Privacy Act of 1974; System of Records

AGENCY:

Office of the Secretary, Interior.

ACTION:

Notice of modified systems of records.

SUMMARY:

Pursuant to the provisions of the Privacy Act of 1974, as amended, and the Office of Management and Budget (OMB) Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, the Department of the Interior (DOI) is issuing a public notice of its intent to modify Departmental and bureau and office system of records notices to add a new breach routine use to ensure that the DOI can assist another agency in responding to a confirmed or suspected breach of personally identifiable information, as appropriate.

DATES:

This notice will be effective upon publication. New or modified routine uses will be effective October 7, 2021. Submit comments on or before October 7, 2021.

ADDRESSES:

You may send comments identified by docket number [DOI-2020-0019] by any of the following methods:

• Federal eRulemaking Portal: http://www.regulations.gov. Follow the instructions for sending comments.
• Email: DOI_Privacy@ios.doi.gov. Include docket number [DOI-2020-0019] in the subject line of the message.
• U.S. Mail or Hand Delivery: Teri Barnett, Departmental Privacy Officer, U.S. Department of the Interior, 1849 C Street NW, Room 7112, Washington, DC 20240.

Instructions: All submissions received must include the agency name and docket number [DOI-2020-0019]. All comments received will be posted without change to http://www.regulations.gov,, including any personal information provided.

Docket: For access to the docket to read background documents or comments received, go to http://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT:

Teri Barnett, Departmental Privacy Officer, U.S. Department of the Interior, 1849 C Street NW, Room 7112, Washington, DC 20240, DOI_Privacy@ios.doi.gov or (202) 208-1605.

SUPPLEMENTARY INFORMATION:

I. Background

On May 22, 2007, OMB issued Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, which required Federal agencies to publish a routine use for their systems of records specifically applying to the disclosure of information in connection with response and remedial efforts in the event of a breach of personally identifiable information. Several DOI bureaus and offices published System of Records Notices (SORNs) in the Federal Register in 2008 to modify DOI bureau and office systems of records by adding a routine use in their “ROUTINE USES” section to address the limited disclosure of records related to a suspected or confirmed breach within DOI consistent with OMB M-07-16. All new and significantly modified SORNs published by the DOI, or its bureaus and offices, since that time included a breach response routine use consistent with the requirements outlined in OMB M-07-16.

On January 3, 2017, OMB issued Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, which rescinded and replaced OMB M-07-16. This memorandum requires agencies to publish two routine uses for their systems of records specifically applying to the disclosure of information in connection with response and remedial efforts in the event of a breach of personally identifiable information. Specifically, OMB M-17-12 requires that agency Senior Agency Officials for Privacy ensure that their agency SORNs include routine uses for the disclosure of information necessary to respond to that agency's breach of PII. Additionally, OMB M-17-12 requires that a breach routine use be added to all agency SORNs to ensure that agencies are able to disclose records in their systems of records to another Federal agency that may reasonably be needed by that agency to respond to a breach of PII. DOI is issuing two separate notices in the Federal Register to modify existing DOI SORNs to satisfy the two breach routine use requirements outlined in OMB M-17-12.

DOI is publishing this notice to modify the DOI SORNs identified below to add a new breach routine use for the limited disclosure of records that may reasonably be needed by another agency to respond to a breach. The DOI SORNs for other DOI, bureau and office systems of records that are omitted from this notice have incorporated the new breach routine use, are being rescinded, or are being modified separately to ensure continuity with their previous notice publications. DOI is publishing a notice elsewhere in the Federal Register to revise DOI bureau and office SORNs to include the required breach routine use to comply with OMB M-17-12 for the bureau and office systems of records for the disclosure of information necessary for DOI to respond to a breach of PII.

This notice adds the new mandatory breach routine use to the DOI systems of records listed below to ensure that the Department can assist another agency in responding to a confirmed or suspected breach, as appropriate, pursuant to OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

To another Federal agency or Federal entity, when DOI determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach; or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.