Privacy Act of 1974; Routine Use Implementation; System of Records

AGENCY:

U.S. Office of Personnel Management.

ACTION:

Notice; Routine Use Implementation and Response to Comments.

SUMMARY:

Pursuant to the provisions of the Privacy Act of 1974, 5 U.S.C. 552a, and Office of Management and Budget (OMB), Circular No. A-130, notice is given that the U.S. Office of Personnel Management is implementing the modification, proposed in 80 FR 42133, to all of its systems of records, as identified in the list below.

SUPPLEMENTARY INFORMATION:

On July 16, 2015, OPM published a notice to establish a new Privacy Act routine use which is applicable to all OPM systems of records. The new routine use allows OPM to disclose information to appropriate persons and entities for response and remediation purposes in the event of suspected or confirmed compromise of information in any of its systems. 80 FR 42133 (July 16, 2015). The July 16th notice invited comments on the new routine use until August 17, 2015. OPM received 5 comments during this period. After reviewing and considering the comments, OPM has decided to implement the new routine use without substantive alteration. A description of the comments and OPM's corresponding responses are included below.

Two Federal agencies requested administrative changes that were unrelated to the form or substance of this routine use. In response to one agency comment, OPM re-listed all of the OPM systems to which the new routine use will apply, including OPM/Central-19, which had been inadvertently left out of the prior notice. OPM determined that the other suggested changes do not affect implementation of the newly proposed use because they pertain specifically to other OPM systems of records. Therefore, those suggestions will be considered in future updates to notices regarding those systems.

OPM also received comments from a non-governmental organization regarding the location of certain records in other OPM systems and requesting notice in the event that those systems are compromised. OPM plans to continue fulfilling its breach notification responsibilities whenever appropriate and will respond separately to the organization with regard to its other comments, which seek OPM's response to a previous communication.

Finally, one individual and one Federal employee union sought information about security measures that would be taken to convey information shared outside of OPM pursuant to the new routine use. As with information shared outside the agency pursuant any routine use associated with its systems, OPM will transmit such information in accordance with applicable information security laws, guidelines, and standards including, but not limited to, the Federal Information Security Management Act (Pub. L. 107-296), and associated OMB policies, standards and guidance from the National Institute of Standards and Technology.

The individual commenter and employee union also questioned whether the routine use is appropriately tailored to address activities related to the suspected or confirmed compromise of information, OPM adopted the model language developed by the Office of Management and Budget (OMB Memorandum 07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, Attachment 2) and adopted by a number of other Federal agencies. As drafted, this routine use permits the agency to protect sensitive information contained in OPM's systems while also facilitating mitigation and prevention activities in the event of confirmed or suspected compromise of information. Therefore, OPM has adopted the new routine use, first published on July 16, 2015, without further change.

A description of the modification to the agency's systems of records is provided below. In accordance with 5 U.S.C. 552a(r), the agency has provided a report to OMB and the Congress.

U.S. Office of Personnel Management Privacy Act notices and citations follow. An asterisk (*) designates the last publication of the complete document in the Federal Register.

Routine Uses of Records Maintained in the System, Including Categories of Users and the Purposes of Such Uses:

To appropriate agencies, entities, and persons when (1) OPM suspects or has confirmed that the security or confidentiality of information in the system of records has been compromised; (2) the agency has determined that as a result of the suspected or confirmed compromise there is a risk of harm to economic or property interests, identity theft or fraud, or harm to the security or integrity of this system or other systems or programs (whether maintained by OPM or another agency or entity) that rely upon the compromised information; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with OPM's efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm.