CFR > Title 32 - National Defense > SUBTITLE A—Department of Defense > CHAPTER VI—DEPARTMENT OF THE NAVY (parts 700 to 777) > SUBCHAPTER A—UNITED STATES NAVY REGULATIONS AND OFFICIAL RECORDS (Parts 700–705) > PART 701—AVAILABILITY OF DEPARTMENT OF THE NAVY RECORDS AND PUBLICATION OF DEPARTMENT OF THE NAVY DOCUMENTS AFFECTING THE PUBLIC > SUBPART F—DON Privacy Program (§701.100 to §701.125) > 701.117—Changes to PA systems of records.

701.117—Changes to PA systems of records.

CNO (DNS-36) is the approval authority for Navy/DON PA systems of records actions. CMC (ARSF) is the approval authority for Marine Corps PA systems of records actions. DON activities wishing to create, alter, amend, or delete systems should contact CNO (DNS-36) or CMC (ARSF), who will assist in electronically preparing the documents for coordination and DOD/Congressional approval.
(a) Creating a new system of records. (1) A new system of records is one for which no existing system notice has been published in the Federal Register. DON activities wishing to establish a new PA system of records notice shall contact CNO (DNS-36) (regarding Navy system of records) or CMC (ARSF) (regarding Marine Corps system of records.) These officials will assist in the preparation and approval of the notice. Once approval is obtained from DOD, the systems notice will be published in the Federal Register for comment by the public. In the case of an exempt system of records, it will also be published at 32 CFR part 701. A listing of all DON PA systems of records notices is available at http://www.privacy.navy.mil.
(2) A DON activity may not begin collecting or maintaining PPI about individuals that is retrieved by their name and/or personal identifier until a PA system of records notice has been approved and published in the Federal Register. Failure to comply with this mandate could result in both criminal and civil penalties.
(3) In those cases where a system of records has been cancelled or deleted and it is later determined that it should be reinstated or reused, a new system notice must be prepared.
(4) DON activities wishing to create a new PA system of records must conduct a risk analysis of the proposed system to consider the sensitivity and use of the records; present and projected threats and vulnerabilities; and projected cost effectiveness of safeguards. (See § 701.118 regarding PIAs.)
(b) Altering a system of records notice. A systems manager shall contact CNO (DNS-36)/CMC (ARSF) to alter a PA system of records notice when there has been:
(1) A significant increase or change in the number or types of individuals about who records are maintained. For example, a decision to expand a system of records that originally covered personnel assigned to only one activity to cover personnel at several installations would constitute an altered system. An increase or decrease in the number of individuals covered due to normal growth or decrease is not an alteration.
(2) A change that expands the types or categories of information maintained.
(3) A change that alters the purpose for which the information is used. In order to be an alteration, the change must be one that is not reasonably inferred from any of the existing purposes.
(4) A change that adds a new routine use.
(5) A change to equipment configuration (either hardware or software) that creates substantially greater use of records in the system. For example, placing interactive computer terminals at regional offices when the system was formerly used only at the headquarters would be an alteration.
(6) A change in the manner in which records are organized or in the method by which records are retrieved.
(7) A combining of record systems due to reorganization.
(c) Amending a system of records notice. DON activities should apprise CNO (DNS-36) or CMC (ARSF) respectively when a minor change has been made to a system of records.
(d) Deleting a system of records notice. When a system of records is discontinued, incorporated into another system, or determined to be no longer subject to this instruction, a deletion notice must be published in the Federal Register. The deletion notice shall include the system identification number, system name, and the reason for deleting it. If a system is deleted through incorporation into or merger with another system, identify the successor system in the deletion notice. Systems managers who determine that a systems notice is no longer needed should contact CNO (DNS-36)/CMC (ARSF) who will prepare the deletion notice and submit it electronically to DOD for publication in the Federal Register.
(e) Numbering a system of records notice. Systems of records notices are identified with an “N” for a Navy system; “M” for a Marine Corps system; or an “NM” to identify a DON-wide system, followed by the subject matter Standard Subject Identification Code (SSIC).
(f) Detailed information. Detailed information on how to write, amend, alter, or delete a PA system of records notice is contained at http://www.privacy.navy.mil.