2023-04830. Privacy Act of 1974; System of Records

AGENCY:

Office of Administration, HUD.

ACTION:

Notice of a modified system of records.

SUMMARY:

Pursuant to the provisions of the Privacy Act of 1974, as amended, the Department of the Housing and Urban Development (HUD) is issuing a public notice of its intent to modify the Multifamily Housing Privacy Act system of records for the Comprehensive Servicing and Monitoring System (CSMS). The modification will clarify the location of records; the system manager; authority for maintenance of the system; and routine uses of records in the system.

DATES:

Comments will be accepted on or before April 10, 2023. This proposed action will be effective immediately upon publication. Routine uses will become effective on the date following the end of the comment period unless comments are received which result in a contrary determination.

ADDRESSES:

You may submit comments, identified by docket number or by one of the following methods:

Federal e-Rulemaking Portal: http://www.regulations.gov. Follow the instructions provided on that site to submit comments electronically.

Fax: [phone].

Email: [e-mail].

Mail: Attention: Privacy Office; LaDonne White, Chief Privacy Officer; The Executive Secretariat; 451 Seventh Street SW, Room 10139; Washington, DC 20410-0001.

Instructions: All submissions received must include the agency name and docket number for this rulemaking. All comments received will be posted without change to http://www.regulations.gov. including any personal information provided.

Docket: For access to the docket to read background documents or comments received go to http://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT:

LaDonne White; 451 Seventh Street SW, Room 10139; Washington, DC 20410-0001; telephone number 202-708-3054 (this is not a toll-free number). HUD welcomes and is prepared to receive calls from individuals who are deaf or hard of hearing, as well as individuals with speech or communication disabilities. To learn more about how to make an accessible telephone call, please visit https://www.fcc.gov/​consumers/​guides/​telecommunications-relay-service-trs.

SUPPLEMENTARY INFORMATION:

The Department of Housing and Urban Development (HUD), Office of Finance and Budget maintains the “Comprehensive Servicing and Management System” (CSMS). CSMS is a mixed financial system that is used for property management and loan servicing. HUD is publishing this revised notice to; update system location; system manager; authorities; safeguards; routine uses; to reflect updated information in the sections being revised. The modification of the system of records will have no undue impact on the privacy of individuals and updates follow the records collected.

1. Location—Added the location of backup records.

2. System Manager—Identified new system manager expected to operate under this system.

3. Authorities—Clarified authorities governing Social Security number collection. requirements, which is the United States Housing and Community Development Act of 1987, 42 U.S.C. 3543(a).

4. Administrative and Technical Safeguards—Clarified or updated information about the applicable safeguards to records. Describes role-based access and annual certification.

5. Routine Use—Incorporated three newly established routine uses pertaining to sharing of information externally for data breach remediation purposes; and matching program for use by the Department of the Treasury, Bureau of the Fiscal Service (Fiscal Service), Do Not Pay Business Center (DNP), to detect suspected instances of programmatic fraud, waste, and abuse. Streamlined and added specific routine uses that are applicable to this system of record rather than relying on HUD's previously published blanket routine uses notice.

SYSTEM NAME AND NUMBER:

HUD/DEPT-03 Comprehensive Servicing and Management System.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

Records are maintained at Dynaxis, 1911 Tech Rd, Silver Spring, MD 20904; at a secure data center at the Disaster Recovery Site, 8180 Green Meadows Drive North, Lewis Center, OH 43035-0001.

SYSTEM MANAGER(S):

Cynthia Tilton, Office of Multifamily Asset Management and Portfolio Oversight, HUD HQ 451 7th St. SW, Washington, DC 20410.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

The National Housing Act, 12 U.S.C 1701 et seq., authorizes the loan programs that are serviced by CSMS; the United States Housing Act of 1937, as amended, 42 U.S.C. 1437 et seq.; The Housing and Community Development Amendments of 1981, 12 U.S.C. 2294a; the Stewart B. McKinney Homeless Assistance Amendments Act of 1988 Section 904 as amended, 42 U.S.C. 3544; the United States Housing and Community Development Act of 1987, Section 165, 42 U.S.C. 3543(a), permits the participants to submit their SSNs as a condition of eligibility.

PURPOSES OF THE SYSTEM:

CSMS is a loan servicing, property management, and accounting system. The purpose of the system is to bill and collect funds owed to HUD/FHA, to provide program information about loan repayment and status, to manage investment of reserve for replace funds, to process and reimburse property managers or vendors for expenses incurred in managing multifamily properties owned by the Department, to track lease information for tenants living in HUD-owned properties, and to account for all transactions on this portfolio. CSMS is a subsidiary ledger to the FHA's general ledger. CSMS provides servicing for loans acquired through the payment of an insurance claims and loans from the Mark to Market and Demonstration preservation programs.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Mortgagors, billing agents, vendors who are local businesses involved in property management or inspection and tenants, federal employees.

CATEGORIES OF RECORDS IN THE SYSTEM:

Property names; Addresses; Phone numbers; Email addresses; Borrower's TIN/Social Security Numbers; Financial information (institutional information, routing, account numbers and account type; Reserve for Replacement escrow accounts; accounting data including debits and credits to HUD accounts based on transaction events; Collection history; Mortgagee-in-Possession activity; loan termination data; HUD-Owned Property/Tenant: Names; addresses; Email addresses; Social Security Number; Marital status; Gender; Bid packages; Closing activities; Vendor/business partner (financial information, TIN/SSN, routing, account numbers, small business identifier.

RECORD SOURCE CATEGORIES:

Records in the system are obtained from HUD employees and their contractors who deal directly with the mortgagors, billing agents, vendors, and tenants. Information is also obtained from Integrated Real Estate Management System. All other data is collected from FHA Subsidiary ledger.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

(A) To a congressional office from the record of an individual, in response to an inquiry from the congressional office made at the request of that individual.

(B) To Federal agencies, non-Federal entities, their employees, and agents (including contractors, their agents or employees; employees or contractors of the agents or designated agents); or contractors, their employees or agents with whom HUD has a contract, service agreement, grant, cooperative agreement, or computer matching agreement for the purpose of: (1) Detection, prevention, and recovery of improper payments; (2) detection and prevention of fraud, waste, and abuse in major Federal programs administered by a Federal agency or non-Federal entity; and (3) detection of fraud, waste, and abuse by individuals in their operations and programs, but only to the extent that the information shared is necessary and relevant to verify pre-award and prepayment requirements prior to the release of Federal funds or to prevent and recover improper payments for services rendered under programs of HUD or of those Federal agencies and non-Federal entities to which HUD provides information under this routine use.

(C) To contractors, grantees, experts, consultants, Federal agencies, and non-Federal entities, including, but not limited to, State and local governments and other research institutions or their parties, and entities and their agents with whom HUD has a contract, service agreement, grant, cooperative agreement, or other agreement, for the purposes of statistical analysis and research in support of program operations, management, performance monitoring, evaluation, risk management, and policy development, or to otherwise support the Department's mission. Records under this routine use may not be used in whole or in part to make decisions that affect the rights, benefits, or privileges of specific individuals. The results of the matched information may not be disclosed in identifiable form.

(D) To contractors, grantees, experts, consultants and their agents, or others performing or working under a contract, service, grant, cooperative agreement, or other agreement with HUD, when necessary to accomplish an agency function related to a system of records. Disclosure requirements are limited to only those data elements considered relevant to accomplishing an agency function.

(E) To appropriate federal, state, local, tribal, or other governmental entities, with the approval of the Chief Privacy Officer, when HUD is aware of a need to use relevant data for purposes of testing new technology.

(F) To appropriate agencies, entities, and persons when (1) HUD suspects or has confirmed that there has been a breach of the system of records, (2) HUD has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, HUD (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HUD's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

(G) To another Federal agency or Federal entity when HUD determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

(H) To appropriate Federal, State, local, tribal, or other governmental agencies or multilateral governmental organizations responsible for investigating or prosecuting the violations of, or for enforcing or implementing, a statute, rule, regulation, order, or license, where HUD determines that the information would assist in the enforcement of civil or criminal laws when such records, either alone or in conjunction with other information, indicate a violation or potential violation of law.

(I) To a court, magistrate, administrative tribunal, or arbitrator in the course of presenting evidence, including disclosures to opposing counsel or witnesses in the course of civil discovery, litigation, mediation, or settlement negotiations, or in connection with criminal law proceedings; when HUD determines that use of such records is relevant and necessary to the litigation and when any of the following is a party to the litigation or have an interest in such litigation: (1) HUD, or any component thereof; or (2) any HUD employee in his or her official capacity; or (3) any HUD employee in his or her individual capacity where HUD has agreed to represent the employee; or (4) the United States, or any agency thereof, where HUD determines that litigation is likely to affect HUD or any of its components.

(J) To any component of the Department of Justice or other Federal agency conducting litigation or in proceedings before any court, adjudicative, or administrative body, when HUD determines that the use of such records is relevant and necessary to the litigation and when any of the following is a party to the litigation or have an interest in such litigation: (1) HUD, or any component thereof; or (2) any HUD employee in his or her official capacity; or (3) any HUD employee in his or her individual capacity where the Department of Justice or agency conducting the litigation has agreed to represent the employee; or (4) the United States, or any agency thereof, where HUD determines that litigation is likely to affect HUD or any of its components.

(K) To the IRS for reporting of payments, forgiveness of debt, and property sales under section 6109 of the Internal Revenue Code.

(L) To banks holding escrow monies for the purpose of establishing interest bearing accounts and reporting of interest payments to the IRS under section 6109 of the Internal Revenue Code.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Electronic and paper records.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Borrowers Name and TIN/SSN.

POLICIES AND PRACTICIES FOR RETENTION AND DISPOSAL OF RECORDS:

Destroy 6 years after final payment or cancellation, but longer retention is authorized if required for business use. Destroy 3 years after lease termination, lapse, reassignment, rejection of application, cancellation of lease, or conclusion of litigation, as applicable.

CSMS Disposition information is:

• HUD Schedule 10, item 7, NC1-207-78-12, item 7
• GRS 3.2, item 51, DAA-GRS-2013-0006-0008
• GRS 5.2, item 20, DAA-GRS-2017-0003-0002
• GRS 3.2, item 30, DAA-GRS-2013-0006-0003
• GRS 3.2, item 40 and 41, Item 40_DAA-GRS-2013-0006-0005 and Item 41_DAA-GRS-2013-0006-0006
• GRS 3.1, item 10 and 11, DAA-GRS-2013-0005-0006 and DAA-GRS-2013-0005-0007
• GRS 3.1, item 51, DAA-GRS-2013-0005-003

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

Access to CSMS is by password and user ID and limited to authorized users. Paper records are maintained in locked drawer or in file cabinets at 11911 Tech Road, Silver Spring, MD 20904. Role-based access levels or assignment roles are restricted to those who have a need-to-know. When first gaining access to CSMS and on an annual basis, all users must agree to the systems “Rules of Behavior” which specify handling of personal information and any physical records.

RECORD ACCESS PROCEDURES:

Individuals seeking to determine whether this System of Records contains information on themselves should address written inquiries to the Department of Housing Urban and Development, 451 7th Street SW, Washington, DC. For verification, individuals should provide full name, current address, and telephone number. In addition, the requester must provide either a notarized statement or an unsworn declaration made under 24 CFR 16.4, in the following format:

If executed outside the United States: “I declare (or certify, verify, or state) under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on (date). (Signature).” If executed within the United States, its territories, possessions, or commonwealths: “I declare (or certify, verify, or state) under penalty of perjury that the foregoing is true and correct. Executed on (date). (Signature).” More information regarding HUD's procedures for accessing records in accordance with the Privacy Act can be found at 24 CFR 16.4, “Protection of Privacy and Access to Individual Records Under the Privacy Act of 1974.”

CONTESTING RECORD PROCEDURES:

The HUD rule for accessing, contesting, and appealing agency determinations by the individual concerned are published in 24 CFR part 16.8 or may be obtained from the system manager.

NOTIFICATION PROCEDURES:

Individuals seeking to determine whether information about themselves is contained in this system should address written inquiries to the Department of Housing Urban Development Office of Multifamily Housing, 451 7th Street SW, Washington, DC 20410-0001. For verification purposes, individuals should provide full name, office or organization where currently assigned, if applicable, and current address and telephone number. In addition, the requester must provide either a notarized statement or an unsworn declaration made in accordance with 24 CFR part 16 in the following format:

If executed outside the United States: “I declare (or certify, verify, or state) under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. executed on (Date). (Signature).”

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

FR-7009-N-01, 2/20/2018, 83 FR 7208.

LaDonne White,

Chief Privacy Officer, Office of Administration.