final 1-23-2020- Supporting Statement

Supporting Statement for Paperwork Reduction Act Submission

License for the Use of Personally Identifiable Information Protected Under the

Privacy Act of 1974

OMB Control # 2528-0297

A. Justification

1. Explain the circumstances that make the collection of information necessary. Identify any legal or administrative requirements that necessitate the collection. Attach a copy of the appropriate section of each statute and regulation mandating or authorizing the collection of information

The United States Department of Housing and Urban Development (HUD) collects and maintains personally identifiable information on tenants in public and assisted housing, the confidentiality of which is protected by the Privacy Act of 1974 (5 U.S.C. 552a). On occasion, HUD shares this information with researchers subject to stringent requirements to protect these households from unauthorized disclosure of information. The purpose for sharing is to further policy-relevant research on the effectiveness of HUD programs.

HUD may, under the terms of its Routine Use Inventory (77 FR 17361), share these data with researchers whom HUD has awarded contracts, grants, or service agreements. HUD has shared data with contractors and grantees and will continue to share data under service agreements because it has a legal form for effectuating such an agreement. HUD does not limit access to the information to parties that have received specific funding to carry out a study through a grant or contract. Instead, HUD also shares the data with legitimate research organizations that have conceived policy-relevant analyses and that are able and willing to protect the data from unauthorized disclosure. The legal form for the service agreement is herein called a “license.”

HUD will continue making the data available for statistical, research, or evaluation purposes to organizations qualified and capable of research and analysis consistent with the statistical, research, or evaluation purposes for which the data were provided or are maintained, but only if the data are used and protected in accordance with the terms and condition stated in the license, upon receipt of such assurance of qualification and capability, and it is agreed by the organization requesting such information and HUD.

All data containing personally identifiable information maintained by HUD that are provided the Licensee and all information derived from that data, and all data resulting from mergers, matches, or other uses of the data provided by HUD with other data are subject to the License and are referred to in this License as subject data.

Subject data under this License may be in the form of CD-ROMs, electronic data, hard copy, etc. The Licensee may only use the subject data in a manner and to purpose consistent with the statistical, research, or evaluation purpose for which the data are maintained. All subject data that include personally identifiable information are protected under the Privacy Act and may be used only for statistical, research, or evaluation purposes consistent with the purposes for which the data was collected and or is maintained.

2. Indicate how, by whom and for what purpose the information is to be used. Except for a new collection, indicate the actual use the agency has made of the information received from the current collection.

The United States Department of Housing and Urban Development (HUD) has collected and maintains personally identifiable information (PII), the confidentiality of which is protected by the Privacy Act of 1974 (5 U.S.C. 552a), which it intends to make available to qualified researchers. The information collected will enable HUD to determine whether a data license permitting access to such PII by legitimate research organizations is in the public interest.

3. Describe whether, and to what extent, the collection of information involves the use of automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses, and the basis for the decision for adopting this means of collection. Also describe any consideration of using information technology to reduce burden.

We have maximized the use of email for transmission of documents. Some wet-ink documents must still be physically transmitted.

4. Describe efforts to identify duplication. Show specifically why any similar information already available cannot be used or modified for use for the purposes described in Item 2 above.

There is no other source of the required information. Data licenses are issued only for unique research projects, which must be uniquely described. Assurances by research organizations and affidavits by project staff promising not to disclose the PII provided to them must be uniquely subscribed.

5. If the collection of information impacts small businesses or other small entities (Item 5 of OMB Form 83-I) describe any methods used to minimize burden.

There is no negative impact on small business or other small entities. In fact, they will benefit from Departmental collected and maintained statistical data that they otherwise would not have access to.

6. Describe the consequence to Federal program or policy activities if the collection is not conducted or is conducted less frequently, as well as any technical or legal obstacles to reducing burden.

If the information is not collected, the Department would not be able to enter into an agreement with the applicant. The applicant would not be able to conduct the research, and the Department and the public would lose the results of the research.

7. Explain any special circumstances that would cause an information collection to be conducted in a manner:

• requiring respondents to report information to the agency more than quarterly;

• requiring respondents to prepare a written response to a collection of information in fewer than 30 days after receipt of it;

• requiring respondents to submit more than an original and two copies of any document;

• requiring respondents to retain records other than health, medical, government contract, grant-in-aid, or tax records for more than three years;

• in connection with a statistical survey, that is not designed to produce valid and reliable results than can be generalized to the universe of study;

• requiring the use of a statistical data classification that has not been reviewed and approved by OMB;

• that includes a pledge of confidentiality that is not supported by authority established in statute or regulation, that is not supported by disclosure and data security policies that are consistent with the pledge, or which unnecessarily impedes sharing of data with other agencies for compatible confidential use; or

• requiring respondents to submit proprietary trade secret, or other confidential information unless the agency can demonstrate that it has instituted procedures to protect the information's confidentiality to the extent permitted by law.

The proposed data collection activities are consistent with the guidelines set forth in 5 CFR 1320 (Controlling Paperwork Burdens on the Public). There are no special circumstances that require deviation from these guidelines. The following below are “Not Applicable” to this collection:

• requiring respondents to report information to the agency more often than quarterly; “Not Applicable”

• requiring respondents to prepare a written response to a collection of information in fewer than 30 days after receipt of it; “Not Applicable”

• requiring respondents to submit more than an original and two copies of any document; “Not Applicable”

• requiring respondents to retain records, other than health, medical, government contract, grant-in-aid, or tax records, for more than three years; “Not Applicable”

• in connection with a statistical survey, that is not designed to produce valid and reliable results that can be generalized to the universe of study; “Not Applicable”

• requiring the use of a statistical data classification that has not been reviewed and approved by OMB; “Not Applicable”

• that includes a pledge of confidentiality that is not supported by authority established in statute or regulation, that is not supported by disclosure and data security policies that are consistent with the pledge, or which unnecessarily impedes sharing of data with other agencies for compatible confidential use; or “Not Applicable”

• requiring respondents to submit proprietary trade secrets, or other confidential information unless the agency can demonstrate that it has instituted procedures to protect the information's confidentiality to the extent permitted by law. “Not Applicable”

None of the 8 bullets detailing special circumstances apply. We note here that the current document refers only to the Privacy Act as our authority, although other agencies can cite the Confidential Information Protection and Statistical Efficiency Act.

8. If applicable, provide a copy and identify the date and page number of publication in the Federal Register of the agency's notice, required by 5 CFR 1320.8(d), soliciting comments on the information collection prior to submission to OMB. Summarize public comments received in response to that notice and describe actions taken by the agency in response to these comments. Specifically address comments received on cost and hour burden.

• Describe efforts to consult with persons outside the agency to obtain their views on the availability of data, frequency of collection, the clarity of instructions and recordkeeping disclosure, or reporting format (if any) and the data elements to be recorded, disclosed, or reported.

• Consultation with representatives of those from whom information is to be obtained or those who must compile records should occur at least once every 3 years -- even if the collection of information activity is the same as in prior periods. There may be circumstances that preclude consultation in a specific situation. These circumstances should be explained.

On November 8, 2019, a 60-Day Federal Register Notice was published at Volume 84, No. 217, page 60429. No public comments were received.

1. Explain any decision to provide any payment or gift to respondents, other than renumeration of contractors or grantees.

None

10. Describe any assurance of confidentiality provided to respondents and the basis for assurance in statute, regulation or agency policy.

With respect to the institutions and affiliated researchers applying for the licenses: we make no assurance of confidentiality with respect to the documents submitted in support of any data license, whether the application, the license, the non-disclosure affidavit, or the certificate of data destruction

With respect to the HUD-assisted tenants or other parties whose personal or sensitive information is requested, the licensee undertakes to share that information only with members of the research team, to protect the information from disclosure to others, to store the data on a non-networked computer in a locked room, and to publish research based on the information only after review by HUD to prevent unlawful disclosures.

Any forms in this information collection that do contain person/sensitive information do contain the appropriate Privacy Act Notice in the document and are protected under the Privacy Act and Freedom of Information Act (FOIA) - 5 U.S. Code § 552.  HUD assures confidentiality to respondent on other information collected if it would result in competitive harm in accord with the FOIA provision and/or Department’s mission.

11. Provide additional justification for any questions of a sensitive nature, such as sexual behavior and attitudes, religious beliefs, and other matters that are commonly considered private. This justification should include the reasons why the agency considers the questions necessary, the specific uses to be made of the information, the explanation to be given to persons from whom the information is requested, and any steps to be taken to obtain their consent.

None

12. Provide estimates of the hour burden of the collection of information. The statement should:

• indicate the number of respondents, frequency of response, annual hour burden, and an explanation of how the burden was estimated. Unless directed to do so, agencies should not conduct special surveys to obtain information on which to base hour burden estimates. Consultation with a sample (fewer than 10) of potential respondents is desirable. If the hour burden on respondents is expected to vary widely because of differences in activity, size, or complexity, show the range of estimated hour burden, and explain the reasons for the variance. Generally, estimates should not include burden hours for customary and usual business practices;

• if this request covers more than one form, provide separate hour burden estimates for each form and aggregate the hour burdens in Item 13 of OMB Form 83-I; and

• provide estimates of annualized cost to respondents for the hour burdens for collections of information, identifying and using appropriate wage rate categories. The cost of contracting out or paying outside parties for information collection activities should not be included here. Instead this cost should be included in Item 13.

Table 1: Data Collection Activities and Anticipated Burden

Information Collection	Number of Respondents	Frequency of Response	Responses Per Annum	Burden Hour Per Response	Annual Burden Hours	Hourly Cost Per Response	Annual Cost
Applicants	15	1	15	1	15	$50.00	$750.00
Quarterly Reports	0	0	0	0	0	$0	$0
Annual Reports	40	1	40	1	40	$44.00	$1,760.00
Final Reports	6	1	6	1	6	$50.00	$300.00
Recordkeeping	15	3	45	1	45	$30.00	$1,350.00
Total Burden Hours	76				106		$4,160.00

Costs to Applicants. Estimate assumes each applicant spends about 1 person-hour to complete the application. Most of this time is invested by a professor or other senior staff person. Average hourly rate is assumed to be $50. Each applicant would incur costs equal to 1 hour x $50 = $50. Total costs to applicants, assuming 15 applicants, will equal 15 x $50= $750.

Costs to Awardees. Each person having access to the data would be required to fill out and notarize an affidavit promising not to disclose the data to third parties. It is expected that on average there will be three such persons per license, paid on average at a graduate assistant level of $30 per hour. Assuming 15 awardees per year, total annual costs would be 45 x $30 = $1,350. This cost is listed under “Recordkeeping.”

This request contains a new requirement for annual review by an information security specialist from the researcher’s home institution on compliance with the data security obligations that the researcher has entered into. We consider this a more effective guarantee of compliance than the prospect of HUD inspection. The officer would report annually on the researcher’s compliance in whatever format he or she chose. HUD does not propose a new form for this report. This is the new annual hour burden line on the table above. The median salary of an information security officer is estimated at $44 per hour, and this reporting burden is estimated at one hour per year per project. Assuming 40 projects are active at any one time, this annual burden is estimated at $1760.

In addition, a data file destruction form (attesting to destruction of all personally identifiable information received from HUD) must be completed at the close of the project. We have assumed 6 such close-out forms per year, requiring 1 hour by the project officer, at average hourly rate of $50 per hour. Total annual costs of the data file destruction form are therefore estimated to be 6 x 1 x $50 = $300. This cost is listed under “Final Report.”

13. Provide an estimate of the total annual cost burden to respondents or recordkeepers resulting from the collection of information (do not include the cost of any hour burden shown in Items 12 and 14).

• The cost estimate should be split into two components: (a) a total capital and start-up cost component (annualized over its expected useful life); and (b) a total operation and maintenance purchase of services component. The estimates should take into account costs associated with generating, maintaining, and disclosing or providing the information. Include descriptions of methods used to estimate major cost factors including system and technology acquisition, expected useful life of capital equipment, the discount rate(s) and the time period over which costs will be incurred. Capital and start-up costs include, among other items, preparations for collecting information such as purchasing computers and software; monitoring, sampling, drilling and testing equipment; and record storage facilities;

• If cost estimates are expected to vary widely, agencies should present ranges of cost burdens and explain the reasons for the variance. The cost of purchasing or contracting out information collection services should be a part of this cost burden estimate. In developing cost burden estimates, agencies may consult with a sample of respondents (fewer than 10) utilize the 60-day pre-OMB submission public comment process and use existing economic or regulatory impact analysis associated with the rulemaking containing the information collection, as appropriate.

• generally, estimates should not include purchases of equipment or services, or portions thereof made: (1) prior to October 1, 1995, (2) to achieve regulatory compliance with requirements not associated with the information collection, (3) for reasons other than to provide information or keep records for the government, or (4) as part of customary and usual business or private practices.

There is no additional total annual cost burden to respondents or record-keepers beyond the labor cost of burden-hours described in item 12 above.

14. Provide estimates of annualized cost to the Federal government. Also, provide a description of the method used to estimate cost, which should include quantification of hours, operational expenses (such as equipment, overhead, printing, and support staff), and any other expense that would not have been incurred without this collection of information. Agencies also may aggregate cost estimates from Items 12, 13, and 14 in a single table.

Estimated annual costs to the Federal government of $959.25 (approximately 15 hours of HUD staff time).

The data license application is reviewed by 3 different people to establish:

1. Applicant proposes data security provisions consistent with HUD regulations.  (20 minutes)

2. Applicant presents a plausible policy-relevant scientific hypothesis to be tested.  (20 minutes)

3. Applicant’s proposal would not unreasonably burden HUD-PD&R resources.  (20 minutes)

Application review is typically conducted by GS-14 staff at $63.95 an hour, equivalent to a GS-14 step 4.

Cost Item	Hours	Hourly Rate	Annual Cost
Applicant proposes data security provisions consistent with HUD regulations.	5	$63.95	$319.75
Applicant presents a plausible policy-relevant scientific hypothesis to be tested.	5	$63.95	$319.75
Applicant’s proposal would not unreasonably burden HUD-PD&R resources.	5	$63.95	$319.75
Total
Data License Review	15	$63.95	$959.25

15. Explain the reasons for any program changes or adjustments reported in Items 13 and 14 of the OMB Form 83-I.

There is no change in burden per agency. HUD does not propose a new form for this report.

16. For collection of information whose results will be published, outline plans for tabulation and publication. Address any complex analytical techniques that will be used. Provide the time schedule for the entire project, including beginning and ending dates of the collection of information, completion of report, publication dates, and other actions.

Not applicable

17. If seeking approval to not display the expiration date for OMB approval of the information collection, explain the reasons that display would be inappropriate.

Not applicable

18. Explain each exception to the certification statement identified in item 19.

None

B. Collections of Information Employing Statistical Methods

No statistical methods will be used to study applicants for this license