SUPPLEMENTARY INFORMATION:

Background

In accordance with the Privacy Act of 1974, the DOT/FMCSA is proposing a new system of records titled “Department of Transportation (DOT)/Federal Motor Carrier Safety Administration (FMCSA) 016, Customer Relationship Records (CRR)”. The information in the system is collected to enable the Agency to receive, respond to, and refer customer inquiries regarding Agency services. The system serves as a record of the inquiry and is used for collecting inquiry data; responding to or referring the inquiry; aggregating data that will be used to inform other functions of the Agency and, as appropriate, other agencies and/or the public; and providing related educational and informational content. The information will also be used for administrative purposes to ensure quality control, performance, and improving management processes at the FMCSA contact center. This system consists of written or verbal inquiries received by the Agency as well as information concerning responses to or referrals of these inquiries, as appropriate.

The information in the system is collected to create a unique Customer Contact Record for each customer. The record is available to all FMCSA authorized users. The record includes all inquiry responses facilitating consistency across engagements and limiting opportunities for “answer shopping.” Answer shopping can cause inconsistent responses and increase time to answer, which is why this activity should be limited within the contact center. This enables the Agency to receive, respond to, and refer customer inquiries regarding Agency services.

Privacy Act

The Privacy Act (5 U.S.C. 552a) governs the means by which the Federal Government collects, maintains, and uses personally identifiable information (PII) in a System of Records. A “system of records” is a group of any records under the control of a Federal agency from which information about individuals is retrieved by name or other personal identifier. The Privacy Act requires each agency to publish in the Federal Register a System of Records Notice (SORN) identifying and describing each System of Records the agency maintains, including the purposes for which the agency uses PII in the system, the routine uses for which the agency discloses such information outside the agency, and how individuals to whom a Privacy Act record pertains can exercise their rights under the Privacy Act ( e.g., to determine if the system contains information about them and to contest inaccurate information). In accordance with 5 U.S.C. 552a(r), DOT has provided a report of this system of records to the Office of Management and Budget and to Congress.

SYSTEM NAME AND NUMBER:

DOT/FMCSA 016—Customer Relationship Records (CRR).

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

Records are maintained in a FedRAMP-authorized third-party cloud environment (Amazon Web Services (AWS) GovCloud East region). The contracts are maintained by U.S. DOT at 1200 New Jersey Avenue SE, Washington, DC 20590.

SYSTEM MANAGER(S):

FMCSA Office of Registration, 1200 New Jersey Avenue SE, Washington, DC 20590.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

49 U.S.C. 502, 504, 506, 508, Chapter 139, and 49 CFR 1.73.

PURPOSE(S) OF THE SYSTEM:

The purpose of this system is to enable the FMCSA to fulfill its statutory mandates under 49 U.S.C. 502, 504, 506, 508, and Chapter 139, as delegated by 49 CFR 1.73. The system serves as a centralized platform to manage, track, and coordinate interactions with both external constituents and governmental ( printed page 51829) partners to enhance the safety, oversight, and administration of motor carrier regulations.

Specifically, the system is used to:

• Execute Regulatory Oversight: Facilitate the collection and management of information required for the registration, licensing, and financial responsibility oversight of entities governed by 49 U.S.C. Chapter 139.
• Facilitate Constituent Engagement: Provide a streamlined mechanism for responding to inquiries, requests for technical assistance, and safety-related information from motor carriers, drivers, and the public.
• Coordinate Inter-agency Enforcement and Safety Initiatives: Enable secure and efficient communication with Federal, State, and local law enforcement and transportation partners to coordinate safety audits, inspections, and enforcement activities as authorized under 49 U.S.C. 502 and 506.
• Maintain Administrative Records: Serve as the official repository for reports, data, and communications required to be maintained or produced under 49 U.S.C. 504, ensuring transparency and accountability in agency proceedings.
• Support Data-Driven Safety Programs: Analyze interaction trends and stakeholder feedback to improve the efficacy of safety programs, outreach initiatives, and regulatory compliance assistance.
• Manage Stakeholder Outreach: Disseminate critical safety alerts, regulatory updates, and official notices to industry stakeholders and governmental partners.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

• Individuals who are sole proprietors, owners, or operators of a regulated entity who have provided PII.
• Individuals associated with regulated entities, including company officials, designated registrant employees, safety managers, and authorized account holders.
• Individuals associated with cargo tank facilities required to register with FMCSA, including manufacturers, assemblers, repairers, inspectors, testers, and design certifying engineers.
• Individuals employed by or acting on behalf of insurers, financial institutions, blanket process agent companies, and third-party service providers who submit registration-related information on behalf of registrants.
• Members of the public who submit registration-related protests.

CATEGORIES OF RECORDS IN THE SYSTEM:

Categories of records in the system include:

• External Constituent and Citizen Records: Records maintained on members of the public, representatives of non-governmental organizations, and private sector entities may include:
• Biographic and Contact Data: Legal name, aliases, and preferred names; home or business mailing addresses; personal and/or professional email addresses; and phone numbers.
• Organizational Affiliations: Name of the entity represented, job title, and professional credentials.
• Inquiry and Response Records: Subject matter of the inquiry; correspondence (electronic or physical); records of phone calls or virtual meetings; and any supporting documentation provided by the individual to facilitate a request for information or service.
• Engagement Metadata: Subscription preferences for agency communications; language preferences; and digital identifiers (such as usernames) for public-facing agency portals.
• Inter-agency and Inter-governmental Stakeholder Records.
• Records maintained on employees of Federal, State, Local, Tribal, or international government agencies acting in their official capacities may include:
• Official Professional Identity: Name, official government title, agency, bureau, or department name; and office location/duty station.
• Work Contact Information: Government-issued email addresses and work telephone numbers.
• Liaison and Coordination Records: Records regarding joint projects or initiatives; inter-agency agreement (IAA) reference numbers associated with a contact; records of official briefings; and logs of inter-agency task force participation.
• Authentication Data: Unique internal identifiers used to grant access to shared government-to-government (G2G) databases or collaborative CRM modules.
• Common Transactional and Audit Records

For all categories of individuals, the system maintains records necessary to ensure the integrity and security of the data, including:

• Audit Logs: Timestamps of record creation, modification, or access; and IP addresses associated with system interactions.
• Reference Identifiers: System-generated unique identification numbers used to link related records across different modules within the CRM.

RECORD SOURCE CATEGORIES:

Information in this system is obtained from individuals, regulated entities, and supporting companies submitting inquiries. Inquiries are received via phone, email, or chat to the Agency's contact center.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act, all or a portion of the records or information contained in this system may be disclosed outside DOT as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:

System Specific Routine Uses:

1. To Federal, State, local, or Tribal agencies, or foreign counterparts, for the purpose of coordinating motor carrier safety audits, inspections, investigations, or enforcement actions, or to facilitate the exchange of information related to the registration and financial responsibility of entities governed by 49 U.S.C. Chapter 139.

2. To members of the public or private sector organizations for the purpose of disseminating safety alerts, regulatory updates, or official agency notices where such disclosure is necessary to ensure the safety of the motoring public or compliance with Federal motor carrier safety regulations.

Department General Routine Uses:

3. In the event that a system of records maintained by DOT to carry out its functions indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether Federal, State, local or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation, or order issued pursuant thereto.

4a. Routine Use for Disclosure for Use in Litigation. It shall be a routine use of the records in this system of records to disclose them to the Department of Justice or other Federal agency conducting litigation when—(a) DOT, or any agency thereof, or (b) Any employee of DOT or any agency thereof, in his/her official capacity, or (c) Any employee of DOT or any agency thereof, in his/her individual capacity where the Department of Justice has agreed to ( printed page 51830) represent the employee, or (d) The United States or any agency thereof, where DOT determines that litigation is likely to affect the United States, is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or other Federal agency conducting the litigation is deemed by DOT to be relevant and necessary in the litigation, provided, however, that in each case, DOT determines that disclosure of the records in the litigation is a use of the information contained in the records that is compatible with the purpose for which the records were collected.

4b. Routine Use for Agency Disclosure in Other Proceedings. It shall be a routine use of records in this system to disclose them in proceedings before any court or adjudicative or administrative body before which DOT or any agency thereof, appears, when—(a) DOT, or any agency thereof, or (b) Any employee of DOT or any agency thereof in his/her official capacity, or (c) Any employee of DOT or any agency thereof in his/her individual capacity where DOT has agreed to represent the employee, or (d) The United States or any agency thereof, where DOT determines that the proceeding is likely to affect the United States, is a party to the proceeding or has an interest in such proceeding, and DOT determines that use of such records is relevant and necessary in the proceeding, provided, however, that in each case, DOT determines that disclosure of the records in the proceeding is a use of the information contained in the records that is compatible with the purpose for which the records were collected.

5. Disclosure may be made to a Congressional office from the record of an individual in response to an inquiry from the Congressional office made at the request of that individual. In such cases, however, the Congressional office does not have greater rights to records than the individual. Thus, the disclosure may be withheld from delivery to the individual where the file contains investigative or actual information or other materials which are being used, or are expected to be used, to support prosecution or fines against the individual for violations of a statute, or of regulations of the Department based on statutory authority. No such limitations apply to records requested for Congressional oversight or legislative purposes; release is authorized under 49 CFR 10.35(9).

6. One or more records from a system of records may be disclosed routinely to the National Archives and Records Administration (NARA) in records management inspections being conducted under the authority of 44 U.S.C. 2904 and 2906.

7a. DOT may disclose records from this system, as a routine use, to appropriate agencies, entities, and persons when (1) DOT suspects or has confirmed that there has been a breach of the system of records; (2) DOT has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, DOT (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with DOT's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

7b. DOT may disclose records from this system, as a routine use, to another Federal agency or Federal entity, when DOT determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

8. DOT may disclose records from this system, as a routine use, to the Office of Government Information Services for the purpose of (a) resolving disputes between FOIA requesters and Federal agencies and (b) reviewing agencies' policies, procedures, and compliance in order to recommend policy changes to Congress and the President.

9. DOT may disclose records from the system, as a routine use, to contractors and their agents, experts, consultants, and others performing or working on a contract, service, cooperative agreement, or other assignment for DOT, when necessary to accomplish an agency function related to this system of records.

10. DOT may disclose records from this system, as a routine use, to an agency, organization, or individual for the purpose of performing audit or oversight operations related to this system of records, but only such records as are necessary and relevant to the audit or oversight activity. This routine use does not apply to intra-agency sharing authorized under Section (b)(1) of the Privacy Act.

11. DOT may disclose from this system, as a routine use, records consisting of, or relating to, terrorism information (6 U.S.C. 485(a)(5)), homeland security information (6 U.S.C. 482(f)(1)), or Law enforcement information (Guideline 2 Report attached to White House Memorandum, “Information Sharing Environment”, November 22, 2006) to a Federal, State, local, tribal, territorial, foreign government and/or multinational agency, either in response to its request or upon the initiative of the Component, for purposes of sharing such information as is necessary and relevant for the agencies to detect, prevent, disrupt, preempt, and mitigate the effects of terrorist activities against the territory, people, and interests of the United States of America, as contemplated by the Intelligence Reform and Terrorism Prevention Act of 2004 (Pub. L. 108-458) and Executive Order 13388 (October 25, 2005).

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Records in the system are stored electronically on a contractor-maintained cloud storage service.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Records are retrieved by USDOT number, Operating Authority number (Docket Number), telephone number, email address, and/or person's name.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

Records in the system are maintained in accordance with NARA retention schedule DAA-0557-2015-0006. The records are considered temporary and are destroyed 20 years after the end of the event product lifecycle and then until no longer needed for conducting business.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

Records in this system are safeguarded in accordance with applicable rules and policies, including all applicable DOT IT systems security and access policies. Appropriate controls have been imposed to minimize the risk of compromising the information that is being stored and ensuring confidentiality of communications using tools such as encryption, authentication, auditing, and compartmentalizing databases. Data is encrypted at rest and in transit. Access to the records in this system is limited to those authorized individuals who have a need to know the information in furtherance of the performance of their official duties, and who have appropriate clearances or permissions. All personnel with access to data are screened through background investigations commensurate with the ( printed page 51831) level of access required to perform their duties.

RECORD ACCESS PROCEDURES:

Individuals seeking access to and notification of any record contained in this system of records or seeking to contest its content may submit a request in writing to the System Manager to the address provided under “System Manager and Address” above or submit online via the Department's Public Access Link (PAL) at pal.dot.gov/​. Requests submitted through these electronic channels must include a digital certification of identity.

When an individual seeks records about himself or herself from this system of records or any other Departmental system of records, the request must conform with the Privacy Act regulations set forth in 49 CFR part 10. The individual's request must verify their identity by providing their full name, current address, and date and place of birth. The individual must sign the request, and the individual's signature must either be notarized or submitted under 28 U.S.C. 1746, a law that permits statements to be made under penalty of perjury as a substitute for notarization. No specific form is required.

In addition, the individual should:

• Explain why the individual believes the Department would have information on them;
• Identify which component(s) of the Department the individual believes may have the information about them;
• Specify when the individual believes the records would have been created;
• and provide any other information that will help FMCSA.

If an individual's request is seeking records pertaining to another living individual, the first individual must include a statement from the second individual certifying his/her agreement for the first individual to access his/her records. Without the above information, the component(s) may not be able to conduct an effective search, and the individual's request may be denied due to a lack of specificity or compliance with the consent requirements of the Privacy Act statute and regulations.

CONTESTING RECORD PROCEDURES:

See “Records Access Procedures” above.

NOTIFICATION PROCEDURES:

See “Record Access Procedures” above.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

None.

91 FR 51828