Federal Acquisition Regulation; Privacy Training, 2010-013, 63896-63899 [2011-26546]

Agencies

• General Services Administration
• National Aeronautics and Space Administration
• DEPARTMENT OF DEFENSE

[Federal Register Volume 76, Number 199 (Friday, October 14, 2011)]
[Proposed Rules]
[Pages 63896-63899]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2011-26546]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF DEFENSE

GENERAL SERVICES ADMINISTRATION

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

48 CFR Parts 24 and 52

[FAR Case 2010-013; Docket 2010-0013; Sequence 1]
RIN 9000-AM02


Federal Acquisition Regulation; Privacy Training, 2010-013

AGENCY: Department of Defense (DoD), General Services Administration 
(GSA), and National Aeronautics and Space Administration (NASA).

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: DoD, GSA, and NASA are proposing to amend the Federal 
Acquisition Regulation (FAR) to require contractors to complete 
training that addresses the protection of privacy, in accordance with 
the Privacy Act of 1974, and the handling and safeguarding of 
personally identifiable information.

DATES: Interested parties should submit written comments to the 
Regulatory Secretariat at one of the addresses shown below on or before 
December 13, 2011 to be considered in the formation of the final rule.

ADDRESSES: Submit comments in response to FAR case 2010-013 by any of 
the following methods:
     Regulations.gov: https://www.regulations.gov. Submit 
comments via the Federal eRulemaking portal by inputting ``FAR Case 
2010-013'' under

[[Page 63897]]

the heading ``Enter Keyword or ID'' and selecting ``Search.'' Select 
the link ``Submit a Comment'' that corresponds with ``FAR Case 2010-
013.'' Follow the instructions provided at the ``Submit a Comment'' 
screen. Please include your name, company name (if any), and ``FAR Case 
2010-013'' on your attached document.
     Fax: (202) 501-4067.
     Mail: General Services Administration, Regulatory 
Secretariat (MVCB), ATTN: Hada Flowers, 1275 First Street, NE., 7th 
Floor, Washington, DC 20417.
    Instructions: Please submit comments only and cite FAR Case 2010-
013, in all correspondence related to this case. All comments received 
will be posted without change to https://www.regulations.gov, including 
any personal and/or business confidential information provided.

FOR FURTHER INFORMATION CONTACT: Mr. Karlos Morgan, Procurement 
Analyst, at (202) 501-2364 for clarification of content. For 
information pertaining to status or publication schedules, contact the 
Regulatory Secretariat at (202) 501-4755. Please cite FAR Case 2010-
013.

SUPPLEMENTARY INFORMATION:

I. Background

    DoD, GSA, and NASA are proposing to amend the Federal Acquisition 
Regulation (FAR) to add a new subpart 24.3, entitled ``Privacy 
Training,'' and related clause to ensure that contractors identify 
employees who require access to a Government system of records, handle 
personally identifiable information, or design, develop, maintain, or 
operate a system of records on behalf of the Federal Government, and 
who, therefore, are required to complete privacy training initially 
upon award of the procurement and at least annually thereafter. In 
addition, contractors are required to keep records indicating that 
employees have completed the required training and, upon request, 
provide those records to the Government. This rule does not apply to 
commercial items.
    These requirements are consistent with subsection (e), Agency 
requirements, and subsection (m), Government contractors, of the 
Privacy Act of 1974, 5 U.S.C. 552a. Other applicable authorities that 
address the responsibility for Federal agencies to ensure that 
Government and contractor personnel are instructed on compliance 
requirements with the laws, rules, and guidance pertaining to handling 
and safeguarding personally identifiable information include the E-
Government Act of 2002, the Federal Information Security Management Act 
(FISMA) of 2002, and Federal guidance from the Office of Management and 
Budget (OMB), e.g., OMB Memorandum M-07-16, entitled ``Safeguarding 
Against and Responding to the Breach of Personally Identifiable 
Information,'' issued May 22, 2007; OMB Memorandum M-10-23, entitled 
``Guidance for Agency Use of Third-Party Web sites and Applications,'' 
issued June 25, 2010 (this memorandum contains the most current 
definition of personally identifiable information, and clarifies the 
definition provided in M-07-16); and OMB Circular No. A-130, entitled 
``Management of Federal Information Resources,'' which address 
significant requirements for safeguarding and handling personally 
identifiable information and reporting any theft, loss, or compromise 
of such information. In addition, FAR subpart 24.1 requires that 
Federal agencies contracting for the design, development, or operation 
of a system of records on individuals must extend all Privacy Act 
safeguards to the contractor and its employees working on the contract.
    Minimum requirements for privacy training are proposed for the 
coverage in order to ensure consistency across the Government. For 
example, any privacy training must address the protection of privacy, 
in accordance with the Privacy Act (5 U.S.C. 552a), and the handling 
and safeguarding of personally identifiable information. The proposed 
FAR text includes seven mandatory elements of the privacy training, 
including any agency-specific requirements. Many agencies currently 
require that designated contractor employees complete agency-developed 
privacy training, but, in some circumstances, an agency may provide a 
contractor with the Privacy Act requirements and have the contractor 
develop the training package. While the use of an agency-developed 
privacy training package is the most common approach, and the approach 
embodied in the clause at FAR 52.224-XX, Privacy Training, the proposed 
FAR language provides an Alternate I to the FAR clause for those cases 
where the agency prefers to have the contractor create the privacy 
training package. Additionally, the proposed FAR language provides an 
Alternate II to the FAR clause for those instances when it's determined 
to be in the best interest of the Government for a contractor employee 
to attend agency-provided privacy training.
    Under the proposed FAR rule, a contractor employee who requires 
access to a Government system of records will be granted or allowed to 
retain such access only if the individual has (1) Completed privacy 
training and (2) met all other applicable agency requirements.

II. Executive Orders 12866 and 13563

    Executive Orders (E.O.s) 12866 and 13563 direct agencies to assess 
all costs and benefits of available regulatory alternatives and, if 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, distributive impacts, and equity). E.O. 
13563 emphasizes the importance of quantifying both costs and benefits, 
of reducing costs, of harmonizing rules, and of promoting flexibility. 
This is a significant regulatory action and, therefore, was subject to 
review under Section 6(b) of E.O. 12866, Regulatory Planning and 
Review, dated September 30, 1993. This rule is not a major rule under 5 
U.S.C. 804.

III. Regulatory Flexibility Act

    The change may have a significant economic impact on a substantial 
number of small entities within the meaning of the Regulatory 
Flexibility Act 5 U.S.C. 601, et seq. The Initial Regulatory 
Flexibility Analysis (IRFA) is summarized as follows:

    This proposed rule was initiated to ensure that contractor 
personnel who handle personally identifiable information; design, 
develop, maintain, or operate a system of records on behalf of the 
Government; or require access to a Government-owned system of 
records are properly trained on the requirements of applicable laws 
and appropriate safeguards to ensure the security and 
confidentiality of personally identifiable information.
    Such training of contractor employees is required by provisions 
of the Privacy Act (5 U.S.C. 552a), Title III of the E-Government 
Act of 2002, the Office of Management and Budget (OMB) Memorandum M-
07-16, and existing Privacy Act clauses (52.224-1 and 52.224-2). 
Various other statutes, applicable authorities, and memoranda 
address the responsibility of Federal agencies to ensure that 
Government and contractor personnel are instructed on compliance 
requirements pertaining to the handling and safeguarding of 
personally identifiable information. The list includes, but is not 
limited to the following:
     The Federal Information Security Management Act (FISMA) 
of 2002 (44 U.S.C. 3541);
     OMB Memorandum M-06-15, Safeguarding Personally 
Identifiable Information; and
     OMB Circular No. A-130, Management of Federal 
Information Resources.
    The proposed rule requires all contractors with contracts that 
require employees to have access to personally identifiable 
information to complete training that addresses the

[[Page 63898]]

statutory requirements for protection of privacy, in accordance with 
the Privacy Act (5 U.S.C. 552a), and the handling and safeguarding 
of personally identifiable information. This rule requires the 
contractor to identify its employees who require access, ensure that 
those employees complete agency-provided privacy training before 
being granted access and annually thereafter, and maintain records 
of the training. In a few cases, the content of the training will 
not be provided by the agency but will be created by the contractor 
in accordance with Alternate I to the clause at FAR 52.224-XX. 
Alternate II to the clause at FAR 52.224-XX if it is determined to 
be in the best interest of the Government for a contractor employee 
to attend agency-provided privacy training. This rule does not apply 
to commercial items.
    Information obtained from the Federal Procurement Data System 
for Fiscal Year 2009 demonstrates that 98,864 small business 
concerns were awarded contracts and 197,728 firms were awarded 
subcontracts. However, only contracts for the types of work 
identified in the paragraphs above will be subject to the privacy-
training requirement. We estimated that approximately one-half of 
one percent of all small business Government prime contractors and 
subcontractors will be required to conduct privacy training as 
follows:

Small business prime contractors...........................       98,864
Small business subcontractors..............................    + 197,728
                                                            ------------
    Total small businesses.................................      296,592
Percent w/privacy-training requirement.....................      x 0.005
                                                            ------------
Number of small businesses impacted........................        1,483
 

    Recordkeeping associated with this proposed rule is minimal; 
there are no required formats or templates for the records, and they 
will be retained by the contractor in most cases. The Government 
only will request a contractor's training records on an exception 
basis, i.e., if the Government has a particular reason to check on a 
contractor's compliance with the training requirement.

    The Regulatory Secretariat will be submitting a copy of the Interim 
Regulatory Flexibility Analysis (IRFA) to the Chief Counsel for 
Advocacy of the Small Business Administration. A copy of the IRFA may 
be obtained from the Regulatory Secretariat. DoD, GSA and NASA invite 
comments from small business concerns and other interested parties on 
the expected impact of this rule on small entities.
    DoD, GSA, and NASA will also consider comments from small entities 
concerning the existing regulations in subparts affected by this rule 
in accordance with 5 U.S.C. 610. Interested parties must submit such 
comments separately and should cite 5 U.S.C. 610 (FAR Case 2010-013) in 
correspondence.

IV. Paperwork Reduction Act

    The Paperwork Reduction Act (44 U.S.C. chapter 35) applies. The 
proposed rule contains information collection requirements. 
Accordingly, the Regulatory Secretariat has submitted a request for 
approval of a new information collection requirement concerning 
``Privacy Training'' to the Office of Management and Budget.
    A. Public reporting burden for this collection of information is 
estimated to average one hour per response, including the time for 
reviewing instructions, searching existing data sources, gathering and 
maintaining the data needed, and completing and reviewing the 
collection of information. The recordkeeping requirements are minor, 
and records generally will be retained within the contractor's 
organization. While a contractor is required to identify its employees 
who require initial privacy training and annual privacy training 
thereafter, there is no requirement to collect this information in a 
particular format or provide it to the Government, other than on an 
exception basis, i.e., when there is an indication that the contractor 
is not complying with the training requirements.
    The annual reporting burden is estimated as follows:

Respondents................................................          148
Responses per respondent...................................            1
                                                            ------------
    Total annual responses.................................          148
Preparation hours per response.............................            1
                                                            ------------
    Total response burden hours............................          148
 
 

    :B. Request for Comments Regarding Paperwork Burden.
    Submit comments, including suggestions for reducing this burden, 
not later than December 13, 2011 to: FAR Desk Officer, OMB, Room 10102, 
NEOB, Washington, DC 20503, and a copy to the General Services 
Administration, Regulatory Secretariat (MVCB), ATTN: Hada Flowers, 1275 
First Street, NE., 7th Floor, Washington, DC 20417.
    Public comments are particularly invited on: whether this 
collection of information is necessary for the proper performance of 
functions of the FAR, and will have practical utility; whether our 
estimate of the public burden of this collection of information is 
accurate, and based on valid assumptions and methodology; ways to 
enhance the quality, utility, and clarity of the information to be 
collected; and ways in which we can minimize the burden of the 
collection of information on those who are to respond, through the use 
of appropriate technological collection techniques or other forms of 
information technology.
    Requester may obtain a copy of the supporting statement from the 
General Services Administration, Regulatory Secretariat (MVCB), Attn: 
Hada Flowers, 1275 First Street, NE., 7th Floor, Washington, DC 20417. 
Please cite OMB Control Number 9000-0182, FAR Case 2010-013, Privacy 
Training, in correspondence.

List of Subjects in 48 CFR Parts 24 and 52

    Government procurement.

    Dated: October 6, 2011.
Laura Auletta,
Acting Director, Office of Governmentwide Acquisition Policy, Office of 
Acquisition Policy.

    Therefore, DoD, GSA, and NASA propose amending 48 CFR parts 24 and 
52 as set forth below:
    1. The authority citation for 48 CFR parts 24 and 52 continues to 
read as follows:

    Authority:  40 U.S.C. 121(c); 10 U.S.C. chapter 137; and 42 
U.S.C. 2473(c).

PART 24--PROTECTION OF PRIVACY AND FREEDOM OF INFORMATION

    2. Add subpart 24.3 to read as follows:
Subpart 24.3--Privacy Training
Sec.
24.301 Privacy Training.
24.302 Contract clause.

Subpart 24.3--Privacy Training


Sec.  24.301   Privacy training.

    (a) Contractors are responsible for conducting initial privacy 
training, and annual privacy training thereafter, for employees who--
    (1) Require access to a Government system of records;
    (2) Handle personally identifiable information; or
    (3) Design, develop, maintain, or operate a system of records on 
behalf of the Federal Government (see subpart 24.1 and 39.105).
    (b) Agencies shall provide contractors with the privacy training 
materials (in a format deemed appropriate) necessary to satisfy the 
requirement described in paragraph (a) of this section unless, on an 
exception basis, the contracting officer authorizes a contractor to 
provide its own privacy training materials (see 24.302(b)).
    (c) Privacy training shall, at a minimum, address--
    (1) The protection of privacy, in accordance with the Privacy Act 
(5 U.S.C. 552a);

[[Page 63899]]

    (2) The handling and safeguarding of personally identifiable 
information;
    (3) The authorized and official use of a Government system of 
records;
    (4) Restrictions on the use of personally-owned equipment to 
process, access, or store personally identifiable information;
    (5) The prohibition against access by unauthorized users, and 
unauthorized use by authorized users, of personally identifiable 
information or systems of records on behalf of the Federal Government;
    (6) Breach notification procedures (i.e., procedures for notifying 
appropriate individuals when privacy information is lost, stolen, or 
compromised) to minimize risk and to ensure prompt and appropriate 
actions are taken should a breach occur; and
    (7) Any agency-specific privacy training requirements.
    (d) The contractor is responsible for ensuring that employees 
identified in paragraph (a) of this section complete the required 
training and maintain evidence of appropriate training completed. The 
contractor is required, upon request, to provide evidence of completion 
of privacy training for all applicable employees.
    (e) Each contractor employee who requires access to a Government 
system of records, handles personally identifiable information, or 
designs, develops, maintains, or operates a Government system of 
records, shall be granted or allowed to retain such access only if the 
individual--
    (1) Has completed agency-mandated privacy training that, at a 
minimum, addresses the elements in paragraph (c) of this section; and
    (2) Has met all other applicable agency requirements.


Sec.  24.302   Contract clause.

    (a) When contractor employees will have access to a Government 
system of records, handle personally identifiable information, or 
design, develop, maintain, or operate a system of records, the 
contracting officer shall insert the clause at FAR 52.224-XX, Privacy 
Training, in solicitations and contracts.
    (b) When the contracting officer elects to have the contractor 
provide its own privacy training materials, use Alternate I in lieu of 
paragraph (a) of the basic clause.
    (c) When an agency elects to provide privacy training to contractor 
employees, use Alternate II in lieu of paragraph (a) of the basic 
clause.

PART 52--SOLICITATION PROVISIONS AND CONTRACT CLAUSES

    3. Add section 52.224-XX to read as follows:


52.224-XX  Privacy Training.

    As prescribed in 24.302(a), insert the following clause:

Privacy Training (Date)

    (a) The Contractor shall conduct initial privacy training, and 
annual privacy training thereafter, using the Government-provided 
privacy training materials, for employees who--
    (1) Require access to a Government system of records;
    (2) Handle personally identifiable information; or
    (3) Design, develop, maintain, or operate a system of records on 
behalf of the Federal Government (see also FAR subpart 24.1 and 
39.105).
    (b) The Contractor shall ensure that its employees, as 
identified in paragraph (a) of this clause, complete the required 
training in a timely manner. In addition, the Contractor shall 
maintain privacy training records, and, upon request, shall provide 
to the Contracting Officer evidence of privacy training completed 
for applicable employees.
    (c) The Contractor shall not grant any employee access to a 
Government system of records or personally identifiable information 
until the employee has completed privacy training, as required by 
this clause, and has met all other applicable agency requirements.
    (d) The substance of this clause, including this paragraph (d), 
shall be included in all subcontracts under this contract, when 
subcontractor employees will (1) have access to a Government system 
of records, (2) handle personally identifiable information, or (3) 
design, develop, maintain, or operate a system of records on behalf 
of the Federal Government.
    (End of clause)
    Alternate I (Date). If the agency elects to have the Contractor 
provide its own privacy training materials, substitute the following 
paragraph (a) for paragraph (a) of the basic clause:
    (a)(1) The Contractor shall conduct initial privacy training, 
and annual privacy training thereafter, using its own privacy 
training materials, for employees who--
    (i) Require access to a Government system of records;
    (ii) Handle personally identifiable information; or
    (iii) Design, develop, maintain or operate a system of records 
on behalf of the Federal Government (see also FAR subpart 24.1 and 
39.105).
    (2) The privacy-training materials shall, at a minimum, 
address--
    (i) The protection of privacy, in accordance with the Privacy 
Act (5 U.S.C. 552a);
    (ii) The handling and safeguarding of personally identifiable 
information;
    (iii) The authorized and official use of a Government system of 
records;
    (iv) Restrictions on the use of personally-owned equipment to 
process, access, or store personally identifiable information;
    (v) The prohibition against access by unauthorized users, and 
unauthorized use by authorized users, of personally identifiable 
information or a system of records on behalf of the Federal 
Government;
    (vi) Breach notification procedures (i.e., procedures for 
notifying appropriate individuals when privacy information is lost, 
stolen, or compromised); and
    (vii) Any agency-specific privacy training requirements 
specified by the Contracting Officer.
    Alternate II (Date). If the agency elects to provide privacy 
training to contractor employees, substitute the following paragraph 
(a) for paragraph (a) of the basic clause:
    (a)(1) The Government shall provide initial privacy training, 
and annual privacy training thereafter, to contractor employees 
who--
    (i) Require access to a Government system of records;
    (ii) Handle personally identifiable information; or
    (iii) Design, develop, maintain, or operate a system of records 
on behalf of the Federal Government (see also subpart 24.1 and 
39.105).
    (2) The Government will conduct privacy training to Contractor 
employees in the same format given its own employees (e.g., lecture, 
computer-based training, Web-based training, video conferencing, 
etc.).

[FR Doc. 2011-26546 Filed 10-13-11; 8:45 am]
BILLING CODE 6820-EP-P