Rule2024-07750
Social Security Number Fraud Prevention Act Requirements
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
April 12, 2024
Effective
June 26, 2024
Issuing agencies
Personnel Management Office
Abstract
The Office of Personnel Management (OPM) is publishing this direct final rule to implement the requirements of the Social Security Number Fraud Prevention Act of 2017 (Act). In accordance with the Act, OPM is amending its privacy procedures to prohibit the inclusion of Social Security numbers (SSNs) on any document sent through the mail unless the Director of OPM deems it necessary. This rule also establishes requirements for safeguarding SSNs sent through the mail by partially redacting SSNs where feasible and prohibiting the display of SSNs on the outside of any package or envelope sent by mail.
Full Text
<html>
<head>
<title>Federal Register, Volume 89 Issue 72 (Friday, April 12, 2024)</title>
</head>
<body><pre>
[Federal Register Volume 89, Number 72 (Friday, April 12, 2024)]
[Rules and Regulations]
[Pages 25749-25750]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2024-07750]
========================================================================
Rules and Regulations
Federal Register
________________________________________________________________________
This section of the FEDERAL REGISTER contains regulatory documents
having general applicability and legal effect, most of which are keyed
to and codified in the Code of Federal Regulations, which is published
under 50 titles pursuant to 44 U.S.C. 1510.
The Code of Federal Regulations is sold by the Superintendent of Documents.
========================================================================
Federal Register / Vol. 89, No. 72 / Friday, April 12, 2024 / Rules
and Regulations
[[Page 25749]]
OFFICE OF PERSONNEL MANAGEMENT
5 CFR Part 297
[Docket ID: OPM-2023-0035]
RIN 3206-AO16
Social Security Number Fraud Prevention Act Requirements
AGENCY: Office of Personnel Management.
ACTION: Direct final rule.
-----------------------------------------------------------------------
SUMMARY: The Office of Personnel Management (OPM) is publishing this
direct final rule to implement the requirements of the Social Security
Number Fraud Prevention Act of 2017 (Act). In accordance with the Act,
OPM is amending its privacy procedures to prohibit the inclusion of
Social Security numbers (SSNs) on any document sent through the mail
unless the Director of OPM deems it necessary. This rule also
establishes requirements for safeguarding SSNs sent through the mail by
partially redacting SSNs where feasible and prohibiting the display of
SSNs on the outside of any package or envelope sent by mail.
DATES: This rule is effective on June 26, 2024, without further action
unless significant adverse comments are received by June 11, 2024. If
significant adverse comments are received, OPM will withdraw this
direct final rule and publish a proposed rule.
ADDRESSES: You may submit comments for this direct final rule using the
following method:
<bullet> Federal Rulemaking Portal: <a href="https://www.regulations.gov">https://www.regulations.gov</a>.
Follow the instructions for sending comments.
All submissions received must include the agency name and docket
number for this direct final rule. The general policy for comments and
other submissions from members of the public is to make these
submissions available for public viewing at <a href="https://www.regulations.gov">https://www.regulations.gov</a>
as they are received, without change, including any personal
identifiers or contact information.
FOR FURTHER INFORMATION CONTACT: Kirsten J. Moncada, Executive
Director, Office of the Executive Secretariat, Privacy, and Information
Management, 202-936-0251.
SUPPLEMENTARY INFORMATION: The Social Security Number Fraud Prevention
Act of 2017, Public Law 115-59, 42 U.S.C. 405 note, restricts the
inclusion of SSNs on documents sent by mail unless the head of the
agency determines that the inclusion of the SSNs on the documents is
necessary. The Act also directs agencies to issue regulations that
specify when inclusion of an SSN is necessary and include requirements
for the safeguarding of SSNs by partially redacting SSNs where feasible
and prohibiting the display of SSNs on the outside of any package or
envelope sent by mail.
To implement the Act, OPM is adding new subpart F, titled
``Protecting Social Security Numbers in Mailed Documents,'' to its
privacy procedures at 5 CFR part 297. The new requirements in subpart F
prohibit the inclusion of SSNs on any document OPM program offices send
through the mail unless the Director of OPM, on the advice of the
Senior Agency Official for Privacy, deems it necessary and precautions
are taken to protect the SSNs. In addition, subpart F includes
requirements for OPM program offices to partially redact SSNs where
feasible and specifically prohibits the display of complete or partial
SSNs on the outside of any package or envelope sent by mail or through
the window of an envelope or package. Subpart F applies to all OPM
office activities and written or printed documents OPM sends by mail
that include a complete or partial SSN.
OPM is also amending 5 CFR 297.102 to add the definitions of
``document,'' and ``mail'' to make explicit OPM's meaning of the terms
in this new subpart F. For the purposes of this rule, a document is a
record of some information that can be used as an authority or for
reference, further analyses, or study. This includes all records OPM
maintains and uses to identify, track, and correspond with agencies,
Federal employees, contractors, and annuitants, among others. Mail is
defined as artifacts used to assemble letters and packages that are
sent or delivered by the United States Postal Service or other
commercial letter or parcel delivery services.
Direct Final Rule Justification
This rule of agency organization, procedure, or practice is exempt
from the prior public notice and comment requirements of the
Administrative Procedure Act. See 5 U.S.C. 553(b)(3)(A). This rule will
not have any effect on the rights, obligations, or interests of any
affected parties, as it is merely procedural and reflects a statutory
requirement that is already in effect. The rule restricts and
safeguards the inclusion of SSNs in documents that are mailed to
prevent unauthorized disclosure of SSNs and protect individual privacy.
Accordingly, OPM for good cause finds that the notice and comment
requirements are unnecessary. See 5 U.S.C. 553(b)(3)(B).
This rule is also suitable for direct final rulemaking because it
is non-controversial and consistent with Federal law and policy
regarding the appropriate handling and protection of SSNs. The
provisions of the rule will be beneficial to members of the public and
Federal employees because it protects their personally identifiable
information. Because this non-substantive rule makes no changes to the
legal obligations or rights of any affected parties (i.e., reflects a
statutory requirement that is already in effect) and because it is in
the public interest to have this rule be effective as soon as possible,
OPM does not expect to receive any significant adverse comments.
This rule will be effective June 26, 2024, without further action
unless significant adverse comments are received. A significant adverse
comment is one that explains: (1) why the rule is inappropriate,
including challenges to the rule's underlying premise or approach; or
(2) why the direct final rule will be ineffective or unacceptable
without a change. If such comments are received, this direct final rule
will be withdrawn and a proposed rule for comments will be published.
If no such comments are received, this direct final rule will become
effective 15 days after the comment period expires. In determining
whether a significant adverse comment necessitates withdrawal of this
direct final rule, OPM will consider whether the
[[Page 25750]]
comment raises an issue serious enough to warrant a substantive
response had it been submitted in a standard notice and comment
process. A comment recommending an addition to the rule will not be
considered significant and adverse unless the comment explains how this
direct final rule would be ineffective without the addition.
Expected Impact of This Direct Final Rule
SSNs are used as unique identifiers by government agencies,
businesses, and other entities. The theft and fraudulent use of SSNs
can result in significant repercussions for the SSN holder, as well as
the entities from which SSNs were stolen. This direct final rule
formalizes in regulation OPM's current practice of safeguarding SSNs in
mailed documents and will support efforts to protect individual
privacy. In accordance with the E-Government Act (2002), OPM currently
applies encryption technology and other security controls, such as
password protection, to minimize the risk of unauthorized disclosure of
SSNs. OPM program offices are also required to conduct proper
assessments to minimize the use of SSNs and the impact to individual
privacy as a result of their inclusion in any document. This rule
supplements these procedures and is beneficial because it protects
individual privacy and standardizes OPM's procedures for mailing
documents with SSNs. There are no alternatives to this rule because it
is required by statute.
Regulatory Review
Executive Orders 13563, 12866, and 14094 direct agencies to assess
all costs and benefits of available regulatory alternatives and, if
regulation is necessary, to select regulatory approaches that maximize
net benefits (including potential economic, environmental, public
health and safety effects, distributive impacts, and equity). The
Office of Information and Regulatory Affairs in the Office of
Management and Budget has determined this rule is not a ``significant
regulatory action'' under section 3(f) of Executive Order 12866, as
amended by Executive Order 14094.
Regulatory Flexibility Act
The Director of OPM certifies that this rule will not have a
significant economic impact on a substantial number of small entities
because it is a procedural rule that only applies only to OPM.
E.O. 13132, Federalism
This rule will not have substantial direct effects on the States,
on the relationship between the National Government and the States, or
on distribution of power and responsibilities among the various levels
of government. Therefore, in accordance with Executive Order 13132, OPM
has determined that this direct rule does not have federalism
implications that require preparation of a federalism summary impact
statement.
E.O. 12988, Civil Justice Reform
OPM has determined that this rule meets the relevant standards of
Executive Order 12988.
Unfunded Mandates Reform Act of 1995
This rule will not result in the expenditure by State, local, or
tribal governments, or the private sector of more than $100 million
annually. Thus, no written assessment of unfunded mandates is required.
Congressional Review Act
Subtitle E of the Small Business Regulatory Enforcement Fairness
Act of 1996 (known as the Congressional Review Act or CRA) (5 U.S.C.
801, et seq.) requires rules to be submitted to Congress before taking
effect. OPM will submit to Congress and the Comptroller General of the
United States a report regarding the issuance of this rule before its
effective date, as required by 5 U.S.C. 801. The Office of Information
and Regulatory Affairs in the Office of Management and Budget has
determined that this rule is not a major rule as defined by the CRA (5
U.S.C. 804).
Paperwork Reduction Act of 1995
This regulatory action will not impose any reporting or
recordkeeping requirements under the Paperwork Reduction Act (44 U.S.C.
Chapter 35).
List of Subjects in 5 CFR Part 297
Privacy.
Office of Personnel Management.
Kayyonne Marston,
Federal Register Liaison.
For reasons stated in the preamble, OPM amends 5 CFR part 297 as
follows:
PART 297--PRIVACY PROCEDURES FOR PERSONNEL RECORDS
0
1. The authority citation for part 297 is revised to read as follows:
Authority: 5 U.S.C. 552a; Pub. L. 115-59, 113 Stat. 1152 (42
U.S.C. 405 note).
0
2. Amend Sec. 297.102 by adding in alphabetical order the definitions
for ``Document'' and ``Mail'' to read as follows:
Sec. 297.102 Definitions.
* * * * *
Document means a piece of written or printed matter that provides
information or evidence or that serves as official record.
Mail means artifacts used to assemble letters and packages that are
sent or delivered by the United States Postal Service or other
commercial letter or parcel delivery services.
* * * * *
0
3. Add subpart F, consisting of Sec. Sec. 297.601 and 297.602, to read
as follows:
Subpart F--Privacy and Social Security Number Fraud Prevention
Sec.
297.601 Purpose and scope.
297.602 Protecting Social Security numbers in mailed documents.
Sec. 297.601 Purpose and scope.
The purpose of this subpart is to implement the requirements of the
Social Security Number Fraud Prevention Act of 2017 to limit the use of
Social Security numbers on documents mailed by the Office of Personnel
and Management (OPM). The subpart applies to all written or printed
documents that OPM sends by mail that include a complete or partial
Social Security number.
Sec. 297.602 Protecting Social Security numbers in mailed documents.
(a) Social Security numbers must not be visible on the outside of
any package OPM sends by mail or displayed on correspondence that is
visible through the window of an envelope or package.
(b) A document OPM sends by mail may only include a Social Security
number if the Director of OPM determines, on the advice of the Senior
Agency Official for Privacy, that the inclusion of a Social Security
number on a document sent by mail is necessary and appropriate to meet
legal and mission requirements.
(c) The inclusion of a Social Security number on a document sent by
mail is necessary when--
(1) Required by law; or
(2) Necessary to identify a specific person and no adequate
substitute is available.
(d) Social Security numbers must be partially redacted in documents
sent by mail whenever feasible to mitigate any risks to privacy.
[FR Doc. 2024-07750 Filed 4-11-24; 8:45 am]
BILLING CODE 6325-67-P
</pre></body>
</html>Indexed from Federal Register on April 12, 2024.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.