This section of the FEDERAL REGISTER

contains notices to the public of the proposed

issuance of rules and regulations. The

purpose of these notices is to give interested

persons an opportunity to participate in the

rule making prior to the adoption of the final

rules.

Proposed Rules Federal Register

2642 

Vol. 90, No. 7 

Monday, January 13, 2025 

1See Public Law 93–579, 88 Stat. 1896, as 

amended; see also 5 U.S.C. 552a. 

2See 5 U.S.C. 552a(a)(2). 

3 6 U.S.C. 142 and DHS Del. No. 13001, Rev. 01 

(June 2, 2020). 

4Public Law 115–59, 131 Stat. 1152 (2017); 

codified at 42 U.S.C. 405 note. 

5 Id. 

6 Id. 

7 DHS, Directive 047–01–010: Social Security 

Number Collection and Use Reduction (June 18, 

2019), https://www.dhs.gov/sites/default/files/ 

publications/047-01-010_ssn_collection_final_06- 

17-2019.pdf. 

8 Id. 

9 87 FR 68599 (Nov. 16, 2022). 

10See id. 

11See Public Law 115–59, 131 Stat. 1152 (2017); 

codified at 42 U.S.C. 405 note. 

DEPARTMENT OF HOMELAND 

SECURITY 

Office of the Secretary 

6 CFR Part 5 

[Docket No. DHS–2025–0002] 

RIN 1601–AB04 

Privacy Act of 1974; Implementation 

AGENCY: Office of the Secretary, 

Department of Homeland Security. 

ACTION: Notice of proposed rulemaking. 

SUMMARY: The Department of Homeland 

Security (DHS or Department) is 

proposing to amend its regulations 

under the Privacy Act of 1974 consistent 

with the Social Security Number Fraud 

Prevention Act of 2017. In addition, 

DHS is proposing to amend the rules 

regarding including a Social Security 

number on physical mail only when 

necessary to further define ‘‘necessary’’ 

and provide instructions on redaction of 

social security numbers when feasible. 

DATES: Comments must be received by 

February 12, 2025. 

ADDRESSES: You may submit comments, 

identified by docket number DHS– 

2025–0002 through the Federal eRulemaking Portal: https://

www.regulations.gov. Follow the 

instructions for submitting comments. 

Instructions: All submissions received 

must include the agency name and 

docket number for this notice. All 

comments received may be posted 

without change to https://

www.regulations.gov, including any 

personal information provided. 

Docket: For access to the docket to 

read background documents or 

comments received, go to https://

www.regulations.gov. 

FOR FURTHER INFORMATION CONTACT: 

Deborah Fleischaker, Acting Chief 

Privacy Officer, Privacy Office, 

Department of Homeland Security, 

Washington, DC 20528, (202) 343–1717, 

Privacy@hq.dhs.gov. 

SUPPLEMENTARY INFORMATION: 

I. Background 

The Privacy Act of 1974, as amended, 

(‘‘Privacy Act’’), serves to safeguard 

public interest in informational privacy 

by delineating the duties and 

responsibilities of Federal agencies that 

collect, store, and disseminate personal 

information about individuals.1 The 

Privacy Act defines an individual to 

encompass U.S. citizens and lawful 

permanent residents.2

The Secretary of Homeland Security 

(‘‘Secretary’’) has authority under 5 

U.S.C. 301, 552, 552a, and 6 U.S.C. 

112(e) to issue Privacy Act regulations. 

The Secretary has delegated that 

authority to the Chief Privacy Officer of 

the Department.3

In 2017, Congress enacted the Social 

Security Number Fraud Prevention Act 

of 2017 (‘‘SSN Fraud Prevention Act’’).4

This law restricts agencies from 

including the Social Security number 

(‘‘SSN’’) of an individual on any 

document sent by mail unless the 

agency head determines inclusion is 

necessary.5 It requires DHS to 

promulgate rules that will: (1) specify 

the circumstances under which 

inclusion of an SSN on a document sent 

by mail is necessary; (2) instruct 

components on the partial redaction of 

SSNs where feasible; and (3) require 

that SSNs not be visible on the outside 

of any package sent by mail.6 DHS 

issued a privacy policy in 2019 that 

required all new and legacy DHS 

Information Technology systems, 

programs, and forms to use a unique 

alternative identifier to SSNs, which 

minimized the use of SSN in 

documents.7 The policy provides that if 

there are technological, legal, or 

regulatory limitations to eliminating the 

use of SSNs, then privacy-enhancing 

SSN alternatives must be utilized, such 

as masking, redacting, or truncating 

SSNs in digital and hard copy formats.8

In 2022, DHS published a final rule 

updating its procedures implementing 

the Privacy Act, 5 U.S.C. 552a., at 6 CFR 

part 5, subpart B.9 The rule, among 

other things, amended 6 CFR 5.33(c) to 

state that DHS cannot include 

individuals’ SSNs on any document 

sent by mail unless the Secretary 

determines inclusion of the number on 

the document is necessary.10 This 

partially met the requirements of the 

SSN Fraud Prevention Act. 

DHS now proposes to further amend 

6 CFR 5.33(c) to define the 

circumstances when it would be 

necessary to include the SSN on a 

document. This change would fully 

comply with the requirements of the 

SSN Fraud Prevention Act and the 2019 

DHS privacy policy. In general, DHS 

proposes to specify that DHS may only 

include an SSN on a document sent by 

mail when necessary, in other words 

when a DHS component would be 

unable to comply, in whole or in part, 

with a legal, regulatory, or policy 

requirement if prohibited from mailing 

the full SSN. 

II. Discussion of Proposed Changes 

This rule proposes amendments to the 

DHS regulations on the use and 

collection of SSN to meet the 

requirements of the SSN Fraud 

Prevention Act.11 As stated above, DHS 

previously amended 6 CFR 5.33(c) 

consistent with some requirements in 

the SSN Fraud Prevention Act. DHS 

proposes to further amend 6 CFR 5.33(c) 

to codify additional requirements as 

mandated by the SSN Fraud Prevention 

Act and the 2019 DHS privacy policy. 

Specifically, DHS proposes to specify 

that DHS will not generally include an 

individual’s full SSN on a document 

sent by mail and will only do so if the 

Secretary or the Secretary’s designee 

determines that the SSN’s inclusion is 

necessary. As stated previously, the 

proposed rule would explain that the 

inclusion of an SSN would only be 

necessary in those circumstances in 

which a component would be unable to 

comply, in whole or in part, with a 

legal, regulatory, or policy requirement 

if prohibited from mailing the full SSN. 

On the other hand, the proposed rule 

would explain that including a full SSN 


ddrumheller on DSK120RN23PROD with PROPOSALS1
Federal Register / Vol. 90, No. 7 / Monday, January 13, 2025 / Proposed Rules 2643 

12Consistent with the language of the Social 

Security Number Fraud Prevention Act, which 

discusses ‘‘documents sent by mail’’, the proposed 

rule would be limited to physical mail sent by DHS. 

Accordingly, the rule proposes to clarify that 

physical mail includes printed document or 

correspondence but does not include emails or 

other documents, correspondence, or 

communications transmitted by electronic means 

(e.g., via web portals). 

13See OMB Circular A–4, p. 11 (Nov. 9, 2023) 

(accessible at https://www.whitehouse.gov/wpcontent/uploads/2023/11/CircularA-4.pdf). 

14 DHS, Social Security Number Fraud Prevention 

Act Final Report to Congress, 5 (June 2023), https:// 

www.dhs.gov/sites/default/files/2023-07/SSN%20

Fraud%20Prevention%20Act%20Final%20Report

%20%282%29.pdf. 

15 Id. 

16 Id. 

is not necessary if the DHS component 

can either redact the SSN, such as by 

using no more than the last four digits 

of the account number, or entirely strike 

the SSN and still comply with all 

relevant legal, regulatory, or policy 

requirements. 

However, if the use of the full SSN on 

a document sent by mail 12 is necessary, 

the DHS component sending the 

document shall implement appropriate 

administrative, technical, and physical 

safeguards to ensure a reasonable level 

of security against unauthorized access 

to, and use, disclosure, disruption, 

modification, or destruction of, the 

documents sent by mail. Finally, this 

proposed rule would specify that in all 

cases the component will ensure that no 

part of an SSN is visible on the outside 

of any package or envelope sent by mail. 

Overall, this proposed rule would 

codify procedures in the regulations to 

ensure compliance with the SSN Fraud 

Prevention Act, but DHS does not 

expect it to have a significant impact on 

the current operations of the 

Department. As discussed further below 

in section III, DHS has already 

eliminated all DHS forms that contain 

SSN fields and are mailed through the 

United States Postal Service (‘‘USPS’’). 

However, should circumstances 

change such that a DHS component 

must include an individual’s full SSN 

on printed mail in order to comply with 

all of the component’s legal, regulatory, 

or policy obligations, then this proposed 

rule would provide a durable framework 

to ensure that the SSN is only used 

when it is truly necessary and that the 

component applies all possible and 

appropriate safeguards. 

III. Regulatory Analyses 

Executive Orders 12866, 14094, and 

13563—Regulatory Review 

Executive Order 12866 (Regulatory 

Planning and Review), as amended by 

Executive Order 14094 (Modernizing 

Regulatory Review) and 13563 

(Improving Regulation and Regulatory 

Review), directs agencies to assess the 

costs and benefits of available regulatory 

alternatives and, if regulation is 

necessary, to select regulatory 

approaches that maximize net benefits 

(including potential economic, 

environmental, public health and safety 

effects, distributive impacts, and 

equity). Executive Order 13563 

emphasizes the importance of 

quantifying costs and benefits, reducing 

costs, harmonizing rules, and promoting 

flexibility. The Office of Management 

and Budget (OMB) has not designated 

this proposed rule a significant 

regulatory action under section 3(f) of 

Executive Order 12866, as amended by 

Executive Order 14094. Accordingly, 

OMB has not reviewed this regulatory 

action. 

DHS has considered the costs and 

benefits of this proposed rule. The 

benefits and costs of a regulation are 

generally measured against a no-action 

baseline, which is a reasonable forecast 

of the way the world would look absent 

the regulatory action being assessed.13

This proposed rule would not introduce 

new regulatory mandates on the public. 

In compliance with the statutory 

requirements in the SSN Fraud 

Prevention Act, this proposed rule 

describes the circumstances in which 

DHS would include SSN on documents 

that DHS sends via mail. This proposed 

rule would also clarify that DHS 

Components and Headquarters Offices 

should undertake technical and 

physical safeguards when mailing 

documents with SSNs, or implement 

alternatives to full SSN, such as 

truncation, when feasible and legally 

permissible. 

DHS reported in its Social Security 

Number Fraud Prevention Act Final 

Report to Congress in June of 2023 that 

it successfully met the requirements of 

the Act in 2019 by eliminating all 69 

DHS forms that contained fields for 

SSNs and were mailed through the 

USPS.14 All DHS Components and 

Headquarters Offices confirmed that 

there remained no DHS-specific forms 

containing fields for SSNs that are 

mailed through the USPS.15

In addition, as noted above, DHS 

issued a privacy policy in 2019 that 

required all new and legacy DHS 

Information Technology systems, 

programs, and forms to use a unique 

alternative identifier to SSNs and that 

provides that components must utilize 

privacy-enhancing SSN alternatives if 

there are technological, legal, or 

regulatory limitations to eliminating the 

use of SSNs.16 If, in future 

circumstances, DHS determined there 

would be a need to include SSN in 

mailed documents, DHS components 

have already taken appropriate steps to 

implement safeguards for securing SSN 

in mailed documents in compliance 

with DHS-wide policy in effect since 

2019. Therefore, the proposed rule 

would provide clarification benefits but 

would not result in cost impacts to DHS 

or the public, because DHS has already 

eliminated SSNs in DHS forms that are 

mailed. Further, in the potential 

circumstance where DHS would mail 

documents with SSNs, since 2019, DHS 

implemented safeguards that would be 

required by this proposed rule. 

Unfunded Mandates Reform Act of 1995 

Title II of the Unfunded Mandates 

Reform Act of 1995 (UMRA), Public 

Law 104–4, establishes requirements for 

Federal agencies to assess the effects of 

their regulatory actions on State, local, 

and Tribal governments and the private 

sector. This proposed rule would not 

contain a Federal mandate that results 

in the expenditure by State, local, and 

Tribal governments, in the aggregate, or 

by the private sector, of $100,000,000 or 

more in any one year, and it would not 

significantly or uniquely affect small 

governments. Therefore, DHS deemed a 

written statement was not necessary 

under the provisions of the UMRA. 

Regulatory Flexibility Act 

Under the Regulatory Flexibility Act 

of 1980 (RFA), 5 U.S.C. 601–612, and 

section 213(a) of the Small Business 

Regulatory Enforcement Fairness Act of 

1996, 5 U.S.C. 601 note, agencies must 

consider the impact of their rulemakings 

on ‘‘small entities’’ (small businesses, 

small organizations, and local 

governments). The term ‘‘small entities’’ 

comprises small businesses, not-forprofit organizations that are 

independently owned and operated and 

are not dominant in their fields, and 

governmental jurisdictions with 

populations of less than 50,000. 

DHS certifies that this regulation 

would not have a significant economic 

impact on a substantial number of small 

entities. The factual basis for this 

certification is due to the requirements 

only applying to the Federal 

Government (DHS Components and 

Headquarter Offices). The proposed rule 

governs only the possible circumstances 

under which DHS would include SSNs 

in documents mailed by DHS. However, 

as previously discussed and reported to 

Congress, DHS has eliminated the SSN 

on all DHS forms. DHS does not believe 

small entities would have new 

compliance requirements or costs as a 

direct result of this proposed rule. 


ddrumheller on DSK120RN23PROD with PROPOSALS1
2644 Federal Register / Vol. 90, No. 7 / Monday, January 13, 2025 / Proposed Rules 

Paperwork Reduction Act 

This regulatory action would not 

impose a collection of information 

requirement subject to review and 

approval by OMB, as it does not include 

any reporting or recordkeeping 

requirements, under the Paperwork 

Reduction Act of 1995 (PRA) (44 U.S.C. 

3501 et seq.). 

National Environmental Policy Act 

Section 102 of the National 

Environmental Policy Act of 1969 

(NEPA), Public Law 91–190, 83 Stat. 

852 (Jan. 1, 1970) (42 U.S.C. 4321 et 

seq.), as amended, requires Federal 

agencies to evaluate the impacts of a 

proposed major Federal action that may 

significantly affect the human 

environment, consider alternatives to 

the proposed action, provide public 

notice and opportunity to comment, and 

properly document its analysis. DHS 

and its agency components analyze 

proposed actions to determine whether 

NEPA applies to them and, if so, what 

level of documentation and analysis is 

required. 

DHS Directive 023–01, Rev. 01 and 

DHS Instruction Manual 023–01–001– 

01, Rev. 01 (Instruction Manual) 

establish the policies and procedures 

DHS and its component agencies use to 

comply with NEPA and the Council on 

Environmental Quality regulations for 

implementing NEPA codified in 40 CFR 

parts 1500 through 1508. The CEQ 

regulations allow Federal agencies to 

establish, in their implementing 

procedures, with CEQ review and 

concurrence, categories of actions 

(‘‘categorical exclusions’’) that 

experience has shown do not, 

individually or in the aggregate, have a 

significant effect on the human 

environment and, therefore, do not 

require preparation of an environmental 

assessment or environmental impact 

statement. 40 CFR 1501.4, 

1507.3(e)(2)(ii). Appendix A of the 

Instruction Manual lists the DHS 

categorical exclusions. 

Under DHS NEPA implementing 

procedures, for an action to be 

categorically excluded, it must satisfy 

each of the following three conditions: 

(1) the entire action clearly fits within 

one or more categorical exclusions; (2) 

the action is not a piece of a larger 

action; and (3) no extraordinary 

circumstances exist that create the 

potential for a significant environmental 

effect. 

DHS is not aware of any significant 

impact on the environment, or any 

change in environmental effect that will 

result from this proposed rule. DHS 

finds promulgation of the rule clearly 

fits within categorical exclusion A3, 

established in the Department’s NEPA 

implementing procedures. 

This proposed rule is a standalone 

rule and is not part of any larger action. 

This proposed rule would not result in 

any major Federal action that would 

significantly affect the quality of the 

human environment. Furthermore, DHS 

has determined that no extraordinary 

circumstances exist that would create 

the potential for significant 

environmental effects. Therefore, this 

proposed rule is categorically excluded 

from further NEPA review and 

documentation. 

List of Subjects in 6 CFR Part 5 

Classified information, Courts, 

Freedom of information, Government 

employees, Privacy. 

For the reasons stated in the 

preamble, DHS proposes to amend 6 

CFR part 5 as follows: 

PART 5—DISCLOSURE OF RECORDS 

AND INFORMATION 

■ 1. The authority citation for part 5 

continues to read as follows: 

Authority: 6 U.S.C. 101 et seq.; Pub. L. 

107–296, 116 Stat. 2135; 5 U.S.C. 301; 6 

U.S.C. 142; DHS Del. No. 13001, Rev. 01 

(June 2, 2020). 

Subpart A also issued under 5 U.S.C. 552. 

Subpart B also issued under 5 U.S.C. 552a 

and 552 note. 

■ 2. Amend § 5.33 by revising paragraph 

(c) to read as follows: 

§ 5.33 Use and collection of Social 

Security numbers. 

* * * * * 

(c) The following rules apply to 

physical mail: 

(1)(i) In general, DHS will not include 

the full Social Security number (SSN) of 

an individual on any document sent by 

physical mail. Physical mail includes 

printed documents or correspondence 

but does not include emails or any other 

documents, correspondence, or 

communications in electronic form. 

(ii) DHS will only include the SSN of 

an individual on any document sent by 

physical mail if the Secretary, or 

designee, determines that the inclusion 

of the SSN on the document is 

necessary. 

(iii) For purposes of paragraph 

(c)(1)(ii) of this section, necessary means 

required for a DHS component to 

comply, in whole or in part, with a 

legal, regulatory, or policy requirement. 

(iv) Including the SSN is not 

necessary under paragraph (c)(1)(ii) of 

this section if the DHS component can 

redact the SSN in accordance with 

paragraph (c)(2) of this section or strike 

the SSN entirely and still comply with 

all relevant legal, regulatory, or policy 

requirements. 

(2) Where feasible, DHS components 

should partially redact the Social 

Security account number on any 

document sent by physical mail by 

including no more than the last four 

digits of the Social Security account 

number. Components should prioritize 

technical methods to redact Social 

Security account numbers in accordance 

with this paragraph (c)(2). 

(3) In all cases, DHS components must 

ensure that no part of the SSN is visible 

from the outside of any package or 

envelope sent by physical mail. 

Deborah Fleischaker, 

Acting Chief Privacy Officer, Department of 

Homeland Security. 

[FR Doc. 2024–31357 Filed 1–10–25; 8:45 am] 

BILLING CODE 9110–9L–P 

DEPARTMENT OF LABOR 

Office of Workers’ Compensation 

Programs 

20 CFR Part 702 

RIN 1240–AA17 

Longshore and Harbor Workers’ 

Compensation Act: Civil Money 

Penalties Procedures; Withdrawal 

AGENCY: Office of Workers’ 

Compensation Programs, Labor. 

ACTION: Withdrawal of notice of 

proposed rulemaking. 

SUMMARY: The Office of Workers’ 

Compensation Programs (OWCP) is 

withdrawing its Notice of Proposed 

Rulemaking (NPRM) that proposed new 

procedures for assessing and 

adjudicating penalties under the 

Longshore and Harbor Workers’ 

Compensation Act (LHWCA). 

DATES: The withdrawal is effective 

January 13, 2025. 

FOR FURTHER INFORMATION CONTACT: 

Stephanie S. Brown, Acting Director, 

Division of Longshore and Harbor 

Workers’ Compensation, Office of 

Workers’ Compensation Programs, 

(562)–256–3190, brown.stephanie.s@

dol.gov. TTY/TDD callers may dial toll 

free 1–877–889–5627 for further 

information. 

SUPPLEMENTARY INFORMATION: 

Summary of the Notice of Proposed 

Rulemaking 

On September 12, 2023, OWCP 

published a notice of proposed 

rulemaking, Longshore and Harbor 


ddrumheller on DSK120RN23PROD with PROPOSALS1