2024-10858. Social Security Number Fraud Prevention Act of 2017

AGENCY:

U.S. Department of Energy.

ACTION:

Final rule.

SUMMARY:

The Department of Energy (DOE or Department) revises its regulations regarding records maintained on individuals under the Privacy Act. The revisions would clarify and update procedural requirements pertaining to the inclusion of a Social Security number (SSN) on documents that the Department sends by mail. These revisions are necessary to implement the SSN Fraud Prevention Act of 2017's restriction on the inclusion of SSNs on documents sent by mail by the Federal Government. Additionally, the Department proposes to maintain a publicly available list authorizing certain designated documents to include SSNs if: inclusion is necessary; and the documents are requested by individuals outside DOE or other Federal agencies.

DATES:

This final rule is effective on June 20, 2024.

FOR FURTHER INFORMATION CONTACT:

Kyle David, U.S. Department of Energy, 1000 Independence Avenue SW, Office 8H-085, Washington, DC 20585; facsimile: [phone]; email: [e-mail], telephone: [phone].

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Authority and Background

A. Authority

B. Background

II. Discussion

III. Summary of Public Comments

IV. Section 1008.22 Analysis

V. Procedural Issues and Regulatory Review

A. Review Under Executive Orders 12866, 13563, and 14094

B. Review Under the Regulatory Flexibility Act

C. Review Under the Paperwork Reduction Act of 1995

D. Review Under the National Environmental Policy Act of 1969

E. Review Under Executive Order 12988

F. Review Under Executive Order 13132

G. Review Under Executive Order 13175

H. Review Under the Unfunded Mandates Reform Act of 1995

I. Review Under Executive Order 12360

J. Review Under Executive Order 13211

K. Review Under the Treasury and General Government Appropriations Act, 1999

L. Review Under the Treasury and General Government Appropriations Act, 2001

M. Congressional Notification

VI. Approval by the Office of the Secretary of Energy

I. Authority and Background

A. Authority

DOE has broad authority to regulate the agency's collection, use, processing, maintenance, storage, and disclosure of SSNs pursuant to the following authorities: 42 U.S.C. 7101 et seq.,50 U.S.C. 2401 et seq.,5 U.S.C. 1104, 5 U.S.C. 293, 5 U.S.C. 552, 5 U.S.C. 552a, 42 U.S.C. 7254, 5 U.S.C. 301, and 42 U.S.C. 405 note.

B. Background

The SSN Fraud Prevention Act of 2017 (the Act) (Pub L. 115-59; 42 U.S.C. 405 note), enacted on September 15, 2017, prohibits Federal agencies from including individuals' full SSN on documents transmitted by physical mail unless the head of the agency determines that the inclusion of the full SSN on the document is necessary (section 2(a), Pub. L. 115-59). The Act requires agency heads to issue regulations specifying the circumstances under which inclusion of a full SSN on a document sent by mail is necessary. The Act specifies that these regulations be issued no later than five years after the date of enactment, include instructions for the partial redaction of SSNs where feasible, and require that SSNs not be visible on the outside of any package sent by mail (section 2(b), Pub. L. 115-59). This rule would revise 10 CFR 1008.22 (Use and collection of Social Security numbers) consistent with these requirements in the Act. The revisions clarify the procedural requirements pertaining to the inclusion of full SSNs on documents that DOE sends by mail.

II. Discussion

Pursuant to the Act, an agency may not include a SSN on a document sent by mail unless the Secretary determines that inclusion of the SSN on the document is necessary. DOE usage of SSNs is necessary in instances when it is required by law, or fulfills a compelling business need. The regulatory text revises 10 CFR 1008.22 to establish the process by which Departmental Elements may request a Secretarial waiver of the prohibition on inclusion of SSNs. The text provides for a Secretarial waiver for pre-approved items listed on DOE's “Un-redacted SSN Mailed Documents Listing” (USMDL). This is a list of categories of documents which the Secretary of Energy, or the Secretary's authorized designee, has determined to be pre-approved for the inclusion of a full SSN in a mailed document. The justification for this determination is that the identified forms are necessary to fulfill a compelling DOE business need or mission function. DOE developed this list of pre-approved forms and documents based on responses to annual DOE data calls to assess which documents (1) contain a full SSN, (2) contain a full SSN that cannot be redacted, and (3) must be transmitted through physical mail and include a full SSN. Documents listed on the USMDL include those related to payroll, human resources, taxes, security, badging, and Privacy Act and Freedom of Information Act requests. DOE proposes that forms and documents included on the USMDL will not require a separate Secretarial waiver to be transmitted by physical mail.

This final rule provides that forms and documents not listed on the USMDL that contain a full SSN and must be transmitted through physical mail to fulfill a compelling DOE business need will require a Secretarial waiver in accordance with these regulations. Pursuant to “Department of Energy Designation Order No. 00-17.00A to the Chief Information Officer,” section 1.3, the Chief Information Officer (CIO), as Senior Agency Official for Privacy (SAOP), has the authority to implement “information privacy protection, including compliance with Federal laws, regulations, and policies that relate to information privacy and the Privacy Act.” Pursuant to this authority, for circumstances where a transmitting DOE Element anticipates the sending of a particular form or document will be a one-time occurrence, and under conditions where such transmission is an urgent matter, the Element may request a conditional, one-time Secretarial waiver from the DOE SAOP. Similarly, pursuant Designation Order No. 00-17.00A section 1.3, for circumstances where the transmitting element anticipates a regular and frequent transmission of a particular form or document, the final rule provides that the Element may request that the relevant form or document be added to the USMDL from the DOE SAOP.

A request by a current or former DOE employee or contractor, through an internal system, to have a document or form containing that individual's SSN mailed to the individual will not require a waiver under this final rule.

III. Summary of Public Comments

On December 18, 2023, DOE published a notice of proposed rulemaking seeking comments on its proposition to revise its regulations in accordance with the previous discussion section. (88 FR 87371) The 30-day public comment period of this notice of proposed rulemaking ended on January 17, 2024. No public comments were received.

IV. Section 1008.22 Analysis

This final rule adds new paragraphs (c)(1) through (c)(2), which prohibit heads of Headquarters Divisions and Offices and heads of other DOE locations from including a full Social Security number on a form or document transmitted by physical mail except under the listed circumstances.

This final rule adds new paragraphs (d)(1) through (d)(5), which describe the process through which heads of Headquarters Divisions and Offices and heads of other DOE locations may request a one-time Secretarial waiver in order to transmit a full Social Security number on a form or document by physical mail.

This final rule also adds new paragraphs (e)(1) through (e)(5), which describe the process through which heads of Headquarters Divisions and Offices and heads of other DOE locations that anticipate frequent transmission through physical mail of a particular form or document containing full Social Security numbers not already listed on the USMDL may request that a new category relevant to the form or document be added to the USMDL.

V. Procedural Issues and Regulatory Review

A. Review Under Executive Order 12866, 13563, and 14094

Executive Order (“E.O.”) 12866, “Regulatory Planning and Review,” 58 FR 51735 (Oct. 4, 1993), as supplemented and reaffirmed by E.O. 13563, “Improving Regulation and Regulatory Review,” 76 FR 3821 (Jan. 21, 2011) and amended by E.O. 14094, “Modernizing Regulatory Review,” 88 FR 21879 (April 11, 2023), requires agencies, to the extent permitted by law, to (1) propose or adopt a regulation only upon a reasoned determination that its benefits justify its costs (recognizing that some benefits and costs are difficult to quantify); (2) tailor regulations to impose the least burden on society, consistent with obtaining regulatory objectives, taking into account, among other things, and to the extent practicable, the costs of cumulative regulations; (3) select, in choosing among alternative regulatory approaches, those approaches that maximize net benefits (including potential economic, environmental, public health and safety, and other advantages; distributive impacts; and equity); (4) to the extent feasible, specify performance objectives, rather than specifying the behavior or manner of compliance that regulated entities must adopt; and (5) identify and assess available alternatives to direct regulation, including providing economic incentives to encourage the desired behavior, such as user fees or marketable permits, or providing information upon which choices can be made by the public. DOE emphasizes as well that E.O. 13563 requires agencies to use the best available techniques to quantify anticipated present and future benefits and costs as accurately as possible. In its guidance, the Office of Information and Regulatory Affairs (OIRA) has emphasized that such techniques may include identifying changing future compliance costs that might result from technological innovation or anticipated behavioral changes. For the reasons stated in this preamble, this regulatory action is consistent with these principles.

Section 6(a) of E.O. 12866 requires agencies to submit “significant regulatory actions” to OIRA for review. OIRA has determined that this regulatory action is not a “significant regulatory action” within the scope of E.O. 12866. Accordingly, this action is not subject to review under E.O. 12866 by OIRA of the Office of Management and Budget (OMB).

B. Review Under the Regulatory Flexibility Act

The Regulatory Flexibility Act of 1980 (5 U.S.C. 601 et seq.) requires that an agency prepare an initial regulatory flexibility analysis (IRFA) and a final regulatory flexibility analysis (FRFA) for any regulation for which a general notice of proposed rulemaking is required, unless the agency certifies that the rule, if promulgated, will not have a significant economic impact on a substantial number of small entities (5 U.S.C. 605(b)). As required by Executive Order 13272, Proper Consideration of Small Entities in Agency Rulemaking,67 FR 53461 (Aug. 16, 2002), DOE published procedures and policies on February 19, 2003, to ensure that the potential impacts of its rules on small entities are properly considered during the rulemaking process. 68 FR 7990. DOE has made its procedures and policies available on the Office of the General Counsel's website ( www.energy.gov/​gc/​office-general-counsel).

DOE reviewed this final rule under the provisions of the Regulatory Flexibility Act and the procedures and policies published on February 19, 2003. DOE certifies that the final rule, if adopted, would not have significant economic impact on a substantial number of small entities. The factual basis for this certification is set forth below.

This final rule updates DOE's policies and procedures concerning the disclosure of records held within a System of Records pursuant to the Privacy Act of 1974. This final rule would apply only to activities conducted by DOE's Federal employees and contractors, who would be responsible for implementing the rule requirements. DOE does not expect there to be any potential economic impact of this final rule on small businesses. Small businesses, therefore, should not be adversely impacted by the requirements in this final rule. For these reasons, DOE certifies that this final rule will not have a significant economic impact on a substantial number of small entities. Accordingly, DOE has not prepared a regulatory flexibility analysis for this rulemaking. DOE's certification and supporting statement of factual basis will be provided to the Chief Counsel for Advocacy of the Small Business Administration for review under 5 U.S.C. 605(b).

C. Review Under the Paperwork Reduction Act of 1995

This final rule does not impose a collection of information requirement subject to review and approval by OMB under the Paperwork Reduction Act (44 U.S.C. 3501 et seq.).

D. Review Under the National Environmental Policy Act of 1969

Pursuant to the National Environmental Policy Act of 1969 (NEPA), DOE has analyzed this action in accordance with NEPA and DOE's NEPA implementing regulations (10 CFR part 1021). DOE's regulations include a categorical exclusion (CX) for rulemakings interpreting or amending an existing rule or regulation that does not change the environmental effect of the rule or regulation being amended. 10 CFR part 1021, subpart D, appendix A5. DOE has determined that this rule is covered under the CX found in DOE's NEPA regulations at paragraph A.5 of appendix A to subpart D, 10 CFR part 1021, because it is an amendment to an existing regulation that does not change the environmental effect of the amended regulation and, therefore, meets the requirements for the application of this CX. See10 CFR 1021.410. Therefore, DOE has determined that this rule is not a major Federal action significantly affecting the quality of the human environment within the meaning of NEPA and does not require an Environmental Assessment or an Environmental Impact Statement.

E. Review Under Executive Order 12988

With respect to the review of existing regulations and the promulgation of new regulations, Section 3(a) of Executive Order 12988, “Civil Justice Reform,” 61 FR 4729 (February 7, 1996), imposes on Federal agencies the general duty to adhere to the following requirements: (1) eliminate drafting errors and ambiguity; (2) write regulations to minimize litigation; (3) provide a clear legal standard for affected conduct rather than a general standard; and (4) promote simplification and burden reduction. Section 3(b) of Executive Order 12988 specifically requires that executive agencies make every reasonable effort to ensure the regulation: (1) clearly specifies the preemptive effect, if any; (2) clearly specifies any effect on existing Federal law or regulation; (3) provides a clear legal standard for the affected conduct while promoting simplification and burden reduction; (4) specifies the retroactive effect, if any; (5) adequately defines key terms; (6) specifies whether administrative proceedings are to be required before parties may file suit in court and, if so, describes those proceedings and requires the exhaustion of administrative remedies; and (7) addresses other important issues affecting clarity and general draftsmanship under any guidelines issued by the Attorney General. Section 3(c) of Executive Order 12988 requires Executive agencies to review regulations in light of applicable standards in section 3(a) and section 3(b) to determine whether they are met or it is unreasonable to meet one or more of the standards. DOE has completed the required review and determined that, to the extent permitted by law, this rule meets the relevant standards of Executive Order 12988.

F. Review Under Executive Order 13132

Executive Order 13132, “Federalism,” 64 FR 43255 (August 10, 1999) imposes certain requirements on agencies formulating and implementing policies or regulations that preempt State law or that have federalism implications. Agencies are required to examine the constitutional and statutory authority supporting any action that would limit the policymaking discretion of the States and carefully assess the necessity for such actions. The Executive order also requires agencies to have an accountable process to ensure meaningful and timely input by State and local officials in the development of regulatory policies that have federalism implications. On March 14, 2000, DOE published a statement of policy describing the intergovernmental consultation process it will follow in the development of such regulations. 65 FR 13735. DOE has examined this rule and has tentatively determined that it would not preempt State law and would not have a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government. No further action is required by Executive Order 13132.

G. Review Under Executive Order 13175

Under Executive Order 13175 (65 FR 67249, November 6, 2000) on “Consultation and Coordination with Indian Tribal Governments,” DOE may not issue a discretionary rule that has “Tribal” implications and imposes substantial direct compliance costs on Indian Tribal governments. DOE has determined that the rule would not have such effects and concluded that Executive Order 13175 does not apply to this rule.

H. Review Under the Unfunded Mandates Reform Act of 1995

Title II of the Unfunded Mandates Reform Act (UMRA) of 1995 (Pub. L. 104-4) requires each Federal agency to assess the effects of a Federal regulatory action on State, local, and Tribal governments, and the private sector. (Pub. L. 104-4, sec. 201 et seq. (codified at 2 U.S.C. 1531 et seq.)). For a regulatory action likely to result in a rule that may cause the expenditure by State, local, and Tribal governments, in the aggregate, or by the private sector of $100 million or more in any one year (adjusted annually for inflation), section 202 of UMRA requires a Federal agency to publish a written statement that estimates the resulting costs, benefits, and other effects on the national economy. (2 U.S.C. 1532(a), (b)) UMRA also requires a Federal agency to develop an effective process to permit timely input by elected officers of State, local, and Tribal governments on a “significant Federal intergovernmental mandate,” and requires an agency plan for giving notice and opportunity for timely input to potentially affected small governments before establishing any requirements that might significantly or uniquely affect them. On March 18, 1997, DOE published a statement of policy on its process for intergovernmental consultation under UMRA. (62 FR 12820) (This policy is also available at: www.energy.gov/​gc/​guidance-opinions under “Guidance & Opinions” (Rulemaking)). DOE examined the final rule according to UMRA and its statement of policy and has determined that the rule contains neither an intergovernmental mandate, nor a mandate that may result in the expenditure by State, local, and Tribal governments, in the aggregate, or by the private sector, of $100 million or more in any year. Accordingly, no further assessment or analysis is required under UMRA.

I. Review Under Executive Order 12630

DOE has determined, under Executive Order 12630, “Governmental Actions and Interference with Constitutionally Protected Property Rights” 53 FR 8859 (March 18, 1988), that this regulation would not result in any takings that might require compensation under the Fifth Amendment to the U.S. Constitution.

J. Review Under Executive Order 13211

Executive Order 13211, “Actions Concerning Regulations That Significantly Affect Energy Supply, Distribution, or Use,” 66 FR 28355 (May 22, 2001) requires Federal agencies to prepare and submit to the OIRA, which is part of OMB, a Statement of Energy Effects for any significant energy action. A “significant energy action” is defined as any action by an agency that promulgates or is expected to lead to promulgation of a final rule, and that: (1)(i) is a significant regulatory action under Executive Order 12866, or any successor order; and (ii) is likely to have a significant adverse effect on the supply, distribution, or use of energy, or (2) is designated by the Administrator of OIRA as a significant energy action. For any significant energy action, the agency must give a detailed statement of any adverse effects on energy supply, distribution, or use should the proposal be implemented, and of reasonable alternatives to the action and their expected benefits on energy supply, distribution, and use. This regulatory action is not a significant energy action. Accordingly, DOE has not prepared a Statement of Energy Effects.

K. Review Under the Treasury and General Government Appropriations Act, 1999

Section 654 of the Treasury and General Government Appropriations Act, 1999 (Pub. L. 105-277) requires Federal agencies to issue a Family Policymaking Assessment for any rule that may affect family well-being. This rule would not have any impact on the autonomy or integrity of the family as an institution. Accordingly, DOE has concluded that it is not necessary to prepare a Family Policymaking Assessment.

L. Review Under the Treasury and General Government Appropriations Act, 2001

Section 515 of the Treasury and General Government Appropriations Act, 2001 (44 U.S.C. 3516) provides for Federal agencies to review most disseminations of information to the public under guidelines established by each agency pursuant to general guidelines issued by OMB. OMB's guidelines were published at 67 FR 8452 (February 22, 2002), and DOE's guidelines were published at 67 FR 62446 (October 7, 2002). Pursuant to OMB Memorandum M-19-15, Improving Implementation of the Information Quality Act (April 24, 2019), DOE published updated guidelines which are available at: www.energy.gov/​sites/​prod/​files/​2019/​12/​f70/​DOE%20Final%20Updated%20IQA%20Guidelines%20Dec%202019.pdf.

DOE has reviewed this rule and will ensure that information produced under this regulation remains consistent with the applicable OMB and DOE guidelines.

M. Congressional Notification

As required by 5 U.S.C. 801, DOE will report to Congress on the promulgation of this rule prior to its effective date. The report will state that the Office of Information and Regulatory Affairs has determined that the rule does not, meet the criteria set forth in 5 U.S.C. 804(2).

VI. Approval by the Office of the Secretary of Energy

The Secretary of Energy has approved publication of this final rule.

List of Subjects in 10 CFR Part 1008

• Administration practice and procedure
• Freedom of information
• Privacy
• Reporting and recordkeeping requirements

Signing Authority

This document of the Department of Energy was signed on May 14, 2024, by Ann Dunkin, Senior Agency Official for Privacy, pursuant to delegated authority from the Secretary of Energy. That document with the original signature and date is maintained by DOE. For administrative purposes only, and in compliance with requirements of the Office of the Federal Register, the undersigned DOE Federal Register Liaison Officer has been authorized to sign and submit the document in electronic format for publication, as an official document of the Department of Energy. This administrative process in no way alters the legal effect of this document upon publication in the Federal Register .

Signed in Washington, DC, on May 14, 2024.

Treena V. Garrett,

Federal Register Liaison Officer, U.S. Department of Energy.

For the reasons set forth in the preamble, the Department of Energy amends part 1008 of chapter X of title 10 of the Code of Federal Regulations as set forth below:

PART 1008—RECORDS MAINTAINED ON INDIVIDUALS (PRIVACY ACT)

1. The authority citation for part 1008 is revised to read as follows:

Authority: 42 U.S.C. 7101 et seq.;50 U.S.C. 2401 et seq.;5 U.S.C. 552; 5 U.S.C. 552a; 42 U.S.C. 7254; and 5 U.S.C. 301. Section 1008.22(c) also issued under 42 U.S.C. 405 note.

2. Amend § 1008.22 by:

a. Revising the section heading;

b. Removing “social security” and adding in its place “Social Security” wherever it appears in paragraphs (a) and (b); and

c. Adding paragraphs (c) through (e).

The revision and additions read as follows:

§ 1008.22

Use and collection of Social Security numbers.

* * * * *

(c) Pursuant to the Social Security Number Fraud and Prevention Act (Pub. L. 115-59; 42 U.S.C. 405 note), Heads of Headquarters Divisions and Offices and heads of other DOE locations may not include a full Social Security number on a form or document transmitted by physical mail unless:

(1) The form or document belongs to a category of forms and documents listed on the Department's “Unredacted SSN Mailed Documents Listing” (USMDL) as published on the Department's website; or

(2) The Senior Agency Official for Privacy (SAOP) provides a one-time waiver for the form or document as provided by paragraph (d) of this section.

(d) The Heads of Headquarters Divisions and Offices and heads of other DOE locations who have a compelling business need to include a full Social Security number on a form or document that is transmitted by physical mail and which do not belong to a category of form or document listed on the USMDL may request a conditional, one-time Secretarial waiver as follows:

(1) The requesting Head of Departmental Element must prepare a memorandum for submission to the SAOP that:

(i) Identifies the document that requires transmission via physical mail;

(ii) Explains with specificity the reasons why a full Social Security number is required to be transmitted via physical mail on the document;

(iii) Provides with specificity details on why the Social Security number cannot be a partial Social Security number; and

(iv) Includes any other justification to support the Element's request, including any legal requirement that necessitates the Department sending a full Social Security number through physical mail for business or mission purposes.

(2) The Departmental Element must send the completed memorandum to the Chief Privacy Officer (CPO) for review.

(3) The CPO will review the request and forward its recommendation to the SAOP.

(4) The SAOP will review and approve or reject the Departmental Element's request.

(5) If the request is approved, the SAOP will issue a memorandum in response to the Head of the Departmental Element authorizing the conditional, one-time transmission of the document.

(e) Under circumstances where the transmitting Departmental Element anticipates a regular and frequent transmission through physical mail of a particular form or document containing Social Security numbers not already listed on the USDML, the Head of the Departmental Element may request that a new category relevant to the form or document be added to the USMDL in accordance with the procedures in paragraphs (e)(1) through (5) of this section:

(1) The requesting Departmental Element must prepare a memorandum for submission to the SAOP that:

(i) Identifies the document that requires transmission via physical mail;

(ii) Explains with specificity the reasons why a full Social Security number is required to be transmitted via physical mail on the form or document;

(iii) Provides with specificity details on why the Social Security number cannot be a partial Social Security number; and

(iv) Includes any other justification to support the Element's request, including any legal requirement that necessitates the Department sending a full Social Security number through physical mail for business or mission purposes.

(2) The Head of the Departmental Element must send the completed memorandum to the CPO for review.

(3) The CPO will review the request and forward its recommendation to the SAOP.

(4) The SAOP will review and approve or reject the Element's request.

(5) If the request is approved, the SAOP will issue a memorandum in response to the requestor stating the SAOP's determination and DOE will update the USDML and publish the updated USDML on the Department's website.