Navigate

CCI-003529

CCI-003529 Definition

The organization ensures that individuals, where feasible, consent to all uses of personally identifiable information (PII) not initially described in the public notice that was in effect at the time the organization collected the PII.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed documents and implements a process to ensure that individuals, where feasible, consent to all uses of PII not initially described in the SORN and Privacy Act Statement that was in effect at the time the organization collected the PII. Minimally, where consent is not feasible or appropriate, the organization will notify users of all uses of PII not initially described in the SORN and Privacy Act Statement that was in effect at the time the organization collected the PII.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed ensures that individuals, where feasible, consent to all uses of PII not initially described in the SORN and Privacy Act Statement that was in effect at the time the organization collected the PII. Where consent is not feasible or appropriate, the organization conducting the inspection/assessment ensures that the organization notifies users of PII not initially described in the SORN and Privacy Act Statement that was in effect at the time the organization collected the PII.

Compelling Evidence

Supply documentation and reference a process to ensure that individuals, where feasible, consent to all uses of PII not initially described in the SORN and Privacy Act Statement that was in effect at the time the organization collected the PII.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003529.

Control	Description
IP-1	The organization: a. Provides means, where feasible and appropriate, for individuals to authorize the collection, use, maintaining, and sharing of personally identifiable information (PII) prior to its collection; b. Provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the collection, use, dissemination, and retention of PII; c. Obtains consent, where feasible and appropriate, from individuals prior to any new uses or disclosure of previously collected PII; and d. Ensures that individuals are aware of and, where feasible, consent to all uses of PII not initially described in the public notice that was in effect at the time the organization collected the PII.

Control

Description

IP-1

The organization: a. Provides means, where feasible and appropriate, for individuals to authorize the collection, use, maintaining, and sharing of personally identifiable information (PII) prior to its collection; b. Provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the collection, use, dissemination, and retention of PII; c. Obtains consent, where feasible and appropriate, from individuals prior to any new uses or disclosure of previously collected PII; and d. Ensures that individuals are aware of and, where feasible, consent to all uses of PII not initially described in the public notice that was in effect at the time the organization collected the PII.