Notice2025-05678
Privacy Act of 1974; System of Records
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
April 3, 2025
Effective
May 5, 2025
Issuing agencies
Postal Service
Abstract
The United States Postal Service (USPS[supreg]) is proposing to revise a General Privacy Act System of Records to integrate enhanced chat analytics, support, and reporting.
Full Text
<html>
<head>
<title>Federal Register, Volume 90 Issue 63 (Thursday, April 3, 2025)</title>
</head>
<body><pre>
[Federal Register Volume 90, Number 63 (Thursday, April 3, 2025)]
[Notices]
[Pages 14666-14669]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2025-05678]
=======================================================================
-----------------------------------------------------------------------
POSTAL SERVICE
Privacy Act of 1974; System of Records
AGENCY: Postal Service[supreg].
ACTION: Notice of a modified system of records.
-----------------------------------------------------------------------
SUMMARY: The United States Postal Service (USPS[supreg]) is proposing
to revise a General Privacy Act System of Records to integrate enhanced
chat analytics, support, and reporting.
DATES: These revisions will become effective without further notice on
May 5, 2025, unless comments received on or before that date result in
a contrary determination.
ADDRESSES: Comments may be submitted via email to the Privacy and
Records Management Office, United States Postal Service Headquarters
(<a href="/cdn-cgi/l/email-protection#0d7d7f647b6c6e744d787e7d7e236a627b"><span class="__cf_email__" data-cfemail="aededcc7d8cfcdd7eedbdddedd80c9c1d8">[email protected]</span></a>). Arrangements to view copies of any written comments
received, to facilitate public inspection, will be made upon request.
FOR FURTHER INFORMATION CONTACT: Janine Castorina, Chief Privacy and
Records Management Officer, Privacy and Records Management Office, 202-
268-3069 or <a href="/cdn-cgi/l/email-protection#d4a4a6bda2b5b7ad94a1a7a4a7fab3bba2"><span class="__cf_email__" data-cfemail="3a4a48534c5b59437a4f494a49145d554c">[email protected]</span></a>.
SUPPLEMENTARY INFORMATION: This notice is in accordance with the
Privacy Act requirement that agencies publish their systems of records
in the Federal Register when there is a revision, change, or addition,
or when the agency establishes a new system of records.
I. Background
As USPS continues in its efforts to serve the American people, they
are constantly looking to innovate and streamline their operations at
every level. To that end, USPS seeks to deploy a web-based chat-and-
response assistant for USPS employee use.
II. Rationale for Changes to USPS Privacy Act Systems of Records
USPS employees perform a variety of tasks, requiring a tremendous
amount of both institutional and external knowledge. As is the nature
of most organizations, this information can often be siloed, difficult
to reach, or highly specific. To alleviate these issues and maximize
efficiency, USPS will employ a large language model-based chat
assistant for USPS employees. This assistant will improve information
access, retention, and recollection among its workforce by providing an
engaging and responsive 24-hour access-medium able to locate
information quickly and with high levels of specificity. This access
will save countless hours of searching disparate sources for critical
pieces of information, and will also allow the organization as a whole
to see if there are any particular trends that require action,
attention, or recognition at a higher level. Deployment of this
assistant will be highly constrained within the USPS Information
Technology Infrastructure, with new data sources subject to enhanced
scrutiny prior to integration with the chat assistant; this will ensure
that
[[Page 14667]]
privacy protections are taken with every step.
The Postal Service is therefore proposing to modify USPS System of
Records (SOR) 550.000 Commercial Information Technology Resources--
Infrastructure to integrate enhanced chat analytics, support, and
reporting. USPS will modify this SOR as follows:
1. Five new purposes, twelve through sixteen.
2. One new record within category of records one, Information
System Account Access records.
3. Three new records within category of records three, Productivity
Analytics records.
III. Description of the Modified System of Records
Pursuant to 5 U.S.C. 552a(e)(11), interested persons are invited to
submit written data, views, or arguments on this proposal. A report of
the proposed revisions has been sent to Congress and to the Office of
Management and Budget for their evaluations. The Postal Service does
not expect this amended system of records to have any adverse effect on
individual privacy rights. The notice for USPS 550.000 Commercial
Information Technology Resources- Infrastructure, provided below in its
entirety, is as follows:
SYSTEM NAME AND NUMBER:
550.000 Commercial Information Technology Resources--
Infrastructure.
SECURITY CLASSIFICATION:
None.
SYSTEM LOCATION:
All USPS facilities and contractor sites.
SYSTEM MANAGER(S):
For records of computer access authorizations: Chief Information
Officer and Executive Vice President, United States Postal Service, 475
L'Enfant Plaza SW, Washington, DC 20260.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
39 U.S.C. 401, 403, and 404.
PURPOSE(S) OF THE SYSTEM:
1. To provide USPS employees, contractors, and other authorized
individuals with hierarchical access to and accounts for commercial
information technology resources administered by the Postal Service and
based on least privileged access.
2. To facilitate a cohesive software experience and simplify ease
of use by sharing user and application data across participating IT
programs.
3. To authenticate user identity for the purpose of accessing USPS
information systems.
4. To assess user attributes and assign related access privileges.
5. To authenticate suppliers and contractors and facilitate further
access to downstream Postal Service information systems.
6. To provide active and passive monitoring of information systems,
applications, software, devices, and users for information security
risks.
7. To review information systems, applications, software, devices,
and users to ensure compliance with USPS regulations.
8. To facilitate and support cybersecurity investigations of
detected or reported information security incidents.
9. To administer programs, processes, and procedures to assess
information security risks and to detect information security threats
and vulnerabilities.
10. To provide tools and analytics for USPS employees and
contractors to measure work productivity and improve efficiency.
11. To improve manager-subordinate relationships within their
formal reporting structure through data-based insights generated from
their own email and related electronic communications with
subordinates.
12. To provide employees access to a large language model based
chat assistant.
13. To associate chat assistant conversations with individual USPS
employee users for quick response and recollection.
14. To identify trends in chat assistant conversations for model
refinement.
15. To ensure the accuracy of responses provided by the chat
assistant to the end user.
16. To voluntarily provide data generated from chat assistant
conversations to large language models for future model training and
development.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
1. Individuals with authorized access to USPS computers,
information resources, and facilities, including employees,
contractors, business partners, suppliers, and third parties.
2. Individuals participating in web-based meetings, web-based video
conferencing, web-based communication applications, and web-based
collaboration applications.
CATEGORIES OF RECORDS IN THE SYSTEM:
1. Information System Account Access records: Records relating to
the access or use of an information system, application, or piece of
software, including; Name, User ID, Email Address, User Type, User
Role, Job Title, Department, Manager, Company, Street Address, State Or
Province, Country Or Region, Work Phone Number(S), Employee
Identification Number (EIN), Advanced Computing Environment (ACE) ID,
License Information, Action Initiated, Datetime, User Principle Name,
Usage Location, Alternate Email Address, Proxy Address, Age Group, IP
Address, MAC Address, Password, Multi-Factor Authentication
Credentials, Security Questions, Security Answers, Passcode,
Geolocation Data, User Profile Picture, Picture Metadata, Information
Technology Account Administration User Configuration Status, Supplier
Credentials, Supplier Company Codes, Conditional Access Attributes,
Last Sign-In Time, User Account Status, User Admin Status, Password
Length Compliance, Password Strength, Number Of Installed External
Apps, Less Secure Apps Access, Admin-Defined Name, Profile Name Status,
Photo Storage Space Used, Total Storage Space Used, Storage Usage
Percentage, Total Emails Sent, Total Emails Received, Total Emails Sent
And Received, Email Server Last Usage Time, Device Application Change,
Device Privilege Changed, Device Policy Changed, Device Action
Reported, Device Compliance Status, Device Operating System Updated,
Device Ownership Updated, Device Settings Changed, Device Status
Changed Through Apple Device Enrollment, Device Account Synced, Device
Risk Signal Updated, Device Work Profile Submitted, Document Uploaded
to chat assistant.
2. Security Analytics records: Records relating to the gathering,
analysis, review, monitoring, and investigation of information system
security risks, including; User Investigation Priority Score, User
Identity Risk Level, User Lateral Movement Paths, User Devices Numbers,
User Account Numbers, User Resources Numbers, User Locations Numbers,
User Matches Files Numbers, User Locations, Apps Used By User, User
Groups, User Last Seen Date, User Affiliation, User Domain, App
Instance, Organizational Groups, User Account Status, Activity ID,
Activity Objects, Activity Type, Administrative Activity, Alert ID,
Applied Action, Activity Date, Device Tag, Activity Files And Folders,
Impersonated Activities, App Instance Activity, App Location Activity,
Activity Matched Policy, Activity Registered ISP, Activity Source,
Activity
[[Page 14668]]
User, Activity User Agent, Activity User Agent Tag, Application Risk
Score, Application Activity, User Software Deactivation, User Software
Installation, User Software Removal, Last Date Of Software Execution,
internet Application Transaction Counts, Data Volume Upload, Data
Volume Download, Data Sensitivity Classification, internet Protocol,
internet Port, And internet Access History, Login IP Address, Login
Type, Login Failed, Login Successful, Number Of Times A User Was
Suspended, Number Of Times A User Was Suspended Due To Spam Relay,
Number Of Times A User Was Suspended Due To Spam, Number Of Times A
User Was Suspended Due To Suspicious Activity, Device Name, Device
Operating System, Days Since First Sync, Days Since Last Sync, Device
Status, Device Type, Device Model, Device Account Registration Changed,
Device Action Event, Device Compliance Status, Device Compromise
Status, Device Ownership Change, Device Operating System Updated,
Device Settings Changed, Device Failed Screen Unlock Attempts, Device
Status Changed On Apple Portal, Device User Signed Out, Device
Suspicious Activity Detected, Device Work Profile Supported, Two-Factor
Authentication Disabled, Two-Factor Authentication Enrolled, Account
Password Changed, Account Recovery Email Changed, Account Recovery
Phone Number Changed, Account Recovery Secret Question Changed, Account
Recovery Secret Answer Changed, Account Password Leak Suspected,
Account Suspicious Login Blocked, Account Suspicious Login From Less
Secure App Blocked, Suspicious Programmatic Login Blocked, User
Suspended, User Suspended (Spam Through Relay), User Suspended (Spam),
User Suspended (Suspicious Activity), Account Enrolled In Advanced
Protection, Account Unenrolled In Advanced Protection, Account Targeted
By Government-Backed Attack, Out Of Domain Email Forwarding Enabled,
Login Challenge Question Presented, Login Verification Presented, Log
Out, Secure Shell Public Key Added, Secure Shell Public Key Deleted,
Secure Shell Public Key Retrieved, Secure Shell Public Key Updated,
Login Profile Retrieved, POSIX Account Deleted, Application Method
Called, Application Access Authorized, Application Access Revoked,
Device Compromised, Failed Password Attempts On User Device, Device
Property Changed.
3. Productivity Analytics records: Records relating to the
gathering, analysis, review, and investigation of information system
utilization, including; Calendar Appointments, Email Read Rate, Email
Response Rate, Operating System Activity History, Email Timestamp,
Statements Made In Email Body, Email Sender, Email Recipient, Email
Subject Line, Calendar Event Type, Calendar Event Status, Calendar
Event Category, Calendar Event Subject, Calendar Event Duration,
Calendar Event Attendees, Meeting Organizer, Meeting Invitees, Meeting
Subject Line, Meeting Scheduled Time, Meeting Attendee Status, Meeting
Scheduled Location, Web Call Organizer, Web Call Invitees, Web Call
Scheduled Time, Web Call Joined Time, Web Call Duration, Web Call
Status, Web Call Join Status, Number Of Collaborative Audio Calls Made,
Number Of Collaborative Video Calls Made, Chat Initiator, Chat
Recipient, Chat IM Sent Time, Number Of Cloud-Based Personal Storage
Documents Worked On, Number Of Cloud-Based Enterprise Storage Documents
Worked On, Device Name, Chat Assistant Conversation Records, Chat
Assistant Usage Metrics, Chat Assistant User Data,
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND THE PURPOSES OF SUCH USES:
Standard routine uses 1. through 9. apply. In addition:
(a) To appropriate agencies, entities, and persons when (1) the
Postal Service suspects or has confirmed that there has been a breach
of the system of records; (2) the Postal Service has determined that as
a result of the suspected or confirmed breach there is a risk of harm
to individuals, the Postal Service (including its information systems,
programs, and operations), the Federal Government, or national
security; and (3) the disclosure made to such agencies, entities, and
persons is reasonably necessary to assist in connection with the Postal
Service's efforts to respond to the suspected or confirmed breach or to
prevent, minimize, or remedy such harm.
RECORD SOURCE CATEGORIES:
Employees; contractors; customers.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Automated database, computer storage media, and paper.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
1. Records relating to information system access are retrievable by
name, email address, username, geolocation data, and ACE ID.
2. Records relating to security analysis are retrievable by name,
unique user ID, email address, geolocation data, IP address and
computer name.
3. Records relating to productivity are retrievable by name, email
address, and ACE ID.
4. Records relating to third-parties are retrievable by name, email
address, user name, and IP address.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
1. Records relating to information system access are retained
twenty-four months after last access.
2. Records relating to security analysis are retained for twenty-
four months.
3. Records relating to productivity are retained for twenty-four
months.
4. Records relating to third-parties are retained for twenty-four
months.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
Paper records, computers, and computer storage media are located in
controlled-access areas under supervision of program personnel.
Computer access is limited to authorized personnel with a current
security clearance, and physical access is limited to authorized
personnel who must be identified with a badge.
Access to records is limited to individuals whose official duties
require such access. Contractors and licensees are subject to contract
controls and unannounced on-site audits and inspections. Computers are
protected by encryption, mechanical locks, card key systems, or other
physical access control methods. The use of computer systems is
regulated with installed security software, computer logon
identifications, and operating system controls including access
controls, terminal and transaction logging, and file management
software.
RECORD ACCESS PROCEDURES:
Requests for access must be made in accordance with the
Notification Procedure above and USPS Privacy Act regulations regarding
access to records and verification of identity under 39 CFR 266.5.
CONTESTING RECORD PROCEDURES:
See Notification Procedure and Record Access Procedures above.
NOTIFICATION PROCEDURES:
Customers wanting to know if other information about them is
maintained in this system of records must address inquiries in writing
to the Chief Information Officer and Executive Vice President and
include their name and address.
[[Page 14669]]
EXEMPTION(S) PROMULGATED FROM THIS SYSTEM:
None.
HISTORY:
May 10th, 2021; 86 FR 24907.
Helen E. Vecchione,
Attorney, Ethics and Legal Compliance.
[FR Doc. 2025-05678 Filed 4-2-25; 8:45 am]
BILLING CODE 7710-12-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on April 3, 2025.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.