1990 Computer Matching & Privacy Protection Amendments

Federal Register I Vol 56. No.78 I Tuesday. April 23. 1991 I Noti~es

18599

E men en ~ dated O ober 31. 1989. as

su~ emented J 25.

~ ' une

.August 23. vember8. an ,-

ovember 1990. and (2) endment

recently enacted Computer Matching

and Privacy Protection Amendments of

1990. which alter the due process

provisions of the Computer Matching

and Privacy Protection Act of 1988. This

latter Act amended the Privacy Act of

1974. The guidance also addresses

another issue suggested by agencies in

reporting to OMB their activities in

implementing the Computer Matching

, and Privacy Protection Act. ,

DATE:Comments should be submitted

no later than May 23.1991.

ADDRESs:Send written comments to the

Information Policy Branch (Attention

Robert N. Veeder); Office of Information

and Regulatory Affairs. Office of

Management and Budget. Room 3235 ,

NEOB. Washington. DC 20503.

Comments may be sent by Fax to Robert

N. Veeder at 202-395-7285.

FORFURTHERINFORMATIDNCONTACT:

Mr. Robert N. Veeder. Information

Policy Branch. Office of Information and

Regulatory Affain. Office of

Management and Budget, Washington.

DC 20503(202) 395-3785. : -' ,

SUPPlEMENTARYINFORMATION:Section

(v) of the Privacy Act of 1974 (5 U.S.C.

5528) charges OMB with overseeing

agencies' implementing activities and

issuing regulations 8.ridguidelines. In

addition. Public Law 100-503, the

Computer Matching and Privacy. .,..,

Protection Actof 1988 (CMPPA). andJ::

Public Law 101-508. the Computer, ."

Matching and Privacy Protection, ...

Amendments of 1990 (amendments)

require OMB to provide guidance on ,

their implementation. Where the

proposed guidance below contradicts , -

earlier guidance on specific points of

" interpretation. it is intended that the ..

most recent guidance should be relied .

H , upon. , , i, .D;!", ',..;::: '.' " c:. ; .

The changes made by the Computer'.

Matching and Privacy Protection.:.. .; -::;:

.~", Amendments of 1990 addressed '-':..t-.f,-

[ agencies' problems in implementing the

due process provisions of the Computer

Matching and Privacy Protection Act of

1988. (See 5 U.S.C. 552a(p). ..Verification

and Opportunity to Contest Findings".)

Under the 1988 provisions. before taking

an adverse action. an agency was

required to verify independently any'

information developed through a; " , ,

matching program that indicated ." '- ~'

ineligi~ility. The agency was also .'

required to notify the individual of any.

proposed action and wait thirty days for

the individual to respond. These: ",. .

provisions were intended to ensure.c.;.:

fairness in t~e determination process. ' ;.'

As implementation took place. it' ,;...

became apparent that the due process ,

provisions in some instances conflicted

~;th existing protections that had

OFFICE OF MANAGEMENT AND

BUDGET

The Computer Matching and Privacy

Protection Amendments of 1990 and

The Privacy Act of 1974

AGENCY:bffice of Management and

Budget (0MB). .-.

ACTION: Proposed guidance. .-

arguably been working well prior to the

Computer Matching and Privacy

Protection Act. This was especially true

in programs such as Food Stamps. Aid

to Families with Dependent Children.

and Medicaid, all of which had well-

established due process traditions

provided by statute, regulation. or both.

The consequence of providing

individuals with 30 days to respond to a

notice of adverse finding was to"

automatically overpay some .

beneficiaries. .

As to independent verification. the-

ljouse Report on the amendment noted

fuat '"I'he purpose of the independent

verification requirement is to assure that

the rights of individuals are not affected

automatically by computers without

human involvement and without takins-

reasonable steps to determine that the

information relied upon is accurate. -:-,

complete and timely." (House Report

101-768. p. 4) Again. the goal was to .;

assure fairness to the individuaL " --;

Indeed. as they implemented the" "

Computer Matching and Privacy -

Protection Act, agencies discovered

instanceu where strict adherence to the'

independent verification requirement ~

could have serious financial and" .-~ ..

administrative implications for the. -.

management of their programs. For: " :-

example, in the case of data exchanges

between State agencies and the Social :.

Security Administration {SSArunder:the

Income Eligibility and Verification ~.: -

System (IEVS), the States have no .,.-

independent procedure throughwhich~.

they can verify the SSA data. IEVS .' "

recognizes this problem by excluding. ,,~.

Social Security and Supplemental " .'J

Security Income (SSI) data from its own

independent verification requirement. ::

Similarly, automated data exchanges .

between the Department of Defense and

the Department of Veteran's Affairs to::J

determine eligibility for certain ,...,.:(-..~

educational benefit programs would

jeopardized if. in each instance,

taking an action. the recipient agency .

had to examine the source agency's. :

underlying paper record. .c

The Computer MatChing and Privacy

Protection Amendments of 1990 change .

both the independent verification and.

3O-day notice due process protection -,

provisions. These changes are described

below, accompanied by proposed ,~..:..:

guidance. -' ;.c.:c;.;. .,,'~; ...

1. Notification of Adverse Finding: ;.

The 1990 amendments authorize"-. ,. ::

agencies that have in law or regulation a

different time period for notification:. .:.,

than thirty days. to substitute that other

period, Agencies without alternative

periods must wait thirty days. "

SUMMARY:6MB request public. ;.;:;

comments on proposed guidance to -,

Federal State and local agencies on

implementing certain provisions of the

Privacy Act of 1974. as amended. This

guidance focuses especially on the.

be ~:-.-

before --:.

: .

:"'

18600

Federal Register / Vol 56. No.78 / Tuesday, April 23. 1001 / Notices

The amendment allowing agencies to

substitute existing alternative time

, periods were effective immediately upon

enactment and did not reqUire lipecific

0MB interpretive guidance. OMB invites

comment therefore. on related guidance

on this provision:

.Under what circumstances should

an agency be permitted to establish a

new time period by regulation? OMB

interprets the amendments to indicate

that agencies should be able to adopt

new time periods that are shorter than

the 30 day threshold the CMPPA .,.

provides. Whatsafeguards are needed

for this process?

.Should 0MB "provide guidance on

what constitutes '"re88ODable notice. -

including defining when the time period

begins to nm? What should that

guidance say?

.Should 0MB mandate what the

co~t of the notices should be? jf &0.

how specific should the content bel

Reviewers should tme the following

proposed guidance as a point of .

departure for commenting on the

questions above.

Proposed Guidance: '"Where a

program statute is silent or permits.

agencies may also establish a new

notification period through rulp~lt;n.?

that involves the public in the process.

-either through hearings or publication in

; the Federal Register for notice-aod-

, comment. Agencies should not establish

periods that are shorter than the

CMPPA's thirty day stanaard 1mless ..

they can ensure that such periods are

adequate to give indiViduals meaningful

notice and sufficient time to respond.

Moreover, whatever the time period

used. agencies must disdose not merely

the fact that they have information that

mdicates ineligibility, btJt what that

information is. This will give individuals

meaningful notice and pe!'mit them to

understand exactly what the discrepant

information is and to provide any

explanatary information. In either case.

the period begins to r11nfrom the date of

the notice that descn"bes the agency'.

findings to the individual 01'the date on

which the Itgency provides a copy in

person."

2.1ndependent Verification

Requirements: The 1900 ameDdmenta

authorize an agency's Data Integrity

Board to waive the independent

verification procedures when it finds a

high,degree of cxmfidence in the

accuracy of the data.

.The amendments create an alternative

to the requirement that agencies

independently verify the .accuracy 0£

information developed through a

) matching program before usi1lg it to

make an adverse determinatiOl1. .

A-ccording to the House Report. .'lbe

alternative procedure permits a Data

Integrity Board to waive the

independent verification procedure

..* for qualifying disclosures. " (House

Report 101-768, Po4.)

Note that this alternative is not a

general exception to the requirement: it

is available only far a specific type of -

matching data and only when the

agency hu ~ certain steps.

Reviewers are invited to comment on

the following proposed guidance. 0MB

is particularly interested in knowing

whether its guidance for identifying the

types of matching data eligible for a

waiver is adequate. Also, are ~ criteria

for evaluating a database sufficient1

Proposed Guidance: "Program

officials may petition the Data Integrity

Board of the recipient Federal agency in

the case of a Federal matching program.

or the Federal source agency in the case

of a Federal/State matching program to

waive the independent verification

requirement only after they haTe taken

the following steps:

.Identification of the ~ of

Matching Data Eligible for the Waiver.

FJigible data are only infonnation that

identifies the individnal and the amount

of benefits paid to the indivith1a1 UDder a

Federal benefit program. A clear

example of the kind of data exchange

that is eligible for waiver consideration

is the furnishing to States by the Social

Secmity Administration of Cost of

Living Adjustment {COLA) information

that consists of the name of the benefit

recipient. the benefit amount including

amowrt of the COLA change, and other

information. In this example. the name

and benefit .amount would be eligible far

the waiver

information"

procedure: the "other

would not. Another .

example would be the flmlishing by the

Department of Defense of information

abont the Reserve status ofmilitary

personnel to the Department of Veterans

Affairs far purposes of det~""ining

l%edit for educational benefits programs.

provided that the in£ormatiOD consisted

of ~ name, rank and reserve mtus. -

i.e.. active or inactive dnting the

reporting time period. In both of these

examples. the data that is conveyed is

unambiguous: E.g.. the CbLA increase is

five percent for all recipients: here is a

list of all reservists who performed duty

such that they are eligible for the

benefit. Where the information

fumjshed is less precise (Rg., it consists

of underlying eligibility infarmatioD-

amount of earned income. amount of

unearned income. number of

dependents) and is different for eaclt

participant. such data is DOta candidate

far the waiver procedure.

.Condncting Thorough

Determinations of Data Accuracy. Once

an agenC"fhas determined that the data

being exchanged qualifies far the waiver

procedure. the agency must present

convincing evidence to the Data

Integrjty Board of the recipient agency

far source agency in the case of a

Federa.ifnon-I;ederal Match) to permit

the Board to assert a high degree of

confidence in the accuracy of the data.

Note that the Amendmenta do not

require that the agencies conduct

thorough audita of their systems. only

that they have infonnation relating to

the quaDty of data. Among the elements

an agency may wish to present to a Data

Integrity Board are the following. {not all

of which may be necessary or "

appropriate):

-A description of the data bases -"

involved (both SOtIrce and recipient)

including information 011how data are

acquired and maintained so as to

permit accuracy assessments.

-The system managers' overall

uses.sment of the reliability of the

systems al1d the accuracy of the daa

they COl1tain(both participants}.

-The results of any audita or risk

assessments conducted (both

parti dpan ts}.

-Any m3terial or significant

~~ir:!!e,-~ identified in respanse to

requirements of the Federal Managers

FInancial Integrity Act or related

legislation and any applicable 0MB -

-Cir1:u]ars (bo1h participants). .

-Any asses3tnents of ~ ~ectiveness /

of the agencies .Personnef Security

~ (both partic:ipant3).

-The security contr1Jls in place for the

system. and tb~ ;ecarity risks

associated with those systems {both

particiJ'antsJ.

-Any historical data relating to

program emJr rat~ {recipient agency).

-Any infannation relating to the

currency of the data (source agency).

Far examp}e. a source agency updates

.~hould

each quarter. A recipient agency

.data

probably not use data that it

received in January to make a

determination in March since newer

data will be available then. In some

cases. the 8OUrt:eagency may wish to

provide confidence intervals to help

the recipient agency determine wh~,

the data is so old 88 to be suspect:

e.g.. data is 99 percent accurate within

" one week of receipt. 95.percent

accurate within two weeks of reC2.ipt.

85 percent accurate within three "

weeks of rei:eipt. Alternatively, a

source agency may wish to WaIn a

recipient agency not to use data 8fter

the date ODwhich dIe data base is

updated.

will ~ at 9 p'.m. in;the <;'.6nference

ROQlft. Coun!:i! on Envirt;>l1'mental

i\i .

,-..~ ,

pan~

-~~4

m...r;

Federal Register I Vol. 56. No.78 I Tuesday. April 23. 1991 I Notices 18601

"--

Note that this list is not meant to be equitable way. While it still may make

~f" o e exhaustive. nor will each item be sense fxom an efficiency standpoint to sclos o a

suitable for every matching program. make one agency responsible for all of clea unw

Agencies should use whatever is the required administrative actions. the pe nal pri

appropriate to their particular matching parties should assign rtion of

circumstances. 80 long as the resultant responsibility in a fair and reasonable

finding is that the Data Integrity Board way.

has a high degree of confidence in the Ol\.iB invites comment on how to

accuracy of the data. Obviously, since clarify the administrative

much of the data used by the recipient responsibilities of these parties in a fair

agency "in tbedetermination must come and equitable manner.

from the source. the source should be JamesB. MacRae.Jr..

prepared to cooperate ~ the Acting Administrator andDeputy

development of the waIver Administrator. Office aj Infannation and

determination. The evaluations should ReguJatoryAffaizs. "

be renewed eacl1 tj.me the matching 1FRDoc. 91-9475F"1led4-22-91:8:45am]

agreement is renewed. Moreover. any BIWNGCODE31- -

changes to the data base that would

affect data quality should be reported to

the Data Integrity Board which must

then determine whether to continue its

certification.

OfIce the Data Integrity Board has

found a matchmg program eligible for

waiver. it should notify the program

officials expeditiously. It should also

notify the source agency. The board -

should be prepared to include

information about any waivers granted

as part of its Matching Report to OMB

and its agency head..' "-' " " "":

Supplemental Guidance on the -..

-Responsibilitiea of the .°SoUl1:e"and

) "Recipient" Agencies (5 U.s.c. 552.a{a]].

Finally. Ol\.iB seeks comment concerning

whether it should amend guidance

previously given canceming the .;

responsibility of the ":source" and"",

"recipient" ,agencieg:;,"!~ o;~.:.-;.-,-,;;;;" -,

OMB'. initial guidance made the, -

recipient Federal agency responsible for

meeting the reporting and publishing

requirements of the Computer Matching

and Privacy Protection Act. This ..

assignment was based on the. " .

.assumption that the recipient agency

was the one moat likely to benefit from

the matcl1iDg program and should. .-

therefore. bear the costs. 0MB now.

believes, however. that in certain -."

limited circumstBncea. the assumption is

.not valid. ID some cases, 8 .single agency

may perform matches for a group of" ..

.other a~ciea. The recipient agency in

such cases derives no benefit of its own.

nor doea it have the information needed

to produce the reports and notices the

Com~ Matching and Privacy

Protection kt requires. It merely

.-matt:het recorrls and gives to the source

agencies information. (e.g..location of a

.Federal employee who has defaulted on

an obligation incurred under a program

operated by the SOIm:e agency) {)n

which they may base some action. In

cases like these, 0MB intends that its .

assignment 0{ responsibilities to the .-.,

-recipient ~ncy be interpreted in an :

~ .an r9)(B}.. -.

!'rtion of 'discuS.sio

c position ~Jt:~cessitate .

'signin~ .frostra~e

,--.