2018-27798. Privacy Act of 1974; Implementation

AGENCY:

Office of the Inspector General, United States Department of Justice.

ACTION:

Final rule.

SUMMARY:

The Office of the Inspector General (OIG), a component within the United States Department of Justice (DOJ or Department), is finalizing its Privacy Act exemption regulations for the system of records titled, “Data Analytics Program Records System,” JUSTICE/OIG-006, which were published as a Notice of Proposed Rulemaking (NPRM) on March 28, 2018. Specifically, the Department's regulations will exempt the records maintained in JUSTICE/OIG-006 from one or more provisions of the Privacy Act and implement other administrative changes. The exemptions are necessary to avoid interference with the law enforcement functions and responsibilities of OIG. The Department received 21 comments on the NPRM, none of which addressed the substance of the proposed Privacy Act exemption regulations for JUSTICE/OIG-006.

DATES:

This final rule is effective January 25, 2019.

FOR FURTHER INFORMATION CONTACT:

Jonathan M. Malis, General Counsel, Office of the Inspector General, Department of Justice, 950 Pennsylvania Avenue NW, Washington, DC 20530, phone: [phone].

SUPPLEMENTARY INFORMATION:

Pursuant to the Inspector General Act of 1978, as amended, Inspectors General, including the DOJ Inspector General, are responsible for conducting, supervising, and coordinating audits and investigations to recognize and mitigate fraud, waste, and abuse by programs and operations of the Federal agency for which their office is established. On March 28, 2018, OIG published a System of Records Notice (SORN) for its system of records titled, “Data Analytics Program Records System,” JUSTICE/OIG-006, 83 FR 13309 (March 28, 2018), for the records collected to implement its data analytics (DA) program. The DA program will assist with the performance of OIG audits, investigations, and reviews, and accommodate the requirements of the Digital Accountability and Transparency Act of 2014, Public Law 113-101, 128 Stat. 1146. Specifically, the DA program will provide OIG: timely insights from the data already stored in DOJ databases that OIG has legal authorization to access and maintain; the ability to monitor and analyze data for patterns and correlations that signal wasteful, fraudulent, or abusive activities impacting Department performance and operations; the ability to find, acquire, extract, manipulate, analyze, connect, and visualize data; the capability to manage vast amounts of data; the ability to identify significant information that can improve decision quality; and the ability to mitigate risk of waste, fraud, and abuse.

On the same day OIG published JUSTICE/OIG-006, OIG published a Notice of Proposed Rulemaking (NPRM), 83 FR 13208 (March 28, 2018), proposing to exempt records maintained in JUSTICE/OIG-006 from certain provisions of the Privacy Act pursuant to 5 U.S.C. 552a(j) and (k). Additionally, as an administrative matter, OIG proposed replacing the current regulations promulgated in paragraphs (c) and (d) of 28 CFR 16.75 with the proposed regulations for JUSTICE/OIG-006. The current regulations promulgated in paragraphs (c) and (d) exempt from certain provisions of the Privacy Act a previously rescinded OIG SORN, “Office of the Inspector General, Freedom of Information/Privacy Acts (FOI/PA) Records,” JUSTICE/OIG-003, 66 FR 29994 (June 4, 2001), and are no longer needed. The Department invited public comment on the proposed regulations. The comment period was open through April 27, 2018. DOJ received 21 comments on the NPRM, none of which addressed the substance of the proposed Privacy Act exemption regulations for JUSTICE/OIG-006. Two of the comments mentioned concerns with “data mining,” but those concerns were expressed in the context of applications on web servers collecting information about shoppers' and users' habits, which is not relevant to the use or purpose of the DA program. The remaining comments touched on numerous other, unrelated topics such as the Environmental Protection Agency and environmental concerns, Russia's attempt to stop American oil and gas drilling, the commodities exchange, and the Consumer Financial Protection Bureau.

After consideration of these public comments, the Department will codify in this final rule the regulations proposed in the NPRM to protect the ability of the OIG to properly engage in its law enforcement functions. Three administrative changes have been made to the regulations proposed in the NPRM. First, in § 16.75(d)(1), the term “interest” in the second sentence is revised to read, “interests.” Second, in § 16.75(d)(3), the term “his” in the first sentence is revised to read, “the subject's.” Third, in § 16.75(d)(8), a duplicative use of the word “could” has been removed.

Executive Orders 12866 and 13563—Regulatory Review

This regulation has been drafted and reviewed in accordance with Executive Order 12866, “Regulatory Planning and Review” section 1(b), Principles of Regulation, and Executive Order 13563 “Improving Regulation and Regulatory Review” section 1(b), General Principles of Regulation.

The Department of Justice has determined that this rule is not a “significant regulatory action” under Executive Order 12866, section 3(f), and accordingly this final rule has not been reviewed by the Office of Management and Budget, Office of Information and Regulatory Affairs, in accordance with Executive Order 12866.

Regulatory Flexibility Act

This regulation will only impact Privacy Act-protected records, which are personal and generally do not apply to an individual's entrepreneurial capacity, subject to limited exceptions. Accordingly, the Chief Privacy and Civil Liberties Officer, in accordance with the Regulatory Flexibility Act (5 U.S.C. 605(b)), has reviewed this regulation and by approving it certifies that this regulation will not have a significant economic impact on a substantial number of small entities.

Executive Order 13132—Federalism

This regulation will not have substantial direct effects on the States, on the relationship between the national government and the States, or on distribution of power and responsibilities among the various levels of government. Therefore, in accordance with Executive Order 13132, it is determined that this rule does not have sufficient federalism implications to warrant the preparation of a Federalism Assessment.

Executive Order 12988—Civil Justice Reform

This regulation meets the applicable standards set forth in sections 3(a) and 3(b)(2) of Executive Order 12988 to eliminate drafting errors and ambiguity, minimize litigation, provide a clear legal standard for affected conduct, and promote simplification and burden reduction.

Executive Order 13175—Consultation and Coordination With Indian Tribal Governments

This regulation will not impact Indian Tribal governments. More specifically, it does not have substantial direct effects on one or more Indian tribes, on the relationship between the Federal government and Indian tribes, or on the distribution of power and responsibilities between the Federal government and Indian tribes. Therefore, the consultation requirements of Executive Order 13175 do not apply.

Unfunded Mandates Reform Act of 1995

This regulation will not result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100,000,000, as adjusted for inflation, or more in any one year, and it will not significantly or uniquely affect small governments. Therefore, no actions were deemed necessary under the provisions of the Unfunded Mandates Reform Act of 1995.

Congressional Review Act

This rule is not a major rule as defined by 5 U.S.C. 804 of the Congressional Review Act.

Paperwork Reduction Act

This rule imposes no information collection or recordkeeping requirements.

List of Subjects in 28 CFR Part 16

• Administrative practices and procedures
• Courts
• Freedom of information, and the Privacy Act

Pursuant to the authority vested in the Attorney General by 5 U.S.C. 552a and delegated to me by Attorney General Order 2940-2008, the Department of Justice amends 28 CFR part 16 as follows:

PART 16—PRODUCTION OR DISCLOSURE OF MATERIAL OR INFORMATION

1. The authority citation for part 16 continues to read as follows:

Authority: 5 U.S.C. 301, 552, 552a, 553; 28 U.S.C. 509, 510, 534; 31 U.S.C. 3717.

Subpart E—Exemption of Records Systems Under the Privacy Act

2. Amend § 16.75 by revising paragraphs (c) and (d) to read as follows:

§ 16.75

Exemption of the Office of the Inspector General Systems/Limited Access.

* * * * *

(c) The Data Analytics Program Records System (JUSTICE/OIG-006) system of records is exempt from 5 U.S.C. 552a(c)(3) and (4); (d); (e)(1), (2), (3), (5) and (8); and (g) of the Privacy Act. These exemptions apply only to the extent that information in this system is subject to exemption pursuant to 5 U.S.C. 552a(j) and/or (k). Where compliance would not appear to interfere with or adversely affect the law enforcement process, and/or where it may be appropriate to permit individuals to contest the accuracy of the information collected, e.g., public source materials, the applicable exemption may be waived, either partially or totally, by OIG.

(d) Exemptions from the particular subsections are justified for the following reasons:

(1) From subsection (c)(3), the requirement that an accounting be made available to the named subject of a record, because release of disclosure accounting could alert the subject of an investigation of an actual or potential criminal, civil, or regulatory violation to the existence of an investigation and the fact that the individual is the subject of the investigation. Such a disclosure could also reveal investigative interests by not only OIG, but also by the recipient agency or component. Since release of such information to the subjects of an investigation would provide them with significant information concerning the nature of the investigation, release could result in the destruction of documentary evidence, improper influencing of witnesses, endangerment of the physical safety of confidential sources, witnesses, and law enforcement personnel, the fabrication of testimony, flight of the subject from the area, and other activities that could impede or compromise the investigation. In addition, providing the individual an accounting for each disclosure could result in the release of properly classified information which would compromise the national defense or disrupt foreign policy.

(2) From subsection (c)(4) notification requirements, for the same reasons that justify exempting this system from the access and amendment provisions of subsection (d), and similarly, from the accounting of disclosures provision of subsection (c)(3). The DOJ takes seriously its obligation to maintain accurate records despite its assertion of this exemption, and to the extent it, in its sole discretion, agrees to permit amendment or correction of DOJ records, it will share that information in appropriate cases.

(3) From subsection (d), the access and amendment provisions, because access to the records contained in this system of records could inform the subject of an investigation of an actual or potential criminal, civil, or regulatory violation, of the existence of the investigation; of the nature and scope of the information and evidence obtained as to the subject's activities; of the identity of confidential sources, witnesses, and law enforcement personnel, and of information that may enable the subject to avoid detection or apprehension. These factors would present a serious impediment to effective law enforcement where they prevent the successful completion of the investigation, endanger the physical safety of confidential sources, witnesses, and law enforcement personnel, and/or lead to the improper influencing of witnesses, the destruction of evidence, or the fabrication of testimony. In addition, granting access to such information could disclose security-sensitive or confidential business information or information that would constitute an unwarranted invasion of the personal privacy of third parties. Finally, access to the records could result in the release of properly classified information that would compromise the national defense or disrupt foreign policy. Amendment of the records would interfere with ongoing investigations and law enforcement activities and impose an impossible administrative burden by requiring investigations to be continuously reinvestigated.

(4) From subsection (e)(1), because the application of this provision could impair investigations and interfere with the law enforcement responsibilities of the OIG for the following reasons:

(i) It is not possible to determine the relevance or necessity of specific information in the early stages of a civil, criminal or other law enforcement investigation, case, or matter, including investigations in which use is made of properly classified information. Relevance and necessity are questions of judgment and timing, and it is only after the information is evaluated that the relevance and necessity of such information can be established.

(ii) During the course of any investigation, the OIG may obtain information concerning actual or potential violations of laws other than those within the scope of its jurisdiction. In the interest of effective law enforcement, the OIG should retain this information in accordance with applicable record retention procedures, as it may aid in establishing patterns of criminal activity, and can provide valuable leads for Federal and other law enforcement agencies.

(iii) In interviewing individuals or obtaining other forms of evidence during an investigation, information may be supplied to an investigator which relates to matters incidental to the primary purpose of the investigation but which may also relate to matters under the investigative jurisdiction of another agency. Such information cannot readily be segregated.

(5) From subsection (e)(2), because, in some instances, the application of this provision would present a serious impediment to law enforcement for the following reasons:

(i) The subject of an investigation would be placed on notice as to the existence of an investigation and would therefore be able to avoid detection or apprehension, to improperly influence witnesses, to destroy evidence, or to fabricate testimony.

(ii) In certain circumstances the subject of an investigation cannot be required to provide information to investigators, and information relating to a subject's illegal acts, violations of rules of conduct, or any other misconduct must be obtained from other sources.

(iii) In any investigation it is necessary to obtain evidence from a variety of sources other than the subject of the investigation in order to verify the evidence necessary for successful litigation.

(6) From subsection (e)(3), because the application of this provision would provide the subject of an investigation with substantial information which could impede or compromise the investigation. Providing such notice to a subject of an investigation could interfere with an undercover investigation by revealing its existence, and could endanger the physical safety of confidential sources, witnesses, and investigators by revealing their identities.

(7) From subsection (e)(5), because the application of this provision would prevent the collection of any data not shown to be accurate, relevant, timely, and complete at the moment it is collected. In the collection of information for law enforcement purposes, it is impossible to determine in advance what information is accurate, relevant, timely, and complete. Material that may seem unrelated, irrelevant, or incomplete when collected may take on added meaning or significance as an investigation progresses. The restrictions of this provision could interfere with the preparation of a complete investigative report, and thereby impede effective law enforcement.

(8) From subsection (e)(8), because to require individual notice of disclosure of information due to compulsory legal process would pose an impossible administrative burden on OIG and may alert the subjects of law enforcement investigations, who might be otherwise unaware, to the fact of those investigations. Such notice could also reveal investigative techniques, procedures, or evidence.

(9) From subsection (g), to the extent that this system is exempt from the access and amendment provisions of subsection (d), pursuant to subsections (j)(2), (k)(1), and (k)(2) of the Privacy Act.

Dated: December 18, 2018.

Peter A. Winn,

Acting Chief Privacy and Civil Liberties Officer, United States Department of Justice.