Privacy Act of 1974; System of Records Revision
| Citation | 86 FR 48975 |
| Record Number | 2021-18808 |
| Published date | 01 September 2021 |
| Section | Notices |
| Court | Food And Nutrition Service |
Federal Register, Volume 86 Issue 167 (Wednesday, September 1, 2021)
[Federal Register Volume 86, Number 167 (Wednesday, September 1, 2021)]
[Notices]
[Pages 48975-48978]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2021-18808]
-----------------------------------------------------------------------
DEPARTMENT OF AGRICULTURE
Food and Nutrition Service
Privacy Act of 1974; System of Records Revision
AGENCY: Food and Nutrition Service (FNS), USDA.
ACTION: Notice of a proposed modified system of records.
-----------------------------------------------------------------------
SUMMARY: Pursuant to the provisions of the Privacy Act of 1974, and
Office of Management and Budget (OMB) Circular No. A-108, notice is
given that a component agency, the Food and Nutrition Service (FNS) of
the U.S. Department of Agriculture (USDA) is proposing to modify the
system of records, currently titled USDA/FNS-11, ``Information on
Persons Identified as Responsible for Serious Deficiencies, Proposed
for Disqualification, or Disqualified to Participate as Principals or
Family Day Care Home Operators in the Child and Adult Care Food Program
(CACFP),'' 69 FR 6933, published February 12, 2004, to include
unaffiliated centers and responsible individuals of unaffiliated
centers terminated or otherwise disqualified from participating in the
Child and Adult Care Food Program, and service institutions and
responsible individuals that have been terminated or otherwise
disqualified from participation in the Summer Food Service Program
(SFSP). The system of records will continue to include the records of
institutions, day care home providers, and responsible individuals who
have been terminated or otherwise disqualified from participation in
the Child and Adult Care Food Program.
DATES: In accordance with 5 U.S.C. 552a(e)(4) and (11), this notice is
effective upon publication, subject to a 30-day notice and comment
period in which to comment on the routine uses described in the routine
uses section of this system of records notice. Please submit your
comments by October 1, 2021.
ADDRESSES: You may submit comments, USDA/FNS-11, by one of the
following methods:
Federal eRulemaking Portal: http://www.regulations.gov
provides the ability to type short comments directly into the comment
field on this web page or attach a file for lengthier comments. Follow
the online instructions at that site for submitting comments.
Ms. Andrea Farmer, Chief, Community Meals Program
Monitoring Branch, Child Nutrition Programs, Food and Nutrition
Service, Braddock Metro Center II, 1320 Braddock Place, Alexandria, VA
22314.
Instructions: All submissions received must include the
agency name and docket number for this rulemaking. All comments
received will be posted without change to http://www.regulations.gov,
including any personal information provided.
Docket: For access to the docket to read background
documents or comments received go to http://www.regulations.gov.
FOR FURTHER INFORMATION CONTACT: For general questions please contact
Stephanie Means via telephone at 312-353-7270 or via email at
[email protected].
SUPPLEMENTARY INFORMATION: FNS maintains a list of institutions and
individuals who have been disqualified from participating in CACFP and/
or SFSP. The State agencies access the list to ensure that no one
participating in either Program in their state has been disqualified.
State agencies provide the information about the disqualifications
they impose by submitting the information to the NDL. FNS reviews and
approves the information. This information is then accessible to all
State agencies that participate in this matching program to help
determine CACFP and/or SFSP eligibility.
In accordance with the Privacy Act of 1974, 5 U.S.C. 552a, the
Department of Agriculture's (``Department'' or ``USDA'') Food and
Nutrition Service (FNS) proposes to modify the system of records
titled, USDA/FNS-11, ``Information on Persons Identified as Responsible
for Serious Deficiencies, Proposed for Disqualification, or
Disqualified to Participate as Principals or Family Day Care Home
Operators in the Child and Adult Care Food Program (CACFP).'' This
includes modifying the title to ``USDA/FNS-11, National Disqualified
List (NDL)--Information on Entities Disqualified from Participation in
the Child and Adult Care Food Program (CACFP) and Summer Food Service
Program (SFSP).''
The NDL system of records currently contains a list of
institutions, responsible individuals, and family day care home
providers that have been disqualified by State agencies from
participating in CACFP. The NDL system of records is being modified to
include unaffiliated centers and responsible individuals of
unaffiliated centers terminated or otherwise disqualified from
participating in the CACFP. The NDL system of records is also being
revised to include service institutions and responsible individuals of
service institutions that have been terminated or otherwise
disqualified from participating in the SFSP as required by Section 322
of the Healthy, Hunger-Free Kids Act of 2010 (HHFKA), Public Law 111-
296 (requiring the Secretary to maintain a list of service institutions
and individuals that have been terminated or disqualified from SFSP and
to make this list available to State agencies for use in approving or
renewing service institutions' applications for SFSP participation).
Responsible individual means: A principal, whether compensated or
uncompensated, who the State agency or FNS determines to be responsible
for a serious deficiency; any other individual employed by, or under
contract with, a sponsoring organization who the State agency or FNS
determines to be responsible a serious deficiency; or an uncompensated
individual who the State agency or FNS determines to be responsible for
a serious deficiency.
FNS will share information from the system in accordance with the
requirements of the Privacy Act. A full list of routine uses is
included in the routine uses section of the document published with
this notice.
In accordance with 5 U.S.C. 552a(r), USDA has provided a report of
this system of records to the Office of Management and Budget and to
Congress.
SYSTEM NAME AND NUMBER:
USDA/FNS-11, ``Information on Persons Identified as Responsible for
Serious Deficiencies, Proposed for Disqualification, or Disqualified to
Participate as Principals or Family Day Care Home Operators in the
Child and Adult Care Food Program (CACFP),'' and also referred to as
the National Disqualified List or NDL.
This notice proposes to modify the system name to: ``National
Disqualified
[[Page 48976]]
List (NDL)--Information on Entities Disqualified from participation in
the Child and Adult Care Food Program (CACFP) and Summer Food Service
Program (SFSP).''
SECURITY CLASSIFICATION:
None.
SYSTEM LOCATION:
This system of records is under the control of the Deputy
Administrator, Child Nutrition Programs, FNS, USDA, 1320 Braddock Pl.,
Alexandria, Virginia 22314.
The data on institutions, service institutions, unaffiliated
centers, day care home providers, and responsible individuals who have
been disqualified from participation in the CACFP and/or SFSP will be
maintained within the NDL system of records.
SYSTEM MANAGER(S):
Branch Chief, Community Meals Program Monitoring Branch, Child
Nutrition Programs, Food and Nutrition Service, USDA, (703)305-2470,
1320 Braddock Pl., Alexandria, Virginia 22314.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
Section 243(c) of Public Law 106-224, the Agricultural Risk
Protection Act of 2000, which amended section (42 U.S.C.
1766(d)(5)(E)(i) and (ii)) of the Richard B. Russell National School
Lunch Act
PURPOSE(S) OF THE SYSTEM:
The purpose of modifying the system of records is to continue to
promote integrity in the CACFP and SFSP (``Program(s)'') by providing
Program-administering States and CACFP sponsoring organizations with
the names of institutions, service institutions, responsible
individuals, unaffiliated centers, and family day care home providers
that have been terminated or otherwise disqualified from participating
in either Program. Once disqualified, these institutions, service
institutions, responsible individuals, unaffiliated centers, and family
day care home providers are prohibited from participating in either
Program for seven years from the effective date of the
disqualification, and until any debt under either Program is paid.
Institutions, service institutions, responsible individuals,
unaffiliated centers, and family day care home providers may be removed
from the NDL system of records before seven years if the Program-
administering States and FNS concur that any Program violation that
caused their placement on the NDL system of records has been corrected.
However, no institution, service institution, responsible individual,
unaffiliated center, or family day care home provider may be removed
from the NDL system of records if they owe a debt under either Program.
Program-administering States and CACFP sponsoring organizations must
verify that Program applicants are not on the NDL system of records
prior to approval or renewal of participation in the Program.
Similarly, CACFP sponsoring organizations must check the NDL system of
records to verify that any new employee that will be paid for using
Program funds or that will be working in either Program is not on the
NDL before hiring.
Maintaining the NDL system of records and making it available to
Program-administering States and CACFP sponsoring organizations
provides them with a tool for promoting Program integrity by preventing
several situations from occurring. First, it prevents institutions,
service institutions, or unaffiliated centers whose Program agreements
were terminated for cause in one State from reapplying for Program
participation in another State. Second, it prevents responsible
individuals disqualified from either Program from continuing to be
involved in Program administration by forming a new corporate entity
and entering the Program under a different organizational name. Third,
it prevents responsible individuals associated with a disqualified
institution, service institution, or unaffiliated center from re-
entering the Program as a family day care home provider, or as a
responsible individual with another institution, service institution,
or sponsored center. Finally, it prevents family day care home
providers terminated for cause by one sponsoring organization from re-
entering the Program under the auspices of a different sponsoring
organization.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
Categories of individuals covered by this system include, but not
limited to, responsible individuals and principals of centers and day
care home providers that have been terminated or otherwise disqualified
from participation in the CACFP. The system also contains information
on responsible individuals and principals of service institutions that
have been terminated or otherwise disqualified from participation in
the SFSP. All individuals, even if they are not users of the USDA/FNS-
11, who are mentioned or referenced in any documents entered into USDA/
FNS-11 by a user are also covered. This group may include, but is not
limited to: Vendors, agents and other business personnel.
CATEGORIES OF RECORDS IN THE SYSTEM:
Categories of records in the system will be modified to include the
following information from unaffiliated centers and responsible
individuals of unaffiliated centers that have been terminated or
otherwise disqualified from participation in the CACFP, and service
institutions and responsible individuals of service institutions that
have been terminated or otherwise disqualified from participation in
the SFSP:
Full name, previously used names;
date of birth;
state and locality in which the disqualification occurred;
addresses of businesses and individuals;
disqualification start date;
reason for disqualification;
Federal Employer Identification Number (FEIN) or Dun and
Bradstreet Data Universal Numbering System (DUNS);
disqualifying State agency;
any debt owed;
supporting documentation such as notices of proposed
termination and disqualification; and,
for records of institutions, service institutions,
unaffiliated centers, or individuals requesting early removal,
corrective action plans to correct Program violations that led to
placement on the NDL system of records.
RECORD SOURCE CATEGORIES:
Information in this system of records is provided to FNS by
Program-administering State agencies. The FNS appropriate regional
office will approve the information and can assist the State agency in
entering or correcting the information. The FNS national office can
also alter information in the system as needed.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND PURPOSES OF SUCH USES:
In addition to those disclosures generally permitted under 5 U.S.C.
552a(b) of the Privacy Act, all or a portion of the records contained
in this system may be disclosed outside USDA as a routine use pursuant
to 5 U.S.C. 552a(b)(3), to the extent that such uses are compatible
with the purposes for which the information was collected. Such
permitted routine uses include the following:
(1) To the Department of Justice when: (a) USDA or any component
thereof; or (b) any employee of USDA in his or her official capacity,
or any
[[Page 48977]]
employee of the agency in his or her individual capacity where the
Department of Justice has agreed to represent the employee; or (c) the
United States Government, is a party to litigation or has an interest
in such litigation, and USDA determines that the records are both
relevant and necessary to the litigation and the use of such records by
the Department of Justice is deemed by USDA to be for a purpose that is
compatible with the purpose for which USDA collected the records.
(2) In an appropriate proceeding before a court, grand jury, or
administrative or adjudicative body or official, when the USDA or other
Agency representing the USDA determines that the records are both
relevant and necessary to the proceeding; or in an appropriate
proceeding before an administrative or adjudicative body when the
adjudicator determines the records to be relevant to the proceeding.
(3) To a congressional office in response to an inquiry from that
congressional office made at the written request of the individual
about whom the record pertains.
(4) To the National Archives and Records Administration or other
Federal government agencies pursuant to records management activities
being conducted under 44 U.S.C. 2904 and 2906.
(5) To an agency, organization, or individual for the purpose of
performing audit or oversight operations as authorized by law, but only
such information as is necessary and relevant to such audit or
oversight function.
(6) To other Federal agencies or non-Federal entities under
approved computer matching efforts, limited to only those data elements
considered relevant to determine eligibility under particular benefit
programs administered by those agencies or entities or by USDA or any
component thereof, to improve program integrity, and to collect debts
and other monies owed under those programs.
(7) To another Federal agency or Federal entity, when information
from this system of records is reasonably necessary to assist the
recipient agency or entity in: (1) Responding to a suspected or
confirmed breach or (2) preventing, minimizing, or remedying the risk
of harm to individuals, the recipient agency or entity (including its
information systems, programs, and operations), the Federal Government,
or national security, resulting from a suspected or confirmed breach.
(8) To appropriate agencies, entities, and persons when: (1) USDA
suspects or has confirmed that there has been a breach of the system of
records; (2) USDA has determined that as a result of the suspected or
confirmed breach there is a risk of harm to individuals, USDA
(including its information systems, programs, and operations), the
Federal Government, or national security; and (3) the disclosure made
to such agencies, entities, and persons is reasonably necessary to
assist in connection with USDA's efforts to respond to the suspected or
confirmed compromise and prevent, minimize, or remedy such harm.
(9) To contractors and their agents, grantees, experts,
consultants, and other performing or working on a contract, service,
grant, cooperative agreement, or other assignment for the USDA, when
necessary to accomplish an agency function related to this system of
records.
(10) When a record on its face, or in conjunction with other
records, indicates a violation or potential violation of law, whether
civil, criminal or regulatory in nature, and whether arising by general
statute or particular program statute, or by regulation, rule, or order
issued pursuant thereto, USDA may disclose the record to the
appropriate agency, whether Federal, foreign, State, local, or tribal,
or other public authority responsible for enforcing, investigating, or
prosecuting such violation or charged with enforcing or implementing
the statute, or rule, regulation, or order issued pursuant thereto, if
the information disclosed is relevant to any enforcement, regulatory,
investigative or prosecutive responsibility of the receiving entity.
(11) USDA/FNS may disclose information from this system of records
on individuals who have been disqualified from participation in the
CACFP and/or SFSP to every agency that administers the CACFP and/or
SFSP directly in the States and to every sponsoring organization
participating in CACFP. The information will be available to the State
agency directors and staff members, who make decisions about
application approval or termination from participation in the program
or, in the case of sponsoring organizations, make hiring decisions or
submit applications for approval of day care home providers to the
State agency.
(12) To the news media and the public, with the approval of the
Chief Privacy Officer, the Office of Communications and in consultation
with counsel, unless it is determined that release of the specific
information in the context of a particular case would constitute an
unwarranted invasion of personal privacy.
(13) USDA will disclose information about individuals from this
system of records in accordance with the Federal Funding Accountability
and Transparency Act of 2006 (Pub. L. 109-282; codified at 31 U.S.C.
6101, et seq.); section 204 of the E-Government Act of 2002 (Pub. L.
107-347; 44 U.S.C. 3501 note), and the Office of Federal Procurement
Policy Act (41 U.S.C. 403 et seq.), or similar statutes requiring
agencies to make available publicly information concerning Federal
financial assistance, including grants, subgrants, loan awards,
cooperative agreements and other financial assistance; and contracts,
subcontracts, purchase orders, task orders, and delivery orders.
(14) Disclosures pursuant to 5 U.S.C. 552a(b)(12). Disclosures may
be made from this system to ``consumer reporting agencies'' as defined
in the Fair Credit Reporting Act (15 U.S.C. 1681a(f)) or the Debt
Collection Act of 1982 (31 U.S.C. 3711(d)(4)).
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
State agencies and FNS can view records in the NDL. eAuthentication
level 2 clearance is required to enter, change or view records in the
system. Records are maintained electronically. The NDL also contains
three notices for each disqualification. These paper notices were
mailed to the disqualified individuals and uploaded in the NDL as PDFs.
Although NDL records are electronic, State agencies and FNS Regional
Offices keep paper copies of the uploaded notices.
For FNS and Program-administering States, records may be retrieved
by the individual's name and date of birth for responsible individuals
and day care home providers, in addition to FEIN or DUNS number for
institutions, service institutions, and unaffiliated centers.
CACFP sponsoring organizations identify records for retrieval using
name and state.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
Currently, records remain in the NDL after the disqualification
expires with a changes status of removed. This process will change to
delete all records three years after disqualification expires.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
NDL system of records Username/Password: NDL user IDs and passwords
are used to limit access to the application. Access is controlled
through USDA eAuthentication service. NDL requires a Level 1 or Level 2
access. Level 1 users are automatically
[[Page 48978]]
provided restricted access to the application. Level 2 users have
managed access within the application.
The NDL system accomplishes this functionality by requiring that a
specific role be assigned to each user. Sponsoring organizations have
e-Authentication level 1 clearance allowing them to view individuals'
names, other legal names, state, termination date, disqualified status,
whether a debt is owed, and pending status. For institutions, they may
view institutions' names and previous names, full address, termination
date, disqualified status, whether a debt is owed, and pending status.
State agency and FNS users have e-Authentication level 2 clearance,
which allows them to view the information listed above, in addition to
date of birth and individuals' full addresses. Currently, all States
and four territories have access to the NDL with e-Authentication level
2 clearance. Once identified, the system uses the existing
functionality within the FNS General Support System platform to
selectively control permissions by role. As mentioned, controls for e-
Authentication level 1 users include restricting information view
privileges by removing dates of birth and individuals' full addresses
from view. e-Authentication level 2 can view all the data.
NDL Application software roles: Users with eAuthentication level 2
credentials are assigned roles which determine the level of access they
have within NDL.
Server to Server and Client to/from Server communications
encryption: Secure Socket Layer (SSL) with 128-bit encryption has been
applied to all the application servers, which are only available
through FNS Intranet connection. In addition, all communications
between servers will be encrypted.
Vulnerabilities and anti-virus: Known vulnerabilities are regularly
identified and resolved. Many tools, such as Tenable and Splunk are
used scan resources. The sources for these scan services include
vendors and the National Vulnerability Database. Industry best
practices are followed to resolution. Users on client machines do not
have local administrative rights, which maintain low vulnerability.
Users have the ability to intentionally or accidentally download and
install malicious code. This risk is mitigated using a multi-layered
approach. First, anti-virus applications are deployed to all client
machines and virus definitions are automatically updated daily using a
centrally managed update server. Second, all systems are monitored and
randomly inspected for unauthorized software. DISC EDC employs Retina
for daily scans of VMs and configured environments to identify
vulnerabilities and alert appropriate personnel.
RECORD ACCESS PROCEDURES:
Individuals seeking notification of and access to any record
contained in this system of records, or seeking to contest its content,
may submit a request in writing to the Headquarters or component's FOIA
Officer, whose contact information can be found at https://www.dm.usda.gov/foia/poc.htm. If an individual believes more than one
component maintains Privacy Act records concerning him or her, the
individual may submit the request to the Chief FOIA Officer, Department
of Agriculture, 1400 Independence Avenue SW, Washington, DC 20250.
The request should include a daytime phone number and email.
Provide as much information as possible about the subject matter of the
records you are requesting. This will help facilitate the search
process.
When seeking records about yourself from this NDL system of
records, or any other Departmental system of records, your request must
conform with the Privacy Act regulations set forth in 7 CFR 1.112
(Procedures for requests pertaining to individual records in a record
system). You must submit a written request in accordance with the
instructions set forth in the system of records.
Provide your full name, date, name of system of records, and either
(1) have your signature witnessed by a notary; or (2) include the
following statement immediately above the signature on your request
letter: ``I declare under penalty of perjury that the foregoing is true
and correct. Executed on [date].'' Requests that do not contain the
required declaration will be processed under the Freedom of Information
Act (FOIA), and, if records are found, you may not receive as much
information, including information about you. If additional information
is required to fulfill a Privacy Act request, you will be notified.
When the request is for one of access, the request should include
the full name of the individual making the request, the name of the
system of records, and a statement of whether the requester desires to
make a personal inspection of the records or to be supplied with copies
by mail or email.
In accordance with 7 CFR 1.113, prior to inspection of the records,
the requester shall present sufficient identification (e.g., driver's
license, employee identification card, social security card, credit
cards) to establish that the requester is the individual to whom the
records pertain. No identification shall be required, however, if the
records are required by 5 U.S.C. 552 to be released. If FNS determines
to grant the requested access, fees may be charged in accordance with
Sec. 1.120 before making the necessary copies. In place of a
notarization, your signature may be submitted under 28 U.S.C. 1746, a
law that permits statements to be made under penalty of perjury as a
substitute for notarization.
CONTESTING RECORD PROCEDURES:
Individuals seeking to contest or amend records maintained in this
system of records must direct their request to the address indicated in
the ``RECORD ACCESS PROCEDURES'' paragraph, above and must follow the
procedures set forth in 7 CFR part 1, subpart G, Sec. 1.116 (Request
for correction or amendment to record). All requests must state clearly
and concisely what record is being contested, the reasons for
contesting it, and the proposed amendment to the record. A
determination whether a record may be amended will be made within 10
days of its receipt.
NOTIFICATION PROCEDURES:
Individuals may be notified if a record in this system of records
pertains to them when the individuals request information utilizing the
same procedures as those identified in the ``RECORD ACCESS PROCEDURES''
paragraph, above.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
HISTORY:
https://www.federalregister.gov/documents/2004/02/12/04-3116/privacy-act-proposed-new-system-of-records.
Cynthia Long,
Acting Administrator, Food and Nutrition Service.
[FR Doc. 2021-18808 Filed 8-31-21; 8:45 am]
BILLING CODE 3410-30-P
