310.33—New and altered record systems.
(a) Criteria for a new record system.
(1)
If a Component is maintaining a system of records as contemplated by § 310.10(a), and a system notice has not been published for it in the Federal Register, the Component shall establish a system notice consistent with the requirements of this subpart.
(2)
If a notice for a system of records has been canceled or deleted but a determination is subsequently made that the system will be reinstated or reused, the system may not be operated (i.e., information collected or used) until a new notice is published in the Federal Register.
(b) Criteria for an altered record system.
A system is considered altered whenever one of the following actions occurs or is proposed:
(1)
A significant increase or change in the number or type of individuals about whom records are maintained.
(i)
Only changes that alter significantly the character and purpose of the record system are considered alterations.
(ii)
Increases in numbers of individuals due to normal growth are not considered alterations unless they truly alter the character and purpose of the system.
(iii)
Increases that change significantly the scope of population covered (for example, expansion of a system of records covering a single command's enlisted personnel to include all of the Component's enlisted personnel would be considered an alteration).
(iv)
A reduction in the number of individuals covered is not an alteration, but only an amendment. (see § 310.34(a).)
(v)
All changes that add new categories of individuals to system coverage require a change to the “Categories of individuals covered by the system” caption of the notice (see § 310.32(e)) and may require changes to the “Purpose(s)” caption (see § 310.32(h) ).
(i)
The addition of any new category of records not described under the “Categories of Records in the System” caption is considered an alteration.
(ii)
Adding a new data element that is clearly within the scope of the categories of records described in the existing notice is an amendment. (see § 310.34(a) ). An amended notice may not be required if the data element is clearly covered by the record category identified in the existing system notice.
(iii)
All changes under this criterion require a change to the “Categories of Records in the System” caption of the notice. (see § 310.32(f) ).
(3)
An alteration of how the records are organized or the manner in which the records are indexed and retrieved.
(i)
The change must alter the nature of use or scope of the records involved (for example, combining records systems in a reorganization).
(ii)
Any change under this criteria requires a change in the “Retrievability” caption of the system notice. (see § 310.32(j)(2) ).
(iii)
If the records are no longer retrieved by name or personal identifier cancel the system notice. (see § 310.10(b) ).
(i)
The new purpose must not be compatible with the existing purposes for which the system is maintained.
(ii)
If the use is compatible and reasonably expected, there is no change in purpose and no alteration occurs.
(iii)
Any change under this criterion requires a change in the “Purpose(s)” caption (see § 310.32(h)) and may require a change in the “Authority for maintenance of the system” caption (see § 310.32 ).
(5)
Changes that alter the computer environment (such as changes to equipment configuration, software, or procedures) so as to create the potential for greater or easier access.
(ii)
Software applications, such as operating systems and system utilities, that provide for easier access are considered alterations.
(iv)
The addition of peripheral devices such as tape devices, disk devices, card readers, printers, and similar devices to an existing IT system constitute an amendment if system security is preserved. (see § 310.34 ).
(v)
Changes to existing equipment configuration with on-line capability need not be considered alterations to the system if:
(B)
The addition of terminals does not extend the capacity of the current operating system and existing security is preserved.
(vi)
The connecting of two or more formerly independent automated systems or networks together creating a potential for greater access is an alteration.
(vii)
Any change under this caption requires a change to the “Storage” caption element of the systems notice. (see § 310.32(j)(i) ).
(c) Reports of new and altered systems.
(1)
Components shall submit a report for all new or altered systems to the DPO consistent with the requirements of this subpart and in the format prescribed at appendix F of this part.
(i)
Components shall include the following when submitting an alteration for a system notice for publication in the Federal Register :
(ii)
The full text of the system notice need not be submitted if the master registry contains a current system notice for the system. (see § 310.32(q) ).
(2)
The DPO coordinates all reports of new and altered systems with the Office of the Assistant Secretary of Defense (Legislative Affairs), Department of Defense.
(3)
The DPO prepares and sends a transmittal letter that forwards the report, as well as the new or altered system notice, to OMB and Congress.
(d) Time restrictions on the operation of a new or altered system.
(1)
The reports, and the new or altered system notice, must be provided OMB and Congress at least 40 days prior to the operation of the new or altered system. The 40 day review period begins on the date the transmittal letters are signed and dated.
(2)
The system notice must be published in the Federal Register before a Component begins to operate the system (i.e., collect and use the information). If the new system has routine uses or the altered system adds a new routine use, no records may be disclosed pursuant to the routine use until the public has had 30 days to comment on the proposed use.
(e) Exemptions for new systems.
See § 310.30(e) for the procedures to follow in submitting exemption rules for a new system of records or for submitting an exemption rule for an existing system of records.