NATCA Bookshelf

2016 CBA Tentati ve Agreement Page 44 of 217 or by Federal Statute. Wh en such disclosure is so required, the person from whom the disclosure is sought shall be informed: a. That submission of the SSN is mandatory. The Federal statutory authority or pre - January 1, 1975 regulation under which submission of the SSN is required sh all be identified. b. Of the uses that will be made of the SSN. Whenever the submission of an SSN is voluntary, the Agency employee requesting an SSN from a bargaining unit employee shall inform such employee: a. That the submission of an SSN is not required by law and an employee's refusal to furnish an SSN will not result in the denial of any right, benefit, or privilege provided by law. b. That if the employee refuses to supply an SSN, a substitute number or other identifier will be assigned in those records where such an identifier is needed. c. That the SSN, if supplied, is used by the Agency to associate the current information relating to the employee with other information about the same employee the Agency may have in its files from previous transactions. d. That the SSN is solicited to assist in performing the Agency's functions under the Federal Aviation Act of 1958, as amended. Section 4. A privacy breach is defined as an incident of confirmed theft, loss or unauthorized disclosure of personal identifying information (PII) that requires disclosure/notification to the individual(s) in accordance with OMB Memo 07 - 16. Section 5. The Union will identify a Point of Contact (POC) for Data Security/Privacy issues at the national level. The Agency shall designate a Point of Contact from the office of IT Enterprise Services (AES). Section 6. In the event that the Agency suffers a privacy breach, regardless of whether the data breached is within the control of the FAA, the Department of Transportation, the Departme nt of Interior, or any other Federal Agency, the FAA shall provide the Union's POC with notification of a breach as soon as the Agency learns of the breach. The Union POC will be provided with updates as information becomes available. Section 7. The Un ion POC will be included in discussions to determine the appropriate level of identity theft protection to be provided in response to a privacy breach. Section 8. The National Points of Contact shall meet at least once quarterly to discuss the Agency i nitiatives to maintain and protect employees PII and the data systems throughout the Agency that support that information. Topics that may be discussed include initiatives to remove PII from data systems, to eliminate the use of or reliance upon employee Social Security Numbers as a means for identification, to prevent privacy breaches to computer and data systems, and other initiatives designed to increase or promote the protection of PII. If the Parties' designees agree to meet at another interval, they may do so through mutual agreement. Section 9. The Parties agree that the Union POC shall be on official time, if otherwise in a duty

• Cover