2021-26754. Withdrawal of Proposed Revision to Department Homeland Security Acquisition Regulation (HSAR); Privacy Training (HSAR Case 2015-003)

AGENCY:

Office of the Chief Procurement Officer, Department of Homeland Security (DHS).

ACTION:

Notice of withdrawal of proposed rule.

SUMMARY:

DHS is withdrawing a proposed rule titled Privacy Training (HSAR Case 2015-003) and providing notice of its cancellation. The Notice of Proposed Rulemaking proposed to amend the HSAR to require contractor and subcontractor employees to complete Privacy training before accessing a Government system of records; handling Personally Identifiable Information (PII) and/or Sensitive Personally Identifiable Information; or designing, developing, maintaining, or operating a Government system of records. DHS is withdrawing this proposed rule because the content of this proposal was addressed in a final rule issued by the Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council and resultant DHS FAR Class Deviation Number 17-03, Implementation of FAR 52.224-3 Privacy Training—Alternate I. Thus, DHS will not take any further action on this proposal.

DATES:

The proposed rule published on January 19, 2017 (82 FR 6425) and the comment period extended to March 20, 2017 (82 FR 14341), is withdrawn effective December 10, 2021.

ADDRESSES:

Mail: Department of Homeland Security, Office of the Chief Procurement Officer, Acquisition Policy and Legislation, ATTN: Candace Lightfoot, 245 Murray Drive, Bldg. 410 (RDS), Washington, DC 20528.

FOR FURTHER INFORMATION CONTACT:

Ms. Candace Lightfoot, Procurement Analyst, DHS, Office of the Chief Procurement Officer, Acquisition Policy and Legislation at [phone] or email [e-mail]. When using email, include HSAR Case 2015-003 in the “Subject” line.

SUPPLEMENTARY INFORMATION:

On January 19, 2017, DHS published a proposed rule at 82 FR 6425 titled Privacy Training (HSAR Case 2015-003). The rule proposed to amend the HSAR to require contractor and subcontractor employees to complete Privacy training before (1) accessing a Government system of records; (2) handling Personally Identifiable Information and/or Sensitive Personally Identifiable Information; or (3) designing, developing, maintaining, or operating a Government system of records.

DHS received two public comments in response to this proposed rule. One commenter stated support for the requirements in the proposed rule. The other commenter:

• Showed support for DHS making available on a public website a DHS-developed privacy training module that contractors can provide to their employees to achieve compliance with the proposed requirements. However, recommended that certain contractors may desire to develop their own internal Privacy Act training that would be compatible with DHS's rules and their own corporate policies, procedures, and training;
• Recommended that DHS add the Privacy Act's definition of a “system of records” to increase understanding by both government and contractor personnel about when the clause and the training are required;
• Recommended requiring flow down of HSAR 3052.224-7X only to subcontractors with a statement of work that triggers the training requirement;
• Recommended that DHS further clarify the requirement to maintain training certificates and leverage electronic recordkeeping when available; and
• Recommended that DHS modify the proposed rule to clarify whether older training certificates must be maintained after submittal and, if so, recommends that DHS specifically identify the retention period.

On December 20, 2016, DoD, GSA, and NASA ^[1] issued a final rule at 81 FR 93476 titled Privacy Training, which amended the Federal Acquisition Regulation (FAR), effective on January 19, 2017. Upon further review, DHS believes that the FAR rule addressed issues raised by this commenter.

DHS is withdrawing the proposed rule (82 FR 6425) and will not proceed with finalization of the rule because all of the requirements in the proposed rule are now covered under the final FAR rule (81 FR 93476) and resultant DHS FAR Class Deviation Number 17-03, Implementation of FAR 52.224-3 Privacy Training—Alternate I. The final FAR rule (81 FR 93476) provides guidance to contractors regarding the requirement to complete training that addresses the protection of privacy in accordance with the Privacy Act of 1974, 5 U.S.C. 552a, as amended, and the handling and safeguarding of PII. Under this rule, contractors are responsible for ensuring that initial privacy training, and annual privacy training thereafter, is completed by contractor employees who have access to a system of records; create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information; or design, develop, maintain, or operate a system of records. A contractor who has employees involved in these activities is also required to maintain records indicating that its employees have completed the requisite training and provide these records to the contracting officer upon request. In addition, the prime contractor is required to flow-down these requirements to all applicable subcontracts. As a result of the FAR change and DHS FAR Class Deviation Number 17-03, the rationale for the proposed rule no longer exists and this proposal is withdrawn.

Dated: December 7, 2021.

Paul Courtney,

Chief Procurement Officer, Department of Homeland Security.

Footnotes

1.  Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council.