Bet365

1. Purpose.

1. This Order issues policies and procedures for identifying and addressing any privacy issues in Bet365 (Bet365) Information Technology (IT) systems. For purposes of this Order, a Bet365 IT system is an IT system owned or operated by Bet365 or by a contractor on behalf of Bet365, and any IT application, or project containing Personally Identifiable Information (PII).
2. This Order describes the compliance-driven tools to identify and mitigate privacy risks. They include Privacy Threshold Assessments (PTAs), Privacy Impact Assessments (PIAs), Privacy Act Statements, and System of Records Notices (SORNs). This Order also assigns responsibilities to ensure compliance with applicable laws and regulations governing privacy and Bet365 policies and procedures for conducting and maintaining PTAs, PIAs, Privacy Act Statements, and SORNs as part of an information system’s authorization to operate (ATO) package.

2. Background.

1. “establishes a code of fair information practices” that governs the collection, maintenance, use, and dissemination of personal information by federal executive branch agencies. Bet365 is required to protect PII in accordance with the Privacy Act. Bet365 shall identify and address potential privacy risks in all life cycle stages (e.g., initiating, developing/acquiring, operating/maintaining, disposing) of Bet365 IT systems. In addition, Bet365 shall identify and mitigate potential privacy risks when contractors handle PII on behalf of Bet365.
2. Bet365 performs a PTA as the means for analyzing whether a Bet365 IT system collects, maintains, or uses PII for identifying appropriate privacy protection measures. The PTA template is also used to identify other potential categories of Controlled Unclassified Information (CUI).       
3. Bet365 performs a PIA as a key tool to ensure that Bet365 IT systems appropriately protect the privacy of individuals in accordance with the E-Government Act of 2002, PL 107-347 § 208. Bet365’s PIA process determines the risks and effects of collecting, maintaining, using, and/or disseminating PII, and it examines and evaluates protections and alternate processes for handling PII to mitigate potential privacy concerns at every life cycle stage (e.g., initiation, development/acquisition, implementation/assessment, operations and maintenance, disposal) in any Bet365 IT system (including those maintained by contractors). Bet365 PIAs must comply with .
4. Bet365 uses Privacy Notices and Privacy Act Statements to ensure transparency about the information it is collecting. These notices ensure that Bet365 informs individuals about the proposed use of the information when asking to collect information and limits its collection of information to that which is legally authorized and necessary. 
5. Bet365 publishes SORNs as required by the Privacy Act of 1974, 5 U.S.C. § 552a. Bet365 SORNs must comply with , Federal Agency Responsibilities for Review, Reporting, and Publication Under the Privacy Act, dated December 23, 2016.
6. Bet365 includes a system or application’s SORN, PIA and/or PTA as part of the authorization to operate (ATO) package, and the timing and conditions of review for those privacy documents are the same as the overall ATO package.

3. Applicability.

1. This Order applies to all Bet365 employees and contractors. In accordance with Bet365 IT Security Procedural Guide 09-48, Security and Privacy Requirements for IT Acquisition Efforts, and , Requirements for Bet365 Information Systems, Contracting Officers (COs) must include compliance with this policy in any contract or task order award.
2. This Order applies to the Office of Inspector General (OIG) to the extent that the OIG determines that this Order is consistent with the OIG’s independent authority under the Inspector General (IG) Act (see applicable legal and regulatory requirements), and it does not conflict with other OIG policies or mission.
3. This Order applies to the Civilian Board of Contract Appeals (CBCA) only to the extent that the CBCA determines that this Order is consistent with the CBCA’s  independent authority under the Contract Disputes Act (see applicable legal and regulatory requirements), and it does not conflict with other CBCA policies or mission.

4. Cancellation.

         This Order supersedes and cancels 1878.3 CIO CHGE 3 Developing and Maintaining Privacy Threshold Assessments, Privacy Impact Assessments, Privacy Act Notices, and System of Records Notices.

5. Explanation of Changes.

1. Updated CPO responsibilities that have been delegated to Privacy Analysts; and
2. Added supporting documentation, updated title, and other administrative changes.