Pia-062s

Privacy Impact Assessment
for the

Administrative Appeals Office (AAO)
Case Management System
DHS/USCIS/PIA-062
April 26, 2016
Contact Point
Donald K. Hawkins
Office of Privacy
United States Citizenship and Immigration Services
(202) 272-8000
Reviewing Official
Karen L. Neuman
Chief Privacy Officer
Department of Homeland Security
(202) 343-1717

Privacy Impact Assessment
DHS/USCIS/PIA-062 AAO CMS
Page 1

Abstract
The United States Citizenship and Immigration Services (USCIS) Administrative Appeals
Office (AAO) developed a case management system (CMS) to capture information related to
appeals, motions, and certifications the AAO adjudicates and to improve its ability to track appeals
and case processing. The AAO CMS is a person-centric case management system used to track
appeals, motions, and certifications filed with or processed by USCIS AAO that are under the
AAO’s jurisdiction. USCIS is conducting this Privacy Impact Assessment to document, analyze,
and assess its current practices with respect to the personally identifiable information (PII)
collected, used, and maintained by the AAO CMS.

Overview
The USCIS Administrative Appeals Office (AAO) conducts administrative review of
immigration benefit decisions to ensure consistency and accuracy in USCIS’ interpretation of
immigration law and policy. The AAO generally issues non-precedential decisions that apply
existing law and policy to the facts of a given case. Non-precedential decisions are binding on the
parties involved in the case, but do not create or modify USCIS policy or practice. The AAO does
not announce new interpretations of law or establish agency policy through non-precedential
decisions.
The AAO adjudicates three primary categories of cases:
1. Appeals are requests to a higher authority to review a decision. When an applicant or
petitioner appeals a decision to the AAO, the officer who made the original decision will
first review the record. A review of the record will determine whether the evidence or
argument submitted in the appeal warrants reopening or reconsidering the decision. If the
adjudicating officer determines that reopening or reconsidering the decision is not
warranted, the officer will forward the case for further review to the AAO or the
Department of Justice (DOJ) Board of Immigration Appeals (BIA). The AAO exercises
appellate jurisdiction over approximately fifty different immigration case types.
Not every type of denied immigration benefit request may be appealed, and some
appeals fall under the jurisdiction of the BIA. 1

1

It is important to note that the BIA and the AAO are separate administrative appellate entities that have jurisdiction
over different types of immigration cases. The BIA is located within the DOJ’s Executive Office for Immigration
Review (EOIR). The majority of appeals to the BIA involve decisions that EOIR immigration judges made in
removal proceedings. The BIA also reviews USCIS decisions on immigrant petitions for alien relatives. The BIA
has the authority to designate its decisions as precedent. BIA precedential decisions are binding on immigration
judges and DHS officers and employees in cases involving the same issue(s).

Privacy Impact Assessment
DHS/USCIS/PIA-062 AAO CMS
Page 2

2. Motions are requests to the original decision maker to review a decision. The AAO has
jurisdiction over motions to reopen and motions to reconsider its own decisions. If AAO
issues an unfavorable decision, the appellant may file a motion to reopen or a motion to
reconsider that decision. The AAO may also reopen or reconsider one of its prior decisions
on its own motion.
A “motion to reopen” is based on documentary evidence of new facts.
Alternatively, a “motion to reconsider” is based on a claim of incorrect application of law
or policy to the prior decision.
3. Certifications are when a USCIS officer wants someone else to weigh in before issuing a
new interpretation of law. USCIS officers may ask the AAO to review an initial decision
for a case that has an unusually complex or novel issue of law or fact. This administrative
procedure is known as “certification.” Except for case types that fall under the BIA’s
appellate jurisdiction, USCIS officers may certify any decision type to the AAO, including
decisions that do not convey appeal rights.

Management of Appeals, Motions, and Certifications
USCIS AAO developed the AAO Case Management System (CMS) to track adjudicative
work performed by the AAO using the Salesforce Government Cloud. The purpose of the
Salesforce Government Cloud is to provide a secure means for data from different government
systems to be aggregated and served to government employees on a platform that can overlay
effective tracking mechanisms that legacy systems may lack. The AAO CMS is a person-centric
case management system used to track appeals, motions, and certifications filed with or processed
by USCIS AAO that are under the AAO’s jurisdiction.
All incoming appeals, motions, and certifications are initially receipted, accepted, and
entered into Computer Linked Application Information Management System 3 (CLAIMS 3) for
processing. CLAIMS 3 is the official system for dates and actions on appeals, motions, and
certifications and displays basic information about each application or petition. Though the official
events are recorded in CLAIMS 3, the system does not support workflow and case management
functionalities that AAO needs to effectively manage the workload, which is why AAO is
leveraging Salesforce to build the AAO CMS.
USCIS developed the AAO CMS to efficiently and effectively track receipts, assignments
of work to officers, adjudications, and administrative actions. Because of the challenges involved
in importing final decisions into CLAIMS 3, as well as other administrative challenges, the AAO
continues to manually update CLAIMS 3 with the final decision. CLAIMS 3 serves as the
authoritative system for official USCIS actions and is viewable across USCIS.

Privacy Impact Assessment
DHS/USCIS/PIA-062 AAO CMS
Page 3

Appeal or Motion Initiation
USCIS oversees lawful immigration to the United States by adjudicating immigration
benefit requests. When USCIS denies an individual an immigration benefit, USCIS sends a letter
to the petitioner or applicant that explains the reason(s) for the denial and, if applicable, how to
file a motion or appeal. When the individual is notified of an unfavorable decision that may be
appealed, the individual also receives information as to how to properly file a motion to reopen, a
motion to reconsider, or an appeal. The individual may appeal the decision to the AAO when a
USCIS field office issues an unfavorable decision for an application or petition that falls under the
AAO’s jurisdiction.
Applicants and petitioners for certain categories of immigration benefits may appeal an
adverse decision on an immigrant petition or application to the AAO. Only the individual who
submitted the petition or application may file an appeal or motion. This means the beneficiary of
a visa petition lacks legal standing to file such an appeal. For example, a woman who would be
the beneficiary of her husband’s visa petition on her behalf may not file an appeal if the petition is
denied, only the husband who filed the original documentation may file the appeal.
Most appeals must be filed on Form I-290B, Notice of Appeal or Motion, 2 with a fee and
within 30 days of the initial denial. The purpose of Form I-290B is to allow an individual to file
an appeal or motion to reopen or reconsider certain decisions under the Immigration and
Nationality Act (INA). An appeal must specifically identify any erroneous conclusion of law or
statement of fact in the unfavorable decision on Form I-290B, in a written statement attached to
Form I-290B, in a brief, or both. Individuals may, but are not required to, submit supplemental
briefs or additional evidence. If the individual elects not to file a brief, the appeal must otherwise
specifically identify any erroneous conclusion of law or fact. If the individual chooses to have legal
representation, he or she must also file a Form G-28, Notice of Entry or Appearance as Attorney
or Representative 3 along with the appeal notice.
Form I-290B collects information about the applicant or petitioner and information about
the appeal/motion. Information collected about the petitioner/applicant includes: full name, ANumber, USCIS Online Account Number, receipt number, mailing address, daytime telephone
number, mobile telephone number, email address, attorney or accredited representative name, and
signature. Form I-290B also requests information regarding the basis of the appeal or motion
request, USCIS form under appeal or motion, date of adverse decision, and the office that issued
the adverse decision.
Individuals or representatives mail forms, supporting documents, and the applicable fee
payment or waiver to either a USCIS Service Center or USCIS Lockbox facility based on his or
2
3

See https://www.uscis.gov/sites/default/files/files/form/i-290b.pdf.
See https://www.uscis.gov/sites/default/files/files/form/g-28.pdf.

Privacy Impact Assessment
DHS/USCIS/PIA-062 AAO CMS
Page 4

her region and the type of benefit request appealed. 4 Individuals or representatives file the appeal
form according to the specific instructions provided on Form I-290B or the denial notice.
Incoming paper-based forms are received and reviewed by USCIS personnel at a Service
Center or Lockbox facility. USCIS personnel review the benefit request form and supporting
evidence for completeness. Every form must include complete information in all required blocks,
be signed, and – unless the fee is waived – include the correct fee. The information from the Form
I-290B is entered into CLAIMS 3 to establish the authoritative electronic record at USCIS
regarding the case. 5
Appeals: Initial Field Review
Accepted appeals are sent from the USCIS Service Center or Lockbox facility to the
appropriate USCIS field office for review. Initially, the USCIS field office that denied the
immigration benefit request reviews the appeal and determines whether or not to take favorable
action and grant the benefit request. A review of the record determines whether the evidence or
argument submitted in the appeal warrants reopening or reconsidering the decision. During this
initial field review, the field office may:
•

Treat the appeal as a motion to reopen or reconsider and approve the application or
petition; or

•

Forward the appeal and the related record of proceeding to the AAO.

Motions:
Accepted motions on decisions made in the field are sent from the USCIS Service Center
or Lockbox facility to the appropriate USCIS field office for review. A review of the record
determines whether the evidence or argument submitted in the appeal warrants reopening or
reconsidering the decision. The field office may:
•

Reopen and/or reconsider and approve the application or petition; or

•

Deny the motion to reopen and/or reconsider.

If the field office or Service Center denies the Motion, applicants may then appeal the
decision to the AAO.
Accepted motions on decisions made by the AAO are sent from the USCIS Service Center
or Lockbox facility to the AAO for review. A review of the record by the AAO determines whether
the evidence or argument submitted in the appeal warrants reopening or reconsidering the decision.
The AAO may:
4

See DHS/USCIS/PIA-061 Benefit Request Intake Process PIA, available at www.dhs.gov/privacy.
See DHS/USCIS/PIA-016(a) - Computer Linked Application Information Management System (CLAIMS 3) and
Associated Systems, available at www.dhs.gov/privacy.
5

Privacy Impact Assessment
DHS/USCIS/PIA-062 AAO CMS
Page 5

•

Reopen or reconsider and sustain the previously dismissed appeal;

•

Reopen or reconsider and remand the underlying benefit to the field office that issued
the adverse decision for it to issue a new decision;

•

Reject the motion to reopen or reconsider; or

•

Deny the motion to reopen or reconsider.

The AAO manually creates an initial record using an A-Number or Receipt Number in the
AAO CMS for all appeals, motions, and certifications that are referred by the originating USCIS
office. Once a record is created, Person Centric Query Service (PCQS) 6 retrieves and updates the
customer biographic information from CLAIMS 3 when prompted by an AAO CMS user. The
AAO CMS then assigns an appeal file number for each case. Each record includes limited
biographic data on the appellant and derivatives; the originating USCIS office; the A-Number or
receipt number; the date the application was received at USCIS; the date the application was
received at the AAO; attorney or preparer information; the assigned officer, editor, and supervisor;
and the AAO’s adjudication. Originating offices are also required to forward either the complete
A-File or the complete receipt file to AAO. To request the A-File or Receipt File, AAO must log
into the National File Tracking System (NFTS) 7 to track the location of files.
When the AAO requires the A-File or receipt file, the AAO officer logs into the Central
Index System (CIS) 8 and electronically requests the file. CIS has a direct interface with NFTS. To
ensure that the AAO has all necessary evidence for the adjudication of the appeal, certification, or
motion, officers may not remove documents from an A-File to create a separate Record of
Proceedings (ROP). 9 As a USCIS File Control Office (FCO), the AAO may receive and review
the complete A-File, as necessary. 10 AAO users may also request and receive file location updates
through the AAO CMS. NFTS sends file status location to the AAO CMS.
AAO personnel assigned to an appeal, motion, or certification reviews all case-related
information provided by the individual, including supplementary evidence and reviews the A-File
or receipt file to determine the benefit eligibility of the individual. If the evidence in the record
does not establish eligibility for the requested immigration benefit, the AAO may:
6

See the DHS/USCIS/PIA-010 Person Centric Query Service (PCQS) PIA, available at www.dhs.gov/privacy.
See DHS/USCIS/PIA-032 National File Tracking System (NFTS), available at www.dhs.gov/privacy.
8
See the DHS/USCIS/PIA-009 Central Index System PIA, available at www.dhs.gov/privacy.
9
A ROP is the official history of any hearing, examination, legal proceeding, order to show cause, or adjudicative
action in conjunction with any immigration action taken by DHS. The ROP serves as a comprehensive record of all
the information considered when making a decision. The ROP may include: the initiating application, petition, or
other initiating document, supporting documents, a transcript of the hearing or interview, USCIS decisions, notice of
appeal, and documents in support of appeals or motions.
10
A FCO is an office that is authorized to manage A-Files and Receipt Files. These offices can create, store,
transfer, receive, maintain, and retire A-Files. FCOs are the only offices permitted to transfer in and out files
involving external offices.
7

Privacy Impact Assessment
DHS/USCIS/PIA-062 AAO CMS
Page 6

•

Dismiss the appeal;

•

Request more information or evidence from the individual; or

•

Notify the individual of its intent to dismiss the appeal.

Requests for evidence (RFE) 11 and notices of intent to dismiss or deny (NOID) 12 specify the type
of evidence required or the bases for the proposed dismissal. The RFE or NOID states the deadline
for responding: up to a maximum of twelve weeks from the issuance of an RFE or thirty days for
a NOID. All correspondence sent to the appellant is tracked in the AAO CMS.
After all the above steps have been taken, AAO personnel make a determination on the
appeal. Case decision actions are tracked and recorded in CLAIMS 3. During the decision-making
process, the following may occur:
•

If an appellant establishes eligibility for the requested immigration benefit, the AAO
may sustain the appeal and order the approval of the application or petition;

•

If an appellant fails to establish eligibility for the requested immigration benefit, the
AAO may dismiss the appeal;

•

If the appellant has overcome the grounds of the unfavorable decision on appeal, the
AAO may remand a decision to the office that made the unfavorable decision to take
further action and to enter a new decision;

•

If the appellant improperly filed the appeal, the AAO may reject it. 13

AAO staff may also allow the appellant to withdraw his or her appeal.
The AAO creates the appeal decision and sends the notice to the appellant and any
representative of record by mail. The appeal decision is effective and final on the date that the
AAO issues it, unless and until the AAO reopens or reconsiders the decision on motion or a federal
court modifies or overrules it. The filing of a subsequent motion to reopen or reconsider the AAO’s
decision does not affect the finality of the decision. USCIS consolidates notices sent to the
applicant and his or her representative into the A-File or receipt file. Final decisions are also
recorded in the AAO CMS and CLAIMS 3, the primary USCIS data system.

11

USCIS uses an RFE when an application lacks required documentation or the AAO officer needs additional
evidence to determine an appellant’s eligibility for the benefit sought. The request will indicate what evidence or
information is needed for USCIS to fully evaluate the appeal under review.
12
A NOID is a formal statement from USCIS that it has determined that the appellant is ineligible for the immigrant
benefit requested. The issuance of a NOID is required when derogatory information is uncovered during the course
of the adjudication that is not known to the individual. However, USCIS will grant the appellant an opportunity to
overcome this determination and demonstrate that he or she is eligible.
13
Examples of improperly filed appeals may include, but are not limited to: untimely filed, missing or incorrect
filing fee, case types that do not fall under the AAO’s jurisdiction, and a Form I-290B is not signed.

Privacy Impact Assessment
DHS/USCIS/PIA-062 AAO CMS
Page 7

Post-Decision Reporting

AAO uses the information contained in the AAO CMS to generate a number of statistical
reports to measure and evaluate workload for proper resource allocation. USCIS generates reports
to identify pending cases, to measure productivity trends, and to calculate average processing
times. USCIS also generates granular level reports to identify types, number, and status of cases
located in a particular office or assigned to a particular USCIS staff member, which allows
supervisors to identify the oldest cases in queue for processing.

Section 1.0 Authorities and Other Requirements
1.1

What specific legal authorities and/or agreements permit and
define the collection of information by the project in question?

8 CFR §§ 103.3 and 103.5 authorize USCIS to collect the information and the associated
evidence on each benefit application. 14 The AAO uses the information the applicant provides on
the Form I-290B to adjudicate appeals or motions on decisions under immigration laws.

1.2

What Privacy Act System of Records Notice(s) (SORN(s)) apply
to the information?

The following Privacy Act System of Records Notices apply to the collection, use,
maintenance, and dissemination of information:

14

•

Benefits Information System, 15 which covers the collection and use of appeal and
motion applications, decisional data, and associated fees; and

•

Alien File, Index, and National File Tracking System of Records, 16 which covers
the collection, use, maintenance of appeals, motions, certifications, and
supplemental evidence.

The AAO’s appellate authority was afforded by the Secretary of DHS in 2003. The Delegation Memo (0150.1,
3/1/2003) references 8 CFR 103.1(f)(3)(E)(iii), which is no longer in effect (but does lend itself to understanding the
AAO’s authority). The Delegation Memo gives AAO appellate authority, not the INA or anything specific in Title 8
of the Code of Federal Regulations. Authority to collect is as stated both here in this PIA and the Privacy Act
Statement on the I-290B form instructions.
15
DHS/USCIS-007 Benefits Information System, 73 FR 56596 (Sept. 29, 2008).
16
DHS/USCIS/ICE/CBP-001 Alien File, Index, and National File Tracking System of Records, 78 FR 69864 (Nov.
21, 2013).

Privacy Impact Assessment
DHS/USCIS/PIA-062 AAO CMS
Page 8

1.3

Has a system security plan been completed for the information
system(s) supporting the project?

Yes. The AAO CMS is covered as a minor application under the Salesforce Hosting
Environment. 17 USCIS completed the Salesforce Hosting Environment security assessment and
authorization documentation on April 29, 2016, and was subsequently enrolled in the USCIS
Ongoing Authorization Program.

1.4

Does a records retention schedule approved by the National
Archives and Records Administration (NARA) exist?

No. USCIS is working with NARA to develop a records retention schedule to cover the
appeals and decision records. AAO proposes to delete and destroy the information 25 years from
the last completed action.

1.5

If the information is covered by the Paperwork Reduction Act
(PRA), provide the OMB Control number and the agency number
for the collection. If there are multiple forms, include a list in an
appendix.

Yes. Form I-290B is subject to OMB Control Number 1615-0095.

Section 2.0 Characterization of the Information
The following questions are intended to define the scope of the information requested and/or collected, as
well as reasons for its collection.

2.1

Identify the information the project collects, uses, disseminates, or
maintains.

The AAO CMS contains data from the Form I-290B, Notice of Appeal or Motion, as
maintained in CLAIMS 3. The following data elements will be manually entered into the system
as an extract from CLAIMS 3:
•

Appeal, Motion, or Certification;

•

Date received by USCIS;

17
The AAO will build its CMS using the SalesForce Government Cloud. The purpose of the SalesForce
Government Cloud is to provide a trusted and secure service to the U.S. Government to quickly and securely deliver
applications to meet customers’ business needs. Customers are able to build their own custom applications on the
SalesForce platform. SalesForce has a FedRAMP Agency ATO with the Department of Health and Human Services.
USCIS applications built on the Salesforce platform will need a separate ATO.

Privacy Impact Assessment
DHS/USCIS/PIA-062 AAO CMS
Page 9

•

Date received by the AAO;

•

Originating Office;

•

Assigned Officer;

•

Reopen date (in case of AAO reopen or service motion);

•

Appeal file number;

•

Underlying petition receipt number;

•

A-Number (when applicable);

•

Appellant name;

•

Appellant country of birth;

•

Appellant citizenship;

•

Appellant country of origin;

•

Form type;

•

Form appealed;

•

Business name (when applicable);

•

Attorney name;

•

Preparer name; and

•

Appellant address.

The following data elements will be entered into the CMS by users at the AAO:
•

A-File or Receipt File Location;

•

Case status (i.e., pending, on hold adjudication complete, decision issued);

•

Decision;

•

Date adjudicated;

•

Case history (i.e., in triage, on file shelf, assigned to officer);

•

Comments, may include an explanation of the decision;

•

Correspondence tracking; and

•

Appellant “Clocks” (i.e., time from receipt of appeal at USCIS until adjudication;
time from receipt at the AAO until adjudication; time from when appeal is first able

Privacy Impact Assessment
DHS/USCIS/PIA-062 AAO CMS
Page 10

to be adjudicated until adjudication; total time an appeal spends in the Fraud
Detection and National Security Directorate (FDNS) process at the AAO 18).
The AAO CMS creates reports on the timeliness of various steps in the adjudication
process. In addition, it creates workload reports to measure the number of receipts, completions,
and pending cases. These reports will help AAO leadership manage the office effectively and
report on timeliness.
An extract of CLAIMS 3 is uploaded into the AAO CMS to ensure accuracy of information
contained in the system. Generally, information ingested into the AAO from CLAIMS 3 will not
change (in CLAIMS 3) while under review by the AAO. In future iterations, the AAO CMS plans
to upload information back into CLAIMS 3, such as decision and adjudication date, but at present
the process is manual.

2.2

What are the sources of the information and how is the
information collected for the project?

The AAO CMS collects information submitted by the applicant on the Form I-290B and
by the attorney or representative on the Form G-28, from CLAIMS 3 and from NFTS. The AAO
collects information from CLAIMS 3 to reduce the amount of manual data entry and potential
errors. The AAO collects information from NFTS to determine the responsible party for the
physical file.

2.3

Does the project use information from commercial sources or
publicly available data? If so, explain why and how this
information is used.

No.

2.4

Discuss how accuracy of the data is ensured.

USCIS relies on individuals and their accredited representative, to provide accurate
information. The aforementioned individuals are required to sign a statement certifying, under
penalty of perjury, that the information included in the appeal and motion form and any submitted
documents are complete, true, and correct.
Incoming Forms I-290B are reviewed by USCIS staff at either a Service Center or Lockbox
facility. AAO staff also checks the accuracy of the data entered into CLAIMS 3 at various points
throughout the process. USCIS has detailed Standard Operating Procedures (SOP) for handling
information collected for Form I-290B. This SOP includes detailed quality control reviews that
help to ensure that the information has been accurately transferred from the paper forms submitted
18

See DHS/USCIS/PIA-013-01 Fraud Detection and National Security Directorate (FDNS), available at
www.dhs.gov/privacy.

Privacy Impact Assessment
DHS/USCIS/PIA-062 AAO CMS
Page 11

by individuals into CLAIMS 3 and the AAO CMS. These procedures ensure that all data fields are
completed and describe how data entry personnel handle inconsistencies during data entry. The
SOP covers every stage of data entry from the time the envelope is opened until the time the data
is entered into CLAIMS 3 and saved.

2.5

Privacy Impact Analysis: Related to Characterization of the
Information

Privacy Risk: There is privacy risk that data is not fully minimized because the AAO CMS
copies information from CLAIMS 3.
Mitigation: This privacy risk is partially mitigated because data copied from CLAIMS 3
are limited to basic biographic data necessary to track appeals and appellants. CLAIMS 3 will
continue to serve as the official system of records for dates and actions on appeals, motions, and
certifications. Although the official events are recorded in CLAIMS 3, the system does not support
workflow and case management functionalities the AAO needs to effectively manage its workload,
which is the reason for developing the AAO CMS. USCIS developed the AAO CMS to efficiently
and effectively track receipts, assignments of work to officers, adjudications, and administrative
actions. CLAIMS 3 remains the system in which the official actions are recorded and viewed
across USCIS.
Privacy Risk: There is a risk that CLAIMS 3 will be manually updated with the incorrect
AAO decision code and adjudication date. This will have an effect on data quality in CLAIMS 3.
Mitigation: USCIS has mitigated this risk of by developing separate, detailed SOPs for
handling information collected in each of the numerous USCIS forms completed by benefit
requestors. These SOPs include detailed quality control reviews that help to ensure that the
information has been accurately transferred from the paper forms submitted by individuals into the
associated case management systems. These procedures also instruct how data entry personnel
handle inconsistencies during data entry. USCIS also requires a second level review and quality
assurance check to verify the accuracy of the information in CLAIMS 3 against the information
on the form. In future iterations, the AAO CMS will interconnect with CLAIMS 3 and each system
will be updated electronically to reduce the risk of inaccurate data due to typological issues.
Privacy Risk: There is privacy risk of overcollection because appellants have to resubmit
benefit request information to USCIS for an appeal that was already submitted as part of their
original application.
Mitigation: This risk is minimal. In order to appeal a denied benefit, appellants must
submit minimal biographic information required by the Form I-290B. Without that information,
AAO adjudicators would not be able to know that a benefit denial was appealed, nor would they
know for which denied benefit (and on what grounds) that appeal was made unless this information
was collected on a Form I-290B. AAO adjudicators avail themselves of the entire Record of

Privacy Impact Assessment
DHS/USCIS/PIA-062 AAO CMS
Page 12

Proceedings (ROP) and only send RFE when the ROP lacks the information necessary for the
appeal to be properly adjudicated. This RFE information is new to the ROP; therefore, it represents
additional evidence (not duplicate evidence). While it is always a risk that an adjudicator may
request information that is not necessary to the proper adjudication of an appeal; such actions
would fall in the realm of misconduct by a USCIS officer with adverse consequences.

Section 3.0 Uses of the Information
The following questions require a clear description of the project’s use of information.

3.1

Describe how and why the project uses the information.

The AAO CMS supports and manages the administration and adjudication of all appeals,
motions, and certifications under AAO jurisdiction. Although basic information on appeals,
motions, and certifications is available from existing USCIS systems, the AAO CMS brings the
ability to closely manage the lifecycle of AAO cases (segmenting the AAO portfolio, assigning
work, assigning and managing tasks and deadlines, etc.) The information is used to assist AAO
leadership in managing and reporting on the office’s caseload.

3.2

Does the project use technology to conduct electronic searches,
queries, or analyses in an electronic database to discover or locate
a predictive pattern or an anomaly? If so, state how DHS plans to
use such results.

No.

3.3

Are there other components with assigned roles and
responsibilities within the system?

No.

3.4

Privacy Impact Analysis: Related to the Uses of Information

Privacy Risk: There is a risk that authorized users could exceed their authority and use
the data for unofficial purposes.
Mitigation: All records are protected from unauthorized access and use through
appropriate administrative, physical, and technical safeguards that include restricting access to
authorized personnel who have a need-to-know. USCIS limits access to PII by employing rolebased access. All USCIS employees and contractors are thoroughly trained regarding the use of
the database and the sensitivity of the information. Additionally, all USCIS employees and
contractors are required take the annual security and privacy awareness training.

Privacy Impact Assessment
DHS/USCIS/PIA-062 AAO CMS
Page 13

Section 4.0 Notice
The following questions seek information about the project’s notice to the individual about the information
collected, the right to consent to uses of said information, and the right to decline to provide information.

4.1

How does the project provide individuals notice prior to the
collection of information? If notice is not provided, explain why
not.

All immigration form instructions contain a Privacy Act Statement. Each Privacy Act
Statement provides notice to individuals about the agency’s authority to collect information, the
purposes of data collection, routine uses of the information, and the consequences of declining to
provide the requested information to USCIS. Additionally, individuals are provided general notice
through the publication of this PIA and the associated SORNs.

4.2

What opportunities are available for individuals to consent to
uses, decline to provide information, or opt out of the project?

The submission of an appeal of a denial of an immigration benefit is voluntary. The denial
notice provides information about whether the decision may be appealed and where to file an
appeal. To appeal an unfavorable decision, individuals must provide certain biographic
information in addition to other information. This information is critical in making an informed
adjudication decision to grant or deny an immigration benefit. Failure to provide the requested
information prohibits USCIS from processing and properly adjudicating the appeal and thus
precludes the applicant from receiving the benefit.

4.3

Privacy Impact Analysis: Related to Notice

Privacy Risk: None.

Section 5.0 Data Retention by the project
The following questions are intended to outline how long the project retains the information after the initial
collection.

5.1

Explain how long and for what reason the information is retained.

USCIS is working with NARA to develop a records retention schedule to cover the appeals
and decision records. The AAO proposes to delete and destroy the information 25 years from the
last completed action.

Privacy Impact Assessment
DHS/USCIS/PIA-062 AAO CMS
Page 14

5.2

Privacy Impact Analysis: Related to Retention

Privacy Risk: Without an approved retention schedule, there is a risk that information may
be retained longer than necessary and may increase the potential of an unauthorized disclosure.
Mitigation: USCIS is working to mitigate this risk. USCIS developed a retention schedule
for the AAO CMS. The proposed NARA schedule is consistent with the concept of retaining data
only for as long as necessary to support USCIS’s mission. Until USCIS completes a NARAapproved retention schedule, USCIS will maintain all records indefinitely.

Section 6.0 Information Sharing
The following questions are intended to describe the scope of the project information sharing external to the
Department. External sharing encompasses sharing with other federal, state and local government, and private sector
entities.

6.1

Is information shared outside of DHS as part of the normal
agency operations? If so, identify the organization(s) and how the
information is accessed and how it is to be used.

The AAO does not engage in any regular information sharing outside of DHS.

6.2

Describe how the external sharing noted in 6.1 is compatible with
the SORN noted in 1.2.

The AAO does not engage in any regular information sharing outside of DHS.

6.3

Does the project place limitations on re-dissemination?

The AAO does not engage in any regular information sharing outside of DHS.

6.4

Describe how the project maintains a record of any disclosures
outside of the Department.

The AAO does not engage in any regular information sharing outside of DHS.

6.5

Privacy Impact Analysis: Related to Information Sharing

There is a minimal privacy risk related to external information sharing because AAO does
not share information outside of DHS.

Privacy Impact Assessment
DHS/USCIS/PIA-062 AAO CMS
Page 15

Section 7.0 Redress
The following questions seek information about processes in place for individuals to seek redress which may
include access to records about themselves, ensuring the accuracy of the information collected about them, and/or
filing complaints.

7.1

What are the procedures that allow individuals to access their
information?

Individuals seeking to access or amend their USCIS records may file Freedom of
Information Act (FOIA) or Privacy Act request. Any individual seeking to access his or her USCIS
record may submit a request to following address:
National Records Center
FOIA/PA Office
P.O. Box 648010
Lee’s Summit, MO 64064-8010
The process for requesting records can be found at 6 CFR § 5.21. The request should state clearly
the information that is being requested. The procedures for making a request for access to one’s
records can also be found on the USCIS web site, located at www.uscis.gov.

7.2

What procedures are in place to allow the subject individual to
correct inaccurate or erroneous information?

Individuals should submit requests to contest or amend information contained in the AAO
CMS as discussed in Section 7.1. The requestor should clearly and concisely state the information
being contested, the reason for contesting or amending it, and the proposed amendment. The
requestor should also clearly mark the envelope, “Privacy Act Amendment Request.” The record
must be identified in the same manner as described for making a request for access.

7.3

How does the project notify individuals about the procedures for
correcting their information?

USCIS notifies individuals of the procedures for correcting their information through this
PIA and the associated SORN, Privacy Act Statements, and through USCIS personnel who interact
with individuals and their representatives.

7.4

Privacy Impact Analysis: Related to Redress

There is minimal privacy risk related to redress. USCIS provides individuals with access,
amendment, or correction to their records when requested through a FOIA or Privacy Act request.

Privacy Impact Assessment
DHS/USCIS/PIA-062 AAO CMS
Page 16

Section 8.0 Auditing and Accountability
The following questions are intended to describe technical and policy based safeguards and security
measures.

8.1

How does the project ensure that the information is used in
accordance with stated practices in this PIA?

USCIS ensures that practices stated in this PIA comply with internal USCIS policies,
including the USCIS privacy policies, SOPs, orientation and training, rules of behavior, and
auditing and accountability.

8.2

Describe what privacy training is provided to users either
generally or specifically relevant to the project.

All USCIS employees and contractors are required to complete the annual privacy and
security awareness training to ensure their understanding of properly handling and securing PII.
The Privacy Awareness training addresses appropriate privacy concerns, including Privacy Act
obligations (e.g., SORNs, Privacy Act Statements). The Computer Security Awareness training
examines appropriate technical, physical, personnel, and administrative controls to safeguard
information.

8.3

What procedures are in place to determine which users may
access the information and how does the project determine who
has access?

USCIS limits access to the AAO CMS to authorized USCIS employees and contractors
with a valid need-to-know. Access privileges are limited by establishing role-based user accounts
to minimize access to information that the user does not need to perform essential job functions.
The employee’s current job functions determine his or her need-to-know. The employee’s
supervisor must validate that the employee needs access to the information. Moreover, USCIS
limits access privileges for users by ensuring they have authorized logon credentials (i.e., DHSissued user ID and password) and have an established role-based user account.

8.4

How does the project review and approve information sharing
agreements, MOUs, new uses of the information, new access to the
system by organizations within DHS and outside?

USCIS has a formal review and approval process in place for new information sharing
access agreements. Any new use of information and/or new access requests for the system must
go through the USCIS change control process and must be approved by the proper authorities of

Privacy Impact Assessment
DHS/USCIS/PIA-062 AAO CMS
Page 17

this process, such as the USCIS Privacy Officer, Chief of Information Security Officer, Office of
Chief Counsel, and the respective Program Office.

Responsible Officials
Donald K. Hawkins
Privacy Officer
United States Citizenship and Immigration Services

Approval Signature
Original signed copy on file with the DHS Privacy Office.
________________________________
Karen L. Neuman
Chief Privacy Officer
Department of Homeland Security