§ 310.63 - New and altered record systems.

(a) Criteria for a new record system. (1) A new system of records is one for which there has been no system notice published in the Federal Register.

(2) If a notice for a system of records has been canceled or deleted before reinstating or reusing the system, a new system notice must be published in the Federal Register.

(b) Criteria for an altered record system. A system is considered altered whenever one of the following actions occurs or is proposed:

(1) A significant increase or change in the number or type of individuals about whom records are maintained.

(i) Only changes that alter significantly the character and purpose of the record system are considered alterations.

(ii) Increases in numbers of individuals due to normal growth are not considered alterations unless they truly alter the character and purpose of the system;

(iii) Increases that change significantly the scope of population covered (for example, expansion of a system of records covering a single command's enlisted personnel to include all of the Component's enlisted personnel would be considered an alteration).

(iv) A reduction in the number of individuals covered is not an alteration, but only an amendment (see paragraph (a) of § 310.64 of this subpart).

(v) All changes that add new categories of individuals to system coverage require a change to the “Categories of individuals covered by the system” caption of the notice (§ 310.62(e)) and may require changes to the “Purpose(s)” caption (§ 310.62(h)).

(2) An expansion in the types or categories of information maintained.

(i) The addition of any new category of records not described under the “Categories of Records in System” caption is considered an alteration.

(ii) Adding a new data element which is clearly within the scope of the categories of records described in the existing notice is an amendment (see § 310.64(a) of this subpart).

(iii) All changes under this criterion require a change to the “Categories of Records in System” caption of the notice (see § 310.62(f) of this subpart).

(3) An alteration in the manner in which the records are organized or the manner in which the records are indexed and retrieved.

(i) The change must alter the nature of use or scope of the records involved (for example, combining records systems in a reorganization).

(ii) Any change under this criteria requires a change in the “Retrievability” caption of the system notice (see § 310.62(j)(2) of this subpart).

(iii) If the records are no longer retrieved by name or personal identifier cancel the system notice (see § 310.10(a) of subpart B).

(4) A change in the purpose for which the information in the system is used.

(i) The new purpose must not be compatible with the existing purposes for which the system is maintained or a use that would not reasonably be expected to be an alteration.

(ii) If the use is compatible and reasonably expected, there is no change in purpose and no alteration occurs.

(iii) Any change under this criterion requires a change in the “Purpose(s)” caption (see § 310.62(h) of this subpart) and may require a change in the “Authority for maintenance of the system” caption (see § 310.62(g) of this subpart).

(5) Changes that alter the computer environment (such as changes to equipment configuration, software, or procedures) so as to create the potential for greater or easier access.

(i) Increasing the number of offices with direct access is an alteration.

(ii) Software releases, such as operating systems and system utilities that provide for easier access are considered alterations.

(iii) The addition of an on-line capability to a previously batch-oriented system is an alteration.

(iv) The addition of peripheral devices such as tape devices, disk devices, card readers, printers, and similar devices to an existing ADP system constitute an amendment if system security is preserved (see paragraph (a) of § 310.64 of this subpart).

(v) Changes to existing equipment configuration with on-line capability need not be considered alterations to the system if:

(A) The change does not alter the present security posture; or

(B) The addition of terminals does not extend the capacity of the current operating system and existing security is preserved;

(vi) The connecting of two or more formerly independent automated systems or networks together creating a potential for greater access is an alteration.

(vii) Any change under this caption requires a change to the “Storage” caption element of the systems notice (see § 310.62(j)(1) of this subpart).

(c) Reports of new and altered systems. (1) Submit a report of a new or altered system to the Defense Privacy Office before collecting information for or using a new system or altering an existing system (see appendix F and paragraph (d) of this section).

(2) The Defense Privacy Office, ODASD(A) coordinates all reports of new and altered systems with the Office of the Assistant Secretary of Defense (Legislative Affairs) and the Office of the General Counsel, Department of Defense.

(3) The Defense Privacy Office prepares for the DASD(A)'s approval and signature the transmittal letters sent to OMB and Congress (see paragraph (e) of this section).

(d) Time restrictions on the operation of a new or altered system. (1) All time periods begin from the date the DASD(A) signs the transmittal letters (see paragraph (c)(3) of this section). The specific time limits are:

(i) 60 days must elapse before data collection forms or formal instructions pertaining to the system may be issued.

(ii) 60 days must elapse before the system may become operational; (that is, collecting, maintaining, using, or disseminating records from the system) (see also § 310.60(f) of this subpart).

(iii) 60 days must elapse before any public issuance of a Request for Proposal or Invitation to Bid for a new ADP or telecommunication system.

Note:

Requests for delegation of procurement authority may be submitted to the General Services Administration during the 60 days’ waiting period, but these shall include language that the Privacy Act reporting criteria have been reviewed and that a system report is required for such procurement.

(iv) Normally 30 days must elapse before publication in the Federal Register of the notice of a new or altered system (see § 310.60(f) of this subpart) and the preamble to the Federal Register notice must reflect the date the transmittal letters to OMB and Congress were signed by DASD(A).

(2) Do not operate a system of records until the waiting periods have expired (see § 310.103 of subpart K).

(e) Outside review of new and altered systems reports. If no objections are received within 30 days of a submission to the President of the Senate, Speaker of the House of Representatives, and the Director, OMB, of a new or altered system report it is presumed that the new or altered systems have been approved as submitted.

(f) Exemptions for new systems. See § 310.60(e) of this subpart for the procedures to follow in submitting exemption rules for a new system of records.

(g) Waiver of time restrictions. (1) The OMB may authorize a federal agency to begin operation of a system of records before the expiration of time limits set forth in § 310.63(d) of this subpart.

(2) When seeking such a waiver, include in the letter of transmittal to the Defense Privacy Office, ODASD(A) an explanation why a delay of 60 days in establishing the system of records would not be in the public interest. The transmittal must include:

(i) How the public interest will be affected adversely if the established time limits are followed; and

(ii) Why earlier notice was not provided.

(3) When appropriate, the Defense Privacy Office, ODASD(A) shall contact OMB and attempt to obtain the waiver.

(i) If a waiver is granted, the Defense Privacy Office, ODASD(A) shall notify the subcommittee and submit the new or altered system notice along with any applicable procedural or exemption rules for publication in the Federal Register.

(ii) If the waiver is disapproved, the Defense Privacy Office, ODASD(A) shall process the system the same as any other new or altered system and notify the subcommittee of the OMB decision.

(4) Under no circumstances shall the routine uses for new or altered system be implemented before 30 days have elapsed after publication of the system notice containing the routine uses in the Federal Register. This period cannot be waived.