[Federal Register: December 29, 2006 (Volume 71, Number 250)] [Notices] [Page 78446-78448] From the Federal Register Online via GPO Access [wais.access.gpo.gov] [DOCID:fr29de06-85] ======================================================================= ----------------------------------------------------------------------- DEPARTMENT OF HOMELAND SECURITY Office of the Secretary [Docket No. DHS-2006-0076] Privacy Act of 1974; System of Records AGENCY: Privacy Office, DHS. ACTION: Notice of Privacy Act System of Records. ----------------------------------------------------------------------- SUMMARY: In accordance with the Privacy Act of 1974, the Department of Homeland Security is giving notice that it proposes to add a new system of records to its inventory of record systems for Department of Homeland Security General Information Technology Access Account Records System. DATES: Written comments must be submitted on or before January 29, 2007. ADDRESSES: You may submit comments, identified by Docket Number DHS- 2006-0076 by one of the following methods:Federal e-Rulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments. Fax: 202-572-8727 (not a toll-free number). Mail: Hugo Teufel III, Chief Privacy Officer, Privacy Office, Department of Homeland Security, Washington, DC 20528. FOR FURTHER INFORMATION CONTACT: Please identify by Docket Number DHS- 2006-0076 to request further information by one of the following methods: Mail: Hugo Teufel III, Chief Privacy Officer, Privacy Office, Department of Homeland Security, Washington, DC 20528. [[Page 78447]] Facsimile: 202-572-8727 (not a toll-free number). E-Mail: privacy@dhs.gov. SUPPLEMENTARY INFORMATION: As part of its efforts to streamline and consolidate its record system, the Department of Homeland Security (DHS) is establishing a new agency-wide systems of records under the Privacy Act of 1974 (5 U.S.C. 552a) for the Department of Homeland Security General Information Technology Access Account Records System (GITAARS). This system of records is part of DHS's ongoing record integration and management efforts. This system will consist of information collected in order to provide authorized individuals with access to DHS information technology resources. This information includes user name, business affiliation, account information and passwords. The Privacy Act embodies fair information principles in a statutory framework governing the means by which the U.S. Government collects, maintains, uses and disseminates personally identifiable information. The Act applies to information that is maintained in a ``system of records.'' A ``system of records'' is a group of any records under the control of an agency from which information is retrieved by the name of an individual or by some identifying number, symbol, or other identifying particular assigned to the individual. The Privacy Act requires each agency to publish in the Federal Register a description of the type and character of each system of records that the agency maintains, and the routine uses for which such information may be disseminated and the purpose for which the system is maintained. Individuals may request their own records that are maintained in a system of records in the possession or under the control of DHS by complying with DHS Privacy Act regulations, 6 CFR Part 5. In accordance with 5 U.S.C. 552a(r), a report on this system has been sent to Congress and to the Office of Management and Budget. DHS-2006-0076 System name: General Information Technology Access Account Records System, DHS/ ALL 004. Security classification: Unclassified but sensitive. System location: Records are maintained by the Department of Homeland Security at the DHS Data Center in Washington, DC, and at a limited number of remote locations where DHS components or program maintain secure facilities and conducts its mission. Categories of individuals covered by the system: A. All persons who are authorized to access DHS Information Technology resources, including employees, contractors, grantees, private enterprises and any lawfully designated representative of the above and including representatives of Federal, state, territorial, tribal, local, international, or foreign government agencies or entities, in furtherance of the DHS mission; B. Individuals who serve on DHS boards and committees; C. Individuals who have business with DHS and who have provided personal information in order to facilitate access to DHS Information Technology resources; and D. Individuals who are facility points of contact for government business and the individual(s) they list as emergency contacts. Categories of records in the system: DHS/ALL 004 contains names, business affiliations, facility positions held, business telephone numbers, cellular phone numbers, pager numbers, numbers where individuals can be reached while on travel or otherwise away from the office, citizenship, home addresses, electronic mail addresses, names and phone numbers of other contacts, the positions or titles of those contacts, their business affiliations and other contact information provided to the Department that is derived from other sources to facilitate authorized access to DHS Information Technology resources. Authority for maintenance of the system: 5 U.S.C. 301; 44 U.S.C. 3101. Purpose(s): This system will collect a discreet set of personal information in order to provide authorized individuals access to DHS information technology resources. The information collected by the system will include full name, user name, account information, citizenship, business affiliation, contact information, and passwords. The system enables DHS to maintain: (a) Account information for gaining access to information technology; (b) lists of individuals who are appropriate organizational points of contact for the Department; and (c) lists of individuals who are emergency points of contact. The system will also enable DHS to provide individuals access to certain programs and meeting attendance and where appropriate allow for sharing of information between individuals in the same operational program to facilitate collaboration. Routine uses of records maintained in the system, including categories of users and the purposes of such uses: In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act, all or a portion of the records or information contained in this system may be disclosed outside DHS as a routine use pursuant to 5 U.S.C. 552a(b)(3), limited by privacy impact assessments, data sharing, or other agreements, as follows: A. To DHS contractors, consultants or others, when necessary to perform a function or service related to this system of records for which they have been engaged. Such recipients are required to comply with the Privacy Act of 1974, as amended (5 U.S.C. 552a). B. To sponsors, employers, contractors, facility operators, grantees, experts, and consultants in connection with establishing an access account for an individual and when necessary to accomplish a DHS mission function related to this system of records. C. To other individuals in the same operational program supported by an information technology system, where appropriate notice to the individual has been made that his or her contact information will be shared with other members of the same operational program in order to facilitate collaboration. D. To a Congressional office from the record of an individual in response to an inquiry from that Congressional office made at the written or attested to request of the individual to whom the record pertains. E. To the National Archives and Records Administration or other Federal government agencies pursuant to records management inspections being conducted under the authority of 44 U.S.C. Sections 2904 and 2906. F. To the Department of Justice (DOJ), or other Federal agency conducting litigation or in proceedings before any court, adjudicative or administrative body, when: (a) DHS; (b) any employee of DHS in his/ her official capacity; (c) any employee of DHS in his/her individual capacity where DOJ or DHS has agreed to represent the employee; or (d) the United States or any agency thereof, is a party to the litigation or has an interest in such litigation. Disclosure to consumer reporting agencies: None. [[Page 78448]] Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system: Storage Records in this system are on paper and/or in digital or other electronic form. Digital and other electronic images are stored on a storage area network in a secured environment. Retrievability: Information may be retrieved by an identification number assigned by computer, by facility, by business affiliation, e-mails address, or by the name of the individual. Safeguards: Information in this system is safeguarded in accordance with applicable laws, rules and policies, including the DHS Information Technology Security Program Handbook. Further, GITAARS security protocols will meet multiple NIST Security Standards from Authentication to Certification and Accreditation. Records in the GITAARS will be maintained in a secure, password protected electronic system that will utilize security hardware and software to include: multiple firewalls, active intruder detection, and role-based access controls. Additional safeguards will vary by component and program. All records are protected from unauthorized access through appropriate administrative, physical, and technical safeguards. These safeguards include: restricting access to authorized personnel who have a ``need to know;'' using locks; and password protection identification features. Classified information is appropriately stored in accordance with applicable requirements. DHS file areas are locked after normal duty hours and the facilities are protected from the outside by security personnel. Retention and disposal: Records are retained and disposed of in accordance with the National Archives and Records Administration's General Records Schedule 24, section 6, ``User Identification, Profiles, Authorizations, and Password Files.'' Inactive records will be destroyed or deleted 6 years after the user account is terminated or password is altered, or when no longer needed for investigative or security purposes, whichever is later. System manager(s) and address: For Headquarters components of the Department of Homeland Security, the System Manager is the Director of Departmental Disclosure, U.S. Department of Homeland Security, Washington, DC 20528. For operational components that comprise the U.S. Department of Homeland Security, the System Managers are as follows: United States Coast Guard, FOIA Officer/PA System Manager, Commandant, CG-611, U.S. Coast Guard, 2100 2nd Street, SW., Washington, DC 20593-0001. United States Secret Service, FOIA/PA System Manager, Suite 3000, 950 H Street, NW., Washington, DC 20223. Under Secretary for Federal Emergency Management Directorate, FOIA/PA System Manager, 500 C Street, SW., Room 840, Washington, DC 20472. Director, Citizenship and Immigration Services, U.S. Citizenship and Immigration Services, ATTN: Records Services Branch (FOIA/PA), 111 Massachusetts Ave, NW., 2nd Floor, Washington, DC 20529. Commissioner, Customs and Border Protection, FOIA/PA System Manager, Disclosure Law Branch, Office of Regulations & Rulings, Ronald Reagan Building, 1300 Pennsylvania Avenue, NW., (Mint Annex) Washington, DC 20229. Bureau of Immigration and Customs Enforcement, FOIA/PA System Manager, Office of Investigation, Chester Arthur Building (CAB), 425 I Street, NW., Room 4038, Washington, DC 20538. Assistant Secretary, Transportation Security Administration, FOIA/PA System Manager, Office of Security, West Building, 4th Floor, Room 432-N, TSA-20, 601 South 12th Street, Arlington, VA 22202-4220. Federal Protective Service, FOIA/PA System Manager, 1800 F Street, NW., Suite 2341, Washington, DC 20405. Federal Law Enforcement Training Center, Disclosure Officer, 1131 Chapel Crossing Road, Building 94, Glynco, GA 31524. Under Secretary for Science & Technology, FOIA/PA System Manager, Washington, DC 20528. Under Secretary for Preparedness, Nebraska Avenue Complex, Building 81, 1st floor, Washington, DC 20528. Director, Operations Coordination, Nebraska Avenue Complex, Building 3, Washington, DC 20529. Officer of Intelligence and Analysis, Nebraska Avenue Complex, Building 19, Washington, DC 20529. Notification procedure: To determine whether this system contains records relating to you, write to the appropriate System Manager(s) identified above. Record access procedures: A request for access to records in this system may be made by writing to the System Manager, identified above, in conformance with 6 CFR Part 5, Subpart B, which provides the rules for requesting access to Privacy Act records maintained by DHS. Contesting record procedures: Same as ``Records Access Procedures'' above. Record source categories: Information contained in this system is obtained from affected individuals/organizations/facilities, public source data, other government agencies and/or information already in other DHS records systems. Exemptions claimed for the system: None. Dated: December 18, 2006. Hugo Teufel III, Chief Privacy Officer. [FR Doc. E6-22008 Filed 12-28-06; 8:45 am] BILLING CODE 4410-10-P