Privacy Act of 1974; as Amended; New System of Records and New Routine Use Disclosures, 15828-15832 [E8-6066]

Agencies

• Social Security Administration

[Federal Register Volume 73, Number 58 (Tuesday, March 25, 2008)]
[Notices]
[Pages 15828-15832]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E8-6066]


=======================================================================
-----------------------------------------------------------------------

SOCIAL SECURITY ADMINISTRATION


Privacy Act of 1974; as Amended; New System of Records and New 
Routine Use Disclosures

AGENCY: Social Security Administration (SSA).

ACTION: Proposed New System of Records and Proposed Routine Uses.

-----------------------------------------------------------------------

SUMMARY: In accordance with the Privacy Act (5 U.S.C. 552a(e)(4) and 
(e)(11)), we are issuing public notice of our intent to establish a new 
system of records entitled Identity Protection Program (IPP) System, 
60-0360, and routine uses applicable to this system of records. 
Hereinafter, we will refer to the proposed system of records as the IPP 
System. The proposed system of records will consist of information used 
to provide enhanced protection for employees who reasonably believe 
that they may be at risk of injury or other harm by the disclosure of 
their work location and telephone number information, supporting 
documentation, and the dispositions of the requests for program 
participation. We invite public comments on this proposal.

DATES: We filed a report of the proposed new system of records and 
proposed routine use disclosures with the Chairman of the Senate 
Committee on Homeland Security and Governmental Affairs, the Chairman 
of the House Committee on Government Reform, and the Director, Office 
of Information and Regulatory Affairs, Office of Management and Budget 
(OMB) on March 17, 2008. The proposed system of records and routine 
uses will become effective on April 26, 2008, unless we receive 
comments warranting it not to become effective.

ADDRESSES: Interested individuals may comment on this publication by 
writing to the Executive Director, Office of Public Disclosure, Office 
of the General Counsel, Social Security Administration, 3-A-6 
Operations Building, 6401 Security Boulevard, Baltimore, Maryland 
21235-6401. All comments received will be available for public 
inspection at the above address.

FOR FURTHER INFORMATION CONTACT: Ms. Edie McCracken, Social Insurance 
Specialist, Office of Public Disclosure, Office of the General Counsel, 
Social Security Administration, 3-A-6 Operations Building, 6401 
Security Boulevard, Baltimore, Maryland 21235, telephone at (410) 965-
6117, e-mail address at edie.mccracken@ssa.gov.

SUPPLEMENTARY INFORMATION:

I. Background and Purpose of the Proposed New System of Records 
Entitled the IPP System

A. General Background

    We approved a recommendation from a national committee on security 
to implement a nationwide program to enhance the safety and security of 
our employees who are victims, or potential victims, of domestic 
violence. It was intended to safeguard the anonymity of at-risk 
employees when requests for their work location and/or phone number 
were received from individuals posing a threat to their personal 
safety, by delaying the disclosure of the information when certain 
conditions were met. This process would have entailed a change in our 
policy that permitted such information requests to be honored. While no 
action was ever taken on the recommendation, we amended our rules to 
reflect a similar approach that strengthened our privacy and disclosure 
rules to better safeguard employees who reasonably believe that they 
may be at risk of injury or other harm by the disclosure of their work 
location and telephone number.

B. Collection and Maintenance of the Data for the Proposed New System 
of Records Entitled the IPP System

    SSA will collect and maintain information that will be housed in 
the IPP System from employees who have requested program participation 
in the IPP from SSA officials. The information maintained in this 
system of records will be maintained in paper and electronic formats 
and will include information on all IPP requests made by employees. 
This system contains such information as: (1) The employee's name, 
personal identification number (PIN), supporting documentation 
collected during the process, number of

[[Page 15829]]

requests made, whether those requests have been granted or denied; (2) 
the employee's locator information and telephone number; (3) the number 
of requests by Agency component that have been approved, and the number 
denied; (4) the reasons for denial; and (5) amount of time to process 
each request. We will retrieve information from the proposed system of 
records by using the employee's name and/or PIN. Thus, the IPP System 
constitutes a system of records under the Privacy Act.

II. Proposed Routine Use Disclosures of Data Maintained in the Proposed 
IPP System

A. Proposed Routine Use Disclosures

    We are proposing to establish routine uses of information that will 
be maintained in the proposed IPP System as discussed below.
    1. To the Office of the President for the purpose of responding to 
an individual pursuant to an inquiry received from that individual or 
from a third party on his or her behalf.
    We will disclose information under this routine use only in 
situations in which an individual may contact the Office of the 
President, seeking that Office's assistance in a matter relating to 
information contained in this system of records. We will disclose 
information when the Office of the President makes an inquiry and 
indicates that it is acting on behalf of the individual whose record is 
requested.
    2. To a congressional office in response to an inquiry from that 
office made at the request of the subject of a record.
    We will disclose information under this routine use only in 
situations in which an individual may ask his or her congressional 
representative to intercede in a matter relating to information 
contained in this system of records. We will disclose information when 
the congressional representative makes an inquiry and indicates that he 
or she is acting on behalf of the individual whose record is requested.
    3. To the Department of Justice (DOJ), a court or other tribunal, 
or another party before such tribunal when:
    (a) SSA, or any component thereof; or
    (b) any SSA employee in his/her official capacity; or
    (c) any SSA employee in his/her individual capacity where DOJ (or 
SSA where it is authorized to do so) has agreed to represent the 
employee; or
    (d) the United States or any agency thereof where SSA determines 
that the litigation is likely to affect the operations of SSA or any of 
its components, is a party to the litigation or has an interest in such 
litigation, and SSA determines that the use of such records by DOJ, a 
court or other tribunal, or another party before such tribunal is 
relevant and necessary to the litigation, provided, however, that in 
each case, SSA determines that such disclosure is compatible with the 
purpose for which the records were collected.
    We will disclose information under this routine use only as 
necessary to enable DOJ to effectively defend SSA, its components or 
employees in litigation involving the proposed new system of records 
and ensure that courts and other tribunals have appropriate 
information.
    4. To the Equal Employment Opportunity Commission (EEOC or 
Commission) when requested in connection with investigations into 
alleged or possible discriminatory practices in the Federal sector, 
examination of Federal affirmative employment programs, compliance by 
Federal agencies with the Uniform Guidelines on Employee Selection 
Procedures, or other functions vested in the Commission.
    We will disclose information to the EEOC, as necessary, to assist 
in reassessing individuals' requests for program participation, to 
assist in investigations into alleged or possible discriminatory 
practices in the Federal sector, to combat and prevent fraud, waste and 
abuse under the Rehabilitation Act of 1973, and for other functions 
vested in the Commission.
    5. To the Federal Labor Relations Authority, the General Counsel, 
the Federal Mediation and Conciliation Service, the Federal Service 
Impasses Panel, or an arbitrator when information is requested in 
connection with investigations of allegations of unfair labor 
practices, matters before an arbitrator or the Federal Impasses Panel.
    We will disclose information about employees under this routine 
use, as necessary, to the Federal Labor Relations Authority, the 
General Counsel, the Federal Mediation and Conciliation Service, and 
the Federal Service Impasses Panel, or an arbitrator in which all or 
part of the allegations involve the Agency's providing program 
participation for at-risk employees.
    6. To the Office of Personnel Management, Merit Systems Protection 
Board, or the Office of the Special Counsel, in connection with 
appeals, special studies of the civil service and other merit systems, 
review of those agencies' rules and regulations, investigation of 
alleged or possible prohibited personnel practices, and other such 
functions promulgated in 5 U.S.C. chapter 12, or as may be authorized 
by law.
    We will disclose information under this routine use, as necessary, 
to the Office of Personnel Management, Merit Systems Protection Board 
or the Office of the Special Counsel in which all or part of the 
allegations in the appeal or action involve the Agency's providing 
program participation for at-risk employees or disapproving such 
participation.
    7. To contractors and other Federal agencies, as necessary, for the 
purpose of assisting SSA in the efficient administration of its 
programs. We will disclose information under this routine use only in 
situations in which SSA may enter into a contractual or similar 
agreement with a third party to assist in accomplishing an Agency 
function relating to this system of records.
    We will disclose information under this routine use only in 
situations in which SSA may enter into a contractual agreement or 
similar agreement with a third party to assist in accomplishing an 
Agency function relating to this system of records.
    8. To student volunteers, individuals working under a personal 
services contract, and other individuals performing functions for SSA, 
who technically do not have the status of Agency employees, when they 
are performing work for SSA, as authorized by law, and they need access 
to the records in order to perform their assigned Agency functions.
    Under certain Federal statutes, SSA is authorized to use the 
service of volunteers and participants in certain educational, 
training, employment and community service programs. Examples of such 
statutes and programs include: 5 U.S.C. 3111 regarding student 
volunteers and 42 U.S.C. 2753 regarding the College Work-Study Program. 
We contemplate disclosing information under this routine use only when 
SSA uses the services of these individuals and they need access to 
information in this system to perform their assigned Agency duties.
    9. To the General Services Administration (GSA) and the National 
Archives and Records Administration (NARA) under 44 U.S.C. 2904 and 
2906, as amended by the NARA Act of 1984, non-tax return information 
which is not restricted from disclosure by Federal law for use by those 
agencies in conducting records management studies.
    The Administrator of GSA and the Archivist of NARA are charged by 
44 U.S.C. 2904, as amended, with promulgating standards, procedures and 
guidelines regarding record

[[Page 15830]]

management and conducting records management studies. 44 U.S.C. 2906, 
as amended, provides that GSA and NARA are to have access to Federal 
agencies' records and that agencies are to cooperate with GSA and NARA. 
In carrying out these responsibilities, it may be necessary for GSA and 
NARA to have access to this system of records. In such instances, the 
routine use will facilitate disclosure.
    10. To Federal, State, and local law enforcement agencies and 
private security contractors, as appropriate, information necessary:
     To enable them to protect the safety of SSA employees and 
the security of the SSA workplace, and the operation of SSA facilities, 
or
     To assist investigations or prosecutions with respect to 
activities that affect such safety and security or activities that 
disrupt the operation of SSA facilities.
    We will disclose information under this routine use to law 
enforcement agencies and private security contractors when information 
is needed to investigate, prevent, or respond to activities that 
jeopardize the security and safety of SSA employees or workplaces, or 
that otherwise disrupt the operation of SSA facilities. Information 
would also be disclosed to assist in the prosecution of persons charged 
with violating Federal or local law in connection with such activities.
    11. To appropriate Federal, State, and local agencies, entities, 
and persons when (1) we suspect or confirm that the security or 
confidentiality of information in this system of records has been 
compromised; (2) we determine that as a result of the suspected or 
confirmed compromise there is a risk of harm to economic or property 
interests, identity theft or fraud, or harm to the security or 
integrity of this system or other systems or programs of SSA that rely 
upon the compromised information; and (3) we determine that disclosing 
the information to such agencies, entities, and persons is necessary to 
assist in our efforts to respond to the suspected or confirmed 
compromise and prevent, minimize, or remedy such harm. SSA will use 
this routine use to respond only to those incidents involving an 
unintentional release of its records.
    This routine use specifically permits the disclosure of SSA 
information in connection with response and remediation efforts in the 
event of an unintentional release of Agency information, otherwise 
known as a ``data security breach.'' This routine use serves to protect 
the interests of the people whose information is at risk by allowing us 
to take appropriate steps to facilitate a timely and effective response 
to a data security breach. It will also help us to improve our ability 
to prevent, minimize, or remedy any harm that may result from a 
compromise of data maintained in these systems of records.

B. Compatibility of Proposed Routine Uses

    The Privacy Act (5 U.S.C. 552a(b)(3)) and our disclosure 
regulations (20 CFR part 401) permit us to disclose information under a 
published routine use for a purpose that is compatible with the purpose 
for which we collected the information. Section 401.150(c) of SSA 
Regulations permits us to disclose information under a routine use 
where necessary to carry out SSA programs. SSA Regulations at section 
401.120 provide that we will disclose information when a law 
specifically requires the disclosure. The proposed routine uses 
numbered 1 through 9, 11 and 12 above will ensure efficient 
administration of the IPP System; the disclosure that would be made 
under routine use number 10 is required by Federal law. Thus, all 
routine uses are appropriate and meet the relevant statutory and 
regulatory criteria.

III. Records Storage Medium and Safeguards for the Proposed New System 
Entitled the IPP System

    SSA will maintain information in the IPP System in electronic and 
paper form. Only authorized SSA and contractor personnel who have a 
need for the information in the performance of their official duties 
will be permitted access to the information. We will safeguard the 
security of the information by requiring the use of access codes to 
enter the computer system that will maintain the data and will store 
computerized records in secured areas that are accessible only to 
employees who require the information to perform their official duties. 
Any paper maintained records will be kept in locked cabinets or in 
otherwise secure areas. Furthermore, SSA employees having access to SSA 
databases maintaining personal information must sign a sanction 
document annually, acknowledging their accountability for making 
unauthorized access to or disclosure of such information.
    Contractor personnel having access to data in the proposed system 
of records will be required to adhere to SSA rules concerning 
safeguards, access and use of the data.
    SSA and contractor personnel having access to the data in this 
system will be informed of the criminal penalties of the Privacy Act 
for unauthorized access to or disclosure of information maintained in 
this system. See 5 U.S.C. 552a(i)(1).

IV. Effect of the Proposed New System of Records entitled the IPP 
System

    The proposed new system of records will maintain only that 
information which is necessary to safeguard the anonymity of employees 
requesting participation in the IPP so that these individuals can 
perform the functions of their employment positions without fear for 
their physical safety or other harm. Security measures will be employed 
that protect access to and preclude unauthorized disclosure of records 
in this system of records. Additionally, SSA will adhere to all 
applicable provisions of the Privacy Act, Social Security Act and other 
Federal statutes that govern our use and disclosure of the information. 
Thus, we do not anticipate that the proposed system of records will 
have an unwarranted effect on the privacy of the individuals that will 
be covered by the IPP System.

    Dated: March 17, 2008.
Michael J. Astrue,
Commissioner.
    SYSTEM NUMBER: 60-0360

System name:
    Identity Protection Program (IPP) System.

System classification:
    None.

System location:
    Social Security Administration, Office of Human Resources, 6401 
Security Boulevard, Baltimore, Maryland 21235.

Categories of individuals covered by the system:
    SSA Employees who have requested participation in the IPP.

Categories of records in the system:
    This system consists of a variety of records concerning 
participation in the IPP. In addition to the employee's name, this 
system includes information such as the employee's personal 
identification number (PIN), locator information, telephone number, 
component, documentation submitted to support the reason for the 
request for program participation, as well as any subsequent 
documentation provided by the employee; employee's written request to 
be removed from the IPP; the number of IPP requests that have been 
granted or denied by employee; the number of IPP requests that have 
been granted or denied by Agency component; reason for program 
participation request denial; and length

[[Page 15831]]

of time taken to process each request for program participation.

Authority for maintenance of the system:
    Sections 205 and 702(a)(5) of the Social Security Act (42 U.S.C. 
405, 902(a)(5)).

Purpose(s):
    Information in the IPP System is used to:
     Provide a means of collecting information about SSA 
employees who reasonably believe that they may be at risk of injury or 
other harm by the disclosure of their work location and telephone 
number.
     Provide a standard approach to ensuring the safety of SSA 
employees who reasonably believe that they may be at risk of injury or 
other harm by the disclosure of their work location and telephone 
number.
    The information in this system will be used to establish 
participation in the IPP. We will establish program participation when 
an employee has made known his/her request for program participation 
and all of the required documentation has been submitted.

Routine uses of records maintained in the system, including categories 
of users and the purpose of such uses:
    Disclosures may be made for routine uses as indicated below.
    (1) To the Office of the President for the purpose of responding to 
an individual pursuant to an inquiry received from that individual or 
from a third party on his or her behalf.
    (2) To a congressional office in response to an inquiry from that 
office made at the request of the subject of a record.
    (3) To the Department of Justice (DOJ), a court or other tribunal, 
or another party before such tribunal when:
    (a) SSA, or any component thereof; or
    (b) Any SSA employee in his/her official capacity; or
    (c) Any SSA employee in his/her individual capacity where DOJ (or 
SSA where it is authorized to do so) has agreed to represent the 
employee; or
    (d) The United States or any agency thereof where SSA determines 
that the litigation is likely to affect the operations of SSA or any of 
its components, is a party to the litigation or has an interest in such 
litigation, and SSA determines that the use of such records by DOJ, a 
court or other tribunal, or another party before such tribunal is 
relevant and necessary to the litigation, provided, however, that in 
each case, SSA determines that such disclosure is compatible with the 
purpose for which the records were collected.
    (4) To the Equal Employment Opportunity Commission (EEOC or 
Commission) when requested in connection with investigations into 
alleged or possible discriminatory practices in the Federal sector, 
examination of Federal affirmative employment programs, compliance by 
Federal agencies with the Uniform Guidelines on Employee Selection 
Procedures, or other functions vested in the Commission.
    (5) To the Federal Labor Relations Authority, the General Counsel, 
the Federal Mediation and Conciliation Service, the Federal Service 
Impasses Panel, or an arbitrator when information is requested in 
connection with the investigations of allegations of unfair labor 
practices, matters before an arbitrator or the Federal Impasses Panel.
    (6) To the Office of Personnel Management, Merit Systems Protection 
Board, or the Office of the Special Counsel, in connection with 
appeals, special studies of the civil service and other merit systems, 
review of those agencies' rules and regulations, investigation of 
alleged or possible prohibited personnel practices, and other such 
functions promulgated in 5 U.S.C. Chapter 12, or as may be authorized 
by law.
    (7) To contractors and other Federal agencies, as necessary, for 
the purpose of assisting SSA in the efficient administration of its 
programs. We contemplate disclosing information under this routine use 
only in situations in which SSA may enter into a contractual or similar 
agreement with a third party to assist in accomplishing an Agency 
function relating to this system of records.
    (8) To student volunteers, individuals who work under a personal 
services contract, and other individuals performing functions for SSA, 
who technically do not have the status of Agency employees, when they 
are performing work for SSA, as authorized by law, and they need access 
to the records in order to perform their assigned Agency functions.
    (9) To the General Services Administration (GSA) and National 
Archives and Records Administration (NARA) under 44 U.S.C. Sec.  2904 
and Sec.  2906, as amended by the NARA Act of 1984, non-tax return 
information which is not restricted from disclosure by Federal law for 
use by those agencies in conducting records management studies.
    (10) To Federal, State, and local law enforcement agencies and 
private security contractors, as appropriate, information necessary:
     To enable them to protect the safety of SSA employees and 
customers, the security of the SSA workplace, the operation of SSA 
facilities, or
     To assist investigations or prosecutions with respect to 
activities that affect such safety and security or activities that 
disrupts the operation of SSA facilities.
    (11) To appropriate Federal, State, and local agencies, entities, 
and persons when (1) we suspect or confirm that the security or 
confidentiality of information in this system of records has been 
compromised; (2) we determine that as a result of the suspected or 
confirmed compromise there is a risk of harm to economic or property 
interests, identity theft or fraud, or harm to the security or 
integrity of this system or other systems or programs of SSA that rely 
upon the compromised information; and (3) we determine that disclosing 
the information to such agencies, entities, and persons is necessary to 
assist in our efforts to respond to the suspected or confirmed 
compromise and prevent, minimize, or remedy such harm. SSA will use 
this routine use to respond only to those incidents involving an 
unintentional release of its records.

Policies and practices for storing, retrieving, accessing, retaining 
and disposing of records in the system:
Storage:
    Records in this system are maintained and stored in both electronic 
and paper form.

Retrievability:
    Records in this system will be retrieved by the employee's PIN and/
or name.

Safeguards:
    Security measures include the use of access codes to enter the 
computer system which will maintain the data, the storage of 
computerized records in secured areas that are accessible only to 
employees who require the information in performing their official 
duties. Manually maintained records will be kept in locked cabinets or 
in otherwise secure areas. SSA employees who have access to the data 
will be informed of the criminal penalties of the Privacy Act for 
unauthorized access to or disclosure of information maintained in the 
system. See 5 U.S.C. 552a(i)(1).
    Contractor personnel and/or alternate employees having access to 
data in the system of records will be required to adhere to SSA rules 
concerning safeguards, access and use of the data.

[[Page 15832]]

Retention and disposal:
    The records are maintained in SSA headquarters Office of Human 
Resources or regional Servicing Personnel Offices. They are disposed of 
in accordance with item 17a of the National Archives and Records 
Administration General Records Schedule 1.

System manager(s):
    Associate Commissioner, Office of Personnel, Social Security 
Administration, 6401 Security Boulevard, Baltimore, Maryland 21235-
6401.

Notification procedure(s):
    An individual can determine if this system contains a record about 
him/her by writing to the system manager at the above address and 
providing his/her name, SSN or other information that may be in the 
system of records that will identify him/her. An individual requesting 
notification of records in person should provide the same information, 
as well as provide an identity document, preferably with a photograph, 
such as a driver's license. If an individual does not have any 
identification documents sufficient to establish his/her identity, the 
individual must certify in writing that he/she is the person claimed to 
be and that he/she understands that knowing and willful request for, or 
acquisition of, a record pertaining to another individual under false 
pretenses is a criminal offense.
    If notification is requested by telephone, an individual must 
verify his/her identity by providing identifying information that 
parallels the record to which notification is being requested. 
Individuals providing insufficient identifying information by telephone 
will be required to submit a request in writing or in person. If an 
individual is requesting information by telephone on behalf of another 
individual, the subject individual must be connected with SSA and the 
requesting individual in the same phone call. SSA will establish the 
subject individual's identity (his/her name, PIN, address, date of 
birth and place of birth along with one other piece of information such 
as mother's maiden name) and ask for his/her consent in providing 
information to the requesting individual.
    If a request for notification is submitted by mail, an individual 
must include a notarized statement to SSA to verify his/her identity or 
must certify in the request that he/she is the person claimed to be and 
that he/she understands that knowing and willful request for, or 
acquisition of, a record pertaining to another individual under false 
pretenses is a criminal offense. These procedures are in accordance 
with SSA Regulations (20 CFR 401.45).

Record access procedure(s):
    Same as Notification procedure(s). Requesters also should 
reasonably specify the record contents they are seeking. These 
procedures are in accordance with SSA Regulations (20 CFR 401.40).

Contesting record procedure(s):
    Same as Notification procedure(s). Requesters should also 
reasonably identify the record, specify the information they are 
contesting, and state the corrective action sought and the reasons for 
the correction, with supporting justification, showing how the record 
is untimely, incomplete, inaccurate, or irrelevant. These procedures 
are in accordance with SSA Regulations (20 CFR 401.65).

Record source categories:
    Information in this system is obtained from information collected 
from SSA employees and officials.

Systems exempt from certain provisions of the Privacy Act:
    None.

[FR Doc. E8-6066 Filed 3-24-08; 8:45 am]
BILLING CODE 4191-02-P