SUPPLEMENTARY INFORMATION:

I. Comments

FHFA seeks public comments on the revisions to the SORN identified in this notice and will take all comments into consideration. The Agency will post all public comments, including any personally identifiable information such as name and contact information, on the FHFA public website at www.fhfa.gov, except as described below. Commenters should submit only information that the commenter wishes to make available publicly. FHFA will not redact personally identifiable information once it is submitted. Commenters who do not wish to be identified by their comments may submit their comments anonymously. FHFA may post only a single representative example of identical or substantially identical comments, and in such cases will generally identify the number of identical or substantially identical comments represented by the posted example. FHFA may, in its discretion, redact or refrain from posting all or any portion of any comment that contains content that is obscene, vulgar, profane, or threatens harm. All comments, including those that are redacted or not posted, will be retained in their original form in FHFA's internal file and considered as required by all applicable laws. Commenters who would like FHFA to consider any portion of their comment exempt from disclosure on the basis that it contains trade secrets, or financial, confidential or proprietary data or information, should follow the procedures in section IV.D. of FHFA's Policy on Communications with Outside Parties in Connection with FHFA Rulemakings, seewww.fhfa.gov/​sites/​default/​files/​documents/​Ex-Parte-Communications-Public-Policy_​3-5-19.pdf. FHFA cannot guarantee that such data or information will remain confidential if disclosure is sought pursuant to an applicable statute or regulation. See 12 CFR 1202.8, 12 CFR 1214.2, and FHFA's FOIA Reference Guide at www.fhfa.gov/​about/​foia-reference-guide for additional information.

II. Introduction

This notice informs the public of FHFA's proposed revisions to an existing system of records. This notice satisfies the Privacy Act requirement that an agency publish a system of records notice in the Federal Register when there is an addition or change to an agency's system of records.

As required by the Privacy Act, 5 U.S.C. 552a(r), and pursuant to section 7 of Office of Management and Budget (OMB) Circular No. A-108, Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act, prior to publication of this notice, FHFA submitted a report describing the system of records covered by this notice to the OMB, the Committee on Oversight and Government Reform of the House of Representatives, and the Committee on Homeland Security and Governmental Affairs of the Senate.

III. Revised System of Records

The revised system of records notice is set out in its entirety and described in detail below. The proposed modification to the “Transit Subsidy Program Records, FHFA-11” makes the following substantive and non-substantive changes:

(1) Changes the title of the system from “Transit Subsidy Program Records, FHFA-11” to “Transit Subsidy and Parking Program Records, FHFA-11” to reflect the full scope of the records contained in the system;

(2) Modifies the system's security classification consistent with OMB guidance;

(3) Revises the Agency's official address and adds references to FHFA-authorized service providers and contractor networks in the system location;

(4) Revises the contact information for the designated system manager;

(5) Revises the authorities for maintenance of the system by citing more specific authorities and removing the description of each cited authority;

(6) Clarifies that the purpose of the system includes collecting and maintaining records related to the parking program and vehicle reservation program and provides details on how the records collected support the administration and management of the program;

(7) Revises the categories of individuals covered by the system to include FHFA employees who request parking permits for parking at FHFA and the Midtown Center location, employees who carpool with parking permit holders, and visitors requesting parking at FHFA headquarters;

(8) Revises the categories of records maintained in the system to remove home address, title, grade, office, work address, commuting schedule, and transit system used and to add SmarTrip card number, user ID, parking garage location, parking date, and the names of visitors and their escorts, and to add the make, year, and license number of vehicles and the names of individuals authorized to carpool with a parking permit holder;

(9) Revises existing routine use (2), which provides for disclosure “[t]o a court, magistrate, or other administrative body in the course of presenting evidence, including disclosures to counsel or witnesses in the course of civil discovery, rules and regulations litigation, or settlement negotiations or in connection with criminal proceedings, when FHFA is a party to the proceeding or has a significant interest in the proceeding, to the extent that the information is determined to be relevant and necessary” by dividing that routine use into new routine use (7), which provides for disclosure “[t]o a court, magistrate, or administrative tribunal, including disclosures to opposing counsel or witnesses, shared in the course of discovery, litigation, or settlement negotiations or in connection with criminal law proceedings or in response to a subpoena from a court of competent jurisdiction if the requested information is relevant and necessary to the pending judicial or administrative proceeding” and new routine use (10), which provides for disclosure “[t]o outside counsel contracted by FHFA, DOJ (including United States Attorney Offices), or other Federal agencies conducting litigation or in proceedings ( printed page 64927) before any court, or adjudicative or administrative body, when it is relevant and necessary to the litigation and one of the following is a party to the litigation or has an interest in such litigation: (a) FHFA; (b) Any employee of FHFA in his/her official capacity; (c) Any employee of FHFA in his/her individual capacity where DOJ or FHFA has agreed to represent the employee; or (d) The United States or any agency thereof that is a party to the litigation or has an interest in such litigation, and FHFA determines that the records are both relevant and necessary to the litigation”;

(10) Revises existing routine use (4), which provides for disclosure “[t]o appropriate federal, state, local authorities, and other entities when (a) It is suspected or confirmed that the security or confidentiality of information in the system has been compromised; (b) there is a risk of harm to economic or property interests, identity theft or fraud, or harm to the security or integrity of this system or other systems or programs that rely upon the compromised information; and (c) the disclosure is made to such agencies, entities, and persons who are reasonably necessary to assist in efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm,” by dividing that routine use into new routine use (1), which provides for disclosure “[t]o appropriate agencies, entities, and persons when—(a) FHFA suspects or has confirmed that there has been a breach of the system of records; (b) FHFA has determined that as a result of a suspected or confirmed breach there is a risk of harm to individuals, FHFA (including its information systems, programs, and operations), the Federal Government, or national security; and (c) The disclosure is made to agencies, entities, and persons as reasonably necessary to assist with FHFA's efforts to: (i) Respond to a suspected or confirmed breach; or (ii) Prevent, minimize, or remedy harm caused by such breach,” and new routine use (2), which provides for disclosure “[t]o a Federal agency or Federal entity, when FHFA determines information from the system of records is reasonably necessary to assist the recipient agency or entity in: (a) Responding to a suspected or confirmed breach; or (b) Preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or to national security, resulting from a suspected or confirmed breach”;

(11) Revises existing routine use (7), which provides for disclosure “[t]o appropriate federal agencies and other public authorities for use in records management inspections” into new routine use (11), which provides for disclosure “[t]o the National Archives and Records Administration or other Federal agencies pursuant to records management inspections being conducted under the authority of 44 U.S.C. 2904 and 2906”;

(12) Revises existing routine use (9), which provides for disclosure “[t]o contractor personnel, grantees, volunteers, interns, and others performing or working on a contract, service, grant, cooperative agreement, or project for the Federal Government” into new routine use (5), which provides for disclosure “[t]o any contractor, agent, or other authorized individual performing work on a contract, service, cooperative agreement, job, or other activity on behalf of FHFA who has a need to access the information in the performance of their official duties or activities”;

(13) Adds new routine use (4), which provides for disclosure “[t]o any individual during the course of any inquiry or investigation conducted by FHFA, or in connection with civil litigation, if FHFA has reason to believe the individual to whom the record is disclosed may have further information about the matters related thereto, and the records appears to be relevant and necessary at the time to the subject matter of the inquiry”;

(14) Adds new routine use (8), which provides for disclosure “[t]o the Office of Management and Budget, the Department of Justice (DOJ), Department of Labor, Office of Personnel Management, Equal Employment Opportunity Commission, U.S. Office of Special Counsel, Department of Homeland Security, or other Federal agencies, to obtain advice regarding statutory, regulatory, policy, and other requirements related to the purpose for which FHFA collected the records”;

(15) Adds new routine use (9), which provides for disclosure “[t]o appropriate third parties contracted by FHFA to facilitate mediation or other dispute resolution procedures or programs, where the record is relevant to the dispute and the dispute is related to the purpose for which the record was collected”;

(16) Adds new routine use (12), which provides for disclosure “[t]o an agency, organization, or individual for the purpose of performing audit or oversight operations as authorized by law, but only such information as is relevant and necessary to such audit or oversight functions”;

(17) Adds new routine use (17), which provides for disclosure “[t]o the U.S. Department of the Treasury when disclosure of the information is relevant to review payment and award eligibility through the Do Not Pay Working System for the purposes of identifying, preventing, or recouping improper payments to an applicant for, or recipient of, Federal funds, including funds disbursed by a state (meaning a state of the United States, the District of Columbia, a territory or possession of the United States, or a federally recognized Indian tribe) in a state-administered, federally funded program in accordance with Executive Order 14249”;

(18) Adds new routine use (18), which provides for disclosure “[t]o the Internal Revenue Service and appropriate state and local taxing authorities if the employee is subject to tax by that authority and to the extent necessary for that entity to carry out its legally authorized functions, whether or not tax is withheld”;

(19) Adds new routine use (19), which provides for disclosure “[t]o the U.S. Department of the Treasury, Federal debt collection centers, other appropriate Federal agencies, and private collection contractors or other third parties authorized by law, for the purpose of collecting or assisting in the collection of delinquent debts owed to FHFA or the Federal government. Disclosure will be limited to the individual's name, Social Security number, and other information necessary to establish the identity of the individual, and the existence, validity, amount, status, and history of the debt”;

(20) Adds new routine use (20), which provides for disclosure “[t]o government and commercial vendors that provide parking-related services and systems involving FHFA employees and visitors as relevant and necessary to facilitate the administration of FHFA's parking and transit subsidy programs”;

(21) Removes the “Disclosure to Consumer Reporting Agencies” category to ensure alignment with OMB guidance;

(22) Updates the “Policies and Practices for Storage of Records” section with FHFA's modernized practices, including use of Federal Records Centers;

(23) Revises the “Policies and Practices for Retrieval of Records” section to add “permit parking number” as an identifier;

(24) Updates the “Policies and Practices for Retention and Disposal of Records” section to add the Agency's ( printed page 64928) retention practices related to legal holds and business usage;

(25) Revises the “Administrative, Technical, and Physical Safeguards” category to replace “access codes” with “role-based access controls” to reflect current practice; and

(26) Makes minor corrections and other administrative updates to the remaining sections of the notice in accordance with OMB Circular A-108 and related OMB guidance.

SYSTEM NAME AND NUMBER:

Transit Subsidy and Parking Program Records, FHFA-11.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

Federal Housing Finance Agency, 400 Seventh Street SW, Washington, DC 20219, and any alternate work site used by employees of FHFA, including contractors assisting agency employees, FHFA-authorized service providers, and FHFA-authorized contractor networks located within the Continental United States.

SYSTEM MANAGER(S):

Logistics Manager, Transportation@fhfa.gov, Federal Housing Finance Agency, 400 Seventh Street SW, Washington, DC 20219.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

5 U.S.C. 7905; 12 U.S.C. 4513(a)(2)(B); E.O. 13150, 65 FR 24613.

PURPOSE(S) OF THE SYSTEM:

The records are used to administer the FHFA transit subsidy and parking program, including determining eligibility; processing applications; verifying enrollment; tracking benefits; managing employee participation; and facilitating coordination with transit authorities, benefit administers, and the payroll office. The system is also used to facilitate and track reservations for government vehicles.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

To the extent not covered by any other system, this system covers: (1) employees who apply for parking permits at an FHFA office location; (2) employees who apply for transit subsidy program benefits for commuting to and from their official duty station whether by commercial or public transit systems, or by bicycle; (3) employees who request temporary parking; (4) employees who carpool with parking permit holders; (5) visitors who request parking at FHFA's headquarters location; (6) employees who request daily parking at the Federal National Mortgage Association's (Fannie Mae's) Midtown Center location in Washington, DC; and (7) employees and contractors who reserve government vehicles.

CATEGORIES OF RECORDS IN THE SYSTEM:

The records in the system include completed FHFA transit subsidy benefit application forms, annual parking applications, temporary or visitor parking requests, vehicle reservation information, and related information. The records include, but are not limited to, an individual's name; SmarTrip card number; user identification (ID) number; work phone number and email address; vehicle make, year, and license number; parking garage location; and parking date(s). The system also includes the names of individuals authorized to carpool with a parking permit holder, as well as the names of visitors who require parking at FHFA's headquarters location, the names of the FHFA employee who requested parking on the visitor's behalf, the names of the visitor's escorts at the site, and the purpose of the visits.

RECORD SOURCE CATEGORIES:

The information is provided either directly by FHFA employees or from internal FHFA information systems.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act, these records and information contained therein may specifically be disclosed outside of FHFA as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows, to the extent such disclosures are compatible with the purposes for which the information was collected:

(1) To appropriate agencies, entities, and persons when—

(a) FHFA suspects or has confirmed that there has been a breach of the system of records;

(b) FHFA has determined that as a result of a suspected or confirmed breach there is a risk of harm to individuals, FHFA (including its information systems, programs, and operations), the Federal Government, or national security; and

(c) The disclosure is made to agencies, entities, and persons as reasonably necessary to assist with FHFA's efforts to:

(i) Respond to a suspected or confirmed breach; or

(ii) Prevent, minimize, or remedy harm caused by such breach.

(2) To a Federal agency or Federal entity, when FHFA determines information from the system of records is reasonably necessary to assist the recipient agency or entity in:

(a) Responding to a suspected or confirmed breach; or

(b) Preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or to national security, resulting from a suspected or confirmed breach.

(3) When there is an indication of a violation or potential violation of law (whether civil, criminal, or regulatory in nature or whether arising by general statute or particular program statute or by regulation, rule, or order issued pursuant thereto), the relevant records in the system of records may be referred, as a routine use, to the appropriate agency ( e.g., federal, state, local, tribal, foreign or a financial regulatory organization) charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing a statute, rule, regulation or order issued pursuant thereto.

(4) To any individual during the course of any inquiry or investigation conducted by FHFA, or in connection with civil litigation, if FHFA has reason to believe the individual to whom the record is disclosed may have further information about the matters related thereto, and the records appears to be relevant and necessary at the time to the subject matter of the inquiry.

(5) To any contractor, agent, or other authorized individual performing work on a contract, service, cooperative agreement, job, or other activity on behalf of FHFA who has a need to access the information in the performance of their official duties or activities.

(6) To a Congressional office from the record of an individual in response to an inquiry from the Congressional office made at the request of that individual.

(7) To a court, magistrate, or administrative tribunal, including disclosures to opposing counsel or witnesses, shared in the course of discovery, litigation, or settlement negotiations or in connection with criminal law proceedings or in response to a subpoena from a court of competent jurisdiction if the requested information is relevant and necessary to the pending judicial or administrative proceeding.

(8) To the Office of Management and Budget, the Department of Justice (DOJ), Department of Labor, Office of Personnel Management, Equal ( printed page 64929) Employment Opportunity Commission, U.S. Office of Special Counsel, Department of Homeland Security, or other Federal agencies, to obtain advice regarding statutory, regulatory, policy, and other requirements related to the purpose for which FHFA collected the records.

(9) To appropriate third parties contracted by FHFA to facilitate mediation or other dispute resolution procedures or programs, where the record is relevant to the dispute and the dispute is related to the purpose for which the record was collected.

(10) To outside counsel contracted by FHFA, DOJ (including United States Attorney Offices), or other Federal agencies conducting litigation or in proceedings before any court, or adjudicative or administrative body, when it is relevant and necessary to the litigation and one of the following is a party to the litigation or has an interest in such litigation:

(a) FHFA;

(b) Any employee of FHFA in his/her official capacity;

(c) Any employee of FHFA in his/her individual capacity where DOJ or FHFA has agreed to represent the employee; or

(d) The United States or any agency thereof that is a party to the litigation or has an interest in such litigation, and FHFA determines that the records are both relevant and necessary to the litigation.

(11) To the National Archives and Records Administration or other Federal agencies pursuant to records management inspections being conducted under the authority of 44 U.S.C. 2904 and 2906.

(12) To an agency, organization, or individual for the purpose of performing audit or oversight operations as authorized by law, but only such information as is relevant and necessary to such audit or oversight functions.

(13) To appropriate Federal, state, and local authorities in connection with hiring or retaining an individual, conducting a background security or suitability investigation, adjudication of liability, or eligibility for a license, contract, grant, or other benefit.

(14) To appropriate Federal, state, and local authorities, agencies, arbitrators, and other parties responsible for processing any personnel actions or conducting administrative hearings or corrective actions or grievances or appeals, or if needed in the performance of other authorized duties.

(15) To officials of a labor organization when relevant and necessary to their duties of exclusive representation concerning personnel policies, practices, and matters affecting working conditions.

(16) To the Washington Metropolitan Transit Authority or other transportation authority to provide transit subsidy benefit related services and systems involving FHFA employees.

(17) To the U.S. Department of the Treasury when disclosure of the information is relevant to review payment and award eligibility through the Do Not Pay Working System for the purposes of identifying, preventing, or recouping improper payments to an applicant for, or recipient of, Federal funds, including funds disbursed by a state (meaning a state of the United States, the District of Columbia, a territory or possession of the United States, or a federally recognized Indian tribe) in a state-administered, federally funded program in accordance with Executive Order 14249.

(18) To the Internal Revenue Service and appropriate state and local taxing authorities if the employee is subject to tax by that authority and to the extent necessary for that entity to carry out its legally authorized functions, whether or not tax is withheld.

(19) To the U.S. Department of the Treasury, Federal debt collection centers, other appropriate Federal agencies, and private collection contractors or other third parties authorized by law, for the purpose of collecting or assisting in the collection of delinquent debts owed to FHFA or the Federal government. Disclosure will be limited to the individual's name, Social Security number, and other information necessary to establish the identity of the individual, and the existence, validity, amount, status, and history of the debt.

(20) To government and commercial vendors that provide parking-related services and systems involving FHFA employees and visitors as relevant and necessary to facilitate the administration of FHFA's parking and transit subsidy programs.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Records are maintained in electronic format. Electronic records are stored on FHFA's secured network, the networks of FHFA-authorized cloud service providers, and/or FHFA authorized contractor networks located within the Continental United States. All records for the system that are stored in paper format or on magnetic disk or tape have been moved off-site to Federal Records Centers.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Records are indexed and retrieved by employee name, employee identification number, or parking permit number.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

The records are retained and managed in accordance with FHFA's Comprehensive Records Schedule and the National Archives and Records Administration's General Records Schedule. Records are destroyed or deleted according to the retention schedule associated with the relevant records schedule, but longer retention is authorized for business use and any applicable legal holds. Paper and microform records ready for disposal are destroyed by shredding or maceration. Records in electronic media are electronically erased using accepted techniques.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

The electronic records are safeguarded in a secured environment and protected by controlled access procedures through the use of role-based access controls and other information technology security measures. Buildings where records and computerized systems are stored have security cameras and 24-hour security guard service. Access to records is restricted to only FHFA staff (and FHFA contractors assisting such staff) in the performance of official duties related to the purposes for which the system of records is maintained.

RECORD ACCESS PROCEDURES:

Individuals seeking access to and/or amendment of records about themselves contained in this system of records should follow the “Notification Procedures” below.

CONTESTING RECORD PROCEDURES:

Individuals seeking access to and/or amendment of records about themselves contained in this system of records should follow the “Notification Procedures” below.

NOTIFICATION PROCEDURES:

Individuals seeking notification of any records about themselves contained in this system of records should address their inquiry to the Privacy Act Officer via email to privacy@fhfa.gov, by mail to the Federal Housing Finance Agency, 400 Seventh Street SW, Washington, DC 20219, or in accordance with the procedures set forth in 12 CFR part 1204. Please note that all mail sent to FHFA via the U.S. Postal Service is ( printed page 64930) routed through a national irradiation facility, a process that may delay delivery by approximately two weeks. For any time-sensitive correspondence, please plan accordingly.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

The system of records notice was last published in the Federal Register at 76 FR 33286 on June 8, 2011, and 80 FR 60900 on October 8, 2015.