[Federal Register Volume 84, Number 177 (Thursday, September 12, 2019)]
[Notices]
[Pages 48162-48165]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-19713]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

[Docket No. FR-6146-N-08]


Privacy Act of 1974; System of Records

AGENCY: Office of Chief information Officer, U.S. Department of Housing 
and Urban Development.

ACTION: Notice of amended Privacy Act System of Records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the Privacy Act of 1974, 5 U.S.C. 552a, the 
Department of Housing and Urban Development, Office of Chief 
Information Office, is giving notice that it intends to amend one of 
its systems of records published in the Federal Register, FR-6009-N-02. 
This update expands the existing system of records notice to authorize 
HUD's Enterprise Data Management (EDM) to collect and maintain 
information for mandatory transparency reporting requirements, such as 
the Federal Funding Accountability and Transparency Act (FFATA) and the 
Digital Accountability and Transparency Act (DATA Act). HUD is 
continuing to upgrade its data management, data warehousing, data 
mining and data security capabilities from current outdated legacy 
databases to the EDM platform.

DATES: October 15, 2019.
    Comments Due Date: October 15, 2019.

ADDRESSES: You may submit comments, identified by docket number and 
title, by one of the following methods:
    Federal e-Rulemaking Portal: http://www.regulation.gov. Follow the 
instructions provided on that site to submit comments electronically.
    Fax: 202-619-8365.
    Email: [email protected].
    Mail: Attention: Housing and Urban and Development, The Privacy 
Office; John Bravacos, Chief Privacy Officer (Acting), 451 Seventh 
Street SW, Room 10139, Washington, DC 20410.
    Instructions: All submission received must include the agency name 
and docket number for this rulemaking. All comments received will be 
posted without change to http://www.regulation.gov, including any 
personal information provided.
    Docket: For access to the docket to read background documents or 
comments received go to http://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT: The Privacy Office, 451 Seventh Street 
SW, Room 10139, Washington, DC 20410, telephone number 202-708-3054 
(this is not a toll-free number). Individuals who are hearing- and 
speech-impaired may access this telephone number via TTY by calling the 
Federal Relay Service at 800-877-8339 (this is a toll-free number).

SUPPLEMENTARY INFORMATION: In accordance with the Privacy Act of 1974, 
5 U.S.C. 552a, in June 2017, the Department of Housing and Urban 
Development (HUD) Office of Chief Information Officer (OCIO) 
established a new HUD system of records titled, ``Enterprise Data 
Management (EDM) System of Records.'' This system of records is 
operated by HUD's OCIO, and it will be developed in several phases. The 
initial phase included personally identifiable information (PII) about 
borrowers of Federal Housing Administration (FHA)-insured single-family 
mortgages, employees of FHA-approved lending institutions, third-
parties associated with FHA/HUD transactions such as appraisers and HUD 
personnel associated with single family transactions.
    OCIO has established an EDM environment, which includes a modern 
``Data Lake''; a centralized data environment to onboard HUD data for 
use in analytical reporting. The EDM also serves as the centralized 
environment for systems to consume data from HUD systems (eliminating 
point to point interfaces). In accordance with Section 203, National 
Housing Act, Public Law 73-479; and 42 U.S.C. 3543, titled ``Preventing 
fraud and abuse in Department of Housing and Urban Development 
programs'' enacted as part of the Housing and Community Development Act 
of 1987, the EDM and data lake enables HUD data consumers to gain new 
insights that will allow HUD to better identify trends and previously 
unknown risk drivers, thus strengthening its risk management and fraud 
prevention framework.
    EDM extracts data from multiple source systems for analysis and 
reporting. EDM provides query and reporting tools that aid in 
supporting HUD's oversight activities, market and economic assessment, 
public and stakeholder communication, financial and transparency 
reporting, planning and performance evaluation, policies and guidelines 
promulgation, and monitoring and enforcement. Making data available 
from the HUD source systems will involve Data Extraction, 
Transformation, and Load (ETL) into the EDM environment. The type of 
HUD source system (e.g., mainframe, relational database management 
system (RDBMS), hierarchical) will determine the approach and the tools 
that will be used to extract the data. EDM extracts data from multiple 
source systems for analysis and reporting. The following lists the type 
of information collected from Source Systems for the initial phase of 
EDM:
     Mortgagors: Name, addresses, date of birth, social 
security number, and racial/ethnic background (if disclosed) which are 
supplied by lenders through Automated Underwriting Systems during the 
mortgage application and underwriting process.
     Parties Involved with Transaction: Name, addresses, and 
identifying numbers which are supplied by the lender or the individual.
     Mortgage Details: Data regarding current and former FHA 
insured mortgages which includes underwriting data, such as: Loan-to-
value ratios and expense ratios; original terms, such as: Mortgage 
amount, interest rate, term in months; status of the mortgage 
insurance; and history.
     Aggregated measures of the data stated above to enable 
statistical reporting and analysis of trends.
    The following lists the type of information collected and 
maintained for the update of EDM to support transparency reporting 
requirements, such as FFATA and the DATA Act:
     Summary Financial Information--Treasury Account Symbols, 
United States Standard General Ledger (USSGL) Account Balances, Program 
Activity Codes and Names, and Budget Object Class Codes.
     Award Financial Information--Parent Award Identification 
Numbers, Procurement Instrument Identification Numbers, Contract 
Obligation and De-obligation Amounts.
     Procurement Information--Award Recipients, Recipient 
Address Information, and other Demographic Indicators sourced from the 
Federal Procurement Data System (FPDS).
     DATA Act Review and Submission Data--DATA Act Broker 
Submission ID, Warning and Error Codes, HUD Review Details (Timestamp, 
Reviewer ID).

SYSTEM NAME AND NUMBER:
    HUD/OCIO-002 Enterprise Data Management (EDM).

SECURITY CLASSIFICATION:
    Not classified.

SYSTEM LOCATION:
    EDM is hosted at the Department of Housing and Urban Development, 
451 Seventh Street SW, Washington, DC 20410.

[[Page 48163]]

SYSTEM MANAGER(S):
    Russel Burns, Chief Technology Officer (Acting), 451 7th Street SW, 
Room 4250 Washington, DC 20410 202-402-3182.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    The Enterprise Data Management environment is authorized by Chapter 
113 of Title 40 of the US Code, (40 U.S.C. 11311 et seq.); the 
Department of Housing and Urban Development Appropriations Act, 2019 
(Title II, Division G, Pub. L. 116-6); and in accordance with the Data 
Accountability and Transparency Act of 2014 (Pub. L. 113-101). The 
system is maintained in accordance with Section 203, National Housing 
Act, Public Law 73-479; and 42 U.S.C. Sec.  3543, titled ``Preventing 
fraud and abuse in Department of Housing and Urban Development 
programs'' enacted as part of the Housing and Community Development Act 
of 1987, which permits the collection of Social Security Numbers.

PURPOSE(S) OF THE SYSTEM:
    EDM replaces HUD's current data storage, retrieval and warehousing 
capabilities. EDM will be implemented in phases across HUD, and the 
first phase was to directly support the new Loan Review System (LRS). 
It collects data from certain specified source systems and returns it 
to LRS. Subsequent phases will collect data from other source systems, 
and ultimately will replace all existing data warehouses across HUD. 
This SORN update is to reflect additional source systems required for 
FFATA and the DATA Act, as well as update the categories of data 
collected to support these transparency reporting requirements. No 
additional information about individuals is collected or reported as 
part of this update.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    The initial phase of EDM covered individuals who have obtained a 
mortgage insured under FHA's single family mortgage insurance programs, 
for example:
     Individuals who have assumed such a mortgage;
     Individuals involved in appraising, underwriting, or 
servicing the mortgage (commonly referred to as ``mortgagee/lender'').
    This SORN update for EDM covers transparency reporting legislation 
requirements--FFATA, and the DATA Act, which requires reporting of 
summary financial information, contract details, and financial 
assistance (loan and grant) transaction information. HUD transparency 
reporting is published on an external website, USASpending.gov. No 
information regarding individuals is collected in EDM for FFATA and 
DATA Act reporting purposes, and governing policy from OMB is such that 
PII is protected and not reported publicly.

CATEGORIES OF RECORDS IN THE SYSTEM:
    The initial categories of records maintained by the system 
included:
     Appraiser: First Name, Last Name, Middle Name, Suffix.
     Case Borrower(s): Borrower(s) Full Name, Borrower(s) 
Social Security number, Non-Borrowing Spouse Social Security number
     Loan Officer: First Name, Last Name, Middle Name.
     Case Property: Basement Code, Neighborhood Percentage 
Owned, Neighborhood Predominate, Price, Subdivision Indicator, Property 
Acquisition Date, Property Street, Property Conversion Type, Rural 
Neighborhood Code, Neighborhood Single Family Home Percentage, 
Subdivision Lot Indicator, Building Type, Date of Sale or Transfer, 
Sale Amount, Year Built, City, Zip, Geocode Flag, Underserved 
Indicator, Block, Lot, House Number, Street Number. FHA Case 
Information: Federal Housing Administration (FHA) Case Number, Case 
Established Date, Case Reinstatement Date, Case Type, Originating 
Mortgage ID, Sponsor Mortgagee ID, Loan Officer Nationwide Multistate 
Licensing System (NMLS) ID, Underwriter Name, Underwriter ID. Mortgagee 
(Lender) Branch: Branch Type, Branch ID, Mortgagee Institution ID, 
Mortgagee Institution Name, Mortgagee Institution Type, Mortgagee 
Nationwide Multistate Licensing System (NMLS) ID, Mortgagee Status, HUD 
Employees: Names and identification of all HUD employees who have 
access to the system records. Also, identification information is 
stored for employees who work with mortgage applications through FHA 
Connection. Servicing Status: Servicing Status, Claims, and 
Indemnification Agreement. New records collected and maintained by the 
system to support FFATA and DATA Act reporting include the following: 
Summary Budget and Financial Information--Treasury Account Symbol, 
Program Activities, Budget Object Class, and Obligation and Outlay 
information, General Ledger balances.
     Contract Information--Contract ID, Obligation Amount, De-
obligation Amount, Parent Award ID, Contract Recipient, Contractor 
Address and Demographic Information, Contract Award Type.
     Title I Insurance, Home Equity Conversation Mortgage 
(HECM), and Multifamily Loan Endorsement Data--FHA Case/Project Number, 
Lender ID, Loan Amount, Section of Act Code, Risk Category, Origination 
Date.
     DATA Act Review and Submission Data--DATA Act Broker 
Submission ID, Warning and Error Codes, HUD Review Details (Timestamp, 
Reviewer ID).

RECORD SOURCE CATEGORIES:
    Mortgagors, appraisers, mortgagee staff, underwriters, and HUD 
employees provide data to the originating source systems then pass 
their data to the Enterprise Data Warehouse used in EDM:
     A43--Single Family Insurance System (SFIS)
     A43C--Single Family Claims Subsystem (SFCS)
     F17--Computerized Homes Underwriting Management System 
(CHUMS)
     F17T--TOTAL Mortgage Scorecard (TOTAL)
     F42D--Single Family Default Monitoring System (SFDMS)
     P2710 Home Equity Reverse Mortgage Information System 
(HERMIT)
     P278--Lender Electronic Assessment Portal (LEAP)
     P303--Loan review System (LRS)
    To support DATA Act reporting, the following systems will provide 
data to EDM:
     P085--Comprehensive Servicing and Monitoring System (CSMS)
     F24A--Development Application Processing System (DAP)
     P013--FHA Subsidiary Ledger (FHA-SL)
     A80S--Single Family Acquired Asset Management System 
(SAMS)
     F72--Title I Insurance and Claims System (TIIS)
     A15--Geocoding Service Center (GSC)
     P237--Ginnie Mae Financial and Accounting System (GFAS)

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    In addition to those disclosures generally permitted under 5 U.S.C. 
Section 552a(b) of the Privacy Act, all or a portion of the records or 
information in this system may be disclosed to authorized entities, as 
determined to be relevant and necessary, outside the Department of 
Housing and Urban Development (HUD) as a routine use pursuant to 5 
U.S.C. 552a(b)(3):
    1. To appropriate agencies, entities, and persons when (1) HUD 
suspects or has confirmed that there has been a breach of the system of 
records, (2) HUD

[[Page 48164]]

has determined that as a result of the suspected or confirmed breach 
there is a risk of harm to individuals, HUD (including its information 
systems, programs, and operations), the Federal Government, or national 
security; and (3) the disclosure made to such agencies, entities, and 
persons is reasonably necessary to assist in connection with HUD's 
efforts to respond to the suspected or confirmed breach or to prevent, 
minimize, or remedy such harm.
    2. To another Federal agency or Federal entity, when HUD determines 
that information from this system of records is reasonably necessary to 
assist the recipient agency or entity in (1) responding to a suspected 
or confirmed breach or (2) preventing, minimizing, or remedying the 
risk of harm to individuals, the recipient agency or entity (including 
its information systems, programs, and operations), the Federal 
Government, or national security, resulting from a suspected or 
confirmed breach.
    3. To the National Archives and Records Administration (NARA) and 
the General Services Administration (GSA) for records having sufficient 
historical or other value to warrant its continued preservation by the 
United States Government, or for inspection under the authority of 
Title 44, Chapter 29, of the United States.
    4. To a congressional office from the record of an individual in 
response to an inquiry from that congressional office made at the 
request of the individual.
    5. To contractors and their agents, grantees, experts, consultants, 
and others performing or working on a contract, service, grant, 
cooperative agreement, or other assignment for HUD, when necessary to 
accomplish an agency function related to this system of records. 
Individuals provided information under this routine use are subject to 
the same Privacy Act requirements and limitations on disclosure as are 
applicable to HUD officers and employees.
    6. To contractors, grantees, experts, consultants, Federal 
agencies, and non-Federal entities, including, but not limited to, 
State and local governments and other research institutions or their 
parties, and entities and their agents with whom HUD has a contract, 
service agreement, grant, or cooperative agreement, when necessary to 
accomplish an agency function related to a system of records, for the 
purposes of statistical analysis and research in support of program 
operations, management, performance monitoring, evaluation, risk 
management, and policy development, or to otherwise support the 
Department's mission. Records under this routine use may not be used in 
whole or in part to make decisions that affect the rights, benefits, or 
privileges of specific individuals. The results of the matched 
information may not be disclosed in identifiable form.
    7. To the American Public in support of Public Law 113-01, the 
Digital Accountability and Transparency Act of 2014 (DATA Act) and 
Public Law 109-282, the Federal Funding Accountability and Transparency 
Act of 2006 (FFATA), for the purposes of reviewing reliable and 
consistent reporting of federal spending data of federal agency 
obligations and expenditures through the publicly accessible website, 
USASpending.gov.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    EDM will be stored in compliance with 36 CFR 1236.10 regulations on 
recordkeeping management controls in a Federal Risk and Authorization 
Management Program (FedRAMP) compliant network. There are no paper 
records associated with EDM.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Information is currently retrieved from EDM using a series of key 
identifiers (e.g., FHA Case Number, Project Number, etc.). User access 
to query information in the EDM does not exist. EDM supports only 
system-to-system interfaces.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    Electronic information maintained in EDM is retrieved from 
originating recordkeeping systems and is retained indefinitely for 
future access. This information does not meet the federal definition of 
a record as it is not evidence of the organization, functions, 
policies, decisions, procedures, operations, or other activities. This 
information is duplicated copies of record content preserved for 
convenience to facilitate new record creation 44 U.S.C. 3301. As 
subsequent phases of EDM are completed, specific retention periods and 
disposal procedures will be evaluated and defined for those records in 
accordance with the HUD Records Schedule in the HUD Records Disposition 
Schedules Handbook (2225.6), or the NARA publication, General Records 
Schedule.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    HUD has developed a system security plan of controls for ensuring 
and protecting Microsoft Azure Government Cloud in accordance with 
applicable laws. End users cannot directly access the Enterprise Data 
Warehouse in EDM. Data exchange with other HUD systems is precisely 
specified and occurs only through secure interfaces. Encryption of data 
both at rest and in motion is enabled on a selective basis. EDM is 
subject to compliance with all Federal requirements and adheres to its 
approved system security plans (SSP).

RECORD ACCESS PROCEDURES:
    For Information, assistance, or inquiries about records, contact 
John Bravacos, Senior Agency Official for Privacy, 451 Seventh Street 
SW, Room 10139, Washington, DC 20410, telephone number (202) 708-3054. 
When seeking records about yourself from this system of records or any 
other HUD system of records, your request must conform with the Privacy 
Act regulations set forth in 24 CFR part 16. You must first verify your 
identity, by providing your full name, address, and date and place of 
birth. You must sign your request, and your signature must either be 
notarized or submitted under 28 U.S.C. 1746, a law that permits 
statements to be made under penalty of perjury as a substitute for 
notarization. If your request is seeking records pertaining to another 
living individual, you must include a statement from that individual 
certifying their agreement for you to access their records. Without the 
above information, the HUD FOIA Office may not conduct an effective 
search, and your request may be denied due to lack of specificity or 
lack of compliance with regulations.

CONTESTING RECORD PROCEDURES:
    The Department's rules for contesting contents of records and 
appealing initial denials appear in 24 CFR part 16, Implementation of 
the Privacy Act of 1974. Additional assistance may be obtained by 
contacting John Bravacos, Senior Agency Official for Privacy, 451 
Seventh Street SW, Room 10139, Washington, DC 20410, or the HUD 
Departmental Privacy Appeals Officers, Office of General Counsel, 
Department of Housing and Urban Development, 451 Seventh Street SW, 
Room 10110, Washington DC 20410.

NOTIFICATION PROCEDURES:
    Individuals seeking notification of and access to any record 
contained in this system of records, or seeking to contest its content, 
may submit a request in writing to the Privacy Office at the address 
provided above or to the component's FOIA Officer, whose contact 
information can be found at http://www.hud.gov/foia under ``contact.'' 
If an individual believes

[[Page 48165]]

more than one component maintains Privacy Act records concerning him or 
her, the individual may submit the request to the Senior Agency 
Official for Privacy, HUD, 451 Seventh Street SW, Room 10139, 
Washington, DC 20410.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    None.

HISTORY:
    EDM SORN was originally published in: DEPARTMENT OF HOUSING AND 
URBAN DEVELOPMENT [Docket No. FR-6009-N-02] Privacy Act of 1974: 
Enterprise Data Management (EDM) System of Records.

    Dated: August 26, 2019.
John G. Bravacos,
Senior Agency Official for Privacy.
[FR Doc. 2019-19713 Filed 9-11-19; 8:45 am]
 BILLING CODE 4210-67-P