Fill and Sign the Deed of Trust and Assignment of Rents Fidelity National Title Fidelitytitle Form

UNCLASSIFIED//FOUO U.S. DEPARTMENT OF COMMERCE UNITED STATES PATENT AND TRADEMARK OFFICE Privacy Impact Assessment Cardinal Intellectual Property (CIP) Patent Cooperation Treaty Search Recordation System (PCTSRS) DOC50PAPT0601026 {Date Signed by Information/System Owner} UNCLASSIFIED//FOUO Privacy Impact Assessment This Privacy Impact Assessment (PIA) is a requirement of the Privacy Act of 1987 and OMB Memorandum 0322, OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002. A PIA documents the due diligence and oversight placed upon information associated with the project or system in question. Written from the System Owner’s perspective for the American public, the PIA discloses what information is being collected, and how that information is protected. The intent is to build confidence that privacy information is secure, processes that utilize this information comply with Federal requirements, and more importantly, inform the privacy expectations of the American public. The Privacy Threshold Analysis (PTA) is a separate artifact that must be completed prior to beginning this PIA. In many cases, the PTA will be the only required artifact to satisfy DOC privacy considerations. UNCLASSIFIED//FOUO SYSTEM DESCRIPTION The Cardinal IP (CIP) Patent Cooperation Treaty Search Recordation System (PCTSRS) is a General Support System (GSS) that performs Patent Cooperation Treaty (PCT) searches and written opinions on behalf of the United States Patent and Trademark Office (USPTO). PCTSRS provides authenticated employees access to Patent Cooperation Treaty (PCT) applications. The purpose of this system is to support the USPTO’s international application or PCT application process. The PCT provides a unified procedure for filing patent applications to protect inventions in each of its Contracting States. PCTSRS facilitates PCT searches and enables CIP employees to submit an accompanying written opinion regarding the patentability of the invention in question. PCTSRS production servers are located at a remote SAS 70 Type II data center. The PCTSRS system consists of several severs for web, email, database, backup, and directory services, as well as local workstations located at CIP’s corporate offices, that store, process, and/or transmit USPTO data in the form of Patent Cooperation Treaty applications. PCT application documents are transferred to CIP directly from USPTO via a secure connection. Remote users authenticate to the PCTSRS system via a two-factor challenge/response authentication using a unique user name and PIN along with a 6 digit code that is automatically regenerated every 60 seconds by a key fob. The remote user will then access a secure virtual desktop after successful authentication using a separate credential. This virtual desktop provides a secure work environment for remote users by isolating the desktop from the remote workstation, therefore eliminating the risks posed by the use of non-corporate workstations. The data communication between the remote workstation and the virtual desktop environment is encrypted. PCTSRS is only accessible by authenticated employees from within the CIP network. There is no public access to the PCTSRS system. PCT opinions are submitted from CIP directly to the USPTO via a secure connection. The CIP network is protected by firewalls, anti-virus, and anti-spam systems. The CIP data center facility includes physical security implementations including proximity card access controls, hand-geometry biometric locks, video surveillance, and building security. UNCLASSIFIED//FOUO QUESTIONNAIRE 1. What information is collected (e.g., nature and source)? Patent Cooperation Treaty (PCT) applications could include applicants’ names and addresses. PCTSRS receives PCT applications directly from the United States Patent and Trademark Office (USPTO). 2. Why is this information being collected (e.g., to determine eligibility)? This PII data is collected by the USPTO and provided to authorized contractors to enable identification of the inventor throughout the PCT application process. 3. What is the intended use of information (e.g., to verify existing data)? The PII data contained in the PCT application uniquely identifies the inventor. 4. With whom will the information be shared (e.g., another agency for a specified programmatic purpose)? Cardinal Intellectual Property (CIP) does not share any information with other agencies, individuals, or organizations. The information provided by USPTO is used by CIP to conduct searches under the PCT. 5. What opportunities do individuals have to decline to provide information (i.e., where providing information is voluntary) or to consent to particular uses of the information (other than required or authorized uses), and how can individuals grant consent? The PCT application documents received by CIP are obtained directly from USPTO. This process does not provide opportunity for individuals to decline to provide their names, addresses, or any other PII data that might be provided on the PCT application received from USPTO. Individuals are not able to decline or consent to any particular use of the PCT application PII data. 6. 7. 8. 9. Under the terms and conditions of the PCT, USPTO serves as a Receiving Office, an International Searching Authority, and an International Preliminary Examination Authority for international patent applications filed in accordance with the PCT. A single filing of an international application is accompanied with a search report and a written opinion regarding the patentability of the invention which is the subject of the application. Applicants are required to provide the information to the Receiving Office, in this case the USPTO, as part of the application process. How will the information be secured (e.g., administrative and technological controls)? The information received from and sent to the USPTO is transmitted using a secure protocol. PCT applications are stored on servers configured to limit access to data. How will the data extract log and verify requirement be met? No individually identifiable payment-related information or other PII is processed by PCTSRS. The address and other contact information are collected by the system for correspondence purposes. This would not be considered a data extract and therefore the data extract log and verify requirement is not applicable to the system. Is a system of records being created under the Privacy Act, 5 U.S.C. 552a? No. Are these records covered by a record control schedule approved by the National Archives and Records Administration (NARA)? Not Applicable. USPTO is in the process of identifying the General Records Schedules (GRS). The COTR will be responsible for determining the correct GRS for this system. UNCLASSIFIED//FOUO SIGNATORY AUTHORITY Agreed: /s/ Blaine Copenheaver ______________________________________________________ 1/26/2011 _____/______/_______ Blaine Copenheaver Date Information System Owner Agreed: ______________________________________________________ _____/______/_______ Rod Turk Date Senior Agency Information Security Officer Agreed: ______________________________________________________ _____/______/_______ Robert Stoll Date Authorizing Official UNCLASSIFIED//FOUO