[Federal Register: October 17, 2006 (Volume 71, Number 200)]
[Rules and Regulations]
[Page 60810-60814]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr17oc06-3]
=======================================================================
-----------------------------------------------------------------------
FEDERAL HOUSING FINANCE BOARD
12 CFR Parts 910 and 913
[No. 2006-19]
RIN 3069-AB32
Privacy Act and Freedom of Information Act; Implementation
AGENCY: Federal Housing Finance Board.
ACTION: Interim final rule with request for comments.
-----------------------------------------------------------------------
SUMMARY: As part of a comprehensive review of agency practices related
to the collection, use, and protection of personally identifiable
information, the Federal Housing Finance Board
[[Page 60811]]
(Finance Board) is updating both its systems of records and
implementing rule under the Privacy Act of 1974 (Privacy Act). This
interim final rule revises the agency's Privacy Act regulation to
include new sections concerning security of systems of records, use and
collection of social security numbers, and employee responsibilities
under the Privacy Act. Elsewhere in this issue of the Federal Register,
the Finance Board is publishing a notice concerning updates to the
Finance Board's Privacy Act systems of records.
The Finance Board also is amending the fee schedule in its Freedom
of Information Act (FOIA) regulation to take into account increased
salary and operating costs. The Finance Board determines the amount of
the fee it charges to duplicate records under the Privacy Act in
accordance with the FOIA fee schedule.
DATES: The interim final rule will become effective on October 17,
2006. The Finance Board will accept comments on the interim final rule
in writing on or before November 16, 2006.
Comments: Submit comments to the Finance Board only once, using any
one of the following methods:
E-mail: comments@fhfb.gov.
Fax: 202-408-2580.
Mail/Hand Delivery: Federal Housing Finance Board, 1625 Eye Street
NW., Washington DC 20006, Attention: Public Comments.
Federal eRulemaking Portal: http://www.regulations.gov. Follow the
instructions for submitting comments. If you submit your comment to the
Federal eRulemaking Portal, please also send it by e-mail to the
Finance Board at comments@fhfb.gov to ensure timely receipt by the
agency. Include the following information in the subject line of your
submission: Federal Housing Finance Board. Interim Final Rule: Privacy
Act and Freedom of Information Act; Implementation. RIN Number 3069-
AB32. Docket Number 2006-19.
We will post all public comments we receive without change,
including any personal information you provide, such as your name and
address, on the Finance Board Web site at http://www.fhfb.gov/Default.aspx?Page=93&Top=93
.
FOR FURTHER INFORMATION CONTACT: Janice A. Kaye, Privacy Act Official
and Senior Attorney-Advisor, Office of General Counsel, kayej@fhfb.gov
or 202-408-2505; or David A. Lee, Chief Privacy Officer and Deputy
Director, Office of Management, leed@fhfb.gov or 202-408-2514. You can
send regular mail to the Federal Housing Finance Board, 1625 Eye Street
NW., Washington DC 20006.
SUPPLEMENTARY INFORMATION:
I. Background and Analysis of the Interim Final Rule
In light of the recent theft of sensitive personal information from
various federal agencies and in response to the Office of Management
and Budget's memorandum (M-06-15 (May 22, 2006)) directing agencies to
review privacy policies and processes, the Finance Board has undertaken
a comprehensive review of agency practices related to the collection,
use, and protection of personally identifiable information. As a result
of that review, the Finance Board has enhanced the safeguards for
sensitive information by adding two-factor authentication and data
encryption to the agency's network infrastructure and is beginning to
implement government-wide personal identity verification management
standards that will result in issuance of new ID cards for all
employees and contractors that may include full name, date of birth,
image (photograph), fingerprints, organization affiliation (e.g.,
employee or contractor), organization/office of assignment, grade, e-
mail address, United States citizenship status, and results of
background investigation. The Finance Board also is updating both its
Privacy Act systems of records and implementing rule.
The current Privacy Act rule, codified at 12 CFR part 913, was last
revised in 2003. See Resolution Number 2003-08, published at 68 FR
39810 (July 3, 2003) (interim final rule), and Resolution Number 2003-
25, published at 68 FR 59309 (Oct. 15, 2003) (final rule) (available
electronically in the FOIA Reading Room on the Finance Board Web site
at: http://www.fhfb.gov/Default.aspx?Page=59&Top=4). The substantive
amendments this interim final rule makes include the addition of new
sections concerning security of systems of records, use and collection
of social security numbers, and employee responsibilities under the
Privacy Act. These amendments are modeled after the U.S. Department of
Justice Privacy Act implementing rule, and are intended to enhance the
agency's ability to protect personally identifiable information.
Elsewhere in this issue of the Federal Register, the Finance Board
is publishing a notice updating the agency's Privacy Act systems of
records to reflect the new office address, changes to certain records
retention periods, and the shift in responsibility for records related
to appointed Federal Home Loan Bank directors from the Office of the
Chairman to the Office of Supervision. We are revising the system of
records concerning Office of Inspector General (OIG) records to cover
both audit and investigative files and, at the request of the OIG,
adding several routine uses. We also are adding two new systems of
records. The first covers examination work papers a Finance Board
examiner uses to determine whether a Federal Home Loan Bank's
Affordable Housing Program (AHP) complies with applicable laws and
regulations. The second covers a Personal Identity Verification (PIV)
Management System as a result of new, government-wide identification
requirements for all federal employees.
The Finance Board also is amending the fee schedule in its FOIA
regulation to take into account increased salary and operating costs.
The Finance Board determines the amount of the fee it charges to
duplicate records under the Privacy Act in accordance with the FOIA fee
schedule. More specifically, the Finance Board is increasing the hourly
search charge for clerical staff from $28.00 to $31.00, for
supervisory/professional staff from $53.00 to $72.00, and for computer
operators from $48.00 to $59.00. The hourly charge to review records
increases from $53.00 to $72.00.
II. Notice and Public Participation
The Finance Board is promulgating these changes as an interim final
rule because it is in the public interest to enhance the agency's
ability to protect personally identifiable information. Accordingly,
the Finance Board for good cause finds that the notice and publication
requirements of the Administrative Procedure Act are unnecessary. See 5
U.S.C. 553(b)(3)(B). However, because this type of rulemaking generally
requires notice and receipt of public comment, the Finance Board will
accept written comments on the interim final rule on or before November
16, 2006.
III. Effective Date
For the reasons stated in part II above, the Finance Board for good
cause finds that the interim final rule should become effective on
October 17, 2006. See 5 U.S.C. 553(d)(3).
IV. Regulatory Flexibility Act
The Finance Board is adopting the amendments to parts 910 and 913
in the form of an interim final rule and not as a proposed rule.
Therefore, the provisions of the Regulatory Flexibility Act do not
apply. See 5 U.S.C. 601(2), 603(a).
[[Page 60812]]
V. Paperwork Reduction Act
The interim final rule does not contain any collections of
information under the Paperwork Reduction Act of 1995. See 44 U.S.C.
3501 et seq. Consequently, the Finance Board has not submitted any
information to the Office of Management and Budget for review.
List of Subjects
12 CFR Part 910
Administrative practice and procedure, Archives and records,
Confidential business information, Federal home loan banks, Freedom of
information.
12 CFR Part 913
Administrative practice and procedure, Archives and records,
Freedom of information, Privacy.
0
For the reasons stated in the preamble, the Finance Board revises 12
CFR parts 910 and 913 to read as follows:
PART 910--FREEDOM OF INFORMATION ACT REGULATION
0
1. The authority citation for part 910 continues to read as follows:
Authority: 5 U.S.C. 552; 52 FR 10012 (Mar. 27, 1987).
0
2. Revise the definition of the terms ``FOIA Officer'' in Sec. 910.1
to read as follows:
Sec. 910.1 Definitions.
* * * * *
FOIA Officer means the Finance Board employee who is authorized to
make determinations as provided in this part. The mailing address for
the FOIA Officer is: Freedom of Information Act Office, Federal Housing
Finance Board, 1625 Eye Street NW., Washington DC 20006.
* * * * *
0
3. Revise Sec. Sec. 910.9(f)(2) and (g) to read as follows:
Sec. 910.9 Fees.
* * * * *
(f) * * *
(2) To pay fees and interest assessed under this section, a
requester shall deliver to the Office of Management, located at the
Federal Housing Finance Board, 1625 Eye Street NW., Washington DC
20006, a check or money order made payable to the ``Federal Housing
Finance Board.''
* * * * *
(g) Fee schedule. The Finance Board shall assess fees in accordance
with the following schedule:
Search:
Supervisory/Professional Staff--$72.00 per hour.
Clerical Staff--$31.00 per hour.
Computer Operator--$59.00 per hour.
Review--$72.00 per hour.
Duplication:
Photocopies--$.10 per page.
Diskettes--$.50 per diskette.
CD-ROMs--$1.00 per CD.
Transcription of audio tape--$4.50 per page.
Certification, seal and attestation--$5.00 per document.
Delivery:
Facsimile transmission (long distance)--long distance charges plus
$.25 per page.
Facsimile transmission (local)--$.25 per call plus $.25 per page.
Express delivery service--actual cost.
PART 913--PRIVACY ACT REGULATION
0
4. The authority citation for part 913 continues to read as follows:
Authority: 5 U.S.C. 552a.
0
5. Revise the definition of the terms ``Privacy Act Official'' and
``system of records'' in Sec. 913.1 to read as follows:
Sec. 913.1 Definitions.
* * * * *
Privacy Act Official means the Finance Board employee who is
authorized to make determinations as provided in this part. The mailing
address for the Privacy Act Official is: Privacy Act Office, Federal
Housing Finance Board, 1625 Eye Street, NW., Washington DC 20006.
* * * * *
System of records means a group of records the Finance Board
maintains or controls from which information is retrieved by the name
of an individual or by some identifying number, symbol, or other
identifying particular assigned to the individual. You can find a
description of the Finance Board's systems of records as part of the
``Privacy Act Compilation'' published by the Federal Register. You can
access the ``Privacy Act Compilation'' in most large reference and
university libraries or electronically at the Government Printing
Office's Web site at http://www.gpoaccess.gov/privacyact/index.html.
You also can request a copy of the Finance Board's systems of records
from the Privacy Act Official.
* * * * *
0
6. Revise Sec. 913.2(a) to read as follows:
Sec. 913.2 Purpose and scope.
(a) This part 913 contains the rules the Finance Board follows
under the Privacy Act. You should read these rules together with the
Privacy Act, which provides additional information about records
maintained on individuals. The rules apply to all records in systems of
records the Finance Board maintains that are retrieved by an
individual's name or personal identifier. They describe the procedures
by which individuals may request access to records, request amendment
or correction of those records, and request an accounting of
disclosures of those records by the Finance Board. Whenever it is
appropriate to do so, the Finance Board automatically processes a
Privacy Act request for access to records under both the Privacy Act
and the FOIA, following the rules contained in part 910 of this chapter
and this part 913. The Finance Board processes a request under both the
Privacy Act and the FOIA so you will receive the maximum amount of
information available to you by law.
* * * * *
0
7. Revise Sec. 913.3(e)(1) and (2)(i) to read as follows:
Sec. 913.3 How do I make a request under the Privacy Act?
* * * * *
(e) Verification of identity. * * *
(1) Verifying your own identity. You must state your full name,
current address, and date and place of birth. In order to help identify
and locate the records you request, you also may, at your option,
include your social security number. If you make your request in person
and your identity is not known to the Privacy Act Official, you must
provide either 2 forms of identification with photographs, or 1 form of
identification with a photograph and a properly authenticated birth
certificate. If you make your request by mail, your signature either
must be notarized or submitted under 28 U.S.C. 1746, a law that permits
statements to be made under penalty of perjury as a substitute for
notarization. You may fulfill this requirement by having your signature
on your request letter witnessed by a notary, or including the
following statement just before the signature on your request letter:
``I declare under penalty of perjury that the foregoing is true and
correct. Executed on [date].''
(2) Verification of guardianship. * * *
(i) The identity of the individual who is the subject of the
record, by stating the individual's name, current address and date and
place of birth, and, at your option, the social security number of the
individual;
* * * * *
[[Page 60813]]
0
8. Revise Sec. 913.4(a) and (b) to read as follows:
Sec. 913.4 How will the Finance Board respond to your Privacy Act
request?
(a) When will the Finance Board respond to my request? The Privacy
Act Official generally will respond to you in writing within 10 working
days of receipt of a request that meets the requirements of Sec.
913.3. The Privacy Act Official may extend the response time in unusual
circumstances, such as the need to consult with another agency about a
record or to retrieve a record shipped offsite for storage. If you make
your request in person, the Privacy Act Official may disclose records
to you directly with a written record made of the grant of the request.
If you are accompanied by another person, we will require your written
authorization before discussing the records in the presence of the
other person.
(b) What will the Finance Board's response include? The written
response will include the Privacy Act Official's determination whether
to grant or deny your request in whole or in part, a brief explanation
of the reasons for the determination, and the amount of the fee
charged, if any, under Sec. 913.6. If you requested access to records,
the Privacy Act Official will make the records, if any, available to
you. If you requested amendment or correction of a record, the response
will describe any amendments or corrections made and advise you of your
right to obtain a copy of the amended or corrected record, in
disclosable form, under this part.
* * * * *
0
9. Revise Sec. 913.5(e)(1) and (3) to read as follows:
Sec. 913.5 What can I do if I am dissatisfied with the Finance
Board's response to my Privacy Act request?
* * * * *
(e) Statements of Disagreement. (1) What is a Statement of
Disagreement? A Statement of Disagreement is a concise written
statement in which you clearly identify each part of any record that
you dispute and explain your reason(s) for disagreeing with the Finance
Board's denial in whole or in part of your appeal requesting amendment
or correction.
* * * * *
(3) What will the Finance Board do with my Statement of
Disagreement? The Finance Board will place your Statement of
Disagreement in the system(s) of records in which the disputed record
is maintained. The Finance Board also may append a concise statement of
its reason(s) for denying the request to amend or correct the record.
The Finance Board will notify all persons, organizations, or agencies
to which it previously disclosed the record, if an accounting of that
disclosure was made, that the record has been amended or corrected. We
will provide a copy of your Statement of Disagreement and its
explanation, if any, along with the record whenever the record is
disclosed.
0
10. Revise Sec. 913.7(b)(1) introductory text to read as follows:
Sec. 913.7 Exemptions.
* * * * *
(b) Which records are exempt? (1) Office of Inspector General Audit
and Investigative Records. Pursuant to 5 U.S.C. 552a(k)(2) and (5), a
record contained in the system of records titled ``Office of Inspector
General Audit and Investigative Records'' (FHFB-6) is exempt from 5
U.S.C. 552a(c)(3), (d), (e)(1), (e)(4)(G), (e)(4)(H), (e)(4)(I), and
(f), to the extent that the record consists of audit or investigatory
material compiled:
* * * * *
0
11. Add a new Sec. 913.8 to read as follows:
Sec. 913.8 Security of systems of records.
(a) Controls. Each Finance Board office must establish
administrative and physical controls to prevent unauthorized access to
its systems of records, unauthorized or inadvertent disclosure of
records, and physical damage to or destruction of records. The
stringency of these controls should correspond to the sensitivity of
the records that the controls protect. At a minimum, the administrative
and physical controls must ensure that:
(1) Records are protected from public view;
(2) The area in which records are kept is supervised during
business hours to prevent unauthorized persons from having access to
them;
(3) Records are inaccessible to unauthorized persons outside of
business hours; and
(4) Records are not disclosed to unauthorized persons or under
unauthorized circumstances in either oral or written form.
(b) Limited access. Access to records is restricted only to
individuals who require access in order to perform their official
duties.
0
12. Add a new Sec. 913.9 to read as follows:
Sec. 913.9 Use and collection of social security numbers.
At least annually, the Privacy Act Official and/or Chief Privacy
Officer will inform employees who are authorized to collect information
that:
(a) Individuals may not be denied any right, benefit, or privilege
as a result of refusing to provide their social security numbers,
unless the collection is authorized either by a statute or by a
regulation issued prior to 1975; and
(b) They must inform individuals who are asked to provide their
social security numbers:
(1) If providing a social security number is mandatory or
voluntary;
(2) If any statutory or regulatory authority authorizes collection
of a social security number; and
(3) The uses that will be made of the social security number.
0
13. Add a new Sec. 913.10 to read as follows:
Sec. 913.10 Employee responsibilities under the Privacy Act.
At least annually, the Privacy Act Official and/or Chief Privacy
Officer will inform employees about the provisions of the Privacy Act,
including the Act's civil liability and criminal penalty provisions.
Unless otherwise permitted by law, a Finance Board employee shall:
(a) Collect from individuals only information that is relevant and
necessary to discharge the Finance Board's responsibilities.
(b) Collect information about an individual directly from that
individual whenever practicable.
(c) Inform each individual from whom information is collected of:
(1) The legal authority to collect the information and whether
providing it is mandatory or voluntary;
(2) The principal purpose for which the Finance Board intends to
use the information;
(3) The routine uses the Finance Board may make of the information;
and
(4) The effects on the individual, if any, of not providing the
information.
(d) Ensure that the employee's office does not maintain a system of
records without public notice and notify appropriate officials of the
existence or development of any system of records that is not the
subject of a current or planned public notice.
(e) Maintain all records that are used in making any determination
about an individual with such accuracy, relevance, timeliness, and
completeness as is reasonably necessary to ensure fairness to the
individual in the determination.
(f) Except as to disclosures made to an agency or made under the
FOIA, make reasonable efforts, prior to disseminating any record about
an individual, to ensure that the record is accurate, relevant, timely,
and complete.
(g) When required by the Privacy Act, maintain an accounting in the
specified
[[Page 60814]]
form of all disclosures of records by the Finance Board to persons,
organizations, or agencies.
(h) Maintain and use records with care to prevent the unauthorized
or inadvertent disclosure of a record to anyone.
(i) Notify the appropriate official of any record that contains
information that the Privacy Act does not permit the Finance Board to
maintain.
Dated: October 11, 2006.
By the Board of Directors of the Federal Housing Finance Board.
Ronald A. Rosenfeld,
Chairman.
[FR Doc. E6-17298 Filed 10-16-06; 8:45 am]
BILLING CODE 6725-01-P