SUPPLEMENTARY INFORMATION:

In accordance with the Privacy Act of 1974 (Privacy Act), 5 U.S.C. 552a, the CFPB is modifying a system of records titled, “CFPB.001—Freedom of Information Act/Privacy Act System.” The modified system of records described in this notice includes the following changes.

First, the CFPB is clarifying that the Chief Privacy Officer is the system manager for records related to requests for amendment of records pursuant to the Privacy Act and the Bureau's Privacy Act implementation regulation, 12 CFR 1070.56.

Second, the authority for maintaining the system is broadened to include the Freedom of Information Act, 5 U.S.C. 552; the Privacy Act of 1974, 5 U.S.C. 552a; and the Federal Records Act, 44 U.S.C. 3101.

Third, the system's purpose is updated to specify that records will be used to process Privacy Act requests to amend records and related subsequent actions, if any.

Fourth, the categories of individuals is modified to clearly include individuals requesting amendment of their records under the Privacy Act.

Fifth, the categories of records is updated to include records pertaining to the processing of requests for amendment of records pursuant to the Privacy Act, and related initial appeals and statements of disagreement, if any.

Sixth, a new routine use is introduced to enable disclosure to the NARA or other Federal agencies conducting records inspections pursuant to the Federal Records Act, 44 U.S.C. 2904 and 2906.

Seventh, the policies and practices for retention and disposal of records are updated to reflect the NARA-approved records retention schedule.

Eighth, the system location is updated to include the new CFPB address.

Lastly, the CFPB is also making non-substantive revisions to the system of records notice to align with the Office of Management and Budget's template in Circular A-108, “Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act,” appendix II (Dec. 2016).

The report of the revised system of records has been submitted to the Committee on Oversight and Government Reform of the U.S. House of Representatives, the Committee on Homeland Security & Governmental Affairs of the U.S. Senate, and the Office of Management and Budget, pursuant to Circular A-108, “Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act” (Dec. 2016) and the Privacy Act of 1974, 5 U.S.C. 552a(r). The modified SORN titled, “CFPB.001—Freedom of Information Act/Privacy Act System” is published in its entirety below.

SYSTEM NAME AND NUMBER:

CFPB.001—Freedom of Information Act/Privacy Act System.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

Consumer Financial Protection Bureau, 445 12th Street SW, Washington, DC 20024.

SYSTEM MANAGER(S):

Chief FOIA Officer and Chief Privacy Officer, Consumer Financial Protection Bureau, 445 12th Street SW, Washington, DC 20024; (855) 444-3642.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

5 U.S.C. 552; 5 U.S.C. 552a; 12 U.S.C. 5492, 5493; 44 U.S.C. 3101.

PURPOSE(S) OF THE SYSTEM:

The information in the system is collected to enable the CFPB to carry out certain specific responsibilities under the Freedom of Information Act (FOIA) and Privacy Act of 1974 (Privacy Act). It allows CFPB staff to receive, track, and respond to access requests and initial administrative appeals under the FOIA as well as access and amendment requests and initial appeals under the Privacy Act, including statements of disagreement regarding a request for amendment. The information is also used to gather data to meet statutory FOIA reporting requirements, outlined in 5 U.S.C. 552(e), mandating that all Federal agencies compile and submit detailed data to the Attorney General regarding their administration of the law and to manage FOIA-related fees and calculations. The information will also be used for administrative purposes to ensure quality control, performance, and improving management processes.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Records are maintained on persons requesting access to records pursuant to the FOIA; individuals who have submitted a request for access to or amendment of records pursuant to the Privacy Act; persons or individuals whose information requests are treated as FOIA and/or Privacy Act requests; and persons or individuals filing an administrative appeal of a denial, in whole or part, of any such request. Other individuals covered include Bureau staff assigned to process such requests and related actions to ensure compliance with the FOIA and/or Privacy Act; individuals submitting on the requester's behalf; and personnel of Federal agencies processing consultations and referrals.

CATEGORIES OF RECORDS IN THE SYSTEM:

Records in the system may contain: (1) correspondence ( e.g., agency acknowledgment letter, access request) from or with the requester or individual submitting on the requester's behalf about the FOIA access requests; Privacy Act access or amendment requests; initial FOIA and/or Privacy Act appeals; and Privacy Act statements of disagreement; (2) documents generated or compiled during the search and processing of the access request for records; (3) fee schedules, cost calculations, and assessed cost for disclosed FOIA and/or PA records; (4) documents and memoranda supporting the decision made in response to the FOIA or PA access request, referral, or consultation, and copies of records provided or withheld; (5) documents and memoranda supporting the decision made in response to the PA amendment requests; (6) documents and memoranda supporting the decision made in response to initial appeals and related actions; (7) identifying information of Bureau staff processing requests and, where a request has been referred to another agency with equities in a responsive document, information about the individual handling the request on behalf of that agency; (8) information identifying the entity that is subject to the requests or appeals; (9) for FOIA access requests, the requester's information, including name, address, ( printed page 66553) phone number, email address, FOIA tracking number, phone number, financial payment information, or some combination thereof; (10) for Privacy Act access or amendment requests, information verifying the identity of the individual who is making the written request or appeal, and/or the individual on whose behalf such written requests are made, including name, a photocopy of a single or two forms of identification that bears the requester's photograph and/or signature ( e.g., driver's license, or Social Security card and identification with photograph), address, phone number, email address, Bureau-generated record number, phone number, financial payment information (for Privacy Act access requests only), or some combination thereof; (11) records related to inquires or communications submitted to other Federal agencies ( e.g., Department of Justice; National Archives and Records Administration, Office of Government Information Services (OGIS)) regarding agency reporting and compliance, and all records related to the resolution of such inquiries.

RECORD SOURCE CATEGORIES:

Information in this system covers individuals about whom records are maintained; agency staff assigned to help process, consider, and respond to the request, including any appeals; entities filing requests or appeals on behalf of the requestor; other governmental authorities; and entities that are the subjects of the request or appeals.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act, and consistent with the CFPB's Disclosure of Records and Information Rules, promulgated at 12 CFR part 1070, all or a portion of the records or information contained in this system may be disclosed outside the CFPB as a routine use to:

(1) Appropriate agencies, entities, and persons when (a) the Bureau suspects or has confirmed that there has been a breach of the system of records; (b) the Bureau has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Bureau (including its information systems, programs, and operations), the Federal Government, or national security; and (c) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Bureau's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

(2) Another Federal agency or entity, when the Bureau determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (a) responding to a suspected or confirmed breach or (b) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

(3) Another Federal or State agency to (a) permit a decision as to access, amendment, or correction of records to be made in consultation with or by that agency, or (b) verify the identity of an individual or the accuracy of information submitted by an individual who has requested access to or amendment or correction of records.

(4) The Executive Office of the President in response to an inquiry from that office made at the request of the subject of a record or a third party on that person's behalf.

(5) Congressional offices in response to an inquiry made at the request of the individual to whom the record pertains.

(6) Contractors, agents, or other authorized individuals performing work on a contract, service, cooperative agreement, job, or other activity on behalf of the Bureau or the Federal Government and who have a need to access the information in the performance of their mission, including duties or activities.

(7) The Department of Justice (DOJ) for its use in providing legal advice to the Bureau or in representing the Bureau in a proceeding before a court, adjudicative body, or other administrative body, where the use of such information by the DOJ is deemed by the Bureau to be relevant and necessary to the advice or proceeding, and such proceeding names as a party in interest:

(a) The Bureau;

(b) Any employee of the Bureau in their official capacity;

(c) Any employee of the Bureau in their individual capacity where DOJ has agreed to represent the employee; or

(d) The United States, where the Bureau determines that litigation is likely to affect the Bureau or any of its components.

(8) A court, magistrate, or administrative tribunal in the course of an administrative proceeding or judicial proceeding, including disclosures to opposing counsel or witnesses (including expert witnesses) in the course of discovery or other pre-hearing exchanges of information, litigation, or settlement negotiations, where relevant or potentially relevant to a proceeding, or in connection with criminal law proceedings.

(9) Appropriate agencies, entities, and persons, including but not limited to potential expert witnesses or witnesses in the course of investigations, to the extent necessary to secure information relevant to the investigation.

(10) Appropriate Federal, State, local, foreign, Tribal, or self-regulatory organizations or agencies responsible for investigating, prosecuting, enforcing, implementing, issuing, or carrying out a statute, rule, regulation, order, policy, or license if the information may be relevant to a potential violation of civil or criminal law, rule, regulation, order, policy, or license.

(11) National Archives and Records Administration, Office of Government Information Services (OGIS), to the extent necessary to fulfill its responsibilities in 5 U.S.C. 552(h), to review administrative agency policies, procedures, and compliance with FOIA, and to facilitate OGIS' offering of mediation services to resolve disputes between persons making FOIA requests and administrative agencies.

(12) National Archives and Records Administration or other Federal Government agencies pursuant to records management inspections being conducted under the authority of 44 U.S.C. 2904 and 2906.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Paper and electronic records.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Records are retrievable by a variety of fields including, but not limited to, the requester's name, the subject matter of request, requestor's organization, FOIA or Bureau-generated tracking number, and staff member assigned to process the request. Records may also be searched by the address, phone number, email address of the requesting party, and subject matter of the request, or by some combination thereof.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

The Bureau will manage these Federal records in accordance with the National Archives and Records Administration (NARA) General Records Schedule (GRS) 4.2. ( printed page 66554)

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

Access to electronic records is restricted to authorized personnel who have been issued non-transferable access codes and passwords. Other records are maintained in locked file cabinets or rooms with access limited to those personnel whose official duties require access.

RECORD ACCESS PROCEDURES:

An individual seeking access to any record pertaining to them contained in this system of records may inquire in writing in accordance with instructions in 12 CFR 1070.50 et seq. Address such requests to: Chief Privacy Officer, Consumer Financial Protection Bureau, 445 12th Street SW, Washington, DC 20024. Instructions are also provided on the Bureau website: www.consumerfinance.gov/​foia-requests/​submit-request/​.

CONTESTING RECORD PROCEDURES:

See “Access Procedures” above.

NOTIFICATION PROCEDURES:

See “Access Procedures” above.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

85 FR 3655; 83 FR 23435; 79 FR 78837; 78 FR 47306; 76 FR 45768.

91 FR 66551