SUPPLEMENTARY INFORMATION:

In accordance with the Privacy Act of 1974, 5 U.S.C. 552a, the Department of the Treasury (“Treasury”) proposes to modify the Treasury system of records, as identified below, to include two new ( printed page 36461) routine uses permitting disclosure to appropriate persons and entities for purposes of response and remedial efforts in the event of a breach of data contained in the applicable system of records.

On May 22, 2007, the Office of Management and Budget (OMB) issued Memorandum M-07-16 “Safeguarding Against and Responding to the Breach of Personally Identifiable Information.” It required agencies to publish a routine use for their systems of records in regards to the disclosure of information in connection with response and remedial efforts in the event of a breach of personally identifiable information. Treasury published a notice in the Federal Register on October 3, 2007 (72 FR 56434), modifying the Treasury systems of records by adding the applicable routine use. New Treasury systems of records published after that date have included a breach response routine use.

On January 3, 2017, OMB issued Memorandum M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information.” OMB Memorandum M-17-12 rescinded and replaced OMB Memorandum M-07-16 and updated the breach response routine use. OMB M-17-12 requires two new breach response routine uses, one to respond to a breach of the agencies personally identifiable information and another to ensure agencies are able to disclose records in their systems of records that may be needed by another agency in response to a breach.

This notice modifies the breach response routine use published at 72 FR 56434 in accordance with OMB M-17-12 breach response routine use; as identified in the chart below for systems of records published at 72 FR 56434; and adds a new routine use to the Treasury systems of records as identified below to ensure that Treasury can assist other agencies in responding to a confirmed or suspected breach, as appropriate.

Treasury has provided a report of this system of records to the Committee on Oversight and Government Reform of the House of Representatives, the Committee on Homeland Security and Governmental Affairs of the Senate, and OMB, pursuant to 5 U.S.C. 552a(r) and OMB Circular A-108, “Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act,” dated December 23, 2016.

Department of the Treasury systems of records notices, breach response routine uses and citations follow.

The remainder of Treasury's systems of records for the 166 records remains unchanged except for the two breach routine uses identified below.Treasury's system of records routine use numbers are listed above, and the breach response routine use are replaced as follows:

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

( ) To appropriate agencies, entities, and persons when (1) the Department of the Treasury and/or Treasury bureau suspects or has confirmed that there has been a breach of the system of records; (2) the Department of the Treasury and/or Treasury bureau has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Department of the Treasury and/or Treasury bureau(s) (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Department of the Treasury's and/or Treasury bureau's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm;

( ) To another Federal agency or Federal entity, when the Department of the Treasury and/or Treasury bureau determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

85 FR 36460