OTCnet PII Information
Removing and Safeguarding PII within OTCnet
As part of the federal government’s continuing directive to safeguard, eliminate, and reduce Personally Identifiable Information (PII), OTCnet Release 3.4 (coming in February 2021) adds masking capabilities within reports and pages for Check Processing in OTCnet Online and Offline.
PII is defined as any information that identifies an individual (e.g., name, address, social security number, passport number, account number, or other identifying number or code, telephone number, email address, etc.). Name is acceptable if it is not coupled with any other PII.
Masking within OTCnet
Masking refers to the replacing of PII within User Defined Fields (UDFs) with asterisks (*) to ensure the protection of sensitive data.
Release 3.4 adds default PII masking to reports and pages in Check Processing within the UDFs that were flagged in Check Forms by the OTCnet Deployment Team as having PII. PII flagged UDFs will either:
- Partially mask UDFs with PII data values of five or more characters so that only the last 4 characters are displayed (i.e. ********6789).
- Entirely mask UDFs with PII data values of four or less characters. (i.e. ****).
Updated Data Privacy Table
Masking policy changes can be made at the lowest level endpoint and will be determined by a newly added checkbox in the Data Privacy Table in the Manage Organization page. With Release 3.4, the box will automatically be checked to mask PII, however the box can be unchecked to customize the desired masking policy. This option is available to address agency business needs to view the complete UDF as part of their collection process.
Pages and Reports with PII Masking
UDFs that were flagged to contain PII in Check Forms by your agency will be masked as described above. The masked UDFs will appear in the following forms and pages within Check Processing:
- Batch and Check Details Page
- Create MVD Record Page
- Search MVD Record Page – Search Results Page
- Search MVD Record Page – Review MVD Record Page (OTCnet Online Only)
- View CIRA Item Details Page in CIRA Query (OTCnet Online only)
- Check Verification Overlay
- Batch List Report
- CIRA CSV Historical Report
- Check Verification Report
- Item Detail Report
- LVD Contents Report (OTCnet Online only)
Note: The items listed are masked in Online and Offline except for the items listed as OTCnet Online only, which are only applicable to the Online application.
Replacing SSN UDF Labels
In addition to masking UDFs that contain PII with asterisks, Release 3.4 will also replace UDF labels that are labeled as SSN for Social Security Number to User Defined Field on the Check Verification overlay and in the Verification Report in OTCnet Online and Offline.
PII Audit Logging
An audit log entry will also be added to record each time a user modifies an endpoint's PII masking policy, enabling the history of masking policy changes in OTCnet to be viewed.
PII Masking in the Offline Application
Additionally, data masking policy selections made in OTCnet Online will be downloaded with the OTC endpoints to the OTCnet Offline application and the option to mask or unmask will only be available at the lowest level endpoint.
Protecting sensitive data is critical to the safety of our citizens, and OTCnet should not be used as a source for storing PII. OTCnet is committed to supporting your agency with this federal initiative and ensuring the safety of sensitive data.
Contact us if you have any questions and thank you for your cooperation.
Sincerely,
The OTCnet Deployment Team
OTCnet Deployment Line: 703-377-5586