SUPPLEMENTARY INFORMATION:

I. General Information

The Privacy Act of 1974, as amended, 5 U.S.C. 552a, governs the means by which the United States Government collects, maintains, and uses personally identifiable information (PII) in a system of records. A “system of records” is a group of any records under the control of a federal agency from which information about individuals is retrieved by name or other personal identifier. The Privacy Act requires each agency to publish in the Federal Register , for public notice and comment, a system of records notice (SORN) identifying and describing each system of records the agency maintains, including the purposes for which the ( printed page 62528) agency uses PII in the system and the routine uses for which the agency discloses such information outside the agency. As provided in OMB Circular A-108, “Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act,” agencies may publish all routine uses applicable to a system of records in a single Federal Register Notice for that system. However, an agency may publish a separate notice of routine uses that are applicable to many systems of records at the agency and then incorporate them by reference into the notices for specific systems to which they apply. When incorporating such routine uses by reference, the agency shall ensure that the routine use section of the SORN clearly indicates which of the separately published routine uses apply to the system of records and includes the Federal Register citation where they have been published.

EPA has previously published twelve general routine uses ( see73 FR 2245, published January 14, 2008). The amended list of general routine uses included herein reflects a non-substantive change to an existing EPA general routine use ( see73 FR 2245, published January 14, 2008). The amended general routine uses implemented by this notice reflect the two pieces of the existing general routine use in two parts: (a) A general routine use for disclosure of records in response to a breach or suspected breach of EPA's systems of records and (b) a general routine use for disclosure of records in response to a breach or suspected breach of another agency's systems of records.

The amended general routine uses are compatible with the purposes for which the information to be disclosed under these general routine uses was originally collected. Individuals whose personally identifiable information is in EPA systems expect their information to be secured. Sharing their information with appropriate parties in the course of responding to a confirmed or suspected breach of an EPA system, or another agency's system, will help EPA and all Federal agencies protect them against potential misuse of their information by unauthorized persons. For the reasons above, the existing general routine use L is amended to reflect the guidance provided in OMB Memorandum M-17-12, reflected in new general routine uses L and M. Accordingly, the Agency's general routine uses are as follows:

A. Disclosure for Law Enforcement Purposes: Information may be disclosed to the appropriate Federal, State, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity.

B. Disclosure Incident to Requesting Information: Information may be disclosed to any source from which additional information is requested (to the extent necessary to identify the individual, inform the source of the purpose of the request, and to identify the type of information requested,) when necessary to obtain information relevant to an agency decision concerning retention of an employee or other personnel action (other than hiring,) retention of a security clearance, the letting of a contract, or the issuance or retention of a grant, or other benefit.

C. Disclosure to Requesting Agency: Disclosure may be made to a Federal, State, local, foreign, or tribal or other public authority of the fact that this system of records contains information relevant to the retention of an employee, the retention of a security clearance, the letting of a contract, or the issuance or retention of a license, grant, or other benefit. The other agency or licensing organization may then make a request supported by the written consent of the individual for the entire record if it so chooses. No disclosure will be made unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another Federal agency for criminal, civil, administrative, personnel, or regulatory action.

D. Disclosure to Office of Management and Budget: Information may be disclosed to the Office of Management and Budget at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A-19.

E. Disclosure to Congressional Offices: Information may be disclosed to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of the individual.

F. Disclosure to Department of Justice: Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which the Agency is authorized to appear, when:

1. The Agency, or any component thereof;

2. Any employee of the Agency in his or her official capacity;

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

4. The United States, if the Agency determines that litigation is likely to affect the Agency or any of its components,

Is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or the Agency is deemed by the Agency to be relevant and necessary to the litigation provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.

G. Disclosure to the National Archives: Information may be disclosed to the National Archives and Records Administration in records management inspections.

H. Disclosure to Contractors, Grantees, and Others: Information may be disclosed to contractors, grantees, consultants, or volunteers performing or working on a contract, service, grant, cooperative agreement, job, or other activity for the Agency and who have a need to have access to the information in the performance of their duties or activities for the Agency. When appropriate, recipients will be required to comply with the requirements of the Privacy Act of 1974 as provided in 5 U.S.C. 552a(m).

I. Disclosures for Administrative Claims, Complaints and Appeals: Information from this system of records may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.

J. Disclosure to the Office of Personnel Management: Information from this system of records may be disclosed to the Office of Personnel Management pursuant to that agency's responsibility for evaluation and oversight of Federal personnel management.

K. Disclosure in Connection With Litigation: Information from this system of records may be disclosed in connection with litigation or settlement ( printed page 62529) discussions regarding claims by or against the Agency, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions and except where court orders are otherwise required under section (b)(11) of the Privacy Act of 1974, 5 U.S.C. 552a(b)(11).

L. Disclosure to Persons or Entities in Response to an Actual or Suspected Breach of Personally Identifiable Information: To appropriate agencies, entities, and persons when (1) EPA suspects or has confirmed that there has been a breach of the system of records; (2) EPA has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, EPA (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with EPA's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

M. Disclosure to Assist Another Agency in Its Efforts to Respond to a Breach of Personally Identifiable Information: To another Federal agency or Federal entity, when EPA determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

HISTORY: 73 FR 2245 (January 14, 2008).

86 FR 62527