82 FR 57484 - Privacy Act of 1974; System of Records

OFFICE OF PERSONNEL MANAGEMENT

Federal Register Volume 82, Issue 232 (December 5, 2017)

Page Range		57484-57487
FR Document		2017-26105
In accordance with the Privacy Act of 1974, the Office of Personnel Management proposes to establish a new OPM system of records titled ``OPM/Central-20 National CFC System of Records.'' This system of records contains information that OPM collects and maintains about individuals who make charitable contributions to eligible non-profit organizations through the Combined Federal Campaign (CFC). This newly established system of records will be included in the Office of Personnel Management's inventory of record systems.
Federal Register, Volume 82 Issue 232 (Tuesday, December 5, 2017)
[Federal Register Volume 82, Number 232 (Tuesday, December 5, 2017)]
[Notices]
[Pages 57484-57487]
From the Federal Register Online  [www.thefederalregister.org]
[FR Doc No: 2017-26105]


=======================================================================
-----------------------------------------------------------------------

OFFICE OF PERSONNEL MANAGEMENT


Privacy Act of 1974; System of Records

AGENCY: U.S. Office of Personnel Management, Merit Systems 
Accountability and Compliance, Office of the Combined Federal Campaign.

ACTION: Notice of a new system of records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the Privacy Act of 1974, the Office of 
Personnel Management proposes to establish a new OPM system of records 
titled ``OPM/Central-20 National CFC System of Records.'' This system 
of records contains information that OPM collects and maintains about 
individuals who make charitable contributions to eligible non-profit 
organizations through the Combined Federal Campaign (CFC). This newly 
established system of records will be included in the Office of 
Personnel Management's inventory of record systems.

DATES: Please submit comments on or before January 4, 2018. This new 
system is effective upon publication in today's Federal Register, with 
the exception of the routine uses, which are effective January 9, 2018.

ADDRESSES: You may submit written comments by one of the following 
methods:
     Mail: Keith Willingham, Director, Office of CFC, Office of 
Personnel Management, 1900 E Street NW., Suite 6484, Washington, DC 
20415.
     Email: [email protected].

FOR FURTHER INFORMATION, CONTACT: For general questions, please 
contact: Keith Willingham, 202-606-2564, Director, Office of the 
Combined Federal Campaign, Office of Personnel Management. For privacy 
questions, please contact: Kellie Cosgrove Riley,

[[Page 57485]]

202-606-2308, Chief Privacy Officer, Office of Personnel Management.

SUPPLEMENTARY INFORMATION: In accordance with the Privacy Act of 1974, 
5 U.S.C. 552a, the Office of Personnel Management proposes to establish 
a new system of records titled ``OPM/Central-20 National CFC System.'' 
This system of records is being established in order to facilitate the 
Combined Federal Campaign's transition from a largely paper-based, 
decentralized collection of donations to a centralized, national 
electronic collection. The system of records contains information that 
OPM, through its Central Campaign Administrator (CCA) contractor(s), 
collects, maintains, and uses regarding individuals who make charitable 
contributions to eligible non-profit organizations through the Combined 
Federal Campaign (CFC).
    The CFC is the largest workplace giving campaign in the world. 
Since its inception in 1961, Federal employees have pledged more than 
$8 billion to thousands of qualified local, national, and international 
charities. Through 2016, the CFC was administered in over 120 local 
areas across the country and overseas. Charities applied to 
participate, either as an independent charity or a member of a 
federation, by submitting an application to either OPM or to one of the 
local CFC offices. Similarly, Federal, Postal and military personnel 
donated through the CFC by submitting a completed paper or electronic 
pledge form to their payroll office and/or the local administrator in 
their local CFC office. The local administrators, known as Principal 
Combined Fund Organizations (PCFO), collected and maintained 
information about the donors, their contribution, and their designated 
charitable organizations to process and account for donor 
contributions. The PCFO collected cash, checks, or credit card 
contributions directly from the donors or from the donors' payroll 
offices if the donors had chosen to make contributions via payroll 
deduction. The PCFO then made payments directly to the individual 
charities or federations chosen by the donors.
    Based on recommendations from a Federal Advisory Committee known as 
the CFC 50 Commission established in 2011 to study the CFC and 
determine how to streamline and improve the program, OPM is now 
centralizing two core components of the CFC: (a) The applications 
submitted by charities and federations that want to participate in the 
CFC; and (b) the contributions from individuals who wish to support 
those charities. Accordingly, the CFC Online Application System 
(cfccharities.opm.gov) and the CFC Online Donation System 
(cfcgiving.opm.gov) will replace the paper and electronic systems that 
were operated by the PCFOs. Individuals will submit their donation 
information either electronically through the CFC Online Donation 
System or by filling out a paper pledge form, which the CCA will then 
scan into the electronic system. In addition to centralizing the CFC 
functions, OPM is also expanding the donor pool by allowing civilian 
annuitants and military retirees to participate and by permitting 
Federal employees to pledge volunteer hours in addition to financial 
gifts.
    The records collected from the individual donors and the 
participating charities will now be maintained in one central location 
as the OPM/Central-20 National CFC System. This newly established 
system of records will be included in OPM's inventory of records 
systems. In accordance with 5 U.S.C. 552a(r), OPM has provided a report 
of this system of records to the Office of Management and Budget and to 
Congress.


U.S. Office of Personnel Management.
Kathleen M. McGettigan,
Acting Director.
SYSTEM NAME AND NUMBER:
    National CFC System, OPM/Central-20.

SECURITY CLASSIFICATION:
    Unclassified.

SYSTEM LOCATION:
    The Office of the Combined Federal Campaign, Office of Personnel 
Management, 1900 E Street NW., Suite 6484, Washington, DC 20415, is 
responsible for this system of records. By contract, CFC's Central 
Campaign Administrator(s) in Madison, Wisconsin, through its 
subcontractors, maintains records in a government-approved cloud server 
accessed through secure data centers in the continental United States.

SYSTEM MANAGER(S):
    Director, Office of the Combined Federal Campaign, U.S. Office of 
Personnel Management, 1900 E Street NW., Suite 6484, Washington, DC 
20415, Phone 202-606-2564 or [email protected].

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Executive Order (EO) 12353 (March 23, 1982), EO 12404 (February 10, 
1983), and EO 13743 (October 13, 2016); 5 CFR part 950; Public Law 100-
202, and Public Law 102-393 (5 U.S.C. 1101 Note).

PURPOSE(S) OF THE SYSTEM:
    The purpose of the system is to permit OPM and its contractors 
serving as Central Campaign Administrators (CCA) for the CFC, to 
accurately receive, process, and account for charitable donations made 
by Federal employees, retirees, and others; make payments to charitable 
organizations; and address inquiries from donors and other 
stakeholders, including Federal agencies, charitable organizations, and 
Congress, as necessary. In addition, information in this system of 
records that is obtained from charitable organizations is used to 
approve or deny an applicant's participation in the CFC and to 
adjudicate appeals by charities that are denied. This system of records 
also supports the production of summary, de-identified descriptive 
statistics and analytical studies pertaining to the CFC program.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    a. Federal employees, civilian annuitants, military retirees, and 
contractors who voluntarily participate in the CFC program via a one-
time or recurring gift; and
    b. Individuals who serve as points of contact for charitable 
organizations that participate or apply to participate in the CFC.

CATEGORIES OF RECORDS IN THE SYSTEM:
    a. Name;
    b. Social Security Number or other employee identification number 
used by a Federal payroll or retirement system;
    c. Work address;
    d. Home address;
    e. Phone number;
    f. Government email address;
    g. Secondary email address;
    h. Employment information (to include, but not limited to, Federal 
agency or military branch, department/unit, office, military service, 
commands, etc.);
    i. Charity or charities designated;
    j. Amount of donation, in dollars or hours;
    k. Credit card information, including credit card number and 
expiration date;
    l. Bank account number and bank routing number;
    m. Authorization to release name and other information to 
charities;
    n. Charity and federation application data to meet qualifications 
of 5 CFR 950;
    o. Usernames and passwords for accounts used by donors or applying 
charities to access the CFC Web sites;
    p. Security questions and answers (for resetting passwords); and

[[Page 57486]]

    q. Help desk ticket information.

RECORD SOURCE CATEGORIES:
    Records are obtained from individuals who choose to participate in 
the CFC; charitable organizations that apply to participate in the CFC; 
and individuals who contact the CFC help desk.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND PURPOSES OF SUCH USES:
    In addition to those disclosures generally permitted under 5 U.S.C. 
552a(b) of the Privacy Act, all or a portion of the records or 
information contained in this system may be disclosed outside OPM as a 
routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:
    a. To the Department of Justice, including Offices of the U.S. 
Attorneys; another federal agency conducting litigation or in 
proceedings before any court, adjudicative, or administrative body; 
another party in litigation before a court, adjudicative, or 
administrative body; or to a court, adjudicative, or administrative 
body. Such disclosure is permitted only when it is relevant or 
necessary to the litigation or proceeding and one of the following is a 
party to the litigation or has an interest in such litigation:
    (1) OPM, or any component thereof;
    (2) Any employee or former employee of OPM in his or her official 
capacity;
    (3) Any employee or former employee of OPM in his or her individual 
capacity where the Department of Justice or OPM has agreed to represent 
the employee;
    (4) The United States, a Federal agency, or another party in 
litigation before a court, adjudicative, or administrative body, upon 
the OPM General Counsel's approval, pursuant to 5 CFR part 295 or 
otherwise.
    b. To the appropriate Federal, State, or local agency responsible 
for investigating, prosecuting, enforcing, or implementing a statute, 
rule, regulation, or order, when a record, either on its face or in 
conjunction with other information, indicates or is relevant to a 
violation or potential violation of civil or criminal law or 
regulation.
    c. To a member of Congress from the record of an individual in 
response to an inquiry made at the request of the individual to whom 
the record pertains.
    d. To the National Archives and Records Administration (NARA) for 
records management inspections being conducted under the authority of 
44 U.S.C. 2904 and 2906.
    e. To appropriate agencies, entities, and persons when (1) OPM 
suspects or has confirmed that there has been a breach of the system of 
records,[middot] (2) OPM has determined that as a result of the 
suspected or confirmed breach there is a risk of harm to individuals, 
OPM (including its information systems, programs, and operations), the 
Federal Government, or national security; and (3) the disclosure made 
to such agencies, entities, and persons is reasonably necessary to 
assist in connection with OPM's efforts to respond to the suspected or 
confirmed breach or to prevent, minimize, or remedy such harm.
    f. To another Federal agency or Federal entity, when OPM determines 
that information from this system of records is reasonably necessary to 
assist the recipient agency or entity in (1) responding to a suspected 
or confirmed breach or (2) preventing, minimizing, or remedying the 
risk of harm to individuals, the recipient agency or entity (including 
its information systems, programs, and operations), the Federal 
Government, or national security, resulting from a suspected or 
confirmed breach.
    g. To contractors, grantees, experts, consultants, or volunteers 
performing or working on a contract, service, grant, cooperative 
agreement, or other assignment for OPM when necessary to accomplish an 
agency function related to this system of records. Individuals provided 
information under this routine use are subject to the same Privacy Act 
requirements and limitations on disclosure as are applicable to OPM 
employees.
    h. To an individual's payroll office or retirement service to 
facilitate accurate payroll and annuity deductions requested by the 
individual.
    i. To credit card companies, banks, and other financial 
institutions in order to process an individual's one-time or recurring 
donation.
    j. To independent public accounting firms to conduct audits of the 
CFC, but only such information as is necessary and relevant to the 
specific audit being conducted.
    k. To charitable organizations and federations in order to provide 
them with monetary donations and time pledged and, where individual 
donors have so authorized, information about the individual donors.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    The records in this system of records are encrypted and stored 
electronically in a government-approved cloud server pursuant to a 
contract between OPM and the CFC's Central Campaign Administrators.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Records may be retrieved by name or other personal identifier.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    Pursuant to 5 CFR 950.604, CFC records must be retained for at 
least three completed campaign periods. OPM is currently developing a 
records schedule to submit to the National Archives and Records 
Administration for approval.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    Records in the system are protected from unauthorized access and 
misuse through various administrative, technical and physical security 
measures. OPM security measures are in compliance with the Federal 
Information Security Modernization Act (Pub. L. 113-283), associated 
OMB policies, and applicable standards and guidance from the National 
Institute of Standards and Technology (NIST).

RECORD ACCESS PROCEDURES:
    Individuals may access their own records by logging into 
cfcgiving.opm.gov with their email address, password, and a multi-
factor authentication token (i.e., a one-time password or code sent to 
the user's email account or phone). Those who need assistance with this 
may contact the CFC Customer Care Center at 608-237-4898 (local/
international) or 800-797-0098 (toll free). Additionally, 
representatives of CFC-participating organizations and federal employee 
application reviewers who need assistance accessing their information 
on cfccharities.opm.gov can call 608-237-4935 (local/international) or 
888-232-4935 (toll free).
    Alternatively, individuals seeking notification of and access to 
their records in this system of records may submit a request in writing 
to the Office of Personnel Management, Office of the Combined Federal 
Campaign, 1900 E Street NW., Washington, DC 20415. Individuals must 
furnish the following information for their records to be located:
    1. Full name.
    2. Date of birth.
    3. Social Security Number.
    4. Signature.
    5. Available information regarding the type of information 
requested.
    6. The reason why the individual believes this system contains 
information about him/her.
    7. The address to which the information should be sent.

[[Page 57487]]

    Individuals requesting access must also comply with OPM's Privacy 
Act regulations regarding verification of identity and access to 
records (5 CFR 297).

CONTESTING RECORD PROCEDURES:
    Individuals may modify or correct their own records by logging into 
cfcgiving.opm.gov with their email address, password, and a multi-
factor authentication token (i.e., a one-time password or code sent to 
the user's email account or phone). Those who need assistance with this 
may contact the CFC Customer Care Center at 608-237-4898 (local/
international) or 800-797-0098 (toll free). Additionally, 
representatives of CFC-participating organizations and federal employee 
application reviewers who need to update records on 
cfccharities.opm.gov can call 608-237-4935 (local/international) or 
888-232-4935 (toll free).
    Alternatively, individuals may request that records about them be 
amended by writing to the Office of Personnel Management, Office of the 
Combined Federal Campaign, 1900 E Street NW., Washington, DC 20415 and 
furnish the following information for their records to be located:
    1. Full name.
    2. Date of birth.
    3. Social Security Number.
    4. Local CFC name or city, state and zip code of their duty station
    5. Signature.
    6. Precise identification of the information to be amended.
    Individuals requesting amendment must also follow OPM's Privacy Act 
regulations regarding verification of identity and amendment to records 
(5 CFR 297).

NOTIFICATION PROCEDURES:
    See ``Record Access Procedure.''

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    None.

HISTORY:
    None.

[FR Doc. 2017-26105 Filed 12-4-17; 8:45 am]
 BILLING CODE 6325-58-P
57484 Federal Register / Vol. 82, No. 232 / Tuesday, December 5, 2017 / Notices

granting or denying access) is governed minimize any unnecessary delays in for processing and resolving requests
by 10 CFR 2.311.3 identifying those petitioners who have under these procedures.
I. The Commission expects that the standing and who have propounded It is so ordered.
NRC staff and presiding officers (and contentions meeting the specificity and Dated at Rockville, Maryland, this 17th day
any other reviewing officers) will basis requirements in 10 CFR part 2. of November, 2017.
consider and resolve requests for access The attachment to this Order For the Nuclear Regulatory Commission.
to SUNSI, and motions for protective summarizes the general target schedule Annette L. Vietti-Cook,
orders, in a timely fashion in order to Secretary of the Commission.

ATTACHMENT 1—GENERAL TARGET SCHEDULE FOR PROCESSING AND RESOLVING REQUESTS FOR ACCESS TO SENSITIVE
UNCLASSIFIED NON-SAFEGUARDS INFORMATION IN THIS PROCEEDING
Day Event/Activity

0 ........................ Publication of Federal Register notice of hearing and opportunity to petition for leave to intervene, including order with in-
structions for access requests.
10 ...................... Deadline for submitting requests for access to Sensitive Unclassified Non-Safeguards Information (SUNSI) with information:
supporting the standing of a potential party identified by name and address; describing the need for the information in order
for the potential party to participate meaningfully in an adjudicatory proceeding.
60 ...................... Deadline for submitting petition for intervention containing: (i) Demonstration of standing; and (ii) all contentions whose formu-
lation does not require access to SUNSI (+25 Answers to petition for intervention; +7 petitioner/requestor reply).
20 ...................... U.S. Nuclear Regulatory Commission (NRC) staff informs the requester of the staff’s determination whether the request for
access provides a reasonable basis to believe standing can be established and shows need for SUNSI. (NRC staff also in-
forms any party to the proceeding whose interest independent of the proceeding would be harmed by the release of the in-
formation.) If NRC staff makes the finding of need for SUNSI and likelihood of standing, NRC staff begins document proc-
essing (preparation of redactions or review of redacted documents).
25 ...................... If NRC staff finds no ‘‘need’’ or no likelihood of standing, the deadline for petitioner/requester to file a motion seeking a ruling
to reverse the NRC staff’s denial of access; NRC staff files copy of access determination with the presiding officer (or Chief
Administrative Judge or other designated officer, as appropriate). If NRC staff finds ‘‘need’’ for SUNSI, the deadline for any
party to the proceeding whose interest independent of the proceeding would be harmed by the release of the information to
file a motion seeking a ruling to reverse the NRC staff’s grant of access.
30 ...................... Deadline for NRC staff reply to motions to reverse NRC staff determination(s).
40 ...................... (Receipt +30) If NRC staff finds standing and need for SUNSI, deadline for NRC staff to complete information processing and
file motion for Protective Order and draft Non-Disclosure Affidavit. Deadline for applicant/licensee to file Non-Disclosure
Agreement for SUNSI.
A ....................... If access granted: issuance of presiding officer or other designated officer decision on motion for protective order for access
to sensitive information (including schedule for providing access and submission of contentions) or decision reversing a
final adverse determination by the NRC staff.
A + 3 ................. Deadline for filing executed Non-Disclosure Affidavits. Access provided to SUNSI consistent with decision issuing the protec-
tive order.
A + 28 ............... Deadline for submission of contentions whose development depends upon access to SUNSI. However, if more than 25 days
remain between the petitioner’s receipt of (or access to) the information and the deadline for filing all other contentions (as
established in the notice of opportunity to request a hearing and petition for leave to intervene), the petitioner may file its
SUNSI contentions by that later deadline.
A + 53 ............... (Contention receipt +25) Answers to contentions whose development depends upon access to SUNSI.
A + 60 ............... (Answer receipt +7) Petitioner/Intervenor reply to answers.
>A + 60 ............. Decision on contention admission.

[FR Doc. 2017–25390 Filed 12–4–17; 8:45 am] Personnel Management proposes to the routine uses, which are effective
BILLING CODE 7590–01–P establish a new OPM system of records January 9, 2018.
titled ‘‘OPM/Central-20 National CFC
ADDRESSES: You may submit written
System of Records.’’ This system of
comments by one of the following
OFFICE OF PERSONNEL records contains information that OPM
methods:
MANAGEMENT collects and maintains about
individuals who make charitable • Mail: Keith Willingham, Director,
Privacy Act of 1974; System of contributions to eligible non-profit Office of CFC, Office of Personnel
Records organizations through the Combined Management, 1900 E Street NW., Suite
Federal Campaign (CFC). This newly 6484, Washington, DC 20415.
AGENCY: U.S. Office of Personnel established system of records will be • Email: cfc@opm.gov.
Management, Merit Systems included in the Office of Personnel
Accountability and Compliance, Office Management’s inventory of record FOR FURTHER INFORMATION, CONTACT: For
of the Combined Federal Campaign. systems. general questions, please contact: Keith
ACTION: Notice of a new system of Willingham, 202–606–2564, Director,
sradovich on DSK3GMQ082PROD with NOTICES

records. DATES: Please submit comments on or Office of the Combined Federal
before January 4, 2018. This new system Campaign, Office of Personnel
SUMMARY: In accordance with the is effective upon publication in today’s Management. For privacy questions,
Privacy Act of 1974, the Office of Federal Register, with the exception of please contact: Kellie Cosgrove Riley,
3 Requesters should note that the filing 46562; August 3, 2012) apply to appeals of NRC applicable), but not to the initial SUNSI request
requirements of the NRC’s E-Filing Rule (72 FR staff determinations (because they must be served submitted to the NRC staff under these procedures.
49139; August 28, 2007, as amended at 77 FR on a presiding officer or the Commission, as

VerDate Sep<11>2014 18:13 Dec 04, 2017 Jkt 244001 PO 00000 Frm 00062 Fmt 4703 Sfmt 4703 E:\FR\FM\05DEN1.SGM 05DEN1
Document Created: 2017-12-04 23:45:05
Document Modified: 2017-12-04 23:45:05
Category		Regulatory Information
Collection		Federal Register
sudoc Class		AE 2.7: GS 4.107: AE 2.106:
Publisher		Office of the Federal Register, National Archives and Records Administration
Section		Notices
Action		Notice of a new system of records.
Dates		Please submit comments on or before January 4, 2018. This new system is effective upon publication in today's Federal Register, with the exception of the routine uses, which are effective January 9, 2018.
FR Citation		82 FR 57484