SUPPLEMENTARY INFORMATION:

I. Comments

FHFA seeks public comments on the revisions to the SORN identified in this notice and will take all comments into consideration. The Agency will post all public comments, including any personally identifiable information such as name and contact information, on the FHFA public website at www.fhfa.gov, except as described below. Commenters should submit only information that the commenter wishes to make available publicly. FHFA will not redact personally identifiable information once it is submitted. Commenters who do not wish to be identified by their comments may submit their comments anonymously. FHFA may post only a single representative example of identical or substantially identical comments, and in such cases will generally identify the number of identical or substantially identical comments represented by the posted example. FHFA may, in its discretion, redact or refrain from posting all or any portion of any comment that contains content that is obscene, vulgar, profane, or threatens harm. All comments, including those that are redacted or not posted, will be retained in their original form in FHFA's internal file and considered as required by all applicable laws. Commenters who would like FHFA to consider any portion of their comment exempt from disclosure on the basis that it contains trade secrets, or financial, confidential or proprietary data or information, should follow the procedures in section IV.D. of FHFA's Policy on Communications with Outside Parties in Connection with FHFA Rulemakings, see www.fhfa.gov/​sites/​default/​files/​documents/​Ex-Parte-Communications-Public-Policy_​3-5-19.pdf. FHFA cannot guarantee that such data or information will remain confidential if disclosure is sought pursuant to an applicable statute or regulation. See 12 CFR 1202.8, 12 CFR 1214.2, and FHFA's FOIA Reference Guide at www.fhfa.gov/​about/​foia-reference-guide for additional information.

II. Introduction

This notice informs the public of FHFA's proposed revisions to an existing system of records. This notice satisfies the Privacy Act requirement that an agency publish a system of records notice in the Federal Register when there is an addition or change to an agency's system of records. As required by the Privacy Act, 5 U.S.C. 552a(r), and pursuant to section 7 of Office of Management and Budget ( printed page 55581) (OMB) Circular No. A-108, Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act, prior to publication of this notice, FHFA submitted a report describing the system of records covered by this notice to the OMB, the Committee on Oversight and Government Reform of the House of Representatives, and the Committee on Homeland Security and Governmental Affairs of the Senate.

III. Revised System of Records

The revised system of records notice is set out in its entirety and described in detail below. The proposed modification to “Employee Benefits Records, FHFA-10” makes the following substantive and non-substantive changes:

(1) Modifies the system's security classification consistent with OMB guidance;

(2) Revises the Agency's official address and adds references to FHFA-authorized service providers and contractor networks in the system location;

(3) Updates the contact information for the designated system manager;

(4) Revises the legal authorities for maintaining the system;

(5) Clarifies the system's purpose by detailing how the records support the administration and management of the program;

(6) Clarifies that the categories of individuals covered in the system include beneficiaries and expounds upon applicable employee benefit programs;

(7) Updates the categories of records maintained in the system by removing references to employees' emergency contact information and including beneficiaries and retirement savings contribution information;

(8) Updates the record source categories to include relevant Federal agencies and FHFA benefits providers;

(9) Revises existing routine use (1), which provides for disclosures “[t]o appropriate federal, state, and local authorities responsible for investigating or prosecuting a violation of, or for enforcing or implementing a statute, rule, regulation, or order issued, when the information indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule, or order issued pursuant thereto” and renumbers it new routine use (3);

(10) Revises existing routine use (2), which provides for disclosure “[t]o a court, magistrate, or other administrative body in the course of presenting evidence, including disclosures to counsel or witnesses in the course of civil discovery, litigation, or settlement negotiations or in connection with criminal proceedings, when FHFA is a party to the proceeding or has a significant interest in the proceeding, to the extent that the information is determined to be relevant and necessary” by dividing that routine use into new routine use (7), which provides for disclosure “[t]o a court, magistrate, or administrative tribunal, including disclosures to opposing counsel or witnesses shared in the course of discovery, litigation, or settlement negotiations or in connection with criminal law proceedings or in response to a subpoena from a court of competent jurisdiction if the requested information is relevant and necessary to the pending judicial or administrative proceeding” and new routine use (10), which provides for disclosure “[t]o outside counsel contracted by FHFA, DOJ (including United States Attorney Offices), or other Federal agencies conducting litigation or in proceedings before any court, or adjudicative or administrative body, when it is relevant and necessary to the litigation and one of the following is a party to the litigation or has an interest in such litigation: (a) FHFA; (b) Any employee of FHFA in his/her official capacity; (c) Any employee of FHFA in his/her individual capacity where DOJ or FHFA has agreed to represent the employee; or (d) The United States or any agency thereof that is a party to the litigation or has an interest in such litigation, and FHFA determines that the records are both relevant and necessary to the litigation”;

(11) Revises existing routine use (4), which provides for disclosure “[t]o appropriate federal, state, local authorities, and other entities when (a) It is suspected or confirmed that the security or confidentiality of information in the system of records has been compromised; (b) FHFA has determined that as a result of the suspected or confirmed compromise there is a risk of harm to economic or property interests, identity theft or fraud, or harm to the security or integrity of this system or other systems or programs (whether maintained by FHFA or another agency or entity) that rely upon the compromised information; and (c) the disclosure is made to such agencies, entities, and persons who are reasonably necessary to assist in connection with FHFA's efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm,” by dividing that routine use into new routine use (1), which provides for disclosure “[t]o appropriate agencies, entities, and persons when—(a) FHFA suspects or has confirmed that there has been a breach of the system of records; (b) FHFA has determined that as a result of a suspected or confirmed breach there is a risk of harm to individuals, FHFA (including its information systems, programs, and operations), the Federal Government, or national security; and (c) The disclosure is made to agencies, entities, and persons as reasonably necessary to assist with FHFA's efforts to: (i) Respond to a suspected or confirmed breach; or (ii) Prevent, minimize, or remedy harm caused by such breach,” and new routine use (2), which provides for disclosure “[t]o a Federal agency or Federal entity, when FHFA determines information from the system of records is reasonably necessary to assist the recipient agency or entity in: (a) Responding to a suspected or confirmed breach; or (b) Preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or to national security, resulting from a suspected or confirmed breach”;

(12) Revises existing routine use (7), which provides for disclosure “[t]o appropriate federal agencies and other public authorities for use in records management inspections” into new routine use (11), which provides for disclosure “[t]o the National Archives and Records Administration or other Federal agencies pursuant to records management inspections being conducted under the authority of 44 U.S.C. 2904 and 2906”;

(13) Revises existing routine use (9), which provides for disclosure “[t]o contractor personnel, grantees, volunteers, interns, and others performing or working on a contract, service, grant, cooperative agreement, or project for the Federal Government” into new routine use (5), which provides for disclosure “[t]o any contractor, agent, or other authorized individual performing work on a contract, service, cooperative agreement, job, or other activity on behalf of FHFA who has a need to access the information in the performance of their official duties or activities”;

(14) Revises existing routine use (10), which provides for disclosure “[t]o the Department of Agriculture, National Finance Center to provide personnel, payroll, and related services and systems involving FHFA employees” into new routine use (16), which ( printed page 55582) provides for disclosure “[t]o the Department of Interior, to provide personnel, payroll, and related services and systems involving FHFA employees”;

(15) Removes existing routine use (11), which provides for disclosure “[t]o the Department of Treasury, Bureau of the Public Debt to provide financial management services and systems, including local and temporary duty travel, involving FHFA employees”;

(16) Revises existing routine use (12), which provides for disclosure “[t]o the Internal Revenue Service and appropriate State and local taxing authorities” into new routine use (17), which provides for disclosure “[t]o the Internal Revenue Service and appropriate state and local taxing authorities if the employee is subject to tax by that authority and to the extent necessary for that entity to carry out its legally authorized functions, whether or not tax is withheld”;

(17) Revises existing routine use (13), which provides for disclosure “[t]o appropriate Federal agencies to effect salary or administrative offsets, or for other purposes connected with the collection of debts owed to the United States” into new routine use (18), which provides for disclosure “[t]o the U.S. Department of the Treasury, Federal debt collection centers, other appropriate Federal agencies, and private collection contractors or other third parties authorized by law, for the purpose of collecting or assisting in the collection of delinquent debts owed to FHFA or the Federal government. Disclosure will be limited to the individual's name, Social Security number, and other information necessary to establish the identity of the individual, and the existence, validity, amount, status, and history of the debt”;

(18) Adds new routine use (4), which provides for disclosure “[t]o any individual during the course of any inquiry or investigation conducted by FHFA, or in connection with civil litigation, if FHFA has reason to believe the individual to whom the record is disclosed may have further information about the matters related thereto, and the record appears to be relevant and necessary at the time to the subject matter of the inquiry”;

(19) Adds new routine use (8), which provides for disclosure “[t]o the Office of Management and Budget, the Department of Justice (DOJ), Department of Labor, Office of Personnel Management, the Equal Employment Opportunity Commission, U.S. Office of Special Counsel Department of Homeland Security, or other Federal agencies, to obtain advice regarding statutory, regulatory, policy, and other requirements related to the purpose for which FHFA collected the records”;

(20) Adds new routine use (9), which provides for disclosure “[t]o appropriate third parties contracted by FHFA to facilitate mediation or other dispute resolution procedures or programs, where the record is relevant to the dispute and the dispute is related to the purpose for which the record was collected”;

(21) Adds new routine use (12), which provides for disclosure “[t]o an agency, organization, or individual for the purpose of performing audit or oversight operations as authorized by law, but only such information as is relevant and necessary to such audit or oversight functions”;

(22) Adds new routine use (23), which provides for disclosure “[t]o the U.S. Department of the Treasury when disclosure of the information is relevant to review payment and award eligibility through the Do Not Pay Working System for the purposes of identifying, preventing, or recouping improper payments to an applicant for, or recipient of, Federal funds, including funds disbursed by a state (meaning a state of the United States, the District of Columbia, a territory or possession of the United States, or a federally recognized Indian tribe) in a state-administered, federally funded program in accordance with Executive Order 14249”;

(23) Removes the “Disclosure to Consumer Reporting Agencies” category to align with OMB guidance;

(24) Updates the policies and practices for storage of records with FHFA's modernized practices, including use of Federal Records Centers;

(25) Revises the policies and practices for the retention and disposal of records to add the Agency's retention practices related to legal holds and business use of records;

(26) Revises the “Administrative, Technical, and Physical Safeguards” category to replace “access codes” with “role-based access controls” to reflect current practices; and

(27) Makes minor corrections and other administrative updates to the remaining sections of the notice in accordance with OMB Circular A-108 and related OMB guidance.

SYSTEM NAME AND NUMBER:

Employee Benefits Records, FHFA-10.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

Federal Housing Finance Agency, 400 Seventh Street SW, Washington, DC 20219, and any alternate work site used by employees of FHFA, including contractors assisting agency employees, FHFA-authorized service providers, and FHFA-authorized contractor networks located within the Continental United States.

SYSTEM MANAGER(S):

Chief Human Resource Officer, Office of Human Resources Management, Federal Housing Finance Agency, benefits@fhfa.gov 400 Seventh Street SW, Washington, DC 20219.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

12 U.S.C. 4513(a)(2)(B); 12 U.S.C. 4515(a); 5 U.S.C. 7901; 5 U.S.C. Chapter 84; 5 U.S.C. Chapter 87; 5 U.S.C. Chapter 89; 5 U.S.C. Chapter 89A; 5 U.S.C. Chapter 89B; 5 U.S.C. Chapter 90.

PURPOSE(S) OF THE SYSTEM:

The purpose of the system is to collect, maintain, and use records necessary to administer and manage FHFA's employee benefits programs. The system supports the full lifecycle of benefits-related activities for current and former employees, their spouses, domestic partners, dependents, and designated beneficiaries who are enrolled in, apply for, or otherwise participate in Agency-sponsored benefit programs. The system ensures the accurate processing of claims, reimbursements, contributions, payroll deductions, and benefit payments. It also facilitates the recording and tracking of key program functions, including eligibility determinations, enrollments, changes in coverage, and termination of benefits.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

To the extent not covered by any other system, this system covers current and former FHFA employees and their spouses, domestic partners, dependents and beneficiaries who are enrolled in, apply for, or participate in one or more of FHFA employee benefit programs including retirement savings, health club memberships, health, life, and other insurance programs, and other FHFA-sponsored benefit programs.

CATEGORIES OF RECORDS IN THE SYSTEM:

This system contains general enrollment and claim information for FHFA-sponsored programs. As appropriate to the specific program, records contain salary and earnings; name of employee and employee's spouse, domestic partner, and dependents and their sex, birth date, ( printed page 55583) home address, contact information (including home phone number, mobile phone number, and personal email address), and Social Security number; beneficiary information including names and dates of birth; membership in professional organizations (including membership number); retirement savings contribution information; health, life, vision, and dental information; claims for reimbursement; student loan information; and related information.

RECORD SOURCE CATEGORIES:

The information is provided by current and former employees, the Office of Human Resources Management, FHFA personnel records, the Office of Personnel Management, the Department of Labor, the Thrift Savings Plan, and vendors who provide benefits services such health, dental, and vision insurance providers.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act, these records and information contained therein may specifically be disclosed outside of FHFA as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows, to the extent such disclosures are compatible with the purposes for which the information was collected:

(1) To appropriate agencies, entities, and persons when—

(a) FHFA suspects or has confirmed that there has been a breach of the system of records;

(b) FHFA has determined that as a result of a suspected or confirmed breach there is a risk of harm to individuals, FHFA (including its information systems, programs, and operations), the Federal Government, or national security; and

(c) The disclosure is made to agencies, entities, and persons as reasonably necessary to assist with FHFA's efforts to:

(i) Respond to a suspected or confirmed breach; or

(ii) Prevent, minimize, or remedy harm caused by such breach.

(2) To a Federal agency or Federal entity, when FHFA determines information from the system of records is reasonably necessary to assist the recipient agency or entity in:

(a) Responding to a suspected or confirmed breach; or

(b) Preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or to national security, resulting from a suspected or confirmed breach.

(3) When there is an indication of a violation or potential violation of law (whether civil, criminal, or regulatory in nature or whether arising by general statute or particular program statute or by regulation, rule, or order issued pursuant thereto), the relevant records in the system of records may be referred, as a routine use, to the appropriate agency ( e.g., federal, state, local, tribal, foreign or a financial regulatory organization) charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing a statute, rule, regulation or order issued pursuant thereto.

(4) To any individual during the course of any inquiry or investigation conducted by FHFA, or in connection with civil litigation, if FHFA has reason to believe the individual to whom the record is disclosed may have further information about the matters related thereto, and the record appears to be relevant and necessary at the time to the subject matter of the inquiry.

(5) To any contractor, agent, or other authorized individual performing work on a contract, service, cooperative agreement, job, or other activity on behalf of FHFA who has a need to access the information in the performance of their official duties or activities.

(6) To a Congressional office from the record of an individual in response to an inquiry from the Congressional office made at the request of that individual.

(7) To a court, magistrate, or administrative tribunal, including disclosures to opposing counsel or witnesses, shared in the course of discovery, litigation, or settlement negotiations or in connection with criminal law proceedings or in response to a subpoena from a court of competent jurisdiction if the requested information is relevant and necessary to the pending judicial or administrative proceeding.

(8) To the Office of Management and Budget, the Department of Justice (DOJ), Department of Labor, Office of Personnel Management, the Equal Employment Opportunity Commission, U.S. Office of Special Counsel, Department of Homeland Security, or other Federal agencies, to obtain advice regarding statutory, regulatory, policy, and other requirements related to the purpose for which FHFA collected the records.

(9) To appropriate third parties contracted by FHFA to facilitate mediation or other dispute resolution procedures or programs, where the record is relevant to the dispute and the dispute is related to the purpose for which the record was collected.

(10) To outside counsel contracted by FHFA, DOJ (including United States Attorney Offices), or other Federal agencies conducting litigation or in proceedings before any court, or adjudicative or administrative body, when it is relevant and necessary to the litigation and one of the following is a party to the litigation or has an interest in such litigation:

(a) FHFA;

(b) Any employee of FHFA in his/her official capacity;

(c) Any employee of FHFA in his/her individual capacity where DOJ or FHFA has agreed to represent the employee; or

(d) The United States or any agency thereof that is a party to the litigation or has an interest in such litigation, and FHFA determines that the records are both relevant and necessary to the litigation.

(11) To the National Archives and Records Administration or other Federal agencies pursuant to records management inspections being conducted under the authority of 44 U.S.C. 2904 and 2906.

(12) To an agency, organization, or individual for the purpose of performing audit or oversight operations as authorized by law, but only such information as is relevant and necessary to such audit or oversight functions.

(13) To appropriate federal, state, and local authorities in connection with hiring or retaining an individual, conducting a background security or suitability investigation, adjudication of liability, or eligibility for a license, contract, grant, or other benefit.

(14) To appropriate federal, state, and local authorities, agencies, arbitrators, and other parties responsible for processing any personnel actions or conducting administrative hearings or corrective actions or grievances or appeals, or if needed in the performance of other authorized duties.

(15) To officials of a labor organization when relevant and necessary to their duties of exclusive representation concerning personnel policies, practices, and matters affecting working conditions.

(16) To the Department of Interior, to provide personnel, payroll, and related services and systems involving FHFA employees.

(17) To the Internal Revenue Service and appropriate state and local taxing authorities if the employee is subject to tax by that authority and to the extent necessary for that entity to carry out its ( printed page 55584) legally authorized functions, whether or not tax is withheld.

(18) To the U.S. Department of the Treasury, Federal debt collection centers, other appropriate Federal agencies, and private collection contractors or other third parties authorized by law, for the purpose of collecting or assisting in the collection of delinquent debts owed to FHFA or the Federal government. Disclosure will be limited to the individual's name, Social Security number, and other information necessary to establish the identity of the individual, and the existence, validity, amount, status, and history of the debt.

(19) To the Office of Child Support Enforcement, Administration for Children and Families, Department of Health and Human Services for the purpose of locating individuals to establish paternity, establish and modify orders of child support enforcement actions as required by the Personal Responsibility and Work Opportunity Reconciliation Act, the Federal Parent Locator System and the Federal Tax Offset System.

(20) To the Office of Child Support Enforcement for release to the Social Security Administration for verifying Social Security numbers in connection with the operation of the Federal Parent Locator System by the Office of Child Support Enforcement.

(21) To the Office of Child Support Enforcement for release to the U.S. Department of the Treasury for purposes of administering the Earned Income Tax Credit Program and verifying a claim with respect to employment in a tax return.

(22) To commercial benefit providers, carriers, vendors, contractor personnel, and agents to process claims and provide related administrative services involving FHFA employees.

(23) To the U.S. Department of the Treasury when disclosure of the information is relevant to review payment and award eligibility through the Do Not Pay Working System for the purposes of identifying, preventing, or recouping improper payments to an applicant for, or recipient of, Federal funds, including funds disbursed by a state (meaning a state of the United States, the District of Columbia, a territory or possession of the United States, or a federally recognized Indian tribe) in a state-administered, federally funded program in accordance with Executive Order 14249.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Records at FHFA are maintained in electronic format. Electronic records are stored on FHFA's secured network, the networks of FHFA-authorized cloud service providers, FHFA-authorized contractor networks, or the networks of other Federal agencies (or their authorized contractors) acting as shared service providers for FHFA. All networks are located within the Continental United States. All records for the system that were stored in paper format or on magnetic disk or tape at FHFA have been moved off-site to Federal Records Centers.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Records are retrieved by the name, Social Security number, assigned file number, or employee identification number.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

The records are retained and managed in accordance with FHFA's Comprehensive Records Schedule and the National Archives and Records Administration's General Records Schedule. Records are destroyed or deleted according to the retention schedule associated with the relevant records schedule, but longer retention is authorized for business use and any applicable legal holds. Paper and microform records ready for disposal are destroyed by shredding or maceration. Records in electronic media are electronically erased using accepted techniques.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

The electronic records are safeguarded in a secured environment and protected by controlled access procedures through the use of role-based access controls and other information technology security measures. FHFA buildings where records and computerized systems are stored have security cameras and 24-hour security guard service. Access to records is restricted to only FHFA employees, FHFA contractors, and the employees and contractors of FHFA's shared service providers who require access in the performance of official duties related to the purposes for which the system of records is maintained.

RECORD ACCESS PROCEDURES:

Individuals seeking access to and/or amendment of records about themselves contained in this system of records should follow the “Notification Procedures” below.

CONTESTING RECORD PROCEDURES:

Individuals seeking access to and/or amendment of records about themselves contained in this system of records should follow the “Notification Procedures” below.

NOTIFICATION PROCEDURES:

Individuals seeking notification of any records about themselves contained in this system of records should address their inquiry to the Privacy Act Officer via email to privacy@fhfa.gov, by mail to the Federal Housing Finance Agency, 400 Seventh Street SW, Washington, DC 20219, or in accordance with the procedures set forth in 12 CFR part 1204. Please note that all mail sent to FHFA via the U.S. Postal Service is routed through a national irradiation facility, a process that may delay delivery by approximately two weeks. For any time-sensitive correspondence, please plan accordingly.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

The system of records notice was last published in the Federal Register at 76 FR 33286 on June 8, 2011 and 80 FR 60900 on October 8, 2015.

91 FR 55580