The Agency's general authority to collect personal information is published at https://tti.tamu.edu/notices-policies/privacy-and-security-policy. Specific programs or information resources with authority to collect that extends beyond the Agency's general authority shall be published on that specific information resource.
Laws and regulations are violated due to inappropriate collection of personal information.
The organization determines and documents the legal authority that permits the collection, use, maintenance, and sharing of personally identifiable information (PII), either generally or in support of a specific program or information system need.
Legal authority is explicitly defined.
No statewide control
Obtain data privacy policy and procedures; other relevant documents or records and ascertain if:
(I) the organization determines whether the contemplated collection of PII is legally authorized before collecting PII in connection with an information system or program.
(ii) the organization consults with Senior Agency Official for Privacy (SAOP) / Chief Privacy Officer (CPO) and legal counsel regarding the authority of any program or activity to collect PII.
(iv) the organization documents the authority to collect PII in the System of Records Notice (SORN) and/or Privacy Impact Assessment (PIA).
