Chapter 2. Procedures for Creating, Altering or Terminating a System of Records
PURPOSE. This Chapter outlines procedures for the creation, alteration, or termination of a System of Records that meets the requirements of the Privacy Act.
RESPONSIBILITY. Assistant Administrators, the Inspector General, the General Counsel, Associate Administrators, Regional Administrators, Laboratory Directors, and Staff Office Directors are responsible for designating System Managers to carry out procedures for creating, altering, or terminating a System of Records.
NEW SYSTEM OF RECORDS. A new System of Records is one for which no public notice has been published in the Federal Register. Specifically, a new System is created whenever any one of the following criteria is met:
A program, authorized by either a new or an existing statute or Executive order, requires for its successful accomplishment the creation and retrieval of individually identifiable records.
There is a proposed new use of existing records that is incompatible with the purpose for which the records were originally collected. In this case, all individuals covered by the existing System of Records must be notified of the new purpose and routine uses for the records in the System and must be provided with a new Privacy Act statement.
There is a new organization of records, resulting in consolidation of two or more existing systems into one new ("umbrella") system, whenever the consolidation cannot be classified under a current System notice.
It is discovered that records about individuals are being created and used, and that this activity is not covered by a current, published System notice. (This is a "found System.") OMB requires the temporary suspension of data collection and disclosure in this case. (The period of suspension for a found System begins as soon as the System is "found," and continues through the advance notice period required for a new System.)
A new organization (configuration) of existing records about individuals which had not previously been subject to the Privacy Act (i.e., had not been a System of Records) results in the creation of a System of Records.
SIGNIFICANT ALTERATION OF A SYSTEM OF RECORDS. A significant alteration to an existing System occurs as a result of a change in the manner in which records are organized or the manner in which records are indexed or retrieved, or a change in the nature or scope of the records. A System of Records is considered to be significantly altered when a change to the System will:
Increase or change the number or type of individuals on whom records are maintained. (Changes involving the number, rather than the type, of individuals about whom records are kept need only be reported when the change significantly alters the character and purpose of the System of Records.)
Expand the type or categories of information maintained. For example, if an employee file is expanded to include data on education and training, this would be considered an expansion of the "types or categories of information" maintained.
Alter the manner in which the records are organized or the manner in which the records are indexed or retrieved so as to change the nature or scope of these records, such as splitting an existing System into two or more different Systems such as might occur in a centralization or a decentralization of organizational responsibilities.
Alter the purpose for which information in the System is used.
Change the equipment configuration (that is, hardware or software on which the System is operated so as to create the potential for either greater or easier access).
Change procedures associated with the System in a manner which affects an individual's exercise of his/her rights.
DOCUMENTATION OF NEW SYSTEM OR SIGNIFICANT ALTERATION OF EXISTING SYSTEM. Documentation in support of a new System or significant alteration to an existing System must be sent to the Chief, Information Management Branch, IMSD, OIRM, and consist of a draft of the following: (a) narrative report of the System (for OMB); (b) Privacy Act Statement (for the individuals to whom the records pertain); and (c) System notice (Federal Register notice). Documentation must reach the Information Management Branch, IMSD, in sufficient time for Agency review, the sixty-day advance notice required by OMB prior to placing a System in operation, and the thirty-day public comment period after Federal Register publication. Documentation guidelines are contained in Figure 2-1.
REQUESTS FOR WAIVER OF OMB'S SIXTY DAY ADVANCE NOTICE PERIOD. A waiver from OMB of the sixty day advance notice requirement can be requested by the Assistant Administrator for Administration and Resource Management in compelling cases. Program requests should be made part of the documentation sent to the Chief, Information Management Branch, IMSD.
The waiver must demonstrate that a delay of sixty days in establishing a System of Records--or making significant alteration to an existing System--would not be in the public interest by (1) showing how the public interest would be adversely affected if the waiver were not granted, and explaining why the responsible EPA organization was unable to provide earlier notice; or, (2) demonstrating that suspending operation of a found System would adversely affect the public interest and failure to report it was due to administrative oversight.
Compelling circumstances for which a waiver request would be in the public interest include the following examples: (1) the health and safety of individuals are at serious risk, (2) the statute or Executive order authorizing the program provides a specific date for compliance, (3) there would be serious harm to a class of beneficiaries who are proposed to be included in the System.
MINOR ALTERATIONS TO SYSTEM OF RECORDS. Alterations that do not meet the criteria of par. 4 above for significantly altered System of Records require only the publication in the Federal Register of a revised notice. The thirty-day public comment period and sixty-day advance notice to OMB are not required. A draft notice is to be sent to the Chief, Information Management Branch, IMSD.
TERMINATION OF SYSTEM OF RECORDS. A System of Records is considered to be terminated whenever the information is no longer accessed by individuals' names or other identifiers, or whenever it is consolidated with another System of Records. Terminating a System may involve the physical destruction of records; it may involve purging the System of individual identifiers and maintaining the data in another form, such as statistical data; and it may involve altering the manner in which the records are accessed so that records are no longer accessed by the name of the subject individuals or other personal identifiers. Because records retired to a Federal Records Center (FRC) are still under the control of EPA, the act of retiring an inactive System to the FRC does not in itself constitute termination of the System. See Figure 2-2 for documentation guidelines.
Note: Complete documentation, consisting of both paper copy and floppy disk, must be sent to the Chief, Information Management Branch (PM-211-D), Information Management and Services Division, U.S. Environmental Protection Agency, Washington, D.C. 20460.
Federal Register Notice. The Federal Register notice must be prepared in accordance with the Federal Register Document Drafting Handbook and include the signature element of the Assistant Administrator for Administration and Resources Management. The following must be included in the notice:
System Name. Provide the name of the System of Records.
Security Classification. Identify the security classification of the System of Records. (Primarily for use by the Defense Department.) If there is no such classification, enter "none."
System Location. Specify each address at which the System is maintained. Include Headquarters and field locations and the address of contractors, if any, who may maintain the System for EPA. If there are many locations, the list may be added as an appendix.
Categories of Individuals in System. Describe the categories of individuals on whom records are maintained in sufficient detail to enable individuals to determine if there is information on them in the System.
Categories of Records in System. Give a brief description of all of the types of information in the System. For example, medical history, employment history.
Authority for Maintenance of System. Cite the specific statute(s) and/or Executive order(s) which authorize EPA to maintain the System.
Purpose(s). State the reason(s) for creating the System and what the System is designed to accomplish.
Routine Uses of Records Maintained in the System Including Categories of Users and Purpose of Such Use. Describe each routine use which will be made of the records, including the categories of users and the purpose of each use.
Policies and Practices for Storing, Retrieving, Accessing, Retaining, and Disposing of Records in the System.
Storage. List all media in which records in the System are maintained (file folders, magnetic tape, microform, etc.). Briefly describe how each medium is stored.
Retrievability. Describe how the records are indexed and retrieved.
Safeguards. Describe your security policies and the procedures taken to prevent unauthorized disclosure of the records. Include the categories of EPA employees to whom access will be limited.
Retention and Disposal. Indicate how long the EPA retains the records in identifiable form. If the records are covered by a Records Control Schedule, so state.
System Manager and Address. Give the title and complete business address of the person responsible for the records. A contractor, consultant, or anyone other than an EPA employee may not be designated as a System Manager.
Notification Procedure. Provide the procedural information necessary for an individual to find out whether or not there are records about him/her in the System. Provide the complete address of the System Manager to which requests for notification may be presented. Do not include telephone numbers.
Record Access Procedures. Provide the procedural information necessary for an individual to gain access to records about him/herself. Give name and address of the System Manager whom the individuals should contact if they want to gain access to any record about themselves in the System.
Contesting Records Procedures. Provide procedures for an individual to contest the accuracy, relevancy, completeness and timeliness of records about him/herself. Give name and address of the System Manager to be contacted.
Record Source Categories. Describe the sources from which the information in the System is obtained. Sources include, but are not limited to, the individual on whom the records are maintained, previous and current employees, other agencies, etc.
Systems Exempted from Certain Provisions of the Act. Under limited circumstances, the Privacy Act permits agencies to exempt a System of Records from compliance with certain provisions of the Act. (See Chapter 3, par. 3 and Figure 3-1.) Identify the Privacy Act exemption(s), by subsection of the Act, applicable to the System; the provisions of the Act being exempted and a brief statement of the reason for invoking the exemption. Cite the Federal Register issue and page number where the proposed rule creating the exemption was published. If no exemptions are applicable, enter "none."
(NOTE: Attach a completed and signed Federal Register Typesetting Request, EPA Form 2340-15, to the Federal Register notice. This form is available through normal supply channels).
Narrative Report for OMB. This report, normally not more than two pages, must:
Describe the purpose of the System Records.
Identify the authority under which the System of Records is to be maintained.
Describe briefly the steps the Agency has taken to minimize the risk of unauthorized access to the System, and the higher or lower risk alternatives which the Agency considered.
Privacy Act Statement. This statement must be in writing and must inform the individual of the authority for collecting the information, the purpose for which the information is being collected on him/her and the routine uses which will be made of the information. The statement must also state whether furnishing information is voluntary or mandatory and explain what the consequences will be if an individual does not agree to furnish the information.
Sample Federal Register Notice -- New System
ENVIRONMENTAL PROTECTION AGENCY
Privacy Act of 1974; Proposed New System of Records
AGENCY: Environmental Protection Agency.
ACTION: Privacy Act of 1974, Proposed new system of records.
SUMMARY: As required by law (5 U.S.C.552a) the U.S. Environmental Protection Agency is publishing for comment a new system of records that it is proposing to maintain. The proposed system is "Enforcement Case Support Expert Resources Inventory System." Agency enforcement personnel will use the records to aid in the identification and selection of individuals with appropriate expertise and qualifications to serve either as expert consultants or as expert witnesses in connection with hazardous waste enforcement cases and in maintaining a record of use of experts on enforcement cases.
EFFECTIVE DATE: This system shall become effective as proposed, without further notice thirty days after publication unless comments are received which would result in contrary determination.
FOR FURTHER INFORMATION CONTACT: Mike Kosakowski, Chief, Technical Support Branch, Office of Waste Programs Enforcement (WH-527), U.S. Environmental Protection Agency, 401 M Street, S.W., Washington, D.C. 20460. Telephone: 202-382-5611.
Howard M. Messner,
Assistant Administrator for Administration and Resources Management.
SYSTEM NAME: Enforcement Case Support Expert Resources Inventory System--EPA-14.
SECURITY CLASSIFICATION: None.
SYSTEM LOCATION: Office of Waste Programs Enforcement (WH- 527), U.S. Environmental Protection Agency, 401 M Street, S.W., Washington, D.C. 20460.
CATEGORIES OF INDIVIDUALS IN SYSTEM: Individuals included in the system are experts in scientific and technical fields who have appropriate expertise and qualifications to serve either as consultants or expert witnesses in connection with hazardous waste enforcement cases and who have agreed to be included in the system.
CATEGORIES OF RECORDS IN SYSTEM: Basic input to the system is selected information from a professional resume and supporting documents supplied by the individual which contain such data as name, contact points and telephone numbers, educational background, disciplines, specialty areas, specific subject knowledge, research interests, specific chemical knowledge, membership in technical societies and working groups, awards and honors, consulting experience, background in litigation, professional history (with periods of employment, titles, names of employers, positions held, descriptions of work), and similar information. Certain information is entered in summary form. Other input into the system consists of records pertaining to U.S. EPA's proposed and actual use of the individual as an expert consultant or an expert witness for enforcement cases.
AUTHORITY FOR MAINTENANCE OF SYSTEM: 42 U.S.C. 9604, 9606, 9607 (Enforcement authority under Comprehensive Environmental Response, Compensation and Liability Act); 42 U.S.C. 9628, 9673 (Enforcement authority under Resource Conservation and Recovery Act).
PURPOSE(S): EPA enforcement personnel will use the records to aid in the identification and selection of potential expert consultants and expert witnesses for hazardous waste enforcement cases and in maintaining a record of use experts on cases.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USE:
Records of individuals will be disclosed on a case-by-case basis to the U.S. Department of Justice (U.S. DOJ) attorneys who are members of the negotiation/litigation team for the purpose of enabling their participation in the case and permitting their assistance in the selection of expert consultants and expert witnesses.
Records of individuals in the system will be disclosed on a case-by-case basis to other scientific and technical experts used by the U.S. EPA to familiarize them with experts for use on the case or to obtain their assistance in identifying possible expert consultants and expert witnesses.
Records in the system may be disclosed to OWPE enforcement contractors for the purpose of subcontracting experts identified in the system and for the purpose of updating or otherwise refining records in the system. By the terms of the contract, enforcement contractors are required to maintain the information in confidence and in accordance with the requirements of the Privacy Act.
Records in the system may be disclosed to the U.S. DOJ when related to litigation or anticipated litigation involving the records or the subject matter of the records.
Also see Prefatory Statement of General Routine Uses 41 FR 39689 (September 15, 1976).
POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING AND DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE: Various portions of the system are maintained on computer disks, word-processor disks, and in hard-copy files.
RETRIEVABILITY: Information is retrieved from the computer database and word-processor format by addressing selected data items in the system which cross-reference to an individual's name. The name is used to manually access materials in alphabetized hard-copy files.
SAFEGUARDS: Only authorized individuals have access to the system and it is maintained under a classification of "Enforcement Confidential." Records on the computer disks are protected from access by a unique identification code. Hard-copy files and word-processor disks, when not in use or in the possession of an authorized individual, are maintained in a locked cabinet. Both the computer and cabinets are in rooms protected by door locks in a building with restricted access.
RETENTION AND DISPOSAL: Records are maintained and periodically updated until individuals identified in the system request that their own record be deleted. Other reasons for deletion will be at the discretion of the Expert Resources coordinator and the System Manager.
SYSTEM MANAGER(S) AND ADDRESS: Chief, Technical Support Branch, Office of Waste Programs Enforcement (WH-527), U.S. Environmental Protection Agency, 401 M Street, S.W., Washington, D.C. 20460.
NOTIFICATION PROCEDURES: Inquiries should be addressed to the System Manager. Additional information and requirements will be provided.
RECORD ACCESS PROCEDURES: Inquiries should be addressed to the System Manager. Additional information and requirements will be provided.
CONTESTING RECORDS PROCEDURES: Inquiries should be addressed to the System Manager. The record and the specific information being contested should be identified. The corrective action sought and supporting justification for the correction should be provided by the individual. Additional information and requirements will be provided as necessary.
RECORD SOURCE CATEGORIES:
Records furnished by individuals identified in the system. Information may be entered into the system in interpretive and summary form.
Records developed by U.S. EPA personnel concerning the proposed and actual use of expert consultants and expert witnesses.
SYSTEMS EXEMPTED FROM CERTAIN PROVISIONS OF THE ACT: None.
Note: Documentation, consisting of both paper copy and floppy disk, must be sent the Chief, Information Management Branch (PM-211-D), Information Management and Services Division, U.S. Environmental Protection Agency, Washington, D.C. 20460.
Whenever one of the conditions in Chapter 2, par. 8, occur, actual termination of a System of Records is accomplished, and a Federal Register notice is required. A draft Federal Register notice must be sent to the Chief, Information Management Branch, IMSD. The notice must describe the following:
Original Federal Register publication citation (volume, page number, and date of publication).
Reason for termination.
Disposition of records
Sample Federal Register Notice -- Termination
Privacy Act of 1974, Notification of Deletion of System of Records
SUMMARY: The Environmental Protection Agency is deleting a system of records, Statements of Known Financial Interests (EPA-12), that is no longer in use.
DATE: Effective July 29, 1985
FOR FURTHER INFORMATION CONTACT: Mr. Donnell Nantkes, Grants, Contracts, and General Law Division, Office of General Counsel (LE-132G), Washington, D.C. 20460, telephone (202) 382-4550.
SUPPLEMENTARY INFORMATION: On September 8, 1978, and pursuant to the provisions of the Privacy Act of 1974, there was published in the Federal Register (43 FR 40057) a notice of the system of records, Statements of Known Financial Interests (EPA-12) Section 207(c) of the Ethics in Government Act (Pub. L. 95-521) superseded the requirement for this report. Accordingly, this notice formally deletes this system of records.
Dated: July 22, 1985
Seymour D. Greenstone,
Acting Assistant Administrator for Administration and Resources Management.