E8-445. Amendment to General Routine Uses

AGENCY:

Environmental Protection Agency.

ACTION:

Amendment to Agency's General Routine Uses.

SUMMARY:

The Environmental Protection Agency is giving notice that it proposes to amend its current list of General Routine Uses to add a new routine use. The new general routine use will allow the Agency to disclose information in its systems covered under the Privacy Act to persons and entities that may be needed by the Agency to respond, prevent, minimize or remedy harm resulting from an actual or suspected breach or compromise of personally identifiable information. The Agency currently has general routine uses A-K that are applicable to more than one of EPA's systems of records. The intent of this notice is to add general routine use “L” to the current list of General Routine Uses.

EFFECTIVE DATES:

Persons wishing to comment on this routine use notice must do so by February 25, 2008.

ADDRESSES:

Submit your comments, identified by Docket ID No. EPA-HQ-OEI-2007-1144, by one of the following methods:

• www.regulations.gov: Follow the online instructions for submitting comments.
• E-mail: [e-mail].
• Fax: [phone].
• Mail: OEI Docket, Environmental Protection Agency, Mail code: 2822T, 1200 Pennsylvania Ave., NW., Washington, DC 20460.
• Hand Delivery: OEI Docket, EPA/DC, EPA West Building, Room 3334, 1301 Constitution Ave., NW., Washington, DC. Such deliveries are only accepted during the Docket's normal hours of operation, and special arrangements should be made for deliveries of boxed information.

Instructions: Direct your comments to Docket ID No. EPA-HQ-OEI-2007-1144. EPA's policy is that all comments received will be included in the public docket without change and may be made available online at www.regulations.gov,, including any personal information provided, unless the comment includes information claimed to be Confidential Business Information (CBI) or other information for which disclosure is restricted by statute. Do not submit information that you consider to be CBI or otherwise protected through www.regulations.gov. The www.regulations.gov Web site is an “anonymous access” system, which means EPA will not know your identity or contact information unless you provide it in the body of your comment. If you send an e-mail comment directly to EPA without going through www.regulations.gov your e-mail address will be automatically captured and included as part of the comment that is placed in the public docket and made available on the Internet. If you submit an electronic comment, EPA recommends that you include your name and other contact information in the body of your comment and with any disk or CD-ROM you submit. If EPA cannot read your comment due to technical difficulties and cannot contact you for clarification, EPA may not be able to consider your comment. Electronic files should avoid the use of special characters, any form of encryption, and be free of any defects or viruses. For additional information about EPA's public docket visit the EPA Docket Center homepage at http://www.epa.gov/​epahome/​dockets.htm.

Docket: All documents in the docket are listed in the www.regulations.gov index. Although listed in the index, some information is not publicly available, e.g., CBI or other information for which disclosure is restricted by statute. Certain other material, such as copyrighted material, will be publicly available only in hard copy. Publicly available docket materials are available either electronically in www.regulations.gov or in hard copy at the OEI Docket Center, EPA/DC, EPA West Building, Room 3334, 1301 Constitution Ave., NW, Washington. DC. The Public Reading Room is open from 8:30 a.m. to 4:30 p.m., Monday through Friday excluding legal holidays. The telephone number for the Public Reading Room is [phone], and the telephone number for the OEI Docket Center is [phone].

FOR FURTHER INFORMATION CONTACT:

Judy E. Hutt, Privacy Act Officer, U.S. Environmental Protection Agency, Office of Information Collections, Records, FOIA, and Privacy Branch (MC-2822T), Washington, DC 20460; [phone]; [e-mail].

SUPPLEMENTARY INFORMATION:

I. General Information

The Office of Management and Budget (OMB) requires all federal agencies to be able to quickly and efficiently respond in the event of a breach of personally identifiable information and has directed agencies to publish a routine use that will allow disclosure of Privacy Act information to persons and entities in a position to assist with notifying affected individuals or playing a role in preventing, minimizing, or remedying any harm from a breach. Accordingly, the EPA is proposing to add a new routine use that will allow it to meet the OMB objective of responding quickly and efficiently should such a breach occur. This new routine use will help the Agency prevent, minimize, or remedy a data breach or compromise. All responses to a confirmed or suspected breach will be prepared on a case-by-case basis. The purpose and intent of this routine use is to allow the Agency, when necessary, to disclose information regarding the breach to individuals identified under the routine use and to give the affected individuals full and fair notice of the extent of these potential disclosures. Accordingly, the Agency is amending its prefatory statement of general routine uses to include “L” as a new routine use.

A. Disclosure for Law Enforcement Purposes

Information may be disclosed to the appropriate Federal, State, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity.

B. Disclosure Incident to Requesting Information

Information may be disclosed to any source from which additional information is requested (to the extent necessary to identify the individual, inform the source of the purpose of the request, and to identify the type of information requested,) when necessary to obtain information relevant to an agency decision concerning retention of an employee or other personnel action (other than hiring,) retention of a security clearance, the letting of a contract, or the issuance or retention of a grant, or other benefit.

C. Disclosure to Requesting Agency

Disclosure may be made to a Federal, State, local, foreign, or tribal or other public authority of the fact that this system of records contains information relevant to the retention of an employee, the retention of a security clearance, the letting of a contract, or the issuance or retention of a license, grant, or other benefit. The other agency or licensing organization may then make a request supported by the written consent of the individual for the entire record if it so chooses. No disclosure will be made unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another Federal agency for criminal, civil, administrative, personnel, or regulatory action.

D. Disclosure to Office of Management and Budget

Information may be disclosed to the Office of Management and Budget at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A-19.

E. Disclosure to Congressional Offices

Information may be disclosed to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of the individual.

F. Disclosure to Department of Justice

Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which the Agency is authorized to appear, when:

1. The Agency, or any component thereof;

2. Any employee of the Agency in his or her official capacity;

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

4. The United States, if the Agency determines that litigation is likely to affect the Agency or any of its components,

Is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or the Agency is deemed by the Agency to be relevant and necessary to the litigation provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.

G. Disclosure to the National Archives

Information may be disclosed to the National Archives and Records Administration in records management inspections.

H. Disclosure to Contractors, Grantees, and Others

Information may be disclosed to contractors, grantees, consultants, or volunteers performing or working on a contract, service, grant, cooperative agreement, job, or other activity for the Agency and who have a need to have access to the information in the performance of their duties or activities for the Agency. When appropriate, recipients will be required to comply with the requirements of the Privacy Act of 1974 as provided in 5 U.S.C. 552a(m).

I. Disclosures for Administrative Claims, Complaints and Appeals

Information from this system of records may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.

J. Disclosure to the Office of Personnel Management

Information from this system of records may be disclosed to the Office of Personnel Management pursuant to that agency's responsibility for evaluation and oversight of Federal personnel management.

K. Disclosure in Connection With Litigation

Information from this system of records may be disclosed in connection with litigation or settlement discussions regarding claims by or against the Agency, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions and except where court orders are otherwise required under section (b)(11) of the Privacy Act of 1974, 5 U.S.C. 552a(b)(11).

L. Disclosure to Persons or Entities in Response to an Actual of Suspected Compromise or Breach of Personally Identifiable Information

Information from this system of records may be disclosed to appropriate Federal, State, or local agencies, other entities, and persons when it is suspected or confirmed that: (1) The security or confidentiality of information in the system of records has been compromised; (2) there is a risk of harm to economic or property interests, identity theft or fraud, or harm to the security or integrity of this system or other systems or programs that rely upon the compromised information; and (3) and those receiving the information are reasonably necessary to assist with the Agency's efforts to respond to the suspected or confirmed compromise and to prevent, minimize, or remedy any such harm.

Dated: January 4, 2008.

Molly A. O'Neill,

Assistant Administrator and Chief Information Officer.