Document ID: FMCSA-2012-0243-0001
Agency: fmcsa
Document Type: Notice
Title: Privacy Act; Systems of Records
Posted Date: 2012-07-19T04:00Z

[Federal Register Volume 77, Number 139 (Thursday, July 19, 2012)]
[Notices]
[Pages 42548-42552]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2012-17597]

-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Motor Carrier Safety Administration

[Docket No. FMCSA-2012-0243]

Privacy Act of 1974; Department of Transportation, Federal Motor 
Carrier Safety Administration (FMCSA) 007 Pre-Employment Screening 
Program

AGENCY: Federal Motor Carrier Safety Administration (FMCSA) Department 
of Transportation (DOT).

ACTION: Notice to amend a system of records.

-----------------------------------------------------------------------

SUMMARY: In accordance with the Privacy Act of 1974, the Department of 
Transportation proposes to update and reissue a Department of 
Transportation system of records notice titled Department of 
Transportation/Federal Motor Carrier Safety Administration--007 Pre-
Employment Screening Program. The updated system of records consists of 
information that is created and used by the Department's Pre-Employment 
Screening program to provide commercial drivers and persons conducting 
pre-employment screening services for the motor carrier industry 
electronic access to driver history reports extracted from the 
Department's Motor Carrier Management Information System (MCMIS).
    As a result of biennial review of this system, the Privacy Office 
has made the five major modifications to the systems of records. The 
category of records identified as ``Financial Transaction Records'' in 
the previously published System of Records Notice for this system has 
been removed as the Department does not maintain these records. The 
``Access Transaction Records'' record category also has been revised to 
clarify the types of information maintained about the two categories of 
users permitted to request access to records for the purposes of pre-
employment screening. The routine uses have been updated to clarify 
disclosure of Pre-Employment Screening Program (PSP) records to 
industry service providers directly involved in the hiring of 
commercial motor vehicle (CMV) drivers on behalf of motor carriers and/
or CMV drivers and the routine use concerning the sharing of CMV driver 
access transaction records with Validation Authorities (e.g. Lexis-
Nexis). The system owner information has been modified to omit the 
contact information for the MCMIS and Freedom of Information Act 
systems of records and, instead, include only contact information for 
the PSP system

[[Page 42549]]

of records. Additionally, this Notice includes non-substantive changes 
to simplify the formatting and text of the previously published Notice. 
This updated system will be included in the Department of 
Transportation's inventory of record systems.

DATES: Effective August 21, 2012. Written comments should be submitted 
on or before the effective date. If no comments are received, the 
proposal will become effective on the above date. If comments are 
received, the comments will be considered and, where adopted, the 
documents will be republished with changes.

ADDRESSES: You may submit comments, identified by Docket No. FMCSA-
2012-0243 by one of the following methods:
    [squf] Federal e-Rulemaking Portal: http://www.regulations.gov. 
Follow the instructions for submitting comments.
    [squf] Mail: Department of Transportation Docket Management, Room 
W12-140, 1200 New Jersey Ave. SE. Washington, DC 20590.
    [squf] Instructions: All submissions received must include the 
agency name and docket number for this rulemaking. All comments 
received will be posted without change to www.regulations.gov, 
including any personal information provided.
    [squf] Docket: For access to the docket to read background 
documents or comments received go to www.regulations.gov. Follow the 
online instructions for accessing the docket.
    [squf] Fax: 202-493-2251. Instructions: You must include the agency 
name and Docket Number FMCSA-2012-0243. All comments received will be 
posted without change to http://www.regulations.gov, including any 
personal information provided.
    Privacy Act: Anyone is able to search the electronic form of all 
comments received in any of our dockets by the name of the individual 
submitting the comment (or signing the comment, if submitted on behalf 
of an association, business, labor union, etc.). You may review DOT's 
Privacy Act notice in the Federal Register published on January 17, 
2008 (73 FR 3316-3317), or you may visit www.dot.gov/privacy.
    Docket: For access to the docket to read background documents or 
comments received, go to http://www.regulations.gov or to the street 
address listed above. Follow the online instructions for accessing the 
docket.

FOR FURTHER INFORMATION CONTACT: For general questions, please contact: 
Arlene Thompson, (202) 366-2094, Arlene.Thompson@dot.gov. For privacy 
issues please contact: Claire W. Barrett, Departmental Chief Privacy 
Officer, Privacy Office, Department of Transportation, Washington, DC 
20590; privacy@dot.gov; or (202) 527-3284.

SUPPLEMENTARY INFORMATION: In accordance with the Privacy Act of 1974, 
the Department of Transportation (DOT)/Federal Motor Carrier 
Administration (FMCSA or Administration) proposes to update and reissue 
a current DOT system of records notice titled, ``Department of 
Transportation/Federal Motor Carrier Safety Administration--007 Pre-
Employment Screening Program.'' The FMCSA's primary mission is to 
prevent commercial motor vehicle-related fatalities and injuries. The 
FMCSA contributes to safe motor carrier operations through strong 
enforcement of safety regulations; targeting high-risk carriers and 
commercial motor vehicle drivers; improving safety information systems 
and commercial motor vehicle technologies; strengthening commercial 
motor vehicle equipment and operating standards; and increasing safety 
awareness. To accomplish these activities, the FMCSA works with 
Federal, State, and local enforcement agencies, the motor carrier 
industry, labor safety interest groups, and others.
    This system of records is used to satisfy requirements mandated by 
Congress in the Safe, Accountable, Flexible, Efficient Transportation 
Equity Act: A Legacy for Users, 49 U.S.C. 31150, Public Law 109-59, 
Section 4117. FMCSA believes that making this driver data available to 
potential employers and operator-applicants will improve the quality of 
safety data and help employers make more informed decisions when hiring 
commercial drivers. The PSP is a screening tool that allows motor 
carriers and individual drivers to purchase driving records from the 
FMCSA MCMIS system. A record purchased through PSP contains the most 
recent five years of crash data and the most recent three years of 
roadside inspection data, including serious safety violations for an 
individual driver. The record displays a snapshot in time, based on the 
most recent MCMIS data extract loaded into the PSP system.
    This SORN makes four primary changes to the existing system of 
records. It removes an existing category of records, clarifies the 
information maintained in the ``Access Transaction Records,'' adds a 
new routine use, and clarifies an existing routine use. The category of 
records has been revised to exclude the category of ``Financial 
Transaction Records'' as this information is maintained exclusively by 
DOT's PSP Service Provider and these records are not considered federal 
records under the stewardship of the DOT. The ``Access Transaction 
Records'' record category was revised to clarify that information is 
maintained on the two categories of users permitted to request access 
to records for the purposes of pre-employment screening. In addition to 
transactions initiated by motor carriers, the record will include 
information on transactions initiated by industry service providers as 
authorized by the routine use added as part of this system of records 
notice. The category of records more clearly states the information 
maintained on requests initiated by operator-applicant requesting his 
or her own PSP record. This information establishes a record of account 
access to ensure that operator-applicants only access their own 
information. These changes have been made to more clearly reflect 
existing FMCSA processes and do not introduce changes in actual 
operations.
    The routine uses have been updated to permit disclosure of PSP 
records to industry service providers directly involved in the hiring 
of commercial motor vehicle (CMV) drivers on behalf of motor carriers 
and/or CMV drivers. This change reflects motor carrier business models 
which may include the use of industry service providers to directly 
hire commercial motor vehicle drivers on behalf of motor carriers. 
Additionally, the routine use concerning the sharing of CMV driver 
Access Transaction Records with Validation Authorities (e.g. Lexis-
Nexis) was clarified by removing information incorrectly included in 
the routine use that should be discussed in the Notice's categories of 
information.
    The system owner information has been modified to include only 
contact information for the PSP system of records and no longer 
included information for the MCMIS and Freedom of Information Act 
(FOIA) systems, which are separate and distinct system of records. The 
complete system of records notices for these systems may be found at 
www.dot.gov/privacy.
    FMCSA plans to introduce PSP Mobile iOS Application as an 
alternative means of providing information available through the PSP 
Web site to the authorized users. FMCSA does not require individuals to 
register or provide any PII as a condition of downloading PSP iOS 
application. Individuals downloading the PSP iOS application must 
fulfill Apple's registration requirements prior to downloading the 
application. Apple does not provide FMCSA any PII of individuals who 
download the PSP iOS application from its site. Requesters seeking 
information on CMV drivers

[[Page 42550]]

through the PSP iOS mobile application can only access PSP records 
using the same authorization process and data elements described in 
this System of Records Notice.
    This updated system will be included in DOT's inventory of record 
systems.

SYSTEM NUMBER:
    DOT/FMCSA 007.

SYSTEM NAME:
    Department of Transportation Federal Motor Carrier Safety 
Administration Pre-Employment Screening Program.

SECURITY CLASSIFICATION:
    Unclassified, Sensitive.

SYSTEM LOCATION:
    Records are maintained at the DOT Service Provider sites managed by 
AT&T in Ashburn, VA and Allen, TX.

CATETORIES OF INDIVIDUALS COVERED BY THE SYSTEM OF RECORDS:
    PSP records will include personally identifiable information (PII) 
pertaining to Commercial Motor Vehicle (CMV) drivers, as defined by 49 
CFR 390.5, (referred to in this system of records notice as operator-
applicants). PSP will also include access transaction records. For CMV 
drivers, this will include personal information submitted by the CMV 
driver to access his or her personal PSP record. For motor carriers or 
authorized industry service provider, Access Transaction Records will 
include the unique username and password submitted by the user to 
access the PSP system and the CMV driver information submitted by the 
motor carrier or authorized industry service provider to retrieve a PSP 
record.

CATEGORIES OF RECORDS:
    Categories of records in this system include:
    CMV crash and inspection records. Data extract from the FMCSA Motor 
Carrier Management Information System (MCMIS) containing the most 
recent five years' crash data and the most recent three years' 
inspection information for operator-applicants including:

[squf] CMV driver name (last, first)
[squf] CMV driver date of birth
[squf] CMV driver license number
[squf] CMV driver license State

    Access transaction records. In the case of a motor carrier or 
industry service provider accessing a CMV driver's PSP record, 
transaction records include information about the subject of the 
electronic record request including:

[squf] CMV driver name (last, first, middle initial)
[squf] CMV driver date of birth
[squf] CMV driver license number
[squf] CMV driver license State

    Access Transaction Records also include information about the motor 
carrier or industry service provider accessing the record including:

[squf] User unique system username
[squf] User unique system password

    In the case of an operator-applicant requesting his or her own PSP 
record, the Access Transaction Record will include:

[squf] CMV driver name (last, first, middle initial)
[squf] CMV driver date of birth
[squf] CMV driver license number
[squf] CMV driver license State
[squf] CMV driver address.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    49 U.S.C. 31150, as added by section 4117 of Public Law 109-59 
[Safe, Accountable, Flexible, Efficient Transportation Equity Act: A 
Legacy for Users (SAFETEA-LU)].

PURPOSE(S):
    The purpose of this system is to make CMV crash and inspection 
records available to authorized operator-applicants, authorized 
industry service providers, and authorized motor carriers. Records 
maintained in the system will also support operational management of 
the PSP program.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND PRUPOSES OF USE:
    In addition to those disclosures generally permitted under Section 
(b) of the Privacy Act, 5 U.S.C. 552a(b), all or a portion of the 
records or information contained in this system may be disclosed 
outside of DOT as a routine use pursuant to 5 U.S.C. 552a(b)(3) as 
follows:
    1. To authorized industry service providers and motor carriers as 
part of the operator-applicant's PSP record; authorized industry 
service providers and motor carriers may use PSP records only for 
purposes of pre-employment safety screening of operator-applicants and 
must have the operator-applicant's consent to access the PSP record;
    2. To the DOT Validation Authority (e.g., Lexis-Nexis) to verify 
and validate the presented identity of the individual operator-
applicant requesting access to his or her own inspection and crash 
data.
    3. Other possible routine uses of the information, applicable to 
all DOT Privacy Act systems of records, are published in the Federal 
Register at 75 FR 82132, December 29, 2010, under ``Prefatory Statement 
of General Routine Uses'' (available at http://www.dot.gov/privacy/privacyactnotices).

DISCLOSURE TO CONSUMER REPORTING AGENCIES:
    None.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, 
AND DISPOSING OF RECORDS:
STORAGE:
    Records in this system are stored electronically or on paper in 
secure facilities. Electronic records may be stored on magnetic disc, 
tape, digital media, and CD-ROM. Any paper records received or required 
for purposes of processing data requests will be stored in secure file 
folders at the DOT Service Provider's secure storage facility.

RETRIEVABILITY:
    Records will be retrieved by using the operator-applicant's last 
name, date of birth, license number, and license State.

SAFEGUARDS:
    All records in the system will be protected from unauthorized 
access through appropriate administrative, physical, and technical 
safeguards. Electronic files will be stored in a database secured by 
password security, encryption, firewalls, and secured operating 
systems, to which only authorized Service Provider or DOT/FMCSA 
personnel will have access, on a need-to-know basis. Paper files will 
be stored in file cabinets in a locked file room to which only the 
authorized Service Provider and DOT/FMCSA personnel will have access, 
on a need-to-know basis. All access to the electronic system and paper 
files will be logged and monitored. All PII data elements will be 
encrypted in the PSP system.
    The Service Provider will be subject to routine audits of the PSP 
program by FMCSA to ensure compliance with the Privacy Act, applicable 
sections of the Fair Credit Reporting Act and other applicable Federal 
laws, regulations, or other requirements.
    Access by external users (operator-applicants, authorized industry 
service providers and motor carriers) will be restricted within the 
system based upon the user's role as an authorized industry service 
provider, motor carrier, or validated operator-applicant. An authorized 
industry service provider or motor carrier is an entity or person who 
has been provided a unique user identification and password and must 
use the unique identification and password to access data in PSP. 
External users will be able to query the CMV

[[Page 42551]]

crash and inspection database only. The Service Provider will provide 
users with an advisory statement that authorized industry service 
providers and motor carriers could be subject to criminal penalties and 
other sanctions under 18 U.S.C. 1001 for misuse of the PSP system.
    In order for an authorized industry service provider or motor 
carrier to receive an individual operator-applicant's crash and 
inspection data, the authorized industry service provider or motor 
carrier must certify, for each request, under penalty of perjury, that 
the request is for pre-employment purposes only and that written or 
electronic consent of the operator-applicant has been obtained. Upon 
completion of certification, the Service Provider will provide the 
individual operator-applicant data to the industry service provider or 
motor carrier via the secure PSP Web site. The authorized industry 
service provider or motor carrier will access this individual's 
information by entering a unique identification username and password. 
Authorized industry service providers or motor carriers will be 
required to maintain each operator-applicant's signed, written consent 
form or electronic signature for five years. Authorized industry 
service providers or motor carriers are subject to random audits by DOT 
to ensure that written or electronic consent of operator-applicants was 
obtained.
    The PSP system also allows validated operator-applicants to access 
their own crash and inspection data upon written or electronic request. 
Upon receipt of an operator-applicant's request, the Service Provider 
will validate the identity of the requestor (operator-applicant) by 
using his or her full name, date of birth, driver license number, 
driver license State and current address against a validation 
authority.
    The contractor and FMCSA have established an ongoing, random-
selection audit process to monitor compliance with the written consent 
obligation. The audit requirements and penalties process is 
incorporated by reference as part of the contract between FMCSA and the 
contractor. The purpose of the audit requirements and penalties process 
is to ensure that the account holder obtains a driver-signed consent 
form prior to completing a PSP driver record inquiry in accordance with 
the Fair Credit Reporting Act, 15 U.S.C. 1681 et seq., and 49 U.S.C. 
31150. The contractor will penalize an account holder, who fails to 
comply with the audit requirements. Based on the nature and frequency 
of these violations, the contractor may send a written warning, 
suspend, or terminate the account holder from the PSP.
    Individuals who access the PSP system via the iOS application are 
subject to the privacy policy integrated in the application.

RETENTION AND DISPOSAL:
    1. CMV crash and inspection records: Pursuant to General Records 
Schedule (GRS) 20 (``Electronic Records,'' February 2008, see http://www.archives.gov/records-mgmt/ardor/grs20.html), governing extract 
files, each monthly MCMIS extract in PSP is deleted approximately three 
months after being superseded by a current MCMIS extract, unless needed 
longer for administrative, legal, audit or other operational purposes.
    2. Access Transaction Records: Pursuant to GRS 24, ``Information 
Technology Operations and Management Records,'' Item 6, April 2010, see 
http://www.archives.gov/records-mgmt/grs/grs24.html) Access Transaction 
Records are retained for a period of five years.

SYSTEM MANAGER CONTACT INFORMATION:
    PSP System Manager: Office of Information Technology; Federal Motor 
Carrier Safety Administration; U.S. Department of Transportation; 1200 
New Jersey Avenue SE., W65-319; Washington, DC 20590.

NOTIFICATION PROCEDURE:
    Operator-applicants wishing to know if their inspection and crash 
records appear in this system may directly access the PSP system or 
make a request in writing to the PSP System Manager identified under 
``System Manager Contact Information.''
    Individual operator-applicants wishing to know if their Access 
Transaction Records appear in this system may make a written request to 
the following address: NIC Technologies, 4601 N. Fairfax Drive, Suite 
1160, Arlington, VA 22203.
    Any other requests for records about yourself from this system of 
records or any other Departmental system of records your request must 
conform with the Privacy Act regulations set forth in 49 CFR part 10. 
You must sign your request, and your signature must either be notarized 
or submitted under 28 U.S.C. 1746, a law that permits statements to be 
made under penalty of perjury as a substitute for notarization. While 
no specific form is required, you may obtain forms for this purpose 
from the Chief Freedom of Information Act Officer, http://www.dot.gov/foia or 202.366.4542. In addition you should provide the following:
    An explanation of why you believe the Department would have 
information on you;
    [squf] Identify which component(s) of the Department you believe 
may have the information about you;
    [squf] Specify when you believe the records would have been 
created;
    [squf] Provide any other information that will help the FOIA staff 
determine which DOT component agency may have responsive records; and
    [squf] If your request is seeking records pertaining to another 
living individual, you must include a statement from that individual 
certifying his/her agreement for you to access his/her records.
    Without this bulleted information the component(s) may not be able 
to conduct an effective search, and your request may be denied due to 
lack of specificity or lack of compliance with applicable regulations.

RECORD ACCESS PROCEDURES:
    See ``Notification Procedure'' above.

CONTESTING RECORDS PROCEDURE:
    Operator-applicants seeking to contest the content of information 
about them in this system should apply to the System Manager by 
following the same procedures as indicated under ``Notification 
Procedure.'' Operator-applicants may also submit a data challenge to 
FMCSA's online system to record and monitor challenges to FMCSA data, 
DataQs. The system can be accessed via the DataQs Web site (https://dataqs.fmcsa.dot.gov/login.asp). The DataQs system, provides an 
electronic means for operator-applicants to file concerns about Federal 
and State data contained in the PSP report. Specifically, DataQs allows 
an individual to challenge data maintained by FMCSA on, among other 
things, crashes, inspections, registration, operating authority, safety 
audits and enforcement actions. Through this system, data concerns are 
automatically forwarded to the appropriate Federal or State office for 
processing and resolution. Any challenges to data provided by State 
agencies must be resolved by the appropriate State agency. 
Additionally, FMCSA is not authorized to direct a State to change or 
alter MCMIS data for violations or inspections originating within a 
particular State(s). Once a State office makes a determination on the 
validity of a challenge, FMCSA considers that decision as the final 
resolution of the challenge. FMCSA cannot change State records without 
State consent. The system also allows filers to monitor the status of 
each filing.

[[Page 42552]]

RECORD SOURCE CATEGORIES:
    1. CMV crash and inspection records: All commercial driver crash 
and inspection data in PSP is received from a monthly MCMIS data 
extract. The MCMIS SORN identifies the source(s) of the information in 
MCMIS. (FMCSA modified the MCMIS SORN to describe the system's sharing 
of PII with the Driver Information Resource and PSP systems. See 74 FR 
66391, December 15, 2009). All DOT SORNs may be found at www.dot.gov/privacy.
    2. Access transaction records: An audit trail of those entities or 
persons that accessed the PSP (i.e. authorized motor carriers, 
authorized industry service providers, or validated operator-
applicants) is automatically created when requests are initiated and 
when data is released by the Service Provider. These records are 
internal documents to be used by the Service Provider and FMCSA for 
auditing, monitoring and compliance purposes.

EXEMPTIONS CLAIMED FOR THE SYSTEM:
    None.

    Issued in Washington, DC on July 13, 2012.
Claire W. Barrett,
Departmental Privacy Officer.
[FR Doc. 2012-17597 Filed 7-18-12; 8:45 am]
BILLING CODE 4910-EX-P