[Federal Register Volume 84, Number 53 (Tuesday, March 19, 2019)]
[Notices]
[Pages 10025-10030]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-05080]


-----------------------------------------------------------------------

DEPARTMENT OF AGRICULTURE

Food and Nutrition Service


Agency Information Collection Activities: How States Safeguard 
SNAP Participant Personally Identifiable Information

AGENCY: Food and Nutrition Service (FNS), United States Department of 
Agriculture (USDA).

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: In accordance with the Paperwork Reduction Act of 1995, this 
notice invites the general public and other public agencies to comment 
on this proposed information collection. This is a new information 
collection. The Supplemental Nutrition Assistance Program (SNAP) is the 
largest domestic nutrition assistance program in the United States, 
having served approximately 20.1 million low-income households in 2018, 
with $60.1 billion in benefits provided during that time. Section 
11(e)(8) of the Food, Conservation, and Energy Act of 2008 requires 
that these millions of households must submit personally identifiable 
information (PII) in order to receive SNAP benefits. PII includes 
information that directly identifies individuals, such as individuals' 
names and Social Security numbers, as well as information like home 
addresses, which can be used to deduce the identity of an individual. 
While State agencies (SAs) implement policies to safeguard SNAP PII, 
little is systematically known about the policies and practices that 
SAs have in place. Accordingly, FNS wants to assess the ways that 
States safeguard SNAP PII and identify best practices to protect such 
information.

DATES: Written comments on this notice must be received on or before 
May 20, 2019.

ADDRESSES: Comments are invited on (a) whether the proposed collection 
of information is necessary for the proper performance of the functions 
of the agency, including whether the information has practical utility; 
(b) the accuracy of the agency's estimate of the burden of the proposed 
collection of information, including the validity of the methodology 
and assumptions that were used; (c) ways to enhance the quality, 
utility, and clarity of the information to be collected; and (d) ways 
to minimize the burden of the collection of information on those who 
are to respond, including the use of appropriate automated, electronic, 
mechanical, or other technological collection techniques or other forms 
of information technology.
    Comments may be sent to: Jenny Laster Genser, Office of Policy 
Support, U.S. Department of Agriculture, Food and Nutrition Service, 
3101 Park Center Drive, Room 1014, Alexandria, VA 22302. Comments may 
also be submitted via fax to the attention of Jenny Laster Genser at 
703-305-2576 or via email to [email protected]. Comments will 
also be accepted through the Federal eRulemaking Portal. Go to http://www.regulations.gov and follow the online instructions for submitting 
comments electronically.
    All written comments will be open for public inspection at FNS 
offices during regular business hours (8:30 a.m. to 5:00 p.m. Eastern 
Time, Monday through Friday) at 3101 Park Center Drive, Room 1014, 
Alexandria, VA 22302.
    All responses to this notice will be summarized and included in the 
request for Office of Management and Budget approval. All comments will 
be a matter of public record.

FOR FURTHER INFORMATION CONTACT: Requests for additional information 
should be directed to Jenny Laster Genser at 703-305-2559.

SUPPLEMENTARY INFORMATION: 
    Title: How States Safeguard SNAP Participant Personally 
Identifiable Information.
    OMB Number: 0584-NEW.
    Expiration Date of Approval: Not yet determined.
    Type of Information Collection Request: New Collection.
    Abstract: Supplemental Nutrition Assistance Program (SNAP) benefits 
are funded by the Federal Government through the U.S. Department of 
Agriculture (USDA) Food and Nutrition Service (FNS). FNS and State SNAP 
agencies (SAs) share responsibility for program administration and 
associated administrative expenses. As part of their administrative 
responsibilities, SAs are required to ensure that all personally 
identifiable information (PII) provided by SNAP applicants and 
participants is properly safeguarded and secure. SAs develop security 
plans as part of their Advanced Planning Document (OMB number 0584-
0083, expires 7/30/2020), which is required in order for the SA to 
obtain federal funding for information systems updates.
    No known breaches of SNAP data have occurred to date. However, the 
following circumstances suggest a need for more focus on data security: 
(1) The growing amount of data stored by SAs (and by the Federal 
Government as a whole); (2) the degree to which PII is shared or 
matched with data from multiple State and Federal agencies, with a wide 
variety of matches required by statute; and (3) the increasingly 
sophisticated methods for breaching datasets. These trends, in 
combination with limited resources for many SAs, may have left many 
States vulnerable to data security breaches. The contexts in which SAs 
must operate (for example, outdated computer systems) may also 
contribute to inadequate levels of PII security. Because little is 
known about the security protocols, policies, and procedures that SAs 
implement in protecting PII, FNS seeks to examine how States are 
currently protecting SNAP applicant/participant PII that is submitted 
in SNAP applications and maintained in SNAP caseload files.
    This study has five main objectives: (1) Describe legislation, 
regulations, and policies that address how participants' PII must be 
safeguarded; (2) describe methods that can be used to safeguard

[[Page 10026]]

PII; (3) describe how States currently safeguard participants' PII; (4) 
examine the consistency of safeguarding practices across States; and 
(5) provide recommendations to States to improve safeguarding of PII.
    The study will draw on the following primary data sources:
    [ssquf] A web-based survey of all 53 SA SNAP Directors and other 
relevant SA staff, which will obtain information on safeguarding 
methods and current processes required to address research questions 
under Objectives 2, 3, and 4. The survey respondents will also include 
up to two State information technology (IT) and/or data/program 
analysts in each of the 53 SAs to provide technical information that 
the SA Director may not know. The survey is expected to take a 
cumulative total of 1 hour to complete across the three respondents.
    [ssquf] Semi-structured, 1-hour telephone interviews with five 
industry experts who will provide broader views of PII protection in 
private-sector companies and in other public agencies (business or not-
for-profit), which will clarify both private-industry and public-sector 
benchmarks for information security, thereby informing Objectives 1, 2, 
and 5.
    [ssquf] In-depth, semi-structured telephone interviews (expected to 
be 1 hour long) with five SA SNAP Directors in five States that have 
been identified as strong examples of best practices for protecting 
PII. The interviews will also include the same two State IT and data/
program analysts who responded to the web survey, again to provide 
technical information that the SA SNAP Director may not know. Selection 
of these States will be based on the discussions with industry experts 
and on analysis of the web survey. These interviews will provide 
information relevant to Objective 5.
    Secondary information sources will include laws, regulations, 
policies, and FNS guidance materials, which will be used to address 
Objective 1 research questions.
    FNS will use the information collected to provide information to 
SAs on ways they can improve how they safeguard SNAP PII. SAs may have 
developed innovative and cost-effective methods that can be shared with 
other States. In addition, information from this study will provide 
insight into the various constraints SAs face in their efforts to 
maintain PII protection. By further understanding these constraints, 
future policies and regulations can support SAs in maintaining adequate 
protection.
    Affected Public: State governments (SA SNAP Directors, SA IT staff, 
and SA data/program analysts) and Business or Not-for-Profit Private/
Commercial Industry (industry experts).
    Estimated Number of Respondents: (169 in total, with 164 
respondents, and 5 nonrespondents). Estimates of respondent burden 
account for the fact that multiple staff may need to be consulted for 
SAs to address all of the topics explored in the web survey and also 
(for those selected) in the exemplary SA interviews. The total 
estimated number of respondents for the web-based survey is 53 SA SNAP 
Directors, 53 SA IT staff, and 53 SNAP program/data analysts, and 5 
business-sector respondents for the industry expert interviews. The 
semi-structured interviews with five exemplary SAs are assumed to be 
with the same staff who completed the web survey for these States, so 
they are not considered additional respondents.
    The estimated number of respondents for the web survey and 
interviews are as follows:
    (1) SA Web Survey: The sample for this collection includes all 53 
SA SNAP Directors (50 U.S. States, 2 U.S. Territories, and the District 
of Columbia); 53 SA IT staff; and 53 SA data/program analysts, all of 
whom are expected to respond. To make response as easy as possible, the 
study team will send biweekly email reminders throughout the data 
collection period (14 weeks) to SAs that have not yet responded. If an 
SA has not responded within 6 weeks, the study team will then reach out 
via telephone reminder calls in the weeks between emails. The initial 
mailing will encourage the SA Director to assign parts of the 
instrument that require detailed IT or security expertise to other 
staff members, as appropriate, simply by forwarding the original email 
containing the link to the survey. On the study team's behalf, the SA 
SNAP Director will send the survey to up to two senior IT staff or 
data/program analysts. The survey's estimated duration of 1 hour will 
be split evenly across the three respondents (20 minutes or .33 hour 
each). The study team will offer resources in the form of telephone and 
email help desks to provide quick answers to any questions (including 
problems with survey access), along with answers to frequently asked 
questions (FAQs) that will be accessible from within the survey or 
separately. As SA Directors submit surveys, an automated process will 
check the quality and completeness of each survey, allowing the study 
team to recontact the respondents promptly, if necessary. Total 
respondents = 159, assuming full cooperation by SAs.
    (2) Business: Industry Expert Interviews: The sample for this 
collection will initially include up to 10 industry experts, selected 
using snowball sampling based on the experts' knowledge of IT, SNAP 
data collection and management, and privacy protection standards and 
practices. The study team will prioritize the list of experts, and 
study team recruiters will proceed down the list in order until five 
experts have agreed to participate. The study team will conduct these 
interviews by telephone, so follow-up calls generally will not be 
needed. The team expects to contact no more than 10 individuals (5 
respondents and up to 5 nonrespondents).
    (3) Exemplary SA Interviews: The sample for this collection 
includes up to seven SA SNAP Directors. When five SA SNAP Directors 
agree to participate, they will be supported during the interview by up 
to two SNAP senior IT staff or data/program analysts. These staff are 
assumed to be the same individuals who previously completed the web 
survey. The five exemplary SAs will be selected using information 
gathered through the web survey and industry expert interviews. The 
assumption is that obtaining cooperation among SAs called ``exemplary'' 
will only require contacts with seven SAs to obtain five exemplary SA 
interviews. The study team will conduct these interviews by telephone 
conference call, with all respondents from a given SA participating 
jointly or in another, similar format. The number of respondents will 
be unchanged, since all are assumed to have participated in the web 
survey. The number of nonrespondents is expected to be no more than 
two, but they also are assumed to have participated in the web survey.
    Estimated Total Number of Respondents: 169 across the 3 data 
collection efforts. The total number of respondents contacted will be 
159 for the web survey (53 SAs with up to 3 respondents each) and, at 
most, 5 respondents (and 5 nonrespondents) for the industry expert 
interviews. The number of respondents contacted for the exemplary SA 
interviews is 7 SA SNAP Directors (out of which 2 are nonrespondents), 
and 10 staff for the 5 directors who agree to the interview. For all 
individuals contacted, it is assumed that the respondents will be the 
same individuals who are responding to the web survey, so they are not 
included in the total.
    Estimated Number of Responses per Respondent: 4.71. SA SNAP 
Director respondents will be asked to complete the web survey one time. 
Each SA

[[Page 10027]]

SNAP Director may receive up to 8 follow-up/reminder emails and up to 6 
reminder phone calls until the target of 53 respondents is reached. 
After completing the survey, there may be up to three brief additional 
contacts--two for questions and one for a thank-you email.
    The five SA SNAP Directors selected to participate in the exemplary 
SA interviews will be interviewed one time. The five selected SA SNAP 
Directors may receive up to three invitation and follow-up emails and 
up to two reminder phone calls to confirm the time of the planned 
interview until the target of five respondents is reached.
    The five industry experts who agree to participate in the industry 
expert interviews will be interviewed one time. Ten selected experts 
may receive up to three invitation/recruiting emails and up to two 
reminder phone calls to confirm the time of the planned interview, 
until the target of five respondents is reached. All who participate 
will receive thank-you emails.
    For the exemplary SA interviews, there is a total of six pre- and 
post-interview responses in addition to the interview. (We assume that 
only one of the staff attending the exemplary SA interview will receive 
the contacts before and after the interview.)
    Estimated Total Annual Responses: 796. All 53 SA SNAP Directors 
will complete the web survey with up to 106 others assisting them, with 
up to 13 reminders before the survey is completed and up to 3 contacts 
afterwards. Up to 7 SA SNAP Directors will be recruited to reach five 
SA SNAP Directors for the exemplary SA interviews, but the study team 
does not count these five as respondents because they are expected to 
have completed the web survey earlier. Additionally, 10 industry 
experts will be recruited for the industry expert interviews until the 
target of 5 respondents is reached. Both types of semi-structured 
interviews may involve as many as five contacts to arrange the 
interview and one post-interview contact (thank-you email). We also 
include burden on nonrespondents from receiving and reading the various 
recruiting contacts (emails or phone calls).
    Estimated Time per Response: 0.14 hours. The estimated time per web 
survey response is 1 hour. The estimated time per interview is 1 hour. 
The estimated time will vary depending on the type of contact and will 
range from 2 minutes (0.03 hours) to 3 hours (when three staff 
participate in a 1-hour interview). The following table outlines the 
estimated total annual burden for each type of respondent and for 
nonrespondents.
    Estimated Total Annual Burden on Respondents: The annual reporting 
burden is estimated to be 108.76 hours.

    Dated: March 7, 2019.
Brandon Lipps,
Administrator, Food and Nutrition Service.
BILLING CODE 3410-30-P

[[Page 10028]]

[GRAPHIC] [TIFF OMITTED] TN19MR19.001


[[Page 10029]]


[GRAPHIC] [TIFF OMITTED] TN19MR19.002


[[Page 10030]]


[FR Doc. 2019-05080 Filed 3-18-19; 8:45 am]
BILLING CODE 3410-30-C