy protection requirements. This guide is organized into two sections: technology management and technology development. Each section is associated with a particular role within the technology development process and each is designed to address a particular category of privacy protection considerations. The PTIG concludes with a summary checklist presenting the considerations from the body of the guide.