Privacy Act of 1974; System of Records, 61618-61621 [2022-22103]

Agencies

• DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

[Federal Register Volume 87, Number 196 (Wednesday, October 12, 2022)]
[Notices]
[Pages 61618-61621]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-22103]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

[Docket No. FR-7062-N-18]


Privacy Act of 1974; System of Records

AGENCY: Office of the Assistant Secretary for Housing-Federal Housing 
Commissioner, HUD.

ACTION: Notice of a modified system of records.

-----------------------------------------------------------------------

SUMMARY: The Distributive Shares and Refund Subsystem (DSRS) serves as 
the Federal Housing Administration (FHA) repository for verifying 
mortgage insurance premium refunds and distributive share payments 
which are issued to eligible homeowners (mortgagors) who had an FHA 
mortgage insured loan. Pursuant to the provisions of the Privacy Act of 
1974, as amended, the Department of Housing and Urban Development (HUD) 
is issuing a public notice of its intent to modify a system of records 
entitled ``Distributive Shares and Refund Subsystem'' (DSRS). This 
system of records is being revised to make clarifying changes within: 
System Location, System Manager, Record Authority for Maintenance of 
the System, Purpose of the System, Categories of Individuals Covered by 
the System, Categories of Records in the System, Records Source 
Categories, Routine Uses of Records Maintained in the System, Retention 
and Disposal of Records. The SORN modifications are outlined in the 
SORN SUPPLEMENTARY INFORMATION section.

DATES: Comments will be accepted on or before November 14, 2022. The 
SORN becomes effective immediately, while the routine uses become 
effective after the comment period immediately upon publication except 
for the routine uses, which will become effective on the date following 
the end of the comment period unless comments are received which result 
in a contrary determination.

ADDRESSES: You may submit comments, identified by docket number by one 
method:
    Federal e-Rulemaking Portal: https://www.regulations.gov. Follow the 
instructions provided on that site to submit comments electronically.
    Fax: 202-619-8365.
    Email: [email protected].
    Mail: Attention: Privacy Office; LaDonne White, Chief Privacy 
Officer; The Executive Secretariat; 451 Seventh Street SW, Room 10139; 
Washington, DC 20410-0001.
    Instructions: All submissions received must include the agency name 
and

[[Page 61619]]

docket number for this rulemaking. All comments received will be posted 
without change to https://www.regulations.gov. including any personal 
information provided.
    Docket: For access to the docket to read background documents or 
comments received go to https://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT: LaDonne White; 451 Seventh Street SW, 
Room 10139; Washington, DC 20410-0001; telephone number 202-708-3054 
(this is not a toll-free number). Individuals who are hearing- or 
speech-impaired can dial 7-1-1 to access the Telecommunications Relay 
Service (TRS), which permits users to make text-based calls, including 
Text Telephone (TTY) and Speech to Speech (STS) calls. Individuals who 
require an alternative aid or service to communicate effectively with 
HUD should email the point of contact listed above and provide a brief 
description of their preferred method of communication.

SUPPLEMENTARY INFORMATION: HUD, Single Family Insurance Operations 
Division, maintains the DSRS system. HUD is publishing this revised 
notice to establish a new and modified routine use and to reflect 
updated information in the sections being revised. The modification of 
the system of records will have no undue impact on the privacy of the 
individuals covered and updates made are explained below.
    The following are updates since the previous SORN publication:
    Security Classification: Added systems of record classification 
status.
    System Location: Replaced former data center and HUD locations with 
new locations in Virginia, Mississippi, and Washington.
    System Manager: Identified new system manager expected to operate 
this system of records.
    Authority for Maintenance of the System: Updated with existing 
authorities that permit the maintenance of the systems records. 
Statutes and regulations are listed below.
    Categories of Individuals Covered by the System: Reorganized this 
section to group and clarify individuals according to their system 
coverage. Updated to reflect the inclusion of records previously 
covered as ``Third Party Representatives''.
    Categories of Records in the System: Updated this section to 
clarify the individuals whose personal identifiable information is 
collected and reflect the inclusion of new and previously covered 
records entitled ``Identification and Verification''.
    Records Source Categories: Updated to cover all record sources for 
internal and external systems to HUD.
    Routine Use of Records:
    Added General Service Administration for purpose of supporting 
agency dispute resolution.
    Updated routine uses for breach remediation efforts to extend 
agency data sharing when relevant for breach remediation efforts to 
appropriate agencies.
    Readded a routine use for disclosure to the general public which 
had previously been placed in the section immediately preceding the 
routine use section.
    Reorganized, incorporated, and updated routine uses previously 
applied through HUD's 2015 Routine Use Inventory publication as part of 
this system of records. See routine uses (C), (K), (L), and (M) for 
updates.
    Records Retention and Disposition: Updated this section to describe 
current retention and disposal requirements.
    Policy and Practice for Retrieval of Records: Updated to include 
minor changes and format.
    Records Access, Contesting, and Notification Procedures: Updated to 
include Federal requirements and HUD office to which the individuals' 
request should be directed.

SYSTEM NAME AND NUMBER:
    Distributive Shares and Refund Subsystem (DSRS) HUD/HOU-03.

SECURITY CLASSIFICATION:
    Unclassified.

SYSTEM LOCATION:
    National Center for Critical Information Processing and Storage, 
9325 Cypress Loop Road, Stennis Space Center, MS 39529-0001; 250 
Burlington Drive, Clarksville, VA 23927; and at the HUD Headquarter, 
451 Seventh Street SW, Room 3238, Washington, DC 20410.

SYSTEM MANAGER(S):
    Silas Vaughn, System Manager, Single Family Insurance Operations 
Division, HWAFS, Department of Housing and Urban Development, 451 
Seventh Street SW, Ninth floor, Washington, DC 20410-0001 telephone 
number, 202-708-2438.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Section 203(a) of the National Housing Act of 1934 (12 U.S.C. 
1709(a)); 24 CFR 203.35. Section 7(d) of the Department of Housing and 
Urban Development Act of 1965 (12 U.S.C. 3535(d)); 24 CFR 5.210; 24 CFR 
200.1101. The Housing Community Development Act of 1987, 42 U.S.C. 
3543(a). The Debt Collection Act of 1982, Public Law 97-365.

PURPOSES OF THE SYSTEM:
    DSRS maintains detailed records for single family non-claim 
terminated case activities to ensure that the proper homeowner 
associated with the FHA guaranteed loan is identified. Upon non-claim 
termination (i.e., prepayment, assignment, assumption, or refinance), 
the borrower may be eligible for a refund of any unearned upfront 
mortgage insurance premium (UFMIP) paid at closing or a distributive 
share payment. The ``Does HUD Owe You a Refund?'' website is used in 
conjunction with DSRS to allow homeowners who have had an FHA endorsed 
mortgage determine if they are eligible for an upfront mortgage 
insurance premium refund or distributive share payment. In addition, 
DSRS utilizes the Premium Refund Application Upload web page component 
to provide another option for homeowners to securely send the required 
documents to HUD to complete the homeowner refund process. SFIOD staff 
can request disbursement of refunds due, and DSRS will certify that the 
requests are valid.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    Homeowners (Mortgagors) who had Federal Housing Administration 
(FHA) mortgage insured loans and may be eligible for a mortgage 
insurance premium refund or distributive share payment; Third Party 
Representatives who are sources of mortgagor information.

CATEGORIES OF RECORDS IN THE SYSTEM:
    Full Name, Social Security Number (SSN), Date of Birth, Phone 
Number, Home Address, Email Address, Employer Identification Number, 
and User id, Related Premium Refund/Payment Correspondence (borrower 
name, address, email address, phone and fax number), Supporting 
Documentation (borrower identification and verification document 
copies): Birth, Death, Marriage, Religion, Naturalization, Citizenship 
Certificate, US Passport, Green Card, Change-of-Address, Drivers' 
license, Military, State, Federal ID, or similar identification, Bank, 
Mortgage, Credit Card, Tax, Utility, Doctor, Hospital Company Bill, 
Medicaid, Medicare Statement, Social Security Administration, Pension, 
Retirement Benefit Statement, Veteran Discharge or Separation Papers, 
Dependent, Medical, SSN Card, W-2, 1099, DD-214 form (for SSN 
verification purposes), Pay Statement, Vehicle, Voters Registration, 
Legal documents (mortgage, deed, will, loan, rental contracts, gender, 
name change) or similar document.

[[Page 61620]]

Information on Supporting documents may include State were issued, SSN, 
Birthdate, Gender, Sex, Affiliation, Marital, Financial, Retirement, 
Pay, Employment, Medical, Account Number, and Address information.

RECORD SOURCE CATEGORIES:
    Homeowners, third party businesses, and authorized representatives 
of the homeowners that complete the form application for premium 
refund. Internal and External data exchanges from the following 
systems:
    Housing Office of Finance and Budget: Single Family Insurance 
System (SFIS) A43, The ``Does HUD Owe You a Refund?'' website, and 
Premium Refund Application Upload webpage.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND PURPOSES OF SUCH USES:
    (A) To the National Archives and Records Administration, Office of 
Government Information Services (OGIS), to the extent necessary to 
fulfill its responsibilities in 5 U.S.C. 552(h), to review 
administrative agency policies, procedures, and compliance with the 
Freedom of Information Act (FOIA), and to facilitate OGIS's offering of 
mediation service to resolve disputes between persons making FOIA 
requests and administrative agencies.
    (B) To a congressional office from the record of an individual, in 
response to an inquiry from the congressional office made at the 
request of that individual.
    (C) To contractors, grantees, experts, consultants, Federal 
agencies, and non-Federal entities, including, but not limited to, 
State and local governments and other research institutions or their 
parties, and entities and their agents with whom HUD has a contract, 
service agreement, grant, cooperative agreement, or other agreement, 
for the purposes of statistical analysis and research in support of 
program operations, management, performance monitoring, evaluation, 
risk management, and policy development, or to otherwise support the 
Department's mission. Records under this routine use may not be used in 
whole or in part to make decisions that affect the rights, benefits, or 
privileges of specific individuals. The results of the matched 
information may not be disclosed in identifiable form.
    (D) To contractors, grantees, experts, consultants and their 
agents, or others performing or working under a contract, service, 
grant, or cooperative agreement with HUD, when necessary to accomplish 
an agency function related to a system of records. Disclosure 
requirements are limited to only those data elements considered 
relevant to accomplishing an agency function.
    (E) To authorized requesters or third-party tracers who request 
access to Upfront Mortgage Insurance Premiums homeowner refund and 
distributive share payment information, when such information is 
unavailable on HUD's FOIA reading room or Does HUD Owe You a Refund? 
websites. This information is releasable under FOIA. Third party 
release of this material may require authorized consent of the 
homeowner to whom the records belong and must adhere to all HUD 
procedures prior to release.
    (F) To the U.S. Department of the Treasury for collection and 
disbursement of check transactions.
    (G) To the general public when, after two-years of attempting to 
contact each unpaid mortgagor of their FHA insurance refund, the 
Department makes available a cumulative listing of any unpaid refund 
that remains unpaid. The information that will be disclosed includes 
eligible mortgagor(s) full name, last known address, refund amount, 
termination date, and FHA case number. This information is available to 
the public on HUD's refund database ``Does HUD Owe You A Refund?'' and 
``FOIA Mortgage Insurance State List Page.''
    (H) To the recorders' offices for recording legal documents and 
responses to offsets (i.e., child support) or other legal responses 
required during the servicing of the insured loan to allow HUD to 
release mortgage liens and respond to bankruptcies or deaths of 
mortgagors to protect the interest of the Secretary of HUD.
    (I) To appropriate federal, state, local, tribal, or foreign 
governmental agencies or multilateral governmental organizations, with 
the approval of the Chief Privacy Officer, when HUD is aware of a need 
to use relevant data for purposes of testing new technology.
    (J)(1) To another Federal agency or Federal entity when HUD 
determines that information from this system of records is reasonably 
necessary to assist the recipient agency or entity in (a) responding to 
a suspected or confirmed breach or (b) preventing, minimizing, or 
remedying the risk of harm to individuals, the recipient agency or 
entity (including its information systems, programs, and operations), 
the Federal Government, or national security, resulting from a 
suspected or confirmed breach.
    (K) To appropriate agencies, entities, and persons when (a) HUD 
suspects or has confirmed that there has been a breach of the system of 
records; (b) HUD has determined that as a result of the suspected or 
confirmed breach there is a risk of harm to individuals, HUD (including 
its information systems, programs, and operations), the Federal 
Government, or national security; and (c) the disclosure made to such 
agencies, entities, and persons is reasonably necessary to assist in 
connection with HUD's efforts to respond to the suspected or confirmed 
breach or to prevent, minimize, or remedy such harm.
    (L) To appropriate Federal, State, local, tribal, or governmental 
agencies or multilateral governmental organizations responsible for 
investigating or prosecuting the violations of, or for enforcing or 
implementing, a statute, rule, regulation, order, or license, where HUD 
determines that the information would assist in the enforcement of 
civil or criminal laws, when such records, either alone or in 
conjunction with other information, indicate a violation or potential 
violation of law.
    (M) To a court, magistrate, administrative tribunal, or arbitrator 
in the course of presenting evidence, including disclosures to opposing 
counsel or witnesses in the course of civil discovery, litigation, 
mediation, or settlement negotiations, or in connection with criminal 
law proceedings; when HUD determines that use of such records is 
relevant and necessary to the litigation and when any of the following 
is a party to the litigation or have an interest in such litigation: 
(1) HUD, or any component thereof; or (2) any HUD employee in his or 
her official capacity; or (3) any HUD employee in his or her individual 
capacity where HUD has agreed to represent the employee; or (4) the 
United States, or any agency thereof, where HUD determines that 
litigation is likely to affect HUD or any of its components.
    (N) To any component of the Department of Justice or other Federal 
agency conducting litigation or in proceedings before any court, 
adjudicative, or administrative body, when HUD determines that the use 
of such records is relevant and necessary to the litigation and when 
any of the following is a party to the litigation or have an interest 
in such litigation: (1) HUD, or any component thereof; or (2) any HUD 
employee in his or her official capacity; or (3) any HUD employee in 
his or her individual capacity where the Department of Justice or 
agency conducting the litigation has agreed to represent the employee; 
or (4) the United States, or any agency thereof, where HUD determines 
that litigation is likely to affect HUD or any of its components

[[Page 61621]]

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    Paper and electronic.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Records are retrieved by Name, SSN and Property Address.

POLICIES AND PRACTICIES FOR RETENTION AND DISPOSAL OF RECORDS:
    (1) Payments and Disbursements files. Temporary. Destroy 6 years 
after final payment or cancellations, but longer retention is 
authorized if required for business use.
    (2) System development/infrastructure project files. Temporary. 
Destroy 5 years after project is terminated, but longer retention is 
authorized if required for business use.
    (3) System general technology management records. Temporary. 
Destroy 5 years after system is superseded by a new iteration, or is 
terminated, defunded, or no longer needed for agency/IT administrative 
purposes, but longer retention is authorized if required for business 
use.
    (4) System technical documents. Temporary. Destroy 5 years after 
the project/activity/transaction is completed or superseded, or the 
associated system is terminated, or the associated data is migrated to 
a successor system, but longer retention is authorized if required for 
business use.
    (5) System access records. Temporary. Destroy 6 years after 
password is altered or user account is terminated, but longer retention 
is authorized if required for business use.
    (6) System backups and tape library records (Incremental backup 
files). Temporary. Destroy when second subsequent backup is verified as 
successful, or when no longer needed for system restoration, whichever 
is later.
    (7) System backups and tape (full backup files). Temporary. Destroy 
when subsequent backup is verified as successful or when no longer 
needed for system restoration, whichever is later.
    (8) System backup on master files. Temporary. Destroy when second 
subsequent backup is verified as successful or when no longer needed 
for system restoration, whichever is later.
    (9) Premium Refund Application website search files. Temporary. 
Destroy upon verification of successful creation of the final document 
or file, or when no longer needed for business use, whichever is later.
    (10) Premium Refund Application Upload page files. Temporary. 
Destroy upon verification of successful creation of the final document 
or file, or when no longer needed for business use, whichever is later.
    (11) System input/output files. Temporary. Destroy upon 
verification of successful creation of the final document or file, or 
when no longer needed for business use, whichever is later.
    (12) Paper Records and related technical documentation. Temporary. 
Destroy upon verification of successful creation of the final document 
or file, or when no longer needed for business use, whichever is later.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    Administrative Controls: Backups Secured Off-Site, Methods to 
Ensure Only Authorized Personnel Access to PII, Periodic Security 
Audits, and Regular Monitoring of User's Security Practices. Technical 
Controls: Encryption of Data at Rest, Firewall, Role-Based Access 
Controls, Virtual Private Network (VPN), Encryption of Data in Transit, 
Least Privilege Access, User Identification and Password, PIV Card, 
Intrusion Detection System (IDS).
    Physical Safeguards: Combination locks, Key Cards, Security Guards, 
Identification badges, and all paper records that contain PII and 
sensitive information are locked in file rooms.

RECORD ACCESS PROCEDURES:
    Individuals seeking notification of and access to their records in 
this system of records may submit a request in writing to the 
Department of Housing and Urban Development, Attn: FOIA Program Office, 
451 7th Street SW, Suite 10139, Washington, DC 20410-0001. or by 
emailing [email protected]. Individuals must furnish the following 
information for their records to be located:
    1. Full name.
    2. Signature.
    3. The reason why the individual believes this system contains 
information about him/her.
    4. The address to which the information should be sent.

CONTESTING RECORD PROCEDURES:
    Same as the Notification Procedures above.

NOTIFICATION PROCEDURES:
    Any person wanting to know whether this system of records contains 
information about him or her should contact the System Manager. Such 
person should provide his or her full name, position title and office 
location at the time the accommodation was requested, and a mailing 
address to which a response is to be sent.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    None.

HISTORY:
    DSRS SORN: 81 FR 22293 (April 15, 2016)
    DSRS SORN: 72 FR 40890 (July 25, 2007)

LaDonne White,
Chief Privacy Officer, Office of Administration.
[FR Doc. 2022-22103 Filed 10-11-22; 8:45 am]
BILLING CODE 4210-67-P