2021-27253. Privacy Act of 1974; System of Records

AGENCY:

Office of Mission Support, Environmental Protection Agency (EPA).

ACTION:

Notice of a modified system of records.

SUMMARY:

The U.S. Environmental Protection Agency's (EPA) Office of Mission Support, Office of Enterprise Information Programs is giving notice that it proposes to modify a system of records pursuant to the provisions of the Privacy Act of 1974. eDiscovery Enterprise Tool Suite, EPA-63 is being modified to update the system manager, add locations where the data may be stored, modify Routine Use L, and add Routine Use M. The purpose of the system is to assist with the preservation, search, processing, review, and production of electronically stored information (ESI) in support of legal discovery or to respond to other formal information requests, such as FOIA requests and congressional inquiries. Unless noted in this modification, all exemptions and provisions included in the previously published system of record notice for eDiscovery Enterprise Tool Suite, EPA-63 will transfer to the modified system of record notice for eDiscovery Enterprise Tool Suite, EPA-63.

DATES:

Persons wishing to comment on this system of records notice must do so by January 18, 2022. New or Modified routine uses if adding or changing routine uses for this modified system of records will be effective January 18, 2022.

ADDRESSES:

Submit your comments, identified by Docket ID No. EPA-HQ-OEI-2012-0882, by one of the following methods:

Federal eRulemaking Portal: https://www.regulations.gov. Follow the online instructions for submitting comments.

Email: [e-mail]. Include the Docket ID number in the subject line of the message.

Fax: [phone].

Mail: OMS Docket, Environmental Protection Agency, Mail Code: 2822T, 1200 Pennsylvania Ave. NW, Washington, DC 20460.

Hand Delivery: OMS Docket, EPA/DC, WJC West Building, Room 3334, 1301 Constitution Ave. NW, Washington, DC 20460. Such deliveries are only accepted during the Docket's normal hours of operation, and special arrangements should be made for deliveries of boxed information.

Instructions: Direct your comments to Docket ID No. EPA-HQ-OEI-2012-0882. The EPA's policy is that all comments received will be included in the public docket without change and may be made available online at https://www.regulations.gov,, including any personal information provided, unless the comment includes information claimed to be Controlled Unclassified Information (CUI) or other information for which disclosure is restricted by statute. Do not submit information that you consider to be CUI or otherwise protected through https://www.regulations.gov. The https://www.regulations.gov website is an “anonymous access” system for the EPA, which means the EPA will not know your identity or contact information. If you submit an electronic comment, the EPA recommends that you include your name and other contact information in the body of your comment. If the EPA cannot read your comment due to technical difficulties and cannot contact you for clarification, the EPA may not be able to consider your comment. If you send an email comment directly to the EPA without going through https://www.regulations.gov,, your email address will be automatically captured and included as part of the comment that is placed in the public docket and made available on the internet. Electronic files should avoid the use of special characters, any form of encryption, and be free of any defects or viruses. For additional information about the EPA public docket, visit the EPA Docket Center homepage at https://www.epa.gov/​dockets.

Docket: All documents in the docket are listed in the https://www.regulations.gov index. Although listed in the index, some information is not publicly available, e.g., CUI or other information for which disclosure is restricted by statute. Certain other material, such as copyrighted material, will be publicly available only in hard copy. Publicly available docket materials are available either electronically in https://www.regulations.gov or in hard copy at the OMS Docket, EPA/DC, WJC West Building, Room 3334, 1301 Constitution Ave. NW, Washington, DC 20460. The Public Reading Room is normally open from 8:30 a.m. to 4:30 p.m., Monday through Friday excluding legal holidays. The telephone number for the Public Reading Room is [phone], and the telephone number for the OMS Docket is [phone].

Temporary Hours During COVID-19

Out of an abundance of caution for members of the public and our staff, the EPA Docket Center and Reading Room are closed to the public, with limited exceptions, to reduce the risk of transmitting COVID-19. Our Docket Center staff will continue to provide remote customer service via email, phone, and webform. We encourage the public to submit comments via https://www.regulations.gov/​ or email, as there may be a delay in processing mail and faxes. Hand deliveries and couriers may be received by scheduled appointment only. For further information about EPA Docket Center services and the current status, please visit us online at https://www.epa.gov/​dockets.

FOR FURTHER INFORMATION CONTACT:

Division Director, eDiscovery Division, Office of Mission Support, Office of Enterprise Information Programs, 1301 Constitution Ave. NW, Washington, DC 20001.

SUPPLEMENTARY INFORMATION:

eDiscovery Enterprise Tool Suite, EPA-63 is being modified to update the System Manager to the Director of the eDiscovery Division, to add government-certified cloud locations where data may be stored to the System Location section, to modify Routine Use L, and to add Routine Use M.

SYSTEM NAME AND NUMBER:

eDiscovery Enterprise Tool Suite, EPA-63.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

eDiscovery Enterprise Tool Suite, U.S. Environmental Protection Agency, eDiscovery Division, Office of Mission Support, Office of Enterprise Information Programs, 1200 Pennsylvania Avenue NW, Washington, DC 20460. Records are also maintained in Research Triangle Park, 109 T.W. Alexander Drive, Durham, NC 27709, and other Agency offices, or mission locations. Information may also be stored within a government-certified cloud, implemented and overseen by the Agency's Chief Information Officer (CIO).

SYSTEM MANAGER(S):

The system manager is the eDiscovery Division Director, Office of Mission Support, Office of Enterprise Information Programs, 1301 Constitution Ave. NW, Washington, DC 20001; [e-mail].

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

40 U.S.C. 11315 and 44 U.S.C. 3506.

PURPOSE(S) OF THE SYSTEM:

To support the document identification and collection processes for eDiscovery, Freedom of Information Act requests and other formal information requests.

CATEGORIES OF INDIVIDUALS COVERED BY SYSTEM:

Categories of individuals covered by this system include: (1) All persons subject to a litigation hold due to a “reasonable anticipation of litigation” as determined by EPA; (2) all persons deemed a participant of past or present litigation, investigation or arbitration where EPA is involved, including civil and criminal enforcement cases and defensive litigation; and (3) individuals impacted by Freedom of Information Act (FOIA) requests, litigation or other cases in EPA.

A wide variety of individuals are covered by the system, including individuals who correspond with EPA; provide information to EPA that is subject to discovery, a FOIA request or other formal information request; or are the subject of litigation with EPA; individuals who file complaints or petitions with EPA; and individuals involved in matters with EPA as either plaintiffs or defendants in both civil and criminal matters.

CATEGORIES OF RECORDS IN THE SYSTEM:

eDiscovery Litigation Hold Files. The litigation hold files contain the names and email addresses of EPA employees and EPA contractors, interns, or grantees who have been provided EPA email addresses and who have been identified as custodians of information that needs to be preserved in the anticipation of litigation. The records in the system will include these individuals' names and EPA email addresses which are entered into the system by designated EPA employees responsible for the administration of litigation holds. Information in the system includes litigation hold notices and answers to certification questions. Reports may be generated from the system that identify whether an individual is designated as a custodian of hold-responsive information, as well as reports containing the information received from individuals in response to questions asked through the litigation hold system.

eDiscovery Case Tracking Files. The case tracking files contain information about the cases created in response to a litigation, investigation, FOIA matter or other formal information request. Case tracking files may contain the names, phone numbers, organizations, and email addresses of EPA employees and EPA contractors, interns, or grantees who have been identified as custodians in a case or as points of contact for managing the case. Information in the case tracking files may include the location of the information to be searched, search terms and case notes entered into the system by designated EPA employees or contractors responsible for operating EPA's eDiscovery Enterprise Tool Suite.

eDiscovery Collection Files. The collection files contain information potentially responsive to a litigation, investigation, FOIA matter or other formal information request. The Tool Suite may capture many types of personally identifiable information depending on where that information is stored, including an individual's name; work address and telephone number; home address and telephone number; email addresses; vehicle information; names of individuals associated with a FOIA request or litigation hold; or other related information. The collection files contain all data collected by the tools using the search criteria and may contain, but not be limited to, correspondence ( e.g., case coordination reports; memoranda and other records of communication, including electronic communication over email systems or instant messaging among other EPA employees and/or personnel of other federal agencies and outside parties and attachments to those messages or communications); local/shared drive data; information collected or compiled from EPA database systems; spreadsheets of data collections often including personally identifiable information or law enforcement data used to track the process of investigations or focus investigative priorities; records relating to litigation by or against the United States government; records relating to requests for EPA records other than requests under the FOIA and the Privacy Act of 1974; legal documents including complaints, summaries, affidavits, litigation reports, motions, subpoenas and any other court filing or administrative filing, or other related litigation documents; documentary evidence; supporting documents related to the legal and programmatic issues of a case; transcripts of interviews; regulatory history ( i.e., permits and reports generated as a result of normal program activity); administrative record material and comments on administrative records; technical support (reports generated to test search criteria); investigative notes; reports requesting permission and use; transcripts of tapes; records checks (personal history, police information, fingerprint cards, photographs); property reports; property obtained and retained by an examiner including documents, personal property and documentary or other evidence; employment records and information related to employment matters; claims and records regarding discrimination, including employment and sex discrimination; personnel matters; contracts and information relating to contracts; manifests and other related investigative information.

RECORD SOURCE CATEGORIES:

EPA employees; employees of federal contractors; employees of other federal agencies and of state, local, tribal and foreign agencies; witnesses; informants; public source materials; and other persons who may have information relevant to the search criteria.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

The routine uses below are both related to and compatible with the original purpose for which the information was collected. The following general routine uses apply to this system:

A. Disclosure for Law Enforcement Purposes: Information may be disclosed to the appropriate Federal, State, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity.

C. Disclosure to Requesting Agency: Disclosure may be made to a Federal, State, local, foreign, or tribal or other public authority of the fact that this system of records contains information relevant to the retention of an employee, the retention of a security clearance, the letting of a contract, or the issuance or retention of a license, grant, or other benefit. The other agency or licensing organization may then make a request supported by the written consent of the individual for the entire record if it so chooses. No disclosure will be made unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another Federal agency for criminal, civil, administrative, personnel, or regulatory action.

D. Disclosure to Office of Management and Budget: Information may be disclosed to the Office of Management and Budget at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A-19.

E. Disclosure to Congressional Offices: Information may be disclosed to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of the individual.

F. Disclosure to Department of Justice: Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which the Agency is authorized to appear, when:

1. The Agency, or any component thereof;

2. Any employee of the Agency in his or her official capacity;

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

4. The United States, if the Agency determines that litigation is likely to affect the Agency or any of its components,

Is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or the Agency is deemed by the Agency to be relevant and necessary to the litigation provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.

G. Disclosure to the National Archives: Information may be disclosed to the National Archives and Records Administration in records management inspections.

H. Disclosure to Contractors, Grantees, and Others: Information may be disclosed to contractors, grantees, consultants, or volunteers performing or working on a contract, service, grant, cooperative agreement, job, or other activity for the Agency and who have a need to have access to the information in the performance of their duties or activities for the Agency. When appropriate, recipients will be required to comply with the requirements of the Privacy Act of 1974 as provided in 5 U.S.C. 552a(m).

I. Disclosures for Administrative Claims, Complaints and Appeals: Information from this system of records may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.

K. Disclosure in Connection With Litigation: Information from this system of records may be disclosed in connection with litigation or settlement discussions regarding claims by or against the Agency, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions and except where court orders are otherwise required under section (b)(11) of the Privacy Act of 1974, 5 U.S.C. 552a(b)(11).

The two routine uses below (L and M) are required by OMB Memorandum M-17-12.

L. Disclosure to Persons or Entities in Response to an Actual or Suspected Breach of Personally Identifiable Information: To appropriate agencies, entities, and persons when (1) EPA suspects or has confirmed that there has been a breach of the system of records; (2) EPA has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, EPA (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with EPA's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

M. Disclosure to Assist Another Agency in Its Efforts to Respond to a Breach of Personally Identifiable Information: To another Federal agency or Federal entity, when EPA determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Records in the system are stored in database applications running on computer servers.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Litigation hold and case tracking files are assigned a case file control number or case name. Information collected from individuals pertaining to particular cases may be retrieved by name of individuals, email addresses, and other unique identifiers.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

Records stored in the system are subject to records schedules 1012 and 0089.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

Computer records are maintained in a secure, password protected computer system. Role-based access controls limit a user's access to the information in the system. Users are provided access to information in the system based on their need to know. Individuals working on a particular matter will be given access to the information related to that matter. The eDiscovery Enterprise Tool Suite is a password protected system requiring all users log in to access the information in the system. The system times out after a period of latency ensuring a user re-authenticates their session with a username and password. The system also maintains a user log that identifies and records persons who access and use the system. Users of EPA systems are required to complete security and privacy training on an annual basis to ensure continued access to the system. All records are maintained in secure areas and buildings with physical access controls.

RECORD ACCESS PROCEDURES:

Request for access must be made in accordance with the procedures described in EPA's Privacy Act regulations at 40 CFR part 16. Requesters will be required to provide adequate identification, such as a driver's license, employee identification card or other identifying document. Additional identification procedures may be required in some instances.

CONTESTING RECORDS PROCEDURES:

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Complete EPA Privacy Act procedures are described in EPA's Privacy Act regulations at 40 CFR part 16.

NOTIFICATION PROCEDURES:

Individuals who wish to be informed whether a Privacy Act system of records maintained by EPA contains any record pertaining to them, should make a written request to the EPA, Attn: Agency Privacy Officer, MC 2831T, 1200 Pennsylvania Ave. NW, Washington, DC 20460, or by email at: [e-mail].

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

For those records within the system collected and maintained pursuant to the Federal Rules of Civil Procedure (FRCP) and/or for the purpose of civil discovery, action or proceeding, 5 U.S.C. 552a(d)(5) will apply, stating that “nothing in this [Act] shall allow an individual access to any information compiled in reasonable anticipation of a civil action or proceeding.” In addition, pursuant to 5 U.S.C. 552a(k)(2), this system is exempt from the following provisions of the Privacy Act, subject to the limitations set forth in that subsection: 5 U.S.C. 552a(c)(3), (d), (e)(1), (e)(4)(G), (e)(4)(H) and (f)(2) through (5). Finally, pursuant to 5 U.S.C. 552a(j)(2), when records are contained in this system related to a criminal enforcement proceeding, this system is exempt from the following provisions of the Privacy Act, subject to the limitations set forth in that subsection: 5 U.S.C. 552a(c)(3), (c)(4), (d), (e)(1), (e)(2), (e)(3), (e)(4)(G), (e)(4)(H), (e)(5), (e)(8), (f)(2) through (f)(5) and (g).

HISTORY:

83 FR 35637 (July 27, 2018).

Vaughn Noga,

Senior Agency Official for Privacy.