BRIEF

Policy Summary

This policy describes Lawrence Berkeley National Laboratory's (Berkeley Lab's) approach to managing privacy risks.

Who Should Read This Policy

• Employees and affiliates
• Other users of Berkeley Lab IT, including collaborators and visitors

To Read the Full Policy, Go To:

The POLICY tab on this wiki page

Contact Information

Laboratory Privacy Officer
Information Technology Division
[email protected]

POLICY

A. Purpose

Lawrence Berkeley National Laboratory (Berkeley Lab) has an interest in ensuring the privacy of its workforce members, research subjects, and visitors is respected consistent with University of California and Department of Energy (DOE) policy, the California Constitution, and state and federal privacy laws and regulations. This policy articulates Berkeley Lab's policy position on privacy and how workforce members must handle personal information gathered and used in furtherance of the Laboratory's mission. It also serves to ensure that Berkeley Lab complies with applicable data protection laws, regulations, and contractual obligations, and adequately protects the information of staff, customers, and research and business partners.

B. Persons Affected

This policy applies to employees, affiliates, and casual users of Berkeley Lab IT and resources, including collaborators and visitors as to processing of personal information.

C. Exceptions

Not applicable.

D. Policy Statement

1. Risk-Based Approach. All personal information is not created equal and therefore should not all be protected the same way. This policy requires the Privacy Officer to develop processes and controls for identifying, assessing, and managing privacy risks proactively. The Privacy Officer shall work cross-functionally with Laboratory Management to coordinate implementation of these controls consistently and commensurably with the risks certain business processes pose to individual autonomy or information privacy. To the greatest extent possible, controls shall be built into business processes by design.
2. Individual Autonomy and Expectations of Privacy by Berkeley Lab Workforce. The Privacy Officer shall coordinate the implementation of controls addressing end users' expectations of privacy, monitoring, and/or surveillance of Berkeley Lab staff activities and use of Laboratory IT, and limitations on access to Laboratory IT without express consent by the end user consistent with the following:
   1. Expectations of Privacy. Users have no expectation of privacy when using Laboratory IT, subject to limitations set by law and regulations, University Policy, and Department of Energy Orders as implemented into the Prime Contract.
   2. Acceptable Use. Subject to limitations set by Berkeley Lab policy, end users are permitted to make incidental personal use of Laboratory IT. However, incidental personal use of Laboratory IT is not subject to greater privacy protection than that of routine business use of Laboratory IT.
   3. Monitoring, Surveillance, and Access to Information About or Held by Berkeley Lab staff. The unauthorized monitoring and surveillance of Berkeley Lab staff is strictly prohibited. Authorization will be granted by Laboratory Management in consultation with Laboratory Counsel only where necessary to carry out a legitimate Laboratory function, be subject to appropriate oversight, be appropriately limited in time, place, manner, and scope, and be documented in writing.
3. Information Privacy. The Privacy Officer shall coordinate the implementation of controls addressing the appropriate processing of personal information in connection with furthering the Laboratory's mission consistent with the following:
   1. Governance. Berkeley Lab's Privacy Program is supported by the following:
      1. Laboratory Privacy Officer. The Deputy Director of Operations shall appoint a Laboratory Privacy Officer to work cross-functionally with Laboratory Management on carrying out the intent of this policy. The Privacy Officer shall be a subject-matter expert capable of exercising independent and sound judgment, represent the Laboratory in internal and external fora, champion cross-functional projects, and conduct duties as assigned to ensure the Laboratory remains in compliance with applicable laws, regulations, policies, and contractual requirements.
      2. Privacy Committee. The Laboratory Privacy Officer may chair a Privacy Committee charged with coordinating activities related to advancing Berkeley Lab's Privacy Program objectives consistent with this policy. The Laboratory Privacy Officer may also lead specialized and cross-functional working groups composed of subject-matter experts in specific areas. Additional standards, implementation specifications, and guidance issued by these groups shall serve as extensions of this policy.
      3. Program Documentation, Review, and Authorization. The Laboratory Privacy Officer shall document the Privacy Program consistent with applicable requirements and periodically revise the documentation to ensure it remains current and in compliance with Berkeley Lab's legal, regulatory, contractual, and policy obligations.
   2. Minimization. Berkeley Lab Workforce must limit the collection, use, disclosure, or storage of personal information to that which is relevant and necessary to accomplish the Laboratory's mission and as required or authorized by the California Constitution or statute, or mandated by the federal government.
   3. Proper Basis for Processing of Personal Information. Berkeley Lab Management must process personal information only where the processing is supported by a proper basis. Proper basis includes:
      1. Consent. Where practicable or legally required, Berkeley Lab Workforce may process personal information pursuant to the appropriate consent given by the relevant data subject. Appropriate consent is that which is reasonable under the specific circumstances of the information processing and, where applicable, complies with applicable laws and regulations. Examples of appropriate consent include implied and express (in writing or electronically signed).
      2. Contract Performance. Berkeley Lab Workforce may process personal information to the extent necessary to perform a contract to which the individual is a party.
      3. Where Legally Permitted or Required. Berkeley Lab Management and workforce members may process personal information to the extent necessary to comply with legal or regulatory obligations, as required under the DOE Prime Contract, or as permitted under California or federal law. This includes processing personal information in the course of internal investigations, in connection with lawsuits or as directed by a tribunal with appropriate jurisdiction, for the proper functioning of the Laboratory, to protect the safety and well-being of individuals or the Laboratory community, and as otherwise permitted or required by law, University Policy, or Department of Energy directive.
      4. Specific Prohibitions on Processing of Personal Information. The following uses of personal information are prohibited without approval by the Privacy Officer.
         1. Use of Protected Personal Information as a personal identifier;
         2. Transmission or storage of Protected Personal Information (including DOE-owned personally identifiable information (PII)) via email, cloud storage, or other unsecure means;
         3. Sale or transfer of ownership rights of records containing personal information for any consideration.
   4. Notice. Berkeley Lab Management and workforce members must give appropriate notice to individuals regarding personal information about them which Berkeley Lab collects, permitted uses and disclosures of personal information, and guidance on how individuals may contact Berkeley Lab to make specific requests related to that information. The notice must be approved by the Privacy Officer and comply with requirements arising under applicable laws, regulations, or contract. The processing of personal information contrary to or in excess of what is disclosed via the notice is prohibited.
   5. Training and Awareness. The Privacy Officer shall maintain an education, training, and awareness program designed to inform employees of the requirements identified under this policy, build knowledge and skills to enable staff to protect personal information, and change behaviors towards focusing attention on the protection of personal information. To the greatest extent possible, this program should be tailored for roles based on the degree to which the individual is expected to process personal information in connection with Berkeley Lab business processes. Laboratory Management remains responsible for ensuring that all members of the laboratory workforce receive appropriate training to the extent necessary and appropriate for them to carry out their required job functions.
   6. Third-Party Risk Management. Where a third party is to process personal information on behalf of the Laboratory, Laboratory Management shall ensure that the third party will agree in writing to comply with the requirements under this policy. This may be accomplished through implementation of standard contractual clauses approved by the Privacy Officer and/or the Office of the Laboratory Counsel.
   7. Information Security. The Privacy Officer shall coordinate with the Chief Information Security Officer to ensure that physical, technical, and administrative controls adequately ensure that personal information remains appropriately protected throughout its lifecycle.
   8. Privacy Incident Management. The Privacy Officer shall maintain procedures to ensure the adequate management of privacy incidents resulting in unauthorized disclosure of, or access to, personal information according to contractual, legal, and regulatory obligations.
   9. Compliance. The Privacy Officer shall coordinate and collaborate with Berkeley Lab Management and workforce members to ensure compliance with applicable laws and regulations, University of California policies, and Department of Energy directives related to Privacy with Laboratory Management.
   10. Review and Assessment. The Privacy Officer shall coordinate assessments of the effectiveness of controls implemented pursuant to this policy. This assessment may be conducted by internal or external parties and will serve to guide the organization on the effectiveness of the overall program.

E. Roles and Responsibilities

All members of the Laboratory community have responsibilities and remain accountable for complying with this policy. This section outlines specific responsibilities that attach to members of the Laboratory community based on their role and/or job duties.

F. Definitions/Acronyms

G. Recordkeeping Requirements

None

H. Implementing Documents

I. Contact Information

Laboratory Privacy Officer
Information Technology Division
[email protected]

J. Revision History

DOCUMENT INFORMATION

Source Requirements Documents

• UC-DOE Prime Contract No. DE-AC02-05CH11231 (Contract 31), Clause H-7, Privacy Act Records

• Contract 31, Clause I.67 – FAR 52.224-1, Privacy Act Notification (APR 1984)

• Contract 31, Clause I.68 – FAR 52.224-2, Privacy Act (APR 1984)

• Contract 31, Clause I.69 – FAR 52.224-3, Privacy Training (JAN 2017)

• Contract 31, Clause I.124 – DEAR 970.5204-3, Access to and Ownership of Records (OCT 2014)

• Contract 31, Appendix I – DOE Directives/List B, DOE O 206.1 Chg1, Department of Energy Privacy Program

• UC Privacy Principles

• UC Policy BFB-RMP-7: Protection of Administrative Records containing Personally Identifiable Information

• UC Policy BFB-IS-3: Electronic Information Security

Implementing Documents