Comments from EPIC & 16 Organizations to the U.S. Department of the Treasury on the Financial Assistance Programs System of Records Notice

COMMENTS OF THE ELECTRONIC PRIVACY INFORMATION CENTER
AND 16 ORGANIZATIONS

to the

U.S. DEPARTMENT OF THE TREASURY

System of Records Notice, Departmental Offices DO .0197—Financial Assistance Programs

91 Fed. Reg. 5,155 | TREAS-DO-2026-0100

March 6, 2026

---

The Electronic Privacy Information Center (EPIC) and the undersigned organizations submit these comments in response to the System of Records Notice for TREAS-DO-2026-0100: Departmental Offices DO .0197—Financial Assistance Programs, published in the Federal Register by the U.S. Department of the Treasury on February 4, 2026.[1] EPIC is a public interest research center in Washington, D.C., established in 1994 to protect privacy, freedom of expression, and democratic values in the information age.

            We strongly object to the Treasury Department’s Notice and planned creation of the Financial Assistance Programs system of records, the maintenance of which would be both illegal and reckless. In proposing this system, the Treasury Department apparently seeks to construct an illegal national data bank[2] containing the personal information of virtually any person associated with any financial assistance program supervised by the Department—data that today is sensibly distributed across the states and other institutions with an operational need for it.[3]

Like many agencies over the past year,[4] the Treasury Department asserts generically that this consolidation of Social Security numbers and other sensitive personal data into a single system is needed to identify “waste, fraud, and abuse.”[5] But even if the Treasury Department were authorized to establish such an omnibus system—which it is not—the Department has at its disposal numerous effective audit and oversight tools that impose dramatically fewer privacy and security risks than the indiscriminate hoarding of personal data. Indeed, the Treasury Department fails to meet the Privacy Act’s clear mandate to strictly minimize the collection of data and limit the use of any data that is collected. The Notice speaks in generalities and unexhaustive lists, making it impossible to know the breadth of information the proposed system will house.[6]

For these and many other reasons, the Treasury Department must withdraw its Notice and abandon its efforts to establish the proposed Financial Assistance Programs system of records.

I. The Treasury Department lacks both the legal authority and a valid purpose to create the Financial Assistance Programs system of records.

The Privacy Act requires federal agencies to adhere to rigorous data minimization standards. An agency may only collect information for a purpose that either a statute or executive order require the agency to accomplish.[7] Even then, the agency may only collect information that is relevant and necessary to accomplish the identified purpose.[8] The Notice neither establishes that the Treasury Department is authorized to create a national data bank of personal data associated with the financial assistance programs supervised by the Department nor identifies a valid purpose for creating the system as the Notice describes it.

The Notice does not include any discussion of the Treasury Department’s authority in this regard, instead wordlessly citing to three executive orders and a handful of statutes.[9] However, the cited authorities do not authorize the Department to create a large and open-ended database such as the one proposed here. The first two statutes cited, for example, pertain solely to agency obligations once it holds records;[10] neither purports to authorize collection or maintenance. The statutes creating the federal programs administered by the Treasury Department are equally unavailing, either omitting discussion of information collection altogether,[11] allowing only collection by the Inspector General,[12] or approving collection far narrower than the instant Notice seeks.[13] Moreover, no executive order may, and the cited orders do not purport to, supersede the Privacy Act. The Treasury Department has no authority to create the bloated database this Notice contemplates, nor does the agency make any meaningful attempt to establish that it does.

Further, the Notice’s failure to identify a limited, legally mandated purpose for the proposed system violates both the Privacy Act and the Paperwork Reduction Act.[14] In explaining its purposes, the Notice names examples of how the Treasury Department “may use” the system, suggesting that the agency will engage in collection for collection’s sake and assign uses later.[15] The Department’s open-ended purpose statement thus violates the Privacy Act’s requirement to only collect information “relevant and necessary” to achieve a purpose that is required by a statute or executive order.[16] Even if the system’s purpose is limited to fraud prevention, this purpose is already achieved through means far less hazardous to privacy and data security, including intensive participation approval processes,[17] detailed agreements with recipient states,[18] and audit controls limited to the office of the Inspector General.[19] There is no credible justification—let alone Congressional authorization—for the Treasury Department to aggregate Social Security Numbers and other sensitive personal data en masse when these time-tested tools for addressing fraud, waste, and abuse already exist. The proposed system threatens to unduly burden every person with even a tangential link to a federal assistance program—exactly the kind of public burden that the Paperwork Reduction Act requires agencies to minimize.[20]

II. The Notice reveals numerous other violations of the Privacy Act.

The Notice fails disclose with adequate specificity the categories of information collected,[21] seeks to collect information that is unnecessary or irrelevant,[22] and identifies overbroad routine uses that are incompatible with the original purpose of collection.[23] Each of these violates the Privacy Act.

As noted, the Treasury Department lacks both the legal authority and a valid purpose for creating this system. No collection of personal records can satisfy the Privacy Act’s data minimization requirement without them.[24] Even if these conditions were to exist, however, the proposed collection cannot pass muster. First, the Treasury Department fails to identify with particularity information categories it seeks. The Notice instead contains a non-exhaustive list of records that they system “may include.”[25] This is not sufficient information for individuals to understand what personal information may be caught up in the system or to evaluate whether that information is being adequately safeguarded.

Second, the categories that are included in the Notice demonstrate the Treasury Department’s intent to capture information that far exceeds the bounds of “necessary” and “relevant.” The agency evidently seeks to consolidate sensitive information related to all federally funded programs. While each program has its own purpose, beneficiaries, and requirements—and thus different requirements for what would theoretically qualify as “necessary” or “relevant”—the Notice does not differentiate between them. Further, the Notice includes a staggeringly broad catchall category that would include “information collected or otherwise maintained by program recipients, subrecipients, and their contractors.”[26] In effect, the Treasury Department asserts its right to any information collected by a state, local government, or “various” private entities in connection to any federally funded program the Department supervises.[27] The Privacy Act forbids such an unbounded and unjustified collection of personal data and any system that would house it.

Finally, the Notice includes a laundry list of routine uses[28] that are both overbroad[29] and incompatible with the original purpose of collection.[30] Routine Use 2, for example, is written so expansively that disclosure could be justified to nearly any other federal agency, state or local government, or commercial entity.[31] This use violates OMB guidelines[32] and defies any attempt to evaluate compatibility. Routine Use 10 would allow disclosure to professional licensing organizations[33]—a use certainly divorced from the purpose of administering federally funded programs. Given the sensitivity and volume of the information the Treasury Department apparently seeks and its asserted right to disclose such information without meaningful constraint, the likelihood of misuse and abuse of sensitive information is high. The asserted routine uses fail the Privacy Act’s requirements, and the Notice must be withdrawn.  

III. Conclusion

For the above reasons, the Treasury Department should withdraw its Notice and immediately abandon its proposal to create the centralized Financial Assistance Programs system of records. If you require any additional information about the agency’s statutory obligations under the Privacy Act and related law, please contact John Davisson, EPIC Deputy Director and Director of Enforcement, at [email protected], and Jeramie D. Scott, EPIC Senior Counsel, at [email protected].

Respectfully submitted,

Electronic Privacy Information Center (EPIC)
Association of Public Data Users

Center for Democracy & Technology

Center for Digital Democracy

Citizens for Responsibility and Ethics in Washington (CREW)

Coalition on Human Needs

Consumer Federation of America

Defending Rights and Dissent, Inc.

Demand Progress Education Fund

Equality California

Government Information Watch

National Consumer Law Center (on behalf of its low-income clients)

National Housing Law Project

National Women’s Law Center Action Fund

Oregon Consumer League

Restore The Fourth

Service Employees International Union

---

[1] 91 Fed. Reg. 5,155, 5,155 (Feb. 4, 2026).

[2] Computer Matching and Privacy Protection Act of 1988, Pub. L.

No. 100-503, § 9, 102 Stat. 2507, 2514, codified at 5 U.S.C. § 552a note (warning agencies not to construe the amended Privacy Act as authorizing the “establishment or maintenance by any agency of a national data bank”).

[3] 91 Fed. Reg. at 5,155-5,156. The Treasury seeks the information of the recipients and ultimate beneficiaries of federal programs. This includes individuals, businesses, vendors, contractors, and employees. Id.

[4] See, e.g., EPIC, Comments to the U.S.D.A. Regarding National SNAP Information Database (Jul. 16, 2025), https://epic.org/wp-content/uploads/2025/07/EPIC-comments-USDA-NSID-SORN-071625.pdf.

[5] 91 Fed. Reg. at 5,155 (Feb. 4, 2026).

[6] 91 Fed. Reg. at 5,156.

[7] 5 U.S.C. § 552a(e)(1).

[8] Id.

[9] 91 Fed. Reg. at 5,155.

[10] See 44 U.S.C. § 3101 (requiring agencies to maintain records of agency activities); Computer Security Act, 44 U.S.C. § 3554 (imposing information security requirements on federal agencies).

[11] See 15 U.S.C. § 9058d (creating the Homeowner Assistance Fund).

[12] See 12 U.S.C. §§ 5701 et seq. (creating the State Small Business Credit Initiative and granting the Inspector General of the Department of the Treasury the power to conduct audits).

[13] See 15 U.S.C. § 9058a(g)(1) (requiring the Treasury Department to provide public reports on funds available through the Emergency Rental Assistance Program).  

[14] 44 U.S.C. §§ 3501 et seq.

[15] 91 Fed. Reg. at 5,155.

[16] 5 U.S.C. § 552a(e)(1).

[17] See 12 U.S.C. §§ 5703, 5704. See also, U.S. Dep’t of the Treasury Office of Economic Policy, Notice of Funding Availability: Social Impact Partnerships to Pay for Results Act (SIPPRA) Projects, 88 Fed. Reg. 83,621, 83,621 (Nov. 30, 2023) (detailing the multi-step application and approval process for SIPPRA applicants, including independent evaluations, beneficiary enrollment plans, and detailed descriptions of all partner qualifications and agreements).

[18] See 12 U.S.C. § 5703(c). See also 15 U.S.C. § 9058(a).

[19] As one example, the Inspector General is specifically granted the authority to audit and investigate the use of funds under the State Small Business Credit Initiative. 12 U.S.C. § 5710(a).

[20] 44 U.S.C. § 3506(c)(2)(A)(iv).

[21] 5 U.S.C. § 552a(e)(4)(B).

[22] 5 U.S.C. § 552a(e)(1).

[23] 5 U.S.C. § 552a(a)(7).

[24] 5 U.S.C. § 552a(e)(1).

[25] 91 Fed. Reg. at 5,156.

[26] Id.

[27] Id.

[28] Id. at 5,156-5,157.

[29] OMB, Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act, OMB Circular No. A-108 at 11.

[30] 5 U.S.C. § 552a(a)(7).

[31] 91 Fed. Reg. at 5,156-5,157.

[32] OMB, Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act, OMB Circular No. A-108 at 11.

[33] Id. at 5, 157.