Privacy Act of 1974; System of Records

AGENCY:

Office of Personnel Management.

ACTION:

Notice of modified systems of records.

SUMMARY:

In accordance with the Privacy Act of 1974, the Office of Personnel Management (OPM) is modifying the systems of records listed in this notice to incorporate two routine uses related to breach of personally identifiable information (PII) pursuant to the Office of Management and Budget's Memorandum 17-12. The first routine use deals with the breach of an agency's own records, and the second addresses the disclosure of agency records to assist other agencies in their efforts to respond to a breach of their own records. The new routine use that addresses breaches of an agency's own records replaces the one OPM previously published November 30, 2015 at 80 FR 74815.

DATES:

Please submit comments on or before March 4, 2022. These new routine uses are effective March 9, 2022.

ADDRESSES:

You may submit written comments by one of the following methods:

Federal Rulemaking Portal: http://www.regulations.gov

All submissions received must include the agency name and docket number for this Federal Register document. The general policy for comments and other submissions from members of the public is to make these submissions available for public viewing on the internet at http://www.regulations.gov,, as they are received, without change, including any personal identifiers or contact information. Email: privacy@opm.gov.

FOR FURTHER INFORMATION CONTACT:

Marc Flaster, Senior Advisor to the Chief Privacy Officer, 202-606-2115.

SUPPLEMENTARY INFORMATION:

On November 30, 2015, the Office of Personnel Management (OPM) published a routine use for all of its systems of records to permit disclosing information when necessary to respond to breaches of OPM's own records. Subsequently, on January 3, 2017, the Office of Management and Budget published Memorandum 17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, which established two model routine uses, one on disclosure of information related to breaches of an agency's own records, similar to what OPM published in 2015, and the second concerning the disclosure of agency records to assist other agencies in their efforts to respond to a breach. The latter would facilitate providing agencies with information to locate and contact individuals potentially affected by a breach, or provide information related to the agency's programs. OPM is now modifying all of the systems of records identified in this Notice to include the two routine uses set forth in OMB M 17-12 and rescinding the routine use published in 2015.

SYSTEM NAME AND NUMBER:

The systems of records to be modified by including the two new routine uses described in this Notice are set forth below. An asterisk (*) designates the last publication of the complete document in the Federal Register . Any history prior to the last publication in the Federal Register is omitted for clarity.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

The appropriate OPM program, as identified in each notice, governs each respective system of records.

SYSTEM MANAGERS:

The applicable program executive is identified in each notice.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act, all or a portion of the records or information contained in the systems identified above may be disclosed outside OPM as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:

• To appropriate agencies, entities and persons when (1) OPM suspects or has confirmed that there has been a breach of the system of records, (2) OPM has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, OPM (including its information systems, programs and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with OPM's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.
• To another Federal agency or Federal entity, when OPM determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

HISTORY:

See System Name and Number above.