PRIVACY ACT OWCP Interagency Meeting November 4, 2014 Paul J. Klingenberg, Esq. Senior Attorney Office of the Solicitor, FEEWC Division.

PRIVACY ACTPRIVACY ACT

OWCP Interagency MeetingOWCP Interagency MeetingNovember 4, 2014November 4, 2014

Paul J. Klingenberg, Esq.Paul J. Klingenberg, Esq.

Senior Attorney Senior Attorney

Office of the Solicitor, FEEWC DivisionOffice of the Solicitor, FEEWC Division

DisclaimersDisclaimers

This is This is notnot a comprehensive Privacy Act a comprehensive Privacy Act presentation—it is specific to OWCP records presentation—it is specific to OWCP records maintained in DOL/GOVT-1, a government-wide maintained in DOL/GOVT-1, a government-wide System of Records (SOR)System of Records (SOR)

If you need Privacy Act advice regarding records If you need Privacy Act advice regarding records maintained by your own agency under your own maintained by your own agency under your own SOR, or under an OPM government-wide SOR, SOR, or under an OPM government-wide SOR, contact your General Counsel’s/Solicitor’s Officecontact your General Counsel’s/Solicitor’s Office

04/19/23 2

04/19/23 3

Structure of the Privacy Act

ESTABLISHES RIGHTS (INDIVIDUALS)

CREATES RESPONSIBILITIES (AGENCIES)

PROVIDES OVERSIGHT MECHANISMS

NOT JUST ACCESS AND DISCLOSURE—RECORDS MANAGEMENT IS KEY

“No Disclosure Without Consent”

04/19/23 4

TERM: RECORDTERM: RECORD INFORMATION ABOUT AN INDIVIDUALINFORMATION ABOUT AN INDIVIDUAL

– EDUCATION, FINANCIAL TRANSACTIONS, EDUCATION, FINANCIAL TRANSACTIONS, MEDICAL HISTORY, AND CRIMINAL AND MEDICAL HISTORY, AND CRIMINAL AND EMPLOYMENT HISTORYEMPLOYMENT HISTORY

INDIVIDUAL IDENTIFIERINDIVIDUAL IDENTIFIER– NAME, IDENTIFYING NUMBER, SYMBOL, OR NAME, IDENTIFYING NUMBER, SYMBOL, OR

OTHER IDENTIFYING PARTICULAR ASSIGNED OTHER IDENTIFYING PARTICULAR ASSIGNED TO INDIVIDUAL, SUCH AS FINGERPRINT, TO INDIVIDUAL, SUCH AS FINGERPRINT, VOICE PRINT, BIOMETRIC OR PHOTOGRAPHVOICE PRINT, BIOMETRIC OR PHOTOGRAPH

PRIVACY ACTPRIVACY ACT

04/19/23 5

TERM: TERM: ROUTINE USEROUTINE USE ALLOWS FOR THE DISCLOSURE OF A ALLOWS FOR THE DISCLOSURE OF A

RECORD OUTSIDE OF THE AGENCY RECORD OUTSIDE OF THE AGENCY WITHOUT CONSENT (BECAUSE OF WITHOUT CONSENT (BECAUSE OF NOTIFICATION TO THE INDIVIDUAL AT NOTIFICATION TO THE INDIVIDUAL AT THE TIME OF COLLECTION)THE TIME OF COLLECTION)

DISCLOSURE MUST BE DISCLOSURE MUST BE “FOR A PURPOSE “FOR A PURPOSE WHICH IS COMPATIBLE WITH THE WHICH IS COMPATIBLE WITH THE PURPOSE FOR WHICH [THE PURPOSE FOR WHICH [THE INFORMATION] WAS COLLECTED”INFORMATION] WAS COLLECTED”

PRIVACY ACTPRIVACY ACT

04/19/23 6

PURPOSE of the PRIVACY ACT:

BALANCE GOVERNMENT’S NEED TOMAINTAIN INFORMATION

WITH

THE RIGHTS OF INDIVIDUALSTO BE PROTECTED AGAINST THE UNWARRANTED INVASION OF THEIR PRIVACY

No Disclosure Without Consent

04/19/23 7

1. RESTRICT DISCLOSURE (No Disclosure Without Consent)

2. GRANT INDIVIDUALS INCREASED RIGHTS OF ACCESS

3. GRANT INDIVIDUALS RIGHT TO SEEK AMENDMENT OF AGENCY RECORDS

4. ESTABLISH A CODE OF “FAIR INFORMATION PRACTICES”

FOUR BASIC POLICY OBJECTIVES

04/19/23 8

REMEMBER--A DISCLOSURE MAY BE WRITTEN (MOST DISCLOSURES ARE)

BUT THERE ARE ORAL DISCLOSURES AS WELL

AND ALL DISCLOSURES (INCLUDING DISCLOSURES FROM AQS & iFECS)

ARE COVERED BY PRIVACY ACT PRINCIPLES

PRIVACY ACT SYSTEM OF RECORDSPRIVACY ACT SYSTEM OF RECORDS

OFFICIAL NAME:OFFICIAL NAME: DOL/GOVT-1DOL/GOVT-1 Office of Workers’ Compensation Programs, Office of Workers’ Compensation Programs, Federal Employees’ Compensation Act FileFederal Employees’ Compensation Act File

04/19/23 9

1. FEDERAL EMPLOYEE DISCLOSURE OF INFORMATION PROHIBITED FROM DISCLOSURE

--(all three)--MISDEMEANOR, FINE NOT > $5,000

PRIVACY ACT—PRIVACY ACT—CRIMINAL CRIMINAL PENALTIES PENALTIES (INDIVIDUALS)(INDIVIDUALS)

3. ANYONE, INCLUDING A FEDERAL EMPLOYEE, REQUESTS OR OBTAINS ANY RECORD UNDER FALSE PRETENSES

2. FEDERAL EMPLOYEE WILLFULLY MAINTAINS A SYSTEM OF RECORDSWITHOUT MEETING NOTICE REQUIREMENTS

04/19/23 10

These provisions are solely criminal, and create no private right of action against a federal employee individually

In other words, if you violate an individual’s privacy, the individual can only sue the government

BUT THE GOVERNMENT CAN PROSECUTE YOU

PRIVACY ACTPRIVACY ACT

04/19/23 11

CIVIL REMEDIES—AMENDMENT, ACCESS, ACCURACY, & OTHER DAMAGES

SUIT IS AGAINST FEDERAL AGENCY ONLY—INDIVIDUAL FEDERAL EMPLOYEE IS NOT ABLE TO BE SUED FOR MONEY DAMAGES UNDER THE PRIVACY ACT

PRIVACY ACT—PRIVACY ACT—CIVIL REMEDIESCIVIL REMEDIES

04/19/23 12

SYSTEMS OF RECORDSSYSTEMS OF RECORDS

WORKERS’ COMPENSATIONRECORDS BELONG TO DOL, AND DOL ONLY

ANY RECORDS THE EMPLOYING AGENCY HAS, INCLUDING COPIES, BELONG TO DOL

04/19/23 13

PRIVACY ACTPRIVACY ACT

WHAT DOES THAT MEAN?

ANY RECORDS THE AGENCY HAS BELONG TO DOL, AND CAN ONLY BE RELEASED IN ACCORDANCE WITH DOL’S PUBLISHED ROUTINE USES, AND WITH DOL’S INTERPRETATION

20 C.F.R. 10.11 20 C.F.R. 10.11 Who maintains custody and control of FECA Who maintains custody and control of FECA

records?records? All records relating to claims for benefits filed All records relating to claims for benefits filed

under the FECAunder the FECA, including any copies of such , including any copies of such records maintained by an employing agencyrecords maintained by an employing agency, , are covered by the government-wide Privacy Act are covered by the government-wide Privacy Act system of records entitled DOL/GOVT-1 (Office system of records entitled DOL/GOVT-1 (Office of Workers’ Compensation Programs, Federal of Workers’ Compensation Programs, Federal Employees’ Compensation Act File). This system Employees’ Compensation Act File). This system of records is maintained by and under the control of records is maintained by and under the control of OWCP, and, as such, of OWCP, and, as such, all records covered by all records covered by DOL/GOVT-1 are official records of OWCP. DOL/GOVT-1 are official records of OWCP.

04/19/23 14

04/19/23 15

SYSTEMS OF RECORDSSYSTEMS OF RECORDSWHAT ARE DOL’S PUBLISHED ROUTINE USES?

In addition to the 12 universal routine uses that apply to all DOL systems of records, there are 17 of them in DOL/GOVT-1

Examples:- third party in a third party action- employing agency at time ofinjury to verify billing, check status of claim, consider rehire, etc.- potential employers for return to work consideration

04/19/23 16

SYSTEMS OF RECORDSSYSTEMS OF RECORDS

- Rehab agencies for evaluation

- Physicians for use in treatment

- Health insurance or medical/welfare plans for clarification of billing responsibility

- Labor union acting on behalf of the employee

- dual benefits issues

04/19/23 17

Distinguish Between “Right of Access” Distinguish Between “Right of Access” Disclosures and “Routine Use” DisclosuresDisclosures and “Routine Use” Disclosures

Disclosure to the subject of the record (the FECA Disclosure to the subject of the record (the FECA claimant), while appropriate, authorized, and claimant), while appropriate, authorized, and required by 5 U.S.C. § 552a(d)(1) (individual’s required by 5 U.S.C. § 552a(d)(1) (individual’s right of access), is right of access), is notnot a disclosure pursuant to a a disclosure pursuant to a routine useroutine use

Examples of routine use disclosures:Examples of routine use disclosures:– Example—routine use Example—routine use ee of DOL/GOVT-1 authorizes of DOL/GOVT-1 authorizes

release of FECA file information to physicians treating release of FECA file information to physicians treating or examining a FECA claimantor examining a FECA claimant

– Another example—routine use Another example—routine use oo allows release of allows release of FECA file information to a Member of Congress in FECA file information to a Member of Congress in response to a request for assistance to a claimantresponse to a request for assistance to a claimant

04/19/23 18

SYSTEMS OF RECORDSSYSTEMS OF RECORDS

SO…WHAT DOES THIS MEAN?

Think It Through …

WORKERS’ COMP DATA CANBE RELEASED ONLY FOR THEROUTINE USES ESTABLISHEDBY DOL

04/19/23 19

WHEN YOU RELEASE DATA, YOU CAN RELEASE ONLY THAT PART OF THE RECORD THAT IS NECESSARY TO MEET THE ROUTINE USE

IT IS A VIOLATION OF THE PRIVACY ACT IF YOU GIVE ANY INFORMATION NOT COVERED BY THE ROUTINE USES TO ANYONE

WHEN IN DOUBT, CALL OWCP

04/19/23 20

Personally Identifiable Information (PII)Personally Identifiable Information (PII)

The department defines PII as informationThe department defines PII as information

“whose disclosure could result in harm to the individual whose name or identity is linked to that information. Examples include, but are not limited to, social security number; credit card number; bank account number; residential address; residential or personal telephone; biometric identifier (image, fingerprint, iris, etc.); date of birth; mother’s maiden name; criminal records; medical records; and financial records. The conjunction of one data element with one or more additional elements increases the level of sensitivity and/or propensity to cause harm in the event of compromise.”

04/19/23 21

DISCLOSURE DISCLOSURE YESYES//NONO????

EMPLOYING AGENCYEMPLOYING AGENCY– OIG—OIG—YESYES (IF INVESTIGATING FECA FRAUD) (IF INVESTIGATING FECA FRAUD)– INJURY COMP—INJURY COMP—YESYES– SECURITY OFFICE—SECURITY OFFICE—YESYES, with limitations, with limitations– SUPERVISOR—SUPERVISOR—YESYES, IF RTW, and with limitations, IF RTW, and with limitations– EEO INVESTIGATOR—EEO INVESTIGATOR—NONO (with PA WAIVER, (with PA WAIVER, YESYES))– PERSONNEL ACTION—PERSONNEL ACTION—NONO– AGENCY ATTORNEY—AGENCY ATTORNEY—NONO (if assisting agency with FECA (if assisting agency with FECA

case itself, case itself, YESYES))– BUDGET OFFICE—BUDGET OFFICE—YES, summary information onlyYES, summary information only– SAFETY AND HEALTH—SAFETY AND HEALTH—YESYES, with limitations, with limitations– UNION REPRESENTATIVE—UNION REPRESENTATIVE—YESYES, , but onlybut only if representing if representing

claimant before OWCPclaimant before OWCP

04/19/23 22

““YES” DOES YES” DOES NOTNOT MEAN MEAN UNQUALIFIED YESUNQUALIFIED YES

It is important to remember that, unless you have It is important to remember that, unless you have a Privacy Act waiver signed by the FECA a Privacy Act waiver signed by the FECA claimant, claimant, oror are responding to a first person are responding to a first person request by the claimant,request by the claimant,

you you alwaysalways must confirm that the expected use of must confirm that the expected use of the information is compatible with the routine use, the information is compatible with the routine use, andand

you disclose the you disclose the leastleast amount of information amount of information necessary for the recipient’s anticipated use.necessary for the recipient’s anticipated use.

04/19/23 23

Privacy Act/FECA ReferencesPrivacy Act/FECA References

Main DOL Privacy Act Systems Page Main DOL Privacy Act Systems Page http://www.dol.gov/sol/privacy/main.htm

DOL/GOVT-1 Systems Notice DOL/GOVT-1 Systems Notice http://www.dol.gov/sol/privacy/dol-govt-1.htm

DOL Universal Routine Uses DOL Universal Routine Uses http://www.dol.gov/sol/privacy/intro.htm

DOL’s assertion of control DOL’s assertion of control http://www.dol.gov/sol/privacy/gov-wide.htm