Privacy Act of 1974; System of Records Personnel Security Integrated Tracking System (PerSIST), 22094-22097 [2018-10103]

Agencies

• DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

[Federal Register Volume 83, Number 92 (Friday, May 11, 2018)]
[Notices]
[Pages 22094-22097]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2018-10103]


-----------------------------------------------------------------------

DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

[Docket No. FR-7009-N-05]


Privacy Act of 1974; System of Records Personnel Security 
Integrated Tracking System (PerSIST)

AGENCY: Office of Chief Human Capital Officer, HUD.

ACTION: Notice of a new system of records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the Privacy Act of 1974, The Department of 
Housing Urban and Development (HUD), Office of Chief Human Capital 
Officer (OCHCO) proposes to implement a new system of records titled 
Personnel Security Integrated Tracking System (PerSIST) in Fiscal Year 
2018. PerSIST will replace the Department's legacy system, Personnel 
Security Files (PSF) henceforth, PSF will be decommissioned in Fiscal 
Year 2019. PerSIST is an enterprise personnel security case management 
system that automates activities associated with the tracking of 
personnel security investigations for HUD. PerSIST enables HUD's 
Personnel Security Division (PSD) staff to store and manage HUD 
personnel security information, manage the integrated workflow 
processes, manage activities, manage caseloads, and reporting 
capabilities relative to personnel security investigations. Records in 
the system are used to document and support decisions regarding the 
suitability, eligibility, and fitness of applicants for federal and 
contract employment to include: Students, interns, or volunteers to the 
extent that their duties require access to federal facilities, 
information, systems, or applications. Additionally, records may be 
used to document security violations, and supervisory actions taken. 
Information contained in PerSIST includes but is not limited to: 
Employment records, education history, credit history, subjects' 
previous addresses, names of friends, neighbors, and associates, 
selective service records, military history, citizenship, pre-
employment waivers, Background Investigations (BI's), security 
clearances, Sensitive Compartmented Information (SCI) access, clearance 
receipts (reciprocity), reinvestigations, completion dates of various 
security checks, and adjudication status/notes and decisions.

DATES: Applicable Date: This notice will become effective June 11, 
2018.

ADDRESSES: You may submit comments, identified by docket number by one 
of the following methods: Interested persons are invited to submit 
comments regarding this notice to the Rules Docket Clerk, Office of 
General Counsel, Department of Housing and Urban Development, 451 
Seventh Street SW, Room 10276, Washington, DC 20410. Comments may be 
filed electronically by accessing: www.regulations.gov. Regulations.gov 
provides clear instructions on how to submit a public comment on a 
rule. Communications should refer to the above docket number and title. 
Faxed comments are not accepted. A copy of each communication submitted 
will be available for public inspection and copying between 8 a.m. and 
5 p.m. weekdays at the above address.
    Federal e-Rulemaking Portal: https://www.regulations.gov. Follow the 
instructions provided on that site to submit comments electronically.
    Fax: 202-619-8365.
    Email: [email protected].
    Mail: Attention: Privacy Office; [John Bravacos]; The Executive 
Secretariat; 451 Seventh Street SW, Room 10139; Washington, DC 20410.
    Instructions: All submissions received must include the agency name 
and docket number for this rulemaking. All comments received will be 
posted without change to https://www.regulations.gov. including any 
personal information provided.
    Docket: For access to the docket to read background documents or 
comments received go to https://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT: John Bravacos, Senior Agency Official 
for Privacy, at 451 7th Street SW, Room 10139; U.S. Department of 
Housing and Urban Development; Washington, DC 20410-0001; telephone 
number 202-708-3054 (this is not a toll-free number). Individuals who 
are hearing- or speech-impaired may access this telephone number via 
TTY by calling the Federal Relay Service at 800-877-8339 (this is a 
toll-free number).

SUPPLEMENTARY INFORMATION: HUD is decommissioning its' legacy system of 
records titled Personnel Security Files (PSF) and replacing it with the 
Personnel Security Integrated Tracking System (PerSIST). PSF is an 
access based system that HUD has been utilizing since 2006. It requires 
manual processing and offers limited capabilities for data collection, 
file storage, file tracking, and file retrievals. The PSF system also 
lacks many capabilities needed to support HUD background security 
investigations such as multi-user access, workflow definition, workflow 
tracking, and the ability to interface with interagency systems such as 
the Office of Personnel Management Electronic Questionnaires for 
Investigations Processing (e-QIP) and Personnel Investigations 
Processing System (PIPS).
    PII collected in PerSIST will remain consistent with data 
categories collected in PSF however, PerSIST reduces errors associated 
with manual entries, streamlines front-end/back-end data collection, 
offers the advance capabilities, takes advantage of the latest tools 
and technologies, and supports data exchange with both internal and 
external agency systems. PerSIST will allow HUD to realize process 
improvements, efficiencies and acquire the ability to capture data 
related to all aspects of pre-appointments, suitability determinations, 
and security clearance processing.
    Additionally, PerSIST has the ability to leverage and share 
information with existing HUD systems and directly support these 
functions.
SYSTEM NAME AND NUMBER
    Personnel Security Integrated System for Tracking (PerSIST); P315.

SECURITY CLASSIFICATION:
    This system will not house any classified information.

SYSTEM LOCATION:
    The PerSIST system is located at: The Department of Housing and 
Urban

[[Page 22095]]

Development Headquarters, 451 Seventh Street SW, Room 2135, Washington, 
DC 20410.
    Cloud Data Center location(s):
    Production Hosting Data Center is located at 44470 Chilum Pl., 
Ashburn, VA 20147.
    Backup Data Center is located at 180 Peachtree St. NW, Atlanta, GA 
30303.

SYSTEM MANAGER(S):
    Felicia Purifoy, Director of Human Capital Services, 451 7th Street 
SW, Room 2272B; U.S. Department of Housing and Urban Development; 
Washington, DC 20410-0001, telephone number 202-402-2256.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Relative to the purpose of your investigation, the U.S. government 
is authorized to request this information under Executive Orders: 
10865, 12333, 12356, and 13764. Sections 3301 and 9101, of title 5, 
U.S. Code; section 2165 of title 42, U.S. Code; sections 781 to 887 of 
title 50, U.S. Code; parts 5, 732, and 736 of title 5, Code of Federal 
Regulations; and Homeland Security Presidential Directive (HSPD) 12, 
Policy for a Common Identification Standard for Federal Employees and 
Contractors, August 21, 2004. Forms: SF-85, SF-85P, SF-86, SF-87. 
Amending the civil service rules, Executive Order 13488, and Executive 
Order 13467 to Modernize the Executive Branch governance structure and 
processes for security clearances, suitability and fitness for 
employment, and credentialing and related matters.

PURPOSES OF THE SYSTEM:
    Records in the system are used to document and support decisions 
regarding the suitability, eligibility, and fitness for services of 
applicants for federal employment and contract positions to include 
students, interns, or volunteers to the extent that their duties 
require access to federal facilities, information, systems, or 
applications. Additionally, records may be used to document security 
violations, and supervisory actions taken.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    Data will be collected from HUD Employees, Applicants for new hire, 
Contractors, Students, Interns, or volunteers to the extent that their 
duties require access to federal facilities, information, systems, or 
applications.

CATEGORIES OF RECORDS IN THE SYSTEM:
    Data will be collected on all individuals who are being considered 
for employment i.e. employees, new hires, contractors, student interns, 
volunteers or access to HUD facilities, systems, or applications:
     Full Name,
     former names,
     date of birth,
     birth place,
     Social Security number,
     Home address,
     phone numbers,
     employment history,
     residential history,
     education and degrees earned,
     names of associates,
     references and their contact information,
     citizenship,
     names of relatives,
     birthdates and birth places of relatives,
     citizenship of relatives,
     Names of relatives who work for the Federal government,
     criminal history,
     mental health history,
     History of drug use,
     Financial information,
     fingerprints,
     summary report of investigation,
     results of suitability decisions,
     level of security clearance(s) held,
     date of issuance of security clearance,
     requests for appeal,
     witness statements,
     investigator's notes,
     Tax return information,
     credit reports,
     security violations,
     circumstances of violation, and agency action taken.

RECORD SOURCE CATEGORIES:
    1. OPM e-QIP-OMP will provide a conduit for applicants to collect a 
full disclosure of PII (reference list of PII collected under sec. 
Categories of Records in the System) through the Electronic 
Questionnaire for Investigations (e-QIP). e-QIP is an electronic form 
that is downloaded by the applicant/employee; the applicant/employee 
populates the form and the information is transferred to HUD via an 
encrypted file transfer, e-QIP records an applicant record in PerSIST 
system upon the applicants' completion. Government- created general 
service forms, and HUD forms.
    2. OF-306, Declaration for Federal Employment--This document 
collects Name, SSN, DOB, POB, Citizenship, Responses to Criminal, 
Financial, Employment, Military status.
    3. HUD Personal Identity Verification Sheet--This document collects 
Name, SSN, DOB, POB, Citizenship, Phone Number, Address, Email Address.
    4. Data Facts (Vendor)--HUD collects PII associated with 
applicants' credit history through third party vendor to include: Name, 
Aliases, SSN (partial), DOB (partial), credit history; and Credit 
history information collected from TransUnion, Equifax, and Experian.
    5. HUD Fair Credit Reporting Act--Collects applicant name, SSN, and 
signature for acknowledgement to collect Credit info. on this form.
    6. General Services Administration (GSA) USAccess Criminal History 
Results--Collects information on applicants' national criminal history.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND PURPOSES OF SUCH USES:
    In addition to those disclosures generally permitted under 5 U.S.C. 
552a(b) and to appropriate agencies, entities, and persons for 
disclosures compatible with the purpose for which the records in this 
system were collected as set forth by Appendix I--HUD's Routine Use 
Inventory Notice, 80 FR 81837 (December 31, 2015), all or a portion of 
the records or information contained in this system may be disclosed 
outside HUD as a routine use pursuant to 5 U.S.C. 552a(b)(3) as 
follows:
    1. To the National Archives and Records Administration, Office of 
Government Information Services (OGIS), to the extent necessary to 
fulfill its responsibilities in 5 U.S.C. 552(h), to review 
administrative agency policies, procedures and compliance with the 
Freedom of Information Act (FOIA), and to facilitate OGIS' offering of 
mediation services to resolve disputes between persons making FOIA 
requests and administrative agencies.
    2. To the Department of Justice when: (a) The agency or any 
component thereof; or (b) Any employee of the agency in his or her 
official capacity; (c) Any employee of the agency in his or her 
individual capacity where agency or the Department of Justice has 
agreed to represent the employee; or (d) The United States Government, 
is a party to litigation or has an interest in such litigation, and by 
careful review, the agency determines that the records are both 
relevant and necessary to the litigation and the use of such records by 
DOJ is therefore deemed by the agency to be for a purpose compatible 
with the purpose for which the agency collected the records.
    3. To the court or adjudicative body in proceedings when:
    (a) The agency or any component thereof; (b) Any employee of the 
agency in his or her official capacity; (c) Any employee of the agency 
in his or her individual capacity where agency or the Department of 
Justice has agreed to

[[Page 22096]]

represent the employee; or (d) The United States Government, is a party 
to litigation or has an interest in such litigation, and by careful 
review, the agency determines that the records are both relevant and 
necessary to the litigation and the use of such records is therefore 
deemed by the agency to be for a purpose that is compatible with the 
purpose for which the agency collected the records.
    4. Except as noted on Forms SF-85, 85-P, and 86, when a record on 
its face, or in conjunction with other records, made to the appropriate 
public authority, whether Federal, foreign, State, local, or tribal, or 
otherwise, enforcing or implementing the statute, or rule, regulation, 
or order issued pursuant thereto, if the information disclosed is 
relevant to any enforcement, regulatory, investigative or prosecutorial 
responsibility of the receiving entity.
    5. To a Member of Congress or to a Congressional staff member in 
response to an inquiry of the Congressional office made at the written 
request of the constituent about whom the record is maintained.
    6. To HUD contractors, grantees, or volunteers who have been 
engaged to assist the agency in the performance of a contract service, 
grant, cooperative agreement, or other activity related to this system 
of records and who need to have access to the records to perform their 
activity. Recipients shall be required to comply with the requirements 
of the Privacy Act of 1974, as amended, 5 U.S.C. 552a.
    7. To any source or potential source from which information is 
requested during an investigation concerning the retention of an 
employee or other personnel action (other than hiring), or the 
retention of a security clearance, contract, grant, license, or other 
benefit, to the extent necessary to identify the individual, inform the 
source of the nature and purpose of the investigation, and to identify 
the type of information requested.
    8. To a Federal, State, local, foreign, or tribal or other public 
authority the fact that this system of records contains information 
relevant to the retention of an employee, the retention of a security 
clearance, the letting of a contract, or the issuance or retention of a 
license, grant, or other benefit. The other agency or licensing 
organization may then make a request supported by the written consent 
of the individual for the entire record if it so chooses. No disclosure 
will be made unless the information has been determined to be 
sufficiently reliable to support a referral to another office within 
the agency or to another Federal agency for criminal, civil, 
administrative personnel or regulatory action.
    9. To the news media or the public, information the disclosure of 
which would be in the public interest and which would not constitute an 
unwarranted invasion of personal privacy, consistent with Freedom of 
Information Act standards.
    10. To a Federal, State, or local agency, or other appropriate 
entities or individuals, or through established liaison channels to 
selected foreign governments, in order to enable an intelligence agency 
to carry out its responsibilities under the National Security Act of 
1947 as amended, the CIA Act of 1949 as amended, Executive Order 12333 
or any successor order, applicable national security directives, or 
classified implementing procedures with 54836 Federal Register/Vol. 71, 
No. 181/Tuesday, September 19, 2006/Notices approved by the Attorney 
General and promulgated pursuant to such statutes, orders or 
directives.
    1. To appropriate agencies, entities, and persons when (1) HUD 
suspects or has confirmed that there has been a breach of the system of 
records, (2) HUD has determined that as a result of the suspected or 
confirmed breach there is a risk of harm to individuals, HUD (including 
its information systems, programs, and operations), the Federal 
Government, or national security; and (3) the disclosure made to such 
agencies, entities, and persons is reasonably necessary to assist in 
connection with HUD's efforts to respond to the suspected or confirmed 
breach or to prevent, minimize, or remedy such harm.
    2. To another Federal agency entity, when HUD determines that 
information from the system of records is reasonable necessary to 
assist the recipient agency or entity in (1) responding to a suspected 
or confirmed breach or (2) preventing, minimizing, or remedying the 
risk of harm to individuals, the recipient agency or entity (including 
its information systems, programs, and operations), the Federal 
Government, or national security, resulting from a suspected or 
confirmed breach.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Comprehensive electronic records are maintained by the Personnel 
Security Division and stored in the PerSIST electronic database. Access 
to the records is restricted to those with specific roles in the 
Personal Identity Verification (PIV) process. Retrieval of electronic 
records will require a system name or social security number query to 
produce records of an employee, contractor, student, intern, or 
volunteer.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    Prior to decommissioning, existing records maintained in PSF will 
undergo a data quality review and migration to PerSIST. HUD's standard 
protocol for transmitting secure data is via a secure File Transfer 
Protocol (FTP). The FTP is a method of transferring data files from one 
computer to another over a network.
    Comprehensive records are retained and disposed of in accordance 
with General Records Schedule 5.6 items: 180,181 under Disposition 
Authority DAA-GRS-2017-0006-0025, approved by the National Archives and 
Records Administration(NARA). Records regarding individuals with 
security clearances and other clearances for access to Government 
facilities or to sensitive data, created to support initial favorable 
eligibility determinations, periodic reinvestigations, or to implement 
a continuous evaluation program will be destroyed 5 years after the 
employee or contractor relationship ends, however longer retention is 
authorized if required for business use.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    For Paper Records: Comprehensive paper records are maintained and 
locked in metal file cabinets and stored in secured rooms within HUD 
Headquarters, Personnel Security Division.
    For Electronic Records: Comprehensive electronic records are 
maintained within the PerSIST system and stored on a cloud based 
software server and operating system that resides in a Federal Risk and 
Authorization Management Program (FedRAMP) and Federal Information 
Security Management Act (FISMA) Moderate dedicated hosting environment.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    For Paper Records: Comprehensive paper records are kept in locked 
metal file cabinets in locked rooms in HUD Headquarters, in the 
Personnel Security Division which is the office responsible for 
suitability determinations. Access to the records is limited to those 
employees who have a need for them in the performance of their official 
duties.
    For Electronic Records: Comprehensive electronic records are kept 
in the Personnel Security Division. Access to the records are 
restricted to those with specific roles in the Personal Identity 
Verification (PIV) process, requires access to background investigation 
forms to perform their

[[Page 22097]]

duties, and who have been given a password to access applicable file 
within the system including background investigation records. An 
electronic audit trail is maintained within system and reviewed 
periodically to identify and track authorized/unauthorized access. 
Persons given roles in the PIV process must complete training specific 
to their roles to ensure they are knowledgeable with regards to 
handling and safeguarding individually identifiable information.
    For Electronic Records (cloud based): Comprehensive electronic 
records are secured and maintained on a cloud based software server and 
operating system that resides in Federal Risk and Authorization 
Management Program (FedRAMP) and Federal Information Security 
Management Act (FISMA) Moderate dedicated hosting environment. All data 
located in the cloud based server is firewalled and encrypted at rest 
and in transit. The security mechanisms for handing data at rest and in 
transit are in accordance with HUD encryption standards.

RECORD ACCESS PROCEDURES:
    For information, assistance, or inquiry about records, contact John 
Bravacos, Senior Agency Official for Privacy, at 451 7th Street SW, 
Room 10139, U.S. Department of Housing and Urban Development, 
Washington, DC 20410-0001, telephone number 202-708-3054 (this is not a 
toll-free number). When seeking records about yourself from this system 
of records or any other Housing and Urban Development (HUD) system of 
records, your request must conform with the Privacy Act regulations set 
forth in 24 CFR part 16. You must first verify your identity, meaning 
that you must provide your full name, address, and date and place of 
birth. You must sign your request, and your signature must either be 
notarized or submitted under 28 U.S.C. 1746, a law that permits 
statements to be made, under penalty of perjury, as a substitute for 
notarization. In addition, your request should:
    a. Explain why you believe HUD would have information on you.
    b. Identify which Office of HUD you believe has the records about 
you.
    c. Specify when you believe the records would have been created.
    d. Provide any other information that will help the Freedom of 
Information Act (FOIA) staff determine which HUD office may have 
responsive records.
    If your request is seeking records pertaining to another living 
individual, you must include a statement from that individual 
certifying their agreement for you to access their records. Without the 
above information, the HUD FOIA Office may not conduct an effective 
search, and your request may be denied due to lack of specificity or 
lack of compliance with regulations.

CONTESTING RECORD PROCEDURES:
    The Department's rules for contesting contents of records and 
appealing initial denials appear in 24 CFR part 16, Procedures for 
Inquiries. Additional assistance may be obtained by contacting John 
Bravacos, Senior Agency Official for Privacy, at 451 7th Street SW, 
Room 10139; U.S. Department of Housing and Urban Development, 
Washington, DC 20410-0001, or the HUD Departmental Privacy Appeals 
Officers, Office of General Counsel, U.S. Department of Housing and 
Urban Development, 451 7th Street SW, Washington, DC 20410-0001.

NOTIFICATION PROCEDURES:
    Individuals seeking notification of and access to any record 
contained in this system of records, or seeking to contest its content, 
may submit a request in writing to the component's FOIA Officer, whose 
contact information can be found at https://www.hud.gov/foia under 
``contact.'' If an individual believes more than one component 
maintains Privacy Act records concerning him or her, the individual may 
submit the request to the Chief Privacy Officer, HUD, 451 Seventh 
Street SW, Room 10139, Washington, DC 20410.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    None.

HISTORY:
    The PerSIST system replaces the legacy Personnel Security Files 
2006.

    Dated: April 19, 2018.
John Bravacos,
Senior Agency Official for Privacy.
[FR Doc. 2018-10103 Filed 5-10-18; 8:45 am]
 BILLING CODE 4210-67-P