Protecting Personal Information at Fermilab

Outline F Why must we protect personal information? F What is Protected Personally Identifiable Information (Protected PII)? F What are your obligations?

Why? F Identity theft based on improper disclosure of personal information is a serious problem F Several government agencies have been embarrassed by losses of large quantities of personal data F Orders from White House --> DOE --> Office of Science mandate more careful treatment of personal information F Fermilab respects the privacy of employees and users

What is Protected PII? F At Fermilab, Protected PII is defined as an individual’s name in combination with one or more of the following items: –social security number or foreign national ID number –passport number or visa number –driver’s license number –personal credit card number –bank account number –date and place of birth (both together, not one by itself) –mother’s maiden name –security clearance information –biometric information (fingerprints, retinal scan, DNA) –criminal records –detailed personal financial information (not merely salary history) –detailed medical records –detailed educational transcripts (not merely a list of degrees)

Your Obligations F You must not have any Protected PII on any of your computers F You will need to sign a statement that you have inspected your computers and deleted any Protected PII you discovered F “Your computer” means any computer that you are the sole user of, and any file space you have on shared systems or servers. System administrators will NOT examine users’ files; this is the responsibility if each user. F Note: this applies only to PII that “belongs” to Fermilab, and only to electronic copies of PII

Examples of PII that must be deleted F Resumes or transcripts containing social security numbers or other Protected PII F Conference databases with credit card numbers or visa numbers F Spreadsheets with credit card or passport numbers of division/section travelers F Word documents of trip reports or foreign travel forms containing passport numbers or other Protected PII F Note that it is OK to enter Protected PII into external databases (like FTMS for foreign travel) as long as no local copies of reports containing things like passport numbers are kept on your computer.

For more information F If you need to access any of the Protected PII maintained by the laboratory (for example, in HR or financial databases) you will need additional training about proper procedures F If you think you have a business need for keeping PII (or have any other questions) contact your division/section privacy representative

Division/Section Privacy Reps F AD: Arlene Lennox F CD: Irwin Gaines F PPD: Eileen Phillips F TD: John Konc F BSS: Bill Flaherty F ES&H: Tim Miller F FESS: Odarka Jurkiw F FIN: Tom Ackenhusen F WDRS: Heather Sidman

Advanced Course F For lab employees or users who need to access the small amount of protected PII the lab maintains F DOE orders mandate: –Protected PII can only be kept in moderate level Major Applications –Protected PII cannot be downloaded to portable devices or devices outside the boundary of the major application –Any such downloads require a waiver from the DOE site manager, must be renewed every 90 days, and the data must be encrypted –Any remote access to protected PII required two factor authentication and a 30-minute timeout –Any suspected loss of PII must be reported within 1 hour

Fermilab implementation F Two categories of protected PII: –Local access only: live in “locked room” major application No downloading or remote access possible Examples: neutron therapy, radiation film badge –Network access required Lives in financial systems major application (Peoplesoft, Oracle Financials) Only certain accounts will be allowed to access the PII portions of these databases, and no access at all from general internet Only special cases (e.g., particle accelerator school) require downloading; these will require waivers and encryption

Next Steps for PII F Adoption and issuance of policies and procedures by lab management F Appointing division/section privacy reps F Having all employees and users view training material and sign statement F Bring current caches of protected PII into full compliance

Other categories of information F Responsibility on data owner to categorize and protect data according to general guidelines F Level 4: Secure Access data: PII and other statute protected data; specific lab wide policies F Level 3: Restricted Access data: data whose loss or improper disclosure could result in significant harm to the laboratory or to individuals; access restricted to specific identified individuals with business need to know F Level 2: Limited Access data: data whose loss or disclosure could result in only limited harm; access must be restricted to broad groups of individuals F Level 1: Open Access data: no restrictions