SUPPLEMENTARY INFORMATION:

This notice will include substantive modifications to the following sections: System Location; System Manager(s); Authority For Maintenance of The System; Categories of Individuals Covered By The System; Categories of Records In The System, Routine Uses of Records Maintained In The System; Policies And Practice For Storage of Records; Policies And Practices For Retention And Disposal of Records; Administrative, Technical, And Physical Safeguards; Record Access Procedures; Contesting Record Procedures; Notification Procedures; and History. In addition, the Department is taking this opportunity to make minor administrative updates to the SUMMARY , DATES , ADDRESSES; For Further Information Contact; and SUPPLEMENTARY INFORMATION .

SYSTEM NAME AND NUMBER:

Official Gift Records and Gift Donor Vetting Records, State-80.

SECURITY CLASSIFICATION:

Unclassified and Classified.

SYSTEM LOCATION:

Records are kept in many locations nationwide.

(a) Department of State, 2201 C Street NW, Washington, DC 20520

(b) U.S. Embassies

(c) U.S. Consulates

(d) U.S. Consulates General

(e) U.S. Missions

(f) Department of State Annexes

(g) Various field and regional offices throughout the United States

(h) Within a government cloud provided, implemented, and overseen by the Department's Enterprise Server Operations Center (ESOC), 2201 C Street NW, Washington, DC 20520.

SYSTEM MANAGER(S):

Fund Director, Bureau of the Comptroller and Global Financial ( printed page 51519) Services (CGFS), U.S. Department of State, Room 1821, 2201 C Street NW, Washington, DC 20520; Vetting Unit, Office of Global Partnerships, U.S. Department of State, 1800 N Kent Street, Arlington, VA 22209; Director and Curator, Diplomatic Reception Rooms, Department of State, Room 8231, 2201 C Street NW, Washington, DC 20520.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

22 U.S.C. 2621 et seq. Foreign Gifts and Decorations; Foreign Service Buildings Act of 1926, Sec. 9, as amended (22 U.S.C. 300); State Department Basic Authorities Act of 1956, Sec. 25, as amended (22 U.S.C. 2697); Foreign Assistance Act of 1961, Sec. 695(d), as amended (22 U.S.C. 2395(d)); Migration and Refugee Assistance Act of 1962, Sec. 3(a)(2), as amended (22 U.S.C. 2602); Foreign Gifts and Decorations Act, as amended (5 U.S.C. 7342 and 22 CFR part 3); Acceptance of travel and related expense from non-Federal Sources (31 U.S.C. 1353); Mutual Educational and Cultural Exchange Act of 1961 (Fulbright-Hays), Sec. 105(f) and Sec. 108A, as amended (22 U.S.C. 2455(f) and 22 U.S.C. 2458(a)); 41 CFR parts 301 and 41 CFR part 304.

PURPOSE(S) OF THE SYSTEM:

Official Gift Records and Gift Donor Vetting Records consist of an accounting of all donations received on behalf of the Department of State for the purposes of: (a) maintaining a historical record, (b) properly allocating donations given for a particular purpose, (c) determining future solicitation and gift acceptance, and (d) providing donors with acknowledgment letters for tax purposes.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Individuals who have donated gifts; individuals who are being solicited to donate gifts; individuals who are points of contact for corporations or foundations that donate gifts to the Department of State; and individuals who are otherwise being vetted in connection with potential gifts to, or partnerships with, the Department of State. For the purposes of this System of Records Notice (SORN) the term “Department of State” includes the department and its subsidiary divisions which includes U.S. Embassies, U.S. Consulates General, U.S. Consulates, U.S. Missions, Department of State Annexes, and/or various field and regional offices throughout the United States. The Privacy Act defines an individual at 5 U.S.C. 552a(a)(2) as a United States citizen or lawful permanent resident.

CATEGORIES OF RECORDS IN THE SYSTEM:

Records in this system include information about gifts to the Department of State (official gifts) such as gift donor and recipient information as well as information about individuals who are points of contact for corporate or foundation donors. Such information includes but is not limited to:

a. Information about the donor or point of contact including name, title, address, and relevant business affiliations.

b. Information about gifts and recipients including descriptions of gifts and decorations; the dollar value of gifts; the recipient bureau, region, post or office; the purpose of the donation as expressed by the donor and/or the soliciting office; the authority under which the gift was received; the date of receipt; type of gift (cash or in-kind); date of check deposit; deposit number; appropriation type (conditional or unconditional); copies of checks donated; copies of donor letters; and copies of acknowledgment letters.

c. Vetting records, which include (1) identifying information about individual gift donors, potential gift donors, or potential partners that is used to conduct and narrow due diligence research including the individual's full name, date of birth, last known residence, website (if any), affiliation (if any), and other identifying information used to conduct the vetting process; and (2) information obtained as a result of due diligence searches including but not limited to; criminal history information, financial history information (including bankruptcies), information regarding judgments, information regarding liens, information regarding global sanctions, as well as any other information deemed relevant to the determination as to whether there is a conflict of interest.

RECORD SOURCE CATEGORIES:

These records contain information collected directly from: the individual who is the subject of these records; employers and public references; other officials in the Department of State; other government agencies; foreign governments; federal and public searchable databases; other public and professional institutions possessing relevant information; and other agency systems of records.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

Official Gift Records and Gift Donor Vetting Records, State-80 may be disclosed:

(a) To appropriate agencies, entities, and persons when (1) the Department of State suspects or has confirmed that there has been a breach of the system of records; (2) the Department of State has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Department of State (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Department of State efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

(b) To another Federal agency or Federal entity, when the Department of State determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

(c) To federal, state, and local tax authorities in connection with tax, bankruptcy matters, and other lawful purposes.

The Department of State periodically publishes in the Federal Register its standard routine uses that apply to all its Privacy Act systems of records. These notices appear in the form of a Prefatory Statement (published in Volume 73, Number 136, Public Notice 6290, on July 15, 2008). All these standard routine uses apply to Official Gift Records and Gift Donor Vetting Records, State-80.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Records are stored both in hard copy and on electronic media. A description of standard Department of State policies concerning storage of electronic records is found here fam.state.gov/​FAM/​05FAM/​05FAM0440.html. All hard copies of records containing personal information are maintained in secured file cabinets in restricted areas, access to which is limited to authorized personnel only.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Records are retrieved by an individual name; individual address; date of birth; individual website; donor country; recipient bureau, region, post or office; purpose; dollar value; date/fiscal year of ( printed page 51520) receipt or deposit; corporation, foundation, or entity name; gift type (cash or in-kind); authority under which gift was received; deposit number; and appropriation type.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

Records are retained in accordance with the following General Records Disposition Schedules: DAA-0059-2017-0004-0004; DAA-0059-2017-0004-0001.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

All users are given cyber security awareness training which covers the procedures for handling Sensitive but Unclassified (SBU) information, including personally identifiable information (PII). Annual refresher training is mandatory. In addition, all Department OpenNet users are required to take the Foreign Service Institute distance learning course instructing employees on privacy and security requirements, including the rules of behavior for handling PII and the potential consequences if it is handled improperly. Before being granted access to Official Gift Records and Gift Donor Vetting Records, State-80, a user must first be granted access to the Department of State computer system.

Department of State employees and contractors may remotely access this system of records using non-Department owned information technology. Such access is subject to approval by the Department's mobile and remote access program and is limited to information maintained in unclassified information systems. Remote access to the Department's information systems is configured in compliance with the Office of Management and Budget Circular Memorandum A-130 multifactor authentication requirements and includes a time-out function.

All Department of State employees and contractors with authorized access to records maintained in this system of records have undergone a background security investigation. Access to the Department, its annexes and posts abroad is controlled by security guards and admission is limited to those individuals possessing a valid identification card or individuals under proper escort. Access to computerized files is password-protected and under the direct supervision of the system manager. The system manager has the capability of printing audit trails of access from the computer media, thereby permitting regular and ad hoc monitoring of computer usage. When it is determined that a user no longer needs access, the user account is disabled.

All cloud systems that provide IT services and process Department of State information must be specifically authorized by the Department of State Authorizing Official and Senior Agency Official for Privacy.

Information that conforms with Department-specific definitions for Federal Information Security Modernization Act (FISMA) low, moderate, or high categorization are permissible for cloud usage and must specifically be authorized by the Department's Cloud Program Management Office and the Department of State Authorizing Official. Specific security measures and safeguards will depend on the FISMA categorization of the information in a given cloud system. In accordance with Department policy, systems that process more sensitive information will require more stringent controls and review by Department cybersecurity experts prior to approval. Prior to operation, all Cloud systems must comply with applicable security measures that are outlined in FISMA, FedRAMP, OMB regulations, National Institute of Standards and Technology's (NIST) Special Publications (SP) and Federal Information Processing Standards (FIPS) and Department of State policies and standards.

All data stored in cloud environments categorized above a low FISMA impact risk level must be encrypted at rest and in-transit using a federally approved encryption mechanism. The encryption keys shall be generated, maintained, and controlled in a Department data center by the Department key management authority. Deviations from these encryption requirements must be approved in writing by the Department of State Authorizing Official. High FISMA impact risk level systems will additionally be subject to continual auditing and monitoring, multifactor authentication mechanism utilizing Public Key Infrastructure (PKI) and NIST 800 53 controls concerning virtualization, servers, storage, and networking, as well as stringent measures to sanitize data from the cloud service once the contract is terminated.

RECORD ACCESS PROCEDURES:

Individuals who wish to gain access to or amend records pertaining to themselves should submit a Privacy Act request to the U.S. Department of State Information Access Programs (IAP) directorate by following the guidance and procedures located at foia.state.gov/​request/​request2.aspx. Mailed requests can be addressed to U.S. Department of State; Information Access Programs Directorate (A/SKS/IAP); 2201 C Street, NW; Washington, DC 20520-0000. To request information under the Privacy Act, the individual should be a citizen of the United States, or an alien lawfully admitted for permanent residence. The Privacy Act permits access to an individual's own records only if those records are within a system of records that are retrieved by an individual's name or personal identifier.

CONTESTING RECORD PROCEDURES:

Individuals who wish to contest the content of any record pertaining to him or her in the system should write to U.S. Department of State; Information Access Programs Directorate (A/SKS/IAP); 2201 C Street, NW; Washington, DC 20520.

NOTIFICATION PROCEDURES:

Individuals who wish to be notified if the system contains a record pertaining to him or her should write to the U.S. Department of State; Information Access Programs Directorate (A/SKS/IAP); 2201 C Street, NW; Washington, DC 20520-0000.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

Official Gift Records and Gift Donor Vetting Records, State-80, was previously published at 80 FR 30525.

91 FR 51518