[Federal Register Volume 86, Number 235 (Friday, December 10, 2021)]
[Proposed Rules]
[Page 70429]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2021-26754]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY

48 CFR Parts 3001, 3002, 3024 and 3052

[Docket No. DHS-2017-0008]
RIN 1601-AA79


Withdrawal of Proposed Revision to Department Homeland Security 
Acquisition Regulation (HSAR); Privacy Training (HSAR Case 2015-003)

AGENCY: Office of the Chief Procurement Officer, Department of Homeland 
Security (DHS).

ACTION: Notice of withdrawal of proposed rule.

-----------------------------------------------------------------------

SUMMARY: DHS is withdrawing a proposed rule titled Privacy Training 
(HSAR Case 2015-003) and providing notice of its cancellation. The 
Notice of Proposed Rulemaking proposed to amend the HSAR to require 
contractor and subcontractor employees to complete Privacy training 
before accessing a Government system of records; handling Personally 
Identifiable Information (PII) and/or Sensitive Personally Identifiable 
Information; or designing, developing, maintaining, or operating a 
Government system of records. DHS is withdrawing this proposed rule 
because the content of this proposal was addressed in a final rule 
issued by the Civilian Agency Acquisition Council and the Defense 
Acquisition Regulations Council and resultant DHS FAR Class Deviation 
Number 17-03, Implementation of FAR 52.224-3 Privacy Training--
Alternate I. Thus, DHS will not take any further action on this 
proposal.

DATES: The proposed rule published on January 19, 2017 (82 FR 6425) and 
the comment period extended to March 20, 2017 (82 FR 14341), is 
withdrawn effective December 10, 2021.

ADDRESSES: Mail: Department of Homeland Security, Office of the Chief 
Procurement Officer, Acquisition Policy and Legislation, ATTN: Candace 
Lightfoot, 245 Murray Drive, Bldg. 410 (RDS), Washington, DC 20528.

FOR FURTHER INFORMATION CONTACT: Ms. Candace Lightfoot, Procurement 
Analyst, DHS, Office of the Chief Procurement Officer, Acquisition 
Policy and Legislation at (202) 447-0882 or email [email protected]. When 
using email, include HSAR Case 2015-003 in the ``Subject'' line.

SUPPLEMENTARY INFORMATION: On January 19, 2017, DHS published a 
proposed rule at 82 FR 6425 titled Privacy Training (HSAR Case 2015-
003). The rule proposed to amend the HSAR to require contractor and 
subcontractor employees to complete Privacy training before (1) 
accessing a Government system of records; (2) handling Personally 
Identifiable Information and/or Sensitive Personally Identifiable 
Information; or (3) designing, developing, maintaining, or operating a 
Government system of records.
    DHS received two public comments in response to this proposed rule. 
One commenter stated support for the requirements in the proposed rule. 
The other commenter:
     Showed support for DHS making available on a public 
website a DHS-developed privacy training module that contractors can 
provide to their employees to achieve compliance with the proposed 
requirements. However, recommended that certain contractors may desire 
to develop their own internal Privacy Act training that would be 
compatible with DHS's rules and their own corporate policies, 
procedures, and training;
     Recommended that DHS add the Privacy Act's definition of a 
``system of records'' to increase understanding by both government and 
contractor personnel about when the clause and the training are 
required;
     Recommended requiring flow down of HSAR 3052.224-7X only 
to subcontractors with a statement of work that triggers the training 
requirement;
     Recommended that DHS further clarify the requirement to 
maintain training certificates and leverage electronic recordkeeping 
when available; and
     Recommended that DHS modify the proposed rule to clarify 
whether older training certificates must be maintained after submittal 
and, if so, recommends that DHS specifically identify the retention 
period.
    On December 20, 2016, DoD, GSA, and NASA \1\ issued a final rule at 
81 FR 93476 titled Privacy Training, which amended the Federal 
Acquisition Regulation (FAR), effective on January 19, 2017. Upon 
further review, DHS believes that the FAR rule addressed issues raised 
by this commenter.
---------------------------------------------------------------------------

    \1\ Civilian Agency Acquisition Council and the Defense 
Acquisition Regulations Council.
---------------------------------------------------------------------------

    DHS is withdrawing the proposed rule (82 FR 6425) and will not 
proceed with finalization of the rule because all of the requirements 
in the proposed rule are now covered under the final FAR rule (81 FR 
93476) and resultant DHS FAR Class Deviation Number 17-03, 
Implementation of FAR 52.224-3 Privacy Training--Alternate I. The final 
FAR rule (81 FR 93476) provides guidance to contractors regarding the 
requirement to complete training that addresses the protection of 
privacy in accordance with the Privacy Act of 1974, 5 U.S.C. 552a, as 
amended, and the handling and safeguarding of PII. Under this rule, 
contractors are responsible for ensuring that initial privacy training, 
and annual privacy training thereafter, is completed by contractor 
employees who have access to a system of records; create, collect, use, 
process, store, maintain, disseminate, disclose, dispose, or otherwise 
handle personally identifiable information; or design, develop, 
maintain, or operate a system of records. A contractor who has 
employees involved in these activities is also required to maintain 
records indicating that its employees have completed the requisite 
training and provide these records to the contracting officer upon 
request. In addition, the prime contractor is required to flow-down 
these requirements to all applicable subcontracts. As a result of the 
FAR change and DHS FAR Class Deviation Number 17-03, the rationale for 
the proposed rule no longer exists and this proposal is withdrawn.

    Dated: December 7, 2021.
Paul Courtney,
Chief Procurement Officer, Department of Homeland Security.
[FR Doc. 2021-26754 Filed 12-9-21; 8:45 am]
BILLING CODE P