OMB CIRCULAR NO. A-108 TRANSMITTAL MEMORANDUM NO. 1;

• Document Type: CREST
• Collection: General CIA Records
• Document Number (FOIA) /ESDN (CREST): CIA-RDP84-00933R000300240008-7
• Release Decision: RIPPUB
• Original Classification: K
• Document Page Count: 8
• Document Creation Date: December 15, 2016
• Document Release Date: July 21, 2003
• Sequence Number: 8
• Publication Date: October 2, 1975
• Content Type: MEMO

,Approved For
8 CI ~RP 4- 0 (240008-7
Rp-
r)ATE: October 2, 1975
R EPL.Y TO
ATTN OF: ISD
OMB Circus ar No. A-108 Transmciittal Memorandums
Agency Liaison Representa-- t '; es for Privacy Act implementation
Attached for your information is an advance copy of
Transmittal Memorandum No- I to OMB Circular No , A-108
which establishes the new ysu rn reporting re+.ruirements
pursuant to Section 552a (o) of the Privacy
This Transmittal Memo will be published in the Federal
Register within the next few days.
Walter W. Haase
Deputy Associate Director
for Information Systems
Approved For Release 2003/08/20 : CIA-RDP84-00933R000300240008-7
 Approved For ReldibA 2003/08/20: CIA-RDP84-00933R00240008-7
:XECUT1VE OFFICE OF THE PRESIDENT
OFFICE OF MANAGEMENT AND BUDGET
`~aptexnber 30, 973
CIRCULAR NO. A-1,08
Transmitt-al Memorandum 's1o.
'UBJECT: Responsibilities for the maintenance of -records
about individuals by Federal agencies
1. Purpose. This supplement to OMB Circular A--?103 dated
9_
July T ___T_
5 provides guidance to Federal agencies regarding
the preparation and submission of reports of their intention
to establish or alter systems of personal records as
required by the Privacy Act of 1974 (P.L. 93-579, 5 U.S.C.
552a(o)). These procedures supersede preliminary guidance
on preparing the Report on New Systems contained in the 0MB
Privacy Act Guidelines dated July 1, 1975 (Federal Register,
July 9, 1975, p, 28977).
2. Reporting requirements.
a. A Eeport on New Systems must be submitted when:
(1) A new system of personal records sub-i ect to the
Privacy Act is rooosed. A new system of records r.:_zhj?ect to.
the new system reporting requirement is one for which no
public notice consistent with the provisions of subsection
(e)(4) is currently published in the Federal Register.
if a public notice for any specific system of records is
withdrawn, suspended, cancelled, or terminated and
subsequently reinstated, the subject system of records shall
be considered a new system and subject to the new system
reporting requirement at such time that it is reinstated.
(2) A change to a system of personal records
subject to the Privacy Act is proposed. A new system report
is required for any change to an existing system which meets
any of the following criteria.
(No. A--10 8)
Approved For Release 2003/08/20 : CIA-RDP84-00933R000300240008-7
 Approved Fo lease 2003/08/20 : CIA-RDP84-0093 00300240008-7
(a) Increase or change t ae wibe.r or types o 4
inndi v duals on Whom records are _aa Lnta.ined. Changyes
nVo Lori ng the number ra tzer than the ty:oes) of individuals
about whom records are. kept need only be, reported when t_ha
change significantly alters the character and purpose of the
s- tem of records, y normal increases in historical
ri ? as or other increases in the number o t records in a file
-
, w hich can be attributed to normal. g r o w t h xaa ;. terns need not
be reported. A c antie. resulting from a change in the scope
of the population f.'ov?rsd; e.g., a system ~ihich only covered
a portion of the work force is expanded to cover all, is
required to be reported.
(b) Expand the type or categories of
information maintained. For example., if on employee payr'olL
file is expanded to include data on ,duration and trainlnrag6
tlis would be considered an expansion of the "type or
categories of information" maintained, and would have to be
reported.
(c) Alter the manner in which the records are
organized or the-manner in which the records are indexed or..
retrieved so as to change the nature or scope of those
records.. For example, the combining of two or more existing
systems or splitting an existing system into two or more
different systems such as might. occur' in a centralization or
decentralization of organizational responsibilities.: would
require a report.
(d) Alter the purposes for which she
information is used. For example, a proposal that ::ivies
currently used as historical military. service records are.: to
be used for making determinations on eligibility for
disability benefits would require a report. A proposal to
establish or change the "routine uses" of the system will
not require the submission of a Report on New System if such
use is compatible with the purposes for which the systertas
maintained; i.e., does not, in effect, create a new purpose.
Any new or changed "routine use" would, however, be subject
to the requirements to give 30 days prior notice of such
change in the Federal Register (5 U.S.C. 552a(e) (11) )
(e) Change the equipment configuration (i.e.,
hardware and/or software) on which the system is operated so
as to create the potential for either greater or easier
access. For example, the addition of a telecommunications
(No. A-108)
Approved For Release 2003/08/20 : CIA-RDP84-00933R000300240008-7
 Approved For Iase 2003/08/20 : CIA-RDP84-00933F300240008-7
capability which could iicr ase the risk o-E' unauthorized
access would require a report,
b. Content ry t e Aepo:r rji e agency .. ? ort on
proposed new ;y3t:ems, or proposai to modify existing systems
shall co'aj:i sL o.,ff a brief narrative description, supporting
documentation and an update of the inventory Federal
personal data systems as outlined below:
(1 ) Narrative Statement - A brief statement,
normally not Lo exceed four pages in length.,
describes the purposes of the system of
-- identifies the authority under which the
system of records is to be maintained.,
--- provides the agency's evaluation of "the,
probable or potential effect of such proposal on the privacy
and other personal or property rights of individuals or the
disclosure of information relating to such individuals and
its effect on the preservation of the constitutional
principle of federalism and separation of power," and
-- provides a brief description of steps
taken :by the agency to minimize the risk of unauthorized
access to the system of records including a discussion of
higher or lower risk alternatives which Mere considered for
meeting. the requirements of the system. A more detailed
assessment of the risks and specific administrative,
technical, procedural, and physical safeguards established
shall be. available on request.
The narrative statement Should make oterence, as
appropriate., to information 7 n the supporting documentation
rather than restate such information.
Where changes to computer installations, communications
networks, or any other gsneral changes in information
collection, handling, storage or dissemination are made
which affect multiple systems of records; a single
consolidated new system report may be submitted. In such
cases, the narrative statement should address the overall
privacy implications of the proposed change, identify all
systems of records affected by the change and briefly
describe any unique impacts on any specific system of
(No. A-108)
Approved For Release 2003/08/20 : CIA-RDP84-00933R000300240008-7
 Approved Folease 2003/08/20: CIA-RDP84-0093000300240008-7
records. Supporting documentation, as defined in the
subsequent paragraphs, shall be provided for each system of
records.
(2) Supporting Documentation - The following shall
be appended to all new system repo ts;
(.a) An advance co , of the new oo revis.ed
system notice ; onsist'T enr aJ th the provisions o:- 5 J.S.C.
552a(e) (TM-which the agency proposes to publish for the new
or altered system(.s). For proposed alterations of existing
systems the documentation should be provided in the same
form as the agency proposes to publish the public notice of
such changes. i-: the agency proposes to publish changes in
the form of a revision to the public notice, a cop