2018-06528. ABMC Privacy Program

AGENCY:

American Battle Monuments Commission.

ACTION:

Final rule.

SUMMARY:

This rule provides guidance and assigns responsibility for the privacy program under the American Battle Monuments Commission (ABMC) pursuant to the Privacy Act of 1974 and applicable Office of Management Budget (OMB) guidance.

DATES:

This rule is effective April 30, 2018.

FOR FURTHER INFORMATION CONTACT:

Edwin L. Fountain, General Counsel, American Battle Monuments Commission, 2300 Clarendon Boulevard, Suite 500, Arlington, VA 22201, 703-696-6907, [e-mail].

SUPPLEMENTARY INFORMATION:

The authority for this rulemaking is 5 U.S.C. 552a, the Privacy Act of 1974, as amended, which requires the implementation of the Act by Federal agencies.

This action ensures that ABMC's collection, use, maintenance, or dissemination of information about individuals for purposes of discharging its statutory responsibilities will be performed in accordance with the Privacy Act of 1974 and applicable OMB guidance. This rule:

• Establishes rules of conduct for ABMC personnel and ABMC contractors involved in the design, development, operation, or maintenance of any system of records.
• Establishes appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity that could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual about whom information is maintained.
• Ensures that guidance, assistance, and subject matter expert support are provided ABMC staff, contractors and the public as needed in the implementation and execution of and compliance with the ABMC Privacy Program.
• Ensures that laws, policies, procedures, and systems for protecting individual privacy rights are implemented throughout ABMC.

Notice of Proposed Rule

The proposed rule was published at 82 FR 39067 (August 17, 2017). ABMC received one comment that was not germane. Accordingly this rule is being finalized with no changes.

Regulatory Procedures

Executive Order 12866, Regulatory Planning and Review, and Executive Order 13563, Improving Regulation and Regulatory Review

Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). Executive Order 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. This rule benefits the public and the United States Government by providing clear procedures for members of the public, contractors, and employees to follow with regard to the ABMC privacy program. This rule has been designated a not significant regulatory action.

Unfunded Mandates Reform Act

Section 202 of the Unfunded Mandates Reform Act of 1995 (UMRA) (2 U.S.C. 1532) requires agencies to assess anticipated costs and benefits before issuing any rule whose mandates require spending in any 1 year of $100 million in 1995 dollars, updated annually for inflation. In 2016, that threshold is approximately $146 million. This rule will not mandate any requirements for State, local, or tribal governments, nor will it affect private sector costs.

Public Law 96-354, Regulatory Flexibility Act

The ABMC certifies this rule is not subject to the Regulatory Flexibility Act (5 U.S.C. Ch. 6) because it would not, if promulgated, have a significant economic impact on a substantial number of small entities. Therefore, the Regulatory Flexibility Act, as amended, does not require ABMC to prepare a regulatory flexibility analysis.

Executive Order 13132, Federalism

Executive Order 13132 establishes certain requirements that an agency must meet when it promulgates a proposed rule (and subsequent final rule) that imposes substantial direct requirement costs on State and local governments, preempts State law, or otherwise has Federalism implications. This rule will not have a substantial effect on the States; the relationship between the National Government and the States; or the distribution of power and responsibilities among the various levels of Government.

Public Law 96-511, Paperwork Reduction Act

It has been determined that this rule does not impose reporting or record keeping requirements under the Paperwork Reduction Act of 1995 (44 U.S.C. Chapter 35).

List of Subjects in 36 CFR Part 407

• Privacy

For the reasons set forth in the Preamble, the American Battle Monuments Commission amends 36 CFR chapter IV by adding part 407 to read as follows:

PART 407—PROCEDURES AND GUIDELINES FOR COMPLIANCE WITH THE PRIVACY ACT OF 1974

407.1

Purpose and scope of the regulations in this part.

407.2

Definitions.

407.3

Inquiries about ABMC's systems of records or implementation of the Privacy Act.

407.4

Procedures for acquiring access to ABMC records pertaining to an individual.

407.5

Identification required when requesting access to ABMC records pertaining to an individual.

407.6

Procedures for amending or correcting an individual's ABMC record.

407.7

Procedures for appealing a refusal to amend or correct an ABMC record.

407.8

Fees charged to locate, review, or copy records.

407.9

Procedures for maintaining accounts of disclosures made by ABMC from its systems of records.

Authority: 5 U.S.C. 552a(f).

§ 407.1

Purpose and scope of the regulations in this part.

The regulations in this part set forth ABMC's procedures under the Privacy Act, as required by 5 U.S.C. 552a(f), with respect to systems of records maintained by ABMC. The rules in this part apply to all records maintained by ABMC that are retrieved by an individual's name or by some identifying number, symbol, or other identifying particular assigned to the individual. These regulations establish procedures by which an individual may exercise the rights granted by the Privacy Act to determine whether an ABMC system of records contains a record pertaining to him or her; to gain access to such records; and to request correction or amendment of such records. These rules should be read together with the Privacy Act, which provides additional information about records maintained on individuals.

§ 407.2

Definitions.

The definitions in subsection (a) of the Privacy Act (5 U.S.C. 552a(a)) apply to this part. In addition, as used in this part:

ABMC means the American Battle Monuments Commission.

ABMC system means a system of records maintained by ABMC.

Business day means a calendar day, excluding Saturdays, Sundays, and legal public holidays.

General Counsel means the General Counsel of ABMC or his or her designee.

Individual means a citizen of the United States or an alien lawfully admitted for permanent residence.

Privacy Act or Act means the Privacy Act of 1974, as amended (5 U.S.C. 552a).

Secretary means the Secretary of ABMC or his or her designee.

You, your, or other references to the reader of the regulations in this part are meant to apply to the individual to whom a record pertains.

§ 407.3

Inquiries about ABMC's systems of records or implementation of the Privacy Act.

Inquiries about ABMC's systems of records or implementation of the Privacy Act should be sent to the following address: American Battle Monuments Commission, Office of the General Counsel, 2300 Clarendon Boulevard, Suite 500, Arlington VA 22201.

§ 407.4

Procedures for acquiring access to ABMC records pertaining to an individual.

The following procedures apply to records that are contained in an ABMC system:

(a) You may request to be notified if a system of records that you name contains records pertaining to you, and to review any such records, by writing to the Office of the General Counsel (see § 407.3). You also may call the Office of the General Counsel at [phone] on business days, between the hours of 9 a.m. and 5 p.m., to schedule an appointment to make such a request in person. A request for records should be presented in writing and should identify specifically the ABMC system(s) involved. Your request to access records pertaining to you will be treated as a request under both the Privacy Act, as implemented by this part, and the Freedom of Information Act (5 U.S.C. 552), as implemented by part 404 of this title (36 CFR 404.1 through 404.10).

(b) Access to the records, or to any other information pertaining to you that is contained in the system, shall be provided if the identification requirements of § 407.5 are satisfied and the records are determined otherwise to be releasable under the Privacy Act and these regulations. ABMC shall provide you an opportunity to have a copy made of any such records about you. Only one copy of each requested record will be supplied, based on the fee schedule in § 407.8.

(c) ABMC will comply promptly with requests made in person at scheduled appointments, if the requirements of this section are met and the records sought are immediately available. ABMC will acknowledge, within 10 business days, mailed requests or personal requests for records that are not immediately available, and the information requested will be provided promptly thereafter.

(d) If you make your request in person at a scheduled appointment, you may, upon your request, be accompanied by a person of your choice to review your records. ABMC may require that you furnish a written statement authorizing discussion of your records in the accompanying person's presence. A record may be disclosed to a representative chosen by you upon your proper written consent.

(e) Medical or psychological records pertaining to you shall be disclosed to you unless, in the judgment of ABMC, access to such records might have an adverse effect upon you. When such a determination has been made, ABMC may refuse to disclose such information directly to you. ABMC will, however, disclose this information to you through a licensed physician designated by you in writing.

(f) If you are unsatisfied with an adverse determination on your request to access records pertaining to you, you may appeal that determination using the procedures set forth in § 407.7(a).

§ 407.5

Identification required when requesting access to ABMC records pertaining to an individual.

ABMC will require reasonable identification of all individuals who request access to records in an ABMC system to ensure that records are disclosed to the proper person.

(a) The amount of personal identification required will of necessity vary with the sensitivity of the record involved. In general, if you request disclosure in person, you will be required to show an identification card, such as a driver's license, containing your photograph and sample signature. However, with regard to records in ABMC systems that contain particularly sensitive and/or detailed personal information, ABMC reserves the right to require additional means of identification as are appropriate under the circumstances. These means include, but are not limited to, requiring you to sign a statement under oath as to your identity, acknowledging that you are aware of the criminal penalties for requesting or obtaining records under false pretenses or falsifying information (see 5 U.S.C. 552a(i)(3); 18 U.S.C. 1001).

(b) If you request disclosure by mail, ABMC will request such information as may be necessary to ensure that you are properly identified and for a response to be sent. Authorized means to achieve this goal include, but are not limited to, requiring that a mail request include a signed, notarized statement asserting your identity or a statement signed under oath as described in paragraph (a) of this section.

§ 407.6

Procedures for amending or correcting an individual's ABMC record.

(a) You are entitled to request amendments to or corrections of records pertaining to you that you believe are not accurate, relevant, timely, or complete, pursuant to the provisions of the Privacy Act, including 5 U.S.C. 552a(d)(2). Such a request should be made in writing and addressed to the Office of the General Counsel (see § 407.3).

(b) Your request for amendments or corrections should specify the following:

(1) The particular record that you are seeking to amend or correct;

(2) The ABMC system from which the record was retrieved;

(3) The precise correction or amendment you desire, preferably in the form of an edited copy of the record reflecting the desired modification; and

(4) Your reasons for requesting amendment or correction of the record.

(c) ABMC will acknowledge a request for amendment or correction of a record within 10 business days of its receipt, unless the request can be processed and the individual informed of the General Counsel's decision on the request within that 10-day period.

(d) If after receiving and investigating your request, the General Counsel agrees that the record is not accurate, timely, or complete, based on a preponderance of the evidence, then the record will be corrected or amended promptly. The record will be deleted without regard to its accuracy, if the record is not relevant or necessary to accomplish the ABMC function for which the record was provided or is maintained. In either case, you will be informed in writing of the amendment, correction, or deletion. In addition, if accounting was made of prior disclosures of the record, all previous recipients of the record will be informed of the corrective action taken.

(e) If after receiving and investigating your request, the General Counsel does not agree that the record should be amended or corrected, you will be informed promptly in writing of the refusal to amend or correct the record and the reason for this decision. You also will be informed that you may appeal this refusal in accordance with § 407.7.

(f) Requests to amend or correct a record governed by the regulations of another agency will be forwarded to such agency for processing, and you will be informed in writing of this referral.

§ 407.7

Procedures for appealing a refusal to amend or correct an ABMC record.

(a) You may appeal a refusal to amend or correct a record to the Secretary of ABMC. Such appeal must be made in writing within 30 business days of your receipt of the initial refusal to amend or correct your record. Your appeal should be sent to the Office of the General Counsel (see § 407.3), should indicate that it is an appeal, and should include the basis for the appeal.

(b) The Secretary will review your request to amend or correct the record, the General Counsel's refusal, and any other pertinent material relating to the appeal. No hearing will be held.

(c) The Secretary shall render his or her decision on your appeal within 30 business days of its receipt by ABMC, unless the Secretary, for good cause shown, extends the 30-day period. Should the Secretary extend the appeal period, you will be informed in writing of the extension and the circumstances of the delay.

(d) If the Secretary determines that the record that is the subject of the appeal should be amended or corrected, the record will be so modified, and you will be informed in writing of the amendment or correction. Where an accounting was made of prior disclosures of the record, all previous recipients of the record will be informed of the corrective action taken.

(e) If your appeal is denied, you will be informed in writing of the following:

(1) The denial and the reasons for the denial;

(2) That you may submit to ABMC a concise statement setting forth the reasons for your disagreement as to the disputed record. Under the procedures set forth in paragraph (f) of this section, your statement will be disclosed whenever the disputed record is disclosed; and

(3) That you may seek judicial review of the Secretary's determination under 5 U.S.C. 552a(g)(1).

(f) Whenever you submit a statement of disagreement to ABMC in accordance with paragraph (e)(2) of this section, the record will be annotated to indicate that it is disputed. In any subsequent disclosure, a copy of your statement of disagreement will be disclosed with the record. If ABMC deems it appropriate, a concise statement of the Secretary's reasons for denying your appeal also may be disclosed with the record. While you will have access to this statement of the Secretary's reasons for denying your appeal, such statement will not be subject to correction or amendment. Where an accounting was made of prior disclosures of the record, all previous recipients of the record will be provided a copy of your statement of disagreement, as well as any statement of the Secretary's reasons for denying your appeal deemed appropriate.

§ 407.8

Fees charged to locate, review, or copy records.

(a) ABMC will charge no fees for search time or for any other time expended by ABMC to review a record. However, ABMC may charge fees where you request that a copy be made of a record to which you have been granted access. Where a copy of the record must be made in order to provide access to the record (e.g., computer printout where no screen reading is available), the copy will be made available to you without cost.

(b) Copies of records made by photocopy or similar process will be charged to you at the rate of $0.15 per page. Where records are not susceptible to photocopying (e.g., punch cards, magnetic tapes, or oversize materials), you will be charged actual cost as determined on a case-by-case basis. Copying fees will not be charged if the cost of collecting a fee would be equal to or greater than the fee itself. Copying fees for contemporaneous requests by the same individual shall be aggregated to determine the total fee.

(c) Special and additional services provided at your request, such as certification or authentication, postal insurance, and special mailing arrangement costs, will be charged to you at the rates set forth in § 404.7(e) of this chapter.

(d) You may request that a copying fee not be charged or, alternatively, be reduced, by submitting a written petition to ABMC's General Counsel (see § 407.3) asserting that you are indigent. If the General Counsel determines, based on the petition, that you are indigent and that ABMC's resources permit a waiver of all or part of the fee, the General Counsel may, in his or her discretion, waive or reduce the copying fee.

(e) All fees shall be paid before any copying request is undertaken. Payments shall be made by check or money order payable to “American Battle Monuments Commission.”

§ 407.9

Procedures for maintaining accounts of disclosures made by ABMC from its systems of records.

(a) The Office of the General Counsel shall maintain a log containing the date, nature, and purpose of each disclosure of a record to any person or to another agency. Such accounting also shall contain the name and address of the person or agency to whom each disclosure was made. This log need not include disclosures made to ABMC employees in the course of their official duties, or pursuant to the provisions of the Freedom of Information Act (5 U.S.C. 552).

(b) ABMC will retain the accounting of each disclosure for at least five years after the disclosure for which the accounting is made or for the life of the record that was disclosed, whichever is longer.

(c) ABMC will make the accounting of disclosures of a record pertaining to you available to you at your request. Such a request should be made in accordance with the procedures set forth in § 407.4. This paragraph (c) does not apply to disclosures made for law enforcement purposes under 5 U.S.C. 552a(b)(7).

Dated: March 27, 2018.

Robert J. Dalessandro,

Deputy Secretary, ABMC.