2019-19713. Privacy Act of 1974; System of Records

AGENCY:

Office of Chief information Officer, U.S. Department of Housing and Urban Development.

ACTION:

Notice of amended Privacy Act System of Records.

SUMMARY:

In accordance with the Privacy Act of 1974, 5 U.S.C. 552a, the Department of Housing and Urban Development, Office of Chief Information Office, is giving notice that it intends to amend one of its systems of records published in the Federal Register, FR-6009-N-02. This update expands the existing system of records notice to authorize HUD's Enterprise Data Management (EDM) to collect and maintain information for mandatory transparency reporting requirements, such as the Federal Funding Accountability and Transparency Act (FFATA) and the Digital Accountability and Transparency Act (DATA Act). HUD is continuing to upgrade its data management, data warehousing, data mining and data security capabilities from current outdated legacy databases to the EDM platform.

DATES:

October 15, 2019.

Comments Due Date: October 15, 2019.

ADDRESSES:

You may submit comments, identified by docket number and title, by one of the following methods:

Federal e-Rulemaking Portal: http://www.regulation.gov. Follow the instructions provided on that site to submit comments electronically.

Fax: [phone].

Email: [e-mail].

Mail: Attention: Housing and Urban and Development, The Privacy Office; John Bravacos, Chief Privacy Officer (Acting), 451 Seventh Street SW, Room 10139, Washington, DC 20410.

Instructions: All submission received must include the agency name and docket number for this rulemaking. All comments received will be posted without change to http://www.regulation.gov,, including any personal information provided.

Docket: For access to the docket to read background documents or comments received go to http://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT:

The Privacy Office, 451 Seventh Street SW, Room 10139, Washington, DC 20410, telephone number 202-708-3054 (this is not a toll-free number). Individuals who are hearing- and speech-impaired may access this telephone number via TTY by calling the Federal Relay Service at 800-877-8339 (this is a toll-free number).

SUPPLEMENTARY INFORMATION:

In accordance with the Privacy Act of 1974, 5 U.S.C. 552a, in June 2017, the Department of Housing and Urban Development (HUD) Office of Chief Information Officer (OCIO) established a new HUD system of records titled, “Enterprise Data Management (EDM) System of Records.” This system of records is operated by HUD's OCIO, and it will be developed in several phases. The initial phase included personally identifiable information (PII) about borrowers of Federal Housing Administration (FHA)-insured single-family mortgages, employees of FHA-approved lending institutions, third-parties associated with FHA/HUD transactions such as appraisers and HUD personnel associated with single family transactions.

OCIO has established an EDM environment, which includes a modern “Data Lake”; a centralized data environment to onboard HUD data for use in analytical reporting. The EDM also serves as the centralized environment for systems to consume data from HUD systems (eliminating point to point interfaces). In accordance with Section 203, National Housing Act, Public Law 73-479; and 42 U.S.C. 3543, titled “Preventing fraud and abuse in Department of Housing and Urban Development programs” enacted as part of the Housing and Community Development Act of 1987, the EDM and data lake enables HUD data consumers to gain new insights that will allow HUD to better identify trends and previously unknown risk drivers, thus strengthening its risk management and fraud prevention framework.

EDM extracts data from multiple source systems for analysis and reporting. EDM provides query and reporting tools that aid in supporting HUD's oversight activities, market and economic assessment, public and stakeholder communication, financial and transparency reporting, planning and performance evaluation, policies and guidelines promulgation, and monitoring and enforcement. Making data available from the HUD source systems will involve Data Extraction, Transformation, and Load (ETL) into the EDM environment. The type of HUD source system (e.g., mainframe, relational database management system (RDBMS), hierarchical) will determine the approach and the tools that will be used to extract the data. EDM extracts data from multiple source systems for analysis and reporting. The following lists the type of information collected from Source Systems for the initial phase of EDM:

• Mortgagors: Name, addresses, date of birth, social security number, and racial/ethnic background (if disclosed) which are supplied by lenders through Automated Underwriting Systems during the mortgage application and underwriting process.
• Parties Involved with Transaction: Name, addresses, and identifying numbers which are supplied by the lender or the individual.
• Mortgage Details: Data regarding current and former FHA insured mortgages which includes underwriting data, such as: Loan-to-value ratios and expense ratios; original terms, such as: Mortgage amount, interest rate, term in months; status of the mortgage insurance; and history.
• Aggregated measures of the data stated above to enable statistical reporting and analysis of trends.

The following lists the type of information collected and maintained for the update of EDM to support transparency reporting requirements, such as FFATA and the DATA Act:

• Summary Financial Information—Treasury Account Symbols, United States Standard General Ledger (USSGL) Account Balances, Program Activity Codes and Names, and Budget Object Class Codes.
• Award Financial Information—Parent Award Identification Numbers, Procurement Instrument Identification Numbers, Contract Obligation and De-obligation Amounts.
• Procurement Information—Award Recipients, Recipient Address Information, and other Demographic Indicators sourced from the Federal Procurement Data System (FPDS).
• DATA Act Review and Submission Data—DATA Act Broker Submission ID, Warning and Error Codes, HUD Review Details (Timestamp, Reviewer ID).

SYSTEM NAME AND NUMBER:

HUD/OCIO-002 Enterprise Data Management (EDM).

SECURITY CLASSIFICATION:

Not classified.

SYSTEM LOCATION:

EDM is hosted at the Department of Housing and Urban Development, 451 Seventh Street SW, Washington, DC 20410.

SYSTEM MANAGER(S):

Russel Burns, Chief Technology Officer (Acting), 451 7th Street SW, Room 4250 Washington, DC 20410 202-402-3182.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

The Enterprise Data Management environment is authorized by Chapter 113 of Title 40 of the US Code, (40 U.S.C. 11311 et seq.); the Department of Housing and Urban Development Appropriations Act, 2019 (Title II, Division G, Pub. L. 116-6); and in accordance with the Data Accountability and Transparency Act of 2014 (Pub. L. 113-101). The system is maintained in accordance with Section 203, National Housing Act, Public Law 73-479; and 42 U.S.C. § 3543, titled “Preventing fraud and abuse in Department of Housing and Urban Development programs” enacted as part of the Housing and Community Development Act of 1987, which permits the collection of Social Security Numbers.

PURPOSE(S) OF THE SYSTEM:

EDM replaces HUD's current data storage, retrieval and warehousing capabilities. EDM will be implemented in phases across HUD, and the first phase was to directly support the new Loan Review System (LRS). It collects data from certain specified source systems and returns it to LRS. Subsequent phases will collect data from other source systems, and ultimately will replace all existing data warehouses across HUD. This SORN update is to reflect additional source systems required for FFATA and the DATA Act, as well as update the categories of data collected to support these transparency reporting requirements. No additional information about individuals is collected or reported as part of this update.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

The initial phase of EDM covered individuals who have obtained a mortgage insured under FHA's single family mortgage insurance programs, for example:

• Individuals who have assumed such a mortgage;
• Individuals involved in appraising, underwriting, or servicing the mortgage (commonly referred to as “mortgagee/lender”).

This SORN update for EDM covers transparency reporting legislation requirements—FFATA, and the DATA Act, which requires reporting of summary financial information, contract details, and financial assistance (loan and grant) transaction information. HUD transparency reporting is published on an external website, USASpending.gov. No information regarding individuals is collected in EDM for FFATA and DATA Act reporting purposes, and governing policy from OMB is such that PII is protected and not reported publicly.

CATEGORIES OF RECORDS IN THE SYSTEM:

The initial categories of records maintained by the system included:

• Appraiser: First Name, Last Name, Middle Name, Suffix.
• Case Borrower(s): Borrower(s) Full Name, Borrower(s) Social Security number, Non-Borrowing Spouse Social Security number
• Loan Officer: First Name, Last Name, Middle Name.
• Case Property: Basement Code, Neighborhood Percentage Owned, Neighborhood Predominate, Price, Subdivision Indicator, Property Acquisition Date, Property Street, Property Conversion Type, Rural Neighborhood Code, Neighborhood Single Family Home Percentage, Subdivision Lot Indicator, Building Type, Date of Sale or Transfer, Sale Amount, Year Built, City, Zip, Geocode Flag, Underserved Indicator, Block, Lot, House Number, Street Number. FHA Case Information: Federal Housing Administration (FHA) Case Number, Case Established Date, Case Reinstatement Date, Case Type, Originating Mortgage ID, Sponsor Mortgagee ID, Loan Officer Nationwide Multistate Licensing System (NMLS) ID, Underwriter Name, Underwriter ID. Mortgagee (Lender) Branch: Branch Type, Branch ID, Mortgagee Institution ID, Mortgagee Institution Name, Mortgagee Institution Type, Mortgagee Nationwide Multistate Licensing System (NMLS) ID, Mortgagee Status, HUD Employees: Names and identification of all HUD employees who have access to the system records. Also, identification information is stored for employees who work with mortgage applications through FHA Connection. Servicing Status: Servicing Status, Claims, and Indemnification Agreement. New records collected and maintained by the system to support FFATA and DATA Act reporting include the following: Summary Budget and Financial Information—Treasury Account Symbol, Program Activities, Budget Object Class, and Obligation and Outlay information, General Ledger balances.
• Contract Information—Contract ID, Obligation Amount, De-obligation Amount, Parent Award ID, Contract Recipient, Contractor Address and Demographic Information, Contract Award Type.
• Title I Insurance, Home Equity Conversation Mortgage (HECM), and Multifamily Loan Endorsement Data—FHA Case/Project Number, Lender ID, Loan Amount, Section of Act Code, Risk Category, Origination Date.
• DATA Act Review and Submission Data—DATA Act Broker Submission ID, Warning and Error Codes, HUD Review Details (Timestamp, Reviewer ID).

RECORD SOURCE CATEGORIES:

Mortgagors, appraisers, mortgagee staff, underwriters, and HUD employees provide data to the originating source systems then pass their data to the Enterprise Data Warehouse used in EDM:

• A43—Single Family Insurance System (SFIS)
• A43C—Single Family Claims Subsystem (SFCS)
• F17—Computerized Homes Underwriting Management System (CHUMS)
• F17T—TOTAL Mortgage Scorecard (TOTAL)
• F42D—Single Family Default Monitoring System (SFDMS)
• P2710 Home Equity Reverse Mortgage Information System (HERMIT)
• P278—Lender Electronic Assessment Portal (LEAP)
• P303—Loan review System (LRS)

To support DATA Act reporting, the following systems will provide data to EDM:

• P085—Comprehensive Servicing and Monitoring System (CSMS)
• F24A—Development Application Processing System (DAP)
• P013—FHA Subsidiary Ledger (FHA-SL)
• A80S—Single Family Acquired Asset Management System (SAMS)
• F72—Title I Insurance and Claims System (TIIS)
• A15—Geocoding Service Center (GSC)
• P237—Ginnie Mae Financial and Accounting System (GFAS)

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

In addition to those disclosures generally permitted under 5 U.S.C. Section 552a(b) of the Privacy Act, all or a portion of the records or information in this system may be disclosed to authorized entities, as determined to be relevant and necessary, outside the Department of Housing and Urban Development (HUD) as a routine use pursuant to 5 U.S.C. 552a(b)(3):

1. To appropriate agencies, entities, and persons when (1) HUD suspects or has confirmed that there has been a breach of the system of records, (2) HUD has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, HUD (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HUD's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

2. To another Federal agency or Federal entity, when HUD determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

3. To the National Archives and Records Administration (NARA) and the General Services Administration (GSA) for records having sufficient historical or other value to warrant its continued preservation by the United States Government, or for inspection under the authority of Title 44, Chapter 29, of the United States.

4. To a congressional office from the record of an individual in response to an inquiry from that congressional office made at the request of the individual.

5. To contractors and their agents, grantees, experts, consultants, and others performing or working on a contract, service, grant, cooperative agreement, or other assignment for HUD, when necessary to accomplish an agency function related to this system of records. Individuals provided information under this routine use are subject to the same Privacy Act requirements and limitations on disclosure as are applicable to HUD officers and employees.

6. To contractors, grantees, experts, consultants, Federal agencies, and non-Federal entities, including, but not limited to, State and local governments and other research institutions or their parties, and entities and their agents with whom HUD has a contract, service agreement, grant, or cooperative agreement, when necessary to accomplish an agency function related to a system of records, for the purposes of statistical analysis and research in support of program operations, management, performance monitoring, evaluation, risk management, and policy development, or to otherwise support the Department's mission. Records under this routine use may not be used in whole or in part to make decisions that affect the rights, benefits, or privileges of specific individuals. The results of the matched information may not be disclosed in identifiable form.

7. To the American Public in support of Public Law 113-01, the Digital Accountability and Transparency Act of 2014 (DATA Act) and Public Law 109-282, the Federal Funding Accountability and Transparency Act of 2006 (FFATA), for the purposes of reviewing reliable and consistent reporting of federal spending data of federal agency obligations and expenditures through the publicly accessible website, USASpending.gov.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

EDM will be stored in compliance with 36 CFR 1236.10 regulations on recordkeeping management controls in a Federal Risk and Authorization Management Program (FedRAMP) compliant network. There are no paper records associated with EDM.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Information is currently retrieved from EDM using a series of key identifiers (e.g., FHA Case Number, Project Number, etc.). User access to query information in the EDM does not exist. EDM supports only system-to-system interfaces.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

Electronic information maintained in EDM is retrieved from originating recordkeeping systems and is retained indefinitely for future access. This information does not meet the federal definition of a record as it is not evidence of the organization, functions, policies, decisions, procedures, operations, or other activities. This information is duplicated copies of record content preserved for convenience to facilitate new record creation 44 U.S.C. 3301. As subsequent phases of EDM are completed, specific retention periods and disposal procedures will be evaluated and defined for those records in accordance with the HUD Records Schedule in the HUD Records Disposition Schedules Handbook (2225.6), or the NARA publication, General Records Schedule.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

HUD has developed a system security plan of controls for ensuring and protecting Microsoft Azure Government Cloud in accordance with applicable laws. End users cannot directly access the Enterprise Data Warehouse in EDM. Data exchange with other HUD systems is precisely specified and occurs only through secure interfaces. Encryption of data both at rest and in motion is enabled on a selective basis. EDM is subject to compliance with all Federal requirements and adheres to its approved system security plans (SSP).

RECORD ACCESS PROCEDURES:

For Information, assistance, or inquiries about records, contact John Bravacos, Senior Agency Official for Privacy, 451 Seventh Street SW, Room 10139, Washington, DC 20410, telephone number [phone]. When seeking records about yourself from this system of records or any other HUD system of records, your request must conform with the Privacy Act regulations set forth in 24 CFR part 16. You must first verify your identity, by providing your full name, address, and date and place of birth. You must sign your request, and your signature must either be notarized or submitted under 28 U.S.C. 1746, a law that permits statements to be made under penalty of perjury as a substitute for notarization. If your request is seeking records pertaining to another living individual, you must include a statement from that individual certifying their agreement for you to access their records. Without the above information, the HUD FOIA Office may not conduct an effective search, and your request may be denied due to lack of specificity or lack of compliance with regulations.

CONTESTING RECORD PROCEDURES:

The Department's rules for contesting contents of records and appealing initial denials appear in 24 CFR part 16, Implementation of the Privacy Act of 1974. Additional assistance may be obtained by contacting John Bravacos, Senior Agency Official for Privacy, 451 Seventh Street SW, Room 10139, Washington, DC 20410, or the HUD Departmental Privacy Appeals Officers, Office of General Counsel, Department of Housing and Urban Development, 451 Seventh Street SW, Room 10110, Washington DC 20410.

NOTIFICATION PROCEDURES:

Individuals seeking notification of and access to any record contained in this system of records, or seeking to contest its content, may submit a request in writing to the Privacy Office at the address provided above or to the component's FOIA Officer, whose contact information can be found at http://www.hud.gov/​foia under “contact.” If an individual believes more than one component maintains Privacy Act records concerning him or her, the individual may submit the request to the Senior Agency Official for Privacy, HUD, 451 Seventh Street SW, Room 10139, Washington, DC 20410.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

EDM SORN was originally published in: DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT [Docket No. FR-6009-N-02] Privacy Act of 1974: Enterprise Data Management (EDM) System of Records.

Dated: August 26, 2019.

John G. Bravacos,

Senior Agency Official for Privacy.