2024-16354. Privacy Act of 1974; System of Records

Document Headings

Document headings vary by document type but may contain the following:

1. the agency or agencies that issued and signed a document
2. the number of the CFR title and the number of each part the document amends, proposes to amend, or is directly related to
3. the agency docket number / agency internal file number
4. the RIN which identifies each regulatory action listed in the Unified Agenda of Federal Regulatory and Deregulatory Actions

See the Document Drafting Handbook for more details.

Environmental Protection Agency

1. [FRL-11784-01-OMS]

AGENCY:

Office of the Administrator, Office of the Executive Secretariat, Environmental Protection Agency (EPA).

ACTION:

Notice of a modified system of records.

SUMMARY:

The U.S. Environmental Protection Agency's (EPA) Office of the Administrator, Office of the Executive Secretariat is giving notice that it proposes to modify a system of records pursuant to the provisions of the Privacy Act of 1974. EPA-22, the agency's correspondence tracking system formerly known as the Correspondence Management System is being replaced by a new application called Quill, and the SORN is being further modified to include additional workflow processes and reflect corresponding updates.

DATES:

Persons wishing to comment on this system of records notice must do so by September 11, 2024. New or Modified routine uses for this modified system of records will be effective September 11, 2024.

ADDRESSES:

Submit your comments, identified by Docket ID No. EPA-HQ-OEI-2004-0003, by one of the following methods:

Federal eRulemaking Portal: https://www.regulations.gov. Follow the online instructions for submitting comments.

Email: [e-mail]. Include the Docket ID number in the subject line of the message.

Fax: [phone].

Mail: OMS Docket, Environmental Protection Agency, Mail Code: 2822T, 1200 Pennsylvania Avenue NW, Washington, DC 20460.

Hand Delivery: OMS Docket, EPA/DC, WJC West Building, Room 3334, 1301 Constitution Avenue NW, Washington, DC 20460. Such deliveries are accepted only during the Docket's normal hours of operation, and special arrangements should be made for deliveries of boxed information.

Instructions: Direct your comments to Docket ID No. EPA-HQ-OEI-2004-0003. The EPA's policy is that all comments received will be included in the public docket without change and may be made available online at https://www.regulations.gov, including any personal information provided, unless the comment includes information claimed to be Controlled Unclassified Information (CUI) or other information for which disclosure is restricted by statute. Do not submit information that you consider to be CUI or otherwise protected through https://www.regulations.gov. The https://www.regulations.gov website is an “anonymous access” system for the EPA, which means the EPA will not know your identity or contact information. If you submit an electronic comment, the EPA recommends that you include your name and other contact information in the body of your comment. If the EPA cannot read your comment due to technical difficulties and cannot contact you for clarification, the EPA may not be able to consider your comment. If you send an email comment directly to the EPA without going through https://www.regulations.gov, your email address will be automatically captured and included as part of the comment that is placed in the public docket and made available on the internet. Electronic files should avoid the use of special characters, any form of encryption, and be free of any defects or viruses. For additional information about the EPA public docket, visit the EPA Docket Center homepage at https://www.epa.gov/​dockets.

Docket: All documents in the docket are listed in the https://www.regulations.gov index. Although listed in the index, some information is not publicly available, e.g., CUI or other information for which disclosure is restricted by statute. Certain other material, such as copyrighted material, will be publicly available only in hard copy. Publicly available docket materials are available either electronically in https://www.regulations.gov or in hard copy at the OMS Docket, EPA/DC, WJC West Building, Room 3334, 1301 Constitution Avenue NW, Washington, DC 20460. The Public Reading Room is normally open from 8:30 a.m. to 4:30 p.m., Monday through Friday excluding federal holidays. The telephone number for the Public Reading Room is [phone], and the telephone number for the OMS Docket is [phone]. Further information about EPA Docket Center services and current operating status is available at https://www.epa.gov/​dockets.

FOR FURTHER INFORMATION CONTACT:

Director Eric Wachter, Office of the Executive Secretariat, U.S. Environmental Protection Agency, 1200 Pennsylvania Avenue NW, Washington, DC 20460; Telephone: [phone]; Email: [e-mail].

SUPPLEMENTARY INFORMATION:

The EPA is updating EPA-22, its correspondence tracking and workflow management application and is replacing the legacy application with a new system called Quill. Quill is designed to track, route and store incoming and outgoing agency correspondence from and to members of the public, private, and governmental sectors. While correspondence processing is Quill's main function, other workflow processes will be tracked in this system as well, including Federal Advisory Committee Act (FACA) packages and inquiries submitted through the EPA's public-facing websites. EPA-22 is also being modified to reflect corresponding updates to the system, including system owner and location. ( Note: Two categories of correspondence that will not, in most cases, be logged into the system are (1) comments to a docket, and (2) Freedom of Information and Privacy Act requests. The Agency maintains separate applications to log and track such correspondence.)

SYSTEM NAME AND NUMBER:

Quill, EPA-22.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

Office of the Administrator, Office of the Executive Secretariat, 1200 Pennsylvania Avenue NW, Washington, DC 20460; the system is housed in the Microsoft Azure Cloud residing in the EPA's Office-365 Government Community Cloud (GCC), which is managed by Microsoft. These cloud locations are in the U.S. states of Virginia, Texas, Arizona, and Iowa. Paper records are maintained in the relevant EPA offices to which the correspondence was sent.

SYSTEM MANAGER(S):

Quill System Administrator, Office of the Executive Secretariat, U.S. Environmental Protection Agency, 1200 Pennsylvania Avenue NW, Washington, DC 20460 Telephone: [phone]; Email: [e-mail].

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

5 U.S.C. 301 Departmental Regulations; 40 CFR, et. seq.; 44 U.S.C. 3101.

PURPOSE(S) OF THE SYSTEM:

Quill is the EPA's correspondence tracking and workflow management application. The purpose of the system is to manage incoming and outgoing correspondence in all EPA program and regional offices. Quill makes the EPA more efficient in managing and responding to correspondence internally, with the White House, Congress, state and local governments and responding to the needs of the public in a timely manner.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Individuals who correspond with the EPA or any of its employees in their official capacity; all individuals to whom correspondence is addressed by the EPA or any of its employees in their official capacity; and individuals whose correspondence is referred or addressed to the EPA by the President, the Vice President, Congress, another federal agency, or state, tribal and local governments.

CATEGORIES OF RECORDS IN THE SYSTEM:

Name, title, organization, address, email and telephone number, as applicable and present in any correspondence addressed to or from the agency or any of its employees in their official capacity. Complete records may include metadata about the correspondence that facilitates tracking and record retrieval, a scanned image or electronic copy of the incoming communication, draft(s) of the response document, supporting documents or other attachments, and a scanned image or electronic copy of the outgoing signed response.

RECORD SOURCE CATEGORIES:

Sources include individuals who address correspondence to the agency or any of its employees in their official capacities; agency employees preparing responses to incoming correspondence or who generate original correspondence in their official capacities; and the White House and other federal, state, Tribal and local governments agencies that referred or addressed correspondence to the agency.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

The routine uses below are both related to and compatible with the original purpose for which the information was collected. The following general routine uses apply to this system (86 FR 62527): A, B, C, D, E, F, G, H, I, J, K, L, M.

Additional routine uses that apply to this system are:

1. disclosure to another federal governmental agency when it is determined that a response by that agency is more appropriate than a response by the U.S. Environmental Protection Agency.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Electronic records are maintained on cloud storage devices and are stored in Microsoft Power Apps. Paper records are maintained in the relevant EPA offices to which the correspondence was sent.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

All Quill records are full-text indexed and are retrieved by name, organization, physical address, email address, phone number or case number. The case number is the unique alphanumeric identifier for the individual set of documents and associated metadata for each communication or unit of work tracked in the system.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

EPA-22 will retain and dispose of these records in accordance with EPA Records Schedule 0077. The National Archives and Records Administration (NARA) Disposal Authority DAA-GRS-2016-0002-0001 requires that access and disclosure request files should be closed 6 years after final agency action or 3 years after final adjudication by the courts, whichever is later. Further, these records are to be destroyed after file closure. Additionally, NARA Disposal Authority DAA-GRS-2019-0001-0002 requires that “records tracking and controlling access to protected information” should be closed 2 years after last form entry, reply, or submission; when associated documents are declassified, decontrolled, or destroyed; or when an individual's authorization expires, whichever is appropriate. These records are to be destroyed after file closure.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

Security controls used to protect personal sensitive data in Quill are commensurate with those required for an information system rated MODERATE for confidentiality, integrity and availability as prescribed in National Institute of Standards and Technology (NIST) Special Publication, 800-53, “Security and Privacy Controls for Information Systems and Organizations,” Revision 5.

1. Administrative Safeguards: The Quill Rules of Behavior state the use of the system and users are instructed to only enter correspondence-related information. Privacy training is conducted annually during the Information Security and Privacy Training (ISPAT) that is provided by the agency. During end-user training provided by the Quill support staff, end users receive a summary refresher of the ISPAT training. Only EPA employees and contractors may request access to the system, which means they (1) have passed a background check ( e.g., Public Trust SF-85) appropriate to their responsibilities; and (2) receive annual Information Security and Privacy Training and Records Management Training.

2. Technical Safeguards: The access controls are documented in the system Accounts Management Standard Operation Procedure and are maintained by the Quill System Owner in the Office of the Executive Secretariat. All data is encrypted in transit and at rest.

3. Physical Safeguards: Electronic records are maintained in a cloud-based system that resides in the EPA's Office-365 Government Community Cloud (GCC), which is managed by Microsoft. The Microsoft Office-365 Cloud is FedRamp certified. Maintenance of physical records is the responsibility of each office that received the correspondence.

RECORD ACCESS PROCEDURES:

All requests for access to personal records should cite the Privacy Act of 1974 and reference the type of request being made ( i.e., access). Requests must include: (1) the name and signature of the individual making the request; (2) the name of the Privacy Act system of records to which the request relates; (3) a statement whether a personal inspection of the records or a copy of them by mail is desired; and (4) proof of identity. A full description of the EPA's Privacy Act procedures for requesting access to records is included in the EPA's Privacy Act regulations at 40 CFR part 16.

CONTESTING RECORD PROCEDURES:

Requests for correction or amendment must include: (1) the name and signature of the individual making the request; (2) the name of the Privacy Act system of records to which the request relates; (3) a description of the information sought to be corrected or amended and the specific reasons for the correction or amendment; and (4) proof of identity. A full description of the EPA's Privacy Act procedures for the correction or amendment of a record is included in the EPA's Privacy Act regulations at 40 CFR part 16.

NOTIFICATION PROCEDURES:

Individuals who wish to be informed whether a Privacy Act system of records maintained by the EPA contains any record pertaining to them should make a written request to the U.S. Environmental Protection Agency, Attn: Agency Privacy Officer, MC 2831T, 1200 Pennsylvania Avenue NW, Washington, DC 20460, or by email at [e-mail]. A full description of the EPA's Privacy Act procedures is included in the EPA's Privacy Act regulations at 40 CFR part 16.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

69 FR 60997 FR 30045 (October 14, 2004)

Vaughn Noga,

Senior Agency Official for Privacy.