Systems of Records Published Between January 2, 2020 and December 31, 2021

-1

PeoplePlus; EPA-1

U.S. Environmental Protection Agency, National Computer Center (NCC), 109 T.W. Alexander Drive, Durham, NC 27711.

Michael Clanton, Director, Office of Technology Solutions; 1200 Pennsylvania Avenue, N.W., Mail Code 2731R, Washington, DC 20460; email address: Clanton.Michael@epa.gov; telephone number: 202 564-1084.

5 U.S.C. 5101 et seq.; 5 U.S.C. 5501 et seq.; 5 U.S.C. 5525 et seq.; 5 U.S.C. 5701 et seq.; 5 U.S.C. 6301 et seq.; 31 U.S.C. 3512; Executive Order 9397 (Nov. 22, 1943); 5 U.S.C. 6362.

As revised herein, PeoplePlus administers EPA’s time and attendance by allowing EPA federal employees to document their time and attendance, including assigning time reporting and work codes. This time and attendance information is exchanged with EPA’s payroll provider allowing for the processing of EPA employee payroll. PeoplePlus also allows EPA employees to track, request, and cancel various absence forms, including sick leave, annual leave, administrative leave, and time off awards.

Current and former EPA employees.

PeoplePlus contains general EPA employee time and attendance information. This includes elements (Hours/Time Reporting Code/Work Code) associated with bi-weekly time and attendance and elements (Start-End Dates/Leave Category/Absence Type/Duration) related to submitting absence requests for various types of leave. PeoplePlus contains employee information for payroll processing, including: Names, SSNs, EINs, DOBs, Addresses, Work Telephone #s, and Employee IDs.

EPA’s payroll provider, the individual on whom the record is maintained, and Agency officials such as managers and supervisors.

The routine uses below are both related to and compatible with the original purpose for which the information was collected. The following routine uses apply to this system:

A. Disclosure for Law Enforcement Purposes: Information may be disclosed to the appropriate Federal, State, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity.

B. Disclosure Incident to Requesting Information: Information may be disclosed to any source from which additional information is requested (to the extent necessary to identify the individual, inform the source of the purpose of the request, and to identify the type of information requested,) when necessary to obtain information relevant to an agency decision concerning retention of an employee or other personnel action (other than hiring,) retention of a security clearance, the letting of a contract, or the issuance or retention of a grant, or other benefit.

C. Disclosure to Requesting Agency: Disclosure may be made to a Federal, State, local, foreign, or tribal or other public authority of the fact that this system of records contains information relevant to the retention of an employee, the retention of a security clearance, the letting of a contract, or the issuance or retention of a license, grant, or other benefit. The other agency or licensing organization may then make a request supported by the written consent of the individual for the entire record if it so chooses. No disclosure will be made unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another Federal agency for criminal, civil, administrative, personnel, or regulatory action.

D. Disclosure to Office of Management and Budget: Information may be disclosed to the Office of Management and Budget at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A–19.

E. Disclosure to Congressional Offices: Information may be disclosed to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of the individual.

F. Disclosure to Department of Justice: Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which the Agency is authorized to appear, when:

1. The Agency, or any component thereof;

2. Any employee of the Agency in his or her official capacity;

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

4. The United States, if the Agency determines that litigation is likely to affect the Agency or any of its components, is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or the Agency is deemed by the Agency to be relevant and necessary to the litigation provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.

G. Disclosure to the National Archives: Information may be disclosed to the National Archives and Records Administration in records management inspections.

I. Disclosures for Administrative Claims, Complaints and Appeals: Information from this system of records may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.

J. Disclosure to the Office of Personnel Management: Information from this system of records may be disclosed to the Office of Personnel Management pursuant to that agency’s responsibility for evaluation and oversight of Federal personnel management.

K. Disclosure in Connection With Litigation: Information from this system of records may be disclosed in connection with litigation or settlement discussions regarding claims by or against the Agency, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions and except where court orders are otherwise required under section (b)(11) of the Privacy Act of 1974, 5 U.S.C. 552a(b)(11).

The two routine uses below (L and M) are required by OMB Memorandum M–17–12.

L. Disclosure to Persons or Entities in Response to an Actual or Suspected Breach of Personally Identifiable Information: To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records, (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency’s efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

M. Disclosure to Assist Another Agency in Its Efforts to Respond to a Breach of Personally Identifiable Information: To another Federal agency or Federal entity, when the Agency determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

N. Disclosure to EPA’s Payroll Processing Entity

To EPA’s current payroll provider to process EPA’s payroll.

These records are maintained electronically on servers located at EPA, NCC.

Records are retrieved by the employee identification number and/or employee network ID.

The records contained in this system of records are covered by EPA record schedule 300 for purposes of retention and disposal. Records are maintained for 3 years.

Security controls used to protect personally identifiable information (PII) in PeoplePlus are commensurate with those required for an information system rated MODERATE for confidentiality, integrity, and availability, as prescribed in National Institute of Standards and Technology (NIST) Special Publication, 800-53, "Security and Privacy Controls for Federal Information Systems and Organizations," Revision 5.

1. Administrative Safeguards: PeoplePlus follows procedures set out by NIST 800-53 and EPA’s Chief Information Officer (CIO) Security Procedures including that EPA personnel are required to complete annual agency Information Security and Privacy training. EPA personnel are instructed to lock their computers when they leave their desks.

2. Technical Safeguards: Computer records are maintained in a secure password-protected

environment. Access to computer records is limited to those who have a need to know.

Permission level assignments allow users access only to those functions for which they

are authorized. Data stored on the server is encrypted. Backups will be maintained at a disaster recovery site.

3. Physical Safeguards: All servers are maintained in secure, access-controlled areas or buildings.

Individuals seeking access to information in this system of records about themselves are required to provide adequate identification (e.g., driver’s license, military identification card, employee badge, or identification card). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Complete EPA Privacy Act procedures are described in EPA’s Privacy Act regulations at 40 CFR part 16.

Any individual who wants to know whether this system of records contains a record about him or her should make a written request to the EPA, Attn: Agency Privacy Officer, MC 2831T, 1200 Pennsylvania Ave., NW, Washington, D.C. 20460, privacy@epa.gov.

None.

EPA-1, PeoplePlus previously issued SORN modifications published in the Federal Register on June 5, 2014 (79 FR 32543), July 9, 2007 (72 FR 37217-37220), October 10, 2003 (68 FR 58670), and February 22, 2002 (67 FR 8246).

-9 FOIAonline EPA-09.

Unclassified

Amazon Web Service US East (Northern Virginia) and Amazon Web Service US East (Ohio)

Tim Crawford, crawford.tim@epa.gov, U.S. EPA, Office of Environmental Information, MC 2822T, 1200 Pennsylvania Ave., NW, Washington, DC 20460.

Freedom of Information Act, 5 U.S.C 552.

To provide the public a single location to submit and track FOIA requests appeals, consultations and referrals filed with the EPA and participating agencies, to manage EPA FOIA administration activities and to collect data for annual reporting requirements to the Department of Justice.

All persons filing FOIA requests, appeals, consultations or referrals and those whose personally identifiable information may appear in records collected for FOIA request responses.

Freedom of Information Act (FOIA) requests, appeals, consultations and referrals received by the EPA and other participating agencies, and correspondence related to the request, which may include individuals’ names, mailing addresses, e-mail addresses, phone numbers, social security numbers, dates of birth, alias(es) used by the requester, alien numbers assigned to travelers crossing national borders, requesters’ parents’ names, FOIA tracking numbers, dates requests are submitted and received, related appeals and agency responses. Records also include EPA FOIA administrative documents and responsive records.

Records maintained by federal agencies subject to the Freedom of Information Act.

The following routine uses apply to this system because the use of the record is necessary for the efficient conduct of government operations. General routine uses A, E, F, G, H, K, and L apply to this system. Records may also be disclosed to:

Another federal agency (a) with an interest in the record in connection with a referral of a Freedom of Information Act (FOIA) request to that agency for its views or decision on disclosure, or (b) in order to obtain advice and recommendations concerning matters on which the agency has specialized experience or particular competence that may be useful to an agency in making required determinations under the FOIA.

To the National Archives and Records Administration, Office of Government Information Services (OGIS), to the extent necessary to fulfill its responsibilities in 5 U.S.C. 552(h), to review administrative agency policies, procedures and compliance with the Freedom of Information Act (FOIA), and to facilitate OGIS' offering of mediation services to resolve disputes between persons making FOIA requests and administrative agencies.

In addition, the two routine uses below (L and M) are required by OMB M-17-12. The routine uses are related to and compatible with the original purpose for which the information was collected.

L. Disclosure to Persons or Entities in Response to an Actual or Suspected Breach of Personally Identifiable Information. To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records, (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the actual or suspected breach or to prevent, minimize, or remedy such harm.

M. Disclosure to assist another agency in its efforts to respond to a breach. To another Federal agency or Federal entity, when the Agency determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a actual or suspected breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a actual or suspected breach.

Records are stored in file folders in lockable file cabinets. Records are also stored in a secure, password protected electronic system that utilizes security hardware and software to include multiple firewalls, active intruder protection and role-based access controls. Additional safeguards vary by participating agencies.

Requests are retrieved from the system by numerous data elements and key word searches, including name, agency, dates, subject, FOIA tracking number and other information retrievable with full-text searching capability.

Each federal agency handles its records in accordance with its records schedule as approved by the National Archives and Records Administration (NARA). FOIA records are covered under NARA General Record Schedule 14 – Information Services Records that includes a retention period of six years unless a participating agency’s records are managed under other record schedules approved by NARA.

Security controls used to protect personally identifiable information in FOIAonline are commensurate with those required for an information system rated moderate for confidentiality, integrity, and availability, as prescribed in the National Institute of Standards and Technology (NIST) Special Publication, 800-53, "Security and Privacy Controls for Federal Information Systems and Organizations."

Administrative Safeguards: EPA and partner agency users follow annual security training requirements of their organization. Annually, EPA and partner agencies acknowledge and accept "Rules of Behavior" that describe user responsibilities and expected behavior regarding information system usage. Each agency administrator is responsible for ensuring account requests are approved before accounts are created. Each agency administrator is responsible for establishing, activating, modifying, disabling, and removing accounts for their agency and ensuring their established account management protocols are followed. Each agency administrator is responsible for monitoring agency accounts. Each agency administrator is responsible for disabling accounts when accounts are no longer required; when users are terminated or transferred; and when individual information system usage or need-to-know changes. Each agency administrator is responsible for granting access to the system based on: (i) a valid access authorization; (ii) intended system usage; and (iii) other attributes as required by the respective agency.

Technical Safeguards: All NIST 800-53 moderate baseline technical safeguards are built into the FOIAonline application and supporting infrastructure including automated account management locks and reset protocols due to inactivity or cyclical renewals. Accounts must be refreshed after 30 business days of inactivity and are disabled after one year of inactivity. Disabled accounts require reactivation by the FOIAonline Help Desk after approval by the agency’s Point of Contact. System administration and technical support accounts include the ability to reinstate accounts that have been disabled. System administration and technical support users are required to follow the system’s rules of behavior and confidentiality requirements defined in contract conditions renewed annually.

Physical Safeguards: The Physical Environment control is fully inherited from the Amazon Web Service (AWS) physical data center. AWS provides physical data center access only to approved employees. All employees who need data center access must first apply for access and provide a valid business justification. These requests are granted based on the principle of least privilege, where requests must specify to which layer of the data center the individual needs access and are time-bound. Requests are reviewed and approved by authorized personnel, and access is revoked after the requested time expires. Once granted admittance, individuals are restricted to areas specified in their permissions.

Individuals seeking access to their own personal information in this system of records may be required to provide adequate identification (e.g., driver's license, military identification card, employee badge or identification card) as dictated by the request receiving agency. Individuals who create accounts in the system have the ability to edit the contact information they provided when submitting a request. Additional identity verification procedures may be required as warranted. Requests must meet the requirements of EPA regulations at 40 CFR part 16.

Any individual who wants to know whether this system of records contains a record about him or her, should make a written request to the Attn: Agency Privacy Officer, MC 2831T, 1200 Pennsylvania Ave., NW., Washington, D.C. 20460, or electronically to privacy@epa.gov.

None

[FRL-9955-30-OEI]; FR. /Vol. 81, Nov. 22/ Thursday November 17, 2016. P 81096

-17

Online Criminal Enforcement Activities Network (OCEAN); EPA 17

Unclassified

EPA Office of Criminal Enforcement, Forensics and Training, 1200 Pennsylvania Avenue NW., Washington, DC 20004. Access to records is also available to authorized EPA personnel at the field offices of the OCEFT Criminal Investigation Division, listed in the Appendix to this Notice.

Eric Blank, Senior Technical Information Specialist, Operations Branch, Criminal Investigations Division, Office of Criminal Enforcement, Forensics and Training, Environmental Protection Agency, 1200 Pennsylvania Ave., N.W. (Mail Code 2232A), Washington, D.C. 20004; blank.eric@epa.gov (202-566-0656)

18 U.S.C. 3063; Comprehensive Environmental Response, Compensation and Liability Act, 42 U.S.C. 9601 et seq.; Solid Waste Disposal Act (a.k.a., Resource Conservation and Recovery Act), 42 U.S.C. 6901 et seq.; Federal Water Pollution Control Act (a.k.a., Clean Water Act), 33 U.S.C. 1251 et seq.; Toxic Substances Control Act, 15 U.S.C. 2601 et seq.; Clean Air Act, 42 U.S.C. 7401 et seq.; Federal Insecticide, Fungicide and Rodenticide Act, 7 U.S.C. 136 et seq.; Public Health Service Act (a.k.a., Safe Drinking Water Act), 42 U.S.C. 300f et seq.; Emergency Planning and Community Right-To-Know Act of 1986, 42 U.S.C. 11001 et seq.; and the Marine Protection, Research, and Sanctuaries Act of 1972 (a.k.a., Ocean Dumping Act), 33 U.S.C. 1401 et seq.; Crimes and Criminal Procedure, 18 U.S.C. 1 et seq .

1. To support, further, and document the investigation of persons or organizations alleged to have criminally violated any environmental statute or regulation, or to have violated other federal statutes in conjunction with such environmental violations.

2. In addition, to facilitate protection of EPA’s Administrator, the system will include information on individuals or entities that threaten physical harm to the EPA Administrator, other agency senior officials, or their family members, in violation of federal criminal statutes. All lead information on threats will be referred to the Office of Inspector General (OIG), which is responsible for the investigation of threats against EPA personnel.

1. (a) Subjects of investigations about whom data has been collected by criminal investigators of the Office of Criminal Enforcement, Forensics and Training, Criminal Investigation Division, and assembled in the form of investigative reports concerning violations of federal criminal statutes; and (b) persons who have made threats of physical harm to the EPA Administrator, other senior agency officials, or their family members (this information will also be referred to the Office of Inspector General).

2. Persons who provide information and evidence used to substantiate environmental criminal violations or threats of physical harm to the EPA Administrator, other senior agency officials, or their family members.

3. OCEFT criminal investigators and other governmental personnel who participate in investigations, such as EPA Regional Criminal Enforcement Counsel (RCECs); Assistant U.S. Attorneys (AUSAs) and other trial attorneys of the Department of Justice; federal criminal investigators of partner federal agencies, such as the Federal Bureau of Investigations (FBI); and criminal investigators or prosecutors of partner state criminal law enforcement agencies.

1. Investigative Case Management System. The Online Criminal Enforcement Activities Network contains selected information from the criminal investigative files. Such information includes, name, address, telephone number; prior/secondary residences, vehicle information, associated persons (name and role), driver's licenses/aliases, associated companies (name and role), identifying numbers (number type, number and brief description; including Social Security Number, Passport number, Immigration ID number, US Marshall Service number, State ID number, etc.), corporate data (company name, address, telephone number), corporate vehicle information, corporate identifying numbers, case information (e.g., case opened, date referred to EPA), criminal investigator comments, name and office of criminal investigator, dissemination information (e.g., which other agency requested the information), and other related investigative information.

2. Investigative Files. The investigative files housed within OCEAN contain all information relating to an investigative matter which can be stored electronically. In addition to the information contained in the computerized case management system, the investigative files contain, but are not limited to, correspondence (case coordination reports, memos of conversation, and other records of communication relating to the investigation), interviews (witness interview statements generated by either an OCEFT/CID special agent or another agency or person), regulatory history (permits and reports generated as a result of normal program activity), technical support (program reports generated as a result of the investigation), investigative notes, electronic monitoring (reports requesting permission and use, transcripts of tapes), records checks (personal history, police information, fingerprint cards, photographs), property reports, electronic copies or images of property or physical evidence obtained and retained by OCEFT/CID including documents personal property and electronic evidence, manifests and other related investigative information and open source online information.

3. Threat Information. All information related to any individuals or entities that threaten physical harm to the EPA Administrator, senior agency officials, or their family members, in violation of federal criminal statutes. In addition to the information contained in the computerized case management system, the investigative leads files may contain, but are not limited to, digital copies or transcripts of the subject threat, witness statements, records checks (personal history, police information, fingerprint cards, photographs), property reports, electronic copies or images of property obtained and retained by OCEFT/CID including documents, personal property and electronic evidence and other related information, open source online information, investigative reports and other information received from other law enforcement agencies and the EPA OIG.

4. Case Management System. The Online Criminal Enforcement Activities Network is the computerized management information system for the Criminal Investigation Division, which reflects the activity and productivity of individual agents and each OCEFT/CID office. It is also the primary source for assembling statistical data for OCEFT/CID. The Online Criminal Enforcement Activities Network contains the OCEFT/CID case number, the case name, the most recent investigative or prosecutorial activity, the involved environmental media and environmental statutes, government employees involved in the investigation, case status and case closure codes. The case name may be either a company name or the name of a person that denotes the subject of the investigation.

EPA employees and officials, employees of Federal contractors, employees of other Federal agencies and of state, local, tribal, and foreign agencies, witnesses, informants, public source materials, and other persons who may have information relevant to OCEFT/CID investigations.

1. To a potential source of information to the extent necessary to elicit information or to obtain cooperation of that source in furtherance of an EPA criminal investigation or protective service detail investigation.

2. To the Department of Justice for consultation about what information and records are required to be publicly released under federal law.

3. To a federal agency in response to a valid subpoena.

4. To Federal and state government agencies responsible for administering suspension and debarment programs.

5. To international law enforcement organizations if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the organization or a law enforcement agency that is a member of the organization.

6. To the news media and public unless it is determined that the release of the specific information in the context of a particular case would constitute an unwarranted invasion of privacy.

7. To any person if the EPA determines that compelling circumstances affecting human health, the environment, property, or personal safety warrant the disclosure.

8. In connection with criminal prosecution or plea negotiations to the extent that disclosure of the information is relevant and necessary to the prosecution or negotiation and except where court orders are otherwise required under section (b)(11) of the Privacy Act of 1974, 5 U.S.C. 552a(b)(11).

9. To the Office of Inspector General, which is responsible for investigating threats to the Administrator and other agency officials.

10. To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records; (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

11. To another Federal agency or Federal entity, when the Agency determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

The EPA OCEFT currently stores and manages records related to environmental and related non-environmental criminal investigations in a centralized electronic recordkeeping system, EPA 17, Criminal Investigative Index and Files. This computer recordkeeping system, and the modified system that will replace it (OCEAN), involve the "cloud" storage of electronic records obtained or created by OCEFT criminal investigators.

Files are assigned a case file number and records are maintained in numerical order in a web-based computer system with access controls. Access to records is obtained by entering user IDs and passwords then conducting computer database searches using relevant search terms and software programs. The system also allows for printing of records. Information on individuals may be retrieved through the computer case management system which can use, among other things, case titles, the names of individuals, organization names, driver's license numbers, vehicle or tag or vehicle identification numbers and other identifying numbers.

Retention and Disposal: The manner of Retention and Disposal of the Online Criminal Enforcement Activities Network and files will mirror the current disposition of electronic records in the OCEFT Criminal Investigation Index and Files system (EPA-17), known as the Criminal Case Report System, or (CCRS) under EPA Records Schedule 684. These records are scheduled as permanent retention.

Computer records are maintained in a secure, password protected computer system. All records are maintained in secure, access-controlled websites. The case management system maintains a user log that identifies and records persons who access and use the system. Computer-stored information is protected in accordance with the Agency's security requirements. No unauthorized individuals may access the physical equipment on which the system resides. Accounts can only be created by the system administrator or assistant system administrators.

To the extent permitted under the Privacy Act of 1974, 5 U.S.C. 552a(j)(2) or (k)(2), this system has been exempted from the provisions of the Privacy Act of 1974 that permit access and correction. See, 40 CFR 16.11 and 16.12. These same authorities and exemptions also apply to the threat information to be held by the modified system. Exemptions from access may be complete or partial, depending on the applicable exemption. However, EPA may, in its discretion, grant individual requests for access and correction if it determines that the exercise of these rights will not interfere with an interest that the exemption is intended to protect.

Pursuant to the authorities set out in 40 CFR 16.11 and 16.12, exempting federal criminal investigatory agencies from specified provisions of the Privacy Act, individuals do not have the opportunity to decline to provide information to, or to opt out of the collection or sharing of their information by OCEFT criminal investigators. These same authorities and exemptions also apply to the threat information to be held by the OCEAN system. The EPA's procedures for making a Privacy Act request can be found in EPA's Privacy Act regulations at 40 CFR part 16.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Complete EPA Privacy Act procedures are set out in 40 CFR part 16.

Pursuant to 5 U.S.C. 552a(j)(2) this system is exempt from the following provisions of the Privacy Act: 5 U.S.C. 552a(c)(3) and (4); (d); (e)(1), (e)(2), (e)(3), (e)(4)(G), (e)(4)(H), (e)(5) and (e)(8); (f)(2) through (5); and (g). Pursuant to 5 U.S.C. 552a(k)(2), this system is exempt from the following provisions of the Privacy Act, subject to the limitations set forth in that subsection : 5 U.S.C. 552a(c)(3), (d), (e)(1), (e)(4)(G), (e)(4)(H), and (f)(2) through (5). See, 40 CFR 16.11 and 16.12.

71 FR 234 - January 4, 2006 - Republication of Exempted System of Records (EPA- 17)

66 FR 49947 – October 1, 2001 - Creation of the OCEFT/NEIC Master Tracking System of Records (EPA-46)

Appendix to Online Criminal Enforcement Activities Network

Criminal Investigation Division offices where system records may be accessed online:

 Boston Area Office, EPA/Criminal Investigation Division, 5 Post Office Square, Suite 100, 15th Floor, Boston, Massachusetts 02109-3912

 New York Area Office, EPA/Criminal Investigation Division, 290 Broadway (2C100), Room 1551, New York, New York 10007-1866

 Buffalo Resident Office, EPA/Criminal Investigation Division, 138 Delaware Avenue, Room 525, Buffalo, New York 14202

 Syracuse Domicile Office, EPA/Criminal Investigation Division, 441 S. Salina Street, 6th Floor, Box 349, Syracuse, New York 13202

 Philadelphia Area Office, EPA/Criminal Investigation Division, 1650 Arch Street (3CE00), Philadelphia, Pennsylvania 19103-2029

 Baltimore Resident Office, EPA/Criminal Investigation Division, 701 Mapes Road, Suite E230, Environmental Science Center, Fort George G. Meade, Maryland 20755-5350

 Atlanta Area Office, EPA/Criminal Investigation Division, 61 Forsyth Street, Suite 16T90, Sam Nunn Atlanta Federal Center, Atlanta, Georgia 30303

 Tampa Resident Office, EPA/Criminal Investigation Division, 2203 N. Lois Avenue, Suite 815, Tampa, Florida 33607

 Miami Resident Office, EPA/Criminal Investigation Division, 909 SE First Avenue, Suite 700, Brickell Plaza Federal Building, Miami, FL 33131

 Nashville Domicile Office, EPA/Criminal Investigation Division, 801 Broadway, Suite 312, Nashville, Tennessee 37203

 Chicago Area Office, EPA/Criminal Investigation Division, 77 West Jackson, Chicago, Illinois 60604

 Dallas Area Office, EPA/Criminal Investigation Division, Fountain Place, 1445 Ross Avenue, (6CID), Suite 1200, Dallas, Texas 75202-2733

 Houston Resident Office, EPA/Criminal Investigation Division, 1919 Smith Street, Suite 9004, Houston, Texas 77002-8049

 Kansas City Area Office, EPA/Criminal Investigation Division, 11201 Renner Blvd., Lenexa, Kansas 66219

 St. Louis Resident Office, EPA/Criminal Investigation Division, 1222 Spruce Street, Room 2.102G, Robert A. Young Federal Building, St. Louis, Missouri 63103

 Denver Area Office, EPA/Criminal Investigation Division, 1595 Wynkoop Street, Denver, Colorado 80202-1129

 San Francisco Area Office, EPA/Criminal Investigation Division, 75 Hawthorne St., 8th Floor, San Francisco, California 94105-3901

 Los Angeles Resident Office, EPA/Criminal Investigation Division, 600 Wilshire Boulevard, Suite 900, Los Angeles, CA 90017-3212

 Phoenix Domicile Office, EPA/Criminal Investigation Division, Sandra Day O’Connor Federal Building, 401 W. Washington St., SPC #9, Suite 415, Phoenix, Arizona 85003

 Seattle Area Office, EPA/Criminal Investigation Division, 1200 Sixth Avenue, Suite 155, Seattle, Washington 98101-3140

 Portland Resident Office, EPA/Criminal Investigation Division, 805 SW Broadway, Suite 620, Portland, Oregon 97204

-19 EPA Identification Card Record.

1. Security Operations Branch, Security Management Division, Environmental Protection Agency, Ronald Reagan Building, 1200 Pennsylvania Avenue, NW., Washington, DC 20460;

2. Regional EPA offices. See the appendix for regional office addresses.

EPA employees and certain non-EPA employees, including contractors and grantees, who require identification cards to access EPA controlled facilities.

1. EPA Form 5110-1 EPA Identification Card Acknowledgment which contains the following information: Name, identification card credential number, height, weight, color of eyes/hair, date of birth, Social Security Number, position/title, grade, EPA office location, signature, date of issuance.

2. EPA Form 1480-39 Official U.S. Government Identification which contains the following information: Name, Social Security Number, EPA office location, date of birth, height, weight, color of eyes/hair, signature, identification card credential number, date of issuance, and photograph of person issued the identification card.

3. Photographs of individuals.

4. Information captured by automatic card reader machines used to gain access to certain EPA facilities, including the individual's name, card credential number, date and time of access request, and location of access requested.

5. Fingerprint information for individuals.

Executive Order 12072 (Aug. 16, 1978), Federal Property and Administrative Services Act of 1949, 40 U.S.C. 121, and Executive Order 9397 (Nov. 22, 1943).

To issue official U.S. Government identification cards to EPA employees and certain non-EPA employees requiring access to EPA-controlled facilities; to maintain a record of all holders of identification cards for renewal and recovery of expired cards; to manage and confirm requests for and access to EPA- controlled facilities; and to identify lost or stolen identification cards.

General routine uses A, E, F, G, H, and K applies to this system.

Storage:

The completed forms are kept in locked file cabinets in the Crystal City and Ronald Reagan badging offices. This system maintains records in two central command centers. These central command centers retain a record of each instance of request for access to an EPA-controlled facility. Each record indicates the time, location of card reader, and card credential number requesting access. This information can be linked to personally identifiable information using the central command center databases.

Records are retrieved by subject name and identification card credential number.

Computer records are maintained in a secure, password protected computer system. Paper records are maintained in locked file cabinets. All records are maintained in secure, access- controlled areas or buildings.

Records are retained and disposed of in accordance with EPA Records Control Schedule 627, approved by the National Archives and Records Administration.

Headquarters: Chief, Security Operations Branch, Security Management Division, Environmental Protection Agency, Ronald Reagan Building, MS3206R, and 1200 Pennsylvania Avenue, NW., Washington, DC 20460. Other locations: General Services Administration Manager at offices listed in the Appendix.

Any individual who wants to know whether this system of records contains a record about him or her, who wants access to his or her record, or who wants to contest the contents of a record, should make a written request to EPA FOIA Office, Attn: Privacy Act Officer, 1200 Pennsylvania Avenue, MC2822T, NW., and Washington, DC 20460.

Requesters will be required to provide adequate identification, such as a driver's license, EPA identification card, or other identifying document. Additional identification procedures may be required in some instances.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Requests for name changes must be accompanied by a copy of a current redacted SF-50, "Request for Personnel Action". The information contained in the fields identified by the following item numbers must be provided on the redacted form:

1. Name (Last, First, Middle).

2. Social Security Number.

4. Effective Date.

5. First Action (all fields, A-F).

6. Second Action (all fields, A-F).

7. FROM: Position Title and Number.

14. Name and Location of Position's Organization.

15. TO: Position Title and Number.

22. Name and Location of Position's Organization.

38. Duty Station Code.

39. Duty Station.

46. Employing Department or Agency.

47. Agency Code.

48. Personnel Office ID.

49. Approval Date.

50. Signature/Authentication and Title of Approving Official.

Complete EPA Privacy Act procedures are set out in 40 CFR part 16.

Information from EPA Form 5110-1 and EPA Form 1480-39 provided by applicant is entered manually into the central command center database.

None.

Appendix

Region 1: 1 Congress Street, Suite 1100, Boston, MA 02114-2023 >

Region 2: 290 Broadway, New York, NY 10007-1866

Region 3: 1650 Arch Street, Philadelphia, PA 19103-2029

Region 4: 61 Forsyth Street, SW., Atlanta, GA 30303-3104

Region 5: 77 West Jackson Boulevard, Chicago, IL 60604-3507

Region 6: Fountain Place 12th Floor, Suite 1200, 1445 Ross Avenue, Dallas, TX 75202-2733

Region 7: 901 North 5th Street, Kansas City, KS 66101

Region 8: 999 18th Street, Suite 300, Denver, CO 80202-2466

Region 9: 75 Hawthorne Street, San Francisco, CA 94105

Region 10: 1200 Sixth Avenue, Seattle, WA 98101.

-21

External Compliance Case Tracking System (EXCATS), EPA-21

Unclassified.

The EXCATS Web-based application is currently hosted under a contract with MicroPact, Inc. Hosting facility located at Equinix, 44470 Chilum Place DC3 Bldg. 1, Ashburn, Virginia 20147.

Dale Rhines, Deputy Director, OGC/ECRCO, Environmental Protection Agency, 1200 Pennsylvania Avenue, N.W., Mail Code 2310A, Washington, D.C. 20460 or by email at rhines.dale@epa.gov, or at (202) 564-4174.

The EXCATS assists ECRCO in carrying out its responsibilities under the following authorities: Title VI of the Civil Rights Act of 1964, 42 United U.S.C. §§ 2000d to 2000d-7 (Title VI); Section 504 of the Rehabilitation Act of 1973, as amended, 29 U.S.C. § 794; Title IX of the Education Amendments of 1972, as amended, 20 U.S.C. § 1681 et seq.; Federal Water Pollution Control Act Amendments of 1972, Pub. L. 92-500 § 13, 86 Stat. 903 (codified as amended at 33 U.S.C. § 1251 (1972)); Age Discrimination Act of 1975, 42 U.S.C. § 6101 et seq.; 40 C.F.R. Parts 5 and 7; Executive Order 12250 (Nov. 2, 1980).

To support and enhance the discrimination complaint process, including the investigation and resolution of complaints. EXCATS assists OGC/ECRCO in collecting and maintaining case-related information and provides OGC/ECRCO with the ability to more effectively manage program information needs and integrate the office’s various business processes.

Individuals who have filed, or had filed on their behalf, discrimination complaints regarding applicants or recipients of federal financial assistance on the basis of race, color, national origin, age, sex, or disability. Witnesses.

Letters or other documents initiating discrimination complaints including complainant’s name and address, telephone numbers, e-mail addresses, correspondence, internal memoranda and notes pertaining to the complaints; recipient staff interviews and interviews with members of the public; investigative plans; resolution agreements and other resolution documents; findings on the complaints; and related information regarding the complaints and investigations; civil rights compliance reviews of applicants for or recipients of federal financial assistance; medical information and records of physical or mental impairments; eligibility determinations impacting complainants, witnesses or other parties; administrative subpoena files; self-evaluation plans; racial/ethnic analyses of workforce and program enrollees; notice of violations; language assistance plans; training programs; civil enforcement files; environmental policies and program files.

Complaints, applicants and recipients of federal financial assistance, witnesses, EPA Investigators and/or contract investigators, other EPA personnel with a connection to the case, and other persons with information relevant to the case.

The routine uses below are both related to and compatible with the original purpose for which the information was collected. The following general routine uses apply to this system (73 FR 2245):

A. Disclosure for Law Enforcement Purposes. Information may be disclosed to the appropriate Federal, State, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity.

B. Disclosure Incident to Requesting Information. Information may be disclosed to any source from which additional information is requested (to the extent necessary to identify the individual, inform the source of the purpose of the request, and to identify the type of information requested,) when necessary to obtain information relevant to an agency decision concerning retention of an employee or other personnel action (other than hiring,) retention of a security clearance, the letting of a contract, or the issuance or retention of a grant, or other benefit.

C. Disclosure to Requesting Agency. Disclosure may be made to a Federal, State, local, foreign, or tribal or other public authority of the fact that this system of records contains information relevant to the retention of an employee, the retention of a security clearance, the letting of a contract, or the issuance or retention of a license, grant, or other benefit. The other agency or licensing organization may then make a request supported by the written consent of the individual for the entire record if it so chooses. No disclosure will be made unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another Federal agency for criminal, civil, administrative, personnel, or regulatory action.

D. Disclosure to Office of Management and Budget. Information may be disclosed to the Office of Management and Budget at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A-19.

E. Disclosure to Congressional Offices. Information may be disclosed to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of the individual.

F. Disclosure to Department of Justice. Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which the Agency is authorized to appear, when:

1. The Agency, or any component thereof;

2. Any employee of the Agency in his or her official capacity;

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

G. Disclosure to the National Archives. Information may be disclosed to the National Archives and Records Administration in records management inspections.

H. Disclosure to Contractors, Grantees, and Others. Information may be disclosed to contractors, grantees, consultants, or volunteers performing or working on a contract, service, grant, cooperative agreement, job, or other activity for the Agency and who have a need to have access to the information in the performance of their duties or activities for the Agency. When appropriate, recipients will be required to comply with the requirements of the Privacy Act of 1974 as provided in 5 U.S.C. 552a(m).

I. Disclosures for Administrative Claims, Complaints and Appeals. Information from this system of records may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.

J. Disclosure to the Office of Personnel Management. Information from this system of records may be disclosed to the Office of Personnel Management pursuant to that agency's responsibility for evaluation and oversight of Federal personnel management.

K. Disclosure in Connection with Litigation. Information from this system of records may be disclosed in connection with litigation or settlement discussions regarding claims by or against the Agency, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions and except where court orders are otherwise required under section (b)(11) of the Privacy Act of 1974, 5 U.S.C. 552a(b)(11).

The two routine uses below (L and M) are required by OMB Memorandum M–17–12.

L. Disclosure to Persons or Entities in Response to a Compromise or Breach of Personally Identifiable Information. To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records, (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

M. Disclosure to Assist Another Agency in its Efforts to Respond to a Breach. To another Federal agency or Federal entity, when the Agency determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

Additional routine uses that apply to this system are:

1. The Department of Justice or other Federal and State Agencies. When necessary to complete an investigation, enforce the nondiscrimination statutes set forth in the Authority section of this notice, or assure proper coordination between Federal agencies.

2. Persons Named as Alleged Discriminators. To allow such persons the opportunity to respond to the allegations made against them during the course of the discrimination complaint process.

All electronic data are stored on servers maintained in locked facilities with computerized access control and all printed materials are filed in secure cabinets in secure federal facilities with access based on need.

Records are retrieved by complaint number, name, address, email address or telephone number.

Records stored in this system are subject to EPA’s records schedule 1044, Item c: Routine compliance and enforcement records (DAA 0412-2013-0017-0003).

Includes:

▪External discrimination complaints related to civil rights violations filed by individuals or groups alleging that their civil rights have been violated by EPA-funded entities, complaints, correspondence, reports, exhibits, notices, depositions transcripts, and other related records.

▪Compliance review files.

Disposition:

▪Close when activity, project, or case is completed.

▪Destroy 10 years after file closure.

Security controls used to protect personal sensitive data in EXCATS are commensurate with those required for an information system rated MODERATE for confidentiality, integrity, and availability, as prescribed in National Institute of Standards and Technology (NIST) Special Publication, 800-53, "Security and Privacy Controls for Information Systems and Organizations," Revision 5.

1. Administrative Safeguards. EPA personnel are required to complete annual agency Information Security and Privacy training. EPA personnel are instructed to lock their computers when they leave their desks. EXCATS system administrators have appropriate security clearance.

2. Technical Safeguards. Only authorized OGC/ECRCO users whose official duties require the use of such information have access to the information in the system. No users outside of OGC/ECRCO have access to the system. Specific access is structured around need and is determined by the person’s role in the organization. Access is managed through the use of electronic access control lists, which regulate the ability to read, change and delete information in the system. Each OGC/ECRCO user has read access to designated information in the system, with the ability to modify only their own submissions or those of others within their region or group. Data identified as confidential are so designated in the system and only specified individuals are granted access. The system maintains an audit trail of all actions against the data base. All electronic data are stored on servers maintained in locked facilities with computerized access control allowing access to only those support personnel with a demonstrated need for access. A database is kept of all individuals granted security card access to the room, and all visitors are escorted while in the room. The server facility has appropriate environmental security controls, including measures to mitigate damage to automated information system resources caused by fire, electricity, water and inadequate climate controls. Access control to servers, individual computers and databases includes a required user log-on with a password, inactivity lockout to systems based on a specified period of time, legal notices and security warnings at log-on, and remote access security that allows user access for remote users (e.g., while on government travel) under the same terms and conditions as for users within the office.

3. Physical Safeguards. Printed materials are filed in secure cabinets in secure federal facilities with access based on need as described above for the automated component of the system.

Individuals seeking access to their own personal information in this system of records will be required to provide adequate identification (e.g., driver's license, military identification card, employee badge or identification card). Additional identity verification procedures may be required as warranted. Requests must meet the requirements of EPA’s Privacy Act regulations at 40 C.F.R. Part 16.

Any individual who wants to know whether the system of records contains a record about him or her should submit a written request to the EPA, Attn: Agency Privacy Officer, WJC West, MC2831T, 1301 Constitution Avenue, N.W., Washington, D.C. 20460, privacy@epa.gov.

Pursuant to 5 U.S.C. 552a(k)(2), this system is exempt from the following provisions of the Privacy Act of 1974, subject to the limitations set forth in 5 U.S.C. 552a(c)(3), (d), and (e)(1).

79 FR 63622 (October 24, 2014) - Notice of a Modified System of Records. The purpose of that notice was to inform the public that the OGC/ECRCO (formerly known as the Title VI External Compliance Program) was amending the External Compliance Program Discrimination Complaint Files system of records. The system was amended to change the (1) system name; (2) the addresses of system locations and system managers; (3) categories of individuals covered by the system; (4) routine uses; and (5) storage, retrievability and safeguard requirements.

-22 Correspondence Management System.

None.

National Computer Center, U.S. Environmental Protection Agency Main Campus, 109 T.W. Alexander Drive, Research Triangle Park, North Carolina 27709.

Individuals who write to the U.S. Environmental Protection Agency or any of its employees in their official capacity; all individuals to whom correspondence is addressed by EPA or any of its employees in their official capacity; and individuals whose correspondence is referred to EPA by the President, the Vice President, or another federal agency. (Note: Two categories of correspondence that will not, in most cases, be logged into the system are (1) comments to a docket, and (2) Freedom of Information and Privacy Act requests. The Agency maintains separate applications, EPA Dockets and FOIAXPress, respectively, to log and track such correspondence.)

Correspondence generated by anyone in the public, private, or government sectors and addressed to the U.S. Environmental Protection Agency or any of its employees in their official capacity. Correspondence generated by any employee of the U.S. Environmental Protection Agency in his or her official capacity. Complete records may include metadata about the correspondence that facilitates tracking and record retrieval, a scanned image or electronic copy of the incoming communication, draft(s) of the response document, supporting documents or other attachments, and a scanned image or electronic copy of the outgoing signed response. Pre-decisional draft responses will not be included as part of the final record. Maintenance of physical records is the responsibility of each office in accordance with the Agency's records management guidelines.

5 U.S.C. 301.

To track, route, and store incoming and outgoing Agency correspondence from and to members of the public, private, and governmental sectors.

The following General Routine Uses of EPA Systems of Records apply to this application:

A, B, C, D, E, F, G, H, I, J, K

Records may also be disclosed to a federal, state, or local governmental agency when it is determined that a response by that agency is more appropriate than a response by the U.S. Environmental Protection Agency.

Storage:

Computer database and paper files (until the Agency implements a National Archives and Records Administration-certified electronic records management system).

All CMS records are full-text indexed and are searchable by any data element.

CMS resides on servers located in a secure, access- controlled room at the EPA National Computer Center at the main EPA campus in Research Triangle Park, North Carolina. No unauthorized individuals may access the physical equipment on which the system resides.

Electronic access to CMS is available only through the EPA intranet via a Single Socket Layer-encrypted connection. All users must have a password-protected account that defines their level of access to data stored in the system. Accounts can only be created by the System Administrator or Assistant System Administrators. Paper records are maintained in lockable file cabinets in secure, access-controlled rooms, areas, or buildings.

Paper and electronic record copies are retained and disposed of according to National Archives and Records Administration guidelines and the U.S. Environmental Protection Agency Records Control Schedule.

Director, Office of the Executive Secretariat, U.S. Environmental Protection Agency, 1200 Pennsylvania Avenue, NW., Washington, DC 20460; Correspondence Management System Administrator, Office of the Executive Secretariat, 1200 Pennsylvania Avenue, NW., Washington, DC 20460.

Any individual, or his or her duly authorized representative, who (1) is desirous of knowing if information of any kind about him or her is maintained in the Correspondence Management System; (2) wishes to access the information, if any, maintained about him or her in the Correspondence Management System; or (3) wants to formally contest the contents of a record maintained in the Correspondence Management System, should make his or her request in writing to the System Manager(s).

At a minimum, requestors will be required to provide adequate identification (e.g., driver license, military identification card, employee badge or identification card) and, if necessary, proof of authority. Additional identity verification procedures may be required as warranted. Copies of records that are responsive to the individual's request will be mailed or delivered by reasonable alternate means, if requested. Fees may be incurred if copies are made and mailed in accordance with 16.4 of current regulations.

Individuals requesting correction of or amendment to records must reasonably and accurately identify the record in question, specify the information they are contesting, and detail the corrective action sought. Complete U.S. Environmental Protection Agency Privacy Act procedures are set out in 40 CFR Part 16.

Sources include individuals who address correspondence to the Agency or any of its employees in their official capacities; Agency employees preparing responses to incoming correspondence or who generate original correspondence in their official capacities; and the White House and other federal agencies (referrals to the Agency)

None.

-24 Claims Office Master Files.

Office of General Counsel, Environmental Protection Agency, Ariel Rios Building, 1200 Pennsylvania Avenue NW, Washington, DC 20460.

The Claims Office Master Files (COMF) contains claim records affecting individuals in six categories. COMF-TOR is composed of records covering individuals filing claims under the Federal Tort Claims Act, 28 U.S.C. 2671 et seq., for money damages for injury, death or damage caused by the negligence or wrongful acts or omissions of employees of EPA. COMF-FCC is comprised of records covering individuals who are indebted to EPA and against whom EPA has initiated actions under the Federal Claims Collection Act, as amended, 31 U.S.C. 3711 et seq. COMF-MCE is composed of records covering individuals making claims for loss or damage to personal property under the Military Personnel and Civilian Employees Claims act, 31 U.S.C. 3721. COMF-WAV is composed of records covering individuals requesting waiver under 5 U.S.C. 5584 of claims for erroneous payments of salary or transportation expenses. COMF-GAR is composed of records covering EPA employees whose salaries are garnished under 42 U.S.C. 659, 661-662 for alimony, child support, or commercial garnishments. COMF-RCD is composed of records covering individuals claiming reimbursement of collision deductible payments on rental vehicles

1. COMF-TOR contains records relating to tort claims against EPA. It may contain administrative claims, investigative reports, witness statements, certifications of scope of employment, damage estimates, medical records, letters to claimants, claimant responses, the Agency final decision on claims, and other records concerning tort claims. COMF-FCC contains documents relating to debts owed EPA by individuals, corporations, State and local governments, and Indian tribes. It may include documents which evidence the debt (e.g., audit reports, travel voucher, consent decrees, etc.), demand letters, debtor responses, credit reports, information obtained from private collection agencies, and other records concerning debt claims. It may contain the social security numbers of individual debtors to the extent such numbers are contained in travel vouchers or other documents upon which the debt is based

2. COMF-MCE contains records relating to employee claims for loss or damage to personal property. It may contain administrative claim forms, investigative reports, supervisor's reports, accident reports, documentation of the amounts claimed as damages, the Agency final action on claims, and other records concerning employee property claims

3. COMF-WAV contains records relating to employee requests for waiver by the Government of claims for erroneous payment of salary or travel expenses. It may contain employee request for waiver forms, investigative reports and recommendations, certifications of the amount of overpayment, personnel records relevant to overpayments, evidence of the Government's final action on the request, and other records concerning waiver requests. The social security number of the employee is contained in the file

4. COMF-GAR contains legal documents supporting the garnishment of the salary of EPA employees. It may include the order of garnishment or attachment, notices to the employee of garnishment, responses by the employee, payroll information, and other records concerning garnishment requests. The social security number of the employee may be contained in the file

5. COMF-RCD contains records required to settle claims against EPA employees for rental car damage deductible claims. It may contain rental agreements, accident reports, damage estimates, employee requests for reimbursement, travel vouchers, correspondence with rental car companies, evidence of the Agency final action on the claim, and other records concerning rental car deductible claims.

COMF-TOR: 28 U.S.C. 2671 et seq. and 40 CFR part 10

COMF-FCC: 31 U.S.C. 3711 et seq. and 4 CFR parts 101-105

COMF-MCE: 31 U.S.C. 3721 and 40 CFR part 14

COMF-WAV: 5 U.S.C. 5584 and 4 CFR parts 91-92

COMF-GAR: 42 U.S.C. 659, 661-662 and 5 CFR part 581

COMF-RCD: 5 U.S.C. 5704.

To assist the EPA Claims Office in managing its receipt, tracking, processing, and resolution of claims and to assist the Department of Justice and EPA in final resolution of claims.

General routine uses A, D, E, F, G, H, J, and K apply to this system. Records may also be disclosed:

1. To a Federal, State or local agency where necessary to enable EPA to obtain information relevant to an EPA decision concerning a claim by or against an employee

2. Records maintained in the COMF-FCC subsystem may be disclosed to commercial collection agencies under contract with EPA, as provided by 31 U.S.C. 3718 and 40 CFR part 13, for collection purppses

3. Records maintained in the COMF-RCD subsystem may be disclosed to rental car companies as part of EPA's resolution of claims by the rental car companies for damage

4. Records maintained in COMF-RCD may be disclosed to Federal agencies where relevant to their involvement in the rental agreement or claims arising from it

5. Records maintained in the COMF-GAR subsystem may be disclosed to the State agency responsible for child support and/or alimony collection and enforcement, and for enforcing commercial garnishment orders

Disclosure to consumer reporting agencies:

Disclosures pursuant to 5 U.S.C. 552a(b)(12) may be made from records maintained in the COMF-FCC subsystem to consumer reporting agencies as defined in the Fair Credit Reporting Act (15 U.S.C. 1681a(f)) or the Debt Collection Act of 1982 (31 U.S.C. 3701(a)(3)(B)).

Storage:

In file folders in file cabinets within the Claims Office. Records are accessible through computer indexes maintained in the Claims Office.

By the name of the person, corporation, local or state government or Indian tribe, and the assigned claim number. This information is maintained in computer indexes within the Claims Office.

COMF records are retained for ten (10) years. A resolved claim is retained within the Claims Office for five (5) years then transferred to the Federal Records Center where it is retained for an additional five (5) years. The record is destroyed by the Federal Records Center at the end of the retention period.

EPA Claims Officer, Environmental Protection Agency, Ariel Rios Building, 1200 Pennsylvania Avenue NW, Washington, DC 20460.

Requesters will be required to provide adequate identification, such as a driver's license, employee identification card, or other identifying document. Additional identification procedures may be required in some instances.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Complete EPA Privacy Act procedures are set out in 40 CFR part 16.

Record subjects and EPA employees in their official capacities. Other sources are:

COMF-TOR--local police authorities and witnesses;

COMF-FCC--private collection agencies and credit bureaus, other Federal agencies, local officials and State employees;

COMF-MCE--law enforcement and security personnel;

COMF-GAR--State court authorities and garnishers;

COMF-RCD--rental car companies and automobile repair companies.

-27 Employee Counseling and Assistance Program Records.

Career Resource &amp;Counseling Center, Environmental Protection Agency, Ariel Rios Building, 1200 Pennsylvania Avenue NW, Washington, DC 20460. EPA offers counseling services to employees at regional offices through a national agreement with the Public Health Service. See the appendix for addresses of regional and other offices.

EPA employees who seek, are referred to, and/or receive assistance through the Agency Employee Counseling and Assistance Program in connection with personal or work related problems, including, but not limited to, problems related to alcohol and/or drug abuse

Records of employees who have been counseled or otherwise assisted. Information which may be found in this record system includes the employee's name, location within the Agency, sex, age, race, office telephone number, grade, job title and series; problem assessment, recommended treatment, referral source and client status; notes about counseling sessions made by the counselor; copies of admonishments and reprimands received by the employee; copies of performance appraisals received by the employee; copies of performance appraisals; and documentation of treatment from therapists, physicians, rehabilitation treatment centers and other outside private or community resources.

42 U.S.C. 290dd-1, 290ee-1; 5 U.S.C. 7901; Executive Order 12564 (Sept. 15, 1986).

To counsel EPA employees who are experiencing personal or work related problems, including alcohol and drug abuse problems, which may affect their work performance; to document the nature of the employee's problem and the progress made, to record an employee's participation in and the results of community or private sector treatment or rehabilitation programs, and, with the employee's consent, to coordinate with appropriate supervisory or management officials concerning the progress of the employee's rehabilitation; to conduct scientific research, management and financial audits and program evaluations, but individual employees shall not be identified in any resulting reports, audits, or evaluations nor their identities further disclosed in any manner.

General routine uses F and H apply to this system. Disclosure of records pertaining to an employee's alcohol or drug abuse is restricted under the provision of the Confidentiality of Alcohol and Drug Abuse Patient Records regulations, 42 CFR part 2.

Storage:

Paper files.

By the names of the client employees and by client numbers cross-indexed by names.

ECAP records are retained until three years after termination of counseling or until the individual leaves the EPA and are then destroyed.

Director, Career Resource and Counseling Center, Environmental Protection Agency, Ariel Rios Building, 1200 Pennsylvania Avenue NW, Washington, DC 20460.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Complete EPA Privacy Act procedures are set out in 40 CFR part 16.

Record subjects, a record subject's family, sources to whom a record subject has been referred for assistance, supervisors and other EPA officials, agency health unit, and ECAP counselors.

-29 EPA Travel, Other Accounts Payable, and Accounts Receivable Files.

National Computer Center, Environmental Protection Agency, Research Triangle Park, North Carolina 27711; other EPA offices. See the appendix for addresses of regional and other offices.

Individuals who owe monies to and individuals who are owed monies from the Environmental Protection Agency are covered by the system. This includes, but is not limited to, monies owed to EPA for refunds, penalties, travel advances, Interagency Agreements, or Freedom of Information Requests. This system also contains information on corporations and other entities that are in debt to EPA. Records on corporations and other entities are not subject to the Privacy Act. This system also includes monies owed by EPA to Agency employees, consultants, private citizens, and others who travel or perform other services for EPA.

This system of records is composed of an accounts receivable module and travel and other accounts payable modules. The system contains personal identifying information such as names, addresses, and Social Security numbers of persons indebted to or owed money by EPA. The accounts receivable module contains information about the nature of the debt or claim, the amount owed, the history status of the debt, and information that relates to and documents efforts to collect debts owed the Agency. The travel and other accounts payable modules contain information about the travel authorization; travel vouchers, which support the claim for the reimbursement to the travel; travel advance authorizations, which provide fund advances to pay travel expenses incurred in the performance of official government business; and finally itemized invoices for other services performed for EPA. In both modules, banking information necessary to support electronic funds transfers may be maintained.

31 U.S.C. 3511-3513; 5 U.S.C. 5514; 31 U.S.C. 3702; 31 U.S.C. 3711 et seq.; Executive Order 9397 (Nov. 22, 1943).

Records in the accounts receivable module are used primarily to create a record of, and track, all accounts receivable and to assist EPA in collecting debts owed the Agency. Records in the travel and other accounts payable modules are used primarily to create a record of and to track all monies owed by the EPA for authorized travel and for other services performed for EPA.

General routine uses A, B, C, D, E, F, G, H, I, and K apply to this system. Records may also be disclosed:

1. To Union representatives when relevant and necessary to their duties as exclusive bargaining agents under the Civil Service Reform Act of 1978, 5 U.S.C. 7111, 7114

2. To the Office of Management and Budget, and Department of Treasury for purposes of carrying out EPA's financial management responsibilities

3. To the Defense Manpower Data Center of the Department of Defense, U.S. Postal Service, Department of the Treasury, Justice Department or other federal agencies for the Purpose(s) of identifying and locating individuals who are receiving Federal salaries or benefit payments and are delinquent in their repayment of debts owed to the U.S. Government under programs administered by EPA. The Purpose(s) of the disclosure is to collect the delinquent debts by voluntary repayment, administrative, salary, tax refund offset procedures, or through litigation. When disclosures are made as part of computer matching programs, EPA will comply with the Computer Matching and Privacy Protection Act of 1988

4. To provide debtor information to consumer reporting agencies in order to obtain credit reports for use by EPA for debt collection purposes and to report delinquent debts

5. To provide debtor information to debt collection agencies under contract to EPA to help collect debts owed EPA. Debt collection agencies will be required to comply with the Privacy Act and their agents will be made subject to the criminal penalty provisions of the Act.

Note:

The term "debtor information" as used in the routine uses above is limited to the individual's name, address, social security number, and other information necessary to identify the individual; the amount, status and history of the claim; and the agency or program under which the claim arose.

Disclosure to consumer reporting agencies:

Pursuant to 5 U.S.C. 552a(b)(12), disclosure may be made to a consumer reporting agency as defined in the Fair Credit Reporting Act (15 U.S.C. 1681a(f)) or the Federal Claims Collection Act of 1966 (31 U.S.C. 3701(a) (30)).

Storage:

On computer systems, tapes, disks, microfiche, and other hard copy formats. The mainframe and the computer tapes and disks are located in Research Triangle Park, North Carolina. Backup tapes are maintained at a disaster recovery site.

Accounts receivable module records are indexed by account receivable control number (a number assigned to each "incoming" account receivable). Individual records can be accessed by using a cross reference table which links accounts receivable control numbers with debtors names and associated debtor information. Travel and other accounts payable module records are retrievable by name and social security number.

Records are maintained for at least two years. In some cases depending on program needs, records may be maintained for a longer period. Manual records are ultimately transferred to a Record Center where they are kept until disposed of in accordance with record disposal schedules.

Comptroller, Office of the Comptroller, Environmental Protection Agency, Ariel Rios Building, 1200 Pennsylvania Avenue NW, Washington, DC 20460.

Any individual who wants to know whether this system of records contain a record about him or her, who wants access to his or her record, or who wants to contest the contents of a record, should make a written request to the System Manager.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Complete EPA Privacy Act procedures are set out in 40 CFR part 16.

Record subjects, supervisors, consumer reporting agencies, debt collection agencies, the Department of the Treasury and other Federal agencies.

-30 Inspector General Enterprise Management System (IGEMS) Hotline Module.

Unclassified

Office of Inspector General, Environmental Protection Agency, 1200 Pennsylvania Avenue NW., Washington, DC 20460

USEPA, Office of Management (Mail code 2410T), 1200 Pennsylvania Ave. NW., Washington,

DC 20460, Attn: Assistant Inspector General for Management.

Tel Number: 202-566-0847, Fax: 202-566-0857

Inspector General Act of 1978, 5 U.S.C. app. 3.

Facilitates OIG’s responsibilities under Section 7 of the Inspector General Act, that is to receive and investigate complaints of information concerning the possible existence of activities constituting a violation of law, rules or regulations, mismanagement, gross waste of funds, abuse of authority or a substantial and specific danger to the public health or safety, and the subject of the complaints.

Persons who report information to the Office of Inspector General (OIG) concerning the possible existence of activities constituting a violation of law, rules or regulations, mismanagement, gross waste of funds, abuse of authority, or a substantial and specific danger to the public health or safety; the subject of the complaints; persons about whom complaints are made; and possible witnesses identified.

Complainants who report indications of wrongdoing, name and address of the complainant (except for anonymous complainants), date complaint received, program area, nature and subject of complaint, any additional contacts and specific comments provided by the complainant, information on the OIG disposition of the complaint, including investigative case number, preliminary inquiry number, dates of referral, reply and follow-up, status and disposition code of the complaint.

Complainants who are employees of EPA; employees of other Federal agencies; employees of state and local agencies; and private citizens. Records in the system come from complainants through the telephone, mail, personal interviews, web forms, and email. Complainants are advised that if they provide contact information, this information may be used to initiate follow-up communications with the complainant and may be shared by EPA with appropriate administrative, law enforcement, and judicial entities engaged in investigating or adjudicating the tip or complaint.

General routine uses A, B, C, D, E, F, G, H, I, J, and K apply to this system (73 Fed. Reg. 2245). Records may also be disclosed:

•To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records, (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

•To another Federal agency or Federal entity, when the Agency determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

•To a Federal agency responsible for considering suspension or debarment action where such record would be relevant to such action.

•To the Department of Justice to obtain its advice on Freedom of Information Act matters.

•In response to a lawful subpoena issued by a Federal agency.

In accordance with OIG Records Management Policy, computer records are maintained in a secure, password protected computer system. Paper records are maintained in lockable file cabinets. All records are maintained in secure, access-controlled areas or buildings.

By case number, complainant or subject name, and subject matter.

Records stored in this system are subject to EPA Records Schedule 1016, which covers records related to operations and programs of the EPA and its external business partners that ensure compliance with applicable laws and regulations and prevent waste, fraud, and abuse.

Computer records are maintained in a secure, password protected computer system. Paper records are maintained in lockable file cabinets. All records are maintained in secure, access-controlled areas or buildings. The IGEMS Hotline module is restricted to the Hotline Administrator and the Hotline module users. It is one of the modules found in IGEMS. IGEMS is accessible to EPA OIG employees only. It is an internal database accessible by use of strong passwords, which are renewed on a regular basis and controls to lock the screen after a set time are enforced.

To the extent permitted under the Privacy Act of 1974, 5 U.S.C. 552a(k)(2), this system has been exempted from the provisions of the Privacy Act of 1974 that permit access and correction. However, EPA may, in its discretion, fully grant individual requests for access and correction if it determines that the exercise of these rights will not interfere with an interest that the exemption is intended to protect. The exemption from access is limited in some instances by law to information that would reveal the identity of a confidential source. Requesters will be required to provide adequate identification, such as a driver’s license, employee identification card, or other identifying document. Additional identification procedures may be required in some instances.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Complete EPA Privacy Act procedures are set out in 40 CFR Part 16.

Requests to determine whether this system of records contains a record pertaining to you must be sent to the Agency’s Privacy Officer. The address is: U.S. Environmental Protection Agency, 1200 Pennsylvania Avenue, NW (2831T) Washington, DC 20460; (202) 566-1668; Email: (privacy@epa.gov).

Pursuant to 5 U.S.C. 552a(k)(2), this system is exempt from the following provisions of the Privacy Act of 1974, subject to the limitations set forth in that subsection : 5 U.S.C. 552a (c)(3); (d); (e)(1); (e)(4)(G); (e)(4)(H); and (f)(2) through (5).

76 Fed. Reg. 42707 - Changing the name of the system from the Office of Inspector General (OIG) Hotline Allegation System (EPA-30) to the Inspector General Enterprise Management System (IGEMS) Hotline Module.

40 CFR Part 16 -

Exempt the OIG Hotline Allegation System--EPA/OIG (EPA-30) system of records from compliance with certain subsection s of the Act. This amendment is made to maintain the efficiency and integrity of OIG investigations, audits, or referrals that result from complaints concerning the possible existence of activities constituting a violation of law, rules, or regulations, mismanagement, gross waste of funds, abuse of authority, or a substantial and specific danger to the public health or safety.

57 Fed. Reg. 36092 – Established OIG Hotline Allegation System--EPA/OIG and is maintained by the EPA Office of Inspector General (OIG).

-33 Case Application for Debarment and Suspension.

Unclassified.

National Computer Center (NCC), 109 TW Alexander Drive, Research Triangle Park, Durham, NC 27711.

Michael Osinski, Director, Office of Grants and Debarment, Office of Mission Support, Environmental Protection Agency, Ronald Reagan Building, Mailcode 3901R, 1300 Pennsylvania Avenue NW, Washington, DC 20460; telephone number, (202) 564-3792; email address, Osinski.Michael@epa.gov.

Government Paperwork Elimination Act (Pub. L. 105-277, 44 U.S.C. 3504); 33 U.S.C. 1368; 42 U.S.C. § 7606; Executive Order 11738, Providing for administration of the Clean Air Act and the Federal Water Pollution Control Act with respect to Federal contracts, grants, or loans (38 FR 25161, 3 CFR, 1971-1975 Comp., p. 799); Executive Order 12549, Debarment and Suspension (51 FR 6370, 3 CFR, 1986 Comp., p. 189); Executive Order 12689 (54 FR 34131, 3 CFR, 1989 Comp., p. 235); the Federal Acquisition Streamlining Act of 1994, Pub. L. 103-355, 31 U.S.C. 6101 note; 2 CFR part 180—the Office of Management and Budget Guidelines to Agencies on Governmentwide Debarment and Suspension (Nonprocurement); 2 CFR part 1532—Nonprocurement Debarment and Suspension; and the Federal Acquisition Regulation, 48 CFR subpart 9.4—Debarment, Suspension, and Ineligibility.

The purpose of CADS is to assist the Office of Mission Support in processing, investigating, and maintaining records relevant to suspension and debarment case actions. The Office of Mission Support utilizes suspension and debarment as an administrative tool to address waste, fraud, abuse, poor performance, environmental noncompliance or other misconduct by excluding individuals from participating in federal procurement or nonprocurement programs. The Office of Mission Support is also responsible for implementing a statutory debarment authority that arises by operation of law under the Clean Air Act section 306 or Clean Water Act section 508. This statutory debarment authority prohibits the Federal Government from entering into contracts or nonprocurement transactions at violating facilities unless and until the EPA Suspension and Debarment Official can certify that the conditions that gave rise to the Clean Air Act or Clean Water Act conviction have been corrected. This system of records also assists the Office of Mission Support in assembling information in order to conduct and document suspension and debarment proceedings; to ensure that federal contracts and federal assistance, loans, and benefits are awarded to responsible business entities and individuals; and to ensure the government conducts business with persons at facilities that are in compliance with the Clean Air Act or Clean Water Act.

(1) Individuals who have been suspended, proposed for debarment, or debarred from federal procurement and assistance programs; (2) Individuals who have been the subject of agency inquiries to determine whether they should be debarred and/or suspended from federal procurement and assistance programs; and (3) Individuals who have been convicted and are subject to an exclusion by operation of law under Clean Air Act section 306 or Clean Water Act section 508.

Records include information on individuals and firms excluded or considered for exclusion from federal acquisition or assistance programs as a result of suspension or debarment proceedings initiated by the EPA, or as a result of a statutory exclusion arising by operation of law upon conviction pursuant to Clean Air Act section 306 or Clean Water Act section 508. Such information includes, but is not limited to, names and residential addresses of individuals; email addresses of individuals; business addresses associated with individuals; phone numbers associated with individuals; evidence obtained in support of suspension and debarment case actions; records submitted by individuals or other persons (corporations, partnerships, associations, unit of governments, or legal entities, however organized, or their authorized representative); administrative agreements; audits of administrative agreements; and final decisions or reinstatement determinations. Examples of records include correspondence, inspection reports, memoranda of interviews, contracts, assistance agreements, indictments, judgment and conviction orders, plea agreements, and corporate information. Records such as court documents or reports from commercial databases may contain individuals' Social Security Numbers and dates of birth. Computer generated records include data and reports regarding categories and status of cases.

EPA and other federal officials, state and local officials, businesses and other entities who may have information relevant to an inquiry, individuals who have been statutorily excluded, suspended, proposed for debarment or debarred, and their authorized representatives.

The following routine uses apply to this system because the use of the record is necessary for the efficient conduct of government operations. The routine uses below are both related to and compatible with the original purpose for which the information was collected. The following general routine uses apply to this system (73 FR 2245):

A. Disclosure for Law Enforcement Purposes: Information may be disclosed to the appropriate federal, state, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity.

C. Disclosure to Requesting Agency: Disclosure may be made to a federal, state, local, foreign, or tribal or other public authority of the fact that this system of records contains information relevant to the retention of an employee, the retention of a security clearance, the letting of a contract, or the issuance or retention of a license, grant, or other benefit. The other agency or licensing organization may then make a request supported by the written consent of the individual for the entire record if it so chooses. No disclosure will be made unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another federal agency for criminal, civil, administrative, personnel, or regulatory action.

1. The Agency, or any component thereof;

2. Any employee of the Agency in his or her official capacity;

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

G. Disclosure to the National Archives: Information may be disclosed to the National Archives and Records Administration in records management inspections.

H. Disclosure to Contractors, Grantees, and Others: Information may be disclosed to contractors, grantees, consultants, or volunteers performing or working on a contract, service, grant, cooperative agreement, job, or other activity for the Agency and who have a need to have access to the information in the performance of their duties or activities for the Agency. When appropriate, recipients will be required to comply with the requirements of the Privacy Act of 1974 as provided in 5 U.S.C. 552a(m). I. Disclosures for Administrative Claims, Complaints and Appeals: Information from this system of records may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.

The two routine uses below (L and M) are required by OMB Memorandum M-17-12:

L. Disclosure to Persons or Entities in Response to an Actual or Suspected Breach of Personally Identifiable Information: To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records, (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

M. Disclosure to Assist Another Agency in Its Efforts to Respond to a Breach of Personally Identifiable Information: To another federal agency or federal entity, when the Agency determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach. Records may also be disclosed: 1. Disclosure to the System for Award Management: To the General Services Administration (GSA) to compile and maintain the System for Award Management (SAM) Exclusions list in accordance with FAR 9.404 and 2 CFR 180.500 and 180.505. 2. Disclosure to the Federal Awardee Performance and Integrity Information System: To the GSA for the Federal Awardee Performance and Integrity Information System (FAPIIS), which publicly discloses administrative agreements as required by Section 872 of The Duncan Hunter National Defense Authorization Act of 2009 (Public Law 110-417). 3. Disclosure to the Individual Respondent: To the individual person statutorily excluded, suspended, proposed for debarment, or debarred in EPA proceedings; to the individual person who has been the subject of agency inquiries to determine whether the individual person should be debarred and/or suspended from federal procurement and assistance programs; and to the authorized representatives of the individual person statutorily excluded, suspended, proposed for debarment or debarred in EPA proceedings. 4. Disclosure to Other Respondents: To persons (any individual, corporation, partnership, association, unit of government, or legal entity, however organized) who have been suspended, proposed for debarment, or debarred from federal procurement and assistance programs; persons who have been the subject of agency inquiries to determine whether they should be debarred and/or suspended from federal procurement and assistance programs; and to the authorized representatives of the persons in a suspension or debarment proceeding, when by careful review the Agency determines that the records are both relevant and necessary to the persons’ suspension or debarment proceedings.

5. Disclosure to Coordinating Federal Agencies: To a federal agency coordinating with the EPA for an EPA suspension or debarment proceeding or having a suspension or debarment action involving the same person.

6. Disclosure for Eligibility Determinations: To a federal, state, or local agency, financial institution, or other entity to verify an individual's eligibility for engaging in federal procurement transactions or covered transactions as defined in FAR Subpart 9.4 and 2 CFR Part 180. 7. Disclosure to Requesting Agencies for Particular Purposes: To federal, state, or local agencies, in response to requests or subpoenas, or otherwise, for the purpose(s) of: (a) assisting them in administering federal acquisition, assistance, loan and benefit programs or regulatory programs, (b) assisting them in discharging their duties to ensure that federal contracts and assistance, loans, and benefit programs are awarded to responsible individuals and organizations, and (c) ensuring that federal, state or local regulatory responsibilities are met.

8. Disclosure of Final Decisions: To the public, upon request, and to publishers of computerized legal research systems, but such disclosures shall be limited to interim or final decisions.

The information collected within CADS is maintained and stored on computer storage devices physically located at NCC. These records are maintained electronically on computer storage devices such as computer tapes and disks. Backups will be maintained at a disaster recovery site. Computer records are maintained in a secure password protected environment. Access to computer records is limited to those who have a need to know. Permission level assignments will allow users access only to those functions for which they are authorized. All records are maintained in secure, access-controlled areas or buildings.

Records are retrieved by business or organization name, by an individual’s first or last name, by case number, or by file name.

Records are retained in accordance with the EPA’s Records Schedules 1016(c) and 0090(d) and disposed of under National Archives and Records Administration (NARA) disposal authority DAA-0412-2013-0015-0003.

Security controls used to protect personal sensitive data in CADS are commensurate with those required for an information system rated MODERATE for confidentiality, integrity, and availability, as prescribed in National Institute of Standards and Technology (NIST) Special Publication, 800-53, "Security and Privacy Controls for Federal Information Systems and Organizations," Revision 5.

1. Administrative Safeguards: Personnel are instructed to lock their computer when they leave their desks. Personnel receive annual Information Security and Privacy Awareness training and are regularly reminded about appropriate personally identifiable information handling procedures. In addition to the Agency's Rules of Behavior and Privacy Act training that personnel undergo, CADS users are required to sign a Rules of Behavior document and a Request for Remote Access and Use of Sensitive Personally Identifiable Information document before they are granted access to CADS.

2. Technical Safeguards: Access to CADS is strictly controlled and is limited to those with an operational need to access the information. Access is granted and managed by CADS Administrators. Access to the EPA Virtual Private Network requires two-factor authentication accomplished by using Personal Identity Verification (PIV) cards that are issued to all personnel based on the requirements of Homeland Security Presidential Directive 12 (HSPD 12). Access to CADS is restricted to users on the EPA Virtual Private Network who have been granted permission by a CADS administrator to have access to CADS. CADS access is username and password protected.

3. Physical Safeguards: EPA employees and contractors involved in the management, design, development, implementation and execution of CADS will have monitored access to CADS. Only individuals who have the proper authorization and who perform functions related to CADS are allowed to access any information. Entry to the EPA facility and within the facility to specific spaces at the NCC is achieved using HSPD-12 PIV cards on door readers. PIV cards are only issued to personnel who have met EPA’s initial security screening requirements. Security Guards at all entrances confirm that the PIV card is valid, unexpired and reflects the identity of the card holder. Entry to the server rooms is only available to personnel using their PIV cards on door readers, where those personnel have been approved for elevated access (meaning they have undergone a more rigorous security screening). The NCC maintains an Access Control List to ensure access to server rooms is limited to approved personnel only.

Individuals seeking access to information in this system of records about themselves are required to provide adequate identification (e.g., driver’s license, military identification card, employee badge or identification card). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

Individuals who want to know whether this system of records contains information about them should make a written request to the EPA, Attn: Agency Privacy Officer, MC 2831T, 1200 Pennsylvania Ave., NW, Washington, D.C. 20460, privacy@epa.gov.

None.

60 FR 51791 (October 3, 1995) - Creation of the ‘‘Debarment and Suspension Files’’ system of records.

67 FR 8246 (February 22, 2002) - Republication of Existing System of Records

-34 Medical and Research Study Records of Human Volunteers.

Human Studies Facility, Human Studies Division, National Health and Environmental Effects Research Laboratories, Office of Research and Development, Environmental Protection Agency, 104 Mason Farm Road, Chapel Hill, NC 27599.

Individuals who volunteer for participation in EPA-sponsored, human studies research, whether or not they are accepted for participation, and individuals who participate in the research.

Names, addresses, telephone numbers of individual volunteers; individual vital statistics; medical histories; psychological profiles; results of laboratory tests; results of participation in specific research studies; and related records pertinent to the human subject research program.

Resource Conservation and Recovery Act, 42 U.S.C. 6981; Comprehensive Environmental Response, Compensation and Liability Act, 42 U.S.C. 9660; Clean Air Act, 42 U.S.C. 7403; Safe Drinking Water Act, 42 U.S.C. 300j-1; Federal Water Pollution Control Act, 33 U.S.C. 1254; Toxic Substances Control Act, 15 U.S.C. 2609; Federal Insecticide, Fungicide, and Rodenticide Act, 7 U.S.C. 136r.

To support the EPA regulatory process by providing scientific information on the health effects of environmental pollutants; to screen volunteers to protect them from unnecessary health risks, to document their medical condition, and to document the specific research activities in which the subjects participated.

General routine uses D, E, F, H, and K apply to this system. Records may also be disclosed:

1. To scientists at governmental or private institutions, research centers, or businesses who assist with EPA research projects or who conduct related research (normally peer reviewed and institutional review board approved) that can benefit from access to EPA research records

2. To public health authorities in conformity with federal, state, and local laws when necessary to protect the public health. Individuals whose records might be disclosed under this authority are normally notified of the possibility of disclosure through informed consent agreements

Storage:

In file folders, on index cards, and in an electronic database. Some records may also be stored off site in a secure facility maintained by a contractor to the EPA Human Studies Division.

By name and by identifying numbers assigned for each project.

Electronic records are maintained in a secure, password protected electronic system. Paper records are maintained in lockable file cabinets. All records are maintained in secure, access- controlled areas or buildings.

The records are permanently maintained.

Director, Human Studies Facility, Human Studies Division, National Health and Environmental Effects Research Laboratories, Office of Research and Development, Environmental Protection Agency, 104 Mason Farm Road, Chapel Hill, NC 27599.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Complete EPA Privacy Act procedures are set out in 40 CFR part 16.

Research subjects. Medical records of a research subject may be obtained occasionally with the consent of the research subject.

-36 Research Grant, Cooperative Agreement, and Fellowship Application Files.

National Center for Environmental Research, Office of Research and Development, Environmental Protection Agency, Ariel Rios Building, 1200 Pennsylvania Avenue NW, Washington, DC 20460.

Individuals (principal investigators and fellows) who request or have previously requested support from the ORD research grants programs, either individually or through an academic institution, state agency, or non-profit organization.

Names of the principal investigators, research proposals and their identifying numbers, supporting data from the academic institutions or other applicants, proposal evaluations from peer reviewers, review records, financial data, and other material related to evaluation of applications.

Federal Grant and Cooperative Agreement Act, 31 U.S.C. 6301 et seq.; Clean Air Act, 42 U.S.C. 1857 et seq.; Federal Water Pollution Control Act, 33 U.S.C. 1254 et seq.; Public Health Service Act, 42 U.S.C. 241 et seq.; Solid Waste Disposal Act, 42 U.S.C. 6901 et seq.; Federal Insecticide, Fungicide, and Rodenticide Act, 7 U.S.C. 136 et seq.; Safe Drinking Water Act, 42 U.S.C. 300j-1; Toxic Substances Control Act, 15 U.S.C. 2609, Comprehensive Environmental Response, Compensation, and Liability Act, 42 U.S.C. 9660. Other laws may be relevant as well.

To assist EPA in conducting and documenting the receipt and review of applications and award of research grants to the most meritorious applicants in response to solicitations issued by the Office of Research and Development in furtherance of its Science to Achieve Results (STAR) program.

General routine uses A, B, C, D, E, F, G, H, and K apply to this system. Records may also be disclosed:

1. To qualified reviewers retained by EPA for their opinion and evaluation of applicants and their proposals as part of the application review process

2. To other Federal government agencies and private-sector organizations regarding applicants in order to coordinate joint grant programs between Federal agencies, State or local government agencies, and/or private-sector organizations

3. To the applicant institution to obtain data for use in reviewing applications, awarding grants, or administering grants.

Storage:

Electronic databases and hard copy files.

Electronic files may be retrieved by most data elements in the database (primarily by topic area and assistance number). Retrieval by name of principal investigator is reserved to the system manger.

Hard copies of awarded proposals are transferred to the Federal Records Center one year after closeout where they are retained for an additional six years. Hard copies of declined proposals are destroyed three years after they are declined.

Director, Peer Review Division, National Center for Environmental Research, Office of Research and Development, Environmental Protection Agency, Environmental Protection Agency, Ariel Rios Building, 1200 Pennsylvania Avenue NW, Washington, DC 20460.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Complete EPA Privacy Act procedures are set out in 40 CFR part 16.

Academic institutions, principal investigators, other applicants, peer reviewers, and EPA and other Federal agency personnel.

Pursuant to 5 U.S.C. 552a(k) (5), this system is exempt from the following provisions of the Privacy Act, subject to the limitations set forth in that subsection : 5 U.S.C. 552a(c)(3) and (d).

-38 Invention Reports Submitted to the EPA.

Office of General Counsel, Environmental Protection Agency, Ariel Rios Building, 1200 Pennsylvania Avenue NW, Washington, DC 20460. Invention reports from contractors, subcontractors, grantees, and cooperative agreement recipients are submitted to and maintained on behalf of EPA by the Office of Policy for Extramural Research Administration, National Institutes of Health, Bethesda, Maryland, in the Extramural Invention Information Management System (code-named Edison).

EPA employees and employees of contractors, subcontractors, grantees, cooperative agreement recipients (40 CFR part 30), and parties to cooperative research and development agreements (15 U.S.C. 3710a) who have submitted invention reports to EPA

Invention reports, patent applications, patents, patent assignments, licenses, procurement requests, Government purchase orders, and other documents relevant to inventions made under EPA sponsorship.

Executive Order 9865 (June 14, 1947), Executive Order 10096 (Jan. 23, 1950), 35 U.S.C. Ch. 18 (Patent Rights in Inventions Made with Federal Assistance), 37 CFR parts 401, 404, and 501; 40 CFR part 30, 48 CFR parts 27 and 52; 15 U.S.C. 3710a.

Records are maintained for the Purpose (s) of documenting inventions made under EPA sponsorship, including filing patent applications, determining rights to inventions, licensing inventions, and ascertaining inventorship and priority of invention.

General routine uses A, D, E, F, G, H, I, and K apply to this system. Records may also be disclosed:

1. To scientific personnel who possess the expertise to understand the invention and evaluate its importance to the Government and/or the public

2. To contract patent counsel and their employees retained by the Agency for patent searching, preparation and prosecution of United States and foreign patent applications

3. To Government agencies that we contact regarding possible use, interest in or ownership rights in our inventions

4. To technology assistance personnel, technology evaluators, technology finders, and prospective licensees who may further make the invention available to the public through evaluation, promotion, sale, use, or publication

5. To parties, such as supervisors of inventors, whom we contact to determine ownership rights, and to people contacting us to determine the Government's ownership

6. To the United States and foreign Patent and Trademark Offices when we file U.S. and foreign patent applications.

Storage:

Individual file folders in file cabinets and indexed on computer tracking system.

By inventor's name, case identification number, and patent application number or patent number.

The records are maintained for fifteen years after completion or termination of action on the disclosed invention, such as issuance of a patent. The records are maintained at EPA for approximately three and are then sent to a Federal Records Center for the remainder of the applicable retention period.

General Counsel, Environmental Protection Agency, Ariel Rios Building, 1200 Pennsylvania Avenue NW, Washington, DC 20460.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Complete EPA Privacy Act procedures are set out in 40 CFR part 16.

Invention report submitters and their supervisors; other persons with knowledge of the invention or expertise in the particular area of the invention; EPA Patent Counsel; EPA contractors who have searched the invention, prepared a patent application on the invention and/or otherwise performed work relating to a patent application; and the United States and foreign patent offices.

/40-

Inspector General Enterprise Management System (IGEMS) Investigative Module. EPA-40

Unclassified

Office of Inspector General, Environmental Protection Agency, 1200 Pennsylvania Avenue NW., Washington, DC 20460.

James Nussbaumer, Nussbaumer.James@epa.gov, 202-566-2583

Assistant Inspector General for Management, Office of Inspector General, Environmental Protection Agency, 1200 Pennsylvania Avenue NW., Washington, DC 20460.

Inspector General Act of 1978, 5 U.S.C. app. 3.

To serve as the repository of information collected in the course of conducting investigations relating to programs and operations of the EPA.

Subjects, complainants, and witnesses in OIG investigations; OIG employees who perform investigations; and individuals who receive the results of investigations.

Personally Identifiable Information (PII) records to include name, address, telephone number, employee ID, personal cell phone number, date of birth, employment information; Sensitive PII in the form of a social security number (SSN); Health insurance Portability and Accountability Act (HIPAA) records; and financial records. Records include investigative files and materials collected during the investigative process, names of subjects of OIG investigations; address of subjects; names of complainants and witnesses interviewed during the investigations; documents and other records collected from public, business, government and other sources; forensic and other analyses; memoranda of investigative activities and contacts; electronic data; electronic images; and investigative tools.

Subjects of an investigation; present and former associations of the subjects (e.g., colleagues, business associates, acquaintances, or relatives); federal, state, local, international, and foreign investigative or law enforcement agencies; other government agencies; confidential sources; complainants; witnesses; concerned citizens; and public source materials.

General routine uses A, B, C, D E, F, G, H, I, J, and K apply to this system (73 FR 2245).

Records may also be disclosed:

1. To any source, private or public, to the extent necessary to secure from such source information relevant to a legitimate EPA investigation, audit, decision, or other inquiry.

2. To a Federal agency responsible for considering suspension or debarment action where such record would be relevant to such action.

3. To the Department of Justice to obtain its advice on Freedom of Information Act matters.

4. In response to a lawful subpoena issued by a Federal agency.

5. To the Department of the Treasury and the Department of Justice when EPA is seeking an ex parte court order to obtain taxpayer information from the Internal Revenue Service.

6. To a Federal, State, local, foreign, or international agency, or other public authority, for use in a computer matching program, as that term is defined in 5 U.S.C. 552a(a)(8).

7. To a public or professional licensing organization if the record indicates, either by itself or in combination with other information, a violation or potential violation of professional standards, or reflects on the moral, educational, or professional qualifications of an individual who is licensed or who is seeking to become licensed.

8. To any person when disclosure of the record is needed to enable the recipient of the record to take action to recover money or property of the EPA, when such recovery will accrue to the benefit of the United States, or when disclosure of the record is needed to enable the recipient of the record to take appropriate disciplinary action to maintain the integrity of EPA programs or operations.

9. To officers and employees of other Federal agencies for the purpose of conducting quality assessments of the OIG.

10. To the news media and public when a public interest justifies the disclosure of information on public events such as indictments or similar activities.

11. To Members of Congress and the public in the OIG’s Semiannual Report to Congress when the Inspector General determines that the matter reported is significant.

12. To the public when the matter under audit or investigation has become public knowledge, or when the Inspector General determines that such disclosure is necessary to preserve confidence in the integrity of the OIG audit or investigative process or is necessary to demonstrate the accountability of EPA officers, employees, or individuals covered by this system, unless it is determined that disclosure of the specific information in the context of a particular case could reasonably be expected to constitute an unwarranted invasion of personal privacy.

13. To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records,· (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

14. To another Federal agency or Federal entity, when the Agency determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

15. To the Office of Government Ethics to comply with agency reporting requirements in 5 CFR § 2638.206.

By names and other identifiers of subjects, complainants and witnesses interviewed during investigations; others involved in the investigative process; and investigative case file numbers.

Computer records are maintained in a secure, password protected computer system. Paper records are maintained in lockable file cabinets. All records are maintained in secure, access-controlled areas or buildings. The IGEMS Investigations module (I2M) is restricted to the I2M Administrator and the staff of EPA OIG Office of Investigations, Office of Counsel, the Inspector General and Deputy Inspector General. It is one of the modules found in IGEMS. IGEMS is accessible to EPA OIG employees only. It is an internal database accessible by multi-factor authentication. Use of strong passwords, which are renewed on a regular basis, and screen locks are enforced.

To the extent permitted under the Privacy Act of 1974, 5 U.S.C. 552a(j), (k)(2) & (k)(5), this system has been exempted from the provisions of the Privacy Act of 1974 that permit access and correction. However, EPA may in its discretion, fully grant individual requests for access and correction if it determines that the exercise of these rights will not interfere with an interest that the exemption is intended to protect. The exemption from access is limited in some instances by law to information that would reveal the identity of a confidential source. Requesters will be required to provide adequate identification, such as a driver’s license, employee identification card or other identifying document. Additional identification procedures may be required in some instances.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. EPA’s Privacy Act regulations are set out in 40 CFR Part 16.

Requests to determine whether this system of records contains a record pertaining to you must be sent to the Agency’s Privacy Officer at: U.S. Environmental Protection Agency, 1200 Pennsylvania Avenue, NW (2831T) Washington, DC 20460; (202) 566-1668; Email: (privacy@epa.gov); Attn: Privacy Officer

Under 5 U.S.C. 552a(j)(2), this system is exempt from the following provisions of the Privacy Act of 1974, as amended: 5 U.S.C. 552a(c)(3) and (4); (d); (e)(1), (e)(2), (e)(3), (e)(4)(G), (e)(4)(H), (e)(5), and (e)(8); (f); and (g).

Under 5 U.S.C. 552a(k)(2) and (k)(5), this system is exempt from the following provisions of the Privacy Act of 1974 as amended, subject to the limitations set forth in this subsection ; 5 U.S.C. 552a(c)(3); (d); (e)(1), (e)(4)(G), (e)(4)(H), and (f)(2) through (5).

66 F R 49947 - The establishment of the IGOR system in the Office of Inspector General resulted in a restructuring of the OIG systems of records. Two existing systems (for investigative files and personnel security files) migrated to the IGOR structure. One new OIG system for audit, assignment, and time sheet files has been created.

76 FR 71019 - proposes to amend an existing system of records by changing the name of the system from the Inspector General's Operation and Reporting (IGOR) System Investigative Files (EPA-40) to the Inspector General Enterprise Management System (IGEMS) Investigative Module.

-41 Office of Administrative Services Information System (OASIS)

Office of Administrative Services, Environmental Protection Agency, Ariel Rios Building, 1200 Pennsylvania Ave., NW., Washington, DC 20460.

Individuals who require regular, ongoing access to EPA-controlled facilities, information technology systems, or information classified in the interest of national security, including applicants for employment or contracts, Federal employees, contractors, grantees, students, interns, volunteers, other non-Federal employees and individuals formerly in any of these positions. The system also covers individuals authorized to perform or use services provided in Agency facilities (e.g., Fitness Center, etc.). The system does not apply to occasional visitors or short- term guests to whom the Agency will issue temporary identification.

This system maintains records that are used to administer and manage the administrative resources of the EPA. Categories of records include:

● Personal information such as name, home address, telephone number, and date of birth.

● Work related information such as work address, work telephone number, organization/office assignment, and company name.

● Personnel Security Records such as the results of a background investigation, and information derived from documents used to verify applicant's identity.

● Locks and Keys Management information such as combinations, locks, incidents requiring a security report, keys, and safes located at Headquarters.

● Physical Security information such as building vulnerabilities, mitigations, costs associated with mitigation, and risk designation levels at various EPA locations.

● Warehouse Management information such as type of product order, contact information for recipient, and purchase order number.

● Fitness Center information such as photographs, medical information, payroll deductions, and pay grade (GS level only).

● Driver Tracking information such as EPA vehicle license plate numbers, service records, and number of passengers utilizing the Agency buses.

● Parking and Transit information such as carpool members names, addresses, work addresses, license plate numbers, and type of cars as well as transit subsidy information such as subsidy amount, possession of a registered Smart Trip card, and serial number of Smart Trip card if registered.

● Mail Center Management information used to track registered mail. Records include mailing address of the recipient and sender, name of individual who signed for the piece of mail, date and time mail was signed for, and costs of postage for each office.

● Printing information such as name and telephone number of the office requesting print jobs, the budget associated with the print job, and completion and delivery of the print job.

● Trouble Ticket information such as the name and work telephone number of the caller and the nature of the information technology problem.

5 U.S.C. 301; Federal Information Security Act (Pub. L. 104-106, sec. 5113); Electronic Government Act (Pub. L. 104-347, sec. 203); the Paperwork Reduction Act of 1995 (44 U.S.C. 3501); and the Government Paperwork Elimination Act (Pub. L. 105-277, 44 U.S.C. 3504); Federal Property and Administrative Act of 1949, as amended.

The purpose of this system is to administer and manage administrative resources for the EPA. Each module's purpose is described below.

● Physical Security--The purpose of the Physical Security module is to assist the members of the Security Management Division with assessments of the physical vulnerabilities of buildings, risk and cost of exterior/perimeter mitigations, and security access.

● Warehouse Management--The purpose of the Warehouse Management module is to assist the Agency with tracking and recording government property.

● Fitness Center Management System--The purpose of the Fitness Center Management module is to assist team members within the Safety, Health and Environmental Management Division with tracking visitors, fitness center members' information, payment, and equipment inventory and maintenance.

● Parking and Transit System--The purpose of the Parking and Transit module is to assist the members of the Facilities Management and Services Division with tracking of the use of parking spaces provided by EPA. This module also tracks EPA employees' transit subsidy and Smart Trip transactions.

● Combo, Locks, Incidents, Keys, and Safe System--The purpose of the Combo Locks Incident Keys Safe System (CLIKS) module is to assist the members of the Security Management Division with tracking documentation associated with security changes for locks and keys as well as safes and combinations. This system also maintains a log of incidents on the grounds of EPA Headquarters' sites.

● Driver Tracking--The purpose of the Driver Tracking module is to assist the motor pool of the Facilities Management and Services Division with tracking requests, ridership, vehicles and buses. The Driver Tracking module contains information about special requests for the services of an EPA driver or shuttle bus.

● Mail Center--The purpose of the Mail Center module is to track costs associated with the Agency's incoming and outgoing mail as well as route and distribute internal and external mail.

● Personnel Security System--The purpose of the Personnel Security module is to assist the members of the Security Management Division with tracking the documentation associated with security investigations for Federal and non-Federal personnel working for EPA.

General routine uses A, B, C, D, E, F, G, H, I, J, and K apply to this system.

Storage:

Records are stored in electronic media and paper files are stored in locked file cabinets.

Records are maintained in a database that requires authorized user login and password to retrieve personal data.

Security controls used to protect personal sensitive data in OASIS are commensurate with those required for a information system rated MODERATE for confidentiality, integrity, and availability, as prescribed in NIST Special Publication, 800-53, "Recommended Security Controls for Federal Information Systems," Annex 2.

Records are retained and disposed of in accordance with EPA's records control schedule approved by the National Archives and Records Administration.

Director, Office of Administrative Services, Environmental Protection Agency, MC3201A, 1200 Pennsylvania Avenue, NW., Washington, DC 20460.

Any individual who wants to know whether this system of records contains a record about him or her, who wants access to his or her record, or who wants to contest the contents of a record, should make a written request to the EPA FOIA Office, Attn: Privacy Act Officer, MC2822T, 1200 Pennsylvania Avenue, NW., Washington, DC 20460.

Requests for access must be made in accordance with the procedures described in EPA's Privacy Act regulations at 40 CFR part 16. Requesters will be required to provide adequate identification, such as a driver's license, employee identification card, or other identifying document. Additional identification procedures may be required in some instances.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Complete EPA Privacy Act procedures are described in EPA's Privacy Act regulations at 40 CFR part 16.

The system of records notice that applies to OASIS is PeoplePlus Payroll, Time and Labor Application (EPA-1). All data not collected from this system is entered manually from employees and contractors via paper or electronic format.

Under 5 U.S.C. 552a(k)(1), (k)(2), and (k)(5), the Personnel Security System is exempt from the following provisions of the Privacy Act of 1974 as amended, subject to the limitations set forth in this subsection ; 5 U.S.C. 552a(c)(3); (d)(2), (d) (3), and (d)(4); (e)(1), and (f)(2) through (5). Although the Personnel Security System has been exempted, EPA may, in its discretion, fully grant individual requests for access and correction if it determines that the exercise of these rights will not interfere with an interest that the exemption is intended to protect.

-42-

Inspector General Enterprise Management System (IGEMS) Audits, Assignment and Project Management Actuals Modules. EPA-42

Unclassified

Office of Inspector General, Environmental Protection Agency, 1200 Pennsylvania Avenue NW, Washington, DC 20460

USEPA, Office of Management (Mail code 2410T), 1200 Pennsylvania Ave. NW, Washington,

DC 20460, Attn: Assistant Inspector General for Management.

Tel Number: 202-566-0847, Fax: 202-566-0857

Inspector General Act of 1978, 5 U.S.C. app. 3.

Categories of Individuals Covered by the System: Office of Inspector General (OIG) employees; individuals who request audits; names of individual auditees.

Categories of Records in the System: Incoming audit requests, assignment sheets and reports, incoming special project requests, and memorandums or briefing materials, and OIG employee project management actuals which identify time spent on individual projects.

Record subject, OIG supervisors, and other EPA employees.

1. To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records, (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security, and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

2. To another Federal agency or Federal entity, when the Agency determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach

Audits in the Assignments and Project Management Actuals Modules of the Inspector General Enterprise Management System (IGEMS) are retrieved by assignment number, audit report number, the name of the assigned OIG auditor, or the name of the audit requestor.

Computer records are maintained in a secure, password protected computer system. All records are maintained in secure, access-controlled areas or buildings. The IGEMS Assignment and Project Management Actuals (PMA) Modules are restricted to the staff of EPA OIG. Roles and permissions are based on either position of the employee, project membership or based on approved requests. The modules are found in IGEMS. IGEMS is accessible to EPA OIG employees only. It is an internal database accessible by use of strong passwords, which are renewed on a regular basis, and automated locking of screens after a defined number of minutes are enforced.

Persons seeking access to their own personal information in this system of records will be required to provide adequate identification (e.g., driver’s license, military identification card, employee badge or identification card). Additional identity verification procedures may be required as warranted. Requests must meet the requirements of EPA regulations at 40 CFR part 16

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Complete EPA Privacy Act procedures are set out in EPA’s Privacy Act regulations at 40 CFR part 16.

None.

76 Fed. Reg. 42706 - Amend an existing system of records by changing the name of the system from the Inspector General Operations & Reporting (IGOR) System Audit, Assignment, and Timesheet Files (EPA-42) to the Inspector General Enterprise Management System (IGEMS) Audit, Assignment, and Timesheet Modules.

66 Fed. Reg. 49950 – Established the Inspector General’s Operation and Reporting (IGOR) System Audit, Assignment and Timesheet Files. The system is maintained by the EPA Office of Inspector General (OIG). Its purpose is to assist the OIG in planning audits, investigations, and other operations of the OIG; monitoring OIG performance of its activities; and reporting results.

-44 Mass Alert and Notification System

Each Headquarters Office, 1200 Pennsylvania Ave NW Washington DC 20460, WJC North Building, or Regional Office may maintain emergency contact records.

42 U.S.C. 5121 et seq.; Executive Order 12656 (Nov. 18, 1989); Federal Continuity Directive 1 (2012)

To contact EPA personnel, contractors, grantees, consultants, and other support staff, including volunteers, who have an active EPA identification badge or are in the process of obtaining an EPA identification badge, for the purposes of providing emergency alerts and notifications and conducting accountability activities in support of affected persons following an emergency, or, as a means to account for EPA employees, contractors, grantees, consultants, and any other support staff personnel following an emergency event. Records may also be used for mass alert and notification system test, drill, and exercise evolutions. This system will provide EPA with the ability to rapidly and effectively disseminate emergency alerts and notification information. In addition, it will provide the opportunity to identify emergency contacts in case of an incident that involves an employee.

EPA personnel, contractors, grantees, consultants, and any other support staff personnel, including volunteers.

The EPA will pre-populate MANS with the following government-furnished contact information: first name, last name, middle initial, office location, scope of the record subject's responsibilities, work email address, work telephone number and work mobile telephone number, work short message service (SMS) (texting) and work telephone typewriter, teletypewriter or text phone/Telecommunications Device for the Deaf (TTY/TDD). Records are from various communications mediums such as telephones, emails and SMS. Record subjects will also have the option to voluntarily and securely add their own personal contact information, and emergency contact(s), including home address, personal email address(es), home telephone number(s) and personal mobile telephone number(s), short message service (SMS) (texting), telephone typewriter, teletypewriter or text phone/Telecommunications Device for the Deaf (TTY/TDD) by establishing a personal account on the MANS web-portal.

Records contained in this system of records are obtained from:

Individuals about whom the records will pertain and existing EPA systems of records including the following:

EPA-19 EPA Identification Card Record

EPA-62 EPA Personnel Access and Security System (EPASS)

EPA-1-R HRLOB

EPA-32 EPA Telecommunication Detail Records

General routine uses A, E, F, G, H, K and L. apply to this system. Records may also be disclosed to Federal, State, local, foreign, tribal, or other public authorities or to federal contracting companies or individuals involved with an emergency (or related exercise) that may require EPA assistance.

Storage:

In an electronic database.

Information will be retrieved primarily by employee name. Information may also be retrieved by any collected data element.

Records are maintained in a secure, password protected computer system. All records are maintained in secure, access-controlled areas or buildings.

Records stored in this system are subject to EPA’s records schedule 1012, Information Technology Management. Records are kept as long as the record subject is affiliated with EPA.

Director, Office of Emergency Management, Environmental Protection Agency, William Jefferson Clinton North Building, 1200 Pennsylvania Avenue NW, Mail Code 5104A, Washington, DC 20460. EPA coordinators in Regions and other offices may also be responsible for records.

Request for access must be made in accordance with the procedures described in EPA's Privacy Act regulations at 40 CFR part 16. Requesters will be required to provide adequate identification, such as a driver's license, employee identification card, or other identifying document. Additional identification procedures may be required in some instances.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. EPA Privacy Act regulations are set out in 40 CFR Part 16.

Any individual who wants to know whether this system of records contains a record about him or her, who wants access to his or her record, or who wants to contest the contents of a record, should make a written request to the Agency Privacy Officer at Earle.judy@epa.gov or by mail at EPA FOIA Office, Attn: Privacy Act Officer, MC 2822T, 1200 Pennsylvania Avenue NW., Washington, DC 20460.

None.

-49 Child Care Tuition Assistance Program Records.

None

U.S. Environmental Protection Agency/Office of Human Resources and Organizational Services/Employee Services Staff, MC: 3611, Washington, DC 20460.

(1) Current employees of the Environmental Protection Agency who voluntarily apply for a child care subsidy, their spouses, and children who are enrolled in a licensed Federal and non- Federal center, and licensed home- based care

(2) Child-care providers of these employees.

The information collected will include the employee's name, spouse's name, employee's title, grade, home and work telephone numbers, home and work addresses, the organization in which the employee works, the employee's social security number, the spouse's social security number, the employee's tax returns, the spouse's tax returns, the name and social security number of the child on whose behalf the parent is applying for a subsidy, the child's date of birth, the date of entry into the Child Care Subsidy Program, and the amount of subsidy received; the name, address, telephone number, employer identification number (EIN), license and accreditation status of the child care center in which the employee's child(ren) is (are) enrolled, and the dates of attendance.

Pub. L. 107-67, sec. 630 and Executive Order 9397.

The primary use of the records maintained in this system is to establish and verify Environmental Protection Agency employee's eligibility for child care subsidies in order to provide monetary assistance to them. Other uses of the records in the system include verifying the eligibility of child care and verifying compliance with regulations.

General routine uses applicable to more than one system includes: A; E; F; H; J, as stated in the guidelines for preparing notice for a system of records under the Privacy Act.

Storage:

Records are stored both in file folders, and in electronic form, in computer systems.

Records are retrieved by the names, regional location and social security numbers of employees applying for child care subsidies.

Access to records in the system is limited to authorized personnel whose official duties require such access. Paper records are maintained in locked metal file cabinets and/or in secured rooms. Electronic records are password-protected and maintained with safeguards meeting the security requirements of 40 CFR 16.10-- Disclosure of record to person(s) other than the individual to whom it pertains.

Records are retained and disposed of in accordance with National Archives and Records Administration guidelines.

National Program Manager/Office of Human Resources and Organizational Services, U.S. Environmental Protection Agency, MC:3611, Washington, DC 20460.

Inquiries regarding the existence of records contained in the system should be addressed to the System Manager. The request must be in writing, signed by the requester, include the requester's full name and social security number, and must meet the content requirements of 40 CFR 16.3--Procedures for requests pertaining to individual records in a record system.

A request for access to records contained in the system should be addressed to the System Manager. The request must be in writing, signed by the requester, include the requester's full name and social security number, and meet the content requirements of 40 CFR 16.3--Procedures for requests pertaining to individual records in a record system.

A petition for amendment for records contained in the system should be addressed to the System Manager. The request must be in writing, signed by the requester, include the requester's full name and Social Security Number, and meet the content requirements of 40 CFR 16.7--Request for correction or amendment of record.

Applications for child care subsidies and supporting records, which are voluntarily submitted by EPA employees applying for child care subsidies.

None.

-50 OIG AutoAudit--EPA/OIG.

None

National Technology Service Division, Office of Technology Operations and Planning, U.S. Environmental Protection Agency; 79 Alexander Drive; Building 4201, MD-34; Research Triangle Park, North Carolina 27711.

Individuals covered by the system include the assigned OIG auditor or evaluator, the audit or evaluation requestor, or the interviewee. (If Federal employees, this information will include their name, title, EPA office, EPA organization mail code, General Schedule occupation series and grade, geographic location, and type of employee (e.g., EPA employee or EPA OIG employee).)

Records consist of materials compiled and/or generated in connection with audits, evaluations, and other non-audit services performed by OIG staff. These materials include information regarding the planning, conduct, and resolution of audits and evaluations of EPA programs and participants in those programs, information requests, responses to such requests, reports of findings, etc.

Inspector General Act of 1978, as amended, 5 U.S.C. app. 3.

The records contained in the systems are used by the OIG in furtherance of the responsibilities of the Inspector General under the Inspector General Act of 1978, as amended, to conduct and supervise audits and other reviews relating to programs and operations of the EPA; to promote economy, efficiency, and effectiveness in the administration of such programs and operations; and to prevent and detect fraud and abuse in such programs and operations. The records, especially work papers, are used to generate audit and other reports. The system will automate the work papers including organization, retrieval, and indexing Routine Uses of Records Maintained in the system, including categories of users and the purposes of such uses: EPA's general routine uses A through K apply to this system. See 66 FR 49947-49948 for a list of EPA's general routine uses. In addition, EPA OIG's 13 specific routine uses for its Inspector General's Operating and Reporting System Investigative Files apply to this system. See 66 FR 49948-49949.

Storage:

Records are stored electronically in office automation equipment and manually in file jackets.

Records primarily will be retrieved by assignment number. Records may also be retrieved by audit report number; name of the assigned OIG auditor or evaluator; or the name of the audit or evaluation requestor, interviewee, or subject matter of the audit.

Computer records are maintained in a secure, password protected computer system. All records are maintained in secure areas or buildings with physical access and environmental controls. Direct access to the electronic database is limited to authorized employees of the OIG.

Records are retained and disposed of in accordance with EPA Records Control Schedule 700, Inspector General Records, approved by the National Archives and Records Administration.

Assistant Inspector General for Audits, Office of Inspector General (2421), Environmental Protection Agency, 1200 Pennsylvania Avenue, NW., Washington, DC 20460.

The System Manager will accept inquiries from individuals seeking notification of whether the system contains records pertaining to them.

Requests for access should be made in writing to the System Manager in accordance with EPA's regulations at 40 CFR part 16. Requesters will be required to provide adequate identification, such as a driver's license, employee identification card, or other identifying document. Additional identification procedures may be required in some instances.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Complete EPA Privacy Act procedures are set out in 40 CFR part 16.

The OIG collects information from a wide variety of sources, including from EPA, other Federal agencies, the General Accounting Office (GAO), law enforcement agencies, program participants, subject individuals, complainants, witnesses and other non-governmental sources.

None.

-52 Central Data Exchange (CDX), EPA-52

Unclassified.

The CDX system is located at U.S. EPA National Computer Center, 109 T.W. Alexander Drive, Research Triangle Park, NC 27711; additional locations include cloud environments located in Microsoft Azure East US 1, East US 2 and Central US along with other partner sites in Virginia.

Joe Carioti, Branch Chief, U.S. EPA, Information Exchange Services Branch, 1200 Pennsylvania Ave. NW (Mail Code 2824T), Washington, DC 20460. Tel: 202-564-6413, Email: carioti.joe@epa.gov.

In accordance with the Government Paperwork Elimination Act (44 U.S.C. 3504), EPA's electronic compliance filing and environmental data exchange system will enable the "acquisition and use of information technology, including alternative information technologies that provide for electronic submission, maintenance, or disclosure of information as a substitute for paper and for the use and acceptance of electronic signatures." Section 3504(a)(1)(B)(vi) of Title 44, United States Code. Authority is additionally regulated by the CROss-Media Electronic Reporting Rule (40 CFR Part 3), as a regulatory alternative to paper reporting.

CDX is EPA's portal for electronically exchanging environmental data with external customers. Users with CDX accounts may choose to engage in secure, electronic filing of environmental documents as permitted under the Government Paperwork Elimination Act (GPEA).The information is also used to provide authenticated, protected access to the CDX system, thereby protecting CDX and CDX users from potential harm caused by individuals with malicious intentions gaining unauthorized access to the system.

This system contains records on all individuals that have either attempted to register or have registered to obtain an account to use CDX for electronically exchanging data with EPA. Registered users of CDX may include representatives of industry, government or laboratories exchanging information with EPA through CDX.

This system contains records for individuals’ name, self- assigned username and security question, work title, work address and related work contact information (e.g., phone numbers, e-mail address), supervisors’ name and related contact information, information related to the EPA reporting program the individual is planning to electronically file or report under (e.g., EPA program ID # and EPA program role), and the method of reporting (e.g., web browser, file exchange). In cases where individuals are asked to electronically "sign" certain EPA forms, CDX may request additional information items from an individual in order to safeguard their account and create secret questions/answers that only the individual should know.

RECORD SOURCE CATEGORIES:

Information is obtained from individuals who have had or seek to have their identity authenticated.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES: The routine uses below are both related to and compatible with the original purpose for which the information was collected. The following general routine uses apply to this system (73 FR 2245):

1. The Agency, or any component thereof;

2. Any employee of the Agency in his or her official capacity;

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

4. The United States, if the Agency determines that litigation is likely to affect the Agency or any of its components,

Is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or the Agency is deemed by the Agency to be relevant and necessary to the litigation provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.

G. Disclosure to the National Archives: Information may be disclosed to the National Archives and Records Administration in records management inspections.

The two routine uses below (L and M) are required by OMB Memorandum M–17–12.

L. Disclosure to Persons or Entities in Response to an Actual or Suspected Breach of Personally Identifiable Information: To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records, (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

These records are maintained electronically on computer storage devices such as computer disks. The computer storage devices are located at U.S. EPA National Computer Center, 109 T.W. Alexander Drive, Research Triangle Park, NC 27711, on cloud resources and partner sites. Backups will be maintained at a disaster recovery site.

Records are retrievable by the CDX username, program ID number, all or part of the individual's name, phone number, and email address.

The EPA will retain and dispose of these records in accordance with National Archives and Records Administration General Records Schedule 20, Item 1.c. This 0097 schedule provides disposal authorization for electronic files and hard copy printouts created to monitor system usage, including but not limited to log-in files, audit trail files, system usage files, and cost-back files used to access charges for system use. Records will be deleted or destroyed according to EPA Records Schedule 0097.

Security controls used to protect personal sensitive data in Central Data Exchange (CDX) are commensurate with those required for an information system rated moderate for confidentiality, integrity, and availability, as prescribed in NIST Special Publication, 800-53, "Security and Privacy Controls for Information Systems and Organizations," Revision 4.

1. Administrative Safeguards: The system will be operated and maintained by EPA or organizations under contract with the EPA (henceforth referred to as "EPA"). EPA has minimized the risk of unauthorized access to the system by establishing a secure environment for exchanging electronic information.

3. Physical Safeguards: Physical access to the data system housed within the facility is controlled by a computerized badge reading system, and the entire complex is patrolled by security during non-business hours. The computer system offers a high degree of resistance to tampering and circumvention. Multiple levels of security are maintained with the computer system control program.

4. Logical Access Safeguards (Technical): The individual registering for CDX will generate a self-assigned passwords that will be stored in CDX, but it will only be accessible to the registering individual. To restore passwords additional secrets will be provided by individual and validated along with email or other out-of-band factor such as registered mobile phone using a 1-time passphrase.

Individuals seeking access to information in this system of records about themselves are required to provide adequate identification (e.g., driver’s license, military identification card, employee badge or identification card). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

None.

Notice of a New System of Records [Federal Register Vol 67, No. 52 (Monday, March 18, 2002)] Amendment to System of Records Notice [Federal Register Vol 68, No. 235 (Monday, December 8, 2003)].

-53 Integrated Grants Management System (IGMS)/Next Generation Grants System (NGGS), EPA-53

Unclassified.

National Computer Center (NCC), 109 TW Alexander Drive, Research Triangle Park, Durham, NC 27711.

Michael Osinski, osinski.michael@epa.gov at 202-564-3792, Director, Office of Grants and Debarment, Environmental Protection Agency, Ronald Reagan Building, Mail Code 3901R, 1200 Pennsylvania Avenue, NW, Washington, DC 20460.

Bruce Binder, binder.bruce@epa.gov at 202-564-4935, Acting Deputy Director, Office of Grants and Debarment, Environmental Protection Agency, Ronald Reagan Building, Mail Code 3901R, 1200 Pennsylvania Avenue, NW, Washington, DC 20460.

US Environmental Protection Agency (EPA) Enterprise Information Management Policy (EIMP), CIO 2135.1, August 2019; Federal Grant and Cooperative Agreement Act, 31 U.S.C. 6301 et seq; Clean Air Act, 42 U.S.C. 7401 et seq; Federal Water Pollution Control Act, 33 U.S.C. 1254 et seq.; Public Health Service Act, 42 U.S.C. 241 et seq.; Solid Waste Disposal Act, 42 U.S.C. 6901 et seq.; Federal Insecticide, Fungicide, and Rodenticide Act, 7 U.S.C. 136 et seq.; Safe Drinking Water Act, 42 U.S.C. 300j-1; Toxic Substances Control Act, 15 U.S.C. 2609; Comprehensive Environmental Response, Compensation, and Liability Act, 42 U.S.C. 9660.

EPA uses IGMS and NGGS to manage grants in response to solicitations issued by EPA program offices. EPA uses IGMS alone to process interagency agreements

EPA employees, non-EPA Federal government personnel, State or local government personnel

EPA uses IGMS and NGGS to collect and maintain information on applicants for EPA grants. This includes recipient organization names, names of grant applicants, phone numbers, emails, and addresses. EPA also uses IGMS to collect and maintain information on applicants for EPA interagency agreements. This includes recipient organization names, names of interagency agreement applicants, phone numbers, email, and addresses.

The sources of information come from recipient organizations, Federal, State or local agencies. This information is collected from grant and interagency agreement applicants for the EPA grants and interagency agreements programs within the agency.

The routine uses below are both related to and compatible with the original purpose for which the information was collected. The following general routine uses apply to this system (73 FR 2245):

1. The Agency, or any component thereof;

2. Any employee of the Agency in his or her official capacity;

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

4. The United States, if the Agency determines that litigation is likely to affect the Agency or any of its components,

G. Disclosure to the National Archives: Information may be disclosed to the National Archives and Records Administration in records management inspections.

The two routine uses below (L and M) are required by OMB Memorandum M–17–12.

L. Disclosure to Persons or Entities in Response to an Actual or Suspected Breach of Personally Identifiable Information: To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records, (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

These records are maintained electronically on computer storage devices such as computer tapes and disks. The computer storage devices are located at EPA National Computer Center in Research Triangle Park, 109 T.W. Alexander Drive, Durham, NC 27709. Backup will be maintained at a disaster recovery site. Computer records are maintained in a secure password protected environment. Access to computer records is limited to those who have a need to know. Permission-level assignments will allow users access only to those functions for which they are authorized. Paper records are located at Environmental Protection Agency facilities to include Regions 1-10 and Headquarters located at the Ronald Reagan Building, Mail Code 3901R, 1200 Pennsylvania Avenue, NW, Washington DC 20460. All records are maintained in secure, access-controlled areas or buildings

Electronic files may be retrieved by applicant/recipient organization names and EPA grants and interagency agreements contact names.

Records are retained and disposed of in accordance with National Archives and Records Administration record retention schedules appropriate to the retention as well as EPA Record Schedule 0009.

Security controls used to protect personal sensitive data in IGMS/NGGS are commensurate with those required for an information system rated MODERATE for confidentiality, integrity, and availability, as prescribed in National Institute of Standards and Technology (NIST) Special Publication, 800-53, "Security and Privacy Controls for Federal Information Systems and Organizations," Revision 5.

1. Administrative Safeguards: EPA personnel and contractors must complete annual Agency Information Security and Privacy Awareness training. EPA instructs its personnel and contractors to lock and secure their computers when they leave their desks.

2. Technical Safeguards: EPA restricts IGMS/NGGS electronic records to authorized users with appropriate security privileges, including the use of 2-factor PIV Card authentication.

3. Physical Safeguards: All records are maintained in secure, access-controlled areas or buildings. Identification cards are verified to ensure only authorized personnel have access. Paper records are maintained in locked file cabinets

Individuals seeking access to information in this system of records about themselves are required to provide adequate identification (e.g., driver’s license, military identification card, employee badge or identification card). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

Any individual who wants to know whether this system of records contains a record about him or her, should make a written request to the EPA, Attn: Agency Privacy Officer, MC 2831T, 1200 Pennsylvania Ave., NW, Washington, DC 20460, privacy@epa.gov.

None.

68 FR 68387 – Posted on December 8, 2003.

-54 Federal Lead-Based Paint Program System of Records (FLPPSOR) and EPA-54

Unclassified.

Records maintained in FLPPSOR are stored in electronic and hard-copy formats at Research Triangle Park (RTP), NC, EPA regional offices and the Federal program contractor’s office.

Tanya Mottley, Director, National Program Chemicals Division, USEPA, Office of Pollution Prevention and Toxics, (7404T), 1200 Pennsylvania Ave., NW., Washington, DC 20460, (202) 566-1652; and Michelle Price, Chief, Lead, Heavy Metals and Inorganics Branch, National Program Chemicals Division, USEPA, Office of Pollution Prevention and Toxics, (7404T), 1200 Pennsylvania Ave., NW., Washington, DC 20460, (202) 566-0744.

40 CFR Part 745 Lead—Requirements for Lead-Based Paint Activities in Target Housing and Child-Occupied Facilities and 40 CFR Part 745 Lead—Renovation, Repair, and Painting Program.

The purpose of FLPPSOR is to maintain information submitted electronically via EPA’s CDX system to the Agency and through various documents under the Federal Lead-Based Paint and RRP Programs. These records include application forms, notification forms, and various support documents. FLPPSOR supports activities integral to the program (i.e., issuing certificates, analyzing information, generating letters and reports, and providing information to allow for executing various enforcement actions). EPA’s CDX Customer Registration Subsystem’s System of Records Notice is EPA-52 [(Federal Register: December 8, 2003 (Volume 68, Number 234)]. The CDX system has an interconnection to the FLPP Database system. On January 15, 2015, the CDX Memorandum of Understanding (MOU) and CDX Interconnection Security Agreement (ISA) documents were signed. The MOU defines the responsibilities of the participating organizations of the interconnection and the ISA specifies the technical and security requirements of the interconnection.

Individuals covered by the system include those who have been trained or have applied for certification to perform lead-based paint and RRP activities in the following disciplines: inspectors, supervisors, risk assessors, project designers, abatement workers, renovators, and dust sampling technicians. In addition, individuals covered by the system include training program managers and principal course instructors who have been accredited to teach lead-based paint and RRP activities in the following disciplines: inspectors, supervisors, risk assessors, project designers, abatement workers, renovators, and dust sampling technicians.

FLPPSOR contains individuals' names, addresses, telephone numbers, dates of birth, photographs of lead-based paint and RRP professionals, signatures, course test scores, submitted fees, and certificate numbers as well as the names of training program managers and principal course instructors as well as their education or experience or training qualifications.

Information is obtained from individuals who have submitted a certification application and have been trained by an accredited training provider. FLPPSOR maintains records on individuals derived from a variety of sources relating to the undertaking of individuals applying for certification and being trained to perform lead-based paint and RRP activities. Also, FLPPSOR maintains records of the names of training program managers and principal course instructors as well as their education or experience or training qualifications.

These record sources include the following forms submitted to EPA: EPA Form 8500-28, "Application and Instructions for Individuals Applying for Certification to Conduct Lead-Based Paint Activities" and EPA Form 8500-25, "Application and Instructions for Training Providers Applying for Accreditation of Lead-Based Paint Activity and Renovator Training Programs." The information derived from these forms concerns individuals who have applied for certification or accreditation in lead-based paint or renovation, repair and painting activities. Two record sources include information derived from required notifications submitted to EPA pursuant to 40 CFR Part 745. The first record source requires firms certified under 40 CFR 745.227 to provide notification to the Agency prior to conducting lead-based paint abatement activities. The second record source requires training programs accredited under 40 CFR 745.225 to provide notification to the Agency prior to (pre-training notice) and then following conducting lead-based paint and RRP activities training courses (post-training notice). The data derived from the post-training notifications includes information on inspectors, supervisors, risk assessors, project designers, abatement workers, renovators and dust sampling technicians who have been trained. Finally, other record sources of information stored in the system may include supplementary documents obtained by headquarters and regional offices in the application approval process.

General routine uses are as follows: A, B, C, E, F, G, H, I, K(73 FR 2245). (https://www.federalregister.gov/documents/2008/01/14/E8-445/amendment-to-general-routine-uses). In addition, the Agency may disclose information from FLPPSOR to Federal, State, or local agencies, present and former employers and business and personal associates, and hearing officials, as a given situation might require for purposes including the following:

(1) To verify the identity of the individual;

(2) To enforce the conditions or terms of the Agency’s Lead-Based Paint Program and RRP Program regulations;

(3) To investigate possible fraud by, for example, applicants and users, and verify compliance with the Agency’s Lead-Based Paint Program and RRP Program regulations;

(4) To prepare for litigation or to litigate fee collections and reporting enforcement matters;

(5) To initiate a limitation, suspension, and termination (LS&amp;T) or debarment action;

(6) To investigate complaints, update files, and correct errors;

(7) To prepare for alternative dispute resolutions (ADR) in any of the cases described in paragraphs (2), (3), and (4);

(8) To engage in audits or other internal matters within EPA;

(9) To contact certified individuals and applicants in the event of a system modification that changes their application or certification information; or

(10) To respond to a change to FLPPSOR, as in the case of a modification, revocation, or termination of a user’s access privileges.

(11) Disclosure to Persons or Entities in Response to an Actual or Suspected Compromise or Breach of Personally Identifiable Information

To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records,· (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

(12) Disclosure to assist another agency in its efforts to respond to a breach.

To another Federal agency or Federal entity, when the Agency determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

Storage:

Records maintained under the FLPPSOR are stored in different formats and in several locations. Each of these record collections, which together comprise the FLPPSOR, must adhere to the requirements of the Privacy Act and are subject to the rules and restrictions for disclosure of information specified under the Freedom of Information Act.

(1) The main system is located at EPA's National Computer Center (NCC) in Research Triangle Park (RTP), North Carolina. This database contains information entered from some of the primary sources listed above under "Categories of Records in the System" (submitted form and notifications).

(2) Hard-copy files are located in EPA regional offices and the facility operated by EPA's

Federal program contractor's office. These records include the original or photocopied paper submissions (including supplementary information) provided to the Agency.

(3) EPA regional offices have developed electronic systems for their local uses. These electronic records are maintained separate from the main central server at RTP and are used solely by the regional offices.

Retrievability: Records are retrieved by an individual's name, application ID number, applicant ID number, or program activity.

Retention and Disposal: EPA will retain and dispose of these records in accordance with the EPA Records Schedule 089 and the National Archives and Records Administration General Records Schedule 23/8. Application records maintained in the system are deleted/destroyed two years after the date of the last entry.

Safeguards: Physical access to the system housed in the facility at RTP is controlled by a computerized badge-reading system, with security patrols during non-business hours. All interactions between the system and the authorized individual users are recorded through use of a card reader and tracking database. Paper records stored at EPA's Federal program contractor and storage facility are protected by computerized badge-reading security systems, with files maintained in locked file drawers. Records stored at EPA offices are secured through building security protocols and computerized badge-reading systems. FLPP’s Security Manager gives access and assigns the different access roles to FLPP users. The FLPP database uses an authentication system to valid FLPP users to have access to use the database.

Requesters seeking access to this system of records must follow the "Notification Procedure" listed below and will be required to provide adequate identification (e.g., driver's license, military identification card, employee badge or identification card). Additional identity verification procedures may be required as warranted. Requests must meet the requirements of EPA regulations at 40 CFR Part 16.

If you wish to contest a record in the system of records, contact the Agency's National Privacy Program as described under "Notification Procedure" listed below. Your written inquiry should identify the record(s) to be corrected, the corrective action sought, including any requested amendment to the records, and any supporting documentation you consider relevant to EPA’s consideration of your request.

Requests to determine whether this system of records contains a record pertaining to you must be sent to the Agency's National Privacy Program. The address is: U.S. Environmental Protection Agency; 1200 Pennsylvania Ave., NW., Room 2335 West; Washington, DC 20460; (202) 566-1668; E-mail: (privacy@epa.gov); Attn: Agency Privacy Officer.

None.

70 FR 35251 – Established a new System of Records (SOR) under the Federal Lead-Based Paint Program (June 17, 2005).

74 FR 42298 – Amended an existing system of records (SOR) by changing the title of "Lead-Based Paint System of Records" (LPSOR) to the "Federal Lead-Based Paint Program System of Records" (FLPPSOR).

-55

Federal Human Resource Navigator, EPA-55

Unclassified.

EPA Headquarters: 1200 Pennsylvania Avenue NW, Washington, DC 20460; Economic Systems Inc., 3141 Fairview Park Dr., Suite 700, Falls Church, Virginia 22042–4507.

Kendal Holt, System Administrator, 1200 Pennsylvania Avenue NW, Washington, DC 20460, holt.kendal@ epa.gov, 513–569–7796; Alice Martinson, System Administrator, 109 TW Alexander Dr., Research Triangle Park N.C. 27711, martinson.alice@ epa.gov, 919–541–5420.

5 U.S.C. Chapter 53, Pay Rates and Systems; 5 U.S.C. 5101 et seq.; 5 U.S.C. 3323; 5 U.S.C. 8301; 5 U.S.C. 5525 et seq.; 5 U.S.C. 6301 et seq.; Executive Order 9397 (Nov.22, 1943); The American Rescue Plan Act of 2021 (Pub. L. 117-2, H.R. 1319).

The purpose of the FedHR Navigator system is to integrate employees benefits and retirement information into one central database. The application allows EPA employees to access personnel and benefits-related information that will be used by EPA employees to calculate their retirement benefits. The information in the system includes voluntary, early, and disability retirement benefits; part-time and intermittent service; deposits and redeposits owed; Social Security/Federal Employee Retirement System (FERS) supplement benefits; Civil Service Retirement System benefits; Thrift Savings Plan benefits; survivor benefits; and severance pay.

Current and former employees of the Environmental Protection Agency (EPA). Because FedHR Navigator contains records related to benefits, individuals including an employee’s spouse, former spouse, dependents, parents, or other family members are also covered by the system.

Full name (last, first, middle), Social Security Number, Date of Birth, Home Address, Work Address, Service Computation Date, Number of hours worked, Citizenship, Telephone Numbers, Email Addresses, Salary History, Position Titles, Series, Grade, Life and Health Insurance information, , Military Service, Financial Institution Account and Routing Numbers for direct deposit, Marriage Certificate, Date of Marriage, Death Certificate/Benefits, Date of Death, Birth Certificate, Beneficiaries, Worker's Comp Claim Number, Signature of Witness, TSP Account Number, Estate/Trust/Tax ID, Financial Institution (Name, Address, Phone, Email), Medical Diagnosis, Healthcare Provider, Medical Prognosis, Divorce Decree, Custody Agreement, Date of Marriage, Date of Death, Social Security Statements and Medicare CMS-L564.

Information in this system of records is obtained from:

1. Department of Interior: Federal Personnel Processing System (FPPS)

2. Oracle Business Intelligence Enterprise Edition (OBIEE)

3. The employee and family members about whom the record is maintained.

The routine uses below are both related to and compatible with the original purpose for which the information was collected.

1. To the Department of Treasury to issue checks, make payments, make electronic funds transfers, and issue U.S. Savings Bonds.

2. To the Department of Agriculture National Finance Center to credit Thrift Savings Plan deductions and loan payments to employee accounts.

3. To the Department of Labor in connection with a claim filed by an employee for compensation due to a job connected injury or illness.

4. To the Internal Revenue Service; Social Security Administration; and State and local tax authorities in connection with the withholding of employment taxes.

5. To State Unemployment Offices in connection with a claim filed by former employees for unemployment benefits.

6. To the Office of Personnel Management and to Health Benefit carriers in connection with enrollment and payroll deductions.

7. To the Office of Personnel Management in connection with employee retirement, thrift savings plan, flexible spending account, military service and life insurance deductions.

8. To the Combined Federal Campaign in connection with payroll deductions for charitable contributions.

9. To the Office of Management and Budget and Department of the Treasury to provide required reports on financial management responsibilities.

10. To the Internal Revenue Service in connection with withholdings for tax levies.

11. To the Office of Personnel Management in connection with employee leave enrollment and leave deductions.

The following general routine uses apply to this system (73 FR 2245):

G. Disclosure to the National Archives: Information may be disclosed to the National Archives and Records Administration in records management inspections.

J. Disclosure to the Office of Personnel Management: Information from this system of records may be disclosed to the Office of Personnel Management pursuant to that agency's responsibility for evaluation and oversight of Federal personnel management.

K. Disclosure in Connection with Litigation: Information from this system of records may be disclosed in connection with litigation or settlement discussions regarding claims by or against the Agency, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions and except where court orders are otherwise required under section (b)(11) of the Privacy Act of 1974, 5 U.S.C. 552a(b)(11).

The two routine uses below (L and M) are required by OMB Memorandum M–17–12.

Records are stored in electronic media at Economic Systems Inc., 3141 Fairview Park Dr., Suite 700, Falls Church, Virginia 22042-4507.

Personnel information will be retrieved by employee name, email address, employee ID number, or date of birth.

The retention of data in the system will be in accordance with any applicable EPA Records Schedule, as approved by the National Archives and Records Administration.

1, Administrative Safeguards: HR Specialists will be the only authorized personnel with access to PII data and must ensure they receive IT Security Training to use the system.

2. Technical Safeguards: Electronic records are maintained in a secure password-protected computer system and are accessible only by authorized personnel. Individual users will gain access to the system using a combination of two-factor authentication using PIV/CAC card or user ID and password.

3. Physical Safeguards: Network servers are in a locked room with physical access limited to only authorized personnel such as IT personnel.

Individuals requesting access will be required to provide adequate identification, such as a driver's license, employee identification badge, or other identifying document. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

Individuals wishing to contest or amend information maintained in this system should specify the information being contested, the reason for contesting it, and the proposed amendment to such information. Complete EPA Privacy Act procedures are described in EPA’s Privacy Act regulations at 40 CFR part 16.

Individuals who wish to be informed whether a Privacy Act system of records maintained by EPA contains any record pertaining to them, should make a written request to the EPA, Attn: Agency Privacy Officer, MC 2831T, 1200 Pennsylvania Ave. NW, Washington, DC 20460, privacy@ epa.gov

None

Notice of a New System of Records [Federal Register Vol 71, No. 40 (March 1, 2006)].

-56 EZHIRE.

Human Resources Office, Personnel Services Branch, United States Environmental Protection Agency (EPA) 1200 Pennsylvania Avenue, Washington, DC 20640.

Individuals filing applications for employment with the U.S. Environmental Protection Agency in response to advertised position vacancy announcements.

Position vacancy announcement information such as position title, series and grade level(s), office and duty location, opening and closing date of the announcement, and dates of referral and return of lists of qualified candidates; applicant personal data such as name, address, social security number, date of birth, sex, veterans' preference and federal competitive status; and applicant qualification and processing information such as qualifications, grade level eligibility, reason for ineligibility, referral status, and dates of notification.

5 U.S.C. 1104, 5 U.S.C. 1302, 5 U.S.C. 3301, 5 U.S.C. 3304, 5 U.S.C., 3320, 5 U.S.C. 3327, 5 U.S.C. 3361, and 5 U.S.C. 3393; Executive Order 9397 (Nov. 22, 1943).

The records are collected and maintained to monitor, track and rank qualified individuals filing employment applications with the U.S. EPA and to assess recruiting goals and objectives. EZHire will improve time-to-hire cycle, it will comply with the security requirements of Federal Information Security Management Act (FISMA), collect Equal Employment Opportunity (EEO) data and facilitate ad hoc reporting.

A. To the U.S. Office of Personnel Management, the Merit Systems Protection Board, the Office of Government Ethics, the Office of Special Counsel, the Federal Labor Relations Authority or its General Counsel, the Equal Employment Opportunity Commission, to the extent disclosure is determined to be relevant and necessary to carry out the government-wide personnel management, investigatory, adjudicatory, and appellate functions within their respective jurisdictions;

B. To a congressional office in response to a written inquiry made by a congressional office at the request of the individual to whom the record pertains;

C. To the appropriate Federal, State or local agency or responsible authority, such information that is necessary and pertinent for investigating or prosecuting a violation of, or for enforcing or implementing a statute, rule, regulation, or order, when the information indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto;

D. To a court, magistrate, or administrative tribunal in the course of presenting evidence, including disclosures to counsel or witnesses in the course of civil discovery, litigation, or settlement negotiations or in connection with criminal proceedings, when the U.S. EPA is a party to the proceeding or has a significant interest in the proceeding and the information is determined to be relevant and necessary; and

E. To a consultant, person or entity who contracts or subcontracts with the U.S. EPA, to the extent necessary for the performance of the contract or subcontract. The recipient of the records shall be required to comply with the requirements of the Privacy Act of 1974, as amended (5 U.S.C. 552a).

Storage:

Records are stored in electronic media and paper format.

Indexed and retrieved by name and social security number of individual applicant.

Electronic files are password protected and accessible only by authorized personnel (Human Resources Specialist who are assigned to this task). Network servers are located in a locked room with physical access limited to only authorized personnel such as IT personnel.

Personal data that is collected from the individual is maintained for two years after which all data is removed in accordance with National Archives and Records Administration procedures

Acting Director, Office of Human Resources, U.S. Environmental Protection Agency, 1200 Pennsylvania Avenue, NW., Washington, DC 20460.

An Individual wishing to determine if they are named in this system of records or gain access to records maintained in this system must be a registered user. (If you have previously applied for employment enter your online applicant User ID (or e- mail address) plus your Password to view or edit the application, personal data or your resume.)

An individual wishing to determine if they are named in this system of records or gain access to records maintained in this system must be a Registered User.

An individual wishing to contest or amend information maintained in this system should be a Registered User.

None.

Information originates from position vacancy announcements, and applications for employment submitted by individuals.

None.

-58

Science Advisory Board Application (SABAPP) EPA-58

Unclassified.

National Computer Center (NCC), 109 TW Alexander Drive, Research Triangle Park, Durham, NC 27711.

Aaron Yeow, Physical Scientist, SAB Staff Office, U.S. Environmental Protection Agency, Mail Code 1400R, 1200 Pennsylvania Avenue, NW, Washington, D.C. 20460.

The authority for the establishment or appointment of these advisory committees is as follows: For the SAB, the Environmental Research, Development, and Demonstration Authorization Act (42 U.S.C. 4365); CASAC - section 109(d)(2) of the Clean Air Act (42 U.S.C. 7409(d)(2)); the Council, section 312(f) of the Clean Air Act (42 U.S.C. 7612(f)); the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et. seq.); FACA - 41 C.F.R. Part 102-3; 5 U.S.C. 1104; 5 U.S.C. 1302

This system of records assists EPA with providing management and technical support to two active (SAB and CASAC) scientific and technical advisory committees (SAB and CASAC) that report to the EPA Administrator and to maintain historical records of a retired committee (Council). The SAB Staff Office requests nominations of experts from the public wishing to nominate themselves or others for committees and panels providing advice to the Administrator. The Staff Office will identify experts to become Special Government Employees serving on advisory committees and panels. The SAB Staff Office conducts these activities to provide the EPA Administrator with scientific advice from balanced committees of qualified experts on high priority science issues. The SABAPP will track the status of their personnel paperwork; track the status of their ethics training and financial disclosure requirements of the Ethics in Government Act; and facilitate coordination of experts' participation in approximately fifty advisory projects per year and approximately eighty meetings per year. The SABAPP assists the SAB Staff Office to achieve these goals in an efficient manner that protects the privacy of scientific experts. The SABAPP serves as the repository and tracking system for the matters listed.

Scientific and technical experts currently serving on committees and panels administered by the SAB Staff Office; scientific and technical experts who have served on such committees and panels since 2002; and scientific and technical experts nominated to serve on planned SAB Staff Office-supported committees and panels.

Name; professional contact information, e.g., professional title, institutional affiliation, and work contact information; dates of appointment to advisory committees and panels; expertise information, e.g., curricula vitae and professional biographical sketches; and administrative history information, e.g., history of personnel actions, history of submitting confidential financial disclosure forms, and history of completing annual ethics training.

The public provides names and contact information for scientific and/or technical experts to be considered for membership on the SAB and CASAC committees and panel. The individual experts themselves provide further contact information as well as their professional biosketches and curricula vitae.

The following routine uses are both related to and compatible with the original purpose for which the information was collected. The information may be disclosed to and for the following EPA General Routine Uses published at 73 Fed Reg 2245: General routine uses A, B, C, E, F, G, H, I, J, and K apply to this system (73 FR 2245). In addition, the two routine uses below (L and M) are required under OMB M-17-12.

A. Disclosure for Law Enforcement Purposes: Information may be disclosed to the appropriate Federal, State, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity.

B. Disclosure Incident to Requesting Information: Information may be disclosed to any source from which additional information is requested (to the extent necessary to identify the individual, inform the source of the purpose of the request, and to identify the type of information requested,) when necessary to obtain information relevant to an agency decision concerning retention of an employee or other personnel action (other than hiring,) retention of a security clearance, the letting of a contract, or the issuance or retention of a grant, or other benefit.

C. Disclosure to Requesting Agency: Disclosure may be made to a Federal, State, local, foreign, or tribal or other public authority of the fact that this system of records contains information relevant to the retention of an employee, the retention of a security clearance, the letting of a contract, or the issuance or retention of a license, grant, or other benefit. The other agency or licensing organization may then make a request supported by the written consent of the individual for the entire record if it so chooses. No disclosure will be made unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another Federal agency for criminal, civil, administrative, personnel, or regulatory action.

D. Disclosure to Office of Management and Budget: Information may be disclosed to the Office of Management and Budget at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A-19.

E. Disclosure to Congressional Offices: Information may be disclosed to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of the individual.

F. Disclosure to Department of Justice: Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which the Agency is authorized to appear, when:

1. The Agency, or any component thereof;

2. Any employee of the Agency in his or her official capacity;

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

G. Disclosure to the National Archives: Information may be disclosed to the National Archives and Records Administration in records management inspections.

H. Disclosure to Contractors, Grantees, and Others: Information may be disclosed to contractors, grantees, consultants, or volunteers performing or working on a contract, service, grant, cooperative agreement, job, or other activity for the Agency and who have a need to have access to the information in the performance of their duties or activities for the Agency. When appropriate, recipients will be required to comply with the requirements of the Privacy Act of 1974 as provided in 5 U.S.C. 552a(m).

I. Disclosures for Administrative Claims, Complaints and Appeals: Information from this system of records may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.

J. Disclosure to the Office of Personnel Management: Information from this system of records may be disclosed to the Office of Personnel Management pursuant to that agency's responsibility for evaluation and oversight of Federal personnel management.

K. Disclosure in Connection with Litigation: Information from this system of records may be disclosed in connection with litigation or settlement discussions regarding claims by or against the Agency, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions and except where court orders are otherwise required under section (b)(11) of the Privacy Act of 1974, 5 U.S.C. 552a(b)(11).

L. Disclosure to Persons or Entities in Response to an Actual of Suspected Breach of Personally Identifiable Information: To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records, (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

M. Disclosure to assist another agency in its efforts to respond to a breach: To another Federal agency or Federal entity, when the Agency determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

These records are maintained electronically on servers located at EPA, National Computer Center (NCC), 109 TW Alexander Drive, Research Triangle Park, Durham, NC 27711. Backups will be maintained at a disaster recovery site.

Personal information is retrieved by expert's name or by committee or panel name.

Records are retained and disposed of in accordance with NARA records retention schedules appropriate to the retention of Federal Advisory Committee information, as well as EPA's Records Schedule 1024. The disposal of these records fall under the substantive committee records and are permanent.

Security controls used to protect personally identifiable information in SABAPP are commensurate with those required for an information system rated moderate for confidentiality, integrity, and availability, as prescribed in NIST Special Publication, 800-53, "Recommended Security Controls for Federal Information Systems," Revision 4.

1. Administrative Safeguards – only authorized users needing access to the system will be granted role-based credentials to access the system. Users of EPA systems are required to complete security and privacy training on an annual basis to ensure continued access to the system.

2. Technical Safeguards – SABAPP is a password protected system requiring all users to log in to access the information in the system. It is only accessible on the EPA network using government furnished equipment. It utilizes the agency’s network user-authentication process. The system times out after a period of latency ensuring a user re-authenticates their session with a username and password. The records are stored on an encrypted database.

3. Physical Safeguards – All records are maintained in secure areas and buildings with physical access controls.

Individuals seeking access to information in this system of records about themselves are required to provide adequate identification, e.g., driver’s license, military identification card, employee badge or identification card. Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

Any individual who wants to know whether this system of records contains a record about themself, should make a written request to the Attn: Agency Privacy Officer, MC 2831T, 1200 Pennsylvania Ave., NW, Washington, D.C. 20460, or email privacy@epa.gov.

None.

The original system of records notice for EPA-58 was published in the Federal Register on July 13, 2009, (74. Fed. Reg. 33435-33437).

-62EPA Personnel Access and Security System (EPASS).

Environmental Protection Agency, Office of Administration and Resource Management (OARM), Office of Administration (OA), Ariel Rios Building, MC3201A, 1200 Pennsylvania Ave, NW., Washington, DC 20460.

The System will collect and maintain information on individuals who require long-term, regular access as required by their position, to EPA-controlled facilities and information technology systems, including federal employees, contractors, grantees, students, interns, volunteers, other non-federal employees and individuals formerly in any of these positions. The System does not collect information on occasional visitors or short-term guests to whom the Agency may issue temporary identification.

Enrollment records: full name and history of name changes, social security number, applicant ID number, date of birth, gender, race, height, weight, hair color, eye color, digital color photograph, fingerprints, biometric template (two fingerprints), employee affiliation, work e-mail address, work telephone number(s), office location and organizational unit, employee status, foreign national status, federal emergency response official status, National Agency Check with Inquiries (NACI) status (permanent or provisional), citizenship status, government agency code, computer login name/user principal name (UPN), and personal identification verification (PIV) card issuance location. Records in EPASS"™s Identity Management System (IDMS) and Card Management System (CMS) are needed for credential management of enrolled individuals and include PIV card serial number, digital certificate serial number, PIV card issuance and expiration dates, PIV card personal identification number (PIN), cardholder unique identifier (CHUID), and card management keys. All sponsored individuals enrolled within EPASS may be issued a PIV card. The PIV card contains the following mandatory information: name, photograph, individual"™s affiliation, organizational affiliation, PIV card expiration date, Agency card serial number, and color-coding for employee affiliation. The card also contains an integrated circuit chip which is encoded with the following data elements: cardholder unique identifier (CHUID), PIV authentication digital certificate, and two fingerprint biometric minutiae templates.

Government Organization and Employees (5 U.S.C. 301); Public Buildings under the control of Administrator of General Services (40 U.S.C. 3101); Federal Information Security Management Act of 2002 (44 U.S.C. 3541); E-Government Act of 2002 (44 U.S.C. 101); Paperwork Reduction Act of 1995 (44 U.S.C. 3501); Executive Order 9347 (Nov. 22, 1943); and Homeland Security Presidential Directive 12 (HSPD-12) (August 27, 2004).

The primary purposes of the System are to: (1) ensure the safety and security of Federal facilities, systems, or information, and of facility occupants and users; (2) provide for interoperability and trust in allowing physical access to individuals entering Federal facilities; and (3) allow logical access to Federal information systems, networks, and resources on a government-wide basis.

General routine uses A, B, C, D E, F, G, H, I, J, K, and L apply to this System.

Storage:

Records are stored on a secure server within the EPASS sub-system Fingerprint Transmission System (FTS) and can be accessed over the Web using encryption software. The records are kept for 120 days and are either manually or automatically deleted.

Records can only be retrieved within the System database, which requires authorized user login/password credentials and administrative privileges to retrieve personal data within a Web instance of the system by using a combination of first name and last name.

Consistent with the requirements of the Federal Information Security Management Act and associated OMB policies, standards and guidance from the National Institute of Standards and Technology, EPA protects all records from unauthorized access through appropriate administrative, physical, and technical safeguards. Buildings have security guards and secured doors. All entrances are monitored through electronic surveillance equipment. Physical security controls include indoor and outdoor security monitoring and surveillance, badge and picture ID access screening and biometric access screening. Personally identifiable information (PII) is safeguarded and protected in conformance with all Federal statutes and Office of Management and Budget (OMB) requirements. All access has role-based restrictions. Individuals granted access privileges must be screened for proper credentials. EPA maintains an audit trail and performs random periodic reviews to identify any unauthorized access. Persons given roles in the EPASS HSPD-12 process must be screened and complete training specific to their roles to ensure they are knowledgeable about how to protect PII.

Records are retained and disposed of in accordance with EPA"™s records schedule 089.

Director, Office of Administration and Resources Management (OARM), Office of Administration (OA), Environmental Protection Agency, 1200 Pennsylvania Avenue, NW., Washington, DC 20460.

Any individual who wants to know whether this System of records contains a record about him or her, who wants access to his or her record, or who wants to contest the contents of a record, should make a written request to the EPA FOIA Office, Attn: Privacy Act Officer, MC2822T, 1200 Pennsylvania Avenue, NW., Washington, DC 20460.

The sources for information in the system are the individuals about whom, the records are maintained, the supervisors of those individuals, existing EPA systems, the sponsoring agency, the former sponsoring agency, other Federal agencies, the contract employer, the former contract employer and the U.S. Office of Personnel Management (OPM).

None.

-63 eDiscovery Enterprise Tool Suite, EPA-63.

Unclassified.

eDiscovery Enterprise Tool Suite, U.S. Environmental Protection Agency, eDiscovery Division, Office of Mission Support, Office of Enterprise Information Programs, 1200 Pennsylvania Avenue NW, Washington, D.C. 20460. Records are also maintained in Research Triangle Park, 109 T.W. Alexander Drive, Durham, NC 27709, and other Agency offices, or mission locations. Information may also be stored within a government-certified cloud, implemented and overseen by the Agency’s Chief Information Officer (CIO).

The system manager is the eDiscovery Division Director, Office of Mission Support, Office of Enterprise Information Programs, 1301 Constitution Ave, NW, Washington, D.C. 20001; EDD_Director@epa.gov.

40 U.S.C. 11315 and 44 U.S.C. 3506.

To support the document identification and collection processes for eDiscovery, Freedom of Information Act requests and other formal information requests.

Categories of individuals covered by this system include: (1) All persons subject to a litigation hold due to a "reasonable anticipation of litigation" as determined by EPA; (2) all persons deemed a participant of past or present litigation, investigation or arbitration where EPA is involved, including civil and criminal enforcement cases and defensive litigation; and (3) individuals impacted by Freedom of Information Act (FOIA) requests, litigation or other cases in EPA.

A wide variety of individuals are covered by the system, including individuals who correspond with EPA; provide information to EPA that is subject to discovery, a FOIA request or other formal information request; or are the subject of litigation with EPA; individuals who file complaints or petitions with EPA; and individuals involved in matters with EPA as either plaintiffs or defendants in both civil and criminal matters.

eDiscovery Litigation Hold Files. The litigation hold files contain the names and email addresses of EPA employees and EPA contractors, interns, or grantees who have been provided EPA email addresses and who have been identified as custodians of information that needs to be preserved in the anticipation of litigation. The records in the system will include these individuals' names and EPA email addresses which are entered into the system by designated EPA employees responsible for the administration of litigation holds. Information in the system includes litigation hold notices and answers to certification questions. Reports may be generated from the system that identify whether an individual is designated as a custodian of hold-responsive information, as well as reports containing the information received from individuals in response to questions asked through the litigation hold system.

eDiscovery Case Tracking Files. The case tracking files contain information about the cases created in response to a litigation, investigation, FOIA matter or other formal information request. Case tracking files may contain the names, phone numbers, organizations, and email addresses of EPA employees and EPA contractors, interns, or grantees who have been identified as custodians in a case or as points of contact for managing the case. Information in the case tracking files may include the location of the information to be searched, search terms and case notes entered into the system by designated EPA employees or contractors responsible for operating EPA's eDiscovery Enterprise Tool Suite.

eDiscovery Collection Files. The collection files contain information potentially responsive to a litigation, investigation, FOIA matter or other formal information request. The Tool Suite may capture many types of personally identifiable information depending on where that information is stored, including an individual's name; work address and telephone number; home address and telephone number; email addresses; vehicle information; names of individuals associated with a FOIA request or litigation hold; or other related information. The collection files contain all data collected by the tools using the search criteria and may contain, but not be limited to, correspondence (e.g., case coordination reports; memoranda and other records of communication, including electronic communication over email systems or instant messaging among other EPA employees and/or personnel of other federal agencies and outside parties and attachments to those messages or communications); local/shared drive data; information collected or compiled from EPA database systems; spreadsheets of data collections often including personally identifiable information or law enforcement data used to track the process of investigations or focus investigative priorities; records relating to litigation by or against the United States government; records relating to requests for EPA records other than requests under the FOIA and the Privacy Act of 1974; legal documents including complaints, summaries, affidavits, litigation reports, motions, subpoenas and any other court filing or administrative filing, or other related litigation documents; documentary evidence; supporting documents related to the legal and programmatic issues of a case; transcripts of interviews; regulatory history (i.e., permits and reports generated as a result of normal program activity); administrative record material and comments on administrative records; technical support (reports generated to test search criteria); investigative notes; reports requesting permission and use; transcripts of tapes; records checks (personal history, police information, fingerprint cards, photographs); property reports; property obtained and retained by an examiner including documents, personal property and documentary or other evidence; employment records and information related to employment matters; claims and records regarding discrimination, including employment and sex discrimination; personnel matters; contracts and information relating to contracts; manifests and other related investigative information.

EPA employees; employees of federal contractors; employees of other federal agencies and of state, local, tribal and foreign agencies; witnesses; informants; public source materials; and other persons who may have information relevant to the search criteria

The routine uses below are both related to and compatible with the original purpose for which the information was collected. The following general routine uses apply to this system:

1. The Agency, or any component thereof;

2. Any employee of the Agency in his or her official capacity;

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

4. The United States, if the Agency determines that litigation is likely to affect the Agency or any of its components,

G. Disclosure to the National Archives: Information may be disclosed to the National Archives and Records Administration in records management inspections.

The two routine uses below (L and M) are required by OMB Memorandum M–17–12.

L. Disclosure to Persons or Entities in Response to an Actual or Suspected Breach of Personally Identifiable Information: To appropriate agencies, entities, and persons when (1) EPA suspects or has confirmed that there has been a breach of the system of records; (2) EPA has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, EPA (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with EPA's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

M. Disclosure to Assist Another Agency in Its Efforts to Respond to a Breach of Personally Identifiable Information: To another Federal agency or Federal entity, when EPA determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

Records in the system are stored in database applications running on computer servers.

Litigation hold and case tracking files are assigned a case file control number or case name. Information collected from individuals pertaining to particular cases may be retrieved by name of individuals, email addresses, and other unique identifiers.

Records stored in the system are subject to records schedules 1012 and 0089.

Computer records are maintained in a secure, password protected computer system. Role-based access controls limit a user's access to the information in the system. Users are provided access to information in the system based on their need to know. Individuals working on a particular matter will be given access to the information related to that matter. The eDiscovery Enterprise Tool Suite is a password protected system requiring all users log in to access the information in the system. The system times out after a period of latency ensuring a user re-authenticates their session with a username and password. The system also maintains a user log that identifies and records persons who access and use the system. Users of EPA systems are required to complete security and privacy training on an annual basis to ensure continued access to the system. All records are maintained in secure areas and buildings with physical access controls.

Request for access must be made in accordance with the procedures described in EPA's Privacy Act regulations at 40 CFR part 16. Requesters will be required to provide adequate identification, such as a driver's license, employee identification card or other identifying document. Additional identification procedures may be required in some instances

For those records within the system collected and maintained pursuant to the Federal Rules of Civil Procedure (FRCP) and/or for the purpose of civil discovery, action or proceeding, 5 U.S.C. 552a(d)(5) will apply, stating that "nothing in this [Act] shall allow an individual access to any information compiled in reasonable anticipation of a civil action or proceeding." In addition, pursuant to 5 U.S.C. 552a(k)(2), this system is exempt from the following provisions of the Privacy Act, subject to the limitations set forth in that subsection: 5 U.S.C. 552a(c)(3), (d), (e)(1), (e)(4)(G), (e)(4)(H) and (f)(2) through (5). Finally, pursuant to 5 U.S.C. 552a(j)(2), when records are contained in this system related to a criminal enforcement proceeding, this system is exempt from the following provisions of the Privacy Act, subject to the limitations set forth in that subsection: 5 U.S.C. 552a(c)(3), (c)(4), (d), (e)(1), (e)(2), (e)(3), (e)(4)(G), (e)(4)(H), (e)(5), (e)(8), (f)(2) through (f)(5) and (g).

83 FR 35637 (July 27, 2018).

-64 My Workplace.

Environmental Protection Agency (EPA), Office of Environmental Information (OEI), 1200 Pennsylvania Ave. NW., Washington, DC 20460.

EPA employees, contractors on the EPA network and invited stakeholders, including but not limited to grantees, contractors, other federal or state officials, and industry partners.

For EPA employees this includes, but is not limited to, user name, common name or nickname, email address, organization, supervisor name, subordinates, office telephone, telework telephone, government cell phone number, fax number, personal cell phone, home phone, blackberry PIN, building location, office location, mail code, mailing address, courier address, home address, employee's title or position classification, other position title, professional affiliation, clearances, skills, disciplines with experience and knowledge, current and past projects and work activities, membership in inter-Agency or intra-agency formal workgroups or informal communities of practice, membership in professional associations, education, certifications, publications, detail status and photograph. Additionally, users of Lync may have status information, personalized messages and photographs.

5 U.S.C. 301, 40 U.S.C. 11315, 44 U.S.C. 3506.

To enhance and improve efficiencies in the dissemination and exchange of information within the EPA and allow colleagues to more easily connect with each other.

EPA's General Routine Uses: A, C, D, E, F, G, H, J, K, L apply to this system. Please refer tohttp://www.epa.gov/privacy/notice/general.htmfor a full explanation of these routine uses.

Storage:

Computer records are stored on a secure server and accessed over the Web via encryption software. Paper records, when created, are kept in file folders and cabinets in secure rooms. When individuals download information, it is stored on encrypted, password secured Agency computers. All records will have appropriate administrative, technical and physical safeguards to ensure their security and confidentiality.

Information is retrievable by name of the user; organizational information is retrievable by organization name.

Records in the system are protected from unauthorized access and misuse through various administrative, technical and physical security measures. Technical security measures within EPA include restrictions on computer access to authorized individuals, required use of strong passwords that are frequently changed, use of encryption for certain data types and transfers, and regular review of security procedures and best practices to enhance security. Physical measures include restrictions on building access to authorized individuals, only, and by maintaining records in lockable offices and filing cabinets.

The records will be managed in accordance with EPA retention schedule 129, Item b.

Lin Darlington, Office of Environmental Information, 1200 Pennsylvania Ave. NW., Washington, DC 20460.

Requests to determine whether this system of records contains a record pertaining to you must be sent to the Agency's Freedom of Information Office. The address is U.S. Environmental Protection Agency; 1200 Pennsylvania Ave. NW., Room 6416, WJC West, Washington, DC 20460; (202) 566-1667; Email:(hq.foia@epa.gov); Attn: Privacy Act Officer.

Individuals seeking access to their own personal information in this system of records are required to provide adequate identification (e.g., driver's license, military identification card, employee badge or identification card and, if necessary, proof of authority). Additional identity verification procedures may be required as warranted. Requests must meet the requirements of EPA regulations at 40 CFR part 16.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Requests must be submitted to the Agency contact indicated on the initial document for which the related contested record was submitted.

The sources for information in the system are the individuals about whom the records are maintained and other EPA information systems.

None.

-65 Engine and Vehicle Exemptions System (EV-ES)

US EPA, 109 T.W. Alexander Drive, Research Triangle Park, NC 27711

Individuals who apply to the EPA for a nonresident exemption to import a nonconforming on-highway vehicle (e.g., cars, motorcycles or motor homes) for a period of up to one year for personal use.

The vehicle owner"™s name, address, phone number, email address and vehicle identification number (VIN).

Title II of the Clean Air Act, (42 U.S.C. 7521 et seq.) provides that the EPA may issue exemptions and exclusions for nonconforming vehicles to enter into the United States.

The primary purpose of the system is to collect and maintain the information necessary for EPA to determine if the request for a nonresident exemption meets the criteria established in the regulations implementing this program codified in 40 CFR Parts 85 and 1068. In addition, the information collected is used to contact the requestor if there are questions regarding the request and to subsequently issue an approval or denial letter regarding the request. The information may also be used by CBP and EPA"™s Office of Enforcement and Compliance Assurance (OECA) to validate that the shipment at the port is valid.

General routine uses A, F, H, K and L apply to this system. (A detailed description of these routine uses can be found in the Agency's Systems of Records website at http://www.epa.gov/privacy/notice/general.htm.)

Storage:

Records are maintained on computer disks and tapes at the National Computer Center, Research Triangle Park, North Carolina and at EPA"™s Office of Transportation and Air Quality (OTAQ), Ann Arbor, MI.

Records are retrievable by all or part of the person"™s name, phone number, physical address, or email address.

- Computer-stored information is protected in accordance with the Agency"™s security requirements.

- Access to the information in the system is limited to authorized Agency and contractor personnel who administer the program. No external access to the system is provided.

- Any contractor is subject to the Federal Acquisition Regulations (FAR) Privacy

Act clauses in its contract with EPA.

Records stored in this system are subject to Schedule 483.

Holly Pugliese, Compliance Division, Office of Transportation and Air Quality, U.S. Environmental Protection Agency, 2000 Traverwood, Ann Arbor, Michigan 48105; telephone number: 734-214-4288; fax number: 734-214-4869; email address: pugliese.holly@epa.gov.

Any individual who wants to know whether this system of records contains a record about him or her, who wants access to his or her record, or who wants to contest the contents of a record, should make a written request to the EPA FOIA Office, Attn: Privacy Act Officer, MC 2822T, 1200 Pennsylvania Avenue, NW, Washington, D.C. 20460.

Request for access must be made in accordance with the procedures described in EPA"™s Privacy Act regulations at 40 CFR part 16. Requesters will be required to provide adequate identification, such as a driver"™s license, employee identification card, or other identifying document. Additional identification procedures may be required in some instances.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Complete EPA Privacy Act procedures are described in EPA"™s Privacy Act regulations at 40 CFR part 16.

There are two sources of information for records stored in the system:

(1) Vehicle Identification Numbers (VINs) provided to EPA by the requestor of the exemption.

(2) Information on the vehicles provided by their owners from potential and actual participants in the program.

None.

-66 Case Records System.

The paper records will be located at the EPA, Office of Administration and Resources Management (OARM), Office of Administrative Law Judges (OALJ), Ronald Reagan Building, Room M1200, 1300 Pennsylvania Ave NW., Washington, DC 20004. The electronic records will be located on Agency servers housed in Research Triangle Park, North Carolina.

This system covers any persons, including public citizens, representatives of federal, state, or local governments and businesses who submit documents in contested administrative adjudicatory proceedings before the EPA OALJ.

The sources of information in the system are limited to documents submitted by the parties to a matter (e.g., briefs, motions, exhibits) and by the ALJ presiding over the matter (e.g., orders, initial decisions). Parties may submit a wide range of document types to the OALJ containing various types of information including, but not limited to, names, addresses, social security numbers, medical and/or financial information contained in opinions of law, pleadings, motions, exhibits, and other documents submitted by the parties to a matter and the presiding ALJ. This includes information found in individual tax returns and other documents related to a party"™s ability to pay a monetary civil penalty.

42 U.S.C. 11001 et seq. (Emergency Planning &amp; Community Right-to-Know Act (EPCRA)); 42 U.S.C. 6901 et seq. (Resource Conservation and Recovery Act (RCRA)); 15 U.S.C. 2601 et seq. (Toxic Substances Control Act (TSCA)); 7 U.S.C. 136 et seq. (Federal Insecticide, Fungicide and Rodenticide Act (FIFRA)); 42 U.S.C. 9601 et seq. (Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA)); 33 U.S.C. 1251(Federal Water Pollution Control Act (FWPCA), commonly known as the Clean Water Act (CWA)); 42 U.S.C. 7401 (Clean Air Act (CAA)); 40 CFR 22.4 (Consolidated Rules of Practice Governing the Administrative Assessment of Civil Penalties and the Revocation/Termination or Suspension of Permits).

The information contained in the system is primarily for the purpose of ALJs to render determinations with respect to matters before them and communicating the determinations to the appropriate individuals and organizations, as well as to the general public. When fully implemented, the electronic filing portion of the system will provide for online filing, tracking, and accounting of filings (e.g., pleadings, motions, briefs, exhibits, orders, and determinations) in all cases, both pending and archived. Other uses of the system and the information contained, therein, include:

Responding to Freedom of Information Act requests;

Providing the chief judge management information necessary to assess workload, assign incoming cases and monitor case progress;

Allowing individual judges to monitor the progress of assigned cases;

Providing ready access to case docketing information to support staff to enable timely response to complainants, government and private counsel, and respondents concerning the status of a particular case; and

Promoting adjudicative transparency by providing public access to OALJ litigation documents.

General Routine Uses A, E, F, G, H, K, and L apply to this system. Records may also be disclosed to the general public.

Storage:

The records in the system are stored in paper files and computer databases.

Paper files are retrieved by the names of the parties to a particular case or the docket number. All records stored in computer databases are full-text indexed and are searchable by any data element. Once fully implemented, the general public will be able to access most records over the Internet by any data element.

Paper records are maintained in lockable file cabinets in secure, access-controlled rooms, areas, or buildings. Computer records are maintained in a secure, password protected computer database on servers located in secure, access-controlled rooms, areas or buildings at Agency facilities in Research Triangle Park, North Carolina. When fully implemented, the electronic filing portion of the system (known as the "OALJ E-Filing System") will warn the user that information submitted via the OALJ E-Filing System is made public and that users should redact any sensitive PII from the document prior to submitting it. Users of the OALJ E-Filing System must affirm that they have read and understood the warning each time prior to submitting the document electronically. The OALJ published a Privacy Act Statement &amp; Notice of Disclosure of Confidential and Personal Information on its website, which instructs users how to submit documents that contain un-redacted PII. Notwithstanding this public notice, the OALJ will examine documents submitted for sensitive personally identifiable information (PII) and, if found, redact the PII prior to making the document available to the public. The OALJ Case Tracking System portion of the Case Records System allows the employees of OALJ to exclude specific documents from being published to the Internet.

The records will be maintained under EPA Records Schedules 508, 509, and 510.

Bruce Franklin, Administrative Manager, Office of Administrative Law Judges, Ronald Reagan Building, Room M1200, 1300 Pennsylvania Avenue NW., Washington, DC 20004.

Any individual who wants to know whether this system of records contains a record about him or her, who wants access to his or her record, or who wants to contest the contents of a record, should make a written request to the EPA FOIA Office, Attn: Privacy Act Officer, MC 2822T, 1200 Pennsylvania Avenue, NW., Washington, D.C. 20460.

Request for access must be made in accordance with the procedures described in the EPA"™s Privacy Act regulations at 40 CFR part 16. Requesters will be required to provide adequate identification, such as a driver"™s license, employee identification card, or other identifying document. Additional identification procedures may be required in some instances.

Sources include parties to administrative adjudicatory proceedings before the OALJ and the employees within the OALJ. A party may be any persons, including public citizens and representatives of federal, state, or local governments, and businesses who submit documents in contested administrative adjudicatory proceedings before the EPA OALJ.

Nothing in this notice shall allow an individual access to any information compiled in reasonable anticipation of a civil action or proceeding. 5 U.S.C. 552a(d)(5).

-68 Labor and Employee Relations Information System (LERIS).

Xiolink Facility, 1111 Olive St., St. Louis, MO 63101.

Current and former EPA employees, including Health and Human Services (HHS) Public Health Service Commissioned Officers assigned to the EPA.

This system will contain general human resources elements, including First/Middle/Last Name, Appointment Type, Appointment Not-to-Exceed Date (if applicable), Service Computation Date for Leave Accrual Purposes, Service Computation Date for Retirement Eligibility Purposes, Position Title, Pay Plan, Occupational Series, Grade, Step, Supervisory Code, Bargaining Unit Status Code, Organizational Breakdown of Position’s Location ("Organization Level 1" through "Organizational Level 8," as applicable) and Duty Station. The system will contain Labor Relations case file information regarding administrative grievances, Grievances of the Parties, negotiated grievances, formal discussions/meetings, union information requests, negotiations, unfair labor practice (ULP) charges, and unit clarification petitions. The system will contain Employee Relations case file information regarding employee counseling for misconduct or poor performance, disciplinary actions, adverse actions, performance-based actions, performance assistance plans, performance improvement plans, reasonable accommodation requests and Merit System Protection Board (MSPB) appeals.

5 U.S.C. Chapter 71; 5 CFR 771; 5 CFR 752; 5 CFR 432.

These records are maintained in LERIS to administer EPA's Labor and Employee Relations program. They also provide the basic source of factual data about a person's federal employment while in the service and after his or her separation. Records in LERIS have various uses by Agency personnel offices, including employee’s rights and benefits under pertinent laws and regulations governing Federal employment; and other information needed to provide personnel services. These records and their automated equivalents may also be used to locate individuals for personnel research.

General routine uses A, B, C, D, E, and L apply to this system.

Storage: These records are maintained in digital formats on servers and storage hard disks. The computer storage devices are located at the contractor’s Xiolink facility in St. Louis, MO. Backup copies of this information are maintained at an alternate processing site in Bellevue, NE. Data is on hard disk media and retained per client requirements. Additional backup copies of each application are taken annually and retained for 7 years.

Computer records are maintained in a secure password-protected environment. Access to computer records is limited to those who have a need to know the information contained in the records. Permission-level assignments allow users access only to those functions for which they are authorized. All records are maintained in secure, access-controlled areas or buildings.

Records stored in the system are subject to records schedule 756.

Director, Office of Human Resources, Office of Administration and Resources Management, U. S. Environmental Protection Agency, WJC North, 1200 Pennsylvania Avenue, NW., MC 3601, Washington, DC 20460.

Any individual who wants to know whether this system of records contains a record about him or her, who wants access to his or her record, or who wants to contest the contents of a record, should make a written request to the EPA FOIA Office, Attn: Privacy Act Officer, WJC West, MC 2822T, 1200 Pennsylvania Ave., NW., Washington, DC 20460.

Individuals seeking access to information in this system of records about themselves are required to provide adequate identification (e.g. driver’s license, military identification card, employee badge or identification card and, if necessary, proof of authority). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

The individual on whom the record is maintained, Agency officials such as managers and supervisors, HR specialists and assistants who process personnel actions, and HR Shared Service Centers.

None.

-69Eventbrite.

Records are located in EPA offices, on computer servers in Headquarters, Regional Offices and at the third-party location.

Any individual that registers for an EPA-organized event using Eventbrite.com.

Information to be collected for purposes of creating an attendee roster for a specific event. Information collected may include name, title, organization, mailing address, email address, phone number, and special accommodations (such as visual or hearing impairment).

Section 2 of the E-Government Act of 2002 (Pub. L. 107-347, 44 U.S.C. § 3601 n.); Section 2 of the Paperwork Reduction Act of 1995 (Pub. L. 104-13, 44 U.S.C. § 3501)

The purpose of the Eventbrite tool is to collect information on meeting attendees that can be used for a head count, attendee roster, or printed materials, such as nametags and tent cards.

General routine uses B, H, I, J, K, and L apply to this system. (A detailed description of these routine uses can be found in the Agency’s Systems of Records website at http://www.epa.gov/privacy/notice/general.htm.)

Storage:

Once information is downloaded from the Eventbrite site to the EPA server, it will be saved to a secure drive in the office that is organizing the event. Records will be saved in electronic format. A printed registration list may be generated for the specific event to be used onsite to track participation, but the list will not be duplicated or distributed to meeting attendees or other event participants.

Registration information is downloaded from the Eventbrite site in Microsoft Excel format. Each record includes the date the participant registered. Records saved in Excel format may be sorted and retrieved by any of the categories included on the registration form used for any particular event (i.e., name, email address, state, organization, or job title). Files may be saved in Excel or PDF format.

This information can only be downloaded from the Eventbrite site by the event organizer, using an account specific password. The information will be saved on EPA’s secure server within the event sponsoring office. The only EPA staff who will be able to access the registration information are those staff with security access to their office’s server.

Records stored in this system are subject to Schedule 483.

Acting Associate Director of Web Communications and Social Media Lead, OPA/OWC, U.S. Environmental Protection Agency, 1200 Pennsylvania Avenue, NW, Washington, DC, 20460.

Any individual who wants to know whether this system of records contains a record about him or her, who wants access to his or her record, or who wants to contest the contents of a record, should make a written request to the EPA FOIA Office, Attn: EPA Privacy Officer, MC2822T, 1200 Pennsylvania Avenue, NW, Washington, DC 20460.

Individuals seeking access to information in this system of records about themselves are required to provide adequate identification (e.g. driver’s license, military identification card, employee badge or identification card). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. The EPA’s procedures for making a Privacy Act request can be found in EPA’s Privacy Act regulations at 40 CFR part 16.

The information stored in the system will be provided by the individuals registering for an EPA event.

None.

-70 Emergency Management Portal – Field Readiness Application (EMP – FR).

The system is located at the EPA’s Office of Environmental Information, Office of Technology Operations and Planning, National Computing Center, Research Triangle Park, NC 27711.

This system covers current and former EPA employees, grantees, interns and staff of other federal agencies posted at the EPA who are members of the emergency management and response community and/or who are subject to the EPA’s health and safety training requirements. The emergency management and response community includes on scene coordinators, removal managers, RSC members and coordinators and other field personnel. Other EPA employees that are subject to health and safety training requirements include inspectors, special agents and enforcement officers.

Personal and emergency contact information for the EPA RSC volunteers:

Home address, personal email, home and cell phone numbers as well as emergency contact name, relationship and phone numbers.

Certification and training information for emergency response personnel and members of the EPA’s health and safety community; Incident Command System training and certifications for the response personnel; health and safety training and certifications required for other EPA personnel:

Training taken, training required, certifications received and certifications required.

For RSC members, additional fields include emergency response experience and workgroup membership.

As specified by law and EPA Order, the Agency's Occupational Medical Surveillance Program (OMSP) provides for baseline, exit and periodic health evaluations to ensure, to the extent feasible, that EPA employees subject to extraordinary physical demands or hazardous exposures have not suffered adverse health effects. The employee data about this program that are managed in EMP-FR include only the date that an occupational medical review was conducted and the date by which the next review is required. No specifics of employee health, exposures, or other medical confidential information are included in EMP-FR.

CERCLA section 105 (National contingency plan; preparation, contents, etc.); EPCRA section 305 (Emergency training and review of emergency systems); EPA Order 1440.2 (partial list: Occupational Safety and Health Act of 1970 and E. O. 12196, Occupational Health and Safety Programs for Federal Employees); EPA Order 1460.1 ( partial list: 29 U.S.C. 655, section 6, and 29 U.S.C. 668, section 19, Occupational Safety and Health Act of 1970 and section 501 of the Rehabilitation Act of 1973, as amended). Purposes(s): Personal and Emergency Contact Information is used by line supervisors and managers of the RSC Program (1) to contact the RSC member in off-hours when he/she is needed to deploy to an incident and (2) in case of injury to the RSC member while deployed at an incident. Emergency planning, management and response-related training and certification information is used by individuals and managers of the various emergency management and response programs across the Agency to track required emergency response training.

Safety and health-related training and certification information is used by individuals and managers of the safety, health and environmental management program across the Agency to track required safety, health and environmental management training and medical monitoring data.

General routine uses A, D, E, F, G, H, K and L apply to this system. Records may also be disclosed to home-agency supervisors of non-EPA federal employees.

Storage:

Data are stored on in a computer database on a database server.

Personally identifiable information (PII) can be retrieved by name and EPA personnel identification number. Searches by training or certification name can also be used to access user records.

Access to EMP by external trusted partners, such as state employees, other federal employees and contractors as well as internal contractors, grantees, interns and non-EPA federal employees must be requested through OEI’s Web Access Management process and must be approved by the requestor’s EPA point of contact. In addition, requestor’s EPA point of contact must explain and approve all read/edit access to the EMP-FR application. Access is then granted via the EMP Help Desk data managers. Those with edit rights to profiles other than their own, have rights granted individually through the EMP Help Desk in accordance with procedures determined by the various field readiness user community program managers such as the RSC project manager; the National Incident Management System project manager and the Safety, Health and Environmental Management Division of the Office of Administration and Resources Management. Access to the personal and emergency contact information is limited to the person himself/herself; the person’s supervisor, as listed in EMP-FR; and the person’s organizational RSC Coordinators and their specific designees. This access is managed through the standard EMP database security and policies.

An EMP-FR records schedule is currently under development.

Christopher Burgess, Office of Solid Waste and Emergency Response, Office of Emergency Management, Resource Management Division, USEPA,

MC 5104A, WJC North, 1200 Pennsylvania Avenue, NW, Washington, DC 20460.

Any individual who wants to know whether this system of records contains a record about him or her, who wants access to his or her record, or who wants to contest the contents of a record, should make a written request to the EPA Freedom of Information Act Office, Attn: Privacy Act Officer, MC 2822T, 1200 Pennsylvania Avenue, NW., Washington, DC 20460.

Information will come from the individual, from program managers such as OARM/SHEMD and OSWER/OEM/PROD, and from training rosters.

None.

/-71 Federal Docket Management System (FDMS), EPA-71

Unclassified

U.S. EPA, 109 T.W. Alexander Drive, Durham, NC 27709

Tobias Schroeder, (202) 250-8603, or Schroeder.tobias@epa.gov, eRulemaking Program Management Office, U.S. EPA, Office of Mission Support, MC 2282T, 1200 Pennsylvania Ave., NW., Washington, DC 20460.

Section 206(d) of the E-Government Act of 2002 (Public Law 107-347, 44 U.S.C. Ch 36); Clinger-Cohen Act of 1986, 40 U.S.C. 11318; and 5 U.S.C. 301.

To provide the public a central online location to search, view, download and comment on Federal rulemaking documents.

Any individual commenting on a Federal agency’s rulemaking activities or submitting supporting materials.

Agency rulemaking materials including Federal Register publications, supporting rulemaking documentation, scientific and financial studies and public comments.

Agencies and other individuals who create records derived from individuals commenting on Federal rulemaking activities.

The following new routine uses apply to this system because the use of the record is necessary for the efficient conduct of government operations. The routine uses are related to and compatible with the original purpose for which the information was collected. EPA general routine uses A (Disclosure for Law Enforcement Purposes), B (Disclosure Incident to Requesting Information), C (Disclosure to Requesting Agency), D (Disclosure to Office of Management and Budget), E (Disclosure to Congressional Offices), F (Disclosure to Department of Justice), G (Disclosure to National Archives), H (Disclosure to Contractors, Grantees and Others), K (Disclosure in Connection with Litigation), apply to this system (73 FR 2245). (https://www.federalregister.gov/documents/2008/01/14/E8-445.pdf) The following new routine uses are in accordance with M-17-12.

To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records, (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

Records are stored in file folders in lockable file cabinets as maintained by the agency from where the record was initiated. Records are also stored in a secure, password protected electronic system that utilizes security hardware and software to include firewalls, encryption, active intrusion detection and role-based access controls. Additional safeguards vary by participating agencies.

The system retrieves records by numerous data elements and key word searches, including agency, dates, subject, docket type, docket sub-type, agency docket ID, docket title, docket category, document type, CFR Part, date received and Federal Register publication date, and name of the commenter, document, and docket.

The unique identifiers within the system are the docket ID, comment tracking number, and document ID.

Each Federal agency handles its records in accordance with its records schedule as approved by the National Archives and Records Administration (NARA).

FDMS security protocols meet multiple security standards from authentication to certification and accreditation, as identified by the National Institute of Standards and Technology (NIST). Records in the system are maintained in a secure, password protected electronic system that utilizes security hardware and software to include multiple firewalls, active intrusion detection, and role-based access controls. Additional safeguards vary by agency for the regulatory records. Security controls are commensurate with those required for an information system rated moderate for confidentiality, integrity and availability as prescribed by NIST.

Uncontrolled access to information is restricted to publically available information. Partner agencies determine the specific unrestricted information that may be accessed by the public. That information is posted on an open publically accessible website, Regulations.gov. Information maintained on FDMS is only available to the particular partner agency that posts the particular information. User access is controlled by password access. Passwords are maintained in accordance with the government security guidelines. Individuals seeking access to their own personal information in this system of records are required to provide adequate identification (e.g., driver's license, military identification card, employee badge or identification card). Additional identity verification procedures may be required as warranted. Requests must meet the requirements of EPA regulations at 40 CFR part 16.

Record content is controlled by individual partner agencies. The system collects public comment. All comments are assigned a tracking number. Comments are publically viewable. The system does not accept requests for correction or amendment only initial input. Requests for correction or amendment must identify the record to be changed and the corrective action sought. Requests must be submitted to the agency contact indicated on the initial document for which the related contested record was submitted. Complete EPA Privacy Act procedures are described in EPA's Privacy Act regulations at 40 CFR part 16.

Any individual who wants to know whether this system of records contains a record about him or her should contact the agency responsible for the rulemaking activity that the individual believes may contain this information. Agency contact information is provided in the corresponding Federal Register notice. If an individual wants to contact EPA regarding an EPA rulemaking activity, they should send a written request to OMS Docket, Environmental Protection Agency, Mail code: 2822T, 1200 Pennsylvania Ave., NW., Washington, DC 20460.

None.

81 FR 81096 – Posted on December 27, 2016 - The Environmental Protection Agency (EPA) provided notice that it was amending the FOIA Request and Appeal File system of records. All information and data elements collected by the Environmental Protection Agency (EPA) and participating agencies as it relates to FOIA requests, appeals and responses was removed from the Federal Docket Management System (FDMS) system of records and being added to the FOIA Request and Appeal File (EPA-9) system of records.

79 FR 9201 - Posted on February 18, 2014 – The Environmental Protection Agency (EPA) provided notice that it had amended the Federal Docket Management System (FDMS) system of records to include additional categories of records. The amendment was required to address additional categories of information collected from Freedom of Information Act (FOIA) requesters by some participating agencies and information voluntarily provided, even when not required.

78 FR 60868 - Posted on October 2, 2013 – The Environmental Protection Agency (EPA) provided notice that it had amended the Federal Docket Management System (FDMS) system of records to add information collected in a Freedom of Information Act (FOIA) system.

73 FR 2245 – Posted on January 14, 2008 - The Environmental Protection Agency provided notice that it proposed to amend its current list of General Routine Uses to add a new routine use. The new general routine use will allow the Agency to disclose information in its systems covered under the Privacy Act to persons and entities that may be needed by the Agency to respond, prevent, minimize or remedy harm resulting from an actual or suspected breach or compromise of personally identifiable information.

70 FR 15086 - Posted on March 24, 2005 – The EPA, as managing partner of the Federal-wide eRulemaking, eGovernment Initiative, provided notice that it proposed to establish a government-wide system of records, the Federal Docket Management System (FDMS).

/-73

Reasonable Accommodation Management System (RAMS), EPA-73.

Unclassified.

SYSTEM LOCATION:

Hard copy and electronic records are maintained at EPA Headquarters, 1200 Pennsylvania Ave. NW, Washington, D.C. 20460, and/or at the EPA Regional Office and/or the local office of the requestor.

OCAPPM Director, and NRACs, 1200 Pennsylvania Ave. NW, Washington, D.C. 20460.

Title VII of the Civil Rights Act of 1964 (Pub. L. 88-352); the Rehabilitation Act of 1973; the Americans with Disabilities Act (ADA) and the ADA Amendments Act of 2008 (ADAAA) (Pub. L. 110–325); Executive Order 13164, Requiring Federal Agencies To Establish Procedures To Facilitate the Provision of Reasonable Accommodation (July 28, 2000); Executive Order 13548, Increasing Federal Employment of Individuals with Disabilities (July 26, 2010); Executive Order 14043, Requiring Coronavirus Disease 2019 Vaccination for Federal Employees (Sept. 9, 2021); Executive Order 14042, Ensuring Adequate COVID Safety Protocols for Federal Contractors (Sept. 9, 2021); Executive Order 13991, Protecting the Federal Workforce and Requiring Mask-Wearing (Jan. 20, 2021); Executive Order 12196, Occupational Safety and Health Program for Federal Employees (Feb. 26, 1980); 5 U.S.C. chs. 63, 79; 29 U.S.C. 654, 668, 42 U.S.C. 247d, 12101, 44 U.S.C. 3101, 5 CFR part 339, and 29 CFR part 1602; and Equal Employment Opportunity Commission (EEOC) reasonable accommodation regulations and guidance.

EPA uses RAMS to collect and maintain information on reasonable accommodation requests from EPA employees and applicants for employment. Under Title VII of the Civil Rights Act, the Rehabilitation Act, and the ADA and ADAAA, EPA must provide reasonable accommodations to employees and applicants for employment for qualifying medical disabilities and sincerely held religious beliefs and practices, unless the accommodation would impose an undue hardship on the agency. In certain authorized situations, EPA may provide accommodations to individuals whose medical condition may not qualify as a disability.

Reasonable accommodations are modifications or adjustments that will allow applicants and employees to apply for a job, perform job duties, and/ or enjoy the benefits and privileges of employment. Reasonable accommodations may include, but are not limited to: (1) making existing facilities readily accessible to and usable by individual with disabilities; (2) job restructuring, modification of work schedules or place of work, extended leave, telecommuting, or reassignment to a vacant position; (3) acquisition or modification of equipment or devices, including computer software and hardware, appropriate adjustments or modifications of examinations, training materials or policies, the provision of qualified readers and/or interpreters, personal assistants that enable the individual to perform their job duties and enjoy the benefits and privileges of employment, and other similar accommodations; and/or (4) providing interpreters, large print programs, or other accommodations for EPA events or activities open to employees, applicants, and/or the public

EPA employees and applicants for employment at EPA who request a reasonable accommodation (the "Requestor"); individuals whom the Requestor authorizes to submit information in support of their request; and authorized individuals responsible for processing requests

Information collected in RAMS may include but is not limited to: email correspondence with the Requestor and authorized individuals responsible for processing requests; documentation submitted in support of a request consistent with EPA’s Procedures for Providing Reasonable Accommodation for EPA Employees and Applicants with Disabilities; religious belief and practice information submitted in support of a request; and accommodation determination documentation. Specific data elements may include: Requestor name, work address, work phone, work email address, office name, occupational series, pay grade, and bargaining unit; accommodation requested, request date, work/application activity limited by requesting condition; medical information, religious information, disability status, determination date, determination method, explanation of method, and decision-making official name and title; and contact information for individuals whom the Requestor authorizes to submit information in support of their request and for authorized individuals responsible for processing requests

Information is obtained from: the Requestor; authorized individuals responsible for processing requests; persons appointed by and/or acting on the Requestor’s behalf such as a union representative, colleague, or spouse; the NRACs or the Local Reasonable Accommodation Coordinator (LORAC), if there is one for the Requestor’s office; the Requestor’s medical provider(s); and/or third parties attesting to the Requestor’s religious belief or practice (if submitted by or with permission of the individual seeking the accommodation)

The routine uses below are both related to and compatible with the original purpose for which the information was collected. The following general routine uses apply to this system:

A. Disclosure for Law Enforcement Purposes: Information may be disclosed to the appropriate Federal, State, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, when a record, either on its face or in conjunction with other information, indicates or is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity.

B. Disclosure Incident to Requesting Information: Information may be disclosed to any source from which additional information is requested (to the extent necessary to identify the individual, inform the source of the purpose of the request, and to identify the type of information requested) when necessary to obtain information relevant to an agency decision concerning a personnel action (other than hiring), such as retention of an employee, retention of a security clearance, the letting of a contract, or the issuance or retention of a grant, or other benefit.

The Agency, or any component thereof;

Any employee of the Agency in his or her official capacity;

Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

The United States, if the Agency determines that litigation is likely to affect the Agency or any of its components,

G. Disclosure to the National Archives: Information may be disclosed to the National Archives and Records Administration in records management inspections.

I. Disclosures for Administrative Claims, Complaints and Appeals Information may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator, or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.

J. Disclosure to the Office of Personnel Management: Information may be disclosed to the Office of Personnel Management pursuant to that agency’s responsibility for evaluation and oversight of Federal personnel management.

K. Disclosure in Connection with Litigation: Information may be disclosed in connection with litigation or settlement discussions regarding claims by or against the Agency, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions and except where court orders are otherwise required under section (b)(11) of the Privacy Act of 1974, 5 U.S.C. 552a(b)(11).

The two routine uses below (L and M) are required by OMB Memorandum M–17–12.

L. Disclosure to Persons or Entities in Response to an actual or Suspected Breach of Personally Identifiable Information: To appropriate agencies, entities, and persons when (1) EPA suspects or has confirmed that there has been a breach of the system of records, (2) EPA has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, EPA (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with EPA’s efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

M. Disclosure to Assist Another Agency in its Efforts to Respond to a Breach of Personally Identifiable Information: To another Federal agency or Federal entity, when EPA determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

Additional routine uses that apply to this system are:

1. Disclosure for Mandatory Reporting Requirements: Information may be disclosed to appropriate federal, state, local, tribal, or foreign governmental agencies or multilateral governmental organizations, to the extent permitted by law, and in consultation with legal counsel, to satisfy mandatory reporting requirements when applicable.

2. Disclosure to a Public Health Authority: Information may be disclosed to: Federal agencies such as the Department of Health and Human Services (HHS), State and local health departments, and other public health or cooperating medical authorities in connection with program activities and related collaborative efforts to deal more effectively with exposures to communicable diseases or to combat public health threats, and to satisfy mandatory reporting requirements when applicable.

3. Disclosure to Governmental Organization: Information may be disclosed to: appropriate federal, state, local, tribal, or foreign governmental agencies or multilateral governmental organizations, to the extent permitted by law, and in consultation with legal counsel, for the purpose of protecting the vital interests of a data subject or other persons, including to assist such agencies or organizations in preventing exposure to or transmission of a communicable or quarantinable disease or to combat other significant public health threats.

4. Disclosure to Assisting Agency: Information may be disclosed to: a Federal agency or entity authorized to procure assistive technologies and services in response to a request for reasonable accommodation; another Federal agency pursuant to a written agreement with EPA to provide services (such as medical evaluations), when necessary, in support of reasonable accommodation decisions.

5. Disclosure for Emergencies: Information may be disclosed to first aid and safety personnel if the individual's medical condition requires emergency treatment.

6. Disclosure to Oversight Body: Information may be disclosed to another Federal agency or oversight body charged with evaluating EPA's compliance with the laws, regulations, and policies governing reasonable accommodation requests.

7. Disclosure to Hosting Entity: Information may be disclosed to an entity that is hosting an individual receiving an accommodation in order to provide continuation of that accommodation in the hosting location.

Electronic records are maintained in a secure password protected environment on electronic storage devices, including internal servers and local hardware devices (government furnished equipment laptops). The electronic storage devices and any paper records are located at EPA Headquarters, EPA Regional Offices, and/or the local office of the Requestor. Paper records are maintained in file folders stored within locking filing cabinets or locked rooms in secured facilities with controlled access

These records are retrieved by the Requestor’s name, and/or a case number that is assigned to the request in RAMS, and/or by office or region.

Records stored in this system are subject to EPA records schedule number (EPA 0068), Reasonable Accommodation Request Records. A records schedule provides mandatory instructions on how long to keep records (retention) and when they can be disposed. Reasonable accommodation records are retained until three years after an employee separates from EPA or three years after an applicant made the request if they are not hired.

Security controls used to protect personal sensitive data in RAMS are commensurate with those required for an information system rated MODERATE for confidentiality, integrity, and availability, as prescribed in National Institute of Standards and Technology (NIST) Special Publication, 800-53, "Security and Privacy Controls for Information Systems and Organizations," Revision 5.

Administrative Safeguards: EPA staff must complete annual agency training for Information Security and Privacy. EPA instructs staff to lock and secure their computers and offices, if applicable, when unattended. All staff authorized to use RAMS are required to take training on the proper handling of personally identifiable information before using RAMS as well as annual Agency Information Security and Privacy Awareness training.

Technical Safeguards: EPA staff authorized to access electronic records are assigned permission levels. Permission level assignments allow authorized users to access only those system functions and records specific to their Agency work need. EPA also has technical security measures including restrictions on computer access to authorized individuals and required use of a personal identity verification (PIV) card and password. Medical documentation is password protected.

Physical Safeguards: Only authorized EPA staff have access to paper files, which are stored within locking filing cabinets or locked rooms in secured facilities with controlled access. Electronic storage devices are maintained in secured facilities with controlled access

All requests for access to personal records should cite the Privacy Act of 1974 and reference the type of request being made (i.e., access). Requests must include: (1) the name and signature of the individual making the request; (2) the name of the Privacy Act system of records to which the request relates; (3) a statement whether a personal inspection of the records or a copy of them by mail is desired; and (4) proof of identity. A full description of EPA’s Privacy Act procedures for requesting access to records is available at 40 CFR part 16

Requests for correction or amendment must include: (1) the name and signature of the individual making the request; (2) the name of the Privacy Act system of records to which the request relates; (3) a description of the information sought to be corrected or amended and the specific reasons for the correction or amendment; and (4) proof of identity A full description of EPA’s Privacy Act procedures for the correction or amendment of a record are described in EPA’s Privacy Act regulations at 40 CFR part 16.

None.

The original system of records notice for RAMS was published in the Federal Register on July 8, 2019 (84 FR 32456-32460).

/-74

Environmental Assessments of Residential Properties (EARP), EPA-74.

Unclassified.

The system will be managed by the EPA's Office of Emergency Response, OLEM, 1200 Pennsylvania Ave. NW., Mail Code 5103 T, Washington, DC 20460. Information maintained pursuant to this notice may be located at EPA Headquarters Offices or at EPA Regional Offices, or at field offices established as part of the residential assessment field work, depending upon the location where the environmental assessment is conducted or where computer resources are located. Databases may be hosted at the EPA's National Computer Center located at 109 T.W. Alexandra Drive, Durham, NC 27709, or in OLEM's emergency response cloud hosting environment.

Joseph Schaefer, Office of Land and Emergency Management (OLEM), Office of Superfund Remediation and Technology Information (OSRTI), Mail Code 205A-ERT, Raritan Depot 2890 Woodbridge Avenue, Edison, NJ 08837; telephone number (732) 906-6920; Schaefer.Joe@epa.gov.

Resource Conservation and Recovery Act (RCRA), 42 U.S.C. 6981; Comprehensive Environmental Response, Compensation and Liability Act (CERCLA), 42 U.S.C. 9604, 9660; Clean Air Act (CAA), 42 U.S.C. 7403; Safe Drinking Water Act (SDWA), 42 U.S.C. 300i; 300j-1; Federal Water Pollution Control Act, (FWPCA) 33 U.S.C. 1254, 1318, 1321; Toxic Substances Control Act (TSCA), 15 U.S.C. 2609; Federal Insecticide, Fungicide, and Rodenticide Act, (FIFRA) 7 U.S.C. 136r.

The EPA has created a Privacy Act system of records to allow EPA to maintain records that are necessary to conduct environmental assessments at residential properties in order to respond to emergency situations and during environmental assessment activities conducted by EPA under many different programs including Superfund, RCRA, and the SDWA. This system of records promotes transparency, efficiency, and improved environmental and health outcomes by encompassing all of the records associated with EPA residential assessment and response work, including the database repositories, field documentation and analytical reports. Over the course of these assessments EPA is often required to support or work closely with state and local agencies or other federal agencies to evaluate the health and welfare of affected communities. EPA's environmental assessment activities at residential properties include: obtaining and tracking legal access to the properties; gathering environmental data through sampling activities, such as sampling air, water, soil, or other environmental media at sites; collecting structural information such as the age of the structure, information about the service lines, plumbing and pipe information, and building materials in the structure, information about the length of residence or ownership of the structure, and GIS coordinates; and collecting residential contact information such as name, address, and phone number to allow response teams to correspond with individuals affected by environmental contamination.

Members of the public such as residents, property owners, property managers, and other individuals who may be associated with a property whose information needs to be collected as part of EPA's environmental assessment and response activities. In addition, EPA staff, contractors, grantees, or any other individuals engaged in response activities (including state, local, and tribal employees) may have their information in the system such as name, office address, and contact information to facilitate assessment and response activities.

The types of data collected in environmental assessments and responses include names of residents; names of property owners; tenant information; names of property managers; address information; phone number or other contact information; test results from environmental sampling; medical and health information; information about residential structures such as the age of the structure, information about the service lines, plumbing and pipe information, and building materials in the structure; information about the length of residence or ownership of the structure; GIS coordinates; age; property ownership and management information; information about physical dimensions of the property and structures present on the property; information about wells on the property; information about uses of the property; information about sampling locations; and information about prior environmental issues at the property, including prior test results and actions taken. Other site-specific data elements may also be collected if needed for the environmental assessment or emergency response activity.

Records within this system of records are obtained by EPA employees, contractors, or grantees collecting environmental assessment data and sample information at residential sites, or from state or local governments who have collected environmental assessment information as part of their response authorities. Environmental assessment data is received from interviews with residents, property owners, property managers, and other individuals who may be associated with a property, local public records such as property tax data, from inspections of residential properties, from residential property records or other public records, and from other on-site sources such as EPA or contracted laboratories and EPA or contracted GIS systems.

The routine uses below are both related to and compatible with the original purpose for which the information was collected. The following general routine uses apply to this system (73 FR 2245):

1. The Agency, or any component thereof;

2. Any employee of the Agency in his or her official capacity;

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

4. The United States, if the Agency determines that litigation is likely to affect the Agency or any of its components,

G. Disclosure to the National Archives: Information may be disclosed to the National Archives and Records Administration in records management inspections.

The two routine uses below (L and M) are required by OMB Memorandum M–17–12.

L. Disclosure to Persons or Entities in Response to an Actual or Suspected Breach of Personally Identifiable Information: To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records, (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

These records are maintained electronically on computer storage devices such as computer tapes and disks. The computer storage devices are located at EPA, Office of Emergency Response, OLEM. Backup will be maintained at a disaster recovery site. Computer records are maintained in a secure password protected environment. Access to computer records is limited to those who have a need to know. Permission level assignments will allow users access only to those functions for which they are authorized. All records are maintained in secure, access-controlled areas or buildings.

Information may be retrieved by any collected data element, such as a resident's name or address, or information may be retrieved by GIS coordinates or by identifying numbers assigned to a person, sampling location, or residence.

Records maintained in this system are subject to record schedule 1036, which is still being finalized.

Security controls used to protect personal sensitive data in Environmental Assessments of Residential Properties are commensurate with those required for an information system rated MODERATE for confidentiality, integrity, and availability, as prescribed in National Institute of Standards and Technology (NIST) Special Publication, 800-53, "Security and Privacy Controls for Federal Information Systems and Organizations," Revision 5.

ADMINISTRATIVE SAFEGUARDS:

For documents in EPA database systems, those systems have a single point of access via a front-end Portal. All users are required to complete a new user form (signed by their supervisor) and take online security training before they are provided with access. All authorized users of the EARP application are required to take an annual security training identifying the user's role and responsibilities for protecting the Agency's information resources, as well as, consequences for not adhering to the policy. Similarly, those documents maintained on Agency computers prior to placement in EARP are protected by passwords and/or Personal Identity Verification, and all agency users are required to complete a new user form (signed by their supervisor) and take computer security training.

TECHNICAL SAFEGUARDS:

Electronic records are maintained in a secure, password protected electronic system.

PHYSICAL SAFEGUARDS:

Paper files are maintained in locked file cabinets when not in use by EPA emergency response staff. All records are maintained in secure, access-controlled areas or buildings.

Individuals seeking access to information in this system of records about themselves are required to provide adequate identification (e.g., driver’s license, military identification card, employee badge or identification card). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

None.

The original SORN for the EARP (EPA-74) was published in the Federal Register on April 21, 2016 (81 Fed. Reg. 23488-23490).

/-75

Section 608 Technician Certification Records, EPA-75

Unclassified

U.S. Environmental Protection Agency, 1200 Pennsylvania Avenue NW., Washington, DC 20460

Branch Chief, Stratospheric Program Implementation Branch, Stratospheric Protection Division, Office of Atmospheric Programs, Mail Code 6205T, 1200 Pennsylvania Avenue NW., Washington, DC 20460; email address spdcomment@epa.gov.

42 U.S.C. 7414, 7601, 7671–7671q.

The purpose of the system is to accept records from programs that withdraw or have their approval revoked from participation in the Section 608 technician certification program. The system will maintain the information necessary for EPA to assist certified air-conditioning and refrigeration technicians who have lost or damaged their certification cards in obtaining replacement cards.

EPA-certified air-conditioning and refrigeration technicians whose certifying program has withdrawn its participation in the program or had its approval revoked.

Technician name (first, last and middle initial), address, contact information (which can include address, phone number, and email address), type of certification, site of certification or location number, year of certification, certifying program-generated identification number, notes on how past requests for replacement cards were resolved, and other information provided by the technician certification program.

EPA-approved certifying programs that are withdrawing from the program or are having their approval revoked.

The use of the record is necessary for the efficient conduct of government operations; and/or the use is both related to and compatible with the original purpose for which the information was collected. Also, each routine use of the records contained in the system, including the categories of users and the purpose of such use. The last two routine uses are required in accordance with M- 17-12. Information may be provided:

1. To a federal, state, local, tribal or foreign agency if the information is relevant to a violation or potential violation of law, whether civil, criminal or regulatory in nature;

2. To the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which the Agency is authorized to appear, when: 1. The Agency, or any component thereof; 2. Any employee of the Agency in his or her official capacity; 3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or 4. The United States, if the Agency determines that litigation is likely to affect the Agency or any of its components, is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or the Agency is deemed by the Agency to be relevant and necessary to the litigation provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected;

3. To contractors, grantees, consultants or volunteers who have been engaged by the agency to assist in performing a service and who need access to the information in order to perform the service;

4. To an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics;

5. In connection with litigation or settlement discussions regarding claims by or against the Agency, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions and except where court orders are otherwise required under section (b) (11) of the Privacy Act of 1974, 5 U.S.C. 552a(b)(11);

6. To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records, (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

7. To another Federal agency or Federal entity, when the Agency determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

Electronic records will be stored in a password protected file on a computer that is not connected to the EPA network in a locked room and paper records will be stored in a locked filing cabinet in a locked room.

Records are retrieved by the person's name.

Records stored in this system are subject to EPA's records schedule 1035(d). This record retention schedule requires destruction 10 years after file closure.

Records stored at EPA offices are secured through building security protocols such as employee identification checks and security screenings for visitors. Electronic and hardcopy files will be stored at EPA headquarters in Washington DC. Electronic files can only be accessed using an EPA-issued PIV card. Access is limited to specific authorized Agency and contractor personnel who administer the program. All contractors are subject to the Federal Acquisition Regulations (FAR) Privacy Act clauses in their contract with EPA. Computer-stored information is protected in accordance with the Agency's security requirements. The system of records will be maintained as a password protected database on a computer that requires dual-factor authentication to log on to. Different levels of access (e.g., view, edit, etc.) will be assigned to personnel. Personnel that have access to the system will be trained in the handling of personally identifiable information. Paper records related to the system will be kept in locked filing cabinets within a limited access room or on a limited as-needed basis in a locked cabinet in EPA employee workspace.

Individuals can obtain assistance in obtaining a replacement technician certification card here: https://www.epa.gov/section608/steps-replacing-lost-section-608-technician-certification-card. General requests for access must be made in accordance with the procedures described in EPA's Privacy Act regulations at 40 CFR Part 16. Requesters will be required to provide adequate identification, such as a driver's license, employee identification card, or other identifying document. Additional identification procedures may be required in some instances.

Any individual who wants to know whether this system of records contains a record about him or her, who wants access to his or her record, or who wants to contest the contents of a record, should make a written request to the Agency Privacy Officer, MC 2831T, 1200 Pennsylvania Avenue NW., Washington, DC 20460.

None.

/-76 ELPG Case Management System.

Unclassified.

The paper records will be located at the EPA, Office of General Counsel, Employment Law Practice Group,1200 Pennsylvania Ave, N.W. Washington, DC 20460-0001. The electronic records will be located on servers housed in Ashburn, VA.

Associate General Counsel, Office of General Counsel, General Law Office,1200 Pennsylvania Ave NW, Mailcode 2377A, Washington, DC 20460.

Title VII of the Civil Rights Act of 1964, 42 U.S.C. § 2000e et seq. (1964); Equal Pay Act of 1963 (EPA), 29 U.S.C. § 206(d) (1963); Age Discrimination in Employment Act of 1967 (ADEA), 29 U.S.C. § 621-634 (2013); Americans with Disabilities Act of 1990 (ADA), 42 U.S.C. §§ 12101-12213 (2013) (amended 2008); Genetic Information Nondiscrimination Act of 2008 (GINA), Pub. L. No. 110-233, 122 Stat. 881; Sections 501 and 505 of the Rehabilitation Act of 1973, Pub. L. No. 93-112, 87 Stat. 355 (codified as amended in scattered sections of the 29 U.S.C and 31-41c U.S.C.); Uniformed Services Employment and Reemployment Rights of 1994, 38 U.S.C. §4301-4335 (1994); Civil Service Reform Act of 1978, Pub. L. No. 95–454, 92 Stat. 1111; Occupation Safety and Health Act of 1970, 29 U.S.C. ch. 15, §651 et seq. (1971); Whistleblower Protection Enhancement Act of 2012 (WPEA), Pub. L. No. 112-199

The ELPG-CMS will allow ELPG to track case activity, generate mandated and ad hoc reports, and provide access to a centralized case management system to ELPG personnel.

These records are maintained in ELPG-CMS to support the Agency’s Employment Law Practice Group in its efforts to track, manage, and report on employment matters, including litigation, counseling, disciplinary actions, performance actions, and investigations into allegations of workplace harassment.

Current and former EPA employees; Individuals who have filed, or had filed on their behalf, discrimination complaints against the EPA.

Position Title, Pay Plan, Occupational Series, Grade, Step, Supervisory Code, Bargaining Unit Status Code, Organizational Breakdown of Position's Location and Duty Station.

The system will also contain Adverse Action case file information regarding employee counseling for misconduct or poor performance, disciplinary actions, adverse actions, performance-based actions, performance assistance plans, performance improvement plans, reasonable accommodation requests, including medical information.

The system will also contain Office of Inspector General investigatory information regarding allegations of employee misconduct, including Reports of Investigation, Final Summary Reports, Memorandums of Interviews, Memorandum of Activity, and supporting exhibits.

The system will also contain documents created and/or submitted in anticipation of litigation, as well as during the course of litigation, including, but not limited to, Merit System Protection Board (MSPB) appeals, Equal Employment Opportunity Commission (EEOC) appeals, Department of Labor (DOL) appeals, Unemployment proceedings, Office of Special Counsel complaints, and Federal District Court proceedings.

Documents provided as part of litigation or employment law matters may include various types of information including, but not limited to, names, addresses, social security numbers, medical and/or financial information contained in pleadings, motions, exhibits, and any other documents provided to the Office of General Counsel.

Sources include Agency databases, employee personnel files, files maintained by the Office of Administration and Resources Management (OARM) Complainants, Complainant’s attorneys or representatives, witnesses, EPA investigators, EPA Office of the Inspector General, other EPA personnel, Department of Justice, EEOC Administrative Judges, MSPB Judges, DOL Administrative Law Judges, and other persons with information relevant to an employment law matter before the Agency for consideration.

EPA General routine uses A, B, C, E, F, G, H, I, J, K and L apply to this system. (73 FR 2245)

The records in the system are stored in paper files and computer databases. The computer storage devices are located at the contractor's FedRAMP approved facility in Ashburn, VA.

The system will retrieve records employee name.

Records stored in the system are subject to records schedule 1025

Paper records are maintained in lockable file cabinets in secure, access-controlled rooms, areas, of buildings. Computer records are maintained in a secure password-protected environment. Access to computer records is limited to those who have a need to know the information contained in the records. Permission-level assignments allow users access only to those functions for which they are authorized. All records are maintained in secure, access controlled areas of buildings. The system is accessed from an internet browser using the Agency's secured portal and requires a user to have an established log-in name and password.

Individuals seeking access to information in this system of records about themselves should make a written request to the Freedom of Information Act Office. Requesters are required to provide adequate identification (e.g. driver's license, military identification card, employee badge or identification card). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

Any individual who wants to know whether this system of records contains a record about him or her, who wants access to his or her record, or who wants to contest the contents of a record, should make a written request to the EPA National Privacy Program, Attn: Privacy Act Officer, WJC West, MC 2831T, 1200 Pennsylvania Ave. NW., Washington, DC 20460.

None

None.

/-78 EPA ServiceNow (SNOW), EPA-78

Unclassified

Office of Environmental Information, Environmental Protection Agency, 1301 Constitution Ave. Washington DC 20460.

SAIC Inc. 12010 Sunset Hills Road, Reston VA 20190.

Willie J. Abney, Division Director of Desktop Support Services Division (DSSD), Office of Environmental Information, Office of Information Technology Operations, 1301 Constitution Ave.Washington, DC 20460 Email Address: Abney.Willie@epa.gov Phone Number: 202-566-1366.

5 U.S.C. 301 "Departmental Regulations", 8 U.S.C 1101, 1103, 1104, 1201, 1255, 1305, 1360; 44 U.S.C. 3101 "Records Management by Federal Agency Heads."

This system will collect limited personally identifiable information (PII) from requestors (i.e. EPA employees, EPA contractors, non-EPA government personnel, state and local government personnel and/or private citizens), such as first and last name, that will help EPA technical support teams provide individualized support and other service-oriented activities in support of both internal (i.e. EPA employees, EPA contractors) and external (i.e. non-EPA government personnel, state and local government personnel and/or private citizens) requestors. EPA technical support teams will also use the information to provide support for EPA information technology (IT) systems, assets, and other service-oriented activities including the following:

● Managing service request tickets

● Retrieving incident information;

● Troubleshooting issues

● Managing IT assets

● Conveying outage information across the enterprise

All PII associated with the activities listed are only available and presented to internal (i.e. EPA employees, EPA contractors) stakeholders who have a valid need-to-know. PII captured from external requestors (i.e. non-EPA government personnel, state and local government personnel and/or private citizens) is required and only used for opening a trouble ticket on their behalf.

Categories of individuals covered by this system include EPA employees, EPA contractors, non-EPA government personnel, state and local government personnel and/or private citizens (i.e. requestors) who request technical support by directly contacting the EPA Enterprise IT Service Desk or EPA employees and contractors requesting support using ServiceNow’s self-help portal for opening support tickets, external requestors requesting trouble tickets be opened for externally facing EPA applications, EPA Enterprise IT Service Desk personnel or EPA IT System Administrators (SA) working trouble or incident tickets, and ServiceNow Administrators.

Information collected in system are First and Last Name; Work/Business Address; Date; Work Number; Work Email Address; External Email Address (for non-EPA government personnel including state and local government personnel and/or private citizens); Employee LAN ID; Employee Number.

Information contained in this system is obtained from data provided directly from EPA employees and contractors via the EPA ServiceNow self-help portal, from Enterprise IT Service Desk personnel who have received technical support calls from requestors or pre-populated fields captured from EPA Active Directory.

The following new routine uses apply to this system because the use of the record is necessary for the efficient conduct of government. The routine uses are related to and compatible with the original purpose for which the information was collected. The last two routine uses are required under OMB M-17-12. Records in this system may be disclosed to the following entities:

● Disclosure for Law Enforcement Purposes.

Information may be disclosed to the appropriate Federal, State, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity.

● Disclosure Incident to Requesting Information.

Information may be disclosed to any source from which additional information is requested (to the extent necessary to identify the individual, inform the source of the purpose of the request, and to identify the type of information requested,) when necessary to obtain information relevant to an agency decision concerning retention of an employee or other personnel action (other than hiring,) retention of a security clearance, the letting of a contract, or the issuance or retention of a grant, or other benefit.

● Disclosure to Congressional Offices.

Information may be disclosed to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of the individual.

● Disclosure to Department of Justice.

Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which the Agency is authorized to appear, when:

○ The Agency, or any component thereof;

○ Any employee of the Agency in his or her official capacity;

○ Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

○ The United States, if the Agency determines that litigation is likely to affect the Agency or any of its components, is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or the Agency is deemed by the Agency to be relevant and necessary to the litigation provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.

● Disclosure to the National Archives.

Information may be disclosed to the National Archives and Records Administration in records management inspections.

● Disclosure to Contractors, Grantees, and Others.

● Disclosures for Administrative Claims, Complaints and Appeals.

Information from this system of records may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, but are not limited to, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission, and Office of Government Ethics.

● Disclosure in Connection With Litigation.

Information from this system of records may be disclosed in connection with litigation or settlement discussions regarding claims by or against the EPA, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions and except where court orders are otherwise required under section (b)(11) of the Privacy Act of 1974, 5 U.S.C. 552a(b)(11).

● Disclosure to Persons or Entities in Response to an actual of Suspected Breach of Personally Identifiable Information.

● Disclosure to Assist Another Agency in its Efforts to Respond to a Breach

SNOW records are stored in a controlled access facility, inside of a controlled area, using self-encrypting hard drives. ServiceNow, Inc. has deployed a High-Availability architecture to ensure continuous business operations for the ServiceNow platform. There are two data centers supporting Government customers with one configured as the active and the other as the standby. The active and standby facilities are mirrored, which enables the standby to become the active site in the event of a disaster. Both data centers are mirrors of each other, and therefore they act as both an active and a standby facility. In addition to the mirror backup between the two instances, a local backup is kept at each site. Each local backup acts as the offsite backup for their counterpart dedicated data center cage. Backups are performed on disk through network-attached storage and are never written to tape. In addition to backups within each dedicated data center cage facility, a backup of each internal production instance is copied over to the standby site (Disaster Recovery site).

Records for EPA ServiceNow will be retrieved by customer first and last name, email address or by ticket reference number.

SNOW follows the EPA Records Policy for retention and disposal, per schedule 1012 (Information and Technology Management) and schedule 1049 (Information Access and Protection Records). https://www.epa.gov/records/epa-records-policy-and-guidance

ServiceNow is a Cloud-Based Software as a Service (SaaS) solution designed to be accessed over the internet. As such, all remote communication must be encrypted, use for non-business purposes is prohibited and all users are required to be authorized. To verify that a user is authorized, EPA ServiceNow customers and staff must have a current valid EPA Active Directory account. External requestors (i.e. non-EPA government personnel, state and local government personnel and/or private citizens) will not have access to, as they are not authorized, nor will be granted access to EPA ServiceNow. The records in EPA ServiceNow are maintained in a secure, password-protected computer system behind a network firewall. This system is located in a controlled facility that requires the ServiceNow cloud providers to have an authorized badge and biometrics prior to accessing the data centers. ServiceNow users must log in with an authorized user ID and password or Personal Identity Verification (PIV) card to access the system. Group or shared accounts are not used by EPA ServiceNow customers and support personnel. EPA ServiceNow customers and personnel are prohibited from sharing accounts. Each user has a unique identifier within Active Directory used for authentication. In addition to the lock screen setting enforced by EPA on the desktop, EPA ServiceNow implements session timeout period after 30 minutes of user inactivity.

Individuals seeking access to information in this system of records about themselves should make a written request to the Agency Privacy Officer, 1200 Pennsylvania Ave, Mailcode 2831T, Washington, DC 20460. Requesters are required to provide adequate identification (e.g. driver's license, military identification card, employee badge or identification card). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

Requests for correction or amendment must identify the record to be changed and the corrective action sought to the Agency Privacy Officer, 1200 Pennsylvania Ave, Mailcode 2831T, Washington, DC 20460; privacy@epa.gov. Complete EPA Privacy Act procedures are set out in EPA’s Privacy Act regulations at 40 CFR Part 16.

Any individual who wants to know whether this system of records contains a record about themselves should submit a request to the Agency Privacy Officer, MC 2831T, 1200 Pennsylvania Avenue, NW., Washington, DC 20460 or privacy@epa.gov

None

/-79 NEIC Master Tracking System (MTS), EPA-79

Unclassified

National Enforcement Investigations Center, Office of Criminal Enforcement, Forensics & Training, Environmental Protection Agency, Denver Federal Center, 6th and Kipling, Building 25, Denver, Colorado 80225.

Michael Roach, EPA National Enforcement Investigations Center, Denver Federal Center, 6th and Kipling, Building 25, Denver CO 80225; Roach.Michael@epa.gov; (303) 462-9080

Powers of Environmental Protection Agency, 18 U.S.C. 3063; Comprehensive Environmental Response Compensation and Liability Act , 42 U.S.C. 9603; Resource Conservation and Recovery Act, 42 U.S.C. 6928; Clean Water Act, 33 U.S.C. 1319, 1321; Toxic Substances Control Act, 15 U.S.C. 2614, 2615; Clean Air Act, 42 U.S.C. 7413; Federal Insecticide, Fungicide and Rodenticide Act, 7 U.S.C. 136j, 136l; Safe Drinking Water Act, 42 U.S.C. 300h-2, 300i-1; Emergency Planning and Community Right-To-Know Act of 1986, 42 U.S.C. 11045; and the Marine Protection, Research, and Sanctuaries Act of 1972, 33 U.S.C. 1415.

To support, further, and document criminal and civil investigations of persons or organizations alleged to have violated any federal environmental statute or regulation or, pursuant to a cooperative agreement with a state, local, or tribal authority, an environmental statute or regulation of such authority. NEIC MTS is used to maintain information related to such investigative efforts, including the nature of work, investigation outcomes, required resources, and information about the supporting staff. NEIC MTS is used to record, monitor, and manage enforcement case-related activities performed in the office, field, and laboratory. NEIC MTS is also used to manage project files.

Any person who is the subject of a criminal or civil investigation concerning violations of federal environmental statutes and regulations (or state, tribal or local environmental statutes and regulations, pursuant to a cooperative agreement with a state, tribal or local authority); any person who provides information and evidence that is used to substantiate criminal or civil environmental violations; any third parties identified by persons providing information or evidence that is used to substantiate criminal or civil environmental violations; and EPA or other federal, state or local government personnel, or government contractors that perform field and analytical work or otherwise assist in an investigation.

A. Computer Indexes. NEIC MTS includes systems for internal tracking and management of NEIC environmental enforcement technical support projects, including: a description of the project; a schedule of project milestones; the current project status; a listing of personnel working on the project; and the environmental statutes at issue. These indexes include: enforcement data such as planned dates for search warrants or facility inspections; types of sampling or analyses to be conducted; and any other work done to support a project. The indexes also serve as the computerized management information system for NEIC and contain information on the activity and productivity of individual employees as well as the organization. NEIC MTS’s indexes are organized according to project number and project name. NEIC assigns project numbers sequentially by project type (i.e., civil, criminal). NEIC assigns project names by either the name of an entity or an individual, the choice of which depends upon the nature of the violation(s) or type of NEIC support activity. NEIC MTS’s indexes can include the following EPA employee/contractor information: first name, last name, local area network (LAN) identification (ID), personal phone number(s), and personal email address(es). The indexes can include the following investigatory subject information: first name, last name, and location (city and state).

B. Project Files. Documentary information relating to a given enforcement matter, including: correspondence (case coordination reports, memos of conversation, and other records of communication relating to the matter); witness interviews (on-site statements of interviews generated either by an NEIC investigator or another agency or person); regulatory history (permits and reports generated as a result of normal program activity); technical support (project reports generated as a result of the investigation); inspection notes; financial information; sampling and laboratory notes; and other related investigative information. Project files can include first name and/or last name of the EPA employee/contractor, federal, state, local, and/or tribal investigator. Project files can include the following categories of information on the investigatory subject: first name, last name, home address, personal telephone number(s), and personal email address(es).

EPA employees and officials; employees of federal contractors; employees of other federal, state, local, tribal, or foreign agencies; personnel of companies/corporations under investigation; databases maintained by EPA; databases maintained by other federal, state, local, tribal, or foreign agencies; databases maintained by companies/corporations under investigation; witnesses; informants; public source materials; and other persons who may have information relevant to OCEFT/NEIC investigations.

The routine uses below are both related to and compatible with the original purpose for which the information was collected. The following general routine uses apply to this system (73 FR 2245):

Disclosure for Law Enforcement Purposes. Information may be disclosed to the appropriate federal, state, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity.

Disclosure to Requesting Agency. Disclosure may be made to a federal, state, local, foreign, or tribal or other public authority of the fact that this system of records contains information relevant to the retention of an employee; the retention of a security clearance; the letting of a contract; or the issuance or retention of a license, grant, or other benefit. The other agency or licensing organization may then make a request supported by the written consent of the individual for the entire record if it so chooses. No disclosure will be made unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another federal agency for criminal, civil, administrative, personnel, or regulatory action.

1. The Agency, or any component thereof,

2. Any employee of the Agency in his or her official capacity,

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

G. Disclosure to the National Archives. Information may be disclosed to the National Archives and Records Administration in records management inspections.

The two routine uses below (L and M) are required by OMB Memorandum M-17-12.

L. Disclosure to Persons or Entities in Response to an actual or Suspected Breach of Personally Identifiable Information. Information from this system of records may be disclosed to appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records, (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

Hard copy records are stored in file folders labeled with the NEIC project number and project name. The project name can be an entity or an individual. Computer indexes and electronic files are stored on secure, password-protected network drives. They are labeled with the NEIC project number and project name.

Project files are assigned a project number and project name, and records are maintained in numerical order. Records are primarily retrieved by project name; the project number is the secondary retrieval method. Electronic records also may be retrieved by using key words or phrases, which can include an entity’s name, individual person’s name, and/or location (city and state).

Administrative data from the system are retained according to EPA Records Schedule 1006. Project files are closed when discontinued, superseded, or canceled, or when no longer needed for current agency business, and destroyed 6 years after closure. Project files relating to investigations are retained according to EPA Records Schedule 1044, Compliance and Enforcement. Closed project files are retained no less than 2 years and no more than 5 years on site. Project files are destroyed by the Federal Records Center no less than 5 years and no more than 20 years after the closing date, depending on case status. Project files classified as permanent records are transferred from the Federal Records Center to the National Archives from 15-18 years after the closing date, depending on the media.

Security controls used to protect personal sensitive data in NEIC MTS are commensurate with those required for an information system rated MODERATE for confidentiality, integrity, and availability, as prescribed in National Institute of Standards and Technology (NIST) Special Publication, 800-53, "Security and Privacy Controls for Information Systems and Organizations," Revision 5.

1. Administrative Safeguards: EPA personnel are required to complete annual agency Information Security and Privacy training. EPA personnel are instructed to lock their computers when they leave their desks.

2. Technical Safeguards: Computer records are maintained in a secure, password-protected computer system. NEIC MTS access is limited to authorized, authenticated users. Access is restricted to those individuals and managers with an official need for information on a project. Security measures control user access and privileges to the computer databases at the server, file system, and database level.

3. Physical Safeguards: Paper records are maintained in lockable offices, file cabinets or in a staffed and/or access-controlled central records repository. All records are maintained in secure, access-controlled areas or buildings.

Pursuant to 5 U.S.C. 552a(j)(2) and (k)(2), certain records maintained in NEIC MTS are exempt from specific access and accounting provisions of the Privacy Act. See 40 CFR 16.11 and 16.12. However, EPA may, in its discretion, grant individual requests for access if it determines that the exercise of these rights will not interfere with an interest that the exemption is intended to protect. Requests for access must be made in accordance with the procedures described in EPA’s Privacy Act regulations at 40 CFR part 16.

Pursuant to 5 U.S.C. 552a(j)(2) and (k)(2), certain records maintained in NEIC MTS are exempt from specific correction and amendment provisions of the Privacy Act. However, EPA may, in its discretion, grant individual requests for correction or amendment if it determines that the exercise of these rights will not interfere with an interest that the exemption is intended to protect. Requests for correction or amendment must identify the record to be changed and the corrective action sought, and must be made in accordance with the procedures described in EPA’s Privacy Act regulations at 40 CFR part 16.

Individuals who wish to be informed whether a Privacy Act system of records maintained by EPA contains any record pertaining to them, should make a written request to the EPA Attn: Agency Privacy Officer, MC 2831T, 1200 Pennsylvania Ave., NW, Washington, D.C. 20460, or by email at privacy@epa.gov.

For those records within the system collected and maintained pursuant to the Federal Rules of Civil Procedure (FRCP) and/or for the purpose of civil discovery, action or proceeding, 5 U.S.C. 552a(d)(5) will apply, stating that "nothing in this [Act] shall allow an individual access to any information compiled in reasonable anticipation of a civil action or proceeding." In addition, pursuant to 5 U.S.C. 552a(k)(2), this system is exempt from the following provisions of the Privacy Act, subject to the limitations set forth in that subsection : 5 U.S.C. 552a(c)(3), (d), (e)(1), (e)(4)(G), (e)(4)(H), and (f)(2) through (5). Finally, pursuant to 5 U.S.C. 552a(j)(2), when records are contained in this system related to criminal enforcement, those records are exempt from the following provisions of the Privacy Act, subject to the limitations set forth in that subsection : 5 U.S.C. 552a(c)(3) and (4); (d); (e)(1), (e)(2), (e)(3), (e)(4)(G), (e)(4)(H), (e)(5) and (e)(8); (f)(2) through (5); and (g). See 40 CFR 16.11 and 16.12.

66 FR 49947 – October 1, 2001 - Creation of the OCEFT/NEIC Master Tracking System of Records (EPA-46)

78 FR 40737 - July 8, 2013 - Notification of Deletion of System of Records; Office of Criminal Enforcement, Forensics & Training, National Enforcement Investigations Center, Master Tracking System (EPA-46)

/-80 iComplaints EEO Case Management System (ICOM) EPA-80

Unclassified

Office of Civil Rights, US EPA, 1200 Pennsylvania Ave., NW., Washington, DC 20004.

Vicki Simons, Director, Office of Civil Rights, US EPA, 1200 Pennsylvania Ave., NW., Washington, DC 20004, (202) 564-7272 or simmons.vicki@epa.gov.

Section 717 of the Civil Rights Act of 1964, as amended, 42 U.S.C. 2000e-16; Executive Order 11748; and Section 501 of the Rehabilitation Act of 1973, as amended by Pub. L. 99-506, 100 Stat. 1807, October 21, 1986, EEOC Management Directives 110 and 715.

The primary purpose of the ICOM system is to maintain all EPA Equal Employment Opportunity discrimination complaints and subsequent reports, as required by the EEOC, in accordance with Title VII of the Civil Rights Act of 1964 (Title VII), as amended, 42 U.S.C. 2000e et seq., 29 CFR 1614.101 through 1614.110 and EEOC Management Directive 110. The information collected will be used in complaint investigations, as required by the EEOC. The EEOC requires federal agencies to process complaints of discrimination raised by employees or applicants for employment. The documentation received for processing these complaints will contain personally identifiable information (PII) which will be housed in ICOM

Employees of the United States Environmental Protection Agency and applicants for employment.

This system contains general human resources elements and contact information which includes Employee ID; Name; Home Address; Work Address; E-mail Address; Telephone Number; Series, Grade; Step, Salary; Target Grade; Management Level; Supervisor Level; Base Pay; Work Schedule; Fair Labor Standards Act; Union,; Position; Title; Sex; Disability; Age; Education Level; Academic Discipline; Veteran Status; Veteran preferences; Citizenship; Date Entered in Current Grade; Month–in-Grade; Service Completion Date; and Years-in-Service; Race; National Origin; Disability Status.

Employee, Supervisor or Applicant

The following new or modified routine uses apply to this system because the use of the record is necessary for the efficient conduct of government. The routine uses are related to and compatible with the original purpose for which the information was collected. The last two routine uses are required under OMB M-17-12.

1) Disclosure to Congressional Offices

Information may be disclosed to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of the individual.

2) Disclosure to Contractors, Grantees, and Others

Information may be disclosed to contractors, grantees, consultants, or volunteers performing or working on a contract, service, grant, cooperative agreement, job, or other activity for the Agency and who have a need to have access to the information in the performance of their duties or activities for the Agency. When appropriate, recipients will be required to comply with the requirements of the Privacy Act of 1974 as provided in 5 U.S.C. 552a(m).

3) Disclosures for Administrative Claims, Complaints and Appeals

4) Disclosure in Connection with Litigation

Information from this system of records may be disclosed in connection with litigation or settlement discussions regarding claims by or against the Agency, including public filing with a court, to the extent that disclosure of the information is relevant and necessary to the litigation or discussions and except where court orders are otherwise required under section (b)(11) of the Privacy Act of 1974, 5 U.S.C. 552a(b)(11).

5) Disclosure to Persons or Entities in Response to an Actual of Suspected Breach of Personally Identifiable Information.

6) Disclosure to assist another agency in its efforts to respond to a breach.

The paper records are maintained in locked file cabinets inside of a locked office located in the Office of Civil Rights, 1200 Pennsylvania Ave., NW, Washington, DC 20004. Users access the electronic records via the internet. All of the logic and processing functionality of ICOM resides on one or more central servers, with users accessing ICOM from Web browsers.

These records are retrieved by the individual’s/employees’ name.

Records stored in this system are subject to EPA records schedule number (EPA 0541)

•Computer-stored information is protected in accordance with the Agency’s security requirements.

•Access to the ICOM is limited to authorized and licensed users only. Access is granted via internet browser using uniquely assigned user identification and password. Only computers from approved IP addresses can access the database where ICOM records are stored. User access is granted in accordance with a role matrix that allows access to only those records necessary for approved Agency employee to conduct the necessary activities associated with processing an EEO complaint.

•The ICOM contractor is subject to the Federal Acquisition Regulations (FAR) Privacy Act clauses in its contract with EPA.

•ICOM servers are housed in a locked facility in a locked room requiring appropriate identification and biometrics to enter.

•Paper ICOM records are stored in locked file cabinets in a locked office. Only OCR staff with the appropriate security clearance and specific job function of processing EEO complaints has keys to access the paper records.

Individuals seeking access to information in this system of records about themselves are required to provide adequate identification (e.g. driver’s license, military identification card, employee badge or identification card). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

Any individual who wants to know whether this system of records contains a record about him or her, who wants access to his or her record, or who wants to contest the contents of a record, should make a written request to the Attn: Agency Privacy Officer, MC 2831T, 1200 Pennsylvania Ave., NW., Washington, D.C. 20460, privacy@epa.gov

None.

/-82

Online Library System (OLS) – EPA-82

Unclassified.

OLS is owned by the Office of Mission Support (OMS) and hosted at the EPA’s National Computer Center at Research Triangle Park, NC. OMS Headquarters is located at Environmental Protection Agency (EPA), 1301 Constitution Ave. NW, Washington, DC 20460. The EPA’s National Computer Center is at 109 Alexander Drive, Research Triangle Park, NC 27709.

Deborah Balsamo, National Program Manager, OMS, Office of Enterprise Information Programs, 109 T.W. Alexander Dr., Research Triangle Park, NC 27709, Mail code N127-05; balsamo.deborah@epa.gov; (919)541-9412.

5 USC 301 "Departmental Regulations," 44 USC 3101 "Records Management by Federal Agency Heads."

OLS is the data management system that serves to enable and enhance operations of the libraries in the EPA National Library Network.

Individuals who register to borrow materials from the Library can be EPA employees, EPA contractors, and non-EPA individuals.

Circulation data consists of descriptive information about the library materials each patron has requested. Patron data consists of category (EPA employee, contractor, general public), name, optional address, email address, and optional phone number (for EPA staff and contractors these data consist only of work address, work email, work phone number, EPA office, and project officer (for contractors)).

The information for establishing a patron record in the Circulation module is obtained from the patron themselves and entered into the system by authorized library staff. There are three mandatory fields (name, email, office/division). If a requestor does not have an office the librarian can enter (N/A or none).

The following routine uses apply to this system because the use of the record is necessary for the efficient conduct of government operations. The routine uses are related to and compatible with the original purpose for which the information was collected. The last two routine uses are required under OMB M-17-12.

Disclosure for Law Enforcement Purposes

Information may be disclosed to the appropriate Federal, State, local, tribal or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity.

B. Disclosure Incident to Requesting Information

Information may be disclosed to any source from which additional information is requested (to the extent necessary to identify the individual, inform the source of the purpose of the request, and to identify the type of information requested) when necessary to obtain information relevant to an agency decision concerning retention of an employee or other personnel action (other than hiring) retention of a security clearance, the letting of a contract, or the issuance or retention of a grant, or other benefit.

C. Disclosure to Requesting Agency

Disclosure may be made to a Federal, State, local, foreign, or tribal or other public authority of the fact that this system of records contains information relevant to the retention of an employee, the retention of a security clearance, the letting of a contract, or the issuance or retention of a license, grant, or other benefit. The other agency or licensing organization may then make a request supported by the written consent of the individual for the entire record if it so chooses. No disclosure will be made unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another Federal agency for criminal, civil, administrative, personnel, or regulatory action.

D. Disclosure to Office of Management and Budget

Information may be disclosed to the Office of Management and Budget at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A-19.

E. Disclosure to Congressional Offices

Information may be disclosed to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of the individual.

F. Disclosure to Department of Justice

Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which the Agency is authorized to appear when:

The Agency, or any component thereof;

Any employee of the Agency in his or her official capacity;

Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

The United States, if the Agency determines that litigation is likely to affect the Agency or any of its components, is a party to ligation or has an interest in such litigation, and the use of such records by the Department of Justice or the Agency is deemed by the Agency to be relevant and necessary to the litigation provided, however, that in each case it has been determined that the disclosure is compatible with the purpose for which the records were collected.

G. Disclosure to the National Archives

Information may be disclosed to the National Archives and Records Administration in records management inspections.

H. Disclosure to Contractors, Grantees, and Others

Information may be disclosed to EPA employees, contractors, grantees, consultants, or volunteers performing or working on a contract, service, grant, cooperative agreement, job or other activity for the Agency and who have a need to have access to the information in the performance of their duties or activities for the Agency. When appropriate, recipients will be required to comply with the requirement of the Privacy Act of 1974, as provided in 5 USC 552a(m).

I. Disclosures for Administrative Claims, Complaints and Appeals

J. Disclosure to the Office of Personnel Management

Information from this system of records may be disclosed to the Office of Personnel Management pursuant to that agency’s responsibility for evaluation and oversight of Federal personnel management.

K. Disclosure in Connection with Litigation

L. Disclosure to Persons or Entities in Response to an Actual of Suspected Breach of Personally Identifiable Information

To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records; (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

M. Disclosure to Assist Another Agency In Its Efforts To Respond To A Breach.

These records are maintained electronically on secure password protected servers. The secure servers and storage system reside in the National Computer Center’s second floor computer room, 109 T.W. Alexander Drive, Research Triangle Park, NC 27709. Backups reside on a backup disk-based appliance and are replicated daily to an EPA-approved offsite location at Room S4730, 2777 Crystal Drive, Arlington, VA 22202.

Records are retrieved by patron’s first and last name, email address, and system-generated unique patron ID. Records are only retrievable by authorized library employees (who are EPA employees and contractors). These authorized library employees may only access patron data for the library at which the library employee works. The OLS Database Administrator, a library contractor, has access to all records in the OLS system and its modules.

EPA will retain and dispose of these records in accordance with the National Archives and Records Administration General Records Schedule. OMS has established EPA record schedule 0088 for OLS. Records will be deleted or destroyed when the Agency determines they are no longer needed for administrative, legal, audit, or other purposes. The schedule provides disposal authorization for electronic files and hard copy printouts created to monitor system usage, including log-in files, audit trail files, and system usage files. EPA will delete or destroy records when it determines they are no longer needed for administrative, legal, audit, or other purposes.

EPA uses security controls to protect PII/Privacy Act information in OLS commensurate with controls required for an information system rated moderate for confidentiality, integrity, and availability, as prescribed in NIST Special Publication, 800-53, "Recommended Security Controls for Federal Information Systems," Revision 4.

Administrative Safeguards:

EPA employees and contractors must complete annual agency training for Information Security and Privacy. EPA instructs contractors and employees to lock and secure their computers when unattended.

Technical Safeguards:

The OLS Database Administrator, a library contractor, establishes authorized library employees upon request of the local library manager (EPA staff). Permission level assignments allow authorized users to access only those functions and records specific to the module they are using and their local library. EPA also has technical security measures including restrictions on computer access to authorized individuals and required use of a personal identity verification (PIV) card and password.

Physical Safeguards:

EPA equipment used for OLS is located in a secure area of the National Computer Center, 109 T.W. Alexander Drive, Research Triangle Park, NC 27709.

EPA requires individuals seeking access to information in this system of records about themselves to provide adequate identification documentation (e.g., driver’s license, military identification card, employee badge or identification card). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

Any individual who requests correction or amendment of OLS records must identify the record to be changed and the corrective action sought. Complete EPA Privacy Act procedures are described in EPA’s Privacy Act regulations at 40 CFR part 16.

Any individual who wishes to know whether this system of records contains a record about themselves, and to obtain a copy of any such record(s), should make a written request to the Attn: Agency Privacy Officer, MC 2831T, 1200 Pennsylvania Ave., NW, Washington, D.C. 20460, privacy@epa.gov.

None

/-83

Personnel Security System (PSS) 2.0 – EPA-83

Unclassified.

National Computer Center (NCC), 109 TW Alexander Drive, Research Triangle Park, Durham, NC 27711.

Jon Ross, Security Management Division, Environmental Protection Agency, William Jefferson Clinton North Building, Mailcode 3206A, 1200 Pennsylvania Avenue, N.W., Washington, DC 20460; telephone number, (202) 564-6153; e-mail address, Ross.Jon@epa.gov.

5 U.S.C. 301; Federal Information Security Modernization Act (Pub. L. 104-106, sec. 5113); Electronic Government Act (Pub. L. 104-347, sec. 203); the Paperwork Reduction Act of 1995 (44 U.S.C. 3501); and the Government Paperwork Elimination Act (Pub. L. 105-277, 44 U.S.C. 3504); Federal Property and Administrative Act of 1949, as amended.

The purpose of the Personnel Security System is to assist the members of the Security Management Division with tracking the documentation associated with background investigations for potential and current Federal and non-Federal personnel working for EPA.

Individuals who require access to EPA-controlled facilities, information technology systems, or information classified in the interest of national security, including applicants for employment or to work on a contract, grant etc. Federal employees, contractors, grantees, students, interns, volunteers, other non-Federal employees and individuals formerly in any of these positions. The system does not apply to occasional visitors or short-term guests to whom the Agency will issue temporary identification.

Employee name, social security number (SSN), date and place of birth, organization, office and home addresses, office and home and cell phone, job series, pay grade, previous employments, overseas travel, military service, credit information, fingerprint results, OPM’s background investigation reports, driver’s license information, passport information, photograph, emergency contact, foreign passport, foreign travel, foreign involvement, foreign contacts, ownership of foreign property, foreign bank accounts and arrests in foreign countries.

The sources of data within PSS 2.0 are from internal EPA systems such as the Human Resources Line of Business (HRLoB) and the General Service Administration (GSA) external system, USAccess, and from external sources such as vendors, applicants and onboard personnel. The HRLoB SORN is EPA-1 and the USAccess SORN is GSA/GOVT-7.

The following routine uses are both related to and compatible with the original purpose for which the information was collected. General routine uses A, B, C, D E, F, G, H, I, J, and K apply to this system (73 Fed Reg 2245). In addition, the two routine uses below (L and M) are required by M-17-12.

L. Disclosure to Persons or Entities in Response to an Actual or Suspected Breach of Personally Identifiable Information. To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records, (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

M. Disclosure to assist another agency in its efforts to respond to a breach. To another Federal agency or Federal entity, when the Agency determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

The information collected within PSS 2.0 is maintained and stored in the database located at NCC. These records are maintained electronically on computer storage devices such as computer tapes and disks. Backup will be maintained at a disaster recovery site. Computer records are maintained in a secure password protected environment. Access to computer records is limited to those who have a need to know. Permission level assignments will allow users access only to those functions for which they are authorized. All records are maintained in secure, access-controlled areas or buildings.

Personal information will be retrieved by SSN, name, date of birth, email address, personal identification number or background investigation case number.

Records are retained and disposed of in accordance with NARA records retention schedules appropriate to the retention of background investigation related data, as well as EPA's Records Schedule 1008.

Security controls used to protect personal sensitive data in PSS 2.0 are commensurate with those required for an information system rated MODERATE for confidentiality, integrity, and availability, as prescribed in NIST Special Publication, 800-53, "Recommended Security Controls for Federal Information Systems," Revision 4.

Administrative Safeguards:

Access to PSS 2.0 requires two-factor authentication accomplished by using Personal Identity Verification (PIV) cards that are issued to all personnel based on the requirements of Homeland Security Presidential Directive 12 (HSPD 12).

When a user is logged into PSS 2.0, they are asked by the system to confirm that they still want to remain logged in. If there is no response, or after 15 minutes of inactivity, the user is automatically logged out of the system. Personnel are instructed to lock their computer when they leave their desks. Personnel receive annual Privacy Act awareness training and are regularly reminded about appropriate SPII and PII handling procedures.

In addition to the agency’s Rules of Behavior and Privacy Act training that personnel undergo, PSS users are required to sign a PSS-specific Rules of Behavior document prior to their access being granted to the system.

Contracting Officer’s Representatives (CORs) will be receiving SPII / PII as a normal part of their operations. The COR’s user guide provides confirmation of how SPII / PII should be handled, and the following is an excerpt of that guide:

"BE AWARE THAT YOU ARE HANDLING SENSITIVE PERSONALLY IDENTIFIABLE INFORMATION (SPII) and need to do so under the following guidelines, which will help prevent privacy breaches by ensuring the COR, who has a need to know the information, is the only individual to see the PII/SPII:

•The COR will instruct the vendor to send the requested information (name, email address, SSN) by email with the COR as the only EPA email recipient.

•The COR will enter the information into PSS 2.0 and will then delete the email.

•To properly delete the email, press the Shift key and the Delete key at the same time – this will fully remove the email, so it isn’t even in the Deleted Items folder.

•If the COR replies to the email, the COR will ensure that all SPII and PII in their email response is removed prior to hitting Send.

•The COR will not save or print the email in any form.

•The COR will not forward the email to others."

Technical Safeguards:

Access to the data is strictly controlled and is limited to those with an operational need to access the information. Access is granted and managed by PSS 2.0 Administrators. A "least-privilege" role-based access system is employed that restricts access to data on a "need-to-know" basis; access to the data is limited to those with an operational need to access the information. Additionally, all web-based access to the application requires multi-factor authentication.

Physical Safeguards:

EPA employees and contractors involved in the management, design, development, implementation and execution of the program will have monitored access to the application. Only individuals who have the proper authorization and who perform functions related to PSS 2.0 are allowed to access any information. Entry to the EPA facility and within the facility to specific spaces at the NCC is achieved using HSPD-12 PIV cards on door readers. PIV cards are only issued to personnel who have met EPA’s initial security screening requirements. Security Guards at all entrances confirm that the PIV card is valid, unexpired and reflects the identity of the card holder. Entry to the server rooms is only available to personnel using their PIV cards on door readers, where those personnel have been approved for elevated access (meaning they have undergone a more rigorous security screening). The NCC maintains an Access Control List to ensure access to server rooms is limited to approved personnel only.

Any individual who wants access to his or her record, should make a written request to the EPA Attn: Privacy Officer, MC2831T, 1200 Pennsylvania Avenue, N.W., Washington, DC 20460.

Any individual who wants to know whether this system of records contains a record about him or her, should make a written request to the EPA, Attn: Privacy Officer, MC2831T, 1200 Pennsylvania Avenue, NW., Washington, DC 20460.

Under 5 U.S.C. 552a(k)(1), (k)(2), and (k)(5), the Personnel Security System is exempt from the following provisions of the Privacy Act of 1974 as amended, subject to the limitations set forth in this subsection ; 5 U.S.C. 552a(c)(3); (d)(2), (d)(3), and (d)(4); (e)(1), and (f)(2) through (5). Although the Personnel Security System has been exempted, EPA may, in its discretion, fully grant individual requests for access and correction if it determines that the exercise of these rights will not interfere with an interest that the exemption is intended to protect.

The security files were previously covered under Office of Administrative Services Information System (OASIS) EPA 41 Federal Register (FR) Volume 71, Number 169, FR DOC No: 06-7319 until 2019 and is being transferred to this existing PSS 2.0 SORN to include all exemptions and provisions.

/-84

Talent Enterprise Diagnostic (TED), EPA-84

Unclassified.

Office of Human Resources, U.S. Environmental Protection Agency, 1200 Pennsylvania Avenue, NW., Washington, DC 20460.

Mara Kamen, kamen.mara@epa.gov, 202-564-7159, Director, Office of Human Resources, U.S. Environmental Protection Agency, 1200 Pennsylvania Avenue, NW., Washington, DC 20460.

5 U.S. Code 1401 (Establishment of Agency Chief Human Capital Officers); 5 U.S.C. 1402 (a)(2), (b)(1), (b)(2) (Authority and functions of Agency Chief Human Capital Officers, as it applies to identifying and closing competency gaps): 5 CFR 250.203 (b)(1) and (b)(3); and 5 CFR 250.204 (a)(3).

To monitor, address, report and track government-wide and Agency-specific skill gaps within mission critical occupations as required under 5 CFR 250 through a Microsoft O365 SharePoint-based application. To share data resulting from these competency assessments with Agency senior leaders and management for the purpose of developing strategies to close competency gaps.

EPA employees, and their supervisors or managers.

Name of supervisor, randomized SharePoint incumbent ID number, first and last name of employee, pay plan, grade, location, occupational series, organization to which the position is assigned, occupational series, role, name of competency and the proficiency level required for each position, name of competency and the proficiency level required for each incumbent in each position.

The sources of information include: (1) data pulled from EPA’s personnel and payroll system (IBC/OBIEE); and (2) EPA supervisors’ assessments of: (a) the skills proficiency levels required of each position under the supervisor’s immediate chain of command; and (b) assessments of the skills proficiency levels of each incumbent occupying those positions.

The routine uses for this system are compatible with the purpose for which their records are collected. The information may be disclosed to and for the following EPA General Routine Uses: A, B, C, D, E, F, G, H, I, J, and K apply to this system. Routine uses L, and M are required in accordance with OMB- M-17-12.

A. Disclosure for Law Enforcement Purposes:

Disclosure Incident to Requesting Information:

Information may be disclosed to any source from which additional information is requested (to the extent necessary to identify the individual, inform the source of the purpose of the request, and to identify the type of information requested,) when necessary to obtain information relevant to an Agency decision concerning retention of an employee or other personnel action (other than hiring,) retention of a security clearance, the letting of a contract, or the issuance or retention of a grant, or other benefit.

Disclosure to Requesting Agency:

Disclosure to Office of Management and Budget:

Disclosure to Congressional Offices:

Information may be disclosed to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of the individual.

Disclosure to Department of Justice:

Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which the Agency is authorized to appear, when:

1. The Agency, or any component thereof;

2. Any employee of the Agency in his or her official capacity;

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

G. Disclosure to the National Archives:

Information may be disclosed to the National Archives and Records Administration in records management inspections.

H. Disclosure to Contractors, Grantees, and Others:

Disclosures for Administrative Claims, Complaints and Appeals:

Disclosure to the Office of Personnel Management:

Information from this system of records may be disclosed to the Office of Personnel Management pursuant to that agency's responsibility for evaluation and oversight of Federal personnel management.

Disclosure in Connection With Litigation:

Disclosure to Persons or Entities in Response to an Actual or Suspected Breach of Personally Identifiable Information:

Disclosure to assist another agency in its efforts to respond to a breach:

These records are maintained electronically on computer storage devices such as computer tapes and disks. The records are also stored on the access restricted TED SharePoint site. Electronic files are labeled with within TED according to the randomly generated ID number.

EPA will retrieve records by first and last name of employee, pay plan, grade or level, location, series, organization to which the position is assigned and occupational series/family. Designated points of contact can request organization-level, Excel-based reports from the TED Program Managers with results of incumbent and position assessments, which might include the names of individuals. The reports are accessed via SharePoint through a password-restricted system.

Information in TED and the data which is downloaded into Excel spreadsheets will be destroyed when 3 years old, or 3 years after superseded or obsolete, whichever is appropriate, but longer retention is authorized if required for business use. Information stored in TED falls under EPA’s Records Control Schedule 1029 (Employee Training Program Records).

Security controls used to protect personally identifiable information in TED are commensurate with those required for an information system rated moderate for confidentiality, integrity, and availability, as prescribed in NIST Special Publication, 800-53, "Recommended Security Controls for Federal Information Systems," Revision 4.

Administrative Safeguards. EPA implements role-based access controls. TED has three permission level assignments which will allow users access only to those functions for which they are authorized: Owners, Members and Visitors. The TED Owners (Contractor, TED Program Managers and OHR managers) have full control of the system. The TED Owners can give access to TED Members (managers and supervisors) so that they can claim employees and complete the assessments. The third group, the TED Visitors, is anyone who can access EPA’s SharePoint and know how to find the landing page. In addition, EPA personnel are required to complete annual Agency Information Security and Privacy training. EPA personnel are instructed to lock their computers when they leave their desks.

Technical Safeguards. Computer records are maintained in a secure, password-protected computer system. TED access is restricted to authorized, authenticated users. In addition, users are required to have strong passwords that are frequently changed. The Agency uses encryption for transmitting organization-level reports, and regularly reviews security procedures and best practices to enhance security.

Physical Safeguards. All records are maintained in secure, access-controlled areas or buildings. Backups will be maintained at a disaster recovery site.

Individuals seeking access to information in this system of records about themselves are required to provide adequate identification (e.g., driver’s license, military identification card, employee badge or identification card). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

None.

/-85

Fleet Access (FA) - EPA - 85

Unclassified.

AgileFleet (Fleet Access Service Provider): 14101 Willard Rd., Suite A, Chantilly, VA 20151, AgileFleet (Fleet Access Datacenter): 600 West 7th Street Los Angeles CA, 900021, System Managers: 1200 Pennsylvania Ave., NW., Washington, DC 20460,

James Cunningham, IT Project Manager, 1200 Pennsylvania Ave., NW., Washington, DC 20460 Mail code 3101M, cunningham.james@epa.gov, 202-564-7212

40 U.S.C. 175 – Federal Motor Vehicle Expenditure Control; Sections 15301 and 15302 of the Consolidated Omnibus Budget Reconciliation Act of 1986 (Pub. L. No. 99-272) (40 U.S.C. Sec. 17502 and 17503); and General Services Administration (GSA) FMR B-15.

Fleet Access (FA) is a contractor owned and operated system used by EPA to comply with the General Services Administration (GSA) FMR B-15 requirement that each federal agency store and maintain vehicle asset data collected in a Fleet Management Information System (FMIS). The FA system serves two primary purposes: First, to store vehicle level data such as license plate, VIN, make, model, acquisition value/lease rates, designations regarding alternative fuel, energy and sustainability mandates. Which is used to produce the Federal Automotive Statistical Tool Report (FAST Report) as an end of year report. This end of year report is submitted jointly to the Department of Energy (DOE), the GSA, and the Idaho National Lab (INL). The FAST report summarizes each vehicle’s annual data with respect to fuel, mileage, maintenance, acquisition, and disposal. And second, it is used by EPA’s Fleet program management, regional, local staff and support contractors as a standardized vehicle reservation system to reserve and utilize fleet vehicles for official agency business.

The categories of individuals covered by this system include EPA employees and EPA Contractors.

PII collected includes: Last Name, First Name, Work Phone Number, Work Email Address, Driver’s License Expiration Date, and Profile Picture.

Fleet Access is a data management system that allows authorized EPA employees and contractors to store/maintain vehicle asset data and reserve agency vehicles across various programs/regions. PII information is collected directly from the user via an online registration form.

A. Disclosure of Law Enforcement Purposes: Information may be disclosed to the appropriate Federal, State, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the information is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving entity.

B. Disclosure Incident to Requesting Information: Information may be disclosed to any source from which additional information is requested (to the extent necessary to identify the individual, inform the source of the purpose of the request, and to identify the type of information requested,) when necessary to obtain information relevant to an agency decision concerning retention of an employee or other personnel action (other than hiring), retention of a security clearance, the letting of a contract, or the issuance or retention of a grant or other benefit.

The other agency or licensing organization may then make a request supported by the written consent of the individual for the entire record if it so chooses. No disclosure will be made unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another Federal agency for criminal, civil, administrative, personnel or regulatory action.

D. Disclosure of Office of Management and Budget: Information may be disclosed to the Office of Management and Budget (OMB) at any stage in the legislative coordination and clearance process in connection with private relief legislation as set forth in OMB Circular No. A-19.

1. The Agency, or any component thereof;

2. Any employee of the Agency in his or her official capacity;

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

G. Disclosure of National Archives: Information may be disclosed to the National Archives and Records Administration in records management inspections.

I. Disclosures of Administrative Claims, Complaints and Appeals: Information from this system of records may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator or other person properly engaged in investigation or settlement of an administrative grievance, complaint, claim, or appeal filed by an employee, but only to the extent that the information is relevant and necessary to the proceeding. Agencies that may obtain information under this routine use include, the Office of Personnel Management, Office of Special Counsel, Merit Systems Protection Board, Federal Labor Relations Authority, Equal Employment Opportunity Commission and Office of Government Ethics.

L. Disclosure to Persons or Entities in Response to an Actual of Suspected Breach of Personally Identifiable Information: To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records, (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

M. Disclosure to assist another agency in its efforts to respond to a breach: To another Federal agency or Federal entity, when the Agency determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

The information collected within Fleet Access is maintained and stored in a database hosted by Aptum, a DataCenter Service Provider located at 600 West 7th Street, Los Angeles, California, 900021 in accordance to the EPA record retention schedule 00-90-Administrative Support Databases. And EPA Record Schedule 1009 – Motor Vehicles and Personal Property.

Records for Fleet Access are retrievable by User ID and Last Name.

Fleet Access complies with EPA Records Schedule 0090-Administrative Support Databases and EPA Record Schedule 1009 – Motor Vehicles and Personal Property. Personnel information is retained for as long as the user or administrator determines necessary, generally, as long as the individual is employed by the EPA and requires vehicle reservation access. If a person no longer needs to reserve a vehicle for agency business, their user information is deleted permanently, in accordance with EPA Record Schedule 1009. Vehicle data is stored for a minimum of 3 years.

Security controls used to protect personal sensitive data in Fleet Access are commensurate with those required for an information system rated moderate for confidentiality, integrity, and availability, as prescribed in NIST Special Publication, 800-53, "Recommended Security Controls for Federal Information Systems," Revision 4.

Administrative Safeguards

Personnel are required to complete annual agency Information Security and Privacy training. Personnel are instructed to lock their computers when they leave their desks.

Technical Safeguards

Access to Fleet Access is restricted to authorized users via login by username and password. All application passwords are encrypted in the database. User passwords cannot be seen by the administrators. The application is web-based, and user sessions encrypted. Authorized users are defined by an application administrator from within the application. Permission structures are currently role-based and are applied individually by an application administrator as needed.

Physical Safeguards

Equipment used for the purposes of hosting the Fleet Access is in a secure facility. Access to the secure facility is restricted to employees displaying valid identification badges. Access to the Network Operations Center is limited to authorized, network administrators and requires successful validation by additional authentication mechanisms. Access to the secure facility is logged. Power to the facility is insured by both battery backup and diesel generator. Fire suppression systems are in place.

The facility is staffed 24-hours-a-day, seven days a week.

Individuals seeking access to information in this system of records about themselves are required to provide adequate identification (e.g., driver’s license, military identification card, employee badge or identification card). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

None

/-86

EPA Acquisition System (EAS), EPA-86

Unclassified.

Office of Acquisition Solutions, Environmental Protection Agency, Ronald Reagan Building, 1200 Pennsylvania Avenue, NW., Washington, D.C. 20460 and at the National Computer Center (NCC), 109 T.W. Alexander Drive RTP, NC 27711 for hosting.

Kimberly Patrick, patrick.kimberly@epa.gov, 202-566-2605, Director, Office of Acquisition Solutions, Environmental Protection Agency, Ronald Reagan Building, 1200 Pennsylvania Avenue, NW., Washington, D.C. 20460.

Executive Order 12072 (Aug. 16, 1978); Federal Property and Administrative Services Act of 1949, 40 U.S.C. 121; Office of Federal Procurement Policy Act of 1974 41 USC 1702

EPA uses EAS to initiate, award, modify and track acquisition actions. EAS identifies employees who initiate acquisition actions or are assigned to work on these actions. Specifically, the system tracks the requisitioner, contract official, contract specialist, and approving officials for each acquisition action.

Categories of individuals covered are EPA employees, that are the: (a) EPA Project Officer, i.e., the individual who is responsible for the review and evaluation of the application or proposal and the monitoring of a resulting contract acquisition; (b) EPA Program Official, i.e., the individual who is responsible for review and approval of applications or proposals for funding; (c) EPA Budget Official, i.e., the individual who is responsible for certifying availability of funds for approved applications or proposals; (d) EPA Contracting Officer or Contract Specialist, i.e., individuals who are responsible for awarding and administering contracts and (e) EPA Merit / Peer Reviewers, i.e., individuals who provide a written review or evaluation of the application or proposal to the EPA Project Officer.

EAS collects employee first name, last name, work email, work telephone, EPA employee ID and LAN User ID information. The system also collects other information required for the tracking or approval of a contract action including contract proposals, technical reviews by a peer reviewer, records of contract awards, financial data, and other information. EAS also collects Vendor Contact information including Vendor Code, Legal Name, Data Universal Numbering System (DUNS) ID (a 9 character identifier used for identifying the Vendor), Cage Code (used to provide a standardized method of identifying a given facility at a specific location.), address, phone number, fax number, and email address.

EAS collects EPA employee information from EPA’s directory service. Contract proposals and vendor information is collected directly from the user via the federal government’s System for Award Management (SAM).

The following new or modified routine uses apply to this system because the use of the record is necessary for the efficient conduct of the government. The routine uses for this system are compatible with the purpose for which their records are collected. The information may be disclosed to and for the following EPA General Routine Uses, published at 73 Fed Reg 2245: A, B, C, D, E, F, G, H, I, J and K. Routine uses L, and M apply in accordance with OMB M-17-12.

1. The Agency, or any component thereof;

2. Any employee of the Agency in his or her official capacity;

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

G. Disclosure to the National Archives. Information may be disclosed to the National Archives and Records Administration in records management inspections.

L. Disclosure to Persons or Entities in Response to an Actual or Suspected Breach of Personally Identifiable Information. To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records, (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

M. Disclosure to assist another agency in its efforts to respond to a breach. To another Federal agency or Federal entity, when the Agency determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

These records are maintained electronically on computer storage devices such as computer tapes and disks. The computer storage devices are located at EPA, Office of Acquisition Solutions, 1200 Pennsylvania Ave NW, Washington, D.C. 20460. Backups will be maintained at disaster recovery sites, located at EPA Potomac Yards South (PYS) Data Center, 2777 Crystal Drive, Arlington, VA 22202 and EPA’s National Computing Data Center (NCC), 109 T.W. Alexander Drive, Durham, NC 27709. Computer records are maintained in a secure, password protected environment. Access to computer records is limited to those who have a need to know. All EAS user accounts are assigned permissions as needed based on their job functions. Permission level assignments will allow users access only to those functions for which they are authorized. All records are maintained in secure, access-controlled areas or buildings.

Records are retrieved by the first name and last name of EPA employee, User ID, or Vendor ID (DUNS codes) associated with contracts.

EPA will retain and dispose of EAS records in accordance with the National Archives and Records Administration General Records Schedule, and EPA Records Schedule 055. EAS records are retained for at least 6 years after contract closeout for non-Superfund actions, and 30 years after contract closeout for Superfund site actions.

Security controls used to protect Personally Identifiable Information in EPA Acquisition System (EAS) are commensurate with those required for an information system rated moderate for confidentiality, integrity, and availability, as prescribed in NIST Special Publication, 800-53, "Recommended Security Controls for Federal Information Systems," Revision 4.

EPA personnel are required to complete annual agency Information Security and Privacy training. EPA personnel are instructed to lock their computers when they leave their desks.

Electronic records are maintained in a secure, password protected electronic system. EAS access is limited to authorized, authenticated users. All of the system’s electronic communication utilizes Transport Layer Security (TLS) secure communication protocol for all transactions.

All records are maintained in secure, access-controlled areas or buildings.

Paper records are maintained in locked file cabinets.

Individuals seeking access to information in this system of records about themselves are required to provide adequate identification (e.g., driver’s license, military identification card, employee badge or identification card). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

Any individual who wants to know whether this system of records contains a record about themselves, should make a written request to the Attn: Agency Privacy Officer, MC 2831T, 1200 Pennsylvania Ave., NW, Washington, D.C. 20460, privacy@epa.gov.

None

-87

MoveLINQS; EPA-87

Unclassified.

101 Herbert Drive, Boydton, Va. 23917; Microsoft Azure Government Cloud (Azure-Va).

William E. Wiggins Jr., Branch Chief, Business Development & Services Branch (BDSB), EPA's Federal Employee Relocation Center (FERC), Wiggins.William@epa.gov, (513) 487-2013, 26 W Martin Luther King Dr., Cincinnati, OH 45268.

5 U.S.C. 5753; 5 CFR part 575, subpart B.

MoveLINQS, is an EPA major information system (MIS). It was originally published under the EPA-29 SORN, which also covers EPA travel, other accounts payable, and accounts receivable files. However, the EPA proposes to move the MoveLINQS application to a separate Microsoft Azure Government Cloud under the new SORN EPA-87. The EPA utilizes MoveLINQS to help manage the BDSB Federal Employee Relocation Center, where they process employee relocation moves for the EPA.

Federal employees and their family members who are eligible for move-related reimbursements will be covered.

SSN, name, address, email address, children's names and DOB, spouse's name, filing status (for tax purposes).

The employees are the source of information.

MoveLINQS is used internally to maintain and store pertinent employee and relocation expense data. It uses its features and flexible controls to automate and streamline the permanent change of station (PCS) travel cost management process, eliminating errors and simplifying the enforcement of complex federal policy throughout the Agency. General routine uses D, E, F, G, K, L, and M apply to this system. Records may also be disclosed: 1. to the Office of Management and Budget, and Department of Treasury for paying taxes on relocation expenses; and 2. to provide information to contracted agencies of the EPA for the purposes of relocation. This information may contain monthly reports such as taxes that were paid, invoices and travel authorizations that were obligated. The routine uses below are both related to and compatible with the original purpose for which the information was collected. The following general routine uses apply to this system (73 FR 2245):

1. The Agency, or any component thereof;

2. Any employee of the Agency in his or her official capacity;

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

4. The United States, if the Agency determines that litigation is likely to affect the Agency or any of its components,

G. Disclosure to the National Archives: Information may be disclosed to the National Archives and Records Administration in records management inspections.

The two routine uses below (L and M) are required by OMB Memorandum M–17–12.

L. Disclosure to Persons or Entities in Response to an Actual of or Suspected Breach of Personally Identifiable Information: To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records, (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

Records are maintained electronically on computer storage devices such as servers and cloud storage. The computer storage devices are located at the EPA; MoveLINQS backups will be maintained at a disaster recovery site designated by Microsoft Azure Government. Computer records are maintained in a secure password protected environment. Access to computer records is limited to those who have a need to know. Permission level assignments will allow users access only to those functions for which they are authorized. All records are maintained in secure, access-controlled areas or buildings.

Retrieval of computer records is limited to those who have a need to know. Currently requestors (end users) do not have access to records using the MoveLINQS system. All users are required to have appropriate permission levels assigned before accessing the system. The permission levels are determined by the type of user. The MoveLINQS system is the only method of retrieval. Users input the information themselves and only authorized users can access.

MoveLINQS is listed on EPA Records Control Schedule 0089 under Chief Financial Officer as Relocation Expense Management System. The disposition is to close when no longer needed for current agency business and destroy immediately after file closure.

Security controls used to protect personal sensitive data in MoveLINQS are commensurate with those required for an information system rated moderate for confidentiality, integrity, and availability, as prescribed in NIST Special Publication, 800-53, "Recommended Security Controls for Federal Information Systems," Revision 4. Administrative controls include the policies and procedures governing the agency program and systems operated within, background investigations for privileged users and rules of behavior. Technical controls include role-based, user access controls, and data encryption. All MoveLINQS servers and software are stored in the Microsoft Azure Va. Datacenter. All security measures for the physical space are the responsibility of Microsoft. Microsoft Azure Government must in addition adhere to FedRAMP regulations and policies set forth by the Joint Authorization Board, which is the primary authority and decision-making board that ensures FedRAMP Cloud System compliance.

Individuals seeking access to information in this system of records about themselves are required to provide adequate identification (e.g., driver’s license, military identification card, employee badge or identification card). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Complete EPA Privacy Act procedures are described in the EPA’s Privacy Act regulations at 40 CFR part 16.

Any individual who wants to know whether this system of records contains a record about him or her, should make a written request to the EPA Attn: Agency Privacy Officer, MC 2831T, 1200 Pennsylvania Ave., NW., Washington, D.C. 20460, privacy@epa.gov.

None.

67 FR 8255 – Posted on February 22, 2002 – The EPA provided notice that it proposed to establish a new system of records, the EPA Travel, Other Accounts Payable, and Accounts Receivable Files.

-88

Purchase Card Order Request System (PCORS)

Unclassified.

Electronic records are maintained at the National Computer Center (NCC), 109 TW Alexander Drive, Research Triangle Park, Durham, NC 27711.

Michael Hardy, hardy.michael@epa.gov at 202-564-7899, Director, OMS-ARM, Strategic IT Investment Staff (SITIS), Environmental Protection Agency, William Jefferson Clinton – North Building, 1200 Pennsylvania Avenue, NW, Washington, D.C. 20460.

Environmental Protection Agency Acquisition Guide, EPAAG - Chapter 13, Subsection 13.3.1, "Government-wide Commercial Purchase Card"; Executive Order 12072 (Aug. 16, 1978); Federal Property and Administrative Services Act of 1949, 40 U.S.C. 121; Executive Order 9397 (Nov. 22, 1943). 42 U.S.C. 290dd-1, 290ee-1; 5 U.S.C. 7901; Executive Order 12564 (Sept. 15, 1986); Office of Federal Procurement Policy Act of 1974, 41 U.S.C. 414; Public Law 107-67, Section 630; Executive Order 9397.5 U.S.C. 1104, 5 U.S.C. 1302, 5 U.S.C. 3301, 5 U.S.C. 3304, 5 U.S.C., 3320, 5 U.S.C. 3327, 5 U.S.C. 3361, and 5 U.S.C. 3393; The Telework Enhancement Act of 2010 (December 9, 2010); and Public Law 111–292.

The purpose of the Purchase Card Order Request System (PCORS) is to manage the pre-approval process for purchase card transactions. EPA also uses PCORS to place orders once approved by the three mandatory approvers: the Purchase Cardholder, the Approving Official, and the Funds Certifying Officer.

EPA employees, contractors, and grantees.

Order request ID, requester, request status, office/lab, branch, request type, name, contact, customer account number, email, phone, address, city, state, shipping name, shipping address, cardholder, approving official, Funds Certifying Official, deputy director, director/division director, human resource official, Information Management Officer (IMO) / IT reviewer, printing reviewer, facilities reviewer, 508 reviewer, property reviewer, health and safety reviewer.

The sources of data within PCORS are from the user and other Agency systems, including, the Enterprise Identity Data Warehouse (EIDW) – managed by the Agency’s Enterprise IT Service Desk (EISD), the Federal Personnel and Payroll System (FPPS) – managed by the U.S. Department of the Interior, the Electronic Product Environmental Assessment Tool (EPEAT) Site Link – managed by the Green Electronics Council, the Information Management Officer (IMO) Reference List – managed by the EPA Chief Information Officer’s Senior Advisory Council, and the System for Award Management (SAM) – managed by U.S. General Services Administration.

The routine uses below are both related to and compatible with the original purpose for which the information was collected. The following general routine uses apply to this system: A, B, C, D, E, F, G, H, I, J, K, L, and M.

1. The Agency, or any component thereof;

2. Any employee of the Agency in his or her official capacity;

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

4. The United States, if the Agency determines that litigation is likely to affect the Agency or any of its components,

G. Disclosure to the National Archives: Information may be disclosed to the National Archives and Records Administration in records management inspections.

The two routine uses below (L and M) are required by OMB Memorandum M–17–12.

L. Disclosure to Persons or Entities in Response to an Actual or Suspected Breach of Personally Identifiable Information: To appropriate agencies, entities, and persons when (1) EPA suspects or has confirmed that there has been a breach of the system of records, (2) EPA has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, EPA (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with EPA's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

These records are maintained electronically on computer storage devices which are located at EPA, OMS-ARM, Strategic IT Investment Staff (SITIS). SITIS manages the system, which is located at the National Computer Center (NCC) in Research Triangle Park, North Carolina in access-controlled rooms, areas, and buildings. Digital backups will be maintained at a disaster recovery site. Computer records are maintained in a secure password protected environment. Access to computer records is limited to those who have a need to know. Permission level assignments will allow users access only to those functions for which they are authorized.

The primary retrieval method is by searching the employee’s name and EPA Order Request ID (form ID).

PCORS and the requests within PCORS fall under EPA’s Records Control Schedule 0042. Cardholders are to download the PDF version of their requests and save them for their records.

Security controls used to protect Personally Identifiable Information (PII) in PCORS are commensurate with those required for an information system rated MODERATE for confidentiality, integrity, and availability, as prescribed in National Institute of Standards and Technology (NIST) Special Publication, 800-53, "Security and Privacy Controls for Information Systems and Organizations," Revision 5.

2. Technical Safeguards: Electronic records are maintained in a secure, password protected electronic system. PCORS access is limited to authorized, authenticated users integrated with the Agency’s single-sign-on. This integration uses the user’s LAN credentials to identify the user prior to granting access to the platform and PCORS system. All the system’s electronic communication utilizes the agency’s Secure Sockets Layer (SSL) encryption for all transactions.

3. Physical Safeguards: All records are maintained in secure, access-controlled areas or buildings.

Individuals seeking access to information in this system of records about themselves are required to provide adequate identification (e.g., driver’s license, military identification card, employee badge or identification card). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

None.

-89

Public Health Emergency Workplace Response System, EPA-89

Unclassified.

Records are maintained at the EPA Headquarters, 1301 Constitution Ave., NW, Washington DC 20460, regional offices, field offices and laboratories.

Willie J. Abney, Division Director of Desktop Support Services Division (DSSD), Office of Mission Support, 1301 Constitution Ave. NW, Washington, DC 20460 Email Address: Abney.Willie@epa.gov Phone Number: 202-566-1366.

5 U.S.C. 6329c, 5 U.S.C. 7902, 29 U.S.C. 654, 29 U.S.C. 668, 42 U.S.C. 247d, 44 U.S.C. 3101, 42 U.S.C. 12101, 5 CFR Part 339, 29 CFR Part 1602, Executive Order 12196, Occupational safety and health programs for Federal employees (Feb. 26, 1980), OMB Memorandum M-20-23 Aligning Federal Agency Operations with the National Guidelines for Opening Up America Again (Apr. 20, 2020).

EPA proposes to establish a new system of records to manage the Agency’s planning and response to a public health emergency in EPA locations. EPA intends to collect information in the system to assist EPA with maintaining safe and healthy workplaces, to protect individuals in EPA locations from risks associated with a public health emergency, to plan and respond to workplace and personnel flexibilities needed during a public health emergency, to facilitate EPA’s cooperation with public health authorities, and assist with contact tracing. Contact tracing is defined as the identification, monitoring, and support of an affected individual (an individual in an EPA location with confirmed or probable exposure to a public health emergency contaminant), and identification and contact of a potentially affected individual (an individual who was in contact with an affected individual or exposed to a public health emergency contaminant while in an EPA location).

Categories of individuals covered by this system include EPA employees. The system also covers individuals working in EPA facilities or on official EPA business, including: EPA contractors, non-EPA government personnel or contractors, interns, grantees, fellows, and volunteers. Other categories of individuals covered by the system include: visitors to EPA facilities; and potentially affected individuals at EPA locations or otherwise present during official EPA business. The system also covers individuals listed as emergency contacts for such individuals.

Information collected in the system may include but is not limited to: contact information of the individuals (which may include name, address; phone number; email address); EPA LAN ID; EPA employee number; EPA staff office (e.g. organization chart structure) and supervisor contact information (which may include name, phone number, and email address); emergency contact information (which may include name, phone number, and email address); and Agency facility or location access information that includes, but is not limited to, the dates when the affected individual visited the facility or location, the areas that they visited within the facility (e.g., entrance used, office and cubicle number, shared spaces used) or at the location, the duration of time spent in the facility or location, the individuals they came in contact with, and security systems monitoring data; and facility cleaning data. The system also collects Sensitive Personal Identifiable Information (SPII) such as medical information, including but not limited to, dates and results of any: expected or confirmed medical testing (e.g. temperature readings, viral or bacterial exposure testing, antibody testing) performed in relation to a public health emergency; symptoms consistent with a public health emergency; potential or actual exposure to a public health emergency contaminant; immunizations and vaccination information; or other medical history related to the treatment of a public health emergency contaminant. The system may also collect information, including but not limited to, on: recent travel details (including dates, locations, carriers); EPA staff certifications relating to dependent care obligations or whether EPA staff are in a high-risk category regarding a public health emergency contaminant; name and contact information of EPA staff assigned to track and respond to an individual’s case; date and time of information entry; contents of communications between assigned EPA staff and affected individuals; and case status.

The information in this system is collected from the individual, the individual’s manager, and from the individual’s emergency contact. When necessary, for non-EPA personnel, information may also be collected from the individual’s employer, grantee organization, other federal agencies, or similar designated external points of contact. Information is also collected from security systems monitoring access to Agency facilities (such as video surveillance and key card logs), human resources systems, emergency notification systems, and federal, state, and local agencies assisting with the response to a public health emergency.

The following routine uses apply to this system because the use of the record is necessary for the efficient conduct of government operations. The routine uses are related to and compatible with the original purpose for which the information was collected. Routine uses I and J are required under OMB M-17-12.

A. Disclosure for Law Enforcement Purposes.

Disclosure Incident to Requesting Information.

Disclosure to Congressional Offices.

Information may be disclosed to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of the individual.

Disclosure to Department of Justice.

Information may be disclosed to the Department of Justice, or in a proceeding before a court, adjudicative body, or other administrative body before which the Agency is authorized to appear, when:

•

The Agency, or any component thereof;

•

Any employee of the Agency in his or her official capacity;

•

Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

The United States, if the Agency determines that litigation is likely to affect the Agency or any of its components, is a party to litigation or has an interest in such litigation, and the use of such records by the Department of Justice or the Agency is deemed by the Agency to be relevant and necessary to the litigation.

Disclosure to the National Archives.

Information may be disclosed to the National Archives and Records Administration in records management inspections.

Disclosure to Contractors, Grantees, and Others.

Disclosures for Administrative Claims, Complaints and Appeals.

Disclosure in Connection with Litigation.

Disclosure to Persons or Entities in Response to an actual or Suspected Breach of Personally Identifiable Information.

Disclosure to Assist Another Agency in its Efforts to Respond to a Breach

Disclosure to a Public Health Authority

To Federal agencies such as the Department of Health and Human Services (HHS), State and local health departments, and other public health or cooperating medical authorities in connection with program activities and related collaborative efforts to deal more effectively with exposures to communicable diseases, and to satisfy mandatory reporting requirements when applicable.

Disclosure to Governmental Organization

To appropriate federal, state, local, tribal, or foreign governmental agencies or multilateral governmental organizations, to the extent permitted by law, and in consultation with legal counsel, for the purpose of protecting the vital interests of a data subject or other persons, including to assist such agencies or organizations in preventing exposure to or transmission of a communicable or quarantinable disease or to combat other significant public health threats.

M. Disclosure to Emergency Contacts

To a potentially affected individual’s emergency contact for purposes of locating the individual to communicate that they may have been exposed to a public health emergency contaminant in an EPA location or while otherwise present during official EPA business.

N. Disclosure for Contact Tracing

To affected individuals and/or potentially affected individuals, and/or, when needed, to the (potentially) affected individual’s employer, grantee organization, federal agency to whom the individual is contracted, or other similar designated external points of contact, information necessary for contact tracing. For example: informing an individual that they were exposed to an affected individual or public health emergency contaminant in an EPA location or while otherwise present during EPA business, and the timing and location of the exposure; or contacting the employer of a potentially affected individual in the course of trying to contact the potentially affected individual themselves.

Contact tracing is defined as: identification, monitoring, and support of an affected individual (an individual in an EPA location with confirmed or probable exposure to a public health emergency contaminant), and identification and contact of a potentially affected individual (an individual who was in contact with an affected individual or exposed to a public health emergency contaminant while in an EPA location), the same definition as above in Supplemental Information.

These records are maintained electronically on computer storage devices such as computer tapes and disks, or on paper. The computer storage devices are managed by the EPA, Office of Mission Support, 1301 Constitution Ave., NW, Washington DC 20460. Backup files will be maintained at a disaster recovery site. Computer records are maintained in a secure password-protected environment. Access to computer records is limited to those who have a need to know. Permission level assignments will allow users access only to those functions for which they are authorized. All records are maintained in secure, access-controlled areas or buildings.

Records may be retrieved by any data category in the system (e.g., name, office, supervisor, date of medical testing, assigned EPA staff). Records are only retrievable by authorized EPA staff (who are EPA employees and/or contractors) and retrieval methods are limited by permission levels as described below under Technical Safeguards.

EPA will retain and dispose of these records in accordance with the National Archives and Records Administration General Records Schedule. EPA-89 follows the EPA Records Policy for retention and disposal, per schedule 1012 (Information and Technology Management) and schedule 1049 (Information Access and Protection Records). The schedule provides disposal authorization for electronic files and hard copy printouts created to monitor system usage, including log-in files, audit trail files, and system usage files. Records in EPA-89 will be deleted or destroyed when the Agency determines they are no longer needed for administrative, legal, audit, or other purposes.

Security controls used to protect PII and SPII in EPA-89 are commensurate with those required for an information system rated moderate for confidentiality, integrity, and availability, as prescribed in NIST Special Publication, 800-53, "Recommended Security Controls for Federal Information Systems," Revision 4.

Administrative Safeguards

EPA staff must complete annual agency training for Information Security and Privacy. EPA instructs staff to lock and secure their computers when unattended.

Technical Safeguards

The system administrator, an EPA staff member, authorizes appropriate permission levels for authorized EPA staff. Permission level assignments allow authorized users to access only those system functions and records specific to their Agency work need. EPA also has technical security measures including restrictions on computer access to authorized individuals and required use of a personal identity verification (PIV) card and password.

Physical Safeguards

EPA equipment used for EPA-89 is located in the Federal cloud space not connected to other federal systems. Only authorized employees have access to this information in the Federal space.

Individuals seeking access to information in this system of records about themselves are required to provide adequate identification (e.g., driver’s license, military identification card, employee badge or identification card). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

None.

-90

e-Recovery, EPA-90

Unclassified.

109 T.W. Alexander Drive, NCC Building, Durham, NC 27711

Michael Clanton, Director, Office of Technology Solutions, (202) 564-1084, Clanton.Michael@epa.gov, Ronald Reagan Building 1300 Pennsylvania Ave., NW, Washington D.C. 20460.

Comprehensive Environmental Response, Compensation, and Liability Act of 1980, 42 U.S.C. 9607; 5 U.S.C. 301; 31 U.S.C. 3512; Executive Order 9397 (Nov. 22, 1943); Federal Water Pollution Control Act, as amended by the Federal Water Pol¬lution Control Act Amendments of 1972 (Clean Water Act), 33 U.S.C. 1321; National Oil and Hazardous Substances Pollution Contingency Plan, 40 CFR part 300.

The e-Recovery system will maintain and organize cost information associated with responding to releases or threatened releases of hazardous substances or discharges or threatened discharges of oil, and will be used to track FEMA mission assignment costs. EPA will use the information stored in this system to produce cost reports, which will be used to support the Agency’s recovery of its clean-up costs from responsible parties. EPA, the U.S. Department of Justice, and the U.S. Coast Guard will also use this information for litigation support purposes.

EPA employees, EPA contractors, non-EPA government personnel, state and local government personnel and/or private citizens.

The e-Recovery system will store the following information: social security number, name, home address, credit card number, other credit card information, driver’s license number, other personal identification numbers (i.e., home phone numbers, membership numbers, personal license plates, etc.) and other personal information related to travel expenses such as home addresses, credit card numbers, and other recoverable expense items.

The primary source of data for e-Recovery is the Compass Data Warehouse (CDW). CDW is a system that consolidates financial data from several enterprise systems, such as Compass, Integrated Grants Management System (IGMS), People Plus, EPA Acquisition System (EAS), and Payment Tracking System (PTS), into a single relational database. All of the data that resides in the CDW originates from the enterprise systems and is a duplicate of data from the original source.

1. The Agency, or any component thereof;

2. Any employee of the Agency in his or her official capacity;

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

4. The United States, if the Agency determines that litigation is likely to affect the Agency or any of its components,

G. Disclosure to the National Archives: Information may be disclosed to the National Archives and Records Administration in records management inspections.

The two routine uses below (L and M) are required by OMB Memorandum M–17–12.

L. Disclosure to Persons or Entities in Response to an Actual or Suspected Breach of Personally Identifiable Information: To appropriate agencies, entities, and persons when (1) the Agency suspects or has confirmed that there has been a breach of the system of records, (2) the Agency has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, the Agency (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Agency's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

These records are maintained electronically in computer databases and backup disks. Incremental backups run weeknights (Monday through Thursday), full backups run every weekend (Friday PM through Monday AM). These backups are maintained at the National Computer Center (NCC), 109 T.W. Alexander Drive, Durham, NC 27711.

Records are retrieved by employee last name, pay period, and Superfund site identification number.

EPA will retain and dispose of these records in accordance with the National Archives and Records Administration General Records Schedule and EPA Records Schedule 0052, NARA Disposal Authority: DAA-GRS-2013-0003-0001. e-Recovery records are retained for at least 30 years after the completion of all cost recovery at a given Superfund Site.

Security controls used to protect personal and/or sensitive data in the e-Recovery system are commensurate with those required for an information system rated MODERATE for confidentiality, integrity, and availability, as prescribed in National Institute of Standards and Technology (NIST) Special Publication, 800-53, "Security and Privacy Controls for Federal Information Systems and Organizations," Revision 5.

Administrative Safeguards: EPA employees and contractors are required to complete annual agency Information Security and Privacy training. EPA employees and contractors are instructed to lock their computers when they leave their desks.

Technical Safeguards: Computer records are maintained in a secure password protected environment. Access to computer records is limited to those who have a need to know.

Personal Identification Verification (PIV) card is required to get access to e-Recovery. Permission level assignments allow users access only to those functions for which they are authorized.

Physical Safeguards: All records are maintained in secure, access-controlled areas or buildings.

Individuals seeking access to information in this system of records about themselves are required to provide adequate identification (e.g., driver’s license, military identification card, employee badge or identification card). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

None.

Federal Register: October 1, 2001 (Volume 66, Number 190)

-93

Human Resources Line of Business (HR LoB), EPA-93

Unclassified

SYSTEM LOCATION:

EPA OHR, 1200 Pennsylvania Ave., NW, Washington, DC 20460. Records hosted by DOI/IBC are located at 7301 West Mansfield Ave., MS D-2400, Denver, CO 80235-2230, and are also located at Departmental, bureau and office systems and locations that prepare and provide input documents and information for data processing and administrative actions for this system.

Mara Kamen, kamen.mara@epa.gov, 202-564-7159, Director, OHR, U.S. Environmental Protection Agency, 1200 Pennsylvania Avenue, NW., Washington, DC 20460

5 U.S.C. 5101, et seq; 31 U.S.C. 3512; 31 U.S.C. Chapter 11; 5 CFR part 297; The Office of Management and Budget Circular A-127, Revised, Financial Management Systems; this Circular is issued pursuant to the Chief Financial Officers Act (CFOs Act) of 1990, P.L. 101-576).

EPA maintains records in HR LoB to administer EPA’s HR activities, including: pay and leave requirements, processing, accounting, learning and development, and reporting requirements. The records also provide the basic source of factual data about a person's employment while in federal service and after his or her separation from federal service in accordance with applicable records policies. Records in HR LoB have various uses by Agency personnel offices, including screening qualifications of employees; determining status, eligibility, and employee’s rights and benefits under pertinent laws and regulations governing federal employment; computing length of service; and other information needed to provide personnel services.

Current and former EPA employees, including Health and Human Services Public Health Service Commissioned Officers assigned to EPA, grantees, intergovernmental detailees, interagency agreement detailees, and contractors, and family members of these individuals.

HR LoB collects the following employee data elements: Name, Citizenship, Gender, Birth Date, Group Affiliation, Marital Status, Other Names Used, Legal Status, Place of Birth, Security Clearance, Spouse Information, Financial Information, Medical Information, Disability Information, Education Information, Driver’s License State and Number, Race/Ethnicity, Social Security Number (SSN) and truncated SSN, Personal Cell Telephone Number, Personal Email Address, Home Telephone Number, Family member, Child or Dependent Information, Employment Information, Military Status/Service, Mailing/Home Address, Taxpayer Identification Number, Bank Account information such as Routing and Account Numbers, Beneficiary Information, Bond Co-owner Name(s) and Information, Professional Licensing and Credentials, Family Relationships, Age, Involuntary Debt (Garnishments or Child Support Payments), Court Order Information, Back Pay Information, User ID, Time and Attendance data, Leave Time Information, Employee Common Identifier (ECI), , Person Number (a unique number that identifies a person within HR LoB, and Person Number-Emergency (a unique number identifying an individual within HR LoB for a Leave Share Occurrence).

Information is obtained from individuals on whom the records are maintained, official personnel records of individuals on whom the records are maintained, supervisors, timekeepers, previous employers, the Internal Revenue Service and state tax agencies, the Department of the Treasury, other Federal agencies, courts, state child support agencies, employing agency accounting offices, and third-party benefit providers

The routine uses below are both related to and compatible with the original purpose for which the information was collected. The following general routine uses apply to this system:

1. The Agency, or any component thereof;

2. Any employee of the Agency in his or her official capacity;

3. Any employee of the Agency in his or her individual capacity where the Department of Justice or the Agency have agreed to represent the employee; or

G. Disclosure to the National Archives: Information may be disclosed to the National Archives and Records Administration in records management inspections.

The two routine uses below (L and M) are required by OMB Memorandum M–17–12.

Electronic records are stored in computers, removable drives, storage devices, electronic databases, and other electronic media hosted by DOI/IBC.

HR LoB authorized users may retrieve information on an individual employee using full name, SSN, and Employee Common Identifier (ECI) - unique number identifying employees across Federal automated systems.

The retention of data in the system is in accordance with applicable EPA Records Schedules 1005, 1006, 1026, and 1029 as approved by the National Archives and Records Administration (NARA).

Security controls used to protect personally identifiable information (PII) in HR LoB are commensurate with those required for an information system rated MODERATE for confidentiality, integrity, and availability, as prescribed in National Institute of Standards and Technology (NIST) Special Publication, 800-53, "Security and Privacy Controls for Information Systems and Organizations," Revision 5.

2. Technical Safeguards: Electronic records are maintained in a secure password protected environment. Access to records is limited to those who have a need to know. Electronic records are restricted to authorized users with appropriate security privileges, including the use of 2-factor PIV Card authentication and permission level assignments. Web-based connections are Tier3 VPN encrypted sessions between EPA and DOI. The database is maintained behind a firewall. WTTS/EOD, FedTalent, OBIEE, and FPPS have multiple levels of role-based access controls that protect the privacy of information in HR LoB. The level of these access controls determines the security privileges of HR LoB users. There are three levels of role-based security (User, Security, Administrator) and they follow the separation of duties outlined in NIST guidance.

3. Physical Safeguards: These records are maintained in controlled access areas. Identification cards are verified to ensure that only authorized personnel can access

Individuals seeking access to information in this system of records about themselves are required to provide adequate identification (e.g., driver’s license, military identification card, employee badge or identification card). Additional identity verification procedures may be required, as warranted. Requests must meet the requirements of EPA regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

Any individual who wants to know whether this system of records contains a record about themself, should make a written request to: Attn: Agency Privacy Officer, MC 2831T, 1200 Pennsylvania Ave., NW., Washington, D.C. 20460, or to privacy@epa.gov.

None.

-/GOVT-2 Federal Docket Management System (FDMS).

U.S. EPA, Research Triangle Park, NC.

Any individual commenting on a federal agency's rulemaking activities or submitting supporting materials and individuals requesting access to records pursuant to the Freedom of Information Act, 5 U.S.C. 552 (FOIA) or appealing initial denials of their requests.

Agency rulemaking materials including, but not limited to,Federal Registerpublications, supporting rulemaking documentation, scientific and financial studies and public comments. Records also include the requests filed for agency records pursuant to FOIA, including individuals' names, mailing addresses, email addresses, phone numbers, social security numbers, dates of birth, alias(es) used by the requester, alien numbers assigned to travelers crossing national borders, requester's parents' names, user names and passwords for registered users, FOIA tracking numbers, dates requests are submitted and received, related appeals and agency responses. Records also include communications with requesters, internal FOIA administration documents (e.g., billing invoices) and responsive records.

Section 206(d) of the E-Government Act of 2002 (Pub. L. 107-347, 44 U.S.C. Ch 36); Freedom of Information Act, 5 U.S.C. 552; Privacy Act of 1974, 5 U.S.C. 552a; Clinger-Cohen Act of 1986, 40 U.S.C. 11318; and 5 U.S.C. 301.

To provide the public a central online location to search, view, download and comment on Federal rulemaking documents and a single location to submit and track FOIA requests and appeals filed with participating agencies, along with providing the agencies electronic FOIA processing and administrative capabilities.

General routine usesA, B, C, D, E, F, G, H, K, and L apply to this system. Records may also be disclosed to another Federal agency (a) with an interest in an agency record in connection with a referral of a Freedom of Information Act (FOIA) request to that agency for its views or decision on disclosure or (b) in order to obtain advice and recommendations concerning matters on which the agency has specialized experience or particular competence that may be useful to agencies in making required determinations under FOIA.

Storage:

FDMS security protocols meet all required security standards issued by the National Institute of Science and Technology (NIST). Records in FDMS are maintained in a secure, password protected electronic system that utilizes security hardware and software to include multiple firewalls, active intruder detection, and role-based access controls. Additional safeguards will vary by agency.

The system has the ability to retrieve records by numerous data elements and key word searches, including name, agency, dates, subject, docket type, docket sub-type, agency docket ID, docket title, docket category, document type, CFR Part, date received andFederal Registerpublication date, FOIA tracking number and other information retrievable with full-text searching capability.

The public may access regulatory records in the system atwww.regulations.govand FOIA records athttps://foiaonline.regulations.gov.

FDMS security protocols meet multiple NIST security standards from authentication to certification and accreditation. Records in the system are maintained in a secure, password protected electronic system that utilizes security hardware and software to include multiple firewalls, active intruder detection, and role-based access controls. Additional safeguards vary by agency for the regulatory records. Security controls are commensurate with those required for an information system rated moderate for confidentiality, integrity and availability as prescribed by NIST.

Each Federal agency handles its records in accordance with its records schedule as approved by the National Archives and Records Administration (NARA). FOIA records are covered under NARA General Record Schedule 14""Information Services Records unless a participating agency's records are managed under other record schedules approved by NARA.

eRulemaking PMO, Office of Information Collection, Office of Environmental Information, U.S. EPA, M/C 2821T, 1200 Pennsylvania Ave. NW., Washington, DC 20460.

Any individual who wants to know whether this system of records contains a record about him or her, who wants access to his or her record, or who wants to contest the contents of a record, should contact the agency conducting the rulemaking activity or to the agency that provided the FOIA response, as appropriate.

Individuals seeking access to their own personal information in this system of records is required to provide adequate identification (e.g., driver's license, military identification card, employee badge or identification card and, if necessary, proof of authority). Additional identity verification procedures may be required as warranted. Requests must meet the requirements of EPA regulations at 40 CFR part 16.

Requests for correction or amendment must identify the record to be changed and the corrective action sought. Requests must be submitted to the agency contact indicated on the initial document for which the related contested record was submitted.

Records deriving for individuals commenting on federal rulemaking activities and filing FOIA requests and appeals.

None.