Protecting Sensitive Information

• Legal Form Number: FDIC Directive 1360.9
• Section: Federal Deposit Insurance Corporation

FDIC 1212/03 (6-99)

TYPE AND NUMBER

Circular 1360.9

CONTACT

TELEPHONE NUMBER

Christopher Farrow

(703) 516-5507

DATE

April 30, 2007

DATE OF CANCELLATION (Bulletins Only)

TO:

All Divisions and Offices

FROM:

Martin D. Henning

Acting Chief Information Officer and Chief Privacy Officer

Chief Information Officers Organization

SUBJECT:

Protecting Sensitive Information

1. Purpose

To establish FDIC policy on protecting sensitive information collected

and maintained by the Corporation and to provide guidance for

safeguarding the information.

2. Scope

The provisions outlined in this circular apply to all employees and

contractors as well as any other persons who have access to sensitive

information used in the performance of Corporation business. This

includes data maintained electronically as well as information available

in hard copy (paper) format.

3. Background

Interim guidance on Protecting Sensitive Information was provided by

the Chief Information Officer/Chief Privacy Officer in a global electronic

mail (email) message to employees dated August 8, 2006.

In general, sensitive information is information that contains an element

of confidentiality. It includes information that is exempt from disclosure

by the Freedom of Information Act (FOIA) and information whose

disclosure is governed by the Privacy Act of 1974 (Privacy Act).

Sensitive information requires a high level of protection from loss,

misuse, and unauthorized access or modification. Failure to protect

sensitive information may cause the Corporation to be in violation of the

law or may result in avoidable costs or damage to the FDIC’s

reputation. See paragraph 4.c., below for a more detailed definition of

sensitive information.

In recent years, the increase in the incidence of identity fraud has

focused attention on protecting the privacy of individuals by both

commercial businesses and government agencies. In the role as an

employer and in support of its mission, the Corporation collects and

maintains information about employees and other individuals as well as

information obtained from other sources including insured institutions

and the institutions’ customers. Accordingly, the Corporation has a

FEDERAL DEPOSIT INSURANCE CORPORATION

DIRECTIVE SYSTEM

* Pedestrian changes have been made to the directive and appear in blue. 7/27/2015,

5/14/2014, 5/28/2013, and 10/27/2015.)