2023-26516. Privacy

AGENCY:

Federal Labor Relations Authority.

ACTION:

Final rule.

SUMMARY:

This final rule adopts, with one change, the proposed rule published in the Federal Register on October 11, 2023. The rule updates procedures under the Privacy Act for requesting information from the Federal Labor Relations Authority (FLRA) and procedures that the FLRA follows in responding to requests from the public, in order to reflect changes in the law and the FLRA's organization since the regulations were last updated.

DATES:

This final rule is effective January 3, 2024.

FOR FURTHER INFORMATION CONTACT:

Thomas Tso, Solicitor, Senior Agency Official for Privacy, at (771) 444–5779.

SUPPLEMENTARY INFORMATION:

On October 11, 2023, the FLRA published a proposed rule in the Federal Register at 88 FR 70374, amending its regulations under the Privacy Act to update procedures for requesting information from the FLRA and procedures that the FLRA follows in responding to requests from the public, in order to reflect changes in the law and the FLRA's organization since the regulations were last updated. These revised regulations account for issues that have arisen since the regulations were last updated. The FLRA solicited written comments; and requested that any such comments be submitted by November 13, 2023.

The FLRA received one comment on the proposed rule from the American Association of Nurse Practitioners, which suggested changing “physician” to “licensed health care professional” in § 2412.6(d). The FLRA agrees with this change as a requester's provider of choice may not be a physician, but another licensed health care professional, such as a nurse practitioner. Other agencies have also utilized the broader term in similar situations. See, e.g.,5 CFR 1830.4, 45 CFR 164.502(g)(3)(ii)(C). Based on the rationale set forth in the proposed rule and this document, the FLRA is thus adopting the proposed rule as the final rule with this one change.

Regulatory Flexibility Act Certification

Pursuant to section 605(b) of the Regulatory Flexibility Act, 5 U.S.C. 605(b), the FLRA has determined that this regulation, as amended, will not have a significant impact on a substantial number of small entities. The Privacy Act primarily affects individuals and not entities and the final rule would impose no duties or obligations on small entities.

Unfunded Mandates Reform Act of 1995

This rule will not result in the expenditure by state, local, and tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more in any one year, and it will not significantly or uniquely affect small governments. Therefore, no actions were deemed necessary under the provisions of the Unfunded Mandates Reform Act of 1995.

Small Business Regulatory Enforcement Fairness Act of 1996

This action is not a major rule as defined by section 804 of the Small Business Regulatory Enforcement Fairness Act of 1996, 5 U.S.C. 804. This rule will not result in an annual effect on the economy of $100,000,000 or more; a major increase in costs or prices; or significant adverse effects on competition, employment, investment, productivity, innovation, or on the ability of United States-based companies to compete with foreign-based companies in domestic and export markets.

Paperwork Reduction Act of 1995

The regulations contain no additional information collection or record-keeping requirements under the Paperwork Reduction Act of 1995, 44 U.S.C. 3501, et seq.

List of Subjects in 5 CFR Part 2412

• Privacy Act

For the reasons stated in the preamble, the FLRA revises 5 CFR part 2412 to read as follows:

PART 2412—PRIVACY

2412.1

Purpose and scope.

2412.2

Definitions.

2412.3

Notice and publication.

2412.4

Existence-of-records requests.

2412.5

Individual access requests.

2412.6

Records about other individuals, medical records, and limitations on disclosures.

2412.7

Initial decision on access requests.

2412.8

Accountings of disclosures and requests for accountings.

2412.9

Requests for amendment or correction of records.

2412.10

Initial decision on amendment or correction.

2412.11

Amendment or correction of previously disclosed records.

2412.12

Agency review of refusal to inform, to provide access to, or to amend or correct records.

2412.13

Fees.

2412.14

Penalties.

2412.15

Exemptions.

Authority: 5 U.S.C. 552a.

§ 2412.1

Purpose and scope.

This part contains the regulations that the Federal Labor Relations Authority (FLRA), including the Authority component (Authority), the General Counsel of the FLRA (General Counsel), the Inspector General (IG), and the Federal Service Impasses Panel (Panel), follow under the Privacy Act of 1974, as amended, 5 U.S.C. 552a. These regulations should be read together with the Privacy Act, which provides additional information about records maintained on individuals. The regulations apply to all records maintained by the Authority, the General Counsel, the IG, and the Panel that are contained in a system of records, as defined at § 2412.2(d), and that are retrieved by an individual's name or personal identifier. They describe the procedures by which individuals may request access to records about themselves, request amendment or correction of those records, and request an accounting of disclosures of those records. In addition, the regulations limit the access of other persons to those records. The Authority, the General Counsel, the IG, and the Panel also process all Privacy Act requests for access to records under the Freedom of Information Act, 5 U.S.C. 552, giving requesters the benefit of both statutes. These regulations do not relate to those personnel records of Federal Government employees, which are under the Office of Personnel Management's (OPM) jurisdiction, to the extent such records are subject to OPM regulations.

§ 2412.2

Definitions.

For the purposes of this part—

Individual means a citizen of the United States or an alien lawfully admitted for permanent residence.

Maintain includes maintain, collect, use, or disseminate.

Record means any item, collection, or grouping of information about an individual that is maintained by the Authority, the General Counsel, the IG, or the Panel including, but not limited to, information regarding the individual's education, financial transactions, medical history, and criminal or employment history, that contains the individual's name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph.

Request for access to a record means a request made under the Privacy Act, 5 U.S.C. 552a(d)(1).

Request for amendment or correction of a record means a request made under the Privacy Act, 5 U.S.C. 552a(d)(2).

Request for an accounting means a request made under the Privacy Act, 5 U.S.C. 552a(c)(3).

Requester means an individual who makes an existence-of-records request, a request for access, a request for amendment or correction, or a request for an accounting under the Privacy Act.

Routine use means, with respect to the disclosure of a record, the use of such record for a purpose which is compatible with the purpose for which it was collected.

System of records means a group of any records under the control of the Authority, the General Counsel, the IG, or the Panel from which information is retrieved by the name of the individual or by some identifying particular assigned to the individual.

§ 2412.3

Notice and publication.

The Authority, the General Counsel, the IG, and the Panel will publish in the Federal Register such notices describing systems of records as are required by law.

§ 2412.4

Existence-of-records requests.

(a) If you want to know whether a system of records maintained by the Authority, the General Counsel, the IG, or the Panel contains a record pertaining to you, you may submit a written existence-of-records request by mail to the FLRA's Solicitor or IG, as appropriate, at the Authority's offices in Washington, DC, or by email to [e-mail].

(b) You should clearly and prominently identify your request as a Privacy Act request. If you submit the request by mail, it should bear the mark “Privacy Act Request” on the envelope or other cover, as well as your return address. If you submit the request by email, the subject line of the email should include the phrase “Privacy Act Request.” If you do not comply with the provisions of this paragraph, your request will not be deemed received until the time it is actually received by the FLRA's Solicitor or IG.

(c) An existence-of-records request must include your name and address and must reasonably describe the system of records in question. Whenever possible, the request should also describe the time periods in which you believe the records were compiled and the name or identifying number of each system of records in which you believe the records are kept. The Authority, the General Counsel, the IG, and the Panel have published descriptions of the systems of records they maintain in the Federal Register .

(d) When you make an existence-of-records request regarding records about yourself, you must verify your identity. You must state your full name, current address, and date and place of birth. You must sign your request and your signature must either be notarized or submitted by you under 28 U.S.C. 1746, a law that permits statements to be made under penalty of perjury as a substitute for notarization. In order to help the identification and location of requested records, you may also, at your option, include your social security number.

(e) When making an existence-of-records request as the parent or guardian of a minor or as the guardian of someone determined by a court to be incompetent, you must establish:

(1) The identity of the individual who is the subject of the record, by stating the name, current address, date and place of birth, and, at your option, the social security number of the individual;

(2) Your own identity, following the requirements of paragraph (d) of this section;

(3) That you are the parent or guardian of that individual, which you may prove by providing a copy of the individual's birth certificate showing your parentage or by providing a court order establishing your guardianship; and

(4) That you are acting on behalf of that individual in making the request.

(f) The Solicitor or IG, as appropriate, will advise you in writing within ten (10) working days from receipt of your request whether the system of records you identified contains a record pertaining to you or to the individual for whom you are a parent or guardian and, if so, the office in which that record is located. If the Solicitor or IG is prohibited from, or there is otherwise an exemption that prevents, disclosing whether a system of records contains a record pertaining to you or to the individual for whom you are a parent or guardian, you will be notified in writing of the reasons of that determination, and of your right to appeal that determination under the provisions § 2412.12.

§ 2412.5

Individual access requests.

(a) You may make a request for access to a record about yourself that is contained in a system of records maintained by the Authority, the General Counsel, the IG, or the Panel by submitting a written request reasonably identifying the records sought to be inspected or copied by mail to the FLRA's Solicitor or the IG at the Authority's offices in Washington, DC, or by email to [e-mail]. You must describe the records that you want in enough detail to enable Authority, General Counsel, IG, or Panel personnel to locate the system of records containing them with a reasonable amount of effort. Whenever possible, your request should describe the time periods in which you believe the records were compiled and the name or identifying number of each system of records in which you believe the records are kept. The Authority, the General Counsel, the IG, and the Panel have published descriptions of the systems of records they maintain in the Federal Register .

(b) Your written request should be clearly and prominently identified as a Privacy Act request. If you submit the request by mail, it should bear the mark “Privacy Act Request” on the envelope or other cover, as well as your return address. If you submit the request by email, the subject line of the email should include the phrase “Privacy Act Request.” If your request does not comply with the provisions of this paragraph, it will not be deemed received until the time it is actually received by the FLRA's Solicitor or IG.

(c) If you desire, you may be accompanied by another person during your review of the records. If you desire to be accompanied by another person during the inspection, you must notify the Solicitor or IG at least twenty-four hours in advance of the agreed-upon inspection date. Additionally, you must sign a statement and provide it to the representative of the Authority, the General Counsel, the IG, or the Panel, as appropriate, at the time of the inspection, authorizing that person to accompany you. The agency may require a written statement from you authorizing discussion of your record in the accompanying person's presence.

(d) When you make a request for access to records about yourself, you must verify your identity. You must state your full name, current address, and date and place of birth. You must sign your request and your signature must either be notarized or submitted by you under 28 U.S.C. 1746, a law that permits statements to be made under penalty of perjury as a substitute for notarization. In order to help the identification and location of requested records, you may also, at your option, include your social security number.

(e) When making a request as the parent or guardian of a minor or as the guardian of someone determined by a court to be incompetent, for access to records about that individual, you must establish:

(1) The identity of the individual who is the subject of the record, by stating the name, current address, date and place of birth, and, at your option, the social security number of the individual;

(2) Your own identity, following the requirements of paragraph (d) of this section;

(3) That you are the parent or guardian of that individual, which you may prove by providing a copy of the individual's birth certificate showing your parentage or by providing a court order establishing your guardianship; and

(4) That you are acting on behalf of that individual in making the request.

§ 2412.6

Records about other individuals, medical records, and limitations on disclosures.

(a) Requests for records about an individual made by person other than that individual shall also be directed to the FLRA's Solicitor or IG, as appropriate, at the Authority's offices in Washington, DC, or by email to [e-mail]. You must describe the records that you want in enough detail to enable Authority, General Counsel, IG, or Panel personnel to locate the system of records containing them with a reasonable amount of effort. Whenever possible, your request should describe the time periods in which you believe the records were compiled and the name or identifying number of each system of records in which you believe the records are kept. The Authority, the General Counsel, the IG, and the Panel have published descriptions of the systems of records they maintain in the Federal Register .

(b) Such records shall only be made available to persons other than that individual in the following circumstances:

(1) To any person with the prior written consent of the individual about whom the records are maintained;

(2) To officers and employees of the Authority, the General Counsel, the IG, and the Panel who have a need for the records in the performance of their official duties;

(3) For a routine use compatible with the purpose for which it was collected, as defined in 5 U.S.C. 552a(a)(7) and as described under 5 U.S.C. 552a(e)(4)(D);

(4) To any person to whom disclosure is required by the Freedom of Information Act, as amended, 5 U.S.C. 552;

(5) To the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to title 13 of the United States Code;

(6) In a form not individually identifiable to a recipient who has provided the Solicitor or IG with advance adequate written assurance that the record will be used solely as a statistical research or reporting record;

(7) To the National Archives and Records Administration or other appropriate entity as a record which has sufficient historical or other value warranting its preservation, or for evaluation by the Archivist of the United States or the designee of such official to determine whether the record has such value;

(8) To another agency or to an instrumentality of any governmental jurisdiction within or under control of the United States for a civil or criminal law enforcement activity that is authorized by law if the head of the agency or instrumentality has made a written request for the record to the Solicitor or IG, in accordance with part 2417 of this chapter, specifying the particular portion desired and the law enforcement activity for which the record is sought;

(9) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual, provided that notification of such a disclosure shall be immediately mailed to the last known address of the individual;

(10) To either House of Congress or to any committee thereof with appropriate jurisdiction;

(11) To the Comptroller General, or any of Comptroller General's authorized representatives, in the performance of the official duties of the General Accountability Office;

(12) Pursuant to the order of a court of competent jurisdiction; or

(13) To a consumer reporting agency in accordance with 31 U.S.C. 3711(e).

(c) The request shall be in writing and should be clearly and prominently identified as a Privacy Act request and, if submitted by mail or otherwise submitted in an envelope or other cover, should bear the mark “Privacy Act Request” on the envelope or other cover. If a request does not comply with the provisions of this paragraph, it shall not be deemed received until the time it is actually received by the Solicitor or the IG.

(d) If medical records are requested for inspection which, in the opinion of the Solicitor or the IG, as appropriate, may be harmful to the requester if personally inspected by such person, such records will be furnished only to a licensed health care professional designated to receive such records by the requester. Prior to such disclosure, the requester must furnish a signed written authorization to make such disclosure and the licensed health care professional must furnish a written request for the licensed health care professional's receipt of such records to the Solicitor or the IG, as appropriate.

(1) If such authorization is not executed within the presence of an Authority, General Counsel, or Panel representative, the authorization must be accompanied by a notarized statement verifying the identification of the requester.

(2) [Reserved]

§ 2412.7

Initial decision on access requests.

(a) Within ten (10) working days of the receipt of a request pursuant to § 2412.5, the FLRA's Solicitor or IG will make an initial decision regarding whether the requested records exist and whether they will be made available to the requester. The Solicitor or IG will promptly communicate that initial decision to you in writing or other appropriate form.

(b) When the initial decision is to provide access to the requested records, the writing or other appropriate communication notifying you of the decision will:

(1) Briefly describe the records to be made available;

(2) State whether any records maintained about you in the system of records in question are not being made available;

(3) State whether any further verification of your identity is necessary; and

(4) Notify you of any fee charged under § 2412.13.

(5) The Solicitor or IG will promptly disclose the requested records to you upon payment of any applicable fee under § 2412.13.

(c) When the initial decision is not to provide access to requested records and accountings, the Solicitor or IG will, by writing or other appropriate communication, explain the reason for that decision. The Solicitor or IG will only refuse to provide you access when:

(1) Your verification of identity is inadequate under § 2412.5(d);

(2) No such records are maintained or an exemption applies;

(3) Your information is contained in, and inseparable from, another individual's record;

(4) The requested records have been compiled in reasonable anticipation of civil or criminal action or other proceedings.

§ 2412.8

Accountings of disclosures and requests for accountings.

(a) The FLRA's Solicitor or IG, as appropriate, will maintain a record (“accounting”) of every instance in which records about an individual are made available, pursuant to this part, to any person other than:

(1) Officers or employees of the Authority, the General Counsel, the IG, or the Panel in the performance of their duties; or

(2) Any person pursuant to the Freedom of Information Act, as amended, 5 U.S.C. 552.

(b) The accounting which shall be retained for at least five (5) years or the life of the record, whichever is longer, shall contain the following information:

(1) A brief description of records disclosed;

(2) The date, nature and, where known, the purpose of the disclosure; and

(3) The name and address of the person or agency to whom the disclosure is made.

(c) Except when accountings of disclosures are not required to be kept (as stated in paragraph (a) of this section) or are withheld accounting of disclosures that were made pursuant to 5 U.S.C. 552a(b)(7), you may make a request for an accounting of any disclosure that has been made by the Solicitor or IG, to another person, organization, or agency of any record about you. This accounting contains the date, nature, and purpose of each disclosure, as well as the name and address of the person, organization, or agency to which the disclosure was made. Your request for an accounting should identify each particular record in question and should be made by writing to the FLRA's Solicitor or IG, as appropriate, following the procedures in § 2412.5.

(d) The FLRA's Solicitor or IG, as appropriate, will respond to your request for access to an accounting following the procedures in § 2412.7. You may appeal the Solicitor or IG's decision on your request under the procedures in § 2412.12.

§ 2412.9

Requests for amendment or correction of records.

(a) Unless the record is not subject to amendment or correction as stated in paragraph (b) of this section, you may make a request for amendment or correction of an Authority, General Counsel, IG, or Panel record about yourself or about an individual for whom you are a parent or guardian by submitting a written request to the FLRA's Solicitor or IG, as appropriate, following the procedures in § 2412.5. Your request should identify each particular record in question, state the amendment or correction that you want, and state why you believe that the record is not accurate, relevant, timely, or complete. Please note that a requester bears the burden of proving by the preponderance of the evidence that information is not accurate, relevant, timely, or complete. You may submit any documentation that you think would be helpful. If you believe that the same record is in more than one system of records, your request should state that.

(b) The following records are not subject to amendment or correction:

(1) Transcripts of testimony given under oath or written statements made under oath;

(2) Transcripts of grand jury proceedings, judicial proceedings, or quasi-judicial proceedings, which are the official record of those proceedings;

(3) Records in systems of records that have been exempted from amendment and correction under the Privacy Act, 5 U.S.C. 552a(j) or (k), by notice published in the Federal Register ; and

(4) Records compiled in reasonable anticipation of a civil action or proceeding.

§ 2412.10

Initial decision on amendment or correction.

(a) Within ten (10) working days after receiving your request for amendment or correction, the FLRA's Solicitor or IG, as appropriate, will acknowledge receipt of the request and, under normal circumstances, the Solicitor or IG will notify you, by mail or other appropriate means, of the decision regarding the request not later than thirty (30) working days after receiving of the request.

(b) The notice of decision will include:

(1) A statement of whether the Solicitor or IG has granted or denied your request, in whole or in part;

(2) A quotation or description of any amendment or correction made to any records; and

(3) When a request is denied in whole or in part, an explanation of the reason for that denial and of your right to appeal the decision to the Chairman of the Authority, pursuant to § 2412.12.

§ 2412.11

Amendment or correction of previously disclosed records.

When a record is amended or corrected pursuant to § 2412.10, or a written statement of disagreement filed, pursuant to § 2412.12, the FLRA's Solicitor or IG, as appropriate, will give notice of that correction, amendment, or written statement of disagreement to all persons to whom such records or copies have been disclosed, as recorded in the accounting kept pursuant to § 2412.8.

§ 2412.12

Agency review of refusal to inform, to provide access to, or to amend or correct records.

(a) If your request for information regarding whether a system of records contains information about you or an individual for whom you are a parent or guardian, or your request for access to, or amendment or correction of, records of the Authority, the General Counsel, the IG, or the Panel, or an accounting of disclosure from such records, has been denied in whole or in part by an initial decision, you may, within thirty (30) working days after your receipt of notice of the initial decision, appeal that decision by filing a written request by mail to the Chairman of the Authority at the Authority's offices in Washington, DC, or by email to [e-mail].

(b) The appeal must describe:

(1) The request you initially made for information regarding, access to, or the amendment or correction of, records;

(2) The initial decision of the FLRA's Solicitor or IG on the request; and

(3) The reasons why that initial decision should be modified by the Chairman of the Authority.

(c) Not later than thirty (30) working days after receipt of a request for review (unless such period is extended by the Chairman of the Authority or the Chairman's designee for good cause shown), the Chairman of the Authority or the Chairman's designee will notify you of their decision on your request. If the Chairman of the Authority or the Chairman's designee upholds the initial decision not to inform the individual of whether requested records exist, or not to provide access to requested records or accountings, or not to amend or correct the records as requested, then the Chairman of the Authority or the Chairman's designee will notify you of your right:

(1) To judicial review of the Chairman of the Authority or the Chairman's designee's decision pursuant to 5 U.S.C. 552a(g)(1); and

(2) To file with the FLRA's Solicitor or IG, as appropriate, a concise written statement of disagreement with the determination. That written statement of disagreement will be made a part of the record and will accompany that record in any use or disclosure of the record.

§ 2412.13

Fees.

(a) Your Privacy Act request for access to records will be considered an agreement to pay all applicable fees charged under paragraph (b) of this section, up to $25.00. When making a request, you may specify a willingness to pay a greater or lesser amount.

(b) There will be a charge of twenty-five cents per page for paper-copy duplication of records disclosed under this part. For copies of records produced on tapes, disks, or other media, the Solicitor or IG will charge the actual cost of production, including operator time.

(c) The FLRA's Solicitor or IG may waive or reduce any charges under this section whenever it is in the public interest to do so.

§ 2412.14

Penalties.

Any person who knowingly and willfully requests or obtains any record concerning an individual from the Authority, the General Counsel, the IG, or the Panel under false pretenses will be subject to criminal prosecution under 5 U.S.C. 552a(i)(3), which provides that such person shall be guilty of a misdemeanor and fined not more than $5,000.

§ 2412.15

Exemptions.

(a) Files of FLRA's Office of Inspector General (OIG) compiled for the purpose of a criminal investigation and for related purposes. Pursuant to 5 U.S.C. 552a(j)(2), the FLRA hereby exempts the system of records entitled “FLRA/OIG–1, Office of Inspector General Investigative Files,” insofar as it consists of information compiled for the purposes of a criminal investigation or for other purposes within the scope of 5 U.S.C. 552a(j)(2), from the application of 5 U.S.C. 552a, except for 5 U.S.C. 552a(b), (c)(1) and (2), (e)(4)(A) through (F), (e)(6), (7), (9), (10), (11) and (i).

(b) OIG files compiled for other law enforcement purposes. Pursuant to 5 U.S.C. 552a(k)(2), the FLRA hereby exempts the system of records entitled “FLRA/OIG–1, Office of Inspector General Investigative Files,” insofar as it consists of information compiled for law enforcement purposes other than material within the scope of 5 U.S.C. 552a(j)(2), from the application of 5 U.S.C. 552a, (c)(3), (d), (e)(1), (e)(4)(G), (H), and (I), and (f).

Dated: November 28, 2023.

Thomas Tso,

Solicitor and Federal Register Liaison.