ITS-HBK-1382 06-01 Privacy Notice and Redress signed...PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS( AND(REDRESS(ITS9HBK91382.06901((V.1.0( ( 2!|!Page!

PRIVACY(NOTICE(AND(REDRESS

(

(

(

(

(

(

(

(

(

(

WEB(PRIVACY(&(WRITTEN(

NOTICE,(COMPLAINTS,(ACCESS(

AND(REDRESS( (CHAPTER(01(

HANDBOOK( ITS9HBK91382.06901(

EFFECTIVE(DATE:( 20120907(

EXPIRATION(DATE:( 20180831 (

RESPONSIBLE(OFFICE:( OCIO/(SENIOR(AGENCY(OFFICIAL(FOR(PRIVACY(

PRIVACY(NOTICE(AND(REDRESS:((WEB(PRIVACY(&(WRITTEN(NOTICE,(COMPLAINTS,(ACCESS(

AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 2!|!P a g e !(

Change'History'Version! Date! Change!Description!1.0(( 9/7/2012( Initial(draft(((

(1.1( 8/31/2015( (Signed(and(approved(by(the(Acting(IT(Security(

Division(Director(

( ( (

( ( (

( ( (


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 3!|!P a g e !(

Table!of!Contents!!

Change(History(............................................................................................................................................(2(

Index(............................................................................................................................................................(4(

Overview(......................................................................................................................................................(5(

1.( Introduction(.........................................................................................................................................(6(

2.( Privacy(Notice(–(Web(Privacy(Policy(....................................................................................................(6(

2.1.( Web(Privacy(Policy(Roles(and(Responsibilities(............................................................................(6(

2.2.( Web(Privacy(Policy(Notice(Language(–(Standard(.........................................................................(7(

2.3.( Web(Privacy(Policy(Notice(Language(–(Additional(Privacy(Notice(.............................................(12(

3.( Privacy(Notice(–(Third9Party(Social(Media(Website(or(Application(...................................................(13(

3.1.( Third9Party(Social(Media(Notice(Roles(and(Responsibilities(......................................................(13(

4.( Privacy(Notice(–(Written(Notice(........................................................................................................(13(

4.1.( Written(Notice(Roles(and(Responsibilities(.................................................................................(14(

5.( Web(Measurement(and(Customization(Technology((Persistent(Tracking/Cookies)(Use(...................(14(

5.1.( Web(Measurement(and(Customization((Persistent(Tracking)(Use(Roles(and(Responsibilities(..(14(

5.2.( Web(Measurement(and(Customization(Technology((Persistent(Tracking/Cookies)(Use(Process

( 16(

6.( COPPA(Notice(....................................................................................................................................(19(

6.1.( COPPA(Notice(Roles(and(Responsibilities(..................................................................................(19(

6.2.( Exceptions(to(Parental(Consent(.................................................................................................(19(

7.( Privacy(Complaints(............................................................................................................................(19(

7.1.( Privacy(Complaints(Notification(Roles(and(Responsibilities(......................................................(19(

7.2.( Privacy(Complaints(Notification(Process(....................................................................................(20(

8.( Privacy(Redress(and(Privacy(Act(Information(Requests(.....................................................................(20(

8.1.( Privacy(Redress(and(Privacy(Act(Information(Requests(Roles(and(Responsibilities(..................(20(

8.2.( Redress(Process(and(Timeline(....................................................................................................(21(

Appendix(A:(Definitions(.............................................................................................................................(22(

Appendix(B:((Acronyms(..............................................................................................................................(23(

Appendix(C:((Web(Measurement(and(Customization(Technology(Use(Approval(......................................(24(

Appendix(D:((Web(Measurement(and(Customization(Technology(Use(Waiver(.........................................(25(

Appendix(E:((Web(Measurement(and(Customization(Technology(Use(Waiver(Renewal(..........................(26(


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 4!|!P a g e !(

Index'(

C!

Center(Chief(Information(Officer((CIO)(...(5,(14,(15,(16,(

23(

Center(Privacy(Manager((CPM)(.(14,(15,(16,(19,(20,(22(

Children's(Online(Privacy(Protection(Act((COPPA)(5,(6,(

7,(9,(12,(13,(18,(22(

Complaint(......................................................(5,(18,(19(

Cookies(...(See(Web(Measurement(and(Customization(

Technology(

F!

Freedom(of(Information(Act((FOIA)(.....................(7,(22(

I!

Information(System(Owner((ISO)(.(5,(7,(13,(14,(15,(16,(

18,(19,(20,(22(

N!

NASA(Chief(Information(Officer((CIO)(........(5,(6,(24,(25(

NASA(Privacy(Programs(Manager7,(11,(14,(15,(16,(18,(

19,(20,(24,(25(

P!

Persistent(Tracking(.........(See(Web(Measurement(and(

Customization(Technology(

Personally(Identifiable(Information((PII)(.(5,(10,(12,(13,(

14,(15,(16,(18,(19,(20,(21,(22,(23,(24,(25(

Privacy(Act(.....................(5,(6,(7,(11,(12,(18,(19,(20,(21(

Privacy(Impact(Assessment((PIA)(.............(5,(11,(15,(22(

R!

Redress(......................................................(5,(6,(19,(20(

S!

Section(508(of(the(Rehabilitation(Act(.....................(11(

Senior(Agency(Official(for(Privacy((SAOP)(...(14,(15,(16,(

18,(19,(20,(22(

Social(Security(Number((SSN)(...................................(9(

System(Manager(.....................................................(20(

System(of(Records(Notice((SORN)(.....................(15,(22(

T!

Third9Party(Website(or(Application(..........................(5(

W!

Web(Measurement(and(Customization(Technology(5,(

7,(12,(14,(15,(16,(17,(21,(23,(24,(25(

(

(

(

(

(

(

(


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 5!|!P a g e !(

Overview!In(order(to(ensure(transparency(and(provide(public(notice,(the(National(Aeronautics(and(Space(

Administration((NASA)(has(developed(a(web(privacy(policy(that(outlines(NASA’s(privacy(obligations,(

responsibilities,(and(collection(practices.((The(NASA(Chief(Information(Officer((CIO)(is(responsible(for(

ensuring(that(the(general(privacy(policy(is(posted(on(all(externally(facing(websites.((However,(

Information(System(Owners((ISOs)(are(ultimately(responsible(for(including(Additional!Privacy!Notices(that(identify(specific(collection(practices(and(protections,(Web(Measurement(and(Customization(

Technology((Persistent(Tracking/Cookies)(use,(and(the(Children’s(Online(Privacy(Protection(Act((COPPA)(

practices.(

ISOs(should(be(aware(of(several(requirements(outlined(within(this(handbook(including:(

• Collections(from(Children(under(13:((While(collections(from(children(under(13(are(

permissible,(all(COPPA(requirements(outlined(within(this(handbook(for(notice(and(consent(

must(be(satisfied(prior(to(collection.(((

• Third9Party(Website(or(Application(Use:((An(ISO(may(use(Third9Party(Websites(and(

Applications(so(long(as(a(Privacy(Impact(Assessment((PIA)(is(completed((in(accordance(with(

ITS5HBK51382.03501)(and(the(notice(identified(in(this(handbook(is(included(on(the(Third9Party(Website(or(Application.((

• Web(Measurement(and(Customization(Technology((Persistent(Tracking/Cookies):((As(a(

general(rule,(ISOs(may(use(single(session(technology(without(needing(additional(approvals.((

However,(if(the(ISO(wants(to(use(multi9session(web(measurement(and(customization(

technology,(the(ISO(must(consider(whether(Personally(Identifiable(Information((PII)(is(

collected.((If(PII(is(not(collected,(the(Center(Chief(Information(Officer((CIO)(must(approve(the(

use(of(the(technology(prior(to(use.((If(PII(is(collected,(a(waiver(is(required(from(the(NASA(CIO(

following(a(mandated(public(comment(period.(

((

In(addition(to(the(notice(requirements(and(processes(provided(in(this(handbook,(this(handbook(outlines(

the(privacy(complaint(and(redress(process(–(identifying(a(timeframe(for(NASA(response.((Finally,(the(

handbook(addresses(Privacy(Act(information(requests.((

(

(

(


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 6!|!P a g e !(

1. Introduction''This(handbook(is(designated(by(NASA(Procedural(Requirement((NPR)(1382.1(NASA!Privacy!Procedural!Requirements,(as(providing(implementation(guidance(for(privacy(notice(and(redress(requirements.(((The(

handbook(is(designed(to(act(as(a(guide(to(ISOs(to(ensure(that(they(are(meeting(the(privacy(notice(and(

redress(requirements(outlined(in(the(NPR.(

Applicable!Documents!

• Privacy!Act!of!1974,!as!amended,!5!U.S.C.!§!552a.!• Children's!Online!Privacy!Protection!Act!of!1998!(COPPA),!15.!U.S.C.!§§6501!et!seq.,!16!C.F.R!

§!312.!• E!Government!Act!of!2002!(e5Gov),!as!amended,!44!U.S.C.!§§!101!et!seq.!• Office!of!Management!and!Budget!(OMB)!Memorandum!M506516,!Protection!of!Sensitive!

Agency!Information,!June!23,!2006!• OMB!Memorandum!M510522,!Guidance!for!Online!use!of!Web!Measurement!and!

Customization!Technologies,!June!25,!2010!!• OMB!Memorandum!M510523,!Guidance!for!Agency!Use!of!Third5Party!Websites!and!

Applications,!June!25,!2010!• NPD!1382.17,!NASA!Privacy!Policy!• NPR!1382.1,!NASA!Privacy!Procedural!Requirements!• ITS5HBK50001,!Format!and!Procedures!for!IT!Security!Policies!and!Handbooks!• ITS5HBK51382.03501,!Privacy!Risk!Management!and!Compliance:!!Collections,!PIAs,!&!SORNs!!

Cancellation!

• Update!of!NASA!Web!Site!Privacy!Policy!Memorandum,!dated!November!28,!2005!

2. Privacy'Notice'–'Web'Privacy'Policy''The(NASA(Web(Privacy(Policy(shall(be(posted(on(all(publically(facing(websites.((The(language(that(is(

required(for(the(NASA(Web(Privacy(Policy(is(outlined(within(this(section.(

2.1. Web'Privacy'Policy'Roles'and'Responsibilities'2.1.1. The!NASA!CIO!shall:1(

• Approve(of(the(Web(Privacy(Policy.(

• Ensure(that(the(policy(outlined(in(section(2(of(this(handbook(is(posted((or(a(link(is(

provided(within)(on(all(public(facing(NASA(websites(and(any(official(websites(and(

applications(hosted(through(third9party(websites(and(applications,(hosted(externally(or(

internally.2(

(

(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((1(The(terms(“shall”(and(“may”(within(this(handbook(are(used(as(defined(in(ITS5HBK50001,!Format!and!Procedures!for!IT!Security!Policies!and!Handbooks.(2(A(link(to(the(Web(Privacy(Policy(is(included(at(the(bottom(of(every(NASA(webpage(through(the(NASA(content(

management(system.((


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 7!|!P a g e !(

2.1.2. The!ISO!shall:(

• Ensure(that(the(Web(Privacy(Policy(Notice(outlined(in(Section(2(of(this(handbook(is(

incorporated(into(public(facing(NASA(websites,(as(appropriate.(

• Ensure(that(Additional(Privacy(Notices(are(incorporated(into(public(facing(NASA(

websites,(as(appropriate.((

2.2. Web'Privacy'Policy'Notice'Language'–'Standard''The(following(language(shall(be(included,(at(a(minimum,(in(each(publically(facing(website’s(Privacy(

Policy.3(No(re9creation,(modification,(or(additions(to(this(language(are(authorized(without(the(expressed(

concurrence(of(the(NASA(Privacy(Programs(Manager.((

Thank(you(for(visiting(the(National(Aeronautics(and(Space(Administration((NASA)(website(and(

reviewing(the(NASA(policy(notices.((We(have(integrated(these(statements(into(a(single(posting(

for(ease(of(use.((In(addition,(the(website(you(are(visiting(may(have(an(Additional(Privacy(Notices(

link.((If(so,(please(look(to(that(link(to(find(specific(information(on(Web(Measurement(and(

Customization(Technology((Persistent(Tracking/Cookies)(usage(and(Children’s(Online(Privacy(

Protection(Act((COPPA)(Notices.(((The(following(links(will(help(you(navigate(to(a(specific(section:(

• Privacy(Policy((

• Security(Notice(

• Accessibility(Statement(

• Linking(Policy(and(Disclaimer(of(Endorsement(

• NASA(Privacy(Impact(Assessments((PIAs)(

• NASA(Officials(for(Privacy(Related(Matters(

Privacy0Policy0

This(Notice(provides(NASA’s(policy(regarding(the(nature,(purpose,(use,(and(sharing(of(any(

information(collected(via(this(website.((The(information(you(provide(on(a(NASA(website(will(be(

used(only(for(its(intended(purpose.((NASA(will(protect(your(information(consistent(with(the(

principles(of(the(Privacy(Act,(the(e9Government(Act(of(2002,(the(Federal(Records(Act,(and(as(

applicable,(the(Freedom(of(Information(Act((FOIA).(

Submitting(information(to(NASA(is(strictly(voluntary.((By(doing(so,(you(are(giving(NASA(

permission(to(use(the(information(for(the(intended(purpose.((If(you(do(not(want(to(give(NASA(

permission(to(use(your(information,(simply(do(not(provide(it.((However,(not(providing(certain(

information(may(result(in(NASA’s(inability(to(provide(you(with(the(information(or(services(you(

desire.(

There(are(several(types(of(information(NASA(collects.((These(include:(

(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((3(This(Web(Privacy(Policy(is(required(to(be(posted(as(written(within(this(handbook.((While(additions(may(be(

required(in(specific(areas(as(identified(in(this(handbook,(any(other(deviations(from(what(is(prescribed(are(strictly(

prohibited.((


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 8!|!P a g e !(

1. Automatically(Collected(Information(

2. Information(Collected(for(Web(Measurement(and(Customization((Persistent(Tracking/(

Cookies)(

3. Personal(Information(

4. Information(from(Children(

(

NASA(does(not(collect(information(for(commercial(marketing(purposes.((NASA(never(creates(

individual(profiles(or(gives(your(information(to(any(private(organizations.((NASA(only(shares(your(

information(with(other(government(agencies(as(the(information(relates(to(that(agency,(or(as(

otherwise(required(by(law.(((

Inquiries(regarding(NASA’s(Privacy(policy(should(be(directed(to(the(NASA(Privacy(Programs(

Manager(at([email protected].(

Automatically!Collected!Information!

NASA(collects(and(temporarily(stores(certain(technical(information(about(your(visit(to(NASA(

websites.((This(information(is(used(for(site(management(and(security(purposes.((Information(

automatically(collected(includes:(

1. The(Internet(domain(from(which(you(access(the(NASA(website((e.g.(“xcompany.com”(if(

you(use(a(private(Internet(access(account,(or(“yourschool.edu”(if(you(connect(for(an(

educational(domain)(

2. The(IP(address((a(unique(number(for(each(computer(connected(to(the(Internet)(from(

which(you(access(the(NASA(website(

3. Type(of(browser((e.g.(Internet(Explorer,(Firefox)(used(to(access(the(NASA(website(

4. The(operating(System((e.g.(Windows,(Unix)(used(to(access(the(NASA(website(

5. The(date(and(time(you(access(the(NASA(website(

6. The(URLs(of(the(pages(you(visit(

7. Your(Username,(if(it(was(used(to(log(into(the(NASA(website(

8. If(you(visited(the(NASA(website(from(another(website,(the(URL(of(the(forwarding(site.(

(

NASA(collects(this(information(to(help(NASA(make(the(NASA(website(more(useful(for(you.((The(

data(allows(NASA(to(learn(about(the(number(of(visitors(to(the(NASA(website(and(the(types(of(

technology(that(visitors(use.(

Note:((Except(for(authorized(law(enforcement(investigations,(no(attempts(are(made(to(identify(

individual(users(or(their(usage(habits.((Raw(data(logs(are(retained(temporarily(as(required(for(

security(and(site(management(purposes(only.(

Information!Collected!for!Web!Measurement!and!Customization!(Persistent!Tracking/Cookies)!

A(cookie(is(a(small(file(that(a(website(transfers(to(your(computer(to(allow(it(to(remember(specific(

information(about(your(session(while(you(are(connected.((Your(computer(will(only(share(the(

information(in(the(cookie(with(the(website(that(provided(it,(and(no(other(website(can(request(it.((

There(are(two(types(of(cookies,(session(and(persistent.((Session(cookies(last(only(as(long(as(your(


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 9!|!P a g e !(

Web(browser(is(open.((Once(you(close(your(browser,(the(cookie(is(removed.((Persistent(cookies(

store(information(on(your(computer(for(longer(periods(of(time.((NASA(does(not(use(persistent(

cookies(without(explicitly(notifying(the(user.(((

This(NASA(website(uses(session(cookies(for(technical(purposes(such(as(to(enable(better(

navigation(through(the(NASA(website,(or(to(allow(you(to(customize(your(preferences(for(

interacting(with(the(website.(((

If(the(website(you(are(visiting(uses(persistent(cookies(the(Additional0Privacy0Notices(link(will(provide(additional(information.(

Personal!Information!

If(you(choose(to(provide(NASA(with(personal(information,(through(such(methods(as(completing(

a(form(or(sending(NASA(an(email,(NASA(will(use(that(information(to(respond(to(your(message(

and(to(help(NASA(get(you(the(information(or(services(that(you(have(requested(only.(((

Remember(that(e9mail(is(not(necessarily(secure.((You(should(never(send(sensitive(or(personal(

information(like(your(Social(Security(number(in(an(e9mail.(((

Some(of(the(NASA(websites(ask(visitors(who(request(specific(information(to(fill(out(a(registration(

form.((For(example,(vendors(looking(for(marketing(opportunities(by(visiting(the(NASA(Acquisition(

Internet(Service(site(may(be(asked(to(register(to(obtain(e9mail(notices(of(business(opportunities.((

Other(information(collected(at(websites(through(questionnaires,(feedback(forms,(or(other(

means,(enables(NASA(to(determine(visitors’(interests,(with(the(goal(of(providing(better(service(

to(NASA(customers.((

Note(that(privacy(is(not(guaranteed(for(unsolicited(e9mail(sent(to(NASA.(

Information!from!Children!

NASA(is(especially(concerned(about(protecting(children’s(privacy.(We(encourage(parents(and(

teachers(to(be(actively(engaged(in(children’s(Internet(explorations.(It(is(particularly(important(

for(parents(to(guide(their(children(when(children(are(asked(to(provide(information(online.((

In(accordance(with(the(Children’s(Online(Privacy(Protection(Act((COPPA)(of(1998,(no(personal(

information(is(collected(without(explicit(consent(from(a(parent(or(guardian(for(children(under(13(

years(of(age.((If(the(website(you(are(visiting(seeks(to(collect(information(from(children(under(13(

years(of(age,(there(is(an(Additional(Privacy(Notices(link(that(outlines(or(states(the(following(

information:(

• What(Information(is(being(collected(from(children(by(NASA.(

• How(the(information(will(be(used.(

• Who(will(see(the(information(NASA(collects.(

• How(long(the(information(will(be(retained(by(NASA.(

• What(NASA’s(disclosure(practices(include.(


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 10!|!P a g e !(

• Statement(that(NASA(does(not(collect(more(information(than(is(reasonably(necessary(to(

participate(in(a(site(activity.(

• Parental(notice(and(verifiable(consent(review(process.(

• Mechanism(for(parents(to(review(or(have(removed(the(personal(information(NASA(has(

collected(from(a(child(under(13(years(of(age.(

• An(opportunity(for(parental(refusal(to(allow(NASA(future(use(of(the(information,(or(

future(collection(of(the(information,(from(their(children.((

(

ThirdDParty!Website!Notice!

NASA(uses(Third9Party(Websites(and(Applications(such(as(Twitter(and(Facebook(for(a(number(of(

outreach(and(education(campaigns.((These(social(media(websites(are(not(government(websites(

or(applications(and(are(controlled(and(operated(by(a(third9party.((NASA’s(Web(Privacy(Policy(

does(not(always(apply(to(these(social(media(websites.((NASA(will(not(maintain,(use,(or(share(PII(

submitted(to(the(third9party(social(media(websites(or(applications(unless(expressly(stated(and(

consent(is(obtained(from(individuals(providing(the(information.(((

Note(that(by(using(the(third9party(social(media(website(or(application(to(communicate(with(

NASA,(you(may(be(providing(non9government(third(parties(access(to(your(PII(for(which(NASA(has(

no(responsibility.(

Privacy!Concerns!

If(you(have(a(concern(regarding(the(NASA(Privacy(policy(or(a(privacy(practice(of(a(NASA(website,(

contact(the(NASA(Privacy(Programs(Manager(at([email protected].((Please(include(the(

NASA(Privacy(policy(or(Website(involved(and(the(description(of(the(concern.((((

Security0Notice0

For(site(security(purposes(and(to(ensure(this(web(service(remains(available(to(all(users,(this(

Government(computer(system(employs(software(programs(that(monitor(network(traffic(to(

identify(unauthorized(attempts(to(upload(or(change(information.((Anyone(using(this(system(

expressly(consents(to(such(monitoring(and(is(advised(that(if(such(monitoring(reveals(evidence(of(

possible(abuse(or(criminal(activity,(such(evidence(may(be(provided(to(appropriate(law(

enforcement(officials.(

Unauthorized(attempts(to(upload(or(change(information(on(NASA(servers(are(strictly(prohibited(

and(may(be(punishable(by(Federal(law,(such(as(the(Computer(Fraud(and(Abuse(Act(of(1986(and(

the(National(Information(Infrastructure(Protection(Act(of(1996.(


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 11!|!P a g e !(

Accessibility0Statement0

NASA(continually(strives(to(ensure(the(pages(on(this(website(are(accessible(to(individuals(with(

disabilities(in(accordance(with(Section(508(of(the(Rehabilitation(Act([Link(the(Section(508(of(the(

Rehabilitation(Act(to(http:www.section508.gov].((If(you(have(any(difficulty(viewing(any(page(

with(adaptive(technology(please(contact(the(webmaster(for(this(site,(or(the(Center(Section(508(

Coordinator([use(link(hppt://www.section508.nasa.gov/coordinators.htm].(((

Documents(on(NASA(websites(are(presented(in(may(formats.((These(formats(are(generally(

accessible(to(users(using(screen(reading(software.((Some(files(on(the(NASA(website(may(be(

posed(as(Adobe(Acrobat(Portable(Document(Format((PDF)(files.((Adobe(provides(their(Acrobat(

Reader(software(as(a(free(download.(

Linking0Policy0and0Disclaimer0of0Endorsement0

NASA(links(to(many(websites(created(and(maintained(by(other(public(and/or(private(

organizations.((NASA(provides(links(to(these(websites(as(a(service(to(our(users.((The(presence(of(

a(link(is(not(a(NASA(endorsement(of(the(site.(

When(users(follow(a(link(to(an(outside(website,(they(are(leaving(NASA(and(are(subject(to(the(

privacy(and(security(policies(of(the(owners/sponsors(of(the(outside(website(s)(NASA(is(not(

responsible(for(the(information(collection(practices(of(non9NASA(sites.(

( NASA!Privacy!Impact!Assessments!(PIAs)!!

For(a(list(of(Approved(NASA(Privacy(Impact(Assessments((PIAs)(Click(here(

[http://www.nasa.gov/privacy/PIA.html(].(

( NASA!Officials!for!Privacy!Related!Matters!

NASA!Senior!Agency!Official!for!Privacy!Larry(N.(Sweet(

Chief(Information(Officer(

(

NASA!Privacy!Programs!Manager!Bryan(McCall(

NASA(Privacy(Programs(Manager(

NASA(Office(of(the(Chief(Information(Officer(

NASA(Headquarters(

Washington,(DC(2054690001(

Contact:(202935891767(

Email:([email protected](

( (


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 12!|!P a g e !(

NASA!Privacy!Act!Officer!Patti(F.(Stockman(

NASA(Privacy(Act(Officer(

NASA(Office(of(the(Chief(Information(Officer(

NASA(Headquarters(

Washington,(DC(2054690001(

Contact:(202935894787(

Email:([email protected](

(

2.3. Web'Privacy'Policy'Notice'Language'–'Additional'Privacy'Notice''The(following(language(may(be(required(depending(on(what(information(is(actually(being(collected(from(

the(public(and(from(whom(the(information(is(being(collected.((If(it(is(required,(it(shall(be(posted(or(linked(

to(on(each(applicable(public(facing(website.(

Additional0Privacy0Notice0

Web!Measurement!and!Customization!Technology!Usage!(Persistent!Tracking/Cookies)!Notice!(

Web(Measurement(and(Customization(Technology(is(used(by(this(website.((Specifically,(cookies(

have(been(engaged.((A(cookie(is(a(small(file(that(a(website(transfers(to(your(computer(to(allow(it(

to(remember(specific(information(about(your(session(while(you(are(connected.((Your(computer(

will(only(share(the(information(with(the(website(that(provide(the(information,(and(no(other(

website(can(request(it.(((

This(NASA(website(uses(persistent(cookies(to(remember(you(between(visits(so,(for(example,(you(

can(save(your(customized(preference(settings(for(future(visits.(Persistent(cookies(store(

information(on(your(computer(for(longer(periods(of(time.(((

[CHOOSE(THE(APPROPRIATE:(((

The(web(measurement(and(customization(technology(is(not(collecting(PII.(

The(web(measurement(and(customization(technology(is(collecting(PII.((The(PII(is(not(shared(with(

third(parties(as(they(have(no(right(to(that(information.](

If(you(do(not(wish(to(have(session(or(persistent(cookies(stored(on(your(machine,(you(can(turn(

them(off(in(your(browser.((However,(as(this(website(utilizes(them,(it(may(affect(how(this(website(

functions.((

Children’s!Online!Privacy!Protection!Act!of!1998!(COPPA)!Notice!(

The(Children’s(Online(Privacy(Protection(Act(of(1998((COPPA)(governs(information(gathered(

online(from(children(under(the(age(of(13.((NASA(requires(verifiable(consent(from(a(child’s(parent(

or(guardian(prior(to(the(collection,(use,(or(disclosure(of(personal(information(form(a(child(under(


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 13!|!P a g e !(

the(age(of(13.((The(website(your(child(is(accessing(seeks(to(collect(information(and(is(therefore(

subject(to(the(requirements(of(COPPA.(((Please(note(that(NASA(does(not(collect(more(

information(than(is(reasonably(necessary(to(participate(in(this(website’s(related(activity.(((

([INSERT(appropriate(language(for(the(collection(relating(to:((What(Information(is(being(collected(

from(children(by(NASA;(How(the(information(will(be(used;(Who(will(see(the(information(NASA(

collects;(How(long(the(information(will(be(retained(by(NASA;(What(NASA’s(disclosure(practices(

include;(What(the(parental(notice(and(consent(process(is;(and(what(mechanisms(exist(for(

parents(to(review(the(information(collected(and(to(refuse(to(allow(NASA(future(use(of(the(

information(or(future(collection(of(the(information.](

3. Privacy'Notice'–'ThirdEParty'Social'Media'Website'or'Application''NASA(is(permitted(to(use(authorized(third9party(social(media(websites(and(applications.((However,(NASA(

is(required(to(provide(appropriate(privacy(notice(to(users(to(ensure(that(the(public(is(aware(of(the(

related(NASA(privacy(protections.(

The(language(outlined(in(this(section(supports(the(requirements(outlined(in(OMB!Memorandum(M510523.((((

3.1. ThirdEParty'Social'Media'Notice'Roles'and'Responsibilities'(

3.1.1. The!ISO!shall(ensure(that(official(NASA(websites(and(applications(that(are(hosted(on(third9party(websites(or(applications(include(the(following(language(on(the(website(or(

application:(

(

(

(

(

(

(

(

(

(

(

(

(

(

4. Privacy'Notice'–'Written'Notice'As(PII(is(a(sub9set(of(sensitive(information,(certain(protection(and(notice(requirements(are(needed.((In(

order(to(satisfy(those(requirements(the(following(language(has(been(created.((This(is(interim(guidance(

(Privacy!Notice:((This(is(an(official(NASA([website/application](hosted(on([name(of(third(party(website/or(application].((This(is(not(a(government(

[website/application],(the([website/application](is(controlled(and(operated(

by(a(third(party.((NASA’s(Web(Privacy(Policy(does(not(apply(to(this(

[website/application].((NASA(will(not(maintain,(use,(or(share(Personally(

Identifiable(Information((PII)(that(becomes(available(through(the(use(of(this(

third(party(websites(or(applications(unless(expressly(stated(and(consent(is(

obtained(from(the(user.(([Insert(additional(language(as(appropriate(

pertaining(to(PII(use,(etc.](

For(additional(information(on(NASA’s(Third9Party(Privacy(Notice(please(go(to(

http://www.nasa.gov/about/highlights/HP_Privacy.html.(((((


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 14!|!P a g e !(

that(is(valid(until(the(implementation(of(Controlled(Unclassified(Information((CUI)(guidance(addresses(

how(to(deal(with(marking(PII.((((((

4.1. Written'Notice'Roles'and'Responsibilities'(

4.1.1. The!IO!shall!ensure(that(PII(is(properly(marked(and(includes(the(following(statement:(

(

(

(

(

(

(

(

(

(

(

(

(

5. Web'Measurement'and'Customization'Technology'(Persistent'Tracking/Cookies)'Use''

Web(measurement(and(customization(technology(is(permitted(for(single(session(and(multi9session(use(

so(long(as(no(PII(is(collected(and(the(requirements(outlined(in(NPR(1382.1(and(this(handbook(are(

satisfied.((Multi9session(use(that(involves(the(collection(of(PII(is(prohibited,(unless(a(waiver(is(obtained(

from(the(OCIO(by(an(ISO.((The(waiver(process(includes(a(public(comment(period(and(clear(and(concise(

notice(of(the(collection(within(the(associated(privacy(policy.((ISOs(should(work(with(Center(Privacy(

Managers((CPMs)(to(determine(what(tier((as(outlined(in(OMB!Memorandum!M510522)!the(use(of(the(Web(Measurement(and(Customization(falls(under(and(how(to(be(in(compliance(with(the(NPR(and(

handbook.((

The(process(outlined(below(supports(the(requirements(outlined(in(OMB!Memorandum!M510522.(((

5.1. Web'Measurement'and'Customization'(Persistent'Tracking)'Use'Roles'and'Responsibilities'

(

5.1.1. The!Senior!Agency!Official!for!Privacy!(SAOP)!shall:(

• Approve(waivers(to(permit(Tier(3(use(of(Web(Measurement(and(Customization(

Technology.(

• Ensure(privacy(policy(provides(clear(and(conspicuous(notice(of(the(use(of(Web(

Measurement(and(Customization(Technology.((

(

Sensitive!But!Unclassified/Personally!Identifiable!Information!(SBU/PII)!This(document/media,(etc.(((choose(as(appropriate)(contains(Personally(Identifiable(Information(and(is(

considered(to(be(Sensitive(But(Unclassified(Information,(subject(to(protection(and(controls(per(the(

Privacy(Act(of(1974,(e9Gov(Act(of(2002(and(OMB(Memorandum(M906916,(NASA(Privacy(Policy((NPR(

1382.1),(and(Safeguarding(Sensitive(But(Unclassified(Information((NID(1600955),(as(appropriate.((

Wrongful(mishandling,(dissemination(or(willful(unauthorized(use(or(access(to(this(information(may(

result(in(substantial(penalties(including(fines,(administrative(or(termination(of(employment.((Control,(

store,(handle,(transmit,(distribute(and(dispose(of(strictly(in(accordance(with(current(NASA(Privacy(

Policy.(

Violations!or!suspected!breaches!should!be!reported!immediately!to:!Security!Operations!Center!at!877DNASADSEC!(627D2732).!

(


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 15!|!P a g e !(

5.1.2. The!Center!CIO!shall!approve(Tier(2(use(of(Web(Measurement(and(Customization(

Technology.!

5.1.3. The!NASA!Privacy!Programs!Manager!shall:(

• Transmit(and(track(waivers(as(they(move(through(the(approval(process.(

• Review(the(NASA(Web(Measurement(and(Customization(Technology(use(annually(and(

post(the(results(of(the(review(to(www.NASA.gov/open(with(a(mechanism(for(the(public(

to(provide(feedback(on(NASA’s(results.((

• Submit(Tier(3(waivers(to(the(SAOP(for(authorization.((

(

5.1.4. The!CPM!shall:(

• Consult(with(the(ISO(to(determine(under/in(which(tier(the(Web(Measurement(and(

Customization(Technology(use(falls.(

• Submit(Tier(3(waivers(to(the(NASA(Privacy(Programs(Manager(for(SAOP(authorization.((

• Approve(Tier(2(uses.(

• Submit(Tier(2(approval(requests(to(the(Center(CIO.(

(

5.1.5. The!ISO!shall:!

• Determine(under(what(tier(the(Web(Measurement(and(Customization(Technology(use(

falls,(in(consultation(with(the(CPM,(utilizing(the(Tier(Designation(Decision(Chart((Figure(

1).4((

o Tier!1(–(permitted(without(additional(action(required.(

o Tier!2(–(permitted(with(approval(of(Center(CIO(and(notice(to(SAOP.(

o Tier!3(–(prohibition(may(be(waived(following(public(comment(period(NASA(SAOP(

authorization.((

• Submit(Tier(2(approval(through(the(CPM.(

• Submit(Tier(3(waiver(through(the(CPM.(

• Use(Opt9In(settings(for(Tier(3(Web(Measurement(and(Customization(Technology.(

• Ensure(that(the(PIA(and(System(of(Records(Notice((SORN)(is(cited(in(the(associated(

system’s(online(Privacy(Policy.(

• Retain(the(PII(collected(only(as(long(as(necessary(to(achieve(a(NASA(mission/objective.(

• Ensure(only(NASA(Users(with(a(need(to(know(the(information(are(provided(access.(

(

(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((4(The(Privacy(&(CUI(Assessment(Tool((PCAT)(shall(be(utilized(to(complete(this(designation/process.(


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 16!|!P a g e !(

5.2. Web'Measurement'and'Customization'Technology'(Persistent'Tracking/Cookies)'Use'Process'

The(following(outlines(the(steps(required(for(use(of(Web(Measurement(and(Customization(Technology:(

1( ISO(determines(that(the(use(of(the(technology(is(necessary(to(meet(a(NASA(program(and/or(its(

associated(mission.(

2( ISO(determines(whether(the(use(of(the(technology(is(Tier(1,(Tier(2,(or(Tier(3(using(the(Designation(

Decision(Chart((Figure(1)(and(in(consultation(with(the(CPM.5(

3( If(Tier(1,(use(is(

permitted.(

STOP:((No(additional(action(required(to(use(single(session(Web(

Measurement(and(Customization(Technology.(

If(Tier(2,(ISO(obtains(

approval(from(

Center(CIO.((((((((((((

ISO(obtains(approval(from(the(Center(CIO(using(the(form(provided(in(

Appendix!C.6(((

Go!to!Steps!455.!!If(Tier(3,(ISO(obtains(

a(waiver(from(the(

SAOP.(

ISO(seeks(a(waiver(from(the(SAOP(using(the(form(provided(in(Appendix!D.7((

Go!to!Step!659.!4( If(Tier(2,(ISO(submits(approval(request(form(to(the(Center(CIO.(((see!Appendix!C)8(5( If(Tier(2,(Center(CIO(approves(use(of(Web(Measurement(and(Customization(Technology.(

(

STOP:((Once(approved,(multi9session(Web(Measurement(and(Customization(Technology(use(is(

authorized.((ISO(provides(CPM(with(a(copy,(the(CPM(maintains(approval(on(file(and(provides(the(

NASA(Privacy(Programs(Manager(with(a(copy((if(requested).9(

6( If(Tier(3,(ISO(submits(waiver(request(to(the(CPM(for(SAOP(approval.(((see!Appendix!D)10(7( The(SAOP(solicits(comment(through(www.NASA.gov/open(for(30(days(regarding(the(new(or(

substantive(change(to(existing(use(of(Web(Measurement(and(Customization(Technology.(((The(

notice(and(comment(includes:11(

• Proposed(use(and(description(of(the(use(

• Purpose(of(the(Web(Measurement(and/or(Customization(Technology(

• Usage(Tier,(session(type,(and(technology(used(

• Nature(of(information(collected(

• Purpose(and(Use(of(the(Information((

• Whether(and(to(whom(the(Information(will(be(disclosed(

• Privacy(Safeguards(

• Data(Retention(Policy(

• Whether(technology(is(enabled(by(default(or(not(and(why(

• Mechanism(for(opting(out(

• Statement(that(opting(out(does(not(limit(users(ability(to(access(comparable(information(or(

services(

(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((5(The(Privacy(&(CUI(Assessment(Tool((PCAT)(shall(be(utilized(to(complete(this(process.!((

6(Id.!

7(Id.(

8(Id.!

9(Softcopies(of(the(documents(can(be(found(within(PCAT.(

10(PCAT(shall(be(utilized(to(complete(this(process.(

11(PACT(collects(the(required(information(for(the(notice(and(comment(period.((


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 17!|!P a g e !(

• Third9Party(vendors(involved,(if(applicable.(

8( The(SAOP(reviews(and(makes(changes(to(use(where(appropriate.12(

9( The(SAOP(approves(waiver(as(appropriate(and(notifies(the(ISO.13(

10( The(ISO(may(then(use(multi9session(Web(Measurement(and(Customization(Technology(that(

collects(PII.(

11( Yearly,(thereafter,(the(ISO(submits(a(renewal(of(waiver(request(to(the(SAOP.(((see!Appendix!E)14(

(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((12(Completed(within(PCAT.(

13(Id.!

14(PCAT(shall(be(utilized(to(complete(this(process.(Waiver(renewals(are(reviewed(during(Federal(Information(

Security(Management(Act((FISMA)(end(of(year(reporting.(The(SAOP(will(determine(whether(waiver(renewals(are(

required(during(this(period.(If(an(ISO(is(no(longer(using(Web(Measurement(and(Customization(Technology,(his(or(

her(waiver(will(not(be(renewed.((


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 18!|!P a g e !(

(

Is NASA using Web Measurement and

Customization Technology?

Is PII collected by the Web Measurement and

Customization Technology?

Is Multiple Session Web Measurement and

Customization Technology used?

Is a Third Party using it on behalf of NASA and is the PII

shared with NASA?NO

YES

YES

Tier 1 – single session: Permitted without requiring approval or waiver process

Tier 2 – multi-session without PII: Requires approval of Center CIO.

Tier 3 – multi-session with PII: Not permitted unless a waiver from the NASA CIO is obtained, federal requirements are met, and explicit “opt-in” consent for collection is obtained.

Note:&&In&accordance&with&M110122,&NASA&is&not&permitted&to&use&Web&Measurement&and&Customization&Technology&to:

1.&&Track&users&individual1level&activity&on&the&Internet&outside&of&the&website&or&application&form&which&the&technology&originates;

2.&&Share&data&obtained,&without&user’s&explicit&consent,&with&other&departments&or&agencies;&or,

3.&&Cross1reference,&without&user’s&explicit&consent,&any&data&gathered&against&PII&to&determine&individual1level&of&online&activity.

NO

NO

YES

No Action required.

NO

((

Figure!1:!!Web!Measurement!and!Customization!Technology!(Persistent!Tracking)!Use!Tier!Designation!Decision!Chart!


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 19!|!P a g e !(

6. COPPA'Notice'NASA(websites(that(target(children(and(collect(PII(from(children(under(the(age(of(13(are(required(to(

provide(COPPA(notice.((The(specific(language(related(to(a/the(COPPA(Notice(is(outlined(in(Section(2(

above.(

Factors(to(be(considered(in(determining(whether(a(website(is(directed(to(children(under(13(years(of(age(

include(the(subject(matter,(visual(or(audio(content,(the(age(of(models(on(the(site,(language,(whether(

advertising(on(the(website(is(directed(at(children,(information(regarding(the(age(of(the(actual(or(

intended(audience,(and(whether(a(website(uses(animated(characters(or(other(child9oriented(features.(

6.1. COPPA'Notice'Roles'and'Responsibilities'6.1.1. The!ISO!shall(ensure(that(an(additional(COPPA(Notice(is(posted,(or(linked(to,(on(each(

applicable(public(facing(website(when(COPPA(Notice(is(required.(

6.2. Exceptions'to'Parental'Consent'Exceptions(to(parental(consent(include(when(the(website(collects(information(from(a(child(under(the(

age(of(13(to:(

• Respond(to(a(one9time(request(from(the(child((e.g.,(providing(a(poster,(responding(to(a(

question)(after(which(the(PII(is(deleted.(

• Contact(the(parent.(

• Ensure(the(safety(of(the(child(or(the(website.(

• Fulfill(a(NASA(newsletter(request(for(a(single(use((note,(however,(that(a(continuation(of(a(

subscription(requires(consent).(

7. Privacy'Complaints'The(following(outlines(the(privacy(complaints(notification(process.((This(section(does(not(provide(

guidance(on(how(to(respond(to(individual(complaints;(rather,(the(section(outlines(the(privacy(complaints(

requirements.((For(assistance(on(addressing(specific(complaints,(contact(the(SAOP(or(the(NASA(Privacy(

Programs(Manager.15(

7.1. Privacy'Complaints'Notification'Roles'and'Responsibilities'(

7.1.1. The!SAOP!shall:(

• Provide(oversight(over(the(privacy(complaint(process.(

• Ensure(that(the(NASA(Web(Privacy(Policy(website(includes(information(on(the(complaint(

process.(

(

7.1.2. The!NASA!Privacy!Programs!Manager!shall:!

• Receive(privacy(complaints(from(Members(of(the(Public(and(NASA(Users.(

• Respond(to(privacy(complaints(in(a(timely(manner.(

(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((15(Note:((Privacy(Act(complaint(information(is(found(in(14(CFR(1212.((


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 20!|!P a g e !(

• Track(all(privacy(complaints(across(the(Agency.(

(

7.1.3. The!CPM!shall!:!

• Receive(Center(level(privacy(complaints(from(members(of(the(public(and(NASA(users.(

• Respond(to(Center(level(privacy(complaints(in(a(timely(manner.(

• Provide(the(NASA(Privacy(Programs(Manager(with(information(regarding(the(Center(

level(privacy(complaints.(

(

7.2. Privacy'Complaints'Notification'Process'The(following(outlines(the(steps(required(for(privacy(complaints(notification(to(the(NASA(Privacy(

Programs(Manager:(

1( Member(of(the(public(or(NASA(User(contacts(NASA(Privacy(Programs(Manger(or(CPM(to(file(a(

complaint.(

2( The(complaint(is(addressed(as(appropriate.(

3( If(the(CPM(receives(the(complaint,(the(CPM(shall(provide(the(Privacy(Programs(Manager(with(the(

following(information:(

1. Type(of(Complaint:((Process(and(Procedural(Complaint;(Redress(Complaint;(Operational(

Complaint;(or(Referrals(Complaint.(

2. Date(the(Complaint(was(Reported(

3. The(Status(of(the(Complaint((Open,(Resolved)(

4. Description(of(the(Complaint((

4( If(the(Privacy(Programs(Manager(receives(the(complaint(first9hand(or(from(the(CPM,(the(Privacy(

Programs(Manager(shall(update(the(complaints(log(as(appropriate.(

(

8. Privacy'Redress'and'Privacy'Act'Information'Requests'The(following(outlines(the(privacy(redress(roles(and(responsibilities.((Members(of(the(public(and(NASA(

users(have(a(right(to(redress(PII(issues.((Redress(relates(to(a(NASA(mechanism(for(redress(from(misuse(or(

mishandling(of(PII(and(for(correcting(any(inaccuracies.((This(section(does(not(provide(guidance(on(how(to(

respond(to(individual(redress(issues;(rather,(the(section(outlines(the(privacy(redress(requirements.((For(

assistance(on(addressing(specific(redress(issues,(contact(the(SAOP(or(the(NASA(Privacy(Programs(

Manager.((In(addition,(Privacy(Act(related(information(access(requests(shall(follow(the(procedures(

outlined(in(14(C.F.R.(1212.(((

8.1. Privacy'Redress'and'Privacy'Act'Information'Requests'Roles'and'Responsibilities'8.1.1. The!SAOP!shall!ensure(that(PII(issues(are(redressed(by(the(NASA(Privacy(Programs(

Manager,(CPM,(or(ISO(as(appropriate.(!

8.1.2. The!NASA!Privacy!Programs!Manager!shall!redress(PII(issues,(as(appropriate.(!

(


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 21!|!P a g e !(

8.1.3. The!CPM!shall:!

• Redress(PII(issues,(as(appropriate.(

• Upon(request,(review(adverse(access(requests.(

(

8.1.4. The!System!Manager!shall!process(Privacy(Act(record(access(requests(as(permitted(in(the(

Privacy(Act(in(accordance(with(the(procedures(outlined(in(14(C.F.R.(1212.(!

8.2. Redress'Process'and'Timeline''For(Privacy(Act(related(redress(issues,(14(C.F.R.(1212(shall(be(followed.((For(non9Privacy(Act(related(

privacy(redress(issues,(this(timeline(may(be(used.(This(timeline(is(not(mandatory;(however,(if(deviations(

are(necessary,(the(SAOP(should(be(notified.(

1( Member(of(the(public(or(NASA(user(contacts(SAOP,(NASA(Privacy(Programs(Manger,(CPM,(or(ISO,(

seeking(redress(from(misuse(or(mishandling(of(PII(and(for(correcting(inaccuracies.(

2( No(later(than(15(business(days(after(the(issue(is(brought(forward,(the(NASA(Privacy(Programs(

Manager,(CPM,(or(ISO(will(respond(to(the(member(of(the(public(or(NASA(user.(

3( No(later(than(45(business(days(after(the(issue(is(brought(forward,(the(NASA(Privacy(Programs(

Manager,(CPM,(or(ISO(will(provide(the(member(of(the(public(or(NASA(user(the(appropriate(

redress.(

'( '


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 22!|!P a g e !(

Appendix'A:'Definitions''Operational!Complaint! (Complaint(involving(inquiries(regarding(Privacy(Act(matters,(not(including(Privacy(Act(requests(for(access(and/or(

correction.(

Process!and!Procedural!Complaint!

Complaint(involving(consent,(collection,(and(appropriate(notice.(

Redress!Complaint! Complaint(involving(non9Privacy(Act(inquiries(seeking(resolution(of(difficulties(or(concerns(about(privacy(matters.(

Referrals!Complaint! Involving(complaints(referred(to(another(agency(with(jurisdiction.(

!Tier!1!–!single!session! Refers(to(any(use(of(single(session(Web(Measurement(and(Customization(Technology.((Single(Session(include(

technologies(“…(that(remember(a(user’s(online(interactions(within(a(single(session(or(visit.((Any(identifier(

correlated(to(a(particular(user(is(used(only(with(that(session,(is(not(later(reused,(and(is(deleted(immediately(after(

the(session(ends.”((OMB(Memorandum(M910922((

Tier!2!–!multiDsession!without!PII!

Refers(to(any(use(of(multi9session(Web(Measurement(and(Customization(Technology(when(no(PII(is(collected.((

Multiple(Session(include(technologies(that(“remember(a(user’s(online(interactions(through(multiple(sessions(…(

requires(the(use(of(a(persistent(identifier(for(each(user,(which(lasts(across(multiple(sessions(or(visits.”(OMB(

Memorandum(M910922((

!Tier!3!–!multiDsession!with!PII!

Refers(to(any(use(of(multi9session(Web(Measurement(and(Customization(Technology(when(PII(is(collected.((OMB(

Memorandum(M910922(

ThirdDparty!websites!or!applications!

“[w]eb9based(technologies(that(are(not(exclusively(operated(or(controlled(by(a(government(entity,(or(web9based(

technologies(that(involve(significant(participation(of(a(nongovernment(entity.((Often(these(technologies(are(

located(on(a(‘.com’(website(or(other(location(that(is(not(part(of(an(official(government(domain.((However,(third9

party(applications(can(also(be(embedded(or(incorporated(on(an(agency’s(official(website.”(OMB(Memorandum(

M910923(

Web!Measurement!and!Customization!Technology!

Technologies(that(“…(are(used(to(remember(a(user’s(online(interactions(with(a(website(or(online(application(in(

order(to(conduct(measurement(and(analysis(of(usage(or(to(customize(the(user’s(experience.”((OMB(

Memorandum(M910922(

(

( '


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 23!|!P a g e !(

Appendix'B:''Acronyms''CIO! Chief(Information(Officer(

COPPA! Children’s(Online(Privacy(Protection(Act(of(1998(

CPM! Center(Privacy(Manager(

CUI! Controlled(Unclassified(Information((

!e.g.! exempli(gratia([For(example](

eDGov! E(Government(Act(of(2002(

FOIA! Freedom(of(Information(Act(

HBK! Handbook(

IP! Internet(Protocol((

ISO! Information(System(Owner(

!ITS! Information(Technology(Security(

NASA! (National(Aeronautics(and(Space(Administration(

NPD! NASA(Policy(Directive(

NPR! (NASA(Procedural(Requirement((

OMB! Office(of(Management(and(Budget(

PCAT! Privacy(&(CUI(Assessment(Tool(

PDF! Portable(Document(Format(

PIA! Privacy(Impact(Assessment(

PII! Personally(Identifiable(Information(

SAOP! Senior(Agency(Official(for(Privacy(

SBU! Sensitive(But(Unclassified((

SORN! System(of(Records(Notice(

URL! Uniform(Resource(Locator(

(

( (


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 24!|!P a g e !(

Appendix'C:''Web'Measurement'and'Customization'Technology'Use'Approval'Date(

(

(

TO:( [Center](Chief(Information(Officer((

THRU:( Center(Privacy(Manager(

FROM:((( (

SUBJECT:((

((

Approval(of(use(of(multi9session(Web(Measurement(and(Customization(Technology(

without(PII(

Background(

( Proposed(use(and(description(of(the(use:( (

( Purpose(of(the(Web(Measurement(and/or(

Customization(Technology:(

(

( Usage(Tier,(session(type,(and(technology(used:( (

( Nature(of(information(collected:( (

( Whether(technology(is(enabled(by(default(or(not(and(

why:(

(

( Mechanism(for(opting(out:( (

( Statement(that(opting(out(does(not(limit(users(ability(

to(access(comparable(information(or(services:(

(

( Identify(Third9Party(vendors(involved:(

(

(

Justification((

[State(the(compelling(need(and(how(the(information(will(be(used,(the(benefits(to(NASA(of(its(use,(and(

the(consequences(of(not(employing(it]:(

(

Concurrences:!((

( ((

(

(

Center(Privacy(Manger( ((

(

Date( (

Approved:! ((

(

(

( ((

(

(

(Center(CIO(Name)(

[Center](Chief(Information(Officer(

((

(

Date( (

(

( (


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 25!|!P a g e !(

Appendix'D:''Web'Measurement'and'Customization'Technology'Use'Waiver'Date((

(

TO:( OCIO/NASA(Chief(Information(Officer/Senior(Agency(Official(for(Privacy(

THRU:( OCIO/NASA(Chief(Technology(Officer(

THRU:( OCIO/NASA(Privacy(Programs(Manager(

FROM:((( (

SUBJECT:((

((

Waiver(to(allow(multi9session(Web(Measurement(and(Customization(Technology(

that(collects(PII(

Background(

( Proposed(use(and(description(of(the(use:( (

( Purpose(of(the(Web(Measurement(and/or(

Customization(Technology:(

(

( Usage(Tier,(session(type,(and(technology(used:( (

( Nature(of(information(collected:( (

( (Purpose(and(Use(of(the(Information:( (

( (Whether(and(to(whom(the(Information(will(be(

disclosed:(

(

( Privacy(Safeguards:( (

( Data(Retention(Policy:( (

( Whether(technology(is(enabled(by(default(or(not(and(

why:(

(

( Mechanism(for(opting(out:( (

( Statement(that(opting(out(does(not(limit(users(ability(

to(access(comparable(information(or(services:(

(

( Identify(Third9Party(vendors(involved:((

(

Justification((

[State(the(compelling(need(and(how(the(information(will(be(used,(the(benefits(to(NASA(of(its(use,(and(

the(consequences(of(not(employing(it]:(

Concurrences:!((

( (( (

Program(Manager([NASA(Responsible(Official]( ((

(

Date( (

( ( (

NASA(Privacy(Programs(Manager( ((

(

Date( (

( (( (

NASA(Agency(Chief(Technology(Officer( ((

(

Date( (

Approved:! ( (

( (( (

(NASA(CIO(Name)(

NASA(Chief(Information(Officer(

Senior(Agency(Official(for(Privacy((

( Date( (


AND(REDRESS(

ITS9HBK91382.06901(

(

V.1.0( ( 26!|!P a g e !(

Appendix'E:''Web'Measurement'and'Customization'Technology'Use'Waiver'Renewal''Date(

(

(

TO:( OCIO/NASA(Chief(Information(Officer/Senior(Agency(Official(for(Privacy(

THRU:( OCIO/NASA(Chief(Technology(Officer(

THRU:( OCIO/NASA(Privacy(Programs(Manager(

FROM:((( (

SUBJECT:((

((

(

Waiver(Renewal(to(continue(to(allow(multi9session(Web(Measurement(and(

Customization(Technology(that(collects(PII(

Renewal(of(Waiver(requested(for:((((

(

Justification((

[State(the(continued(compelling(need(and(how(the(information(will(be(used,(the(benefits(to(NASA(of(its(

use,(and(the(consequences(of(not(employing(it]:(

(

(

(

Concurrences:!((

( ((

(

(

Program(Manager([NASA(Responsible(Official]( ((

(

Date( (

( ((

(

(

NASA(Privacy(Programs(Manager( ((

(

Date( (

( ((

(

(

NASA(Chief(Technology(Officer( ((

(

Date( (

( ((

(

(

Approved:! ((

(

(

( ((

(

(

(NASA(CIO(Name)(

NASA(Chief(Information(Officer(

Senior(Agency(Official(for(Privacy((

((

(

Date( (

(