Sorn

DEPARTMENT OF DEFENSE

Department of the Air Force

Narrative Statement for a Modified System of Records

Under the Privacy Act of 1974

1. System name and number: Air Force Family Integrated result and Statistical Tracking (AFFIRST) - F036 AFPC Z

2. Nature of proposed modifications for the system: The Department of the Air Force is proposing to alter the existing system of records by System Location, Categories of Individuals and System Managers and Address to reflect the most current information about the system and who we collect data from. AFFIRST is a vital tool for Airman & Family Readiness Center (A&FRC) Operations. Data collected is used to effectively deliver, analyze and report services provided to military/family members and individuals in the general public that are authorized to use our services. In addition, information reported from the system is used to help leadership at all levels determine program effectiveness, direction, manpower and funding needs.

3. Specific authority under which the system of records is maintained: 10 United States Code (U.S.C.) 8013, Secretary of the Air Force: powers and duties; delegation by; as implemented by Air Force Instruction 36-3009, Airman and Family Readiness Centers; and Executive Order (E.O.) 9397 (Social Security Number - SSN), as amended.

4. Provide the agency’s evaluation on the probable or potential effect on the privacy of individuals: In developing this SORN, the Department of the Air Force reviewed the safeguards established for the system to ensure they are compliant with DoD requirements and are appropriate to the sensitivity of the information stored within the system.

5. Routine use compatibility: In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act of 1974, as amended, these records contained therein may specifically be disclosed outside the DoD as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:

a. To the appropriate Federal, State, local, territorial, tribal, foreign, or international law enforcement authority or other appropriate entity where a record, either alone or in conjunction with other information, indicates a violation or potential violation of law, whether criminal, civil, or regulatory in nature.

b. To any component of the Department of Justice for the purpose of representing the DoD, or its components, officers, employees, or members in pending or potential litigation to which the record is pertinent.

c. In an appropriate proceeding before a court, grand jury, or administrative or adjudicative body or official, when the DoD or other Agency representing the DoD determines that the records are relevant and necessary to the proceeding; or in an appropriate proceeding before an administrative or adjudicative body when the adjudicator determines the records to be relevant to the proceeding.

d. To the National Archives and Records Administration for the purpose of records management inspections conducted under the authority of 44 U.S.C. §§ 2904 and 2906.

e. To a Member of Congress or staff acting upon the Member’s behalf when the Member or staff requests the information on behalf of, and at the request of, the individual who is the subject of the record.

f. To appropriate agencies, entities, and persons when (1) the DoD suspects or has confirmed that there has been a breach of the system of records; (2) the DoD has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the DoD (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the DoD’s efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

g. To another Federal agency or Federal entity, when the DoD determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

Reference: OMB Circular A-108

6. OMB public information collection requirements:

OMB collection required: Yes

OMB Control Number (if approved): 0701-0700

Title of collection if different: Not Different

Date Approved or Submitted to OMB: Awaiting Approval

Expiration Date (if approved): Awaiting Approval

Title of Information Collection requests: AFFIRST Customer record

If collecting on members of the public and no OMB approval is required, state the applicable exception(s): N/A

7. Name of IT System: Air Force Family Integrated Results & Statistical Tracking (AFFIRST). DITPR #9051.

8. Is the system, in whole or in part, being maintained, collected, used or disseminated by a contractor? Yes. AFFIRST is being hosted and maintained by a contractor. Airman & Family Readiness Center (A&FRC) staff use the system.

AGENCY: Department of the Air Force

ACTION: Notice of a Modified System of Records.

SUMMARY: The Department of the Air Force proposes to alter a system of records notice, F036 AFPC Z, entitled “Air Force Family Integrated Result and Statistical Tracking (AFFIRST)”

AFFIRST is a web-based application that is a vital tool for Airman & Family Readiness Center (A&FRC) Operations. Data collected is used to effectively deliver, analyze and report services provided to military/family members and individuals in the general public that are authorized to use our services. In addition, information reported from the system is used to help leadership at all levels determine program effectiveness, direction, manpower and funding needs.

DATES: Comments will be accepted on or before [INSERT 30-DAYS FROM DATE PUBLISHED IN THE FEDERAL REGISTER]. This proposed action will be effective the date following the end of the comment period unless comments are received which result in a contrary determination.

ADDRESSES: You may submit comments, identified by docket number and title, by any of the following methods:

* Federal Rulemaking Portal: http://www.regulations.gov

Follow the instructions for submitting comments.

* Mail: Department of Defense, Office of the Deputy Chief Management Officer, Directorate of Oversight and Compliance, Regulatory and Audit Matters Office, 9010 Defense Pentagon, Washington, DC 20301-9010.

Instructions: All submissions received must include the agency name and docket number for this Federal Register document. The general policy for comments and other submissions from members of the public is to make these submissions available for public viewing on the Internet at http://www.regulations.gov as they are received without change, including any personal identifiers or contact information.

FOR FURTHER INFORMATION CONTACT: Mr. LaDonne White, Department of the Air Force, Air Force Privacy Office, Office of Warfighting Integration and Chief Information Officer, ATTN: SAF/CIO A6, 1800 Air Force Pentagon, Washington, DC 20330-1800, or by phone at (571) 256-2515.

SUPPLEMENTARY INFORMATION: The Department of the Air Force's notices for systems of records subject to the Privacy Act of 1974 (5 U.S.C. 552a), as amended, have been published in the Federal Register and are available from the address in the FOR FURTHER INFORMATION CONTACT or from the Defense Privacy and Civil Liberties Division website at http://dpcld.defense.gov/

The proposed systems reports, as required by 5 U.S.C. 552a(r) of the Privacy Act of 1974, as amended, were submitted on (INSERT DATE) to the House Committee on Oversight and Government Reform, the Senate Committee on Homeland Security and Governmental Affairs, and the Office of Management and Budget (OMB) pursuant to paragraph 4c of Appendix I to OMB Circular No. A-130, “Federal Agency Responsibilities for Maintaining Records About Individuals,” dated February 8, 1996, (February 20, 1996, 61 FR 6427).

1. SYSTEM NAME AND NUMBER: Air Force Family Integrated Result and Statistical Tracking (AFFIRST) - F036 AFPC Z

2. SECURITY CLASSIFICATION: Unclassified

3. SYSTEM LOCATION: AFPC/DPFF

4. SYSTEM MANAGER(S): Air Force Family Integrated Results and Statistical Tracking system (AFFIRST) Program Manager, Headquarters Air Force Personnel Center (AFPC), Airman and Family Division, Directorate of Airman and Family Care, (AFPC/DPFF), 550 C Street West, JBSA-Randolph Air Force Base, TX 78150-4712.

5. AUTHORITY FOR MAINTENANCE OF THE SYSTEM: 10 United States Code (U.S.C.) 8013, Secretary of the Air Force: powers and duties; delegation by; as implemented by Air Force Instruction 36-3009, Airman and Family Readiness Centers; and Executive Order (E.O.) 9397 (Social Security Number - SSN), as amended.

6. PURPOSE OF THE SYSTEM: To maintain a record of customer service data determining the effectiveness of Airman and Family Readiness Center activities and services and provide reports reflecting impact of services on mission and family readiness to leadership. Also used as a management tool for statistical analysis, tracking, reporting, evaluating program effectiveness, and conducting research.

7. CATEGORIES OF INDIVIDUALS COVERED BY THE SYTEM: Military personnel and family members, DoD civilians, individuals enrolled in the Air Force Families Forever (AFFF) program which includes Gold Star Family Members and individuals of the general public who are authorized to use Air Force Family Readiness facilities.

8. CATEGORIES OF RECORDS IN THE SYSTEM: Name, Social Security Number (SSN), Department of Defense Identification number (DoD ID number), gender, date of birth, home address, home and work phone, work e-mail, unit, branch of service, rank, squadron, client visit/service notes of services provided and referrals to other agencies.

9. RECORD SOURCE CATEGORIES: Information obtained from individual, unit of assignment, referral agencies and personnel records.

10. ROUTINE USES OF RECODS MAINTAINED IN THE SYTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES: In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) of the Privacy Act of 1974, these records contained therein may be specifically disclosed outside the DoD as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:

Congressional Inquiries Disclosure Routine Use:
Disclosure from a system of records maintained by a DoD Component may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.

Data Breach Remediation Purposes Routine Use: A record from a system of records maintained by a Component may be disclosed to appropriate agencies, entities, and persons when (1) The Component suspects or has confirmed that the security or confidentiality of the information in the system of records has been compromised; (2) the Component has determined that as a result of the suspected or confirmed compromise there is a risk of harm to economic or property interests, identity theft or fraud, or harm to the security or integrity of this system or other systems or programs (whether maintained by the Component or another agency or entity) that rely upon the compromised information; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Components efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm.

11. POLICIES AND PRACTICES FOR STORAGE OF RECORDS: Records are maintained in a secure hosting facility in the form of electronic storage media; physical entry is restricted by security guards and presentation of authenticated identification badges at entry control points, and cipher locks and key cards for access into buildings. Records are accessed by the custodian of the record system and by person(s) responsible for servicing the record system in the performance of their official duties using Common Access Cards. Persons are properly screened and cleared for access. The information is protected by using user profiles, passwords, and encryption. User profiles are role-based and ensure that only data accessible to the individual’s role will appear on the screen.

12. POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS: Records are retrieved by customer name, SSN or DoD ID number. Only Airman & Family Readiness Center staff with approved AFFIRST user accounts and a need to know open customer records for service delivery data entry.

13. POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS: Electronic Records are destroyed after one year or when no longer needed whichever is later. Electronic records are destroyed by erasing, deleting, or overwriting.

14. ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS: Records are maintained in a secure hosting facility; physical entry is restricted by security guards and presentation of authenticated identification badges at entry control points, and cipher locks and key cards for access into buildings. Records are accessed by person(s) responsible for servicing the record system in the performance of their official duties and by authorized personnel who are properly screened and cleared for need-to-know.  Records are only accessed by authorized personnel with Common Access Card (CAC) and need-to-know.

15. RECORDS ACCESS PROCEDURES: Individuals seeking to access records about themselves contained in this system should address written requests to the system manager, or the installation Airman and Family Center.  Official mailing addresses are published as an appendix to the Air Force’s compilation of systems of records notices.

For verification purposes, individual should provide their full name, SSN and/or DoD ID Number, any details which may assist in locating records, and their signature.

In addition, the requester must provide a notarized statement or an unsworn declaration made in accordance with 28 U.S.C. 1746, in the following format:

If executed outside the United States:

‘I declare (or certify, verify, or state) under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on (date). (Signature)’.

If executed within the United States, its territories, possessions, or commonwealths: ‘I declare (or certify, verify, or state) under penalty of perjury that the foregoing is true and correct. Executed on (date). (Signature)’.

16. CONTESTING RECORD PROCEDURES: The Air Force rules for accessing records and for contesting contents and appealing initial agency determinations are published in Air Force Instruction 33-332, Air Force Privacy Program; 32 CFR part 806b; or may be obtained from the system manager.

17. NOTIFICATION PROCEDURES: Individuals seeking to determine whether this system of records contains information on themselves should address written inquiries to the system manager, or the installation Airman and Family Center. Official mailing addresses are published as an appendix to the Air Force’s compilation of systems of records notices.

For verification purposes, individual should provide their full name, SSN and/or DoD ID Number, any details which may assist in locating records, and their signature.

In addition, the requester must provide a notarized statement or an unsworn declaration made in accordance with 28 U.S.C. 1746, in the following format:

If executed outside the United States:

‘I declare (or certify, verify, or state) under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on (date). (Signature)’.

If executed within the United States, its territories, possessions, or commonwealths: ‘I declare (or certify, verify, or state) under penalty of perjury that the foregoing is true and correct. Executed on (date). (Signature)’.

18. EXEMPTIONS PROMULGATED FOR THE SYSTEM: None.

19. HISTORY: N/A

7