System of Records Notice

[Federal Register: June 5, 2007 (Volume 72, Number 107)]

[Notices]

[Page 31080-31082]

From the Federal Register Online via GPO Access [wais.access.gpo.gov]

[DOCID:fr05jn07-58]

=======================================================================

-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY

Office of the Secretary

[Docket No. DHS-2007-0027]

Privacy Act; IDENT System of Records

AGENCY: Privacy Office, Office of the Secretary, Department of Homeland

Security.

ACTION: Notice of updated Privacy Act system of records notice.

-----------------------------------------------------------------------

SUMMARY: The Department of Homeland Security is republishing the

Privacy Act system of records notice for the Automated Biometric

Identification System in order (1) to add a category of records that

comprises unique personal identifiers that links individuals with their

encounters, biometrics, records, and other data elements and (2) to add

a new routine use consistent with Office of Management and Budget

Memorandum M-07-16, Attachment 2 that permits DHS to be in the best

position to respond in a timely and effective manner in the event of a

data breach. This republished system of records notice will replace the

previously published system of records notice for the Automated

Biometric Identification System, Federal Register on July 27, 2006 (71

FR 42651).

DATES: Written comments must be submitted on or before July 5, 2007.

ADDRESSES: You may submit comments, identified by DOCKET NUMBER DHS-

2007-0027 by one of the following methods:

Federal e-Rulemaking Portal: http://www.regulations.gov.

Follow the instructions for submitting comments.

Fax: 1-866-466-5370.

Mail: Hugo Teufel III, Chief Privacy Officer, Privacy

Office, Department of Homeland Security, Washington, DC 20528.

FOR FURTHER INFORMATION CONTACT: Claire Miller, US-VISIT Acting Privacy

Officer, Department of Homeland Security, Washington, DC 20528. For

privacy issues please contact: Hugo Teufel III, Chief Privacy Officer,

Privacy Office, U.S. Department of Homeland Security, Washington, DC

20528.

SUPPLEMENTARY INFORMATION: In accordance with the Privacy Act of 1974,

5 U.S.C. 552a, the Department of Homeland Security (DHS) is publishing

a revision to an existing Privacy Act system of records known as

Automated Biometric Identification System (IDENT). The notice for these

systems of records was last published in the Federal Register on July

27, 2006 (71 FR 42651).

DHS is republishing IDENT in order (1) to add a category of records

that comprises unique personal identifiers that links individuals with

their encounters, biometrics, records, and other data elements and (2)

to add a new routine use consistent with Office of Management and

Budget Memorandum M-07-16, Attachment 2 that permits DHS to be in the

best position to respond in a timely and effective

[[Page 31081]]

manner in the event of a data breach. This republished system of

records notice will replace the previously published system of records

notice for the Automated Biometric Identification System, Federal

Register on July 27, 2006 (71 FR 42651).

IDENT is the primary repository of biometric information held by

DHS in connection with its several and varied missions and functions,

including, but not limited to: The enforcement of civil and criminal

laws (including the immigration and customs laws), including

investigations, inquiries, and proceedings thereunder; and national

security and intelligence activities. IDENT is a centralized and

dynamic DHS-wide biometric database that also contains limited

biographic and encounter history information needed to place the

biometric information in proper context. The information is collected

by, on behalf of, in support of, or in cooperation with DHS and its

components and may contain personally identifiable information

collected by other federal, state, local, tribal, foreign, and

international agencies. As part of an effort to more accurately

identify individuals and ensure that all encounters are appropriately

linked, IDENT will generate, store, and retrieve data by unique numbers

or sequence of numbers and characters. This SORN update adds a category

of records to IDENT to include these unique numbers or sequence of

numbers and characters, also known as enumerators that link individuals

with their encounters, biometrics, records, and other data elements.

Additionally, this SORN adds a new routine consistent with Office of

Management and Budget Memorandum M-07-16, Attachment 2 that permits DHS

to be in the best position to respond in a timely and effective manner

in the event of a data breach.

In accordance with 5 U.S.C. 552a(r), DHS has provided a report of

this system change to the Office of Management and Budget and to

Congress.

DHS/US-VISIT-001

System name:

DHS Automated Biometric Identification System (IDENT).

System location:

US-VISIT, Department of Homeland Security (DHS), Washington, DC

20528.

Categories of individuals covered by the system:

Categories of individuals covered by this notice consist of:

A. Individuals whose biometrics are collected by, on behalf of, in

support of, or in cooperation with DHS concerning operations that

implement and/or enforce laws, regulations, treaties, or orders related

to the mission of DHS.

B. Individuals whose biometrics are collected by, on behalf of, in

support of, or in cooperation with DHS as part of a background check or

security screening in connection with their hiring, retention,

performance of a job function, or the issuance of a license or

credential.

C. Individuals whose biometrics are collected by federal, state,

local, tribal, foreign, or international agencies for national

security, law enforcement, immigration, intelligence, or other DHS

mission-related functions, and who are the subjects of wants, warrants,

or lookouts or any other subject of interest.

Categories of records in the system:

IDENT contains biometric, biographic, unique machine-generated

identifiers, and encounter-related data for operation/production,

testing, and training environments. Biometric data includes, but is not

limited to, fingerprints and photographs. Biographical data includes,

but is not limited to, name, date of birth, nationality, and other

personal descriptive data. The encounter data provides the context of

the interaction with an individual including, but not limited to,

location, document numbers, and reason fingerprinted. Unique machine-

generated identifiers are identifiers that link individuals with their

encounters, biometrics, records, and other data elements. Test data may

be real or simulated biometric, biographic, encounter, or identifiers

related data.

Authority for maintenance of the system:

6 U.S.C. 202, 8 U.S.C. 1103, 1158, 1201, 1225, 1324, 1357, 1360,

1365a, 1365b, 1379, and 1732; 19 U.S.C. 1589a.

Purpose(s):

This system of records is established and maintained to provide a

DHS-wide repository of biometrics captures in DHS or law enforcement

encounters. This will enable DHS to carry out its DHS national

security, law enforcement, immigration, intelligence, and other

mission-related functions, and to provide associated testing, training,

management reporting, planning and analysis, and other administrative

uses, by allowing DHS to positively identify an individual whether the

name information is the same or different based on biometrics.

Routine uses of records maintained in the system, including categories

of users and the purposes of such uses:

In addition to those disclosures generally permitted under 5 U.S.C.

552a(b) of the Privacy Act, all or a portion of the records or

information contained in this system may be disclosed outside DHS as a

routine use pursuant to 5 U.S.C. 552a(b)(3), as follows:

A. To appropriate federal, state, local, tribal, foreign, or

international agencies seeking information on the subjects of wants,

warrants, or lookouts, or any other subject of interest, for purpose

related to administering or enforcing the law, national security,

immigration, or intelligence, where consistent with a DHS mission-

related function as determined by DHS.

B. To appropriate federal, state, local tribal, foreign, or

international government agencies charged with national security, law

enforcement, immigration, intelligence, or other DHS mission-related

functions in connection with the hiring or retention by such an agency

of an employee, the issuance of a security clearance, the reporting of

an investigation of that employee (but only if the System of Records in

which the investigatory files are maintained allows such disclosure),

the letting of a contract, or the issuance of a license, grant, loan,

or other benefit by the requesting agency.

C. To an actual or potential party or to his or her attorney for

the purpose of negotiation or discussion on such matters as settlement

of the case or matter, or discovery proceedings.

D. To a Congressional office from the record of an individual in

response to an inquiry from that Congressional office made at the

request of the individual to whom the record pertains.

E. To the National Archives and Records Administration or other

Federal government agencies pursuant to records management inspections

being conducted under the authority of 44 U.S.C. Sections 2904 and

2906.

F. To individual who are obligors or representatives of obligors of

bonds posted.

G. To contractors, grantees, experts, consultants, and others

performing or working on a contract, service, grant, cooperative

agreement, or other assignment for the Federal Government, when

necessary to accomplish a DHS mission function related to this system

of records. Such recipients are required to comply with the Privacy

Act, 5 U.S.C. 552a, as amended.

H. To the Department of Justice (DOJ) or other Federal agency for

purposes of conducting litigation or proceedings

[[Page 31082]]

before any court, adjudicative, or administrative body when (1) DHS; or

(2) Any employee of DHS in his/her official capacity; or (3) Any

employee of DHS in his/her individual capacity, where DOJ or DHS has

agreed to represent the employee; or (4) The United States or any

agency thereof is a party to the litigation or proceeding, or has an

interest in such litigation or proceeding.

I. To appropriate agencies, entities, and persons when (1) it is

suspected or confirmed that the security or confidentiality of

information in the system of records has been compromised; (2) DHS has

determined that as a result of the suspected or confirmed compromise

there is a risk of harm to economic or property interests, identity

theft or fraud, or ham to the security or integrity of this system or

other systems or programs (whether maintained by DHS or another agency

or entity) that rely upon the compromised information; and (3) the

disclosure is made to such agencies, entities, and persons when

reasonably necessary to assist in connection with DHS's efforts to

respond to the suspected or confirmed compromise and prevent, minimize,

or remedy such harm.

Policies and practices for storing, retrieving, accessing, retaining,

and disposing of records in the system:

Storage:

Information can be stored in case file folders, cabinets, safes, or

a variety of electronic or computer databases and storage media.

Retrievability:

Records may be retrieved by biometrics or select personal

identifiers, including but not limited to names, identification

numbers, date of birth, nationality, document number, and address.

Safeguards:

The system is protected through multi-layer security mechanisms.

The protective strategies are physical, technical, administrative, and

environmental in nature, and provide access to control to sensitive

data, physical access control to DHS facilities, confidentiality of

communications, authentication of sending parties, and personnel

screening to ensure that all personnel with access to data are screened

through background investigations commensurate with the level of access

required to perform their duties.

Retention and disposal:

The following proposal for retention and disposal is pending

approval with National Archives and Records Administration (NARA):

Records that are stored in an individual's file will be purged

according to the retention and disposition guidelines that relate to

the individual's file in DHS/US-VISIT-001, IDENT.

Testing and training data will be purged when the data is no longer

required (GRS 20). Electronic records for which the statute of

limitations has expired for all criminal violations or that are older

than 75 years will be purged. Fingerprint cards, created for the

purpose of entering records in the database, will be destroyed after

data entry. Work Measurement Reports and Statistical Reports will be

maintained within the guidelines set forth in NCI-95-78-5/2 and NCI-85-

78-1/2 respectively.

System manager(s) and address:

System Manager, IDENT Program Management Office, US-VISIT Program,

U.S. Department of Homeland Security, Washington, DC 20528, USA.

Notification procedure:

To determine whether this system contains records relating to you,

write to the US-VISIT Privacy Officer, US-VISIT Program, U.S.

Department of Homeland Security, 245 Murray Lane, SW., Washington, DC

20528, USA.

Record access procedures:

The major part of this system is exempted from this requirement

pursuant to 5 U.S.C. 552a(j)(2) and (k)(2). A determination as to the

granting or denial of access shall be made at the time a request is

received. Requests for access to records in this system must be in

writing, and should be addressed to the US-VISIT Privacy Officer at the

address in the Notification procedure section above. Such request may

be submitted either by mail or in person. The envelope and letter shall

be clearly marked ``Privacy Officer--Access/Redress Request.'' To

identify a record, the record subject should provide his or her full

name, date and place of birth; if appropriate, the date and place of

entry into or departure from the United States; verification of

identity by submitting a copy of fingerprints if appropriate (in

accordance with 8 CFR 103.21(b) and/or pursuant to 28 U.S.C. 1746, make

a dated statement under penalty of perjury as a substitute for

notarization), and any other identifying information that may be of

assistance in locating the record. The requestor shall also provide a

return address for transmitting the records to be released.

Contesting record procedures:

The major part of this system is exempted from this requirement

pursuant to U.S.C. 552a(j)(2) and (k)(2). A determination as to the

granting or denial of a request shall be made at the time a request is

received. An individual requesting amendment of records maintained in

this system should direct his or her request to the System Manager

noted above. The request should state clearly what information is being

contested, the reasons for contesting it, and the proposed amendment to

the information.

Record source categories:

Basic information contained in this system is supplied by

individuals covered by this system, and from Federal, State, local,

tribal, or foreign governments; private citizens; and public and

private organizations.

Exemptions claimed for the system:

The Secretary of Homeland Security has exempted this system from 5

U.S.C. 552a(c)(3) and (4); (d); (e)(1), (e)(2), (e)(3), (e)(4)(G),

(e)(4)(H), (e)(5) and (e)(8); (f)(2) through (5); and (g) pursuant to 5

U.S.C. 552a(j)(2). In addition, the Secretary of Homeland Security has

exempted portions of this system from 5 U.S.C. 552a(c)(3), (d), (e)(1),

(e)(4)(G), and (e)(4)(H) pursuant to 5 U.S.C. 552a(k)(2). These

exemptions apply only to the extent that records in the system are

subject to exemption pursuant to 5 U.S.C. 552a(j)(2) and (k)(2).

Dated: May 25, 2007.

Hugo Teufel III,

Chief Privacy Officer.

[FR Doc. 07-2781 Filed 5-31-07; 1:24 pm]

BILLING CODE 4410-10-M