The picture can't be displayed.
The Privacy Office
U.S. Department of Homeland Security
Washington, DC 20528
PRIVACY ACT STATEMENT/E(3) NOTICE
GUIDANCE AND TEMPLATE
The Privacy Act of 1974, 5 U.S.C. 552a, provides protection to individuals by ensuring
that personal information collected by federal agencies is limited to that which is legally
authorized and necessary and is maintained in a manner which precludes unwarranted
intrusions upon individual privacy.
Pursuant to 5 U.S.C. §552a(e)(3), agencies are required to provide what is commonly
referred to as a “Privacy Act Statement” to all persons asked to provide personal
information about themselves, which will go into a system of records (i.e., the
information will be stored and retrieved using the individual’s name or other personal
identifier such as a Social Security number).
Submission Process
All Privacy Act Statements must be reviewed and approved by the DHS Privacy Office.
Components may request a delegation to review and approve their own Privacy Act
Statements. Components must still submit approved Privacy Act Statements to the DHS
Privacy Office for reporting purposes.
Please submit Privacy Act Statements to the Privacy Office for review and approval at
pia@hq.dhs.gov.
Drafting a Privacy Act Statement
Privacy Act Statements should be written in plain English, while still adhering to the
requirements of 5 U.S.C. §552a (e)(3). When drafting a Privacy Act Statement for
review by the Privacy Office, include the following elements:
• Authority: The legal authority for collecting the information – statute, executive
order, regulation.
• Purpose: The purpose(s) for collecting the information and how DHS will use it.
• Routine Uses: To whom DHS may disclose the information outside of the
Department and for what purposes.
• Disclosure: Mandatory or Voluntary: Whether providing the information is
mandatory or voluntary. DHS can only make collection mandatory when a Federal
statute, executive order, regulation, or other lawful order specifically imposes a duty
on the person to provide the information; and the person is subject to a specific
penalty for failing to provide the requested information. The effects, if any, of not
providing the information – for example the loss or denial of a privilege, benefit, or
entitlement sought as a consequence of not furnishing the requested information.
2
Privacy Act Statement versus a Privacy Notice
Privacy Act Statements should only be used for information collections that will be
stored in a Privacy Act System of Records. To include a “Privacy Act Statement” on an
information collection that is not covered by the Privacy Act is misleading.
However, any time information is collected from a form, DHS encourages a Privacy
Notice that describes the same requirements above, in a less formal format.
Collection of SSNs
If the program or form collects Social Security numbers, specific notice regarding the
collection, use, and authorization of Social Security Numbers must be incorporated into
the Privacy Act Statement. This is addressed by adding a sentence to the Privacy Act
Statement regarding the collection of the SSN.
DHS cannot deny a legal right, benefit, or privilege if individuals refuse to provide their
SSN unless the law requires disclosure or, for systems operated before 1 January 1975, a
law or regulation adopted prior to that date required disclosure in order to verify the
identity of the individual.
Before requesting a Social Security number (SSN), even if it will not go into a system of
records, the agency must provide notice to the individual which includes:
• The law or authority for collecting the SSN.
• How DHS will use the SSN.
• Whether disclosure is mandatory or voluntary.
The information requested is being requested and may be shared externally as a “routine
use” to facilitate the OCPO awards program, and in accordance with DHS/ALL-011
Biographies and Awards System of Records. Providing this information to is voluntary.
3
DHS Privacy Act Statement SAMPLE
ESTA Privacy Act Statement
Pursuant to 5 U.S.C. § 552a(e)(3), this Privacy Act Statement serves to inform you of the
following concerning the collection of the information on this form.
A. AUTHORITY:
Collection of the information solicited on this form is authorized by Title 8 of the United
States Code, whether or not codified. Specifically, Section 711 "Modernization of the
Visa Waiver Program" of the "Implementing Recommendations of the 9/11 Commission
Act of 2007" ("9/11 Act") (110 PL 53) modifies the visa waiver program under section
217 of the Immigration and Nationality Act (8 U.S.C. 1187) to authorize this collection
of information. The Secretary of Homeland Security is authorized to create the electronic
travel authorization system and require aliens under the program to "electronically
provide to the system biographical information and such other information as the
Secretary of Homeland Security shall determine necessary." (8 U.S.C. 1187(a)(11) as
amended by 110 PL 53 sec. 711(d)). Collection of this information is mandatory for
people from Visa Waiver Program countries who wish to travel to the United States.
B. PURPOSE:
The primary purpose for soliciting this information is "to determine the eligibility of, and
whether there exists a law enforcement or security risk in permitting, the alien to travel to
the United States. Upon review of such biographical information, the Secretary of
Homeland Security shall determine whether the alien is eligible to travel to the United
States under the program." 8 U.S.C. 1187(a)(11).
C. ROUTINE USES:
The information solicited on this form may be made available as a "routine use" to other
government agencies to assist the Department of Homeland Security in making
determinations about the alien's eligibility to travel without a visa and for law
enforcement and administration purposes. The information may be made available to the
Department of State in the event the application is not approved, so that a determination
can be made for issuance of a visa. Finally, the information may be made available to the
carrier for verification of authorization to travel. A complete list of the routine uses can
be found in the system of records notice associated with this form, "Department of
Homeland Security/U.S. Customs and Border Protection - DHS/CBP-009 Electronic
System for Travel Authorization (ESTA) System of Records." The Department's system
of records notices can be found on the Department's website at
http://www.dhs.gov/system-records-notices-sorns
D. CONSEQUENCES OF FAILURE TO PROVIDE INFORMATION:
Providing this information is not legally required to gain admission to the United States.
However, aliens traveling without an electronic travel authorization will require a visa to
gain admission to the United States.
