FTC-II-11

SYSTEM NAME:

Personnel Security, Identity Management, and Access Control Records System–FTC.

SECURITY CLASSIFICATION:

Not applicable.

SYSTEM LOCATION:

Federal Trade Commission, 600 Pennsylvania Avenue, NW., Washington, DC 20580. System data pertaining to identity management are maintained separately off-site by an FTC contractor. See Appendix III for other locations where records may be maintained or accessed.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Current and former FTC employees, contractor staff, or other individuals who have requested, been issued, and/or used FTC identification for access to FTC and/or other Federally controlled facilities.

CATEGORIES OF RECORDS IN THE SYSTEM:

Names, security investigation reports, adjudication files, card files, and position sensitivity designation files, and other data compiled, generated or used for personnel security clearance; fingerprints, photographs, signatures, and other personal data collected or used in connection with the issuance of FTC identification (credentials); time, date, location, or other data, logs, tapes, or records compiled or generated when such credentials are used to obtain physical or logical access to FTC facilities or resources.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

5 U.S.C. 301; Homeland Security Presidential Directive–12 (HSPD-12).

PURPOSE(S):

To conduct personnel security investigations; to make determinations required based upon the results of those investigations; and to maintain records of the investigations and determinations; to issue credentials that comply with Government-wide standards issued under HSPD-12, or to issue other non-HSPD-12 temporary identification for access to FTC facilities or resources; to maintain logs or other records of such logical and physical access by FTC staff, contractors, or other individuals; to detect, report and take appropriation action against improper or unauthorized issuance or use of FTC credentials, and unauthorized access to or use of FTC facilities and resources.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

(1) Records in this system may be used to disclose to an agency in the executive, legislative, or judicial branch, in response to its request, information on the issuance of a security clearance or the conducting of a security or suitability investigation on individuals who, at the time the records are added to the system, were Commission employees.

(2) Access logs, tapes, or other system records may be reviewed or referred and disclosed to police or other law enforcement personnel for purposes of investigating possible criminal or other illegal activity of individuals who have accessed FTC facilities or resources.

See Appendix I for other ways that the Privacy Act permits the FTC to use or disclose system records outside the agency.

DISCLOSURE TO CONSUMER REPORTING AGENCIES:

None, except as authorized under 5 U.S.C. 552a(b)(12) when trying to collect a claim of the Government. See Appendix I.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM:

STORAGE:

Paper and electronic records, tapes, or other digital or non-digital media. Identity management system data are maintained in an off-site database maintained and operated by a contractor on behalf of the FTC.

RETRIEVABILITY:

Paper records indexed by individual's name. Electronic records searched and retrieved by name or other data fields or codes.

SAFEGUARDS:

Access to personnel security files is restricted to FTC Personnel Security staff, and such files are maintained in a combination-locked safe and lockable metal file cabinets, in locked rooms. Personnel investigation reports may be reviewed by an agency official (who has been subject to a favorable background investigation) only on a strict need-to-know basis. Identity management system (IDMS) data are collected, maintained and accessed only by authorized individuals. IDMS data are not maintained with other data on agency network servers, but are transferred by dedicated telephone data lines for off-site vendor storage, management and security. Security systems and equipment that electronically log or record usage of FTC-issued credentials to obtain access to FTC facilities or resources are secured electronically and physically (e.g., recording and video monitoring equipment and servers in rooms accessible only by authorized key cards). FTC buildings are guarded and monitored by security personnel, cameras, ID checks, and other physical security measures.

RETENTION AND DISPOSAL:

Personnel investigation reports are retained for 15 years or until an employee separates from the agency. Records of adjudicative actions are maintained for two years. Other records in this system are retained and destroyed in accordance with applicable retention and disposal schedules and guidance issued or approved by the National Archives and Records Administration.

SYSTEM MANAGER(S) AND ADDRESS:

Security Officer, Administrative Services Office, Office of the Executive Director, Federal Trade Commission, 600 Pennsylvania Avenue, NW., Washington, DC 20580.

NOTIFICATION PROCEDURE; RECORD ACCESS PROCEDURES; AND CONTESTING RECORD PROCEDURES:

See Appendix II.

RECORD SOURCE CATEGORIES:

Individual requesting or requiring FTC identification for logical or physical access purposes; Office of Personnel Management Security Investigations Index, FBI Headquarters investigative files, fingerprint index of arrest records, Defense Central Index of Investigations, previous employers, references identified by record subject individual, school registrars, and responsive law enforcement agencies.

EXEMPTIONS CLAIMED FOR THE SYSTEM:

Pursuant to 5 U.S.C. 552a(k)(5), records in this system, to the extent such records have been compiled to determine suitability, eligibility, or qualifications for employment or other matters, as set forth in the cited Privacy Act provision, and would reveal the identity of a confidential source, are exempt from the requirements of subsections (c)(3), (d), (e)(1), (e)(4)(G), (H), (I), and (f) of 5 U.S.C. 552a. See § 4.13(m) of the FTC Rules of Practice, 16 CFR 4.13(m).