The Department of Defense (DoD) is undertaking a notable change in how it manages official travel data for its vast workforce. Effective August 25, 2026, the DoD is modifying and reissuing its "Defense Travel System" (DTS) system of records. This action also involves the consolidation of DTS with the "Commercial Travel Information Management System" (CTIM) system of records, with the latter to be rescinded. This move marks a significant effort by the DoD to centralize its travel data management, aiming for enhanced operational efficiency and streamlined reporting across all its components. The public is invited to comment on specific aspects of these changes, particularly the updated "routine uses," until September 24, 2026.
Understanding the Federal Privacy Act Framework
At the core of this development is the Privacy Act of 1974. This federal statute regulates the collection, maintenance, use, and dissemination of personal information by federal agencies. A System of Records Notice (SORN) is a public declaration an agency must issue whenever it creates or significantly modifies a system of records that retrieves information by an individual's name or other identifier. SORNs inform the public about what data is collected, why it is collected, how it is used, and to whom it may be disclosed, including through "routine uses." For individuals, the Privacy Act grants rights regarding their records, such as access and amendment. The DoD's current action is a compliance step under this Act, signaling important changes in how personal travel data is handled.
The Consolidation: DTS and CTIM Merge
The existing DTS, titled "DHRA 08 DoD," has served as the DoD's primary system for managing temporary duty (TDY) travel, encompassing everything from pre-travel arrangements to post-travel payments. It collects personal information, travel itineraries, financial data, and supporting documentation to verify eligibility, facilitate arrangements, ensure compliance, and process payments. Concurrently, CTIM, previously "DHRA 14 DoD," has functioned as a repository for DoD travel records, including those booked through DTS and commercial vendors. Its purposes ranged from satisfying reporting requirements and identifying travelers in distress to assisting with planning, budgeting, and fraud detection.
The decision to combine these two systems into a single, modified DTS aims to create a more unified approach to travel data management. According to the DoD, this consolidation is intended to improve clarity, update information, and integrate functions that were previously separate. This means a single, comprehensive repository for all official DoD travel data, potentially simplifying oversight and analysis but also centralizing a larger volume of sensitive personal information.
Expanded Disclosures: Updates to Routine Uses
One of the most notable aspects of this modification is the revision and expansion of the "routine uses" section. Routine uses allow agencies to disclose records outside the DoD without the individual's prior consent, provided the disclosure is compatible with the purpose for which the record was collected. The DoD has reorganized its standard routine uses (A through J) for clarity and consistency. More significantly, it has updated Routine Use (M) to broaden and clarify disclosures to banking establishments.
Crucially, Routine Use (R) has been added to incorporate the Department of the Treasury's "Do Not Pay" routine use clause. The "Do Not Pay" initiative is a government-wide program designed to prevent erroneous payments by allowing agencies to check payment requests against databases of individuals and entities deemed ineligible for federal payments. The inclusion of this clause means that personal travel data, including financial information, can now be systematically shared with the Treasury Department for fraud prevention purposes. While intended to safeguard taxpayer money, this expansion of data sharing underscores the increasing interoperability of federal data systems and raises the profile of privacy considerations for individuals whose data is now subject to a wider array of disclosures.
Data Collection: A Broad Scope of Information and Individuals
The updated SORN outlines the extensive categories of individuals whose data will be managed and the types of records collected. The system covers a wide array of personnel, including DoD civilian employees, active, former, and retired military members, Reserve and National Guard personnel, military academy nominees, applicants, and cadets. It also includes other individuals traveling on DoD orders, dependents accompanying sponsors, and registered website guests who submit inquiries regarding commercial travel.
The records collected are comprehensive and sensitive, including full name, Social Security Number (SSN) or truncated SSN, DoD ID Number, sex, date of birth, various addresses, email, phone numbers, and emergency contact information. Employment details such as service/agency, duty station, title/rank, and civilian/military status are also gathered. Travel and identification records include passport and visa information, frequent flier details, itineraries, reservations, vouchers, receipts, and supporting documentation. Critically, financial information such as government travel charge card (GTCC) details, expiration dates, and personal checking and savings account numbers are part of this system. Unique to DTS are the last four digits of the SSN and bank routing information, while CTIM's contributions include truncated SSN, GTCC transactions, government accounting codes, budget data, cellular phone providers, and foreign identification numbers for foreign nationals on invitational orders. This vast collection underscores the critical need for robust data security and strict adherence to privacy protocols.
Implications and Public Oversight
The consolidation and expansion of data sharing have dual implications. On one hand, the DoD's stated goals of enhanced efficiency, streamlined reporting, improved resource allocation, and advanced fraud detection are legitimate government interests. A unified system could lead to better management of travel expenditures and ensure compliance with federal regulations. On the other hand, the centralization of such extensive and sensitive personal and financial data for a broad spectrum of individuals, coupled with expanded routine uses, necessitates rigorous oversight and transparent accountability. The addition of the "Do Not Pay" clause, while a fraud prevention measure, means personal data collected for travel purposes may now be used for payment eligibility verification across federal agencies.
The public comment period, specifically for the routine uses, provides an opportunity for affected individuals and privacy advocates to voice concerns or offer suggestions. This mechanism is vital for ensuring that the balance between government efficiency and individual privacy remains appropriate and that any potential unintended consequences of expanded data sharing are considered before these uses become fully effective.
Conclusion
The DoD's modification and reissuance of the Defense Travel System SORN represents a significant step towards modernizing and integrating its travel data management infrastructure. While promising greater efficiency and improved fraud detection capabilities, the expanded scope of data collection and, particularly, the new routine uses for data disclosure, including the "Do Not Pay" clause, underscore the ongoing tension between operational requirements and individual privacy rights within the federal government. As these changes become fully implemented, continued vigilance and adherence to Privacy Act principles will be essential to safeguard the sensitive information of millions of individuals associated with the DoD. The coming weeks will be important for public input as the final shape of these data sharing provisions is determined.
