2018-16117. Privacy Act of 1974; System of Records

AGENCY:

Office of Environmental Information, Environmental Protection Agency (EPA).

ACTION:

Notice of a new system of records.

SUMMARY:

The Environmental Protection Agency's (EPA) Office of Environmental Information (OEI), Office of Enterprise Information Programs (OEIP), eDiscovery Division, is giving notice that it proposes to establish a new system of records pursuant to the provisions of the Privacy Act of 1974 (5 U.S.C. 552a). The new system of records will contain information collected using the Agency's suite of tools that search and preserve electronically stored information (ESI) in support of eDiscovery requests, Freedom of Information Act (FOIA) requests or other formal information requests. Exemptions for this system of records will be included in the Agency's update of its Privacy Act regulations at 40 CFR part 16.

DATES:

Persons wishing to comment on this system of records notice must do so by. If no comments are received, the systems of records notice will become effective by August 27, 2018.

ADDRESSES:

Submit your comments, identified by Docket ID No. EPA-HQ-OEI-2012-0882, to the Federal eRulemaking Portal: http://www.regulations.gov. Follow the online instructions for submitting comments. Once submitted, comments cannot be edited or withdrawn. The EPA may publish any comment received to its public docket. Do not submit electronically any information you consider to be Confidential Business Information (CBI) or other information for which disclosure is restricted by statute. Multimedia submissions (audio, video, etc.) must be accompanied by a written comment. The written comment is considered the official comment and should include discussion of all points you wish to make. The EPA will generally not consider comments or comment contents located outside of the primary submission (i.e., on the web, cloud or other file sharing system). For additional submission methods, the full EPA public comment policy, information about CBI or multimedia submissions, and general guidance on making effective comments, please visit http://www2.epa.gov/​dockets/​commenting-epa-dockets.

FOR FURTHER INFORMATION CONTACT:

Brian K. Thompson, Acting Director, eDiscovery Division, Office of Environmental Protection Agency, U.S. Environmental Protection Agency, Mail Code 2822T, 1200 Pennsylvania Avenue NW, Washington, DC 20460; email, [e-mail]; telephone number, 202-564-4256.

SUPPLEMENTARY INFORMATION:

The U.S. Environmental Protection Agency (EPA) plans to establish a Privacy Act system of records for information collected using its eDiscovery (electronic discovery) Enterprise Tool Suite. Depending on the specific need, the Agency will use a combination of several electronic tools that together assist with the preservation, search, processing, review and production of electronically stored information (ESI). The tool suite will be used to preserve, search, collect, sort and review ESI including email messages, word processing documents, media files, spreadsheets, presentations, scanned documents and data sets in support of legal discovery. The Agency will also use these tools to search for ESI that is responsive to requests for information submitted under FOIA or other formal information requests.

To minimize the risk of compromising the information that is being stored in the system, strict access controls have been imposed. Access to the tool suite containing records is restricted to a limited number of authorized users with the appropriate security clearances and password permissions. Access to the system is further limited by user type. System administrators have full access to the tool suite, including the ability to perform administrative functions. Other users are provided a level of access to the tool suite that is commensurate with their role in the system, allowing them to perform the functions for which they are authorized. Authorized users include federal and contract staff located throughout the country. The system is maintained in secure areas and buildings with physical access controls. The eDiscovery Enterprise Tool Suite is maintained by the Office of Environmental Information and is stored on servers located in Washington, DC, and Durham, NC. Data retrieved are stored on servers and work stations throughout the country. The information contained in the system can be wide-ranging and potentially include emails, documents and other sources of ESI collected from custodians and may contain personally identifiable information. The information in the system will also contain the names and EPA email addresses of EPA employees, contractors, and grantees who have been identified as potential information custodians. Privacy information may be included in the ESI collected and maintained in the system. Individuals for whom records are maintained in the system include, but are not limited to, those individuals who have been identified as potential information custodians in a litigation, investigation, FOIA matter or other formal information request and those individuals whose information may appear in such records. The system will aid in protecting the privacy of individuals from unwarranted disclosure by allowing authorized users of the tool suite to identify files that contain privacy information to be protected from disclosure. EPA will safeguard individuals' privacy in a manner consistent with the Privacy Act, E-Government Act, OMB directives and other federal requirements concerning privacy. Accordingly, the privacy of individuals should not be affected.

SYSTEM NAME AND NUMBER

eDiscovery Enterprise Tool Suite, EPA-63.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

eDiscovery Enterprise Tool Suite, U.S. Environmental Protection Agency, eDiscovery Division, Office of Enterprise Information Programs, Office of Environmental Information, 1200 Pennsylvania Avenue NW, Washington, DC 20460. Records are also maintained in Research Triangle Park, 109 T.W. Alexander Drive, Durham, NC 27709.

SYSTEM MANAGER(S):

Greg Duke, eDiscovery Division, Office of Enterprise Information Programs, Office of Environmental Information, MC 3PM50, 1650 Arch Street, Philadelphia, PA 19103.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

40 U.S.C. 11315 and 44 U.S.C. 3506.

PURPOSE(S) OF THE SYSTEM:

To support the document identification and collection processes for eDiscovery, Freedom of Information Act requests and other formal information requests.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Categories of individuals covered by this system include: (1) All persons subject to a litigation hold due to a “reasonable anticipation of litigation” as determined by EPA; (2) all persons deemed a participant of past or present litigation, investigation or arbitration where EPA is involved, including civil and criminal enforcement cases and defensive litigation; and (3) individuals impacted by Freedom of Information Act (FOIA) requests, litigation or other cases in EPA.

A wide variety of individuals are covered by the system, including individuals who correspond with EPA; provide information to EPA that is subject to discovery, a FOIA request or other formal information request; or are the subject of litigation with EPA; individuals who file complaints or petitions with EPA; and individuals involved in matters with EPA as either plaintiffs or defendants in both civil and criminal matters.

CATEGORIES OF RECORDS IN THE SYSTEM:

• eDiscovery Litigation Hold Files. The litigation hold files contain the names and email addresses of EPA employees and EPA contractors, interns, or grantees who have been provided EPA email addresses and who have been identified as custodians of information that needs to be preserved in the anticipation of litigation. The records in the system will include these individuals' names and EPA email addresses which are entered into the system by designated EPA employees responsible for the administration of litigation holds. Information in the system includes litigation hold notices and answers to certification questions. Reports may be generated from the system that identify whether an individual is designated as a custodian of hold-responsive information, as well as reports containing the information received from individuals in response to questions asked through the litigation hold system.
• eDiscovery Case Tracking Files. The case tracking files contain information about the cases created in response to a litigation, investigation, FOIA matter or other formal information request. Case tracking files may contain the names, phone numbers, organizations, and email addresses of EPA employees and EPA contractors, interns, or grantees who have been identified as custodians in a case or as points of contact for managing the case. Information in the case tracking files may include the location of the information to be searched, search terms and case notes entered into the system by designated EPA employees or contractors responsible for operating EPA's eDiscovery Enterprise Tool Suite.
• eDiscovery Collection Files. The collection files contain information potentially responsive to a litigation, investigation, FOIA matter or other formal information request. The Tool Suite may capture many types of personally identifiable information depending on where that information is stored, including an individual's name; work address and telephone number; home address and telephone number; email addresses; vehicle information; names of individuals associated with a FOIA request or litigation hold; or other related information. The collection files contain all data collected by the tools using the search criteria and may contain, but not be limited to, correspondence (e.g., case coordination reports; memoranda and other records of communication, including electronic communication over email systems or instant messaging among other EPA employees and/or personnel of other federal agencies and outside parties and attachments to those messages or communications); local/shared drive data; information collected or compiled from EPA database systems; spreadsheets of data collections often including personally identifiable information or law enforcement data used to track the process of investigations or focus investigative priorities; records relating to litigation by or against the United States government; records relating to requests for EPA records other than requests under the FOIA and the Privacy Act of 1974; legal documents including complaints, summaries, affidavits, litigation reports, motions, subpoenas and any other court filing or administrative filing, or other related litigation documents; documentary evidence; supporting documents related to the legal and programmatic issues of a case; transcripts of interviews; regulatory history (i.e., permits and reports generated as a result of normal program activity); administrative record material and comments on administrative records; technical support (reports generated to test search criteria); investigative notes; reports requesting permission and use; transcripts of tapes; records checks (personal history, police information, fingerprint cards, photographs); property reports; property obtained and retained by an examiner including documents, personal property and documentary or other evidence; employment records and information related to employment matters; claims and records regarding discrimination, including employment and sex discrimination; personnel matters; contracts and information relating to contracts; manifests and other related investigative information.

RECORD SOURCE CATEGORIES:

EPA employees; employees of federal contractors; employees of other federal agencies and of state, local, tribal and foreign agencies; witnesses; informants; public source materials; and other persons who may have information relevant to the search criteria.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

EPA's General Routine Uses A, C, D, E, F, G, H, I, K, and L apply to this system. Please refer to https://www.federalregister.gov/​documents/​2008/​01/​14/​E8-445/​amendment-to-general-routine-uses for a full explanation of these routine uses (73 FR 2245).

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Records in the system are stored in database applications running on computer servers.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Litigation hold and case tracking files are assigned a case file control number or case name. Information collected from individuals pertaining to particular cases may be retrieved by names of individuals, email addresses, and other unique identifiers.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

Records stored in the system are subject to records schedule 1012 and 0089.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

Computer records are maintained in a secure, password protected computer system. Role-based access controls limit a user's access to the information in the system. Users are provided access to information in the system based on their need to know. Individuals working on a particular matter will be given access to the information related to that matter. The eDiscovery Enterprise Tool Suite is a password protected system requiring all users log in to access the information in the system. The system times out after a period of latency ensuring a user re-authenticates their session with a username and password. The system also maintains a user log that identifies and records persons who access and use the system. Users of EPA systems are required to complete security and privacy training on an annual basis to ensure continued access to the system. All records are maintained in secure areas and buildings with physical access controls.

RECORD ACCESS PROCEDURES:

Request for access must be made in accordance with the procedures described in EPA's Privacy Act regulations at 40 CFR part 16. Requesters will be required to provide adequate identification, such as a driver's license, employee identification card or other identifying document. Additional identification procedures may be required in some instances.

CONTESTING RECORD PROCEDURES:

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Complete EPA Privacy Act procedures are described in EPA's Privacy Act regulations at 40 CFR part 16.

NOTIFICATION PROCEDURES:

Any individual who wants to know whether this system of records contains a record about him or her should make a written request to the Agency Privacy Officer, MC 2831T, 1200 Pennsylvania Avenue NW, Washington, DC 20460.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

For those records within the system collected and maintained pursuant to the Federal Rules of Civil Procedure (FRCP) and/or for the purpose of civil discovery, action or proceeding, 5 U.S.C. 552a(d)(5) will apply, stating that “nothing in this [Act] shall allow an individual access to any information compiled in reasonable anticipation of a civil action or proceeding.” In addition, pursuant to 5 U.S.C. 552a(k)(2), this system is exempt from the following provisions of the Privacy Act, subject to the limitations set forth in that subsection: 5 U.S.C. 552a(c)(3), (d), (e)(1), (e)(4)(G), (e)(4)(H) and (f)(2) through (5). Finally, pursuant to 5 U.S.C. 552a(j)(2), when records are contained in this system related to a criminal enforcement proceeding, this system is exempt from the following provisions of the Privacy Act, subject to the limitations set forth in that subsection: 5 U.S.C. 552a(c)(3), (c)(4), (d), (e)(1), (e)(2), (e)(3), (e)(4)(G), (e)(4)(H), (e)(5), (e)(8), (f)(2) through (f)(5) and (g).

HISTORY:

None.

Dated: May 30, 2018.

Steven Fine,

Principal Deputy Assistant Administrator.