PM-22, Personally Identifiable Information Quality Management, asks for organization wide policies and procedures to review PII for accuracy, relevance, timeliness and completeness, to correct or delete inaccurate or outdated PII, to notify others of corrections or deletions, and to handle appeals of adverse decisions on correction or deletion requests. It is a federal control that reaches others by contract and works as a reference for privacy programs.
What it means in practice
The record frames quality across the whole life cycle: creation, collection, use, processing, storage, maintenance, dissemination, disclosure and disposition. Inaccurate or outdated PII can cause problems for the person it describes, such as a denied service or a wrong decision.
Four things have to be covered by procedure. Reviews, corrections, notices to people who received the data, and an appeals route. Teams often have the first two and forget the last two.
If you pass PII to a downstream partner, a correction that never reaches that partner is only half done.
Evidence to collect
- The quality management policy and procedures
- Records of periodic data quality reviews
- Correction and deletion request tickets with outcomes
- Copies of notices sent to individuals or recipients
- The appeals process and a sample appeal outcome
Common gaps
- Corrections are made in one system and not in downstream copies
- No appeals route for adverse decisions
- Reviews happen only after a complaint
- No record of who was told about a deletion
How to implement it
- Identify where PII is created, copied and shared.
- Define review points and owners for each stage of the life cycle.
- Build the notice step into the correction workflow.
- Document the appeals route and test it with an example.
Quick check
What four things must the procedures cover?
Review for accuracy and related qualities, correction or deletion, notice of those changes, and appeals of adverse decisions.
