E9-29770. Office of the Secretary; Privacy Act of 1974: System of Records

AGENCY:

Federal Motor Carrier Safety Administration (FMCSA), DOT.

ACTION:

Notice to modify a system of records.

SUMMARY:

DOT proposes to modify a system of records under the Privacy Act of 1974. The system is FMCSA's Motor Carrier Management Information System (MCMIS), which is updated to include new processes and extractions of sensitive data to implement a change that alters the purpose for which the information is used and an addition of a routine use. This system would not duplicate any other DOT system of records.

DATES:

Effective Date: This notice will be effective, without further notice, on January 25, 2010, unless modified by a subsequent notice to incorporate comments received by the public. Comments must be received by January 14, 2010 to be assured consideration.

ADDRESSES:

Send comments to Habib Azarsina, Departmental Privacy Officer, S-80, United States Department of Transportation, Office of the Secretary of Transportation, 1200 New Jersey Avenue, SE., Washington DC 20590 or [e-mail].

FOR FURTHER INFORMATION CONTACT:

Habib Azarsina, Departmental Privacy Officer, S-80, United States Department of Transportation, Office of the Secretary of Transportation, 1200 New Jersey Avenue, SE., Washington, DC 20590; telephone [phone], or [e-mail].

SUPPLEMENTARY INFORMATION:

The DOT system of records notice subject to the Privacy Act of 1974 (5 U.S.C. 552a), as amended, as proposed to be modified, is available from the above mentioned address and appears below:

DOT/FMCSA 001

SYSTEM NAME:

Motor Carrier Management Information System (MCMIS).

SECURITY CLASSIFICATION:

Unclassified, Sensitive.

SYSTEM LOCATION:

Volpe National Transportation Systems Center, U.S. Department of Transportation, 55 Broadway, Cambridge, MA 02142.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM OF RECORDS:

1. Individuals who are the sole proprietor/driver (owner/operator) of a motor carrier or hazardous material shipper subject to Federal Motor Carrier Safety Regulations.

2. Drivers of commercial motor vehicles who:

• Were involved in a recordable crash;
• Were the subject of a roadside driver/vehicle inspection; or
• Are the subjects of an investigatory action.

CATEGORIES OF RECORDS IN MCMIS:

MCMIS stores the following types of information:

• Census Files—These files contain the USDOT number, carrier identification, carrier address, type and size of operation, commodities carried, and other characteristics of the operation for interstate (and some intrastate) motor carriers, intermodal equipment providers, cargo tank facilities, and shippers. They include motor carrier PII consisting of social security numbers (SSN) and employee identification numbers (EIN).
• Investigatory Files—These files contain results of safety audits, compliance review investigations, and enforcement actions conducted by Federal, State, and local law enforcement agencies. They include driver and co-driver PII consisting of SSN and EIN.
• Driver/Vehicle Safety Violations and Inspection Data—This data is collected during roadside inspections of drivers and vehicles and includes driver and co-driver PII consisting of names, dates of birth, vehicle license plate numbers, and State driver's license numbers.
• Crash Data—This data is collected from State and local police crash reports and includes driver and co-driver PII consisting of names, dates of birth, vehicle license plate numbers, and State driver's license numbers.

MCMIS SHARES PII WITH THE FOLLOWING FMCSA SYSTEMS OR SYSTEM COMPONENTS:

• Driver Information Resource (DIR)—The DIR creates a driver profile using MCMIS crash data from the past five years and inspection data from the past three years. This profile shows PII data for the driver regardless of the employing carrier. The DIR also includes driver/vehicle safety violations and inspection data per the PSP description below. Access is restricted to FMCSA staff, FMCSA contractors and Motor Carrier Safety Assistance Program (MCSAP) State lead agencies.
• Pre-Employment Screening System (PSP)—The specific objectives of the PSP are aligned with the requirements of 49 U.S.C. 31150. The PSP will provide driver crash and inspection records from the DIR to requesting motor carriers that have a driver's consent. The PSP also allows a sole proprietor (owner/operator) to review his/her own driver-related data in the DIR.
• Driver Safety Measurement System (DSMS)—FMCSA utilizes MCMIS data in the DSMS to support the Comprehensive Safety Analysis 2010 (CSA 2010) initiative and its operational model test. The DSMS uses driver/vehicle safety violations and inspection data and crash data to evaluate the safety performance of Commercial Motor Vehicle (CMV) drivers in seven categories. Access is restricted to FMCSA enforcement personnel, FMCSA Headquarters (HQ) staff and MCSAP State lead agencies.
• Carrier Safety Measurement System (CSMS)—FMCSA utilizes MCMIS data in the CSMS to support the CSA 2010 initiative and its operational model test. The CSMS uses driver/vehicle safety violations and inspection data and crash data to evaluate the safety of motor carriers. Access is restricted to FMCSA enforcement, Federal and local law enforcement personnel, FMCSA HQ staff, MCSAP State lead agencies and law enforcement agencies that are FMCSA grantees. The objective of CSMS is to provide an assessment of a carrier's regulatory compliance and safety performance.
• Safety Fitness Electronic Records (SAFER)—The SAFER Web site receives MCMIS driver/vehicle safety violations and inspection data and census data on a daily basis for report generation. Although SAFER receives driver-related PII from MCMIS, SAFER reports for the public users and enforcement officers contain no PII. The driver-related PII from MCMIS is included on the Company Safety Profile reports that are requested by commercial motor carriers for their company.
• Enforcement Management Information System (EMIS)—The EMIS is a Web-based application https://emis.fmcsa.dot.gov/​ used to monitor, track, and store information related to FMCSA enforcement actions. It manages and tracks all enforcement actions associated with notifying the carrier, monitoring the carrier's response, determining whether further compliance action is required, and generating reports for various FMCSA Headquarters, FMCSA Service Center, and FMCSA Division staff. It is the authoritative source for FMCSA enforcement data. EMIS imports census files, investigatory files, driver/vehicle safety violations and inspection data, and crash data from MCMIS for the purpose of automatically initiating UNFIT/UNSATISFACTORY cases within EMIS resulting from Safety Rating letters generated by MCMIS.
• Analysis & information (A&I) Online—The A&I is a Web-based tool designed to provide quick and efficient access to descriptive statistics and analyses regarding commercial vehicle, driver, and carrier safety information. It is used by Federal, State and local law enforcement personnel, the motor carrier industry, insurance companies, and the general public. A&I imports census files, investigatory files, driver/vehicle safety violations and inspection data, and crash data from MCMIS for the purpose of processing a monthly data snapshot of the MCMIS database.
• ProVu—ProVu is a viewer that allows Federal and State enforcement personnel and the motor carrier industry to electronically view standard motor carrier safety profile reports available from the FMCSA. ProVu imports driver/vehicle safety violations and inspection data and crash data in a standard report exported from MCMIS for the purpose of generating Company Safety Profile reports.
• Compliance Analysis and Performance Review Information (CAPRI)—CAPRI is used by Federal and State enforcement personnel when conducting compliance reviews and safety audits, specialized cargo tank facility reviews, and hazardous material (HM) shipper reviews. CAPRI includes worksheets for collecting census files, investigatory files, driver/vehicle safety violations and inspection data, and crash data from MCMIS to track (1) hours of service, (2) driver qualifications, and (3) drug and alcohol compliance. It also creates the preliminary carrier safety fitness rating and various reports for motor carriers.
• McQuery—The MCMIS database is copied into McQuery, creating an exact image of the MCMIS database. The data in McQuery is used for responding to Freedom of Information Act (FOIA) requests and other requests for public information, generating special data requests for FMCSA, and supporting the operations of FMCSA.
• GOTHAM—GOTHAM is an internal FMCSA analysis system that utilizes selected extracts of MCMIS data and is only accessible through the DOT/FMCSA Intranet. GOTHAM imports census files, investigatory files, driver/vehicle safety violations and inspection data, and crash data from MCMIS for the purpose of delivering standard reports via the Intranet.

MCMIS SHARES NON-PII WITH THE FOLLOWING FMCSA SYSTEMS OR SYSTEM COMPONENTS:

• Query Central (QC)—QC is a secure Web application that provides Federal and State safety enforcement personnel with a single location where they can enter one query and obtain targeted safety data on commercial motor vehicle (CMV) carriers, vehicles, and drivers from multiple sources in FMCSA and Customs and Border Patrol. QC does not maintain a database of its own, but instead pulls data from the authoritative sources in real-time. QC utilizes MCMIS to verify carrier information. However, QC does not import or use privacy-related information on drivers from MCMIS.
• Licensing and Insurance System (L&I)—The L&I system is used to enter and display licensing and insurance information regarding authorized for-hire motor carriers, freight forwarders, and property brokers. It is the authoritative source for FMCSA licensing and insurance data. L&I is part of the registration process. L&I imports information from MCMIS as follows:

—Data about carriers that received unsatisfactory ratings;

—Data about Out-of-Service carriers; and

—USDOT numbers for synchronization with docket numbers.

• Hazmat Registration (HMReg)—HMReg exports data from MCMIS to the Pipeline and Hazardous Materials Safety Administration (PHMSA) database server in response to HAZMAT registration data requests.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

49 U.S.C. 502, 504, 506, 508, Chapter 139, 49 CFR 1.73, and Executive Order 9397.

PURPOSE(S):

To provide a central collection point for records on some intrastate motor carriers, interstate motor carriers, and hazardous material shippers in order to facilitate the analysis of the safety-related data required to administer and manage the agency's programs.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF USE:

• Information may be shared with Federal, State, local, and foreign government agencies for the purposes of enforcing motor carrier and Hazardous Materials shipper safety.
• Information may be accessed by Federal contractors involved in the system support and maintenance of MCMIS.
• Information may be shared with State lead agencies and other law enforcement grantees under the FMCSA Motor Carrier Safety Grant Program and Border Enforcement Grant program, which is a Federal grant program that provides financial assistance to States for the reduction in the frequency and severity of CMV crashes and hazardous materials incidents.
• Information may be shared with Federal, State, and local law enforcement programs to safeguard against and respond to the breach of personally identifiable information.
• In addition to those disclosures permitted under 5 U.S.C. 552a(b) of the Privacy Act, additional disclosures may be made in accordance with the DOT Prefatory Statement of General Routine Uses published at 65 FR 19476 (April 11, 2000).

DISCLOSURE TO CONSUMER REPORTING AGENCIES:

None.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS:

• Storage—MCMIS records are stored in an automated system operated and maintained at the Volpe National Transportation Systems Center (Volpe Center) in Cambridge, MA.
• Retrievability—Electronic records are retrieved through automated searches on key words or identifying information (e.g., name, Social Security Number, Employer Identification Number, company name, trade name, and geographical location).
• Accessibility (Including Safeguards)—MCMIS access is managed by the Volpe Center. This facility has its own approved System Security Plan that requires the system to be maintained in a secure computer room with access restricted to authorized personnel. Access to the building is limited and requires users to provide a valid account name and password. MCMIS contains a usage tracking system for other authorized users. MCMIS requires users to change access control identifiers at periodic intervals.
• FMCSA operates MCMIS in accordance with the E-Government Act (Pub. L. 107-347), the Federal Information Security Management Act (FISMA) of 2002, and other required policies, procedures, practices, and security controls for implementing the Automated Information System Security Program. Only authorized Federal and State government personnel and contractors conducting system support or maintenance may access MCMIS records. Access to records is password protected, and the scope of access for each password is limited to the official need of each individual who is authorized access. The motor carriers have access to their registration information in MCMIS. Additional protection is afforded by the use of password security, data encryption, and a secure network.
• Retention and Disposal—The master files are logged and backed up. The master tape is retained in a secure offsite storage facility and then destroyed in accordance with applicable NARA retention schedule NI-557-05-07 item #5.

SYSTEM MANAGER CONTACT INFORMATION:

Heshmat Ansari, Ph.D.; Division Chief, IT Development Division; Office of Information Technology; Federal Motor Carrier Safety Administration; U.S. Department of Transportation; 1200 New Jersey Avenue SE.; W68-330; Washington, DC 20590.

NOTIFICATION PROCEDURE:

Individuals wishing to know if their records appear in this system may make a request in writing to the System Manager. The request must include the requester's name, mailing address, telephone number and/or e-mail address, a description and the location of the records requested, and verification of identity (such as, a statement under penalty of perjury that the requester is the individual who he or she claims to be).

RECORD ACCESS PROCEDURES:

Individuals seeking to access their information in this system should apply to the System Manager by following the same procedure as indicated under “Notification Procedure.”

CONTESTING RECORD PROCEDURES:

Individuals seeking to contest their information in this system should apply to the System Manager by following the same procedure as indicated under “Notification Procedure.”

RECORD SOURCE CATEGORIES:

Driver information is obtained from roadside driver/vehicle inspections and crash reports submitted by State and local law enforcement agencies and from investigations performed by State and Federal investigators. State officials and FMCSA field offices forward safety information to MCMIS soon after it has been compiled and processed locally.

EXEMPTIONS CLAIMED FOR THE SYSTEM:

Pursuant to subsection (k)(2) of the Privacy Act (5 USC 552a), portions of this system are exempt from the requirements of subsections (c)(3), (d), (e)(4)(G)-(I) and (f) of the Act, for the reasons stated in DOT's Privacy Act regulation (49 CFR Part 10, Appendix, Part II, at A.8.

Dated: December 8, 2009.

Habib Azarsina,

Departmental Privacy Officer.