|
Click here to download the full Data Privacy document (.doc format)
|
| Executive Summary |
| Program Overview |
| BTR Privacy Policy and Operational Security |
| Frequently Asked Questions |
Executive SummaryThe Bureau of Temporary Relocation (BTR) is committed to protecting the personal information of its customers and employees.
This document outlines the policy and practices that BTR employs to ensure compliance with all applicable laws regarding personal privacy as well as its overall commitment to ensuring the protection of personal information. This policy covers all aspects of the handling of protected customer information from all sources including interviews, applications or collected via the Internet.
Program OverviewThe Bureau of Temporary Relocation (BTR) shall follow these privacy principles in the collection, use, sharing and security of customer information, no matter how it is collected. The BTR shall:
BTR values the relationship we have with our customers and are committed to responsible information-handling practices. Great care is taken to safeguard personal information and in complying with all applicable federal, state and local privacy laws and our own internal standards and best practices. In addressing the privacy of users, the following regulations must be considered.
The Department of Homeland Security (DHS) is the parent agency of the BTR, and as such, any information provided to any employee, facility or web site owned or operated by BTR, may be combined or shared between current or future DHS entities. The BTR operates facilities, support offices and web sites which may be used to collect personal information.
Each member of BTR and each web site established by a member of the BTR support network will follow the privacy policies outlined below. Users of BTR infrastructure must be aware of times when information may be shared with third parties. These include the American Red Cross or healthcare providers. Information provided to these organizations will be limited to information required for a specific purpose and will not include all information on the customer in the BTR database. In addition, information regarding the customer may be shared with the individuals’ home state.
The following Privacy Policy describes the information and privacy practices and operational security for the BTR facilities, support offices, the BTR web site and all other locations, occasions or events where your personal information is collected by, or on behalf of BTR. When you provide us your personal information, you consent to the information practices described in this policy. Information can be collected by a an application completed at one of the BTR sites, via a telephone interview with a BTR associate or completed online via the Internet.
This Privacy Policy does not apply to web sites that are accessible through the BTR operated sites. BTR web sites contain links to third party sites, including but not limited to third-party sites that display the BTR logos. Users should read the privacy policies of those other sites to learn how they collect, use, secure and share information.
The data collected from the customer is limited to the information required to provide services to the customer. The information collected is outlined under the Frequently Asked Questions on page 9 of this document. The information will be used to:
Some information will be shared with third parties as required to provide services to the customer. Third parties will be limited to healthcare providers, Red Cross and the customer’s home state.
Data submitted via the Internet are input via a 128-bit Secure Socket Layer (SSL) connection. All customers will be provided a secure user ID and password. The customer may access only their personal data and no other information. The customer will be able to use their user ID and password to access the system to view or update their information.
Access to the data is granted in accordance with National Institute for Standards and Technology (NIST) Level 2 Assurance Level. Exposure of the data via the Internet is highly restricted and controlled in several layers to protect the data. The customer's request for his specific record passes through three firewalls and the request is serviced by a trusted account behind the third firewall. The single record results are then passed back to the user, thus protecting the database. Each firewall serves to prevent unauthorized intruders from gaining access to systems behind that firewall. BTR has implemented a series of these protection zones, which require successive penetration of each firewall to gain access to the subsequent one unless an authorized account is used.
Unauthorized attempts to access the system for other than intended purposes will result in denial of service. Unauthorized accesses to obtain, alter, damage, or destroy information, or otherwise to interfere with information is prohibited. Such acts will be disclosed to law enforcement authorities and result in criminal prosecution under the Computer Fraud and Abuse Act of 1986 and the National Information Infrastructure Protection Act of 1996 (Pub. L. 104-294), (18 U.S.C. 1030), or other applicable criminal laws.
Cookies are used on the BTR website to allow applications to function correctly. Information collected is not retained after the online transaction is completed. BTR's use of cookie technology is not otherwise designed, intended or used to collect, store or analyze information pertaining to Internet users.
The servers used by BTR (application, database and web servers) are hosted at a DHS data center. The servers are hosted at a DHS data center instead of at the BTR site since it provides an additional level of server and facility security, which provides stability in BTR’s operation.
The data center is a 24 x 7 x 365 managed operation. This allows BTR and users to access the information at all times. There is dedicated fast Ethernet connectivity between the data center and the BTR sites which runs across the providers IP backbone.
The primary data center is replicated to a second data center. This provides full redundancy of the data and operations.
Frequently Asked Questions:
To assist you with reading through our Privacy Policy, we have provided questions and answers below that you may find helpful in understanding our privacy practices:
What information does BTR COLLECT from me? When does BTR COLLECT information from me? Do I have CHOICES regarding the use of my information? What information is PROVIDED to BTR from others? Does BTR collect information from CHILDREN? How does BTR SECURE my personal information? How does BTR handle security intrusion and detection? Does BTR share my personal information with others? Do BTR websites use COOKIES, OTHER TECHNOLOGIES or THIRD PARTIES to collect information about me? How can I UPDATE my information? Whom may I CONTACT if I have questions or concerns about the privacy or security of my information? Disaster Relief Victims (DRV) Debit Card Processing Will this PRIVACY POLICY change?
What information does BTR COLLECT from me?We may collect personal information such as: · Prefix or title · Last name, first name and middle initial · Suffix · Language · Name of spouse and/or dependents. · Home State · Social Security Number · Driver’s license number · Other Identification (passport) · Physical address before relocation · Phone number before location · Cell phone or second phone number. · Email address · Medical Insurance Yes/No · Medical provider · Your personal preferences o disability accommodation o smoker/non-smoker o visibility in BTR directories o dietary needs
When and how does BTR COLLECT information from me?BTR collects information from customers in three methods:
The applicant is asked the
same questions under all three methods. How is my information USED?We use the information you provide in order to:
Do I have CHOICES regarding the use of my information?
Some information is required
in order to utilize BTR services and facilities. Excluding required
information, BTR does allow customers to opt-out of the use of some
personal information after providing it to BTR (such as listings in a
public directory). You always have the ability to opt-in or opt-out of
use of optional information requested by BTR.
· 10 business days for e-mails or online forms · 30 days for phone calls · 6 weeks for direct mail
What information is PROVIDED to BTR from others?
Does BTR collect information from CHILDREN?BTR is committed to protecting the privacy of children. We will only collect information from children in accordance with all applicable laws. Information regarding children should be collected from legal guardians or parents, and will only be done when necessary (such as to provide entry into a BTR facility or to make health benefits available). We will not knowingly or intentionally collect personal information online from children under the age of 13.
How does BTR SECURE my personal information?
Whether you
provide information online or in facilities, we have security measures
in place and take reasonable precautions to protect against the loss,
misuse and unauthorized access of your personal information under our
control. BTR cannot ensure or warrant the security of any information
you transmit to us by e-mail, and you do so at your own risk. BTR
employs the best data security products available as chartered by the
BTR security program. How does BTR handle security intrusion and detection?Unauthorized attempts to defeat or circumvent security features; to use the system for other than intended purposes; to deny service to authorized users; to access, obtain, alter, damage, or destroy information; or otherwise to interfere with the system or its operation is prohibited. Evidence of such acts may be disclosed to law enforcement authorities and result in criminal prosecution under the Computer Fraud and Abuse Act of 1986 and the National Information Infrastructure Protection Act of 1996 (Pub. L. 104-294), (18 U.S.C. 1030) or other applicable criminal laws.
Does BTR SHARE my personal information with others?
BTR does not
sell or rent your personal information to third parties.
Information provided to the
third party is limited to the information needed for the intended
purpose. At no time will a third party be given access to the entire
BTR database.
From time to time, we may be required to share personal information in response to a valid court order, subpoena, government investigation, or as otherwise required by law. We also reserve the right to report to law enforcement agencies any activities that we, in good faith, believe to be unlawful. We may share certain personal information when we believe that such release is reasonably necessary to protect the rights, property and safety of others and ourselves. We may also transfer personal information in the event of a change in BTR alignment within the government (such as a change in responsibility for BTR to process a request to another agency).
Do BTR web sites use COOKIES, OTHER TECHNOLOGIES or THIRD PARTIES to collect information about me?
Cookies How can I UPDATE my information?
BTR wants your
information preferences to be accurate and complete. We provide several
different methods for you to update your personal information. To update
your information:
The required time to make changes is dependent on the method selected.
Whom may I CONTACT if I have questions or concerns about the privacy or security of my information?
Please contact our
Privacy Manager to report any known or suspected privacy or security
breaches or to submit privacy or security-related questions or
complaints. After receiving your inquiry, we will respond within five
business days. You may contact us in the following ways:
Disaster Relief Victims (DRV) Debit Card Processing
In order to apply for a DRV Debit Card, you will need to provide:
BTR is required by law to provide you with a copy of this privacy policy.
The information you give to BTR will be used to refer you to disaster assistance programs. It may be shared with your bank, insurance company, or other assistance providers to ensure there is no duplication of benefits. It may also be shared with state and local governmental agencies to help reduce future disaster losses.
Failure to provide this information will result in a delay or a rejection of your request. You authorize BTR and the state to verify the information that is entered.
If you knowingly make false statements to obtain disaster aid, it is a violation of Federal and state laws that carry penalties including severe fines or imprisonment up to 5 years, or both.
The BTR-DRV registration process requires you to agree to the statements provided in the privacy policy above.
Will this Privacy Policy CHANGE?
Because
BTR will continue to implement new technologies and improve the services
and features we provide, this policy is subject to change. If there are
changes or additions to this Privacy Policy, we will post those changes
to our web portal or in other formats for you to review. If we change
our information practices or this Privacy Policy in such a way that your
personal information may be used or shared in a different manner, we
will give you the opportunity to opt-out of having your information used
or shared in that new manner in accordance with all applicable laws.
Information will not be changed between optional and mandatory without
notice to the customer and adjustment to the documentation associated
with the process that collects this information |
© 2006 BTR/SU - all rights reserved