2022-27143. Privacy Act of 1974; Implementation

AGENCY:

Office of the Secretary of Defense, Department of Defense (DoD).

ACTION:

Direct final rule with request for comments.

SUMMARY:

The Department of Defense (DoD or Department) is giving concurrent notice of a new Department-wide system of records, “Declared Public Health Emergency Exposure Records,” DoD-0013, and this rulemaking, which exempts portions of this system of records from certain provisions of the Privacy Act of 1974, as amended, because of national security requirements. This rule is being published as a direct final rule as the Department does not expect to receive any adverse comments. If such comments are received, this direct final rule will be cancelled and a proposed rule for comments will be published.

DATES:

The rule will be effective on February 24, 2023 unless comments are received that would result in a contrary determination. Comments will be accepted on or before February 14, 2023.

ADDRESSES:

You may submit comments, identified by docket number, Regulation Identifier Number (RIN), and title, by any of the following methods.

* Federal Rulemaking Portal: https://www.regulations.gov.

Follow the instructions for submitting comments.

* Mail: Department of Defense, Office of the Assistant to the Secretary of Defense for Privacy, Civil Liberties, and Transparency, Regulatory Directorate, 4800 Mark Center Drive, Attn: Mailbox 24, Suite 08D09, Alexandria, VA 22350-1700.

Instructions: All submissions received must include the agency name and docket number or RIN for this Federal Register document. The general policy for comments and other submissions from members of the public is to make these submissions available for public viewing on the internet at https://www.regulations.gov as they are received without change, including any personal identifiers or contact information.

FOR FURTHER INFORMATION CONTACT:

Ms. Rahwa Keleta, Privacy and Civil Liberties Division, Directorate for Privacy, Civil Liberties and Freedom of Information, Office of the Assistant to the Secretary of Defense for Privacy, Civil Liberties, and Transparency, Department of Defense, 4800 Mark Center Drive, Mailbox #24, Suite 08D09, Alexandria, VA 22350-1700; [e-mail]; [phone].

SUPPLEMENTARY INFORMATION:

I. Background

In accordance with the Privacy Act of 1974, DoD is establishing a new Department-wide system of records titled “Declared Public Health Emergency Exposure Records” DoD-0013. This system of records covers DoD's collection, use, and maintenance of records about individuals necessitated as a result of a declared public health emergency. These records are maintained to assist the DoD in establishing safe environments, identifying and protecting DoD-affiliated individuals at risk of transmission of or contracting the disease or agent at issue, and in supporting mission readiness.

II. Privacy Act Exemption

The Privacy Act permits Federal agencies to exempt eligible records in a system of records from certain provisions of the Act, including the provisions providing individuals with a right to request access to and amendment of their own records and accountings of disclosures of such records. If an agency intends to exempt a particular system of records, it must first go through the rulemaking process to provide public notice and an opportunity to comment on the proposed exemption. The Office of the Secretary is amending 32 CFR part 310 to add a new Privacy Act exemption rule for this system of records. The DoD is claiming an exemption for this system of records because some of its records may contain classified national security information and providing notice, access, amendment, and disclosure of accounting of those records to an individual, as well as certain record-keeping requirements, may cause damage to national security. The Privacy Act, pursuant to 5 U.S.C. 552a(k)(1), authorizes agencies to claim an exemption for systems of records that contain information properly classified pursuant to executive order. DoD is claiming an exemption from several provisions of the Privacy Act, including various access, amendment, disclosure of accounting, and certain record-keeping and notice requirements, to prevent disclosure of any information properly classified pursuant to executive order, as implemented by DoD Instruction 5200.01 and DoD Manual 5200.01, Volumes 1 and 3.

III. Direct Final Rulemaking

This rule is being published as a direct final rule as the Department does not expect to receive any significant adverse comments. If such comments are received, this direct final rule will be cancelled and a proposed rule for comments will be published. If no such comments are received, this direct final rule will become effective ten days after the comment period expires.

For purposes of this rulemaking, a significant adverse comment is one that explains (1) why the rule is inappropriate, including challenges to the rule's underlying premise or approach; or (2) why the direct final rule will be ineffective or unacceptable without a change. In determining whether a significant adverse comment necessitates withdrawal of this direct final rule, the Department will consider whether the comment raises an issue that would have warranted a substantive response had it been submitted in response to a standard notice of a proposed rule. A comment recommending an addition to the rule will not be considered significant and adverse unless the comment explains how this direct final rule would be ineffective without the addition.

This direct final rule adds to the DoD's Privacy Act exemptions for Department-wide systems of records found in 32 CFR 310.13. Records in this system of records are only exempt from the Privacy Act to the extent the purposes underlying the exemption pertain to the record. A notice of a new system of records for DoD-0013 is also published in this issue of the Federal Register .

Regulatory Analysis

Executive Order 12866, “Regulatory Planning and Review” and Executive Order 13563, “Improving Regulation and Regulatory Review”

Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distribute impacts, and equity). Executive Order 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. It has been determined that this rule is not a significant regulatory action under these executive orders.

Congressional Review Act

The Congressional Review Act, 5 U.S.C. 801 et seq., generally provides that before a rule may take effect, the agency promulgating the rule must submit a rule report, which includes a copy of the rule, to each House of the Congress and to the Comptroller General of the United States. DoD will submit a report containing this rule and other required information to the U.S. Senate, the U.S. House of Representatives, and the Comptroller General of the United States. A major rule cannot take effect until 60 days after it is published in the Federal Register . This direct final rule is not a “major rule” as defined by 5 U.S.C. 804(2).

Public Law 96-354, “Regulatory Flexibility Act” (5 U.S.C. Chapter 6)

The Assistant to the Secretary of Defense for Privacy, Civil Liberties, and Transparency has certified that this rule is not subject to the Regulatory Flexibility Act (5 U.S.C. 601) because it would not, if promulgated, have a significant economic impact on a substantial number of small entities. This rule is concerned only with the administration of Privacy Act systems of records within the DoD. Therefore, the Regulatory Flexibility Act, as amended, does not require DoD to prepare a regulatory flexibility analysis.

Public Law 96-511, “Paperwork Reduction Act” (44 U.S.C. Chapter 35)

The Paperwork Reduction Act (PRA) was enacted to minimize the paperwork burden for individuals; small businesses; educational and nonprofit institutions; Federal contractors; State, local and tribal governments; and other persons resulting from the collection of information by or for the Federal government. The Act requires agencies obtain approval from the Office of Management and Budget before using identical questions to collect information from ten or more persons. This rule does not impose reporting or recordkeeping requirements on the public.

Section 202, Public Law 104-4, “Unfunded Mandates Reform Act”

Section 202 of the Unfunded Mandates Reform Act of 1995 (UMRA) (2 U.S.C. 1532) requires agencies to assess anticipated costs and benefits before issuing any rule whose mandates may result in the expenditure by State, local and tribal governments in the aggregate, or by the private sector, in any one year of $100 million in 1995 dollars, updated annually for inflation. This rule will not mandate any requirements for State, local, or tribal governments, nor will it affect private sector costs.

Executive Order 13132, “Federalism”

Executive Order 13132 establishes certain requirements that an agency must meet when it promulgates a rule that imposes substantial direct requirement costs on State and local governments, preempts State law, or otherwise has Federalism implications. This rule will not have a substantial effect on State and local governments.

Executive Order 13175, “Consultation and Coordination With Indian Tribal Governments”

Executive Order 13175 establishes certain requirements that an agency must meet when it promulgates a rule that imposes substantial direct compliance costs on one or more Indian tribes, preempts tribal law, or effects the distribution of power and responsibilities between the federal government and Indian tribes. This rule will not have a substantial effect on Indian tribal governments.

List of Subjects in 32 CFR Part 310

• Privacy

Accordingly, 32 CFR part 310 is amended as follows:

PART 310—[AMENDED]

1. The authority citation for part 310 continues to read as follows:

Authority: 5 U.S.C. 552a.

2. Amend § 310.13 by adding paragraph (e)(12) to read as follows:

§ 310.13

Exemptions for DoD-wide systems.

* * * * *

(e) * * *

(12) System identifier and name. DoD-0013, “Declared Public Health Emergency Exposure Records”

(i) Exemptions. This system of records is exempt from 5 U.S.C. 552a(c)(3); (d)(1), (2), (3), and (4); (e)(1); (e)(4)(G), (H), and (I); and (f).

(ii) Authority.5 U.S.C. 552a(k)(1).

(iii) Exemption from the particular subsections. Exemption from the particular subsections of the Privacy Act of 1974, as amended, pursuant to exemption (k)(1) is justified for the following reasons:

(A) Subsections (c)(3), (d)(1), and (d)(2). Records in this system of records may contain information concerning individuals that is properly classified pursuant to executive order. Application of exemption (k)(1) for such records may be necessary because access to and amendment of the records, or release of the accounting of disclosures for such records, could reveal classified information. Disclosure of classified records to an individual may cause damage to national security. Accordingly, application of exemption (k)(1) may be necessary.

(B) Subsections (d)(3) and (4). These subsections are inapplicable to the extent an exemption is claimed from (d)(2).

(C) Subsection (e)(1). Records within this system may be properly classified pursuant to executive order. In the collection of information for historical activities, it is not always possible to conclusively determine the relevance and necessity of particular information in the early stages of these types of activities. Additionally, disclosure of classified records to an individual may cause damage to national security. Accordingly, application of exemption (k)(1) may be necessary.

(D) Subsections (e)(4)(G) and (H) and Subsection (f). These subsections are inapplicable to the extent exemption is claimed from the access and amendment provisions of subsection (d). Because portions of this system are exempt from the individual access and amendment provisions of subsection (d) for the reasons noted above, DoD is not required to establish requirements, rules, or procedures with respect to such access or amendment provisions. Providing notice to individuals with respect to the existence of records pertaining to them in the system of records or otherwise setting up procedures pursuant to which individuals may access, view, and seek to amend records pertaining to themselves in the system would potentially undermine national security and the confidentiality of classified information. Accordingly, application of exemption (k)(1) may be necessary.

(E) Subsection (e)(4)(I). To the extent that this provision is construed to require more detailed disclosure than the broad information currently published in the system notice concerning categories of sources of records in the system, an exemption from this provision is necessary to protect national security and the confidentiality of sources and methods, and other classified information.

(iv) Exempt records from other systems. In the course of carrying out the overall purpose for this system, exempt records from other systems of records may in turn become part of the records maintained in this system. To the extent that copies of exempt records from those other systems of records are maintained in this system, the DoD claims the same exemptions for the records from those other systems that are entered into this system, as claimed for the prior system(s) of which they are a part, provided the reason for the exemption remains valid and necessary.

Dated: December 9, 2022.

Aaron T. Siegel,

Alternate OSD Federal Register Liaison Officer, Department of Defense.