89 FR 91 pgs. 39624-39627 - Privacy Act of 1974; System of Records
Type: NOTICEVolume: 89Number: 91Pages: 39624 - 39627
Pages: 39624, 39625, 39626, 39627Docket number: [Notice-IEB-2024-04; Docket No. 2024-0002; Sequence No. 22]
FR document: [FR Doc. 2024-10147 Filed 5-8-24; 8:45 am]
Agency: General Services Administration
Official PDF Version: PDF Version
[top]
GENERAL SERVICES ADMINISTRATION
[Notice-IEB-2024-04; Docket No. 2024-0002; Sequence No. 22]
Privacy Act of 1974; System of Records
AGENCY:
General Services Administration
ACTION:
Notice of a modified system of records.
SUMMARY:
GSA proposes to modify a system of records subject to the Privacy Act of 1974, as amended. The previously published notice is being revised to add two new routine uses, make law enforcement records held within the system exempt from the access and amendment provisions of the Privacy Act, and make changes to update the System of Records Notice (SORN).
DATES:
Submit comments on or before June 10, 2024.
ADDRESSES:
Comments may be submitted to the Federal eRulemaking Portal, http://www.regulations.gov. Submit comments by searching for GSA/ADM-26, Office of Inspector General Counsel Files.
FOR FURTHER INFORMATION CONTACT:
Call or email Richard Speidel, Chief Privacy Officer at 202-969-5830 and gsa.privacyact@gsa.gov.
SUPPLEMENTARY INFORMATION:
GSA proposes to modify the SORN for the Office of Inspector General Counsel Files subject to the Privacy Act of 1974, 5 U.S.C. 552a. GSA intends to add two new routine uses that are consistent with the purpose of this system of records.
GSA proposes adding a routine use (routine use "j") and revising routine use "i" to reflect the current Office of Management and Budget (OMB) breach response guidance in M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information.
The Inspector General Empowerment Act of 2016 (IGEA), 5 U.S.C. 406(j), exempts certain computerized data comparisons performed by or in coordination with Inspectors General from the Computer Matching and Privacy Protection Act of 1988, Pub. L. 100-503. GSA proposes adding a new routine use (routine use "n") to clarify that the GSA Office of Inspector General (OIG) has authority to compare OIG records contained in the system with the records of other Federal agencies and non-Federal records. GSA is also updating the SORN to make law enforcement records contained in the system exempt from the access and amendment provisions of the Privacy Act, consistent with the other two OIG SORNs, which are listed as GSA/ADM-24 and GSA/ADM-25.
[top] In addition to making minor technical and administrative corrections and changes to format, GSA proposes: (1) updating the system location to include secure servers maintained by third-party secure providers to support the procurement of solutions or processes that may require the support of third-party service providers; (2) updating the categories of individuals covered by the system; (3) adding additional detail to the categories of records in the system
The Inspector General Act of 1978 (as amended 5 U.S.C. 401-424) established the GSA OIG to conduct and supervise audits and investigations relating to the programs and operations of GSA. Within the GSA OIG, the responsibilities of the Office of Counsel to the Inspector General include (1) providing legal services to the OIG on GSA programs and operations, administrative law issues, and criminal procedure, (2) representing the OIG in assisting the Department of Justice (DOJ) with litigation, including settlement of cases arising under the False Claims Act, (3) representing the OIG in personnel actions, and (4) responding to requests submitted to the OIG, including under the Freedom of Information Act (FOIA) and Privacy Act. The Office of Inspector General Counsel Files provide for the collection of information to track, manage, and process False Claims Act complaints, administrative actions including personnel matters, FOIA and Privacy Act requests, and other administrative and litigation matters handled by the Office of Counsel to the Inspector General.
Richard Speidel,
Chief Privacy Officer,Office of the Deputy Chief Information Officer, General Services Administration.
SYSTEM NAME AND NUMBER:
Office of Inspector General Counsel Files, GSA/ADM-26.
SECURITY CLASSIFICATION:
Unclassified.
SYSTEM LOCATION:
The system is maintained electronically and in paper form in the Office of Counsel to the Inspector General (OIG/JC). Original and duplicate systems may exist, in whole or in part, at secure sites and on secure servers maintained by third-party service providers for the GSA OIG. These systems are FedRAMP Moderate compliant and have all applicable Federal Information Security Modernization Act (FISMA), Federal Information Processing Standards (FIPS), and security controls as applicable.
SYSTEM MANAGER(S):
Director, Information Technology of the Office of Inspector General (JPM), 1800 F Street NW, Washington, DC 20405.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
General authority to maintain the system is contained in the Inspector General Act of 1978, as amended, 5 U.S.C. 401-424.
PURPOSE(S) OF THE SYSTEM:
The records in this system are maintained for the purpose of providing representational and advisory legal services to the OIG.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
The system contains records related to individuals involved in litigation with the United States, or the OIG, officials, or components of the OIG; individuals involved in administrative proceedings before the OIG, to which the OIG is a party or in which the OIG has an interest; individuals suspected of violations of criminal and civil statutes or regulations or GSA policies, procedures, or directives; individuals who have filed a FOIA request, Privacy Act request, or FOIA or Privacy Act appeal; individuals involved in negotiations, claims, or disputes with the OIG; present and former employees of GSA and the OIG; individuals who have submitted a complaint or allegation to the OIG; and individuals referenced in potential or actual cases and matters under the jurisdiction of the Office of Counsel to the Inspector General.
CATEGORIES OF RECORDS IN THE SYSTEM:
The system contains information needed by the Office of Counsel to the Inspector General to represent and advise the OIG. Records in this system pertain to a broad variety of matters under the jurisdiction of the Office of Counsel, including but not limited to civil, criminal, and administrative actions, personnel matters, correspondence, special projects, and FOIA and Privacy Act requests and appeals. Records may include but are not limited to: name, social security number, addresses, phone numbers, email addresses, birth date, financial information, work history, medical records, or employment records. The system may also contain other records such as: case history files, copies of applicable laws, working papers of attorneys, testimony of witnesses, correspondence, accident reports, pleadings, affidavits, litigation reports, financial data, and other material that is used as a basis for providing legal advice.
RECORD SOURCE CATEGORIES:
Records are collected from other systems, individuals and their representatives, present and former GSA and OIG employees, complainants, informants, witnesses, government contractors, law enforcement agencies, other government agencies, State agencies, credit bureaus, data services, employers, references, educational institutions, public sources, and entities involved in an administrative matter, claim or litigation.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:
In addition to other disclosures generally permitted under subsection (b) of the Privacy Act of 1974, 5 U.S.C. 552a(b), the GSA OIG may disclose records for the following routine uses:
a. A record of any case in which there is an indication of a violation or potential violation of law, whether civil, criminal, or regulatory in nature, may be disseminated to the appropriate Federal, State, local, or foreign agency charged with the responsibility for investigating or prosecuting such a violation or charged with enforcing or implementing the law.
b. A record may be disclosed to a Federal, State, local, or foreign agency or to an individual or organization in the course of investigating a potential or actual violation of any law, whether civil, criminal, or regulatory in nature, or during the course of a trial or hearing or the preparation for a trial or hearing for such a violation, if there is reason to believe that such agency, individual, or organization possesses information relating to the investigation, and disclosing the information is reasonably necessary to elicit such information or to obtain the cooperation of a witness or an informant.
c. A record relating to a case or matter may be disclosed in an appropriate Federal, State, local, or foreign court or grand jury proceeding in accordance with established constitutional, substantive, or procedural law or practice, even when the agency is not a party to the litigation.
d. A record relating to a case or matter may be disclosed to an actual or potential party or to his or her attorney for the purpose of negotiation or discussion on matters such as settlement of the case or matter, plea-bargaining, or informal discovery proceedings.
[top] e. A record may be disclosed to a Federal, State, local, foreign, Tribal, or other public authority in response to its request in connection with the assignment, hiring or retention of an
f. A record may be disclosed to an appeal, grievance, hearing, or complaint examiner; an equal opportunity investigator, arbitrator, or mediator; and/or an exclusive representative or other person authorized to investigate or settle a grievance, complaint, or appeal filed by an individual who is the subject of the record.
g. A record may be disclosed as a routine use to a Member of Congress or to a congressional staff member in response to an inquiry of the congressional office made at the request of the person who is the subject of the record.
h. A record may be disclosed: (a) to an expert, a consultant, or contractor of GSA or GSA OIG engaged in a duty related to an agency function to the extent necessary to perform the function; and (b) to a physician to conduct a fitness-for-duty examination of a GSA or GSA OIG officer or employee.
i. To appropriate agencies, entities, and persons when (1) GSA and/or GSA OIG suspects or has confirmed that there has been a breach of the system of records; (2) GSA and/or GSA OIG has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, GSA and/or GSA OIG (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with GSA's and/or GSA OIG's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.
j. To another Federal agency or Federal entity, when GSA and/or GSA OIG determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.
k. In any legal proceeding, where pertinent, to which GSA, GSA OIG, a GSA employee, a GSA OIG employee, or the United States or other entity of the United States government is a party before a court or administrative body.
l. To the Office of Personnel Management (OPM), the Office of Management and Budget (OMB), and the Government Accountability Office (GAO) in accordance with their responsibilities for evaluating Federal programs.
m. To the National Archives and Records Administration (NARA) for records management purposes.
n. A record may be disclosed to compare such record with records in other Federal agencies' systems of records or to non-Federal records.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Electronic records and backups are stored on secure servers and accessed only by authorized personnel, in accordance with GSA OIG IT Security Policy. Paper files are stored in locked rooms or filing cabinets with access limited to authorized personnel.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
System records are retrievable by searching against information in the record pertaining to an individual, key word, case description, file number, or case title.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
System records are retained and disposed of according to GSA records maintenance and disposition schedules and the requirements of the National Archives and Records Administration.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS
Records in the system are protected from unauthorized access and misuse through a combination of administrative, technical, and physical security measures. Administrative measures include but are not limited to policies that limit system access to individuals within an agency with a legitimate business need, and regular review of security procedures and best practices to enhance security. Technical measures include but are not limited to system design that allows authorized system users access only to data for which they are responsible per FISMA requirements; required use of strong passwords that are frequently changed; and use of encryption for certain data transfers using current FIPS compliant protocols. Physical security measures include but are not limited to the use of data centers which meet government requirements for storage of sensitive data. Paper files are stored in locked rooms or filing cabinets and can only be accessed by authorized users.
RECORD ACCESS PROCEDURES:
This system of records is exempt from certain notification, access, and amendment procedures of the Privacy Act, as described below. However, GSA OIG will consider individual requests to determine whether or not information may be released. If an individual wishes to access any record pertaining to him or her in the system, that individual should consult the GSA's Privacy Act implementation rules available at 41 CFR part 105-64.2.
CONTESTING RECORD PROCEDURES:
If an individual wishes to contest the content of any record pertaining to him or her in the system, that individual should consult the GSA's Privacy Act implementation rules available at 41 CFR part 105-64.4.
NOTIFICATION PROCEDURES:
Individuals seeking notification of any records about themselves contained in this system of records should contact the system manager at the address above. Follow the procedures on accessing records in 41 CFR part 105-64, subpart 105-64.2 to request such notification.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
[top] a. In accordance with 5 U.S.C. 552a(j), this system of records is exempt from all provisions of the Privacy Act of 1974 with the exception of subsections (b); (c)(1) and (2); (e)(4)(A) through (F); (e)(6), (7), (9), (10), and (11); and (i) of the Act, to the extent that information in the system pertains to the enforcement of criminal laws, including police efforts to prevent, control, or reduce crime or to apprehend criminals; to the activities of prosecutors, courts, and correctional, probation, pardon, or parole authorities; and to (a) information compiled for the purpose of identifying individual criminal offenders and alleged offenders and consisting only of identifying data and notations of arrests, the nature and disposition of criminal charges, sentencing, confinement, release, and parole and probation status; (b) information compiled for the purpose of a criminal investigation, including reports of informants and investigators, that is associated with an identifiable individual; or (c) reports of enforcement of the criminal laws, from arrest or indictment through release from supervision. This system is exempted to
In accordance with 5 U.S.C. 552a(k), this system of records is exempt from subsections (c)(3); (d); (e)(1); (e)(4)(G), (H), and (I); and (f) of the Privacy Act of 1974 to the extent that the system consists of investigatory material compiled for law enforcement purposes, other than material within the scope of 5 U.S.C. 552a(j). However, if an individual is denied any right, privilege, or benefit to which the individual would otherwise be eligible as a result of the maintenance of such material, such material shall be provided to such individual, except to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the government under an express promise that the identity of the source would be held in confidence, or, prior to the effective date of the Act, under an implied promise that the identity of the source would be held in confidence; and
b. To the extent the system consists of investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for Federal civilian employment, military service, Federal contracts, or access to classified information, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the government under an express promise that the identity of the source would be held in confidence, or, prior to the effective date of the Act, under an implied promise that the identity of the source would be held in confidence.
This system has been exempted to maintain the efficacy and integrity of lawful investigations conducted pursuant to the Office of Inspector General's law enforcement responsibilities and responsibilities in the areas of Federal employment, government contracts, and access to security classified information.
HISTORY:
This notice revises the previously published notice (76 FR 56763, September 14, 2011).
[FR Doc. 2024-10147 Filed 5-8-24; 8:45 am]
BILLING CODE 6820-AB-P