SUPPLEMENTARY INFORMATION:

The Department of State proposes to rename the current “Passport Records” system (previously published at 80 FR 15653) as the “Passport Services Records” system. The proposed system will include modifications to sections including Summary; Dates; Addresses; For Further Information Contact; Supplementary Information; System Name and Number; System Location; Authority For Maintenance of the System; Purpose(s) of the System; Routine Uses of Records Maintained in the System; Policies And Practice For Storage of Records; Policies And Practices For Retention And Disposal of Records; Administrative, Technical, And Physical Safeguards; Record Access Procedures; Contesting Record Procedures; Notification Procedures; and History. The purpose of these modifications is to reflect the Department's move to cloud storage and new Office of Management and Budget (OMB) guidance including breach notification routine uses, and to clarify the use of passport records in administrative hearings and by additional users for identity verification.

SYSTEM NAME AND NUMBER:

Passport Services Records, State-26.

SECURITY CLASSIFICATION:

Classified and Unclassified.

SYSTEM LOCATION:

Department of State, Passport Services, Vital Records Section, 44132 Mercure Cir., P.O. Box 1213, Sterling, VA 20166-1213 and within a government cloud provided, implemented, and overseen by the Department's Enterprise Server Operations Center (ESOC), 2201 C Street NW, Washington, DC 20520.

SYSTEM MANAGER(S):

Deputy Assistant Secretary of State for Passport Services, 600 19th Street NW, Fourth Floor, Washington, DC 20431.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

(a) 8 U.S.C. 1104, 1185, 1401-1504 (2025); (b) 18 U.S.C. 911, 1001, 1541-1546 (2024); (c) 22 U.S.C. 211a-218, 2651a, 2705, 2714, 2714a (2025); Executive Order 11295, August 5, 1966, 31 FR 10603; and (d) 26 U.S.C. 6039E (2025).

PURPOSE(S) OF THE SYSTEM:

The information maintained in the Passport Services Records, State-26, is used to establish the U.S. nationality and identity of persons for a variety of legal purposes including, but not limited to, the adjudication of passport applications and requests for related services, social security benefits, voter eligibility, employment applications, estate settlements, and Federal and state law enforcement and counterterrorism purposes.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Records are maintained in the Passport Services Records system about individuals who:

(a) have applied for the issuance, amendment, extension, or renewal of U.S. passport books and passport cards;

(b) were issued U.S. passport books or cards, or had passports amended, extended, renewed, limited, revoked, or denied;

(c) applied to document the birth of a U.S. citizen born abroad;

(d) were issued a Consular Report of Birth Abroad of U.S. citizens or for whom Certifications of Birth have been issued;

(e) were born in and/or died in the former Panama Canal Zone prior to October 1979;

(f) registered at U.S. diplomatic or consular posts as U.S. citizens living or traveling abroad prior to 1990;

(g) were issued Cards of Registration and Identity as U.S. citizens;

(h) were issued Certificates of Loss of Nationality of the U.S. by the Department of State;

(i) applied at U.S. diplomatic or consular posts for issuance of Certificates of Witness to marriage and individuals who have been issued Certificates of Witness to Marriage prior to 1989;

(j) deceased individuals for whom a Report of Death of a U.S. Citizen Abroad has been obtained;

(k) although U.S. citizens, are not or may not be entitled under relevant passport laws and regulations to the issuance or possession of U.S. passport books, cards, or other documentation nor service(s);

(l) have previous passport records that must be reviewed before further action can be taken on their passport application or request for other consular services;

(m) requested their own or another's passport records under the Freedom of Information Act (FOIA) or Privacy Act, whether successfully or not; or

(n) have corresponded with Passport Services concerning various aspects of the issuance or denial of a specific applicant's U.S. passport books or cards.

CATEGORIES OF RECORDS IN THE SYSTEM:

Passport Services maintains U.S. passport records for passports issued from 1925 to present, as well as vital records related to births abroad, deaths, and witnesses to marriage overseas. The passport records system does not maintain evidence of travel such as entrance/exit stamps, visas, or residence permits, since this information is entered into the passport book after it is issued. The passport records system includes the following categories of records:

(a) Passport books and passport cards (“passports”), applications for passports, and applications for additional visa pages, amendments, extensions, replacements, and/or renewals of passports (including all information and materials submitted as part of or with all such applications);

(b) Applications for registration at U.S. diplomatic and consular posts as U.S. citizens or for issuance of Cards of Identity and Registration as U.S. citizens;

(c) Consular Reports of Birth Aboard of United States citizens;

(d) Panama Canal Zone birth and death certificates;

(e) Certificates of Witness to Marriage;

(f) Certificates of Loss of United States Nationality;

(g) Oaths of Repatriation;

(h) Consular Certificates of Repatriation;

(i) Reports of Death of a U.S. Citizen Abroad;

(j) Cards of Identity and Registration as U.S. citizens;

(k) Lookout files which identify those persons whose applications for a consular or related services required other than routine examination or action;

(l) Lost, Stolen or Revoked passport status; and

(m) Miscellaneous materials, which are documents and/or records maintained separately, if not in the application, including but not limited to ( printed page 66908) the following types of documents: Investigatory reports compiled in connection with granting or denying passport and related services or prosecuting violations of passport criminal statutes; Transcripts and opinions on administrative hearings, appeals, and civil actions in Federal courts; Legal briefs, memoranda, judicial orders and opinions arising from administrative determinations relating to passports and citizenship; Birth and baptismal certificates; Copies of state-issued driver's licenses and identity cards; Court orders; Arrest warrants; Medical, personal and financial reports; Affidavits; Inter-agency and intra-agency memoranda, telegrams, letters and other miscellaneous correspondence; An electronic index of all passport application records created since 1978; and/or An electronic index of Department of State Reports of Birth of U.S. Citizens Abroad and Consular Reports of Death Abroad.

RECORD SOURCE CATEGORIES:

These records contain information obtained primarily from the individual who is the subject of these records; law enforcement agencies; investigative intelligence sources; investigative security sources; and officials of foreign governments.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

Records in the Passport system may be disclosed to the following users:

(a) Department of Homeland Security for border patrol, screening, and security purposes; law enforcement, counterterrorism, and fraud prevention activities; for verification of passport validity to support employment eligibility and identity corroboration for public and private employment through E-Verify, and for assisting U.S. state or territory driver's licensing or identification issuing authorities seeking to confirm the authenticity of the U.S. passport when it is presented as evidence of identity, nationality, and/or lawful status to acquire a driver's license or identification card;

(b) Department of Justice, including the Federal Bureau of Investigation, the Bureau of Alcohol, Tobacco, Firearms and Explosives, the U.S. Marshals Services, and other components, for law enforcement, counterterrorism, firearms sales and purchases in accordance with 18 U.S.C. 922, border security, fraud prevention, and criminal and civil litigation activities;

(c) Internal Revenue Service for the mailing and permanent addresses of specifically identified taxpayers in connection with pending actions to collect taxes accrued, examinations, and/or other tax-related assessment and collection activities; and an annual transmission of certain data from applications of those U.S. citizens residing abroad consistent with applicable requirements of 26 U.S.C. 6039E;

(d) INTERPOL and other international organizations for law enforcement, counterterrorism, fraud prevention, and criminal activities related to lost and stolen passports;

(e) National Counterterrorism Center to support strategic operational planning and counterterrorism intelligence activities;

(f) Office of Personnel Management (OPM), other Federal agencies, or contracted outside entities to support the investigations OPM, other Federal agencies and contractor personnel conduct for the Federal government in connection with verification of employment eligibility and/or the issuance of a security clearance;

(g) Social Security Administration to support employment-eligibility verification for public and private employers and for support in verification of social security numbers used in processing U.S. passport applications;

(h) Federal law enforcement and intelligence agencies to support their efforts in identifying, verifying identity, and investigating individuals potentially involved in or associated with criminal or terrorist activities and individuals with other ties or connections to terrorism who may pose a threat to the United States;

(i) Federal, state, local or other agencies having information on an individual's history, nationality, or identity, to the extent necessary to obtain information from these agencies relevant to adjudicating an application for a passport or related service, or where there is reason to believe that an individual has applied for or is in possession of a U.S. passport fraudulently or has violated the law;

(j) Federal, state, local or other agencies for use in legal proceedings, as government counsel deems appropriate, in accordance with any understanding reached by the agency with the U.S. Department of State;

(k) Department of Defense for the purpose of responding to inquiries from U.S. military installations concerning the current status of diplomatic, official, or no-fee regular passport applications of Department of Defense personnel and eligible family members;

(l) Immediate family when the information is necessary as a result of a serious and emergency situation, and for the benefit of the subject;

(m) Private U.S. citizen “wardens” designated by U.S. embassies and consulates to serve, primarily in emergency and evacuation situations, as channels of communication with other U.S. citizens in the local community;

(n) Parties and their attorneys in administrative or judicial passport proceedings when necessary for the adjudication of a case involving the individual who is the subject of a Departmental record;

(o) Members of Congress, at the request of the individual to whom the record pertains;

(p) Contractor personnel conducting data entry, scanning, corrections, and modifications on behalf of an agency and for a purpose otherwise covered by this Notice;

(q) Commercial vendors conducting applicant identity verification against commercial databases upon request of the Department of State;

(r) Foreign governments, to permit such governments to fulfill passport control and immigration duties and their own law enforcement, counterterrorism, and fraud prevention functions, and to support U.S. law enforcement, counterterrorism, and fraud prevention activities;

(s) U.S. state vital records issuing authorities for the purpose of confirming or validating a U.S. passport when it is presented as evidence to acquire certified copies of vital records;

(t) The National Association for Public Health Statistics and Information Systems for the purpose of verifying a Consular Report of Birth Abroad presented as evidence of nationality and/or lawful status when acquiring a driver's license or identification card at a U.S. state or territory driver's licensing or identification issuing authority;

(u) To appropriate agencies, entities, and persons when (1) the Department of State suspects or has confirmed that there has been a breach of the system of records; (2) the Department of State has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Department of State (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Department of State efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm. ( printed page 66909)

(v) To another Federal agency or Federal entity, when the Department of State determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach;

(w) Various entities including, but not limited to, Federal, state, territorial, tribal, and local government agencies, and non-profit organizations, utilizing federal government verification platforms, for the purpose of verifying the identity or citizenship for users accessing government websites and applications, voter eligibility, and other governmental services; and

(x) Government agencies other than the ones listed above that have statutory or other lawful authority to maintain such information may also receive access on a need-to-know basis; however, all information is made available to users only for a previously established routine use.

The Department of State periodically publishes in the Federal Register its standard routine uses that apply to all of its Privacy Act systems of records. These notices appear in the form of a Prefatory Statement (published in Volume 73, Number 136, Public Notice 6290, on July 15, 2008). All these standard routine uses apply to Passport Services Records, State-26.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Records are stored both in hard copy and on electronic media. A description of standard Department of State policies concerning storage of electronic records is found here fam.state.gov/​fam/​05fam/​05fam0440.html. All hard copies of records containing personal information are in secured file cabinets in restricted areas, access to which is limited to authorized personnel only.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

By individual name, date and place of birth, social security number, passport book or passport card number.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

Records are retained in accordance with the following Records Disposition Schedule: N1-059-90-23, item 1(3); N1-059-04-02, item 15e; N1-059-04-02, item 15h; DAA-0059-2020-0017-0009 ; DAA-0059-2020-0017-0002 ; DAA-0059-2020-0017-0011 ; DAA-0059-2020-0017-0025.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

All users are given cyber security awareness training which covers the procedures for handling Sensitive but Unclassified (SBU) information, including personally identifiable information (PII). Annual refresher training is mandatory. In addition, all Department OpenNet users are required to take the National Foreign Affairs Training Center distance learning course instructing employees on privacy and security requirements, including the rules of behavior for handling PII and the potential consequences if it is handled improperly. Before being granted access to Passport Services Records, State-26, a user must first be granted access to the Department of State computer system.

Department of State employees and contractors may remotely access this system of records using non-Department owned information technology. Such access is subject to approval by the Department of State's mobile and remote access program and is limited to information maintained in unclassified information systems. Remote access to the Department of State's information systems is configured in compliance with OMB Circular Memorandum A-130 multifactor authentication requirements and includes a time-out function.

All Department of State employees and contractors with authorized access to records maintained in this system of records have undergone a background security investigation. Access to the Department of State, its annexes and posts abroad is controlled by security guards and admission is limited to those individuals possessing a valid identification card or individuals under proper escort. Access to computerized files is password-protected and under the direct supervision of the system manager. The system manager has the capability of printing audit trails of access from the computer media, thereby permitting regular and ad hoc monitoring of computer usage. When it is determined that a user no longer needs access, the user account is disabled.

Physical records containing personal information are maintained in secured file cabinets or in restricted areas, access to which is limited to authorized personnel. Servers are stored in secured facilities in cipher locked server rooms. Physical access to the server rooms is limited to authorized personnel only. The system is secured with the safeguards required by OMB Memorandum M-07 16 as may be applicable.

The safeguards in the following paragraphs apply only to records that are maintained in government-certified cloud systems. All cloud systems that provide IT services and process Department of State information must be specifically authorized by the Department of State Authorizing Official and Senior Agency Official for Privacy.

Information that conforms with Department of State-specific definitions for Federal Information Security Modernization Act (FISMA) low, moderate, or high categorization are permissible for cloud usage and must specifically be authorized by the Department of State's Cloud Program Management Office and the Department of State Authorizing Official. Specific security measures and safeguards will depend on the FISMA categorization of the information in a given cloud system. In accordance with Department of State policy, systems that process more sensitive information will require more stringent controls and review by Department of State cybersecurity experts prior to approval. Prior to operation, all cloud systems must comply with applicable security measures that are outlined in FISMA, FedRAMP, OMB regulations, National Institute of Standards and Technology's (NIST) Special Publications (SP) and Federal Information Processing Standards (FIPS) and Department of State policies and standards.

All data stored in cloud environments categorized above a low FISMA impact risk level must be encrypted at rest and in-transit using a federally-approved encryption mechanism. The encryption keys shall be generated, maintained, and controlled in a Department of State data center by the Department of State key management authority. Deviations from these encryption requirements must be approved in writing by the Department of State Authorizing Official. High FISMA impact risk level systems will additionally be subject to continual auditing and monitoring, multifactor authentication mechanism utilizing Public Key Infrastructure (PKI) and NIST 800 53 controls concerning virtualization, servers, storage and networking, as well as stringent measures to sanitize data from the cloud service once the contract is terminated.

RECORD ACCESS PROCEDURES:

Individuals who wish to gain access to or amend records pertaining to themselves should submit a Privacy Act request to the U.S. Department of State Information Access Programs (IAP) ( printed page 66910) directorate by following the guidance and procedures located at foia.state.gov/​request/​request2.aspx. Mailed requests can be addressed to U.S. Department of State, Information Access Programs Directorate (A/SKS/IAP); 2201 C Street NW; Washington, DC 20520-0000. To request information under the Privacy Act, the individual should be a citizen of the United States, or an alien lawfully admitted for permanent residence. The Privacy Act permits access to an individual's own records only if those records are within a system of records that are retrieved by an individual's name or personal identifier.

CONTESTING RECORD PROCEDURES:

Individuals who wish to contest the content of any record pertaining to him or her in the system should write to U.S. Department of State; Information Access Programs Directorate (A/SKS/IAP); 2201 C Street NW; Washington, DC 20520-0000.

NOTIFICATION PROCEDURES:

Individuals who wish to be notified if the system contains a record pertaining to him or her should write to the U.S. Department of State; Information Access Programs Directorate (A/SKS/IAP); 2201 C Street NW; Washington, DC 20520-0000.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

Pursuant to 5 U.S.C. 552a (k)(1), (k)(2), and (k)(3), certain records contained within this system of records may be exempt from subsections 5 U.S.C. 552a (c)(3), (d), (e)(1); (e)(4)(G), (e)(4)(H), (e)(4)(I) and (f).

HISTORY:

Passport Records, State-26, was previously published at 80 FR 15653.

91 FR 66906