Privacy Act of 1974; System of Records

Issuing agencies

Abstract

This system maintains information that is used to establish the U.S. nationality and identity of persons for a variety of legal purposes including, but not limited to, the adjudication of passport applications and requests for related services, social security benefits, voter eligibility, employment applications, estate settlements, and Federal and state law enforcement and counterterrorism purposes.

Full Text

<html>
<head>
<title>Federal Register, Volume 91 Issue 204 (Friday, October 23, 2026)</title>
</head>
<body><pre>
[Federal Register Volume 91, Number 204 (Friday, October 23, 2026)]
[Notices]
[Pages 66906-66910]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2026-21695]


-----------------------------------------------------------------------

DEPARTMENT OF STATE

[Public Notice: 13151]


Privacy Act of 1974; System of Records

AGENCY: Department of State.

ACTION: Notice of a modified system of records.

-----------------------------------------------------------------------

SUMMARY: This system maintains information that is used to establish 
the U.S. nationality and identity of persons for a variety of legal 
purposes including, but not limited to, the adjudication of passport 
applications and requests for related services, social security 
benefits, voter eligibility, employment applications, estate 
settlements, and Federal and state law enforcement and counterterrorism 
purposes.

DATES: In accordance with 5 U.S.C. 552a(e)(4) and (11), this system of 
records notice is effective upon publication, with the exception of the 
routine uses (u), (v), and (w) that are subject to a 30-day period 
during which interested persons may submit comments to the Department. 
Please submit any comments by November 23, 2026. Unless comments are 
received that would require a revision, routine uses (u), (v), and (w) 
will become effective on November 23, 2026.

ADDRESSES: Interested parties may submit comments, identified by 
Department docket number DOS-2026-1156, through the Federal eRulemaking

[[Page 66907]]

Portal at <a href="http://www.regulations.gov">http://www.regulations.gov</a>. Follow the website instructions 
for submitting comments. Comments submitted in a manner other than the 
eRulemaking Portal will not be considered comments on the System of 
Records Notice (SORN) and might not be considered by the Department.

FOR FURTHER INFORMATION CONTACT: Timothy J. Kootz, Senior Agency 
Official for Privacy; U.S. Department of State; Shared Knowledge 
Services, A/SKS; Room 4534, 2201 C St. NW; Washington, DC 20520 or 
<a href="/cdn-cgi/l/email-protection#ebb8a4b9a5ab989f8a9f8ec58c849d"><span class="__cf_email__" data-cfemail="82d1cdd0ccc2f1f6e3f6e7ace5edf4">[email&#160;protected]</span></a>. Please write ``Passport Services Records, State-26'' on 
the envelope or the subject line of your email.

SUPPLEMENTARY INFORMATION: The Department of State proposes to rename 
the current ``Passport Records'' system (previously published at 80 FR 
15653) as the ``Passport Services Records'' system. The proposed system 
will include modifications to sections including Summary; Dates; 
Addresses; For Further Information Contact; Supplementary Information; 
System Name and Number; System Location; Authority For Maintenance of 
the System; Purpose(s) of the System; Routine Uses of Records 
Maintained in the System; Policies And Practice For Storage of Records; 
Policies And Practices For Retention And Disposal of Records; 
Administrative, Technical, And Physical Safeguards; Record Access 
Procedures; Contesting Record Procedures; Notification Procedures; and 
History. The purpose of these modifications is to reflect the 
Department's move to cloud storage and new Office of Management and 
Budget (OMB) guidance including breach notification routine uses, and 
to clarify the use of passport records in administrative hearings and 
by additional users for identity verification.
SYSTEM NAME AND NUMBER:
    Passport Services Records, State-26.

SECURITY CLASSIFICATION:
    Classified and Unclassified.

SYSTEM LOCATION:
    Department of State, Passport Services, Vital Records Section, 
44132 Mercure Cir., P.O. Box 1213, Sterling, VA 20166-1213 and within a 
government cloud provided, implemented, and overseen by the 
Department's Enterprise Server Operations Center (ESOC), 2201 C Street 
NW, Washington, DC 20520.

SYSTEM MANAGER(S):
    Deputy Assistant Secretary of State for Passport Services, 600 19th 
Street NW, Fourth Floor, Washington, DC 20431.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    (a) 8 U.S.C. 1104, 1185, 1401-1504 (2025); (b) 18 U.S.C. 911, 1001, 
1541-1546 (2024); (c) 22 U.S.C. 211a-218, 2651a, 2705, 2714, 2714a 
(2025); Executive Order 11295, August 5, 1966, 31 FR 10603; and (d) 26 
U.S.C. 6039E (2025).

PURPOSE(S) OF THE SYSTEM:
    The information maintained in the Passport Services Records, State-
26, is used to establish the U.S. nationality and identity of persons 
for a variety of legal purposes including, but not limited to, the 
adjudication of passport applications and requests for related 
services, social security benefits, voter eligibility, employment 
applications, estate settlements, and Federal and state law enforcement 
and counterterrorism purposes.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    Records are maintained in the Passport Services Records system 
about individuals who:
    (a) have applied for the issuance, amendment, extension, or renewal 
of U.S. passport books and passport cards;
    (b) were issued U.S. passport books or cards, or had passports 
amended, extended, renewed, limited, revoked, or denied;
    (c) applied to document the birth of a U.S. citizen born abroad;
    (d) were issued a Consular Report of Birth Abroad of U.S. citizens 
or for whom Certifications of Birth have been issued;
    (e) were born in and/or died in the former Panama Canal Zone prior 
to October 1979;
    (f) registered at U.S. diplomatic or consular posts as U.S. 
citizens living or traveling abroad prior to 1990;
    (g) were issued Cards of Registration and Identity as U.S. 
citizens;
    (h) were issued Certificates of Loss of Nationality of the U.S. by 
the Department of State;
    (i) applied at U.S. diplomatic or consular posts for issuance of 
Certificates of Witness to marriage and individuals who have been 
issued Certificates of Witness to Marriage prior to 1989;
    (j) deceased individuals for whom a Report of Death of a U.S. 
Citizen Abroad has been obtained;
    (k) although U.S. citizens, are not or may not be entitled under 
relevant passport laws and regulations to the issuance or possession of 
U.S. passport books, cards, or other documentation nor service(s);
    (l) have previous passport records that must be reviewed before 
further action can be taken on their passport application or request 
for other consular services;
    (m) requested their own or another's passport records under the 
Freedom of Information Act (FOIA) or Privacy Act, whether successfully 
or not; or
    (n) have corresponded with Passport Services concerning various 
aspects of the issuance or denial of a specific applicant's U.S. 
passport books or cards.

CATEGORIES OF RECORDS IN THE SYSTEM:
    Passport Services maintains U.S. passport records for passports 
issued from 1925 to present, as well as vital records related to births 
abroad, deaths, and witnesses to marriage overseas. The passport 
records system does not maintain evidence of travel such as entrance/
exit stamps, visas, or residence permits, since this information is 
entered into the passport book after it is issued. The passport records 
system includes the following categories of records:
    (a) Passport books and passport cards (``passports''), applications 
for passports, and applications for additional visa pages, amendments, 
extensions, replacements, and/or renewals of passports (including all 
information and materials submitted as part of or with all such 
applications);
    (b) Applications for registration at U.S. diplomatic and consular 
posts as U.S. citizens or for issuance of Cards of Identity and 
Registration as U.S. citizens;
    (c) Consular Reports of Birth Aboard of United States citizens;
    (d) Panama Canal Zone birth and death certificates;
    (e) Certificates of Witness to Marriage;
    (f) Certificates of Loss of United States Nationality;
    (g) Oaths of Repatriation;
    (h) Consular Certificates of Repatriation;
    (i) Reports of Death of a U.S. Citizen Abroad;
    (j) Cards of Identity and Registration as U.S. citizens;
    (k) Lookout files which identify those persons whose applications 
for a consular or related services required other than routine 
examination or action;
    (l) Lost, Stolen or Revoked passport status; and
    (m) Miscellaneous materials, which are documents and/or records 
maintained separately, if not in the application, including but not 
limited to

[[Page 66908]]

the following types of documents: Investigatory reports compiled in 
connection with granting or denying passport and related services or 
prosecuting violations of passport criminal statutes; Transcripts and 
opinions on administrative hearings, appeals, and civil actions in 
Federal courts; Legal briefs, memoranda, judicial orders and opinions 
arising from administrative determinations relating to passports and 
citizenship; Birth and baptismal certificates; Copies of state-issued 
driver's licenses and identity cards; Court orders; Arrest warrants; 
Medical, personal and financial reports; Affidavits; Inter-agency and 
intra-agency memoranda, telegrams, letters and other miscellaneous 
correspondence; An electronic index of all passport application records 
created since 1978; and/or An electronic index of Department of State 
Reports of Birth of U.S. Citizens Abroad and Consular Reports of Death 
Abroad.

RECORD SOURCE CATEGORIES:
    These records contain information obtained primarily from the 
individual who is the subject of these records; law enforcement 
agencies; investigative intelligence sources; investigative security 
sources; and officials of foreign governments.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND PURPOSES OF SUCH USES:
    Records in the Passport system may be disclosed to the following 
users:
    (a) Department of Homeland Security for border patrol, screening, 
and security purposes; law enforcement, counterterrorism, and fraud 
prevention activities; for verification of passport validity to support 
employment eligibility and identity corroboration for public and 
private employment through E-Verify, and for assisting U.S. state or 
territory driver's licensing or identification issuing authorities 
seeking to confirm the authenticity of the U.S. passport when it is 
presented as evidence of identity, nationality, and/or lawful status to 
acquire a driver's license or identification card;
    (b) Department of Justice, including the Federal Bureau of 
Investigation, the Bureau of Alcohol, Tobacco, Firearms and Explosives, 
the U.S. Marshals Services, and other components, for law enforcement, 
counterterrorism, firearms sales and purchases in accordance with 18 
U.S.C. 922, border security, fraud prevention, and criminal and civil 
litigation activities;
    (c) Internal Revenue Service for the mailing and permanent 
addresses of specifically identified taxpayers in connection with 
pending actions to collect taxes accrued, examinations, and/or other 
tax-related assessment and collection activities; and an annual 
transmission of certain data from applications of those U.S. citizens 
residing abroad consistent with applicable requirements of 26 U.S.C. 
6039E;
    (d) INTERPOL and other international organizations for law 
enforcement, counterterrorism, fraud prevention, and criminal 
activities related to lost and stolen passports;
    (e) National Counterterrorism Center to support strategic 
operational planning and counterterrorism intelligence activities;
    (f) Office of Personnel Management (OPM), other Federal agencies, 
or contracted outside entities to support the investigations OPM, other 
Federal agencies and contractor personnel conduct for the Federal 
government in connection with verification of employment eligibility 
and/or the issuance of a security clearance;
    (g) Social Security Administration to support employment-
eligibility verification for public and private employers and for 
support in verification of social security numbers used in processing 
U.S. passport applications;
    (h) Federal law enforcement and intelligence agencies to support 
their efforts in identifying, verifying identity, and investigating 
individuals potentially involved in or associated with criminal or 
terrorist activities and individuals with other ties or connections to 
terrorism who may pose a threat to the United States;
    (i) Federal, state, local or other agencies having information on 
an individual's history, nationality, or identity, to the extent 
necessary to obtain information from these agencies relevant to 
adjudicating an application for a passport or related service, or where 
there is reason to believe that an individual has applied for or is in 
possession of a U.S. passport fraudulently or has violated the law;
    (j) Federal, state, local or other agencies for use in legal 
proceedings, as government counsel deems appropriate, in accordance 
with any understanding reached by the agency with the U.S. Department 
of State;
    (k) Department of Defense for the purpose of responding to 
inquiries from U.S. military installations concerning the current 
status of diplomatic, official, or no-fee regular passport applications 
of Department of Defense personnel and eligible family members;
    (l) Immediate family when the information is necessary as a result 
of a serious and emergency situation, and for the benefit of the 
subject;
    (m) Private U.S. citizen ``wardens'' designated by U.S. embassies 
and consulates to serve, primarily in emergency and evacuation 
situations, as channels of communication with other U.S. citizens in 
the local community;
    (n) Parties and their attorneys in administrative or judicial 
passport proceedings when necessary for the adjudication of a case 
involving the individual who is the subject of a Departmental record;
    (o) Members of Congress, at the request of the individual to whom 
the record pertains;
    (p) Contractor personnel conducting data entry, scanning, 
corrections, and modifications on behalf of an agency and for a purpose 
otherwise covered by this Notice;
    (q) Commercial vendors conducting applicant identity verification 
against commercial databases upon request of the Department of State;
    (r) Foreign governments, to permit such governments to fulfill 
passport control and immigration duties and their own law enforcement, 
counterterrorism, and fraud prevention functions, and to support U.S. 
law enforcement, counterterrorism, and fraud prevention activities;
    (s) U.S. state vital records issuing authorities for the purpose of 
confirming or validating a U.S. passport when it is presented as 
evidence to acquire certified copies of vital records;
    (t) The National Association for Public Health Statistics and 
Information Systems for the purpose of verifying a Consular Report of 
Birth Abroad presented as evidence of nationality and/or lawful status 
when acquiring a driver's license or identification card at a U.S. 
state or territory driver's licensing or identification issuing 
authority;
    (u) To appropriate agencies, entities, and persons when (1) the 
Department of State suspects or has confirmed that there has been a 
breach of the system of records; (2) the Department of State has 
determined that as a result of the suspected or confirmed breach there 
is a risk of harm to individuals, the Department of State (including 
its information systems, programs, and operations), the Federal 
Government, or national security; and (3) the disclosure made to such 
agencies, entities, and persons is reasonably necessary to assist in 
connection with the Department of State efforts to respond to the 
suspected or confirmed breach or to prevent, minimize, or remedy such 
harm.

[[Page 66909]]

    (v) To another Federal agency or Federal entity, when the 
Department of State determines that information from this system of 
records is reasonably necessary to assist the recipient agency or 
entity in (1) responding to a suspected or confirmed breach or (2) 
preventing, minimizing, or remedying the risk of harm to individuals, 
the recipient agency or entity (including its information systems, 
programs, and operations), the Federal Government, or national 
security, resulting from a suspected or confirmed breach;
    (w) Various entities including, but not limited to, Federal, state, 
territorial, tribal, and local government agencies, and non-profit 
organizations, utilizing federal government verification platforms, for 
the purpose of verifying the identity or citizenship for users 
accessing government websites and applications, voter eligibility, and 
other governmental services; and
    (x) Government agencies other than the ones listed above that have 
statutory or other lawful authority to maintain such information may 
also receive access on a need-to-know basis; however, all information 
is made available to users only for a previously established routine 
use.
    The Department of State periodically publishes in the Federal 
Register its standard routine uses that apply to all of its Privacy Act 
systems of records. These notices appear in the form of a Prefatory 
Statement (published in Volume 73, Number 136, Public Notice 6290, on 
July 15, 2008). All these standard routine uses apply to Passport 
Services Records, State-26.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    Records are stored both in hard copy and on electronic media. A 
description of standard Department of State policies concerning storage 
of electronic records is found here <a href="https://fam.state.gov/fam/05fam/05fam0440.html">https://fam.state.gov/fam/05fam/05fam0440.html</a>. All hard copies of records containing personal 
information are in secured file cabinets in restricted areas, access to 
which is limited to authorized personnel only.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    By individual name, date and place of birth, social security 
number, passport book or passport card number.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    Records are retained in accordance with the following Records 
Disposition Schedule: N1-059-90-23, item 1(3); N1-059-04-02, item 15e; 
N1-059-04-02, item 15h; DAA-0059-2020-0017-0009 ; DAA-0059-2020-0017-
0002 ; DAA-0059-2020-0017-0011 ; DAA-0059-2020-0017-0025.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    All users are given cyber security awareness training which covers 
the procedures for handling Sensitive but Unclassified (SBU) 
information, including personally identifiable information (PII). 
Annual refresher training is mandatory. In addition, all Department 
OpenNet users are required to take the National Foreign Affairs 
Training Center distance learning course instructing employees on 
privacy and security requirements, including the rules of behavior for 
handling PII and the potential consequences if it is handled 
improperly. Before being granted access to Passport Services Records, 
State-26, a user must first be granted access to the Department of 
State computer system.
    Department of State employees and contractors may remotely access 
this system of records using non-Department owned information 
technology. Such access is subject to approval by the Department of 
State's mobile and remote access program and is limited to information 
maintained in unclassified information systems. Remote access to the 
Department of State's information systems is configured in compliance 
with OMB Circular Memorandum A-130 multifactor authentication 
requirements and includes a time-out function.
    All Department of State employees and contractors with authorized 
access to records maintained in this system of records have undergone a 
background security investigation. Access to the Department of State, 
its annexes and posts abroad is controlled by security guards and 
admission is limited to those individuals possessing a valid 
identification card or individuals under proper escort. Access to 
computerized files is password-protected and under the direct 
supervision of the system manager. The system manager has the 
capability of printing audit trails of access from the computer media, 
thereby permitting regular and ad hoc monitoring of computer usage. 
When it is determined that a user no longer needs access, the user 
account is disabled.
    Physical records containing personal information are maintained in 
secured file cabinets or in restricted areas, access to which is 
limited to authorized personnel. Servers are stored in secured 
facilities in cipher locked server rooms. Physical access to the server 
rooms is limited to authorized personnel only. The system is secured 
with the safeguards required by OMB Memorandum M-07 16 as may be 
applicable.
    The safeguards in the following paragraphs apply only to records 
that are maintained in government-certified cloud systems. All cloud 
systems that provide IT services and process Department of State 
information must be specifically authorized by the Department of State 
Authorizing Official and Senior Agency Official for Privacy.
    Information that conforms with Department of State-specific 
definitions for Federal Information Security Modernization Act (FISMA) 
low, moderate, or high categorization are permissible for cloud usage 
and must specifically be authorized by the Department of State's Cloud 
Program Management Office and the Department of State Authorizing 
Official. Specific security measures and safeguards will depend on the 
FISMA categorization of the information in a given cloud system. In 
accordance with Department of State policy, systems that process more 
sensitive information will require more stringent controls and review 
by Department of State cybersecurity experts prior to approval. Prior 
to operation, all cloud systems must comply with applicable security 
measures that are outlined in FISMA, FedRAMP, OMB regulations, National 
Institute of Standards and Technology's (NIST) Special Publications 
(SP) and Federal Information Processing Standards (FIPS) and Department 
of State policies and standards.
    All data stored in cloud environments categorized above a low FISMA 
impact risk level must be encrypted at rest and in-transit using a 
federally-approved encryption mechanism. The encryption keys shall be 
generated, maintained, and controlled in a Department of State data 
center by the Department of State key management authority. Deviations 
from these encryption requirements must be approved in writing by the 
Department of State Authorizing Official. High FISMA impact risk level 
systems will additionally be subject to continual auditing and 
monitoring, multifactor authentication mechanism utilizing Public Key 
Infrastructure (PKI) and NIST 800 53 controls concerning 
virtualization, servers, storage and networking, as well as stringent 
measures to sanitize data from the cloud service once the contract is 
terminated.

RECORD ACCESS PROCEDURES:
    Individuals who wish to gain access to or amend records pertaining 
to themselves should submit a Privacy Act request to the U.S. 
Department of State Information Access Programs (IAP)

[[Page 66910]]

directorate by following the guidance and procedures located at <a href="https://foia.state.gov/request/request2.aspx">https://foia.state.gov/request/request2.aspx</a>. Mailed requests can be addressed 
to U.S. Department of State, Information Access Programs Directorate 
(A/SKS/IAP); 2201 C Street NW; Washington, DC 20520-0000. To request 
information under the Privacy Act, the individual should be a citizen 
of the United States, or an alien lawfully admitted for permanent 
residence. The Privacy Act permits access to an individual's own 
records only if those records are within a system of records that are 
retrieved by an individual's name or personal identifier.

CONTESTING RECORD PROCEDURES:
    Individuals who wish to contest the content of any record 
pertaining to him or her in the system should write to U.S. Department 
of State; Information Access Programs Directorate (A/SKS/IAP); 2201 C 
Street NW; Washington, DC 20520-0000.

NOTIFICATION PROCEDURES:
    Individuals who wish to be notified if the system contains a record 
pertaining to him or her should write to the U.S. Department of State; 
Information Access Programs Directorate (A/SKS/IAP); 2201 C Street NW; 
Washington, DC 20520-0000.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    Pursuant to 5 U.S.C. 552a (k)(1), (k)(2), and (k)(3), certain 
records contained within this system of records may be exempt from 
subsections 5 U.S.C. 552a (c)(3), (d), (e)(1); (e)(4)(G), (e)(4)(H), 
(e)(4)(I) and (f).

HISTORY:
    Passport Records, State-26, was previously published at 80 FR 
15653.

Timothy J. Kootz,
Deputy Assistant Secretary, Shared Knowledge Services (A/SKS), U.S. 
Department of State.
[FR Doc. 2026-21695 Filed 10-22-26; 8:45 am]
BILLING CODE 4710-05-P


</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>