10792 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Notices 

requirements in the Alternative Fuels 

Rule (‘‘Rule’’). That clearance expires on 

March 30, 2022. 

DATES: Comments must be submitted by 

March 28, 2022. 

ADDRESSES: Written comments and 

recommendations for the proposed 

information collection should be sent 

within 30 days of publication of this 

notice to www.reginfo.gov/public/do/ 

PRAMain. Find this particular 

information collection by selecting 

‘‘Currently under Review—Open for 

Public Comments’’ or by using the 

search function. 

FOR FURTHER INFORMATION CONTACT: 

Hampton Newsome, Attorney, (202) 

326–2889, Division of Enforcement, 

Bureau of Consumer Protection, Federal 

Trade Commission, 600 Pennsylvania 

Avenue NW, Washington, DC 20580. 

SUPPLEMENTARY INFORMATION: 

Title: Labeling Requirements for 

Alternative Fuels and Alternative 

Fueled Vehicles (‘‘Alternative Fuels 

Rule’’), 16 CFR part 309. 

OMB Control Number: 3084–0094. 

Type of Review: Extension without 

change of currently approved collection. 

Affected Public: Private Sector: 

Businesses and other for-profit entities. 

Estimated Annual Burden Hours: 

6,000 hours. 

Estimated Annual Labor Costs: 

$175,298. 

Estimated Non-Labor Costs: $3,040. 

Abstract: The Energy Policy Act of 

1992 established federal programs to 

encourage the development of 

alternative fuels and alternative fueled 

vehicles (‘‘AFVs’’). Section 406(a) of the 

Act directed the Commission to 

establish uniform labeling requirements 

for alternative fuels and AFVs. 42 U.S.C. 

13232(a). Such labels must provide 

‘‘appropriate information with respect 

to costs and benefits [of alternative fuels 

and AFVs], so as to reasonably enable 

the consumer to make choices and 

comparisons.’’ The required labels must 

be ‘‘simple and, where appropriate, 

consolidated with other labels providing 

information to the consumer.’’ 

Pursuant to the Act, the Commission 

published the Alternative Fuels Rule in 

1995, and the Rule was later amended 

in 2013. The Rule requires disclosure of 

specific information on labels posted on 

fuel dispensers for non-liquid 

alternative fuels. To ensure the accuracy 

of these disclosures, the Rule also 

requires that sellers maintain records 

substantiating product-specific 

disclosures they include on these labels. 

In addition, the Rule requires that 

distributors of non-liquid alternative 

vehicle fuel provide certifications of the 

fuel rating in each transfer to anyone 

who is not a consumer. 

Request for Comment: On October 6, 

2021, the Commission sought comment 

on the information collection 

requirements associated with the 

Privacy Rule. 86 FR 55607 (Oct. 6, 

2021). No relevant comments were 

received. Pursuant to the OMB 

regulations, 5 CFR part 1320, the FTC is 

providing this second opportunity for 

public comment while seeking OMB 

approval to renew clearance for the 

Rule’s information collection 

requirements. 

Your comment—including your name 

and your state—will be placed on the 

public record of this proceeding. 

Because your comment will be made 

public, you are solely responsible for 

making sure that your comment does 

not include any sensitive personal 

information, like anyone’s Social 

Security number, date of birth, driver’s 

license number or other state 

identification number or foreign country 

equivalent, passport number, financial 

account number, or credit or debit card 

number. You are also solely responsible 

for making sure that your comment does 

not include any sensitive health 

information, like medical records or 

other individually identifiable health 

information. In addition, do not include 

any ‘‘[t]rade secret or any commercial or 

financial information which is . . . 

privileged or confidential’’ as provided 

in Section 6(f) of the FTC Act 15 U.S.C. 

46(f), and FTC Rule 4.10(a)(2), 16 CFR 

4.10(a)(2). In particular, do not include 

competitively sensitive information 

such as costs, sales statistics, 

inventories, formulas, patterns devices, 

manufacturing processes, or customer 

names. 

Josephine Liu, 

Assistant General Counsel for Legal Counsel. 

[FR Doc. 2022–03956 Filed 2–24–22; 8:45 am] 

BILLING CODE 6750–01–P 

FEDERAL TRADE COMMISSION 

Agency Information Collection 

Activities; Proposed Collection; 

Comment Request; Extension 

AGENCY: Federal Trade Commission. 

ACTION: Notice. 

SUMMARY: In accordance with the 

Paperwork Reduction Act of 1995 

(PRA), the Federal Trade Commission 

(FTC or Commission) is seeking public 

comment on its proposal to extend for 

an additional three years the Office of 

Management and Budget (OMB) 

clearance for information collection 

requirements contained in the rules and 

regulations under the Health Breach 

Notification Rule (or Rule). That 

clearance expires on June 30, 2022. 

DATES: Comments must be received on 

or before April 26, 2022. 

ADDRESSES: Interested parties may file a 

comment online or on paper by 

following the instructions in the 

Request for Comments part of the 

SUPPLEMENTARY INFORMATION section 

below. Write ‘‘Health Breach 

Notification Rule; PRA Comment: FTC 

File No. P072108’’ on your comment, 

and file your comment online at https:// 

www.regulations.gov by following the 

instructions on the web-based form. If 

you prefer to file your comment on 

paper, mail your comment to the 

following address: Federal Trade 

Commission, Office of the Secretary, 

600 Pennsylvania Avenue NW, Suite 

CC–5610 (Annex J), Washington, DC 

20580, or deliver your comment to the 

following address: Federal Trade 

Commission, Office of the Secretary, 

Constitution Center, 400 7th Street SW, 

5th Floor, Suite 5610 (Annex J), 

Washington, DC 20024. 

FOR FURTHER INFORMATION CONTACT: 

Ryan Mehm, Attorney, Bureau of 

Consumer Protection, (202) 326–2918, 

Federal Trade Commission, 600 

Pennsylvania Ave. NW, Washington, DC 

20580. 

SUPPLEMENTARY INFORMATION: 

Title: Health Breach Notification Rule. 

OMB Control Number: 3084–0150. 

Type of Review: Extension of a 

currently approved collection. 

Abstract: The Health Breach 

Notification Rule (Rule), 16 CFR part 

318, requires vendors of personal health 

records (PHR) and PHR related entities 

to provide notice to: (1) Consumers 

whose unsecured personally identifiable 

health information has been reached; (2) 

the Commission; and (3) in some cases, 

the media. The Rule only applies to 

electronic health records and does not 

include recordkeeping requirements. 

The Rule requires third party service 

providers (e.g., those companies that 

provide services such as billing or data 

storage) to vendors of personal health 

records and PHR related entities to 

provide notification to such vendors 

and PHR related entities following the 

discovery of a breach. To notify the FTC 

of a breach, the Commission developed 

a simple, two-page form, which is 

posted at https://www.ftc.gov/system/ 

files/documents/rules/health-breachnotification-rule/health_breach_

form.pdf 

Likely Respondents: Vendors of 

personal health records, PHR related 

entities and third party service 

providers. 


lotter on DSK11XQN23PROD with NOTICES1
Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Notices 10793 

1On September 15, 2021, the Commission, in 

light of changes in the marketplace, issued a Policy 

Statement that clarified that the Rule applies to 

most health apps and similar technologies that are 

not covered by the Health Insurance Portability and 

Accountability Act (‘‘HIPAA’’). Statement of the 

Commission on Breaches by Health Apps and Other 

Connected Devices, Fed. Trade Comm’n (Sept. 15, 

2021), available at: https://www.ftc.gov/system/ 

files/documents/public_statements/1596364/ 

statement_of_the_commission_on_breaches_by_

health_apps_and_other_connected_devices.pdf 

(‘‘Policy Statement’’). 

Estimated Annual Hours Burden: 

4,654. 

Estimated Frequency: 2,500 singleperson breaches per year and 0.33 major 

breaches per year. 

Total Annual Labor Cost: $90,741. 

Total Annual Capital or Other NonLabor Cost: $31,056. 

As required by section 3506(c)(2)(A) 

of the PRA, 44 U.S.C. 3506(c)(2)(A), the 

FTC is providing this opportunity for 

public comment before requesting that 

OMB extend the existing clearance for 

the information collection requirements 

contained in the Commission’s Health 

Breach Notification Rule. 

Burden Estimates 

Brief Description of the Need for and 

Proposed Use of the Information 

The Health Breach Notification Rule 

(Rule), 16 CFR part 318 (OMB Control 

Number 3084–0150), requires vendors 

of personal health records and PHR 

related entities to provide notice to: (1) 

Consumers whose unsecured personally 

identifiable health information has been 

breached; (2) the Commission; and (3) in 

some cases, the media.1 Under the Rule, 

consumers whose unsecured, 

individually identifiable health 

information has been breached must 

receive notice ‘‘without unreasonable 

delay and in no case later than 60 

calendar days’’ after discovery of the 

breach. Among other information, the 

notices must provide consumers with 

steps they can take to protect 

themselves from potential harm 

resulting from the breach. To notify the 

FTC of a breach, the Commission 

developed a simple, two-page form, 

which is posted at https://www.ftc.gov/ 

system/files/documents/rules/healthbreach-notification-rule/health_breach_

form.pdf. For breaches involving the 

health information of 500 or more 

individuals, entities must notify the 

Commission as soon as possible, and in 

any event no later than ten business 

days after discovering the breach. 

Entities may report all breaches 

involving the information of fewer than 

500 individuals in an annual 

submission covering the prior calendar 

year. The Commission uses entities’ 

notifications to compile a list of 

breaches affecting 500 or more 

individuals that is publicly available on 

the FTC’s website. The list provides 

businesses with information about 

potential sources of data breaches, 

which is helpful to those developing 

data security procedures. It also 

provides the public with information 

about the extent of data breaches. 

The Rule also requires third party 

service providers (e.g., those companies 

that provide services such as billing or 

data storage) to vendors of personal 

health records and PHR related entities 

to provide notification to such vendors 

and PHR related entities following the 

discovery of a breach. 

The Rule only applies to electronic 

health records and does not include 

recordkeeping requirements. 

As required by section 3506(c)(2)(A) 

of the PRA, 44 U.S.C. 3506(c)(2)(A), the 

FTC is providing this opportunity for 

public comment before requesting that 

OMB extend the existing clearance for 

the information collection requirements 

contained in the Rule. 

Burden Estimates 

The PRA burden of the Rule’s 

requirements depends on a variety of 

factors, including the number of covered 

firms; the percentage of such firms that 

will experience a breach requiring 

further investigation and, if necessary, 

the sending of breach notices; and the 

number of consumers notified. The 

annual hours and cost estimates below 

likely overstate the burden because, 

among other things, they assume, 

though it is not necessarily so, that all 

covered firms experiencing breaches 

subject to the Rule’s notification 

requirements will be required to take all 

of the steps described below. 

The analysis may also overstate the 

burden of the Rule’s requirements 

because it assumes that covered firms 

would not take any of the steps 

described were it not for the 

requirements of the Rule. For example, 

the analysis incorporates labor costs 

associated with understanding what 

information has been breached. It seems 

likely that some firms would incur such 

costs even in the absence of the Rule’s 

requirements because the firms are 

independently interested in identifying, 

understanding, and remediating security 

risks. A company that investigates, for 

its own purposes, what information has 

been breached is unlikely to fully 

duplicate the costs of that investigation 

in complying with the Rule. Therefore, 

it may not be correct in all cases that 

complying with the Rule results in 

added labor costs for this activity. 

Nevertheless, in order to allow for a 

complete understanding of all the 

potential costs associated with 

compliance, these costs are included in 

this analysis. 

At the time the Rule was issued in 

2009, insufficient data was available 

about the incidence of breaches in the 

PHR industry. Accordingly, staff based 

its burden estimate on data pertaining to 

private sector breaches across multiple 

industries. Staff estimated that there 

would be 11 breaches per year requiring 

notification of 232,000 consumers. In 

2016, based on available data from the 

years 2010 through 2014, staff arrived at 

new estimates, projecting an average of 

two breaches per year affecting a total of 

40,000 individual consumers. 

The Rule has now been in effect for 

over ten years, and new data regarding 

the number and scale of reported 

breaches from 2017 through 2021 allow 

staff to update its burden estimates. A 

review of the breach reports received by 

the FTC from 2010 through 2021 reveals 

that there are two primary categories of 

breaches reported: (1) ‘‘single-person 

breaches,’’ incidents in which a single 

individual’s information is potentially 

compromised; and (2) what are hereafter 

described as ‘‘major breaches,’’ in which 

multiple—and typically, many— 

individuals are affected. These two 

categories of breaches are addressed 

separately in this analysis because the 

frequency and costs of the categories 

differ significantly. 

Nearly all of the submissions received 

between 2010 and 2021—over 99% of 

them—reported single-person breaches 

related to an individual’s loss of control 

over his or her login credentials. The 

rate of such breaches has fluctuated 

significantly since the Rule went into 

effect. Whereas from 2011 to 2014 the 

average annual number of single-person 

breaches was 7,502, from 2014 to 2017 

the average was almost 15,000. From 

2018 to 2021, the rate dropped 

significantly to 2,500. Assuming that 

this rate continues, staff estimates that 

between 2022 and 2025 the agency will 

receive, on average, about 2,500 singleperson breach reports per year. 

By contrast, major breach reports are 

quite infrequent. On average, the FTC 

receives one major breach report 

approximately every two and a half 

years, with an average of approximately 

200,000 persons affected. Given the low 

frequency at which major breaches 

occur, FTC staff are unable to identify 

any meaningful trends in the frequency 

of major breach reports. FTC staff has 

not identified any existing research 

allowing us to make specific projections 

about future variation in the frequency 

of major breaches. Consequently, FTC 

staff has assumed that the average 

frequency and scale of major breaches 


lotter on DSK11XQN23PROD with NOTICES1
10794 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Notices 

2Hourly wages throughout this document are 

based on mean hourly wages found at http:// 

www.bls.gov/news.release/ocwage.htm 

(‘‘Occupational Employment and Wages—May 

2020,’’ U.S. Department of Labor, released March 

2021, Table 1 (‘‘National employment and wage 

data from the Occupational Employment Statistics 

survey by occupation, May 2020’’). 

The breakdown of labor hours and costs is as 

follows: 50 hours of computer and information 

systems managerial time at approximately $78 per 

hour; 12 hours of marketing manager time at $74 

per hour; 33 hours of computer programmer time 

at $46 per hour; and 5 hours of legal staff time at 

$72 per hour. 

3The cost of telephone operators is estimated at 

$19/hour. 

will remain more or less static. Staff’s 

calculations are based on the estimate 

that a major breach will occur 

approximately every two and a half 

years and that 200,000 people will be 

affected by each major breach, for an 

annual average of 80,000 individuals 

affected per year. 

Estimated Annual Burden Hours: 

4,654. 

As explained in more detail within 

the next section, FTC staff projects that 

the employee time required for each 

single-person breach is quite minimal 

because the processes for notifying 

consumers are largely automated and 

single-person breaches can be reported 

to the FTC in an aggregate annual 

notification using the FTC’s two-page 

form. On average, staff estimates that 

covered firms will require 

approximately 20 seconds of employee 

labor per single-person breach. With an 

estimated 2,500 single-person breaches 

per year, the total estimated burden 

hours for single-person breaches is 

approximately 14 hours. 

For each major breach, covered firms 

will require on average 100 hours of 

employee labor to determine what 

information has been breached, identify 

affected customers, prepare the breach 

notice, and submit the required report to 

the Commission. Based on staff’s 

estimate that one major breach occurs 

every two and a half years, the average 

annual burden of major breaches 

amounts to 40 hours per year. 

Additionally, covered firms will incur 

labor costs associated with processing 

calls they may receive in the event of a 

major breach. The Rule requires that 

covered firms that fail to contact 10 or 

more consumers because of insufficient 

or out-of-date contact information must 

provide substitute notice through either 

a clear and conspicuous posting on their 

website or media notice. Such substitute 

notice must include a toll-free number 

for the purpose of allowing a consumer 

to learn whether or not his/her 

information was affected by the breach. 

Individuals contacted directly will 

have already received this information. 

Staff estimates that no more than 10 

percent of affected consumers will 

utilize the offered toll-free number. 

Thus, of the 200,000 consumers affected 

by a major breach, staff estimates that 

20,000 may call the companies over the 

90 days they are required to provide 

such access. Staff additionally projects 

that 10,000 additional consumers who 

are not affected by the breach will also 

call the companies during this period. 

Staff estimates that processing all 30,000 

calls will require an average of 11,500 

hours of employee labor resulting in an 

average annual burden of 4,600 labor 

hours. Given the low frequency of major 

breaches, the annual average 

requirement for major breaches is 4,640 

hours. 

The combined annual hours burden 

for both single-person and major 

breaches therefore is 4,654 (4,640 + 14). 

Estimated Annual Labor Costs: 

$90,741. 

For each single-person breach, FTC 

staff estimates that the average 20 

seconds of employee labor to provide 

(likely automated) notification to 

affected individuals and produce an 

annual breach notification for 

submission to the FTC will cost 

approximately $0.27 per breach. With 

an estimated 2,500 single-person 

breaches per year, the annual labor costs 

associated with all single-person 

breaches come to $675. 

For major breaches, FTC staff projects 

that the average 100 hours of employee 

labor costs (excluding outside forensic 

services, discussed below as estimated 

non-labor costs) to determine what 

information has been breached, identify 

the affected customers, prepare the 

breach notice, and report to the 

Commission will cost an average of 

$66.66 per hour for a total of $6,666.2

Based on an estimated one breach every 

two and a half years, the annual 

employee labor cost burden for affected 

entities to perform these tasks is $2,666. 

Additionally, staff expects covered 

firms will require, for each major 

breach, 11,500 hours of labor associated 

with answering consumer telephone 

calls at a cost of $218,500.3 Since a 

major breach occurs approximately 

every two and a half years, the average 

annual burden of 4,600 labor hours 

results in annualized labor cost of 

approximately $87,400. 

Accordingly, estimated cumulative 

annual labor costs, excluding outside 

forensic services, for both single-person 

and major breaches, is $90,741 ($87,400 

+ $2,666 + $675). 

Estimated Annual Capital and Other 

Non-Labor Costs: $31,056. 

Commission staff estimates that 

capital and other non-labor costs 

associated with single-person breaches 

will be negligible. Companies generally 

use automated notification systems to 

notify consumers of single-person 

breaches. Automated notifications are 

typically delivered by email or other 

electronic methods. The costs of 

providing such electronic notifications 

are minimal. 

Commission staff anticipates that 

capital and other non-labor costs 

associated with major breaches will 

consist of the following: 

1. Services of a forensic expert in 

investigating the breach; 

2. notification of consumers via email, 

mail, web posting, or media; and 

3. the cost of setting up a toll-free 

number, if needed. 

Staff estimates that, for each major 

breach, covered firms will require 240 

hours of a forensic expert’s time, at a 

cumulative cost of $37,440 for each 

breach. This estimate is based on a 

projection that an average major breach 

will affect approximately 20 machines 

and that a forensic analyst will require 

about 12 hours per machine to conduct 

his or her analysis. The projected cost 

of retaining the forensic analyst consists 

of the hourly wages of an information 

security analyst ($52), tripled to reflect 

profits and overhead for an outside 

consultant ($156), and multiplied by 

240 hours. Based on the estimate that 

there will be one major breach every 

two and a half years, the annual cost 

associated with the services of an 

outside forensic expert is $14,976. 

As explained above, staff estimates 

that an average of 200,000 consumers 

will be entitled to notification of each 

major breach. Given the online 

relationship between consumers and 

vendors of personal health records and 

PHR related entities, most notifications 

will be made by email and the cost of 

such notifications will be minimal. 

In some cases, however, vendors of 

personal health records and PHR related 

entities will need to notify individuals 

by postal mail, either because these 

individuals have asked for such 

notification, or because the email 

addresses of these individuals are not 

current or not working. Staff estimates 

that the cost of a mailed notice is $0.11 

for the paper and envelope, and $0.58 

for a first class stamp. Assuming that 

vendors of personal health records and 

PHR related entities will need to notify 

by postal mail 10 percent of the 200,000 

customers whose information is 

breached, the estimated cost of this 

notification will be $13,800 per breach. 

The annual cost will be around $5,520. 

In addition, vendors of personal 

health records and PHR related entities 

may need to notify consumers by 


lotter on DSK11XQN23PROD with NOTICES1
Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Notices 10795 

posting a message on their home page, 

or by providing media notice. Staff 

estimates the cost of providing notice 

via website posting to be $0.08 per 

breached record, and the cost of 

providing notice via published media to 

be $0.04 per breached record. Applied 

to the above-stated estimate of 200,000 

affected consumers, the estimated total 

cost of website notice will be $16,000, 

and the estimated total cost of media 

notice will be $8,000, yielding an 

estimated total per-breach cost for both 

forms of notice to consumers of $24,000. 

Annualized, this number is 

approximately $9,600 per year. 

Finally, staff estimates that the cost of 

providing a toll-free number will 

depend on the costs associated with T1 

lines sufficient to handle the projected 

call volume and the cost of obtaining a 

toll-free telephone number. Based on 

industry research, staff projects that 

affected entities may need two T1 lines 

at a cost of $1,800 for the 90-day period. 

In addition, staff estimates the cost of 

obtaining a dedicated toll-free line to be 

$100 per month. Accordingly, staff 

projects that the cost of obtaining two 

toll-free lines for 90 days will be $2,400. 

The total annualized cost for providing 

a toll-free number will be $960. 

In sum, the total annual estimate for 

non-labor costs associated with major 

breaches is $31,056: $14,976 (services of 

a forensic expert) + $5,520 (cost of mail 

notifications) + $9,600 (cost of website 

and media notice) + $960 (cost of 

providing a toll-free number). Negligible 

non-labor costs are associated with 

single-person breaches. 

The total estimated PRA annual cost 

burden is $90,741 for labor costs and 

$31,056 for non-labor costs, totaling 

approximately $121,797. 

Request for Comments 

Pursuant to Section 3506(c)(2)(A) of 

the PRA, the FTC invites comments on: 

(1) Whether the proposed collection of 

information is necessary for the proper 

performance of the functions of the 

agency, including whether the 

information will have practical utility; 

(2) the accuracy of the agency’s estimate 

of the burden of the proposed collection 

of information, including the validity of 

the methodology and assumptions used; 

(3) ways to enhance the quality, utility, 

and clarity of the information to be 

collected; and (4) ways to minimize the 

burden of maintaining records and 

providing disclosures to consumers. All 

comments must be received on or before 

April 26, 2022. 

You can file a comment online or on 

paper. For the FTC to consider your 

comment, we must receive it on or 

before April 26, 2022. Write ‘‘Health 

Breach Notification Rule; PRA 

Comment: FTC File No. P072108’’ on 

your comment. Your comment— 

including your name and your state— 

will be placed on the public record of 

this proceeding, including the https://

www.regulations.gov website. 

Due to the public health emergency in 

response to the COVID–19 outbreak and 

the agency’s heightened security 

screening, postal mail addressed to the 

Commission will be subject to delay. We 

encourage you to submit your comments 

online through the https://

www.regulations.gov website. 

If you prefer to file your comment on 

paper, write ‘‘Health Breach Notification 

Rule; PRA Comment: FTC File No. 

P072108’’ on your comment and on the 

envelope, and mail your comment to the 

following address: Federal Trade 

Commission, Office of the Secretary, 

600 Pennsylvania Avenue NW, Suite 

CC–5610 (Annex J), Washington, DC 

20580; or deliver your comment to the 

following address: Federal Trade 

Commission, Office of the Secretary, 

Constitution Center, 400 7th Street SW, 

5th Floor, Suite 5610 (Annex J), 

Washington, DC 20024. If possible, 

submit your paper comment to the 

Commission by courier or overnight 

service. 

Because your comment will become 

publicly available at https://

www.regulations.gov, you are solely 

responsible for making sure that your 

comment does not include any sensitive 

or confidential information. In 

particular, your comment should not 

include any sensitive personal 

information, such as your or anyone 

else’s Social Security number; date of 

birth; driver’s license number or other 

state identification number, or foreign 

country equivalent; passport number; 

financial account number; or credit or 

debit card number. You are also solely 

responsible for making sure that your 

comment does not include any sensitive 

health information, such as medical 

records or other individually 

identifiable health information. In 

addition, your comment should not 

include any ‘‘trade secret or any 

commercial or financial information 

which . . . . is privileged or 

confidential’’—as provided by Section 

6(f) of the FTC Act, 15 U.S.C. 46(f), and 

FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2)— 

including in particular competitively 

sensitive information such as costs, 

sales statistics, inventories, formulas, 

patterns, devices, manufacturing 

processes, or customer names. 

Comments containing material for 

which confidential treatment is 

requested must be filed in paper form, 

must be clearly labeled ‘‘Confidential,’’ 

and must comply with FTC Rule 4.9(c). 

In particular, the written request for 

confidential treatment that accompanies 

the comment must include the factual 

and legal basis for the request, and must 

identify the specific portions of the 

comment to be withheld from the public 

record. See FTC Rule 4.9(c). Your 

comment will be kept confidential only 

if the General Counsel grants your 

request in accordance with the law and 

the public interest. Once your comment 

has been posted publicly at 

www.regulations.gov, we cannot redact 

or remove your comment unless you 

submit a confidentiality request that 

meets the requirements for such 

treatment under FTC Rule 4.9(c), and 

the General Counsel grants that request. 

The FTC Act and other laws that the 

Commission administers permit the 

collection of public comments to 

consider and use in this proceeding, as 

appropriate. The Commission will 

consider all timely and responsive 

public comments that it receives on or 

before April 26, 2022. For information 

on the Commission’s privacy policy, 

including routine uses permitted by the 

Privacy Act, see https://www.ftc.gov/ 

site-information/privacy-policy. 

Josephine Liu, 

Assistant General Counsel for Legal Counsel. 

[FR Doc. 2022–03958 Filed 2–24–22; 8:45 am] 

BILLING CODE 6750–01–P 

GENERAL SERVICES 

ADMINISTRATION 

[OMB Control No. 3090–0112; Docket No. 

2021–0001; Sequence No. 13] 

Submission for OMB Review; Federal 

Management Regulation; State Agency 

Monthly Donation Report of Surplus 

Property, GSA Form 3040 

AGENCY: Federal Acquisition Service, 

General Services Administration (GSA). 

ACTION: Notice of request for public 

comments regarding a renewal to an 

existing OMB clearance. 

SUMMARY: Under the provisions of the 

Paperwork Reduction Act, the 

Regulatory Secretariat Division will be 

submitting to the Office of Management 

and Budget (OMB) a request to review 

and approve an extension of a 

previously approved information 

collection requirement regarding State 

Agency Monthly Donation Report of 

Surplus Property, GSA Form 3040. 

DATES: Submit comments on or before 

March 28, 2022. 

ADDRESSES: Written comments and 

recommendations for this information 


lotter on DSK11XQN23PROD with NOTICES1