Notice2021-23821
Privacy Act of 1974; System of Records
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
November 2, 2021
Effective
December 2, 2021
Issuing agencies
Securities and Exchange Commission
Abstract
The Securities and Exchange Commission (SEC) established SEC- 34, Public Health and Safety Records under the Privacy Act of 1974. This system of records maintains information collected in response to a public health emergency. Information will be collected from SEC personnel (political appointees, employees, consultants, detailees, interns, and volunteers), contractors, visitors, job applicants, and others who access or seek to access SEC facilities or worksites to assist the SEC with maintaining a safe and healthy workplace and to protect its workforce from risks associated with communicable diseases.
Full Text
<html>
<head>
<title>Federal Register, Volume 86 Issue 209 (Tuesday, November 2, 2021)</title>
</head>
<body><pre>
[Federal Register Volume 86, Number 209 (Tuesday, November 2, 2021)]
[Notices]
[Pages 60496-60498]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2021-23821]
-----------------------------------------------------------------------
SECURITIES AND EXCHANGE COMMISSION
[Release No. PA-57; File No. S7-14-21]
Privacy Act of 1974; System of Records
AGENCY: Securities and Exchange Commission.
ACTION: Notice of a new system of records.
-----------------------------------------------------------------------
SUMMARY: The Securities and Exchange Commission (SEC) established SEC-
34, Public Health and Safety Records under the Privacy Act of 1974.
This system of records maintains information collected in response to a
public health emergency. Information will be collected from SEC
personnel (political appointees, employees, consultants, detailees,
interns, and volunteers), contractors, visitors, job applicants, and
others who access or seek to access SEC facilities or worksites to
assist the SEC with maintaining a safe and healthy workplace and to
protect its workforce from risks associated with communicable diseases.
DATES: The changes will become effective December 2, 2021 to permit
public comment on the new and revised routine uses. The Commission will
publish a new notice if the effective date is delayed to review
comments or if changes are made based on comments received. To assure
consideration, comments should be received on or before December 2,
2021.
ADDRESSES: Comments may be submitted by any of the following methods:
Electronic Comments
<bullet> Use the Commission's internet comment form (<a href="http://www.sec.gov/rules/other.shtml">http://www.sec.gov/rules/other.shtml</a>); or
<bullet> Send an email to <a href="/cdn-cgi/l/email-protection#7301061f165e101c1e1e161d0700330016105d141c05"><span class="__cf_email__" data-cfemail="394b4c555c145a5654545c574d4a794a5c5a175e564f">[email protected]</span></a>. Please include
File Number S7-14-21 on the subject line.
Paper Comments
Send paper comments to Vanessa A. Countryman, Secretary, U.S.
Securities and Exchange Commission, 100 F Street NE, Washington, DC
20549-1090. All submissions should refer to S7-14-21. This file number
should be included on the subject line if email is used. To help
process and review your comments more efficiently, please use only one
method. The Commission will post all comments on the Commission's
internet website (<a href="http://www.sec.gov/rules/other.shtml">http://www.sec.gov/rules/other.shtml</a>). Comments are
also available for website viewing and printing in the Commission's
Public Reference Room, 100 F Street NE, Washington, DC 20549, on
official business days between the hours of 10 a.m. and 3 p.m. All
comments received will be posted without change; we do not edit
personal identifying information from submissions. You should submit
only information that you wish to make publicly available.
FOR FURTHER INFORMATION CONTACT: For general and privacy related
questions please contact: Ronnette McDaniel, Privacy and Information
Assurance Branch Chief, 202-551-7200 or <a href="/cdn-cgi/l/email-protection#bececcd7c8dfddc7d6dbd2cefecddbdd90d9d1c8"><span class="__cf_email__" data-cfemail="8cfcfee5faedeff5e4e9e0fcccffe9efa2ebe3fa">[email protected]</span></a>.
SUPPLEMENTARY INFORMATION: In order to collect and maintain contractor,
visitor and job applicant disclosures, the SEC established SEC-34,
Public Health and Safety Records, a system of records under the Privacy
Act. The SEC is committed to maintaining a safe and healthy workplace
and to protect its workforce from risks associated with a public health
emergency. To ensure and maintain the safety of all SEC personnel
(political appointees, employees, consultants, detailees, interns, and
volunteers), contractors, visitors, job applicants, and others who
access or seek to access an SEC facility, space, or worksite during a
public health emergency, the SEC may develop and institute safety
measures that require the collection of personal information. Records
may include information on individuals' vaccination status and
information to support a request for reasonable accommodation based on
disability or sincerely held religious belief. Records also may include
information on individuals who have been suspected or confirmed to have
contracted a disease or illness, or who have been exposed to an
individual who had been suspected or confirmed to have contracted a
disease or illness, related to a declared public health emergency.
Records may also include information on the individual circumstances
surrounding the disease or illness such as dates of suspected exposure,
testing results, symptoms, treatments, and other related health status
information. Any contact tracing conducted by SEC personnel will
involve collecting information about SEC personnel, contractors and
visitors who are exhibiting symptoms or who have tested positive for an
infectious disease in order to identify and notify other SEC personnel,
contractors and visitors with whom they may have come into contact and
who may have been exposed. Records may also include information on
individuals identified as emergency contacts for SEC personnel.
Information from this system of records will be collected,
maintained, and disclosed in accordance with applicable law,
regulations, and statutes, including, but not limited to; the Americans
with Disabilities Act of 1990 and regulations and guidance published by
the U.S. Occupational Safety and Health Administration, the U.S. Equal
Employment Opportunity Commission, and the U.S. Centers for Disease
Control and Prevention.
SYSTEM NAME AND NUMBER:
SEC-34 Public Health and Safety Records.
SECURITY CLASSIFICATION:
Non-classified.
SYSTEM LOCATION:
Securities and Exchange Commission (SEC), 100 F Street NE,
Washington, DC 20549. Files may also be maintained in the following SEC
Regional Offices: Atlanta Regional Office (ARO), 950 East Paces Ferry
Road NE, Suite 900, Atlanta, GA 30326-1382; Boston Regional Office
(BRO), 33 Arch Street, 24th Floor, Boston, MA 02110-1424; Chicago
Regional Office (CHRO), 175 W Jackson Boulevard, Suite 1450, Chicago,
IL 60604; Denver Regional Office (DRO), Byron Rogers Federal Office
Building,
[[Page 60497]]
1961 Stout Street, Suite 1700, Denver, CO 80294-1961; Fort Worth
Regional Office (FWRO), Burnett Plaza, 801 Cherry Street, Suite 1900,
Unit 18, Fort Worth, TX 76102; Los Angeles Regional Office (LARO), 444
South Flower Street, Suite 900, Los Angeles, CA 90071; Miami Regional
Office (MIRO), 801 Brickell Avenue, Suite 1950, Miami, FL 33131; New
York Regional Office (NYRO), Brookfield Place, 200 Vesey Street, Suite
400, New York, NY 10281-1022; Philadelphia Regional Office (PLRO), One
Penn Center, 1617 John F. Kennedy Boulevard, Suite 520, Philadelphia,
PA 19103-1844; Salt Lake Regional Office (SLRO), 351 S West Temple St.,
Suite 6.100, Salt Lake City, UT 84101; and San Francisco Regional
Office (SFRO), 44 Montgomery Street, Suite 2800, San Francisco, CA
94104.
SYSTEM MANAGER(S):
Chief Operating Officer, Securities and Exchange Commission, 100 F
Street NE, Washington, DC 20549.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
The authority to collect this information derives from General Duty
Clause, Sections 5(a)(1) and 19(a) of the Occupational Safety and
Health (OSH) Act of 1970 (29 U.S.C. 654(a)(1), 668(a)); Section 319 of
the Public Health Service Act (42 U.S.C. 247d); E.O. 12196,
Occupational Safety and Health Programs for Federal Employees (Feb. 26,
1980); E.O 13991, Protecting the Federal Workforce and Requiring Mask-
Wearing; (Jan. 25, 2021); Executive Order on Ensuring Adequate COVID
Safety Protocols for Federal Contractors (September 9, 2021); Executive
Order on Requiring Coronavirus Disease 2019 Vaccination for Federal
Employees (September 9, 2021); OMB Memorandum M-20-23 Aligning Federal
Agency Operations with the National Guidelines for Opening Up America
Again (Apr. 20, 2020); and OMB Memorandum M-21-15 COVID-19 Safe Federal
Workplace: Agency Model Safety Principles (Jan. 24, 2021). Information
will be collected and maintained in accordance with the Americans with
Disabilities Act of 1990 (42 U.S.C. 12101 et seq.)
PURPOSE(S) OF THE SYSTEM:
The information in the system is collected to assist the SEC with
maintaining a safe and healthy workplace and to protect its workforce
from risks associated with communicable diseases that the Secretary of
the Department of Health and Human Services has determined to be a
public health emergency pursuant to Section 319(a) of the Public Health
Service Act (42 U.S.C. 247d(a)) (``Public Health Emergency''). Records
in this system may be collected, maintained, and used to: (1) Determine
who may be allowed access to SEC facilities or worksites and what
testing or medical screening is necessary before a person may enter;
(2) respond to a significant risk of harm to SEC personnel,
contractors, and visitors, as well as to any others in SEC facilities
or worksites; (3) document reports that SEC personnel, contractors, or
any persons who have been in SEC facilities or worksites may have or
may have been exposed to a communicable disease that is the subject of
a Public Health Emergency; (4) perform contact tracing investigations
of and notifications to SEC personnel, contractors, and visitors known
or suspected of exposure to communicable diseases that are the subject
of a Public Health Emergency; (5) inform federal, state, or local
public health authorities so that these authorities may act to protect
public health as allowed or required by law; (6) implement such actions
(e.g., quarantine or isolation) as necessary to prevent the
introduction, transmission, and spread of a communicable disease that
is the subject of a Public Health Emergency by SEC personnel,
contractors, and persons who have been in SEC facilities or worksites;
(7) comply with Occupational Safety and Health Administration Act
recordkeeping requirements; and (8) process employee requests for
reasonable accommodation based on disability or sincerely held
religious belief.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
Individuals covered by this system include all SEC personnel
(political appointees, employees, consultants, detailees, interns, and
volunteers), contractors, visitors, job applicants, and others who
access or seek to access SEC facilities or worksites. The system also
covers individuals identified as emergency contacts for SEC staff.
CATEGORIES OF RECORDS IN THE SYSTEM:
Information collected and maintained may include, but is not
limited to:
--Biographical information: Name and contact information.
--Health information: Body temperature, dates of and symptoms
relating to a potential or actual exposure to a pathogen, or
immunization and/or vaccination information.
--Information to support a request for reasonable accommodation
based on disability or sincerely held religious belief.
--Contact tracing information: Dates of visits to SEC facilities,
locations visited within the facility (e.g., office and cubicle
number), the duration of time spent in the facility, dates the SEC was
made aware of the exposure, and potential contacts between potentially
contagious persons and others in SEC facilities.
--Testing Results: Negative results, confirmed or unconfirmed
positive test results, and documents related to the reasons for testing
or other aspects of test results.
--Subsequent actions taken by the SEC to address an incident:
Identifying and contact information of individuals who have been
suspected or confirmed to have contracted a communicable disease that
is the subject of a Public Health Emergency, or who have been exposed
to an individual who has been suspected or confirmed to have contracted
a communicable disease that is the subject of a Public Health
Emergency; individual circumstances and dates of suspected exposure;
symptoms; and treatments. The SEC uses this information to maintain a
safe and healthy workplace and to protect its workforce. Although it is
not the intent for the SEC to collect family medical information, an
individual may indicate that they were exposed to specific family
members who have been diagnosed with, or are suspected to have, the
disease in question. To the extent this information may be acquired
inadvertently, such information will be kept as a confidential medical
record and maintained separately from an employee's SEC personnel file.
RECORD SOURCE CATEGORIES:
The information in this system is collected directly from the
individual or from the individual's emergency contact. Information may
also be collected from security systems that monitor access to SEC
facilities, such as badging systems, video surveillance, human
resources systems, emergency notification systems, and federal, state,
and local agencies assisting with the response to a Public Health
Emergency. Information may also be collected from SEC contractors or
from property management companies responsible for managing office
buildings that house SEC facilities or worksites, including the General
Services Administration (GSA).
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND THE PURPOSES OF SUCH USES:
In addition to those disclosures generally permitted under 5 U.S.C.
552a(b) of the Privacy Act, these records
[[Page 60498]]
or information contained therein may specifically be disclosed outside
the Commission as a routine use pursuant to 5 U.S.C. 552a(b)(3) as
follows:
1. To appropriate agencies, entities, and persons when (a) it is
suspected or confirmed that the security or confidentiality of
information in the system of records has been compromised; (b) the SEC
has determined that, as a result of the suspected or confirmed
compromise, there is a risk of harm to economic or property interests,
identity theft or fraud, or harm to the security or integrity of this
system or other systems or programs (whether maintained by the SEC or
another agency or entity) that rely upon the compromised information;
and (c) the disclosure made to such agencies, entities, and persons is
reasonably necessary to assist in connection with the SEC's efforts to
respond to the suspected or confirmed compromise and prevent, minimize,
or remedy such harm.
2. To a Federal, State, or local agency to the extent necessary to
comply with laws governing reporting of infectious disease.
3. To SEC personnel, contractors, visitors, emergency contacts, or
others to notify an individual (1) who has been exposed or may have
potentially been exposed to a communicable disease that is the subject
of a Public Health Emergency of information regarding the exposure or
potential exposure, or (2) who may have reason to know of circumstances
that increase the risk of such exposure. To the extent possible, all
information will be anonymized.
4. To another Federal agency, to a court, or a party in litigation
before a court or in an administrative proceeding being conducted by a
Federal agency when the SEC is a party to the judicial or
administrative proceeding where the information is relevant and
necessary to the proceeding.
5. To employees, grantees, experts, contractors, and others who
have been engaged by the Commission to assist in the performance of a
service related to this system of records and who need access to the
records for the purpose of assisting the Commission in the efficient
administration of its programs, including by performing clerical,
stenographic, or data analysis functions, or by reproduction of records
by electronic or other means. Recipients of these records shall be
required to comply with the requirements of the Privacy Act of 1974, as
amended, 5 U.S.C. 552a.
6. To produce summary descriptive statistics and analytical
studies, as a data source for management information, in support of the
function for which the records are collected and maintained or for
related personnel management functions or manpower studies; may also be
used to respond to general requests for statistical information
(without personal identification of individuals) under the Freedom of
Information Act.
7. To a Congressional office from the record of an individual in
response to an inquiry from the Congressional office made at the
request of that individual.
8. To members of Congress, the Government Accountability Office, or
others charged with monitoring the work of the Commission or conducting
records management inspections.
9. To another Federal agency or Federal entity, when the SEC
determines that information from this system of records is reasonably
necessary to assist the recipient agency or entity in (1) responding to
a suspected or confirmed breach or (2) preventing, minimizing, or
remedying the risk of harm to individuals, the recipient agency or
entity (including its information systems, programs, and operations),
the Federal Government, or national security, resulting from a
suspected or confirmed breach.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Records in this system of records are stored electronically or on
paper in secure facilities. Electronic records are stored on the SEC's
secure network.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Information covered by this system of records notice may be
retrieved by the name of the individual, contact information, or by
some combination thereof.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
The records will be maintained until they become inactive, at which
time they will be retired or destroyed in accordance with records
schedules of the United States Securities and Exchange Commission, and
as approved by the National Archives and Records Administration.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
Access to SEC facilities, data centers, and information or
information systems is limited to authorized personnel with official
duties requiring access. SEC facilities are equipped with security
cameras, and, at certain SEC facilities, 24-hour security guard
service. Computerized records are safeguarded in a secured environment.
Security protocols meet the promulgating guidance as established by the
National Institute of Standards and Technology (NIST) Security
Standards from Access Control to Data Encryption and Security
Assessment & Authorization (SA&A). Records are maintained in a secure,
password-protected electronic system that will utilize commensurate
safeguards that may include: Firewalls, intrusion detection and
prevention systems, and role-based access controls. Additional
safeguards will vary by program. All records are protected from
unauthorized access through appropriate administrative, operational,
and technical safeguards. These safeguards include: Restricting access
to authorized personnel who have a ``need to know''; using locks; and
password protection identification features. Contractors and other
recipients providing services to the Commission shall be required to
maintain equivalent safeguards.
RECORD ACCESS PROCEDURES:
Persons wishing to obtain information on the procedures for gaining
access to or contesting the contents of these records may contact the
FOIA/PA Officer, Securities and Exchange Commission, 100 F Street NE,
Mail Stop 5100, Washington, DC 20549-2736.
CONTESTING RECORD PROCEDURES:
See Record Access Procedures above.
NOTIFICATION PROCEDURES:
All requests to determine whether this system of records contains a
record pertaining to the requesting individual may be directed to the
FOIA/PA Officer, Securities and Exchange Commission, 100 F Street NE,
Mail Stop 5100, Washington, DC 20549-2736.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
HISTORY:
New SORN.
By the Commission.
Dated: October 27, 2021.
Vanessa A. Countryman,
Secretary.
[FR Doc. 2021-23821 Filed 11-1-21; 8:45 am]
BILLING CODE 8011-01-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on November 2, 2021.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.