I85PREP
⌘ K
Military Civilian Grade 7 Admin study materials
Military Civilian Grade 7 Admin study resources

PII on a Reimaged Laptop and a FOIA Request

Military Civilian Grade 7 Admin · Put your knowledge to work in context.

All case studies

PII on a Reimaged Laptop and a FOIA Request

You are the records management officer for a joint base. A staff sergeant reports that a laptop checked out to a separated civilian employee was returned to the IT pool without being wiped. The laptop contained a spreadsheet with 1,200 names and Social Security numbers used for an awards ceremony. The employee's account was disabled 60 days ago. The IT shop says it reimaged the laptop three weeks ago, before the loss was discovered, and has no backup. A Freedom of Information Act request arrives for all records concerning the awards ceremony. The base has 14 days to respond. The records disposition schedule says awards files are temporary and may be destroyed two years after cutoff. The commander wants to know whether this is a reportable incident, who is responsible, and whether the FOIA request can be denied because the file was destroyed.

1. What immediate actions and notifications do you take?

Read the worked answer

Treat this as a suspected PII breach first and a records question second.

Immediate:

  1. Contain: impound the laptop and any media; ask IT to stop further wiping or reimaging; preserve the reimaging ticket, logs, emails, and the returned laptop serial number.
  2. Assess: confirm the number of records, data elements, whether the spreadsheet was encrypted, who had access, and whether there is any evidence of exfiltration. Reimaging does not prove there was no disclosure, and it destroyed evidence.
  3. Notify: privacy officer and security manager immediately; commander; legal; FOIA office. Follow the command's incident reporting timeline; do not wait for a perfect assessment.
  4. Preserve: place a litigation hold on all related records, including email and shared drives.
  5. Do not notify the 1,200 individuals until the privacy office assesses risk and approves the message; premature notice can be inaccurate.
  6. Document every action with time, person, and item.

The reportable determination belongs to the privacy office, but the supervisor's job is to surface it fast and preserve evidence.

2. How do you handle the FOIA request and the records schedule?

Read the worked answer

The FOIA request is not answered by saying the file was destroyed. That is both a records issue and a potential litigation risk.

  • Search broadly: awards ceremony files, email, shared drives, calendars, the spreadsheet if any copy exists, and IT backups. Document the search.
  • Suspend destruction: the two-year temporary schedule allows destruction only after cutoff and only if no FOIA, litigation, or audit hold applies. A request is a hold trigger.
  • Coordinate with the FOIA office and legal on exemptions, especially personal privacy for SSNs. Release segregable non-exempt portions; withhold only what the law allows.
  • Meet the 14-day deadline or request a written extension with a reason. Do not miss it silently.
  • If records were destroyed, report that to legal and the FOIA office; do not conceal it. The remedy is not to deny the request but to document what happened and preserve what remains.

The records schedule is a disposal authority, not a shield.

3. Who is responsible, and what corrective actions do you recommend?

Read the worked answer

Responsibility is distributed; the commander needs facts and fixes, not a single scapegoat.

  • The separating employee had custody and apparently returned the laptop without confirming a wipe or notifying the custodian. If the turn-in procedure required a wipe certificate, that step failed.
  • IT reimaged an accountable device without verifying the user, contents, or authorization. That is an asset-management and privacy control failure.
  • The supervisor or property custodian did not reconcile the checkout against the return.
  • The records officer's inventory did not catch a PII file on a loaner.

Recommendations:

  1. Revise turn-in: no reimage without a signed custodian verification and a wipe certificate; log serial number and date.
  2. Label and inventory PII files; require encryption and limited storage.
  3. Reconcile loaner laptops monthly against hand receipts.
  4. Train staff on PII handling and incident reporting.
  5. Add the control to the next inspection checklist.
  6. Refer any disciplinary question to HR and legal after the facts are complete; do not prejudge.

This is a corrective-action plan, not just blame.