31836 Federal Register / Vol. 72, No. 110 / Friday, June 8, 2007 / Notices 

5 For example, under FTC rules, disclosures to 

other law enforcement agencies may be made on a 

confidential basis for law enforcement purposes. 

See Commission Rule 4.11(c), 16 CFR 4.11(c). 

6See Memorandum for the Heads of Department 

and Agencies, from Clay Johnson, Deputy Director 

for Management, OMB, ‘‘Recommendations for 

Identity Theft Related Data Breach Notification’’

(Sept. 20, 2006) (attaching Memorandum from the 

Identity Theft Task Force, ‘‘Identity Theft Related 

Data Security Breach Notification Guidance’’ (Sept. 

19, 2006), also reproduced in The President’s 

Identity Theft Task Force, Combating Identity Theft: 

A Strategic Plan (Apr. 2007) at 73-82 (App. A)). 

disclosures, consistent with the Privacy 

Act’s requirement that individuals be 

made aware of how their records may be 

disclosed, even if the FTC anticipates 

that there may often be very limited or 

no disclosure of an individual’s records 

to third parties as part of the agency’s 

investigatory or remedial efforts. 

Developing fixed categories of access 

for certain entities or individuals, as 

EPIC suggests, would not appear to 

confer significantly greater protection, if 

any, for an individual’s records than 

limiting disclosures to those that are 

‘‘reasonably necessary.’’ The 

determination of when disclosure is 

‘‘reasonably necessary’’ will logically 

depend on a case-by-case evaluation of 

the specific circumstances of the breach, 

including how much of an individual’s 

information, if any, it is reasonably 

necessary to disclose, and the specific 

nature of the entities to whom such 

information needs to be disclosed, in 

order to investigate or respond to a 

breach.5 Amending a routine use to 

accommodate disclosures in response to 

a breach is not a viable option when 

there is a clear need to respond rapidly 

and effectively in investigating and 

mitigating the breach, in light of the 

prior notice and comment requirements 

of the Privacy Act for routine use 

amendments. 

Second, EPIC’s comment advocates 

that consumers be notified as soon as 

possible after a security breach results 

in their personal information being 

accessed by an unauthorized person, 

and before notifying any other agency, 

entity or individual. That issue, 

however, is outside the scope of a 

routine use notice under the Privacy 

Act. The Act requires that agencies 

notify individuals about the 

establishment of a Privacy Act system of 

records, the routine uses of such 

systems of records, and additional 

notice at the time that information in 

such a system is collected from 

individuals. 

Nothing in the Act, however, governs 

or provides criteria for determining 

when notice of a data breach to affected 

individuals would be appropriate or 

not. Guidance on that issue has been 

issued to all Federal agencies by the 

Office of Management & Budget (OMB), 

in conjunction with the President’s 

Identity Theft Task Force, chaired by 

the Attorney General and co-chaired by 

the FTC Chairman.6 As stated in that 

guidance, agencies must consider 

various factors in determining whether 

notice is appropriate in a given case. 

The routine use published by the FTC 

neither addresses nor is it intended to 

supersede or supplant such guidance, or 

any other applicable guidance that may 

later arise in applicable statute, rule or 

policy regarding when notice to 

individuals must or should be given. 

Accordingly, after consideration of 

the above, the FTC has determined to 

adopt the routine use for data breach as 

originally published, and hereby 

amends Appendix 1 of its Privacy Act 

system notices, as published at 57 FR 

45678, by adding the following new 

routine use at the end of the existing 

routine uses set forth in that Appendix: 

* * * 

To appropriate agencies, entities, and 

persons when (1) the FTC suspects or 

has confirmed that the security or 

confidentiality of information in the 

system of records has been 

compromised; (2) the FTC has 

determined that as a result of the 

suspected or confirmed compromise 

there is a risk of harm to economic or 

property interests, identity theft or 

fraud, or harm to the security or 

integrity of this system or other systems 

or programs (whether maintained by the 

FTC or another agency or entity) that 

rely upon the compromised 

information; and (3) the disclosure 

made to such agencies, entities, and 

persons is reasonably necessary to assist 

in connection with the FTC’s efforts to 

respond to the suspected or confirmed 

compromise and prevent, minimize, or 

remedy such harm. 

By direction of the Commission. 

Donald S. Clark 

Secretary 

[FR Doc. E7–11122 Filed 6–7–07: 8:45 am] 

[BILLING CODE 6750–01–S] 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

National Committee on Vital and Health 

Statistics: Meeting 

Pursuant to the Federal Advisory 

Committee Act, the Department of 

Health and Human Services (HHS) 

announces the following advisory 

committee meeting. 

Name: National Committee on Vital and 

Health Statistics (NCVHS). 

Time and Date: June 20, 2007: 9 a.m.–3:15 

p.m.; June 21, 2007: 9 a.m.–3 p.m. 

Place: Natcher Center, Building 45, 

National Institutes of Health, Bethesda 

Campus, Bethesda, MD. 

Status: Open. 

Purpose: At this meeting the Committee 

will hear presentations and hold discussions 

on several health data policy topics. On the 

morning and afternoon of the first day the 

Committee will hear updates and status 

reports from its subcommittees as well as a 

briefing on the 5010 transaction data set. 

On the morning of the second day the 

Committee will first hear updates from the 

Department on activities of the Data Council 

and the Office of the National Coordinator for 

Health Information Technology (ONCHIT) 

followed by Committee actions on selected 

topics from the subcommittees. The next 

item will be a briefing on the International 

Health Terminology Standards Development 

Organization (IHTSDO.) This briefly will be 

followed by a discussion of secondary uses 

of electronic medical record information 

which will continue after the noon break. 

There will be a short discussion of future 

agendas before the meeting adjourns. 

The times shown above are for the full 

Committee meeting. Subcommittee breakout 

sessions are scheduled for late in the 

afternoon of the first day and in the morning 

prior to the full Committee meeting on the 

second day. Agendas for these breakout 

sessions will be posted on the NCVHS Web 

site (URL below) when available. 

Contact Person for More Information: 

Substantive program information as well as 

summaries of meetings and a roster of 

committee members may be obtained from 

Marjorie S. Greenberg, Executive Secretary, 

NCVHS, National Center for Health Statistics, 

Centers for Disease Control and Prevention, 

3311 Toledo Road, Room 2402, Hyattsville, 

Maryland 20782, telephone (301) 458–4245. 

Information also is available on the NCVHS 

home page of the HHS Web site: http:// 

www.ncvhs.hhs.gov/, where further 

information including an agenda will be 

posted when available. 

Should you require reasonable 

accommodation, please contact the CDC 

Office of Equal Employment Opportunity on 

(301) 458–4EEO (4336) as soon as possible. 

Dated: May 31, 2007. 

James Scanlon, 

Deputy Assistant Secretary for Planning and 

Evaluation (SDP), Office of the Assistant 

Secretary for Planning and Evaluation. 

[FR Doc. 07–2861 Filed 6–7–07; 8:45 am] 

BILLING CODE 4151–05–M 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Administration on Aging 

Agency Information Collection 

Activities; Proposed Collection; 

Comment Request; Fourth National 

Study of Older Americans Act 

Recipients 

AGENCY: Administration on Aging, HHS. 


pwalker on PROD1PC71 with NOTICES