Privacy Act of 1974; System of Records

AGENCY:

United States Department of Justice.

ACTION:

Notice of modified Systems of Records; blanket routine use.

SUMMARY:

Pursuant to the Privacy Act of 1974, 5 and Office of Management and Budget (OMB) Circular No. A-108, notice is hereby given that the United States Department of Justice (Department or DOJ) proposes to modify the DOJ System of Records Notices for the DOJ systems of records listed below.

DATES:

In accordance with 5 U.S.C. 552a(e)(4) and (11), this notice is subject to a 30-day notice and comment period. Please submit any comments by June 26, 2017.

ADDRESSES:

The public, OMB, and Congress are invited to submit any comments to the U.S. Department of Justice, ATTN: Privacy Analyst, Office of Privacy and Civil Liberties, National Place Building, 1331 Pennsylvania Avenue NW., Suite 1000, Washington, DC 20530-0001, by facsimile at 202-307-0693, or email at privacy.compliance@usdoj.gov. To ensure proper handling, please reference the above CPCLO Order No. on your correspondence.

FOR FURTHER INFORMATION CONTACT:

Andrew A. Proia, Attorney Advisor, Office of Privacy and Civil Liberties, National Place Building, 1331 Pennsylvania Avenue NW., Suite 1000, Washington, DC 20530-0001, by facsimile at 202-307-0693, or email at privacy.compliance@usdoj.gov. To ensure proper handling, please reference the above CPCLO Order No. on your correspondence.

SUPPLEMENTARY INFORMATION:

On May 22, 2007, OMB issued Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, to the heads of all executive departments and agencies. In its memorandum, OMB required agencies to publish a routine use for their systems of records specifically applying to the disclosure of information in connection with response and remedial efforts in the event of a breach of personally identifiable information. DOJ published a notice in the Federal Register, 72 FR 3410 (January 25, 2007), modifying all DOJ System of Records Notices by adding a routine use to address the limited disclosure of records related to a suspected or confirmed breach within the Department, consistent with OMB requirements. Since that time, all new DOJ System of Records Notices published by the Department, as well as significantly modified System of Records Notices that were republished in full, included a breach response routine use consistent with the requirements in OMB Memorandum M-07-16.

On January 3, 2017, OMB issued Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, to the heads of all executive departments and agencies. OMB Memorandum M-17-12 rescinds and replaces OMB Memorandum M-07-16 and updates agency routine use requirements for responding to a breach. Specifically, OMB Memorandum M-17-12 requires all Senior Agency Officials for Privacy to ensure that their agency's System of Records Notices include a routine use for the disclosure of information necessary to respond to a breach of the agency's personally identifiable information. Additionally, OMB Memorandum M-17-12 requires agencies to add a routine use to ensure that agencies are able to disclose records in their systems of records that may reasonably be needed by another agency in responding to a breach.

To satisfy the routine use requirements in OMB Memorandum M-17-12, DOJ is issuing two notices in the Federal Register to modify all of the Department's System of Records Notices. The records maintained in many DOJ systems of records are still subject to the Department's blanket breach response routine use published at 72 FR 3410 (January 25, 2007). For these DOJ systems of records, this notice rescinds 72 FR 3410 (January 25, 2007) and adds the two routine uses required by OMB Memorandum M-17-12.

Other DOJ systems of records have been created or significantly modified since 72 FR 3410 (January 25, 2007) added the previous, OMB-required breach response routine use. The DOJ System of Records Notices for these DOJ systems of records incorporated the OMB Memorandum M-07-16 breach response routine use in their “ROUTINE USES” section, rather than relying on the routine use published at 72 FR 3410 (January 25, 2007). These System of Records Notices are not affected by this notice publication. Elsewhere in the Federal Register, the Department is modifying the DOJ System of Records Notices for the DOJ systems of records that do not rely on the breach response routine use published at 72 FR 3410 (January 25, 2007). The DOJ System of Records Notices for these DOJ systems of records are being modified separately to ensure continuity with their previous notice publications. Pursuant to OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (January 3, 2017), this notice: (1) Rescinds the breach response routine use published at 72 FR 3410 (January 25, 2007); (2) revises the breach response routine use for the DOJ systems of records, listed below; and (3) adds a new routine use to the DOJ systems of records, listed below, to ensure that the Department can assist another agency in responding to a confirmed or suspected breach, as appropriate.

In accordance with 5 U.S.C. 552a(r), the Department has provided a report to OMB and to Congress on this notice of modified systems of records.

United States Department of Justice System of Records Notices and citations follow. An asterisk (*) designates the last full Federal Register notice that includes all of the elements that are required to be in a System of Records Notice.

The routine use published at 72 FR 3410 (January 25, 2007) is hereby rescinded for the DOJ System of Records Notices, listed above, and replaced as follows:

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

To appropriate agencies, entities, and persons when (1) the Department suspects or has confirmed that there has been a breach of the system of records; (2) the Department has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, DOJ (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Department's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

To another Federal agency or Federal entity, when the Department determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.