Privacy Act memo

DATE:

November 15, 2019

TO:

Marla Jacobson
Acquisition Oversight, Policy & Operations Branch
National Cancer Institute

FROM:

NIH Privacy Act Officer

SUBJECT: Applicability of the Privacy Act: “NCI Evaluation of Office of Acquisitions System
(OASYS) and FFRDC Contract Administration System (FCAS) Vendor Portals”
I have reviewed the NCI submission to OMB which requests the approval of the OASYS and FCAS
Vendor Portals. The vendor portals will serve as a one-stop shop for transmission of requests,
reports, deliverables and other correspondence due on numerous research and development and in
support of R&D contracts. These reports and deliverables cover a wide variety of topics in the areas
of cancer research including prevention, detection, diagnosis, and control.
The OASYS/FCAS vendor portals will use technology to collect information from vendors. Vendors
that do not have existing vendor portal accounts with whom NCI Office of Acquisitions (OA) wish to
negotiate based upon evaluation of their proposal, will be invited by NCI OA by email to set up a
vendor profile. This will allow the authorized vendor users to access to the subject solicitation to
view and respond to the request for revised proposal, and or negotiation questions
I have determined that the Privacy Act will apply to this data collection. The following Personally
Identifiable Information (PII) will be collected to establish the vendor profile so that vendor users that
are authorized can have access to their specific vendor firm’s account: name of business official,
business officials title, email address of business official, firm/company name, firm/company mailing
address, firm/company phone number and firm DUNS number. This information will be stored within
the internal OASYS/FCAS system and will only be accessible by authorized users.
The information the vendors provide will be included in a Privacy Act system of records and will be
used and may be disclosed for the purposes and routine uses described and published in the
following System of Records Notices (SORN): 09-25-0216 Administration: NIH Electronic Discovery
and 09-25-0118 Contracts: Professional Services Contractors. If you have questions, contact me at
(301) 402-6201.

Celeste Dade-Vinson
NIH Privacy Act Officer
CC: Diane Kreinbrink, Office of Management Policy and Compliance, NCI