SURFACE TRANSPORTATION BOARD

Thank you for visiting the STB’s website.  We are committed to respecting your right to privacy and will protect it when you visit our website.

This Privacy Policy explains our online information practices only, including how we collect and use your personal information.  It covers information collected on the STB website.  Our Privacy Policy does not apply to third party websites that you are able to reach from our website.  We encourage you to read the Privacy Policies of those third parties to learn how they collect and use information about you.

To assist you with reading our Privacy Policy, we have provided answers to the following questions:

1. What information do we collect automatically online, and why do we collect it?
2. What additional information do we collect about you online?
3. Why do we collect your information online, and how do we use it?
4. How, and with whom, do we share the information we collect online?
5. Do we give you choices on how we use the information you provide us?
6. What are our information practices for children?
7. Do we use cookies or other tracking devices?
8. How do we secure your information we collect online?
9. What are your rights under the Privacy Act of 1974? (5 U.S.C. § 552a)
10. How do you submit a Privacy Act request?
11. How do you find out more about, or comment on, our privacy practices?

1.  What information do we collect automatically online, and why do we collect it?

When you visit our website, we collect information about your visit that does not identify you personally.  We can tell the type of computer, browser, and Web service you are using.  We also know the date, time, and pages you visit.  Collecting this information helps us design the site to suit your needs.  In the event of a known security or virus threat, we may also collect information on the web content you view.

2.  What additional information do we collect about you online?

When you visit our website, we may request and collect personal contact information from you.

3.  Why do we collect personal information online, and how do we use it?

Our principal purpose for collecting personal information online is to provide you with the information you seek, to respond to your inquiries, to facilitate the use of our website, and in particular circumstances, to address security and virus concerns.

We will only use your information for the purposes for which you have provided this information, or for the purposes required under the law.  (In order to learn more about how we provide choices to you regarding our use of your information, visit the “Choices” section in this Privacy Policy.)

Generally, our uses of information collected online include:

• Responding to your complaints

• Replying to your “feedback comments”

• Managing your access to restricted areas of the website

• Fulfilling requests for reports and other similar information

• Registering you for a member account

4.  How, and with whom, do we share the information we collect online?

We may share personally, identifiable information you provide to us online with appropriate representatives within other federal government agencies, or other designated representatives as needed to facilitate your request or transaction.  In a government-wide effort to combat security and virus threats, we may also collect and share some information that we do not normally collect, such as IP address (your computer’s unique identification number on the Web), with other federal government agencies.

Additionally, we may be required by law to share information we collect with authorized law enforcement, homeland security, and national security organizations.  (See also the “What are your rights under the Privacy Act of 1974?” section in this Privacy Policy.)

5.  Do we give you choices on how we use the information you provide us?

Throughout our website, we will let you know whether the information we ask you to provide is voluntary or required.  By providing personally, identifiable information, you are granting us consent to use this personally, identifiable information for the primary purpose for which you are providing it.  Additionally, we will ask for you to grant us consent before using your voluntarily provided information for any secondary purposes, other than those required under the law.

6.  What are our information practices for children?

Our website does not intentionally collect information from children under the age of 13.  If we choose to collect personal information from children, we will comply with the Children’s Online Privacy Protection Act (COPPA).  To find out more about COPPA, please click on the following link:  www.ftc.gov/privacy/privacyinitiatives/childrens.html.

7.  Do we use cookies or other tracking devices?

A “cookie” is a small text file that is stored on your computer and makes it easy for you to move around a website without having to continually re-enter your name, password, preferences, etc.

We use only “session” cookies; this means we store the cookie on your computer only during each visit to our website.  After you turn off your computer or stop using the Internet, the cookie is erased and nothing will be remembered the next time you visit our website.

8.  How do we secure your information we collect online?

We are committed to properly securing the information we collect online.  To help us accomplish this, we take the following steps:

• We employ internal access controls to ensure that the only people who see your information are those with a need to do so to perform their official duties;

• We train relevant personnel on our privacy and security measures so that our personnel know what is required for compliance;

• We physically secure the areas where we hold hard copies of the information we collect online;

• We regularly back up the information we collect online to insure against loss;

• We use technical controls to secure the information we collect online as appropriate, including but not limited to:  Secure Socket Layer (SSL), encryption, firewalls, password protections;

• We periodically test our security procedures to ensure personnel and technical compliance; and

• We employ external access safeguards to identify and thwart unauthorized attempts of outsiders to hack into, or cause harm to, the information in our systems.

Tampering with the STB website is against the law.  If anyone tries to tamper with it, they may be punished under the Computer Fraud and Abuse Act of 1986 and the National Information Infrastructure Protection Act.

9.  What are your rights under the Privacy Act of 1974? (5 U.S.C. § 552a)

The Privacy Act of 1974 protects the personal information the federal government keeps on you in “systems of records (SOR)” (information an agency controls that can be retrieved by name or some other personal identifier).  The Privacy Act regulates how the government can disclose, share, provide access to, and maintain the personal information that it collects.  Not all information collected online is covered by the Privacy Act.  Information that does not identify you personally (for example, information in aggregate about users of this website) is not covered by the Privacy Act.

The Act’s major provisions require agencies to:

• Publish a Privacy Act Notice in the Federal Register explaining the existence, character and uses of a new or revised SOR;

• Keep information about you accurate, relevant, timely, and complete to assure fairness in dealing with you; and

• Allow you to, upon request, access and review your information held in a SOR and request amendment of the information if you disagree with it.

When the STB collects information from you online that is subject to the Privacy Act (i.e., information to be kept in a SOR), we will provide you, through a link on the Web page from which we collect information, access to our Privacy Act Notice.  This Privacy Act Notice will inform you what portion of the information is maintained and retrieved by your name or other personal identifier.

Each Privacy Act Notice will also notify you of the following:

• The authority for and purpose and use of the collection of information subject to the Privacy Act;

• Whether providing the information is voluntary or mandatory; and

• The effects on you if you do not provide any or all of the requested information.

10.  How do you submit a Privacy Act request?

You may request access to any information maintained by the Board pertaining to you. Direct your request to:

Your request must be in writing; must be signed; and must include your full name, your home and business addresses, and telephone numbers. The request must specify the title and identifying number as it appears in the system notice published by the Board, provide any identifying information as may be required by the system notice, describe the specific information or kind of information sought within that system of records, and set forth any unusual arrangements sought concerning the time, place, or form of access. The Board will respond in writing to your request within ten business days.

11.  How do you find out more about, or comment on, our privacy practices?

For more information on our privacy practices, or for comments and concerns, please send an email to Rachel Campbell, Managing Director and Senior Agency Official for Privacy, at .  The Board’s Privacy Act regulations are located at 49 C.F.R. Part 1007.