2017-24042. Privacy Act Regulations

AGENCY:

Council of the Inspectors General on Integrity and Efficiency.

ACTION:

Interim final rule.

SUMMARY:

The Council of the Inspectors General on Integrity and Efficiency (CIGIE) is updating its regulations addressing procedures relating to access, maintenance, disclosure, and amendment of records that are in a CIGIE system of records under the Privacy Act of 1974 (Privacy Act) to implement changes in accordance with the Inspector General Empowerment Act of 2016 and to make minor typographical corrections.

DATES:

This interim final rule is effective November 6, 2017. Written comments may be submitted by December 6, 2017.

ADDRESSES:

You may submit comments by any of the following methods:

• Federal eRulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments.
• Email: [e-mail].
• Fax: [phone].
• Mail: Atticus J. Reaser, General Counsel, Council of the Inspectors General on Integrity and Efficiency, 1717 H Street NW., Suite 825, Washington, DC 20006.
• Hand Delivery/Courier: Council of the Inspectors General on Integrity and Efficiency, 1717 H Street NW., Suite 825, Washington, DC 20006.

FOR FURTHER INFORMATION CONTACT:

Atticus J. Reaser, General Counsel, CIGIE, [phone].

SUPPLEMENTARY INFORMATION:

Background Information

CIGIE published its final rule to provide the procedures and guidelines under which CIGIE implements the Privacy Act in the Federal Register, 81 FR 86563, December 1, 2016. The final rule is reflected in part 9801 of the Code of Federal Regulations. On December 16, 2016, the Inspector General Empowerment Act of 2016, Public Law 114-317, 130 Stat. 1595 (IGEA) was signed into law by the President thereby amending the Inspector General Act of 1978, as amended, 5 U.S.C. app., (IG Act) and expanding CIGIE's records maintenance responsibilities to include maintenance of the records of CIGIE's Integrity Committee (IC) by CIGIE's Chairperson. IC records were previously maintained pursuant to the IG Act by the Federal Bureau of Investigation.

In order to conform to the IGEA and meet its obligations thereunder, CIGIE is amending its regulations implementing the Privacy Act. Specifically, CIGIE is amending 5 CFR 9801.102 to accurately reflect the changed custodianship of IC records and adding a new subpart D to address the exemptions necessary to maintain the Privacy Act system of records associated with IC records. CIGIE is also making three minor typographical corrections.

Administrative Procedure Act

Pursuant to 5 U.S.C. 553(d)(3), CIGIE has found that good cause exists for waiving the general notice of proposed rulemaking and public comment procedures as to these amendments and for issuing this interim final rule without a delayed effective date. The notice and comment procedures are being waived because these amendments are being made in accordance with the mandates of the IGEA, which took effect without delay on December 16, 2016. Additionally, these amendments specify exemptions regarding the public's access to information about themselves maintained by CIGIE. The absence of well-defined exemptions to the Privacy Act regulations could impair confidentiality and privacy rights of those who submit sensitive information to CIGIE and the ability of CIGIE to use that information to carry out its statutory mission.

Executive Orders 12866 and 13563

In promulgating this amended rule, CIGIE has adhered to the regulatory philosophy and the applicable principles of regulation set forth in section 1 of Executive Order 12866, Regulatory Planning and Review. The Office of Management and Budget (OMB) has determined that this rule is not “significant” under Executive Order 12866.

Regulatory Flexibility Act

These amended regulations will not have a significant economic impact on a substantial number of small entities. Therefore, a regulatory flexibility analysis under the Regulatory Flexibility Act, as amended, is not required.

Paperwork Reduction Act

These amended regulations impose no additional reporting and recordkeeping requirements. Therefore, clearance by OMB is not required.

Federalism (Executive Order 13132)

This amended rule does not have Federalism implications, as set forth in Executive Order 13132. It will not have substantial direct effects on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government.

List of Subjects in 5 CFR Part 9801

• Information
• Privacy
• Privacy Act
• Records

For the reasons set forth in the preamble, CIGIE amends part 9801 to title 5 of the Code of Federal Regulations as follows:

PART 9801—PRIVACY ACT REGULATIONS

1. The authority citation for part 9801 continues to read as follows:

Authority: Section 11 of the Inspector General Act of 1978, as amended, 5 U.S.C. app.; 5 U.S.C. 301, 552a; 31 U.S.C. 9701.

2. Revise § 9801.102 to read as follows:

§ 9801.102

CIGIE organization.

(a) Centralized program. CIGIE has a centralized Privacy Act program, with one office receiving and coordinating the processing of all Privacy Act requests to CIGIE.

(b) Acceptance of requests and appeals. CIGIE will accept initial requests or appeals regarding CIGIE records.

3. Amend § 9801.105 by revising paragraphs (d) and (i) to read as follows:

§ 9801.105

Employee standards of conduct.

* * * * *

(d) Maintain no system of records without public notice and notify appropriate CIGIE officials of the existence or development of any system of records that is not the subject of a current or planned public notice;

* * * * *

(i) Maintain and use records with care to prevent the unauthorized or inadvertent disclosure of a record to anyone. No record contained in a CIGIE system of records shall be disclosed to another person, or to another agency outside CIGIE, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless the disclosure is otherwise authorized by the Privacy Act; and

* * * * *

4. Amend § 9801.301 by revising paragraph (b)(2) to read as follows:

§ 9801.301

Requests for amendment of record.

* * * * *

(b) * * *

(2) The exact portion of the record the requester seeks to have amended should be indicated clearly. If possible, proposed alternative language should be set forth, or, at a minimum, the reasons why the requester believes the record is not accurate, relevant, timely, or complete should be set forth with enough particularity to permit CIGIE to not only understand the requester's basis for the request, but also to make an appropriate amendment to the record.

* * * * *

5. Add subpart D to read as follows:

Subpart D—Exemptions

§ 9801.401

Exemptions.

(a) General policy. Systems of records maintained by CIGIE are authorized to be exempted from certain provisions of the Privacy Act under the general and specific exemptions set forth in the Privacy Act. In utilizing these exemptions, CIGIE is exempting only those portions of systems that are necessary for the proper functioning of CIGIE and that are consistent with the Privacy Act. Where compliance would not appear to interfere with or adversely affect the law enforcement process, and/or where it may be appropriate to permit individuals to contest the accuracy of the information collected, e.g., public source materials, the applicable exemption may be waived, either partially or totally, by CIGIE, at the sole discretion of CIGIE, as appropriate.

(b) Specific system of records exempted under (j)(2), (k)(1), and (k)(2). The system of records maintained in connection with CIGIE's Integrity Committee, the Integrity Committee Management System (CIGIE-04), is subject to general exemption under 5 U.S.C. 552a(j)(2) and the specific exemptions under 5 U.S.C. 552a(k)(1) and (2). These exemptions apply only to the extent that information in this system is subject to exemption pursuant to 5 U.S.C. 552a(j)(2), (k)(1) and (k)(2). Where compliance would not appear to interfere with or adversely affect the law enforcement process, and/or where it may be appropriate to permit individuals to contest the accuracy of the information collected, e.g., public source materials, the applicable exemption may be waived, either partially or totally, by CIGIE, at the sole discretion of CIGIE, as appropriate.

(1) Pursuant to the provisions of 5 U.S.C. 552a(j)(2), CIGIE-04 is exempt from the following provisions of the Privacy Act: 5 U.S.C. 552a(c)(3) and (c)(4); (d); (e)(1), (e)(2), (e)(3), (e)(4)(G)-(H), (e)(5), and (e)(8); (f); and (g).

(2) Pursuant to the provisions of 5 U.S.C. 552a(k)(1) and (2), CIGIE-04 is exempt from the following provisions of the Privacy Act: 5 U.S.C. 552a(c)(3); (d); (e)(1) and (e)(4)(G)-(H); and (f).

(3) Exemptions from the particular subsections are justified for the following reasons:

(i) From subsection (c)(3) because release of disclosure accounting could alert the subjects of an investigation of an actual or potential criminal, civil, or regulatory violation to the existence of the investigation and the fact that they are subjects of the investigation, and reveal investigative interest by not only CIGIE, through the IC, but also by external agencies such as the Public Integrity Section of the Department of Justice. Because release of such information to the subjects of an investigation would provide them with significant information concerning the nature of the investigation, release could result in the destruction of documentary evidence, improper influencing of witnesses, and other activities that could impede or compromise the investigation. In addition, accounting for each disclosure could result in the release of properly classified information which would compromise the national defense or disrupt foreign policy.

(ii) From subsection (c)(4) because this system is exempt from the access provisions of subsection (d) pursuant to subsections (j) and (k) of the Privacy Act.

(iii) From the access and amendment provisions of subsection (d) because access to the records contained in this system of records could inform the subjects of an investigation of an actual or potential criminal, civil, or regulatory violation of the existence of that investigation and of the nature and scope of the information and evidence obtained as to their activities. Such awareness by the subjects could prevent the successful completion of an investigation and/or lead to the improper influencing of witnesses, the destruction of evidence, or fabricated testimony. In addition, granting access to such information could disclose security-sensitive or confidential business information or information that would constitute an unwarranted invasion of the personal privacy of third parties. Finally, access to the records could result in the release of classified information which would compromise the national defense or disrupt foreign policy. Amendment of the records would interfere with ongoing investigations and law enforcement activities and impose an impossible administrative burden by requiring investigations to be continuously reinvestigated.

(iv) From subsection (e)(1) because the application of this provision could impair investigations and interfere with the law enforcement responsibilities of CIGIE through the IC for the following reasons:

(A) It is not possible to detect relevance or necessity of specific information in the early stages of a civil, criminal, or other law enforcement investigation, case, or matter, including investigations in which use is made of classified information. Relevance and necessity are questions of judgment and timing, and it is only after the information is evaluated that the relevance and necessity of such information can be established.

(B) During the course of any investigation, CIGIE, through the IC, may obtain information concerning actual or potential violations of laws other than those within the scope of its jurisdiction. In the interest of effective law enforcement, CIGIE should retain this information, as it may aid in establishing patterns of criminal activity and can provide valuable leads for Federal and other law enforcement agencies.

(C) In interviewing individuals or obtaining other forms of evidence during an investigation, information may be supplied to an investigator that relates to matters incidental to the primary purpose of the investigation but which may relate also to matters under the investigative jurisdiction of another agency. Such information cannot readily be segregated.

(v) From subsection (e)(2) because, in some instances, the application of this provision would present a serious impediment to law enforcement for the following reasons:

(A) The subjects of an investigation would be placed on notice as to the existence of an investigation and would therefore be able to avoid detection or apprehension, to improperly influence witnesses, to destroy evidence, or to fabricate testimony.

(B) In certain circumstances the subjects of an investigation cannot be required to provide information to investigators, and information relating to their illegal acts, violations of rules of conduct, or any other misconduct must be obtained from other sources.

(C) In any investigation it is necessary to obtain evidence from a variety of sources other than the subjects of the investigation.

(vi) From subsection (e)(3) because the application of this provision would provide the subjects of an investigation with substantial information which could impede or compromise the investigation.

(vii) From subsection (e)(4)(G)-(I) because this system of records is exempt from the access provisions of subsection (d).

(viii) From subsection (e)(5) because the application of this provision may prevent the collection of any data not shown to be accurate, relevant, timely, and complete at the moment it is collected. In the collection of information for law enforcement purposes, it is impossible to determine in advance what information is accurate, relevant, timely, and complete. Material which may seem unrelated, irrelevant, or incomplete when collected may take on added meaning or significance as an investigation progresses. The restrictions of this provision could interfere with the preparation of a complete investigative report, and thereby impede effective law enforcement.

(ix) From subsection (e)(8) because the application of this provision could prematurely reveal an ongoing criminal investigation to the subjects of an investigation and could reveal investigative techniques, procedures, or evidence.

(x) From subsection (f) because CIGIE's rules are inapplicable to those portions of the system that are exempt and would place the burden on CIGIE of either confirming or denying the existence of a record pertaining to a requesting individual, which might in itself provide an answer to that individual relating to an ongoing investigation. The conduct of a successful investigation leading to the indictment of a criminal offender precludes the applicability of established agency rules relating to verification of record, disclosure of the record to that individual, and record amendment procedures for this record system.

(xi) From subsection (g) to the extent that this system is exempt from the access and amendment provisions of subsection (d) pursuant to subsections (j)(2), (k)(1), and (k)(2) of the Privacy Act.

Dated: October 23, 2017.

Michael E. Horowitz,

Chairperson of the Council of the Inspectors General on Integrity and Efficiency.