2020-06490. Social Security Number Fraud Prevention Act of 2017 Implementation

AGENCY:

Office of the Secretary, Department of Commerce.

ACTION:

Notice of proposed rulemaking.

SUMMARY:

This proposed rule would revise the Department of Commerce (Department) regulations under the Freedom of Information Act (FOIA) and the Privacy Act. The revisions would clarify and update the language of procedural requirements pertaining to the inclusion of Social Security account numbers (SSNs) on documents that the Department sends by mail. These revisions are necessary to implement the Social Security Number Fraud Prevention Act of 2017, which restricts the inclusion of Social Security Numbers (SSNs) on documents sent by mail by the Federal Government.

DATES:

Submit comments on or before April 24, 2020. Comments received by mail will be considered timely if they are postmarked on or before that date. The electronic Federal Docket Management System (FDMS) will accept comments until Midnight Eastern Time at the end of that day.

ADDRESSES:

You may submit comments, identified by Regulatory Information Number (RIN) 0605-AA49, by any of the following methods:

• Federal eRulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments.
• Mail: Departmental Privacy Act Officer, Office of Privacy and Open Government, Department of Commerce, 1401 Constitution Ave. NW, Mail Stop 61025, Washington, DC 20230.

Instructions: All submissions received must include the agency name and docket number or RIN for this rulemaking. All comments received will be posted without change to regulations.gov, including any personal information provided. Comments sent by any other method, to any other address or individual, or received after the end of the comment period, may not be considered by the Department.

FOR FURTHER INFORMATION CONTACT:

Departmental Privacy Act Officer, Office of Privacy and Open Government, United States Department of Commerce, [phone].

SUPPLEMENTARY INFORMATION:

The Social Security Number Fraud Prevention Act of 2017 (the Act) (Pub. L. 115-59; 42 U.S.C. 405 note), which was signed on September 15, 2017, restricts Federal agencies from including individuals' SSNs on documents sent by mail, unless the head of the agency determines that the inclusion of the SSN on the document is necessary (section 2(a) of the Act). The Act requires agency heads to issue regulations specifying the circumstances under which inclusion of a SSN on a document sent by mail is necessary. These regulations, which must be issued not later than five years after the date of enactment, shall include instructions for the partial redaction of SSNs where feasible, and shall require that SSNs not be visible on the outside of any package sent by mail (section 2(b) of the Act). This proposed rule would revise the Department regulations under the Freedom of Information Act (FOIA) (subpart A, 15 CFR part 4) and the Privacy Act (subpart B, 15 CFR part 4), consistent with these requirements in the Act. The proposed revisions would clarify the language of procedural requirements pertaining to the inclusion of SSNs on documents that the Department sends by mail. The proposed rule also makes clarifying updates by changing the term “Privacy Officer” to “Privacy Act Officer” where it occurs in Subpart B of 15 CFR part 4, and by changing the term “FOI Officer” to “FOIA Officer” in several places in Appendix B, The proposed rule also updates an office name by changing the phrase “Assistant General Counsel for Employment, Litigation, and Oversight” to “Assistant General Counsel for Employment, Litigation, and Information” where it occurs in part 4.

Classification

This proposed rule has been determined to be significant for purposes of review under Executive Order 12866. This proposed rule is not subject to the requirements of Executive Order 13771 because it is expected to result in no more than de minimis costs to citizens and residents of the United States. In accordance with the Regulatory Flexibility Act (5 U.S.C. 605(b)), the Chief Counsel for Regulation has reviewed this rule and certifies that this regulation, if implemented, will not have a significant economic impact on a substantial number of small entities. This rule is largely procedural in nature, and, therefore, will not affect requesters. This regulation does not contain a collection of information as defined by the Paperwork Reduction Act, 44 U.S.C. 3501, et seq.

List of Subjects in 15 CFR Part 4

• Appeals
• Freedom of Information Act
• Information
• Privacy
• Privacy Act

Catrina D. Purvis,

Chief Privacy Officer, and Director of Open Government.

For the reasons stated in the preamble, the Department of Commerce proposes to amend Subpart B of 15 CFR part 4 as follows:

PART 4—DISCLOSURE OF GOVERNMENT INFORMATION

1. The authority citation for part 4 continues to read as follows:

Authority: 5 U.S.C. 301; 5 U.S.C. 552; 5 U.S.C. 552a; 5 U.SC. 553; 31 U.S.C. 3717; 44 U.S.C. 3101; Reorganization Plan No. 5 of 1950; Pub. L. 115-59, 131 Stat. 1152 (42 U.S.C. 405, note).

Subpart A—Freedom of Information Act

2. In § 4.7, revise paragraph (d) to read as follows:

§ 4.7

Responses to Requests.

* * * * *

(d) All responses shall be made subject to the provisions of § 4.25(b)(2)(iv).

* * * * *

Subpart B [Amended]

3. Amend subpart B by removing the words “Privacy Officer” wherever they appear and adding in their place the words “Privacy Act Officer”.

4. Amend § 4.22:

a. In paragraph (b)(7), emoving the words “Privacy Officer” and adding, in their place, the words “Privacy Act Officer”; and

b. Adding new paragraph (b)(10).

The addition reads as follows:

§ 4.22

Definitions

* * * * *

(b) * * *

(10) Un-redacted SSN Mailed Documents Listing (USMDL) means the Department approved list, as posted at www.commerce.gov/​privacy,, designating those_documents for which the inclusion of the Social Security number (SSN) is determined to be necessary to fulfill a compelling Department business need when the documents are requested by individuals outside the Department or other Federal agencies, as determined jointly by the Senior Agency Official for Privacy and the Departmental Privacy Act Officer.

5. Amend § 4.25 by:

a. Adding paragraphs (a)(3) and (4); and

b. Revising paragraph (b)(2)(iii), and adding paragraphs (b)(2)(iv) and (v).

The additions and revisions read as follows:

§ 4.25

Disclosure of requested records to individuals [Amended]

(a) * * *

(3) Inclusion of Social Security Numbers (SSNs) on responsive documents.

The Department shall redact SSNs from responsive documents provided to requesters where feasible. Where full redaction is not feasible, partial redaction to create a truncated SSN shall be preferred to no redaction.: The following conditions must be met for the inclusion of an unredacted (full) SSN or partially redacted (truncated) SSN on a responsive document:

(i) The inclusion of the full SSN or truncated SSN of an individual must be required or authorized by law,

(ii) The inclusion of the full SSN or truncated SSN of an individual must be determined by the Senior Agency Official for Privacy and Departmental Privacy Act Officer to be necessary to fulfill a compelling Department business need; and

(iii) The full SSN of an individual may be included only on documents listed on the USMDL.

(4) The following requirements apply when the Department mails or delivers responsive documents containing SSNs or truncated SSNs:

(i) The full SSN of an individual may be included only on documents listed on the USMDL.

(ii) For documents that are listed on the USMDL and that include the full SSN of an individual, the signature of the recipient is required upon delivery.

(iii) For documents that include the truncated form of the SSN of an individual, the signature of the recipient is required upon delivery.

(iv) The full SSN, the truncated SSN, any part of the SSN of an individual must not be visible from the outside of the envelope or package.

(b) * * *

(2) * * *

(iii) Copies of documents may be mailed at the request of the individual, and may be subject to payment of the fees prescribed in §§ 4.25(a)(3) and 4.31. In the event that the Department, at its own initiative, elects to provide a copy by mail, no fee will be charged to the individual.

(iv) Copies of documents listed on the USMDL, include full SSNs, and are requested by an individual are subject to payment of the fees prescribed in § 4.31.

(v) Documents containing SSNs or truncated SSNs that are required to be returned by the individual to the Department will be mailed or delivered along with a prepaid mail or delivery service envelope at the expense of the Department.

* * * * *

Appendix B to Part 4 [Amended]

6. Amend Appendix B to part 4 by adding the word “Act” after the phrase “Departmental Freedom of Information” wherever it appears, after the phrase “Executive Secretary; Freedom of Information”, and before the phrase “Officer for the Office of the Secretary”.