TREASURY DIRECTIVE 81-08

DATE: April 29, 2015

ADMINISTRATIVE EDIT: June 23, 2021

SUBJECT:  Certification Process for the Use of Web Measurement and Customization Technologies on Treasury Websites     

  1. PURPOSE.  This Directive establishes the process for obtaining certification for the use of Web Measurement and Customization Technologies, including “Cookies,” on the Department of the Treasury’s (“Treasury” or “Department”) Public Access Websites.  Any use of such technologies must be respectful of privacy, open and transparent, and solely to improve the Department’s services and activities online.  In accordance with Office of Management and Budget (OMB) Memorandum 10-22 (M-10-22), “Guidance for Online Use of Web Measurement and Customization Technologies,” the Directive also establishes the required steps for obtaining approval from the Deputy Assistant Secretary for Information Systems and Chief Information Officer (DASIS/CIO) for the use of Tier 3 multi-session technology that collects Personally Identifiable Information (PII).
  2. SCOPE.  This Directive applies to all bureaus, offices, and organizations in the Department, including the Offices of Inspectors General within the Department.  The provisions of this Directive shall not be construed to interfere with or impede the authorities or independence of the Department’s Inspectors General.  Pursuant to M-10-22, it does not apply to internal agency activities (such as intranets, applications, or interactions that do not involve the public) or authorized law enforcement, national security, or intelligence activities.
  3. POLICY.  Treasury uses Web Measurement and Customization Technologies to measure and analyze its online services and improve the Department’s services and activities online.  
    1. When employing such technologies, it is the policy of the Department to:
      1. 1) use technologies that allow members of the public to easily opt-out of Web Measurement and Customization Technologies with respect to their activities;
      2. 2) provide users who decline to opt-in or decide to opt-out with access to information and services that are comparable to the information and services available to users who opt-in or decline to opt-out;
      3. 3) use web tracking and measurement technologies to remember that a user has opted out of all other uses of such technologies on the relevant domain or application;
      4. 4) retain data collected from Web Measurement and Customization Technologies for only if necessary, to achieve the specific objective for which it was collected;
      5. 5) provide users clear and conspicuous notice (e.g., through the use of a Privacy Policy) of the decision to enable such technologies and, if applicable, the appropriate approval for the use of a Tier 3 technology, Privacy and Civil Liberties Impact Assessment (PCLIA), and/or System of Records Notice (SORN);
      6. 6) only use Tier 3 technologies that require users to opt-in, that are reviewed by the Department’s Deputy Assistant Secretary for Privacy Transparency & Records (DASPTR), and that have written approval from the DASIS/CIO;
      7. 7) provide the public with a minimum of 30 days, unless waived by DASIS/CIO, to comment on any new proposed use of a Tier 3 technology or substantive changes to existing uses of such technologies.
      8. 8) annually review its systems and procedures to ensure that they comply with this Directive, as well as all applicable legal, regulatory, and policy requirements; and
      9. 9) make the results of its annual review available to the public through the Department’s Open Government Initiative web page.
    2. Under no circumstances will Treasury:
      1. 1) track individual-level user activity on the Internet outside of the website or application from which the technology originates;
      2. 2) share the data obtained through such technologies with other departments or agencies, without the user’s explicit consent or authorized use by the Privacy Act and the routine uses in the applicable SORNs;
      3. 3) cross-reference, without the user’s explicit consent, any data gathered from Web Measurement and Customization Technologies against PII to determine individual-level online activity;
      4. 4) collect PII without the user’s explicit consent in any fashion; or
      5. 5) use such technologies in a manner otherwise prohibited by OMB.
  4. DEFINITIONS.
    1. Certificate of Use.  Certification issued by the DASIS/CIO serves as the explicit written approval necessary to use Tier 3 technologies.
    2. Cookie.  A small text record is placed on the hard drive that facilitates the transaction between the user and the website.  In certain instances, the text may be left on the user’s hard drive following the session’s termination.
    3. Personally Identifiable Information (PII).  Information that can be used to distinguish or trace an individual's identity, either alone such as their name, social security number, or biometric records, alone, or when combined with other information that is linked or linkable to a specific individual, such as date and place of birth, and mother’s maiden name.
    4. Public Access Website.  Any Internet site accessible by the public or other users external to Treasury’s bureaus and offices.
    5. Web Measurement and Customization Technologies.  Technologies are used to remember a user’s online interactions with a website or online application to conduct measurement and analysis of usage or customize the user’s experience.
      1. 1) Tier 1 technologies – single session.  These technologies remember a user’s online interactions within a single session or visit.  Any identifier correlated to a particular user is used only within that session, is not later reused, and is deleted immediately after the session ends.  (Example: When a user visits a government website to view statistical data and run searches, a session cookie is created to enhance website navigation when the user is logged into the website.  Any tracking data is deleted when the session ends.)
      2. 2) Tier 2 technologies – multi-session without PII.  These technologies remember a user’s online interactions through multiple sessions.  This approach requires a persistent identifier for each user, which lasts across multiple sessions or visits.  This Tier encompasses any use of multi-session Web Measurement and Customization Technologies when no PII is collected (including when the agency cannot identify an individual as a result of its use of such technologies).  (Example: An analyst wants to monitor internet traffic across a Public Access Website.  To monitor the traffic, the analyst uses a cookie to track users.  The cookie does not require the user to provide any personal information and uses a random string of alphanumeric characters that only the analyst who set the cookie can read.
      3. 3) Tier 3 technologies – multi-session with PII. These technologies encompass any use of multi-session Web Measurement and Customization Technologies when PII is collected (including when the agency can identify an individual due to its use of such technologies).  (Example: A user registers on a Treasury website to order statistical data products.  The user’s IP address, credit card number, and expiration date are retained for subsequent transactions on the website.) 
  5. RESPONSIBILITIES.
    1. The Deputy Assistant Secretary for Information System and Chief Information Officer (DASIS/CIO) shall:
      1. 1) review and approve or deny all requests for the use of Tier 3 technologies;
      2. 2) review all requests to waive the 30-day required notice and approve or deny the request; accordingly, and
      3. 3) issue Certificates of Use for Tier 3 technologies that will serve as the written authorization for such technologies.
    2. The Deputy Assistant Secretary of Privacy, Transparency & Records (DASPTR) shall:
      1. 1) review all requests for the use of Tier 3 technologies or substantive changes to      existing uses of such technologies;
      2. 2) inform the Senior Agency Official for Privacy of proposals for the use of Tier 3 technologies or substantive changes to existing uses of such technologies;
      3. 3) solicit public comment through Treasury’s Open Government Initiative web page, with a minimum comment period of 30 days (unless waived by the DASIS/CIO), on the proposed use of Tier 3 technologies or substantive changes to existing uses of such technologies.  The description of the Tier 3 technologies will include:
        1. (a) those items enumerated in OMB M-10-22, Attachment 3; and
        2. (b) a description of the PII (including each data element) that will be collected, used and/or accessed;
      4. 4) review comments received during the 30-day public comment period and work with the appropriate Privacy and Civil Liberties Officer to ensure that any necessary changes are made to the intended use of the technology;
      5. 5) sign and submit a written request for a Certificate of Use to the DASIS/CIO;
      6. 6) annually review the Department’s ongoing use of Web Measurement and Customization Technologies, as well as the associated policies and procedures, to ensure that they comply with applicable legal, regulatory, and policy requirements; and
      7. 7) make the results of the annual review of Web Measurement and Customization Technologies available to the public through the Department’s Open Government Initiative web page.
    3. The Heads of Bureaus and the Inspectors General, as it relates to their respective bureau and office, shall:
      1. 1) work with their respective Privacy and Civil Liberties Officer to ensure all legal, regulatory, and policy requirements are met when procuring and subsequently employing Web Customization and Measurement Technologies; and
      2. 2) annually review their systems and procedures to ensure they comply with this Directive and all other applicable legal, regulatory, and policy requirements.
    4. Any Treasury component proposing to employ or substantively change an existing use of a Tier 3 technology shall:
      1. 1) coordinate all new proposals of Tier 3 technologies or substantive changes to existing uses of such technologies with the DASIS/CIO and the DASPTR.
      2. 2) prepare a written request for a Certificate of Use that includes:
        1. (a) a description of the proposed technology, including how it improves the Department’s services and activities online, and the PII that it collects;
        2. (b) an explanation of how the PII collected by the technology will be protected;
        3. (c) the anticipated data retention period; and
        4. (d) the proposed language, if applicable, to inform potential users of the policies associated with the use of the technology, including the opt-in functionality and the alternate access paths for users who decline to opt-in or decide to opt-out.
      3. 3) consider if the required 30-day notice-and-comment process is reasonably likely to result in serious public harm, and if so, submit a written request to the DASIS/CIO to waive this requirement;
      4. 4) submit a written request for a Certificate of Use to the DASPTR for review;
      5. 5) review and consider substantive comments received during the 30-day public comment period, if applicable, and make changes to the intended use of the technology where appropriate;
      6. 6) upon receipt of the approved Certificate of Use, review and revise any relevant privacy policies to include those items enumerated in OMB M-10-22, Attachment 3, as necessary.
  6. AUTHORITIES.
    1. OMB Memorandum 10-22, “Guidance for Online Use of Web Measurement and Customization Technologies.”
    2. OMB Memorandum 10-06, “Open Government Directive.”
    3. OMB Memorandum 05-04, “Policies for Federal Agency Public Websites.”
    4. OMB Memorandum 03-22, “OMB Guidance for Implementing Privacy Provisions of the E-Government Act of 2002,” as amended by OMB Memorandum 10-22.
    5. OMB Memorandum 17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information”.
  7. REFERENCES.
    1. OMB Memorandum 99-18, “Privacy Policies on Federal Websites.”
    2. Privacy Act of 1974, 5 USC § 552a, as amended.
  8. CANCELLATION.  Treasury Directive 81-08, “Certification Process for the Use of Persistent Cookies on Treasury Websites,” dated January 10, 2002, is superseded.
  9. OFFICE OF PRIMARY INTEREST.  Office of the Deputy Assistant Secretary for Information System and Chief Information Officer, Office of the Deputy Assistant Secretary for Privacy, Transparency, & Records, and Office of the Assistant Secretary for Management.

 

 

/S/          
Brodi Fontenot          
Assistant Secretary for Management