E8-8241. Privacy Act of 1974; System of Records

AGENCY:

Department of Commerce.

ACTION:

Notice of a new Privacy Act System of Records: COMMERCE/NOAA System-20, Search and Rescue Satellite Aided Tracking (SARSAT) 406 MHz Emergency Beacon Registration Database.

SUMMARY:

The Search and Rescue Satellite Aided Tracking (SARSAT) is responsible for keeping and maintaining a registration database for 406 MHz emergency beacons as directed by the Federal Communication Commission (FCC). This database contains personally identifiable information that is required to be protected by the Privacy Act. The purpose for this system of records is to provide search and rescue (SAR) authorities with information about the user of the beacon such as the name, phone number, and emergency contact information. This information allows SAR authorities to shorten response times, and it provides a way to cancel false alerts quickly and safely; thereby, increasing safety for SAR authorities and decreasing costs to the government and the SAR system.

DATES:

Comment Date: To be considered, written comments on the proposed new system of records must be submitted on or before May 19, 2008.

Effective Date: Unless comments are received, the new system of records will become effective as proposed on the date of publication of a subsequent notice in the Federal Register.

ADDRESSES:

Comments should be sent to: LT. Jeffrey Shoup, SARSAT Operations Support Officer, 4231 Suitland Road, Suitland, MD 20746-4304.

FOR FURTHER INFORMATION CONTACT:

LT. Jeffrey Shoup, SARSAT Operations Support Officer, 4231 Suitland Road, Suitland, MD 20746-4304.

SUPPLEMENTARY INFORMATION:

SARSAT is required by the FCC under 47 CFR parts 80, 87, and 95 to maintain a registration for emergency beacons that operate on the 406 MHz frequency. SARSAT has not found any probable or potential adverse effects of the proposal on the privacy of individuals. To minimize the risk of unauthorized access to the system of records, electronic data will be stored securely with access password protected and limited to those SARSAT program employees whose official duties require access.

COMMERCE/NOAA-20

System Name:

Search and Rescue Satellite Aided Tracking (SARSAT) 406 MHz Emergency Beacon Registration Database.

Security Classification:

None.

System Location:

NOAA/SARSAT, E/SP3, NSOF, 4231 Suitland Road, Suitland, MD 20746.

Categories of Individuals Covered by the System:

Owners of 406 MHz Emergency Position Indicating Radio Beacons (EPIRBs), 406 MHz Emergency Location Transmitters (ELTs), 406 MHz Personnel Locator Beacons (PLBs), and 406 MHz Ship Security Alerting System (SSAS) Beacons.

Categories of Records in the System:

Beacon Unique Identifier Number (Beacon ID), beacon category, beacon manufacturer, beacon model; owner name, owner address, owner e-mail address, owner telephone number by home, work, cellular, and fax; and name and telephone number of primary/alternate 24-hour emergency contact. Additional categories specifically for:

EPIRBs and SSAS beacon registrations—vessel information including usage, type, name, color, survival and radio equipment, vessel telephone numbers with call sign, Inmarsat number, cellular and MMSI number, federal/state registration number, length, capacity, and homeport; ELT registrations—aircraft information including registration (tail) number, type, manufacturer, model, color, seating capacity, radio equipment, survival equipment, principal airport; and

PLB registrations—general use data including usage, specific usage, and type.

Authority for Maintenance of the System:

47 CFR parts 80, 87, and 95. The system is also authorized by the U.S. Office of Management & Budget (OMB) Control Number: OMB 0648-0295.

Purpose(s):

This information will assist search and rescue forces in carrying out their mission of rescue assistance and false alert abatement.

Routine Uses of Records Maintained in the System, Including Categories of Users and the Purposes of Such Uses:

These records may be disclosed as follows:

1. A record in this system of records is used when a beacon alert is received at the United States Mission Control Center (USMCC) from a registered beacon. The information kept in the database is automatically forwarded to rescue coordination centers operated by the United States Air Force, United States Coast Guard, State Police/State SAR authority, or another foreign SARSAT Mission Control Center, should it be requested for use in a SAR case in a foreign search and rescue region. The information is used by search and rescue (SAR) controllers as a tool to coordinate and resolve the SAR event.

2. Every two years, NOAA uses the information in the database to alert beacon owners to update and renew their registration in the database.

3. In the event that a system of records maintained by the Department to carry out its function indicates a violation or potential violation of law or contract, whether civil, criminal or regulatory in nature and whether arising by general statute or particular program statute or contract, or rule, regulation or order issued pursuant thereto, or the necessity to protect an interest of the Department, the relevant records in the system of records may be referred to the appropriate agency, whether federal, state, local or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute or contract, or rule, regulation or order issued pursuant thereto, or protecting the interest of the Department.

4. A record from this system of records may be disclosed in the course of presenting evidence to a court, magistrate, or administrative tribunal, including disclosures to opposing counsel in the course of settlement negotiations.

5. A record in this system of records may be disclosed to a Member of Congress submitting a request involving an individual when the individual has requested assistance from the Member with respect to the subject matter of the record.

6. A record in this system of records may be disclosed to a contractor of the Department having need for the information in the performance of the contract, but not operating a system of records within the meaning of 5 U.S.C. 552a(m).

7. A record in this system of records may be disclosed to the Department of Justice in connection with determining whether the Freedom of Information Act (5 U.S.C. 552) requires disclosure thereof.

8. A record in this system of records may be disclosed to the appropriate manufacturer, medical authority, or law enforcement authority if the Department finds that it is in the best interest of the individual's safety.

Disclosure to Consumer Reporting Agencies:

None.

Policies and Practices for Storing, Retrieving, Accessing, Retaining, and Disposing of Records in the System:

Storage:

Computerized database stored behind open air firewall, electronic storage media, and paper records. All three mediums are retained in accordance with NOAA Records Disposition Handbook, Chapter 1404-02.

Retrievability:

Records may be retrieved by unique beacon identification number, name of beacon owner, date of submittal, vessel name, aircraft name, or aircraft tail number; however, records can be accessed by any file element or any combination thereof.

Access:

Due to the sensitive information stored in the registration database, access has been granted only to a limited number of personnel in accordance with this system of records routine uses provision. This access comes in four different categories; beacon owners, system administrators, SAR users, and vessel/aircraft inspectors.

• The beacon owner is granted access to his/her own registration information through the use of a user ID and an online password. Information can be accessed and updated by the beacon owner at any time.
• The system administrator consists of personnel at the USMCC who maintains and operates the registration database. Access to records is through the use of a user ID and an online password.
• The SAR user is limited to rescue coordination personnel responsible for SAR operations within internationally recognized SAR regions. Each individual SAR controller is issued a user ID and an online password. SAR controllers are given a view-only capability.
• The vessel or aircraft inspector is an approved representative of a federal agency charged with inspecting vessels or aircraft which includes verifying that the emergency beacons carried onboard the vessel or aircraft are properly registered. Each individual inspector is issued a user ID and an online password. Inspectors are given a view-only capability.

Exceptions to the above categories can only be approved by the SARSAT Program Steering Group. Consideration for access to the database by a requesting individual/agency will be based in light of their overall contribution to the SAR mission versus balancing the individual beacon owner's right to privacy.

Safeguards:

Operational controls—the SARSAT Beacon Registration Database Computer Systems are located at NOAA's USMCC facility in Suitland, Maryland. The facility has a uniformed guard service and the USMCC has key card controls limiting access to all production servers.

Technical controls—access controls are implemented on the production equipment through the use of system user names and passwords as well as database user names and passwords. Access logs are maintained and reviewed for any improprieties. The entire database is covered by an intrusion detection system that monitors and detects any attempt to access or hack any part of the database. Communications with web users are by Secure Sockets Layer (SSL) protocol to ensure safe transmission of information. In addition to the SSL, information that is sent to the database is transferred through two firewalls prior to storage and use in the USMCC. The computerized database is backed up daily and the information is housed in a Redundant Array of Independent Disks (RAID) shelf to minimize the risk of disk drive failure. Every month the data is backed up to tape and stored in a safe at an offsite location. The system is also certified and accredited according to federal guidelines.

Hardcopy records are maintained in areas that are accessible only to authorized personnel and stored in accordance with NOAA Records Disposition Handbook.

Retention and Disposal:

All records shall be retained and disposed of in accordance with NOAA Records Disposition Handbook, Chapter 1404-02, Departmental directives, and comprehensive records schedules.

System Manager(s) and Addresses:

NOAA/SARSAT, E/SP3, NSOF, 4231 Suitland Road, Suitland, MD 20746.

Notification Procedure:

Beacon owners are notified by letter once registration information has been put into the database. Every two years thereafter, beacon owners are contacted by e-mail or letter to update their information or to confirm that their information is correct.

Record Access Procedure:

Requests from individuals regarding this system of records should be addressed to the system manager. Individuals with information in the database have the ability to review and update their own individual information on the internet at http://www.beaconregistration.noaa.gov. User ID and user password are set-up with initial Web registration or with a first visit to the Web site.

Contesting Record Procedures:

Individual beacon owners have access to their database file and have the ability to update or correct information. Other issues are addressed by the system manager who can be contacted at the above address.

Record Source Categories:

The individual on whom the record is maintained provides information to NOAA by either the website or mail. Existing registrations can be updated according to the above processes, by a phone call from the beacon owner, or by rescue coordination center controllers when updated information is collected while processing a case.

Exemptions Claimed for the System:

None.

Dated: April 11, 2003.

Brenda Dolan,

Department of Commerce, Freedom of Information/Privacy Act Officer.