2018-26310. Privacy Act of 1974; System of Records

AGENCY:

Postal Service^TM.

ACTION:

Notice of establishment of new system of records.

SUMMARY:

The United States Postal Service® (Postal Service) is proposing to establish a new Customer Privacy Act System of Records (SOR) to support the Change of Address and Hold Mail services.

DATES:

This system will become effective without further notice on January 3, 2019 unless, in response to comments received on or before that date, the Postal Service makes any substantive change to the purposes or routine uses set forth, or to expand the availability of information in this system, as described in this notice. If the Postal Service determines that certain portions of this SOR should not be implemented, or that implementation of certain portions should be postponed in light of comments received, the Postal Service may choose to implement the remaining portions of the SOR on the stated effective date, and will provide notice of that action.

ADDRESSES:

Comments may be mailed or delivered to the Privacy and Records Management Office, United States Postal Service, 475 L'Enfant Plaza SW, Room 1P830, Washington, DC 20260-1101. Copies of all written comments will be available at this address for public inspection and photocopying between 8 a.m. and 4 p.m., Monday through Friday.

FOR FURTHER INFORMATION CONTACT:

Janine Castorina, Chief Privacy and Records Management Officer, Privacy and Records Management Office, 202-268-3069 or [e-mail].

SUPPLEMENTARY INFORMATION:

This notice is in accordance with the Privacy Act requirement that agencies publish their systems of records in the Federal Register when there is a revision, change, or addition, or when the agency establishes a new system of records. The Postal Service is establishing a new system of records to support the new Address Matching Database that is being implemented to facilitate the prevention of fraudulent Change of Address and Hold Mail requests through address matching across Postal Service customer systems.

I. Background

In an effort to enhance the security of mailing services, the Postal Service is using a new Address Matching Database to identify, prevent and mitigate potential fraudulent activity within the Change of Address and Hold Mail processes.

II. Rationale for Changes to USPS Privacy Act Systems of Records

The Postal Service is using a new Address Matching Database to facilitate mail fraud prevention for Change of Address and Hold Mail services through address matching across Postal Service customer systems. Specifically, the Address Matching Database will establish a dataflow across existing Postal Service customer systems and applications and confirm if there is an address match when a new Change of Address or Hold Mail request is submitted. The Address Matching Database will also confirm the presence of a Change of Address or Hold Mail request for the same address. With the exception of Change of Address requests subject to protective court orders, the Address Matching Database will send email or text message confirmation notifications to customers who submit a Change of Address and/or Hold Mail request. The Address Matching Database will also generate aggregate data analytics that will help guide business decisions and efforts to mitigate potential fraud as it relates to the Change of Address and Hold Mail processes. Additionally, this information will be used to improve the customer experience by helping the Postal Service maintain up-to-date user records across customer systems and minimizing the risk of fraudulent transactions.

Privacy and Security

For more than two centuries, the Postal Service has maintained a brand that customers trust to protect the privacy and security of their information. The new Address Matching Database will enhance the confidentiality and privacy of mail delivery services by improving the security of Change of Address and Hold Mail processes. The new Address Matching Database will also protect Postal Service customers from becoming potential victims of mail fraud and identity theft. Other policies that ensure the security and confidentiality of personal information are described below in the Safeguards section of the new Address Matching for Mail Fraud Detection and Prevention SOR.

III. Description of the New System of Records

Pursuant to 5 U.S.C. 552a(e)(11), interested persons are invited to submit written data, views, or arguments to this proposal. A report of the establishment of this SOR has been sent to Congress and to the Office of Management and Budget for their evaluations. The Postal Service does not expect the establishment of this SOR to have any adverse effect on individual privacy rights. Accordingly, for the reasons stated above, the Postal Service proposes a new system of records as follows:

USPS 800.050

System Name:

Address Matching for Mail Fraud Detection and Prevention.

System Location:

USPS National Customer Support Center (NCSC) and USPS IT Eagan Host Computing Services Center.

Categories of Individuals Covered by the System:

Customers requesting Change of Address mail forwarding, or Hold Mail services.

Categories of Records in the System:

1. Customer information: For Change of Address requests, old and new address, email address(es), telephone numbers and device identification; for Hold Mail, address, email address(es), and telephone numbers.

2. Online user information: Device identification.

Authority for Maintenance of the System:

18 U.S.C. 1341, 1343 and 3061; 39 U.S.C. 401, 403, 404, 3003 and 3005.

Purpose(s):

1. To enhance the customer experience by improving the security of Change of Address (COA) and Hold Mail processes.

2. To protect USPS customers from becoming potential victims of mail fraud and identity theft.

3. To identify and mitigate potential fraud in the COA and Hold Mail processes.

4. To verify a customer's identity when applying for COA and Hold Mail services.

5. To facilitate mail fraud prevention for COA and Hold Mail services through address matching across USPS customer systems.

6. To facilitate the provision of accurate and reliable mail and package delivery services.

Routine Uses of Records Maintained in the System, Including Categories of Users and the Purposes of Such Uses:

Standard routine uses 1. through 7, 10 and 11. apply.

Policies and Practices for Storing, Retrieving, Accessing, Retaining, and Disposing of Records in the System:

Storage:

Automated databases.

Retrievability:

Retrieval is accomplished by a computer-based system, using one or more of the following elements: ZIP Code(s), address, telephone number, email address, device identification and/or IP address.

Safeguards:

Electronic records, computers, and computer storage media are located in controlled-access areas under supervision of program personnel. Access to records is limited to individuals whose official duties require such access. Contractors and licensees are subject to contract controls and unannounced on-site audits and inspections.

Computers are protected by mechanical locks, card key systems, or other physical access control methods. The use of computer systems is regulated with installed security software, computer logon identifications, and operating system controls including access controls, terminal and transaction logging, and file management software.

Online data transmission is protected by encryption, dedicated lines, and authorized access codes.

Retention and Disposal:

COA and Hold Mail records are retained in an electronic database for 10 years from the effective date.

Electronic records existing on computer storage media are destroyed according to the applicable USPS media sanitization practice.

System Manager(s) and Address:

Vice President, Product Innovation, United States Postal Service, 475 L'Enfant Plaza SW, Washington, DC 20260.

Notification Procedure:

Customers wanting to know if information about them is maintained in this system of records must address inquiries in writing to the system manager. Inquiries must contain name, address, email, and other identifying information.

Record Access Procedures:

Requests for access must be made in accordance with the Notification Procedure above and the USPS Privacy Act regulations regarding access to records and verification of identity under 39 CFR 266.5.

Contesting Record Procedures:

See Notification Procedure and Record Access Procedures above.

Record Source Categories:

Individual customers requesting Change of Address, mail forwarding, or Hold Mail services and other USPS customer systems.

* * * * *

Brittany M. Johnson,

Attorney, Federal Compliance.