Notice2021-14409
Privacy Act of 1974; System of Records
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
July 7, 2021
Effective
July 7, 2021
Issuing agencies
Education Department
Abstract
In accordance with the Privacy Act of 1974, as amended (Privacy Act), the U.S. Department of Education (Department) publishes this notice of a new system of records entitled ``Education Enterprise Identity, Credential, and Access Management (ED ICAM) System'' (18-04- 05). The ED ICAM System contains identifying information about individual Department employees and contractors.
Full Text
<html>
<head>
<title>Federal Register, Volume 86 Issue 127 (Wednesday, July 7, 2021)</title>
</head>
<body><pre>
[Federal Register Volume 86, Number 127 (Wednesday, July 7, 2021)]
[Notices]
[Pages 35763-35766]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2021-14409]
[[Page 35763]]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF EDUCATION
[Docket ID ED-2021-OCIO-0026]
Privacy Act of 1974; System of Records
AGENCY: Office of the Chief Information Officer, U.S. Department of
Education.
ACTION: Notice of a new system of records.
-----------------------------------------------------------------------
SUMMARY: In accordance with the Privacy Act of 1974, as amended
(Privacy Act), the U.S. Department of Education (Department) publishes
this notice of a new system of records entitled ``Education Enterprise
Identity, Credential, and Access Management (ED ICAM) System'' (18-04-
05). The ED ICAM System contains identifying information about
individual Department employees and contractors.
DATES: Submit your comments on this new system of records notice on or
before August 6, 2021. This new system of records will become effective
upon publication in the Federal Register on July 7, 2021, unless the
new system of records notice needs to be changed as a result of public
comment. The routine uses listed in the paragraph entitled ROUTINE USES
OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND
PURPOSES OF SUCH USES will become effective on August 6, 2021, unless
the new system of records notice needs to be changed as a result of
public comment. The Department will publish any significant changes to
the system of records or routine uses resulting from public comment.
ADDRESSES: Submit your comments through the Federal eRulemaking Portal
or via postal mail, commercial delivery, or hand delivery. We will not
accept comments submitted by fax or by email or those submitted after
the comment period. To ensure that we do not receive duplicate copies,
please submit your comments only once. In addition, please include the
Docket ID at the top of your comments.
<bullet> Federal eRulemaking Portal: Go to <a href="http://www.regulations.gov">www.regulations.gov</a> to
submit your comments electronically. Information on using
<a href="http://Regulations.gov">Regulations.gov</a>, including instructions for accessing agency documents,
submitting comments, and viewing the docket, is available on the site
under the ``Help'' tab.
<bullet> Postal Mail, Commercial Delivery, or Hand Delivery: If you
mail or deliver your comments about this new system of records notice,
address them to: Roman Kulbashny, Branch Chief, Security Engineering
and Architecture, Information Assurance Services, Office of the Chief
Information Officer, U.S. Department of Education, 550 12th Street SW,
Washington, DC 20202.
Privacy Note: The Department's policy is to make all comments
received from members of the public available for public viewing in
their entirety on the Federal eRulemaking Portal at
<a href="http://www.regulations.gov">www.regulations.gov</a>. Therefore, commenters should be careful to include
in their comments only information that they wish to make publicly
available.
Assistance to Individuals with Disabilities in Reviewing the
Rulemaking Record: On request, we will supply an appropriate
accommodation or auxiliary aid to an individual with a disability who
needs assistance to review the comments or other documents in the
public rulemaking record for this notice. If you want to schedule an
appointment for this type of accommodation or auxiliary aid, please
contact the person listed under FOR FURTHER INFORMATION CONTACT.
FOR FURTHER INFORMATION CONTACT: Roman Kulbashny, Branch Chief,
Security Engineering and Architecture, Information Assurance Services,
Office of the Chief Information Officer, U.S. Department of Education,
550 12th Street SW, Washington, DC 20202. Telephone: (202) 245-6848. If
you use a telecommunications device for the deaf (TDD) or a text
telephone (TTY), you may call the Federal Relay Service at 1-800-877-
8339.
SUPPLEMENTARY INFORMATION: The records maintained in this system
establish a central and authoritative identity management data
repository for the Department's enterprise identities. The system of
records is maintained to provide authorized individuals access to, or
to interact with, the Department's information technology resources.
The system will be utilized to support identity management data
activities including, but limited to: (1) The management and governance
of digital identity lifecycle activities; (2) the full auditing of all
digital identities; and, (3) the management of application and system
access.
Accessible Format: On request to the program contact person listed
under FOR FURTHER INFORMATION CONTACT, individuals with disabilities
can obtain this document and a copy of the application package in an
accessible format. The Department will provide the requestor with an
accessible format that may include Rich Text Format (RTF) or text
format (txt), a thumb drive, an MP3 file, braille, large print,
audiotape, or compact disc, or other accessible format.
Electronic Access to This Document: The official version of this
document is the document published in the Federal Register. You may
access the official edition of the Federal Register and the Code of
Federal Regulations at <a href="http://www.govinfo.gov">www.govinfo.gov</a>.
At this site, you can view this document, as well as all other
documents of this Department published in the Federal Register, in text
or Portable Document Format (PDF). To use PDF, you must have Adobe
Acrobat Reader. You may also access documents of the Department
published in the Federal Register by using the article search feature
at: <a href="http://www.federalregister.gov">www.federalregister.gov</a>. Specifically, through the advanced search
feature at this site, you can limit your search to documents published
by the Department.
Jason Gray,
Chief Information Officer.
For the reasons discussed in the preamble, the Office of the Chief
Information Officer of the U.S. Department of Education publishes a
notice of a new system of records to read as follows:
SYSTEM NAME AND NUMBER:
Education Enterprise Identity, Credential, and Access Management
(ED ICAM) System (18-04-05).
SECURITY CLASSIFICATION:
Controlled Unclassified.
SYSTEM LOCATION:
Office of the Chief Information Officer, Information Assurance,
U.S. Department of Education, 550 12th Street SW, Washington, DC 20202.
Oracle Corporation, 1501 4th Avenue, Suite #1800/Century Square
Building, Seattle, WA 98101 (provides the infrastructure on which the
ED ICAM System runs).
IBM SmartCloud for Government, 6300 Diagonal Hwy., B001, 1st Floor,
Boulder, CO 80301-3292 (provides the infrastructure on which the ED
ICAM System runs).
SYSTEM MANAGER(S):
Branch Chief, Office of the Chief Information Officer, U.S.
Department of Education, 550 12th Street SW, Washington, DC 20202.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
Federal Information Security Modernization Act of 2014, 44 U.S.C.
3551 et seq.; Homeland Security Presidential Directive 12: Policy for a
Common Identification Standard for Federal Employees and Contractors
(Aug. 2015); Federal Information
[[Page 35764]]
Processing Standards (FIPS) 201-2, Personal Identity Verification (PIV)
of Federal Employees and Contractors (Aug. 2013); Office of Management
and Budget (OMB) Circular A-130, Managing Information as a Strategic
Resource (July 2016); OMB Memorandum 10-28, Clarifying Cybersecurity
Responsibilities and Activities of the Executive Office of the
President and the Department of Homeland Security (July 6, 2010); OMB
Memorandum 14-03, Enhancing the Security of Federal Information and
Information Systems (Nov. 18, 2013); and OMB Memorandum 19-17, Enabling
Mission Delivery through Improved Identity, Credential, and Access
Management (May 21, 2019).
PURPOSE(S) OF THE SYSTEM:
The records maintained in this system establish a central and
authoritative identity management data repository for the Department's
enterprise identities. The system of records is maintained to provide
authorized individuals with access to, or to interact with, the
Department's information technology resources. The system will be
utilized to support identity management data activities including, but
not limited to:
(1) The management and governance of digital identity lifecycle
activities;
(2) the full auditing of all digital identities; and,
(3) the management of application and system access.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
This system contains records on Department employees and
contractors who apply for, and were granted access to, the Department's
information technology resources.
CATEGORIES OF RECORDS IN THE SYSTEM:
This system of records contains records for employees and
contractors related to digital identity, credential, access management,
and identity governance including, but not limited to: Name; unique
numerical/alphanumerical identification numbers; work address; date of
birth (DOB); country of citizenship; credential information; contact
information; organizational data; identity investigation and summary
adjudication information; verification of training requirements or
other prerequisite requirements for access to Department information
technology resources; and system access data such as account data,
roles, privileges, and entitlements.
RECORD SOURCE CATEGORIES:
Information in this system is obtained from official Department
information technology systems and is fed into the system of records
from the following source systems: The Department's system of records
entitled ``Investigatory Material Compiled for Personnel Security,
Suitability, Positive Identification Verification and Access Control
for the Department of Education Security Tracking and Reporting System
(EDSTAR),'' (18-05-17), which was last published in full in the Federal
Register at 72 FR 66158 (Nov. 27, 2007); and the General Services
Administration's system of records entitled ``HSPD-12 USAccess,'' (GSA/
GOVT-7), which was last published in full in the Federal Register at 80
FR 64416 (Oct. 23, 2015).
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND PURPOSES OF SUCH USES:
The Department may disclose individually identifiable information
contained in a record in this system of records under the routine uses
listed in this system of records without the consent of the individual
if the disclosure is compatible with the purpose(s) for which the
record was collected. The Department may make these disclosures on a
case-by-case basis or, if the Department has complied with the computer
matching requirements of the Privacy Act of 1974, as amended (Privacy
Act), under a computer matching agreement.
(1) Congressional Member Disclosure. The Department may disclose
information to a member of Congress and to his or her staff from the
records of an individual in response to an inquiry from the member made
at the written request of that individual. The member's right to the
information is no greater than the right of the individual who
requested the inquiry.
(2) Litigation and Alternative Dispute Resolution (ADR) Disclosure.
(a) Introduction. In the event that one of the parties listed in
sub-paragraphs (i) through (v) is involved in judicial or
administrative litigation or ADR, or has an interest in judicial or
administrative litigation or ADR, the Department may disclose certain
records to the parties described in paragraphs (b), (c), and (d) of
this routine use under the conditions specified in those paragraphs:
(i) The Department or any of its components;
(ii) Any Department employee in his or her official capacity;
(iii) Any Department employee in his or her individual capacity if
the U.S. Department of Justice (DOJ) agrees to or has been requested to
provide or arrange for representation for the employee;
(iv) Any Department employee in his or her individual capacity
where the Department has agreed to represent the employee; or
(v) The United States where the Department determines that the
litigation is likely to affect the Department or any of its components.
(b) Disclosure to the DOJ. If the Department determines that
disclosure of certain records to the DOJ is relevant and necessary to
judicial or administrative litigation or ADR, the Department may
disclose those records as a routine use to DOJ.
(c) Adjudicative Disclosure. If the Department determines that
disclosure of certain records to an adjudicative body before which the
Department is authorized to appear, to a person or entity designated by
the Department or otherwise empowered to resolve or mediate disputes,
is relevant and necessary to judicial or administrative litigation or
ADR, the Department may disclose those records as a routine use to the
adjudicative body, person, or entity.
(d) Disclosure to Parties, Counsel, Representatives, or Witnesses.
If the Department determines that disclosure of certain records is
relevant and necessary to judicial or administrative litigation or ADR,
the Department may disclose those records as a routine use to the
party, counsel, representative, or witness.
(3) Enforcement Disclosure. If information in this system of
records, alone or in connection with other information, indicates a
violation or potential violation of any applicable statutory,
regulatory, or legally binding requirement, the Department may disclose
records to an entity charged with investigating or prosecuting such
violation or potential violation.
(4) Employment, Benefit, and Contracting Disclosure.
(a) For Decisions by the Department. The Department may disclose a
record to a Federal, State, or local agency maintaining civil,
criminal, or other relevant enforcement or other pertinent records, or
to another public authority or professional organization, if necessary
to obtain information relevant to a Department decision concerning the
hiring or retention of an employee or other personnel action, the
issuance of a security clearance, the letting of a contract, or the
issuance of a license, grant, or other benefit.
(b) For Decisions by Other Public Agencies and Professional
Organizations. The Department may disclose a record to a Federal,
State, local, or foreign agency or other public authority or
professional organization, in connection with its decision concerning
the hiring or retention of an
[[Page 35765]]
employee or other personnel action, the issuance of a security
clearance, the reporting of an investigation of an employee, the
letting of a contract, or the issuance of a license, grant, or other
benefit, to the extent that the record is relevant and necessary to the
receiving entity's decision on the matter.
(5) Employee Grievance, Complaint, or Conduct Disclosure. If a
record is relevant and necessary to an employee grievance, complaint,
or disciplinary action involving a present or former employee of the
Department, the Department may disclose a record in this system of
records in the course of investigation, fact-finding, or adjudication,
to any party to the grievance, complaint, or action; to the party's
counsel or representative; to a witness; or to a designated fact-
finder, mediator, or other person designated to resolve issues or
decide the matter.
(6) Labor Organization Disclosure. The Department may disclose
records from this system of records to an arbitrator to resolve
disputes under a negotiated grievance procedure or to officials of
labor organizations recognized under 5 U.S.C. chapter 71 when relevant
and necessary to their duties of exclusive representation.
(7) Freedom of Information Act (FOIA) or Privacy Act Advice
Disclosure. The Department may disclose records to DOJ or OMB if the
Department concludes that disclosure is desirable or necessary in
determining whether particular records are required to be disclosed
under FOIA or the Privacy Act.
(8) Contract Disclosure. If the Department contracts with an entity
for the purposes of performing any function that requires disclosure of
records in this system to the employees of the contractor, the
Department may disclose the records to those employees. As part of such
a contract, the Department shall require the contractor to agree to
establish and maintain safeguards to protect the security and
confidentiality of the disclosed records.
(9) Research Disclosure. The Department may disclose records to a
researcher if an appropriate official of the Department determines that
the individual or organization to which the disclosure would be made is
qualified to carry out specific research related to functions or
purposes of this system of records. The official may disclose records
from this system of records to that researcher solely for the purpose
of carrying out that research related to the functions or purposes of
this system of records. The researcher shall be required to agree to
establish and maintain safeguards to protect the security and
confidentiality of the disclosed records.
(10) Disclosure in the Course of Responding to a Breach of Data.
The Department may disclose records from this system to appropriate
agencies, entities, and persons when (a) the Department suspects or has
confirmed that there has been a breach of the system of records; (b)
the Department has determined that as a result of the suspected or
confirmed breach there is a risk of harm to individuals, the Department
(including its information systems, programs, and operations), the
Federal Government, or national security; and (c) the disclosure made
to such agencies, entities, and persons is reasonably necessary to
assist in connection with the Department's efforts to respond to the
suspected or confirmed breach or to prevent, minimize, or remedy such
harm.
(11) Disclosure in Assisting another Agency in Responding to a
Breach of Data. The Department may disclose records from this system to
another Federal agency or Federal entity, when the Department
determines that information from this system of records is reasonably
necessary to assist the recipient agency or entity in (a) responding to
a suspected or confirmed breach or (b) preventing, minimizing, or
remedying the risk of harm to individuals, the recipient agency or
entity (including its information systems, programs, and operations),
the Federal Government, or national security, resulting from a
suspected or confirmed breach.
(12) Disclosure in the Course of Responding to a Security Incident.
The Department may disclose records to appropriate governmental
agencies, entities, and persons when (a) the Department suspects or has
confirmed that there has been a security incident involving the system
of records; (b) the Department has determined that as a result of the
suspected or confirmed security incident, there is a risk of harm to
individuals, the Department (including its information systems,
programs, and operations), the Federal Government, or national
security; and (c) the disclosure made to such governmental agencies,
entities, and persons is necessary to assist in connection with the
Department's efforts to respond to such suspected or confirmed security
incident or to prevent, minimize, or remedy such harm.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Records are stored on an encrypted server within a secured and
controlled environment. There are no hardcopy records that require
additional storage.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Records are retrieved by a combination of name and other unique
personal identifiers.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
Records are retained and disposed of in accordance with General
Records Schedule (GRS) 3.2, Item 030 (DAA-GRS-2013-0006-0003) and Item
031 (DAA-GRS-2013-0006-0004). GRS 3.2, Item 030, requires destruction
of records when business use ceases; and, GRS 3.2, Item 031, requires
destruction of records 6 years after password is altered or user
account is terminated, but longer retention is authorized if required
for business use.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
All physical access to the Department site, and the sites of
Department contractors where this system of records is maintained, is
controlled and monitored by security personnel who check each
individual entering the building for his or her employee or visitor
badge. The computer systems employed by the Department offer a high
degree of resistance to tampering and circumvention. These security
systems limit data access to Department and contract staff on a ``need
to know'' basis and control individual users' ability to access and
alter records within the system. All users of this system of records
are given a unique user ID with personal identifiers. All interactions
by individual users with the system are recorded.
RECORD ACCESS PROCEDURES:
If you wish to gain access to a record regarding you in this system
of records, contact the system manager at the address listed above. You
must provide the system manager with the necessary particulars such as
your full, legal name, date of birth, work address, country of
citizenship, and any other identifying information requested by the
Department while processing the request in order to distinguish between
individuals with the same name. Requesters must also reasonably specify
the record contents sought. Your request must meet the requirements of
the regulations at 34 CFR 5b.5, including proof of identity.
CONTESTING RECORD PROCEDURES:
If you wish to contest the content of a record regarding you in
this system of records, contact the system manager at
[[Page 35766]]
the address listed above. You must provide your full, legal name, and
any other identifying information requested by the Department while
processing the request in order to distinguish between individuals with
the same name. You must also specify the information to be contested.
Your request must meet the requirements of the regulations at 34 CFR
5b.7.
NOTIFICATION PROCEDURES:
If you wish to determine whether a record exists regarding you in
this system of records, contact the system manager at the address
listed above. You must provide necessary particulars such as your full,
legal name, date of birth, work address, country of citizenship, and
any other identifying information requested by the Department while
processing the request to distinguish between individuals with the same
name. Your request must meet the requirements of the regulations at 34
CFR 5b.5, including proof of identity.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
HISTORY:
None.
[FR Doc. 2021-14409 Filed 7-6-21; 8:45 am]
BILLING CODE 4000-01-P
</pre></body>
</html>Indexed from Federal Register on July 7, 2021.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.