00-14784. The Production of Nonpublic Records and Testimony of NCUA Employees in Legal Proceedings and the Privacy Act

AGENCY:

National Credit Union Administration (NCUA).

ACTION:

Proposed rule.

SUMMARY:

NCUA proposes to make minor and technical revisions to its regulation implementing the Privacy Act of 1974 (PA). The proposal updates the rule to conform to current law governing the method an individual may use to establish his or her identity to obtain access to protected records and the requirements for the release of medical records. The proposed rule changes time limits so that they conform more closely to those under the Freedom of Information Act (FOIA) and clarifies that the agency maintains four, rather than three, systems of records subject to exemptions under the PA. The proposal also updates the rule to reflect organizational changes within NCUA and corrects cross-references in Subpart C.

DATES:

Comments must be received on or before August 11, 2000.

ADDRESSES:

Direct comments to Becky Baker, Secretary of the Board. Mail or hand-deliver comments to: National Credit Union Administration, 1775 Duke Street, Alexandria, Virginia 22314-3428. Fax comments to [phone]. E-mail comments to [e-mail]. Please send comments by one method only.

FOR FURTHER INFORMATION CONTACT:

Dianne M. Salva, Staff Attorney, Division of Operations, Office of General Counsel, at the above address or telephone: [phone].

SUPPLEMENTARY INFORMATION:

The PA, 5 U.S.C. 552a, governs the collection, maintenance, use and disclosure of personal information in a federal agency's systems of records. NCUA's PA regulation sets forth procedures for individuals to follow to obtain access to records about themselves in systems of records. It also permits the amendment of any inaccurate records and places restrictions on the disclosure of information in the records.

As part of a government-wide initiative, NCUA recently reviewed its practices related to privacy and personal information in federal records. In its review of the agency systems of records, it identified several changes in recordkeeping practices and agency organization. As a result of that review, NCUA revised its systems notices to make them clearer and simpler and to eliminate redundancies. 65 FR 3486, January 21, 2000. Now, as a result of its review of the PA regulation, NCUA proposes to update the regulation to reflect current law, terminology and organizational functions and clarify which of its systems of records are subject to PA exemptions.

The revisions are minor or technical in nature. The changes seek to align PA processing more closely with Office and Management and Budget (OMB) guidelines and FOIA, 5 U.S.C. 552, practices. Specifically, the current regulation calls for an agency response within 10 working days of receipt. The PA itself does not set a time limit for agency responses. OMB guidelines recommend that agencies acknowledge requests within 10 days and, when records will be produced, do so within 30 days. 40 FR 28957, July 9, 1975. For ease of administration, NCUA proposes to adopt processing time limits similar to those imposed by the FOIA: 20 working days to respond to initial PA requests, with a 10-day extension if necessary. The proposal also changes the time period for an individual to file an appeal of an adverse decision, currently 180 days, to the time period commonly used in the FOIA context, which is 30 days. The current regulation sets the copying fee at $0.25 per page. In connection with the FOIA, NCUA establishes a fee schedule adjusted periodically to reflect actual costs. The current rate for copies on the NCUA FOIA fee schedule is $0.05 per page. The proposal makes the copying fee for PA records the same as the fee on the FOIA fee schedule.

The proposal eliminates the requirement in the current regulation that an individual produce a notarized statement affirming his identity when he is seeking access to a record about himself and he cannot produce documentation to establish his identity, or when he submits a request by mail. Current case law requires that an individual need only submit an unsworn declaration, subscribed to as true under penalty of perjury. Summers v. DOJ, 999 F.2d 570 (D.C. Cir. 1993).

The current regulation requires that an NCUA official determine whether to release to an individual his non-exempt medical information in a system of records. The proposal eliminates that provision and conforms the rule to current law that holds that an agency may impose special procedures to minimize the potential harm to an individual from disclosure of sensitive medical records, but ultimately the agency must ensure that the individual receives all nonexempt medical records. Benavides v. Bureau of Prisons, 995 F.2d 269 (D.C. Cir. 1993).

The proposal also amends the regulation to reflect the correct number of systems of records subject to a PA exemption. The PA requires agencies to promulgate a rule to exempt a system of records from its access and notice provisions. The following four of NCUA's notices of systems of records state that the systems are exempt from certain provisions of the PA: NCUA-1, Employee Suitability and Security Investigations Containing Adverse Information, NCUA, and; NCUA-8, Investigative Reports Involving Any Crime, Suspected Crime or Suspicious Activity Against a Credit Union, NCUA, and; NCUA-11, Office of Inspector General (OIG) Investigative Records, and; NCUA-13, Litigation Case Files, NCUA. However, the current regulation only describes three systems subject to exemption from provisions of the PA, excluding the Litigation Case Files system. 12 CFR 792.34.

The Litigation Case Files system, designated NCUA-13, will be exempt from subsections (c)(3), (d), (e)(1), (e)(4)(G), (H), (I) and (f) of the PA. 5 U.S.C. 552a (c)(3), (d),(e)(1), (e)(4)(G), (H), (I) and (f). Because the system covers investigatory materials compiled for law enforcement purposes, it is eligible for these exemptions under subsection (k)(2) of the PA. 5 U.S.C. 552a(k)(2). However, if an individual is denied any right, privilege, or benefit to which the individual would otherwise be entitled by federal law, or for which the individual otherwise would be eligible, as a result of the maintenance of such records, the records or information will be made available to the individual, provided the identity of a confidential source is not disclosed. The records in the Litigation Case Files system are used in connection with the execution of NCUA's legal and enforcement responsibilities. These files may contain unverified, unsolicited statements, sometimes received from confidential sources. In addition, investigative reports and other internal agency memoranda concerning violations of laws or regulations may be included in the files. The NCUA Board believes that the disclosure of the existence of such information in the files or the nature of information obtained in law enforcement investigations may seriously hamper and undermine effective enforcement actions. Disclosure might prematurely alert individuals that they are under investigation or provide access to evidentiary information. Similarly, this system must be exempt from the PA provision requiring agencies to make an accounting of disclosures from the system upon request from the individual. An accounting would risk revealing to the individual that NCUA has forwarded records to the U.S. Department of Justice for consideration of criminal proceedings. If such an accounting were required, an individual might flee the jurisdiction or otherwise interfere with criminal prosecution. During litigation, authorized NCUA employees may disclose case file information within the bounds of discovery rules.

Finally, the proposal also corrects certain cross-references in Subpart C that are necessary due to earlier revisions of part 792. 63 FR 14338, March 25, 1998.

Regulatory Procedures

Paperwork Reduction Act

This regulation, if adopted, will impose no additional information collection, reporting or recordkeeping requirements.

Regulatory Flexibility Act

Pursuant to section 605(b) of the Regulatory Flexibility Act (5 U.S.C. 605(b)), NCUA certifies that this proposed rule will not have a significant economic impact on a substantial number of small entities. NCUA expects that this proposal will not: (1) Have significant secondary or incidental effects on a substantial number of small entities; or (2) create any additional burden on small entities. These conclusions are based on the fact that the proposed regulations are minor changes intended to simplify and clarify agency recordkeeping and disclosure procedures. Accordingly, a regulatory flexibility analysis is not required.

Executive Order 13132

Executive Order 13132 encourages independent regulatory agencies to consider the impact of their regulatory actions on state and local interests. In adherence to fundamental federalism principles, NCUA, an independent regulatory agency as defined in 44 U.S.C. 3502(5), voluntarily complies with the executive order. This proposed rule, if adopted, is procedural in nature and will not have substantial direct effects on the states, on the relationship between the national government and the states, or on the distribution of power and responsibilities among the various levels of government. NCUA has determined that the proposed rule does not constitute a policy that has federalism implications for purposes of the executive order.

The Treasury and General Government Appropriations Act, 1999—Assessment of Federal Regulations and Policies on Families

The NCUA has determined that this proposed rule will not affect family well-being within the meaning of section 654 of the Treasury and General Government Appropriations Act, 1999, Pub. L. 105-277, 112 Stat. 2681 (1998).

Agency Regulatory Goal

NCUA's goal is to promulgate clear and understandable regulations that impose minimal regulatory burden. We request your comments on whether the proposed amendment is understandable and minimally intrusive if implemented as proposed.

List of Subjects in 12 CFR Part 792

• Administrative practice and procedure
• Archives and records
• Credit unions
• Information
• Records

By the National Credit Union Administration Board on June 6, 2000.

Becky Baker,

Secretary of the Board.

For the reasons set out in the preamble, the NCUA proposes to amend 12 CFR Part 792 as follows:

PART 792—REQUESTS FOR INFORMATION UNDER THE FREEDOM OF INFORMATION ACT AND PRIVACY ACT, AND BY SUBPOENA; SECURITY PROCEDURES FOR CLASSIFIED INFORMATION

1. The authority citation for part 792 continues to read as follows:

Authority: 5 U.S.C. 301, 552, 552a, 552b; 12 U.S.C. 1752a(d), 1766, 1789, 1795f; E.O. 12600, 52 FR 23781, 3 CFR, 1987 Comp., p. 235; E.O. 12958, 60 FR 19825, 3 CFR, 1995 Comp., p. 333.

§ 792.41

[Amended]

2. In § 792.41, remove “ § 792.4(b)(2)” and add, in its place, “§ 792.32.”

§ 792.47

[Amended]

3. In § 792.47(b), remove “§ 792.5” and add, in its place, “§ 792.19.”

§ 792.49

[Amended]

4. In § 792.49, in the definition of Nonpublic records, remove “§ 792.3” and add, in its place, “§ 792.11”.

5. Amend § 792.55 by revising paragraph (a)(3) to read as follows:

§ 792.55

Times, places and requirements for identification of individuals making requests and identification of records requested.

(a) * * *

(3) An individual seeking access to records about himself by mail or in person, who cannot provide the required documentation or identification, may provide an unsworn declaration subscribed to as true under penalty of perjury.

* * * * *

6. Amend § 792.56 by revising paragraphs (b)(1), (b)(2) and (b)(3) to read as follows:

§ 792.56

Notice of existence of records, access decisions and disclosure of requested information; time limits.

* * * * *

(b) * * *

(1) A request concerning a single system of records which does not require consultation with or requisition of records from another agency will be responded to within 20 working days after receipt of the request.

(2) A request requiring requisition of records from or consultation with another agency will be responded to within 30 working days of receipt of the request.

(3) If a request under paragraphs (b)(1) or (2) of this section presents unusual difficulties in determining whether the records involved are exempt from disclosure, the Privacy Act Officer, in the Office of General Counsel, may extend the time period established by the regulations by 10 working days.

* * * * *

7. Amend § 792.57 by revising paragraph (b) to read as follows:

§ 792.57

Special Procedures: Information furnished by other agencies; medical records.

* * * * *

(b) When an individual requests medical records concerning himself, the NCUA official responsible for action on the request may advise the individual that the records to be released will be provided first to a physician designated in writing by the individual. The physician will provide the records to the individual.

8. Amend § 792.58 by revising the fourth sentence of paragraph (a) to read as follows:

§ 792.58

Requests for correction or amendment to a record; administrative review of requests.

* * * * *

(a) * * * An individual who does not have access to NCUA's “Notice of Systems of Records,” and to whom the appropriate address is otherwise unavailable, may submit a request to the Privacy Act Officer, Office of General Counsel, National Credit Union Administration, 1775 Duke Street, Alexandria, Virginia, 22314-3428, in which case the request will then be referred to the appropriate NCUA official.* * *

* * * * *

9. Amend § 792.59 by revising paragraph (e) to read as follows:

§ 792.59

Appeal of initial determination.

* * * * *

(e) If access is denied because of an exemption, the individual will be notified of the right to appeal that determination to the General Counsel within 30 days after receipt. Appeals will be determined within 20 working days.

10. Amend § 792.65 by revising paragraph (a)(1) to read as follows:

§ 792.65

Fees.

(a) * * *

(1) For copies of documents provided, copy fees as stated in NCUA's current FOIA fee schedule; and

* * * * *

11. Amend § 792.66 by revising the first sentence of paragraph (a), and the first two sentences of paragraph (b)(1), and the first sentence of paragraph (b)(2), and adding a new paragraph (b)(4) as follows:

§ 792.66

Exemptions.

(a) NCUA maintains four systems of records that are exempted from some provisions of the Privacy Act. * * *

(b)(1) System NCUA-1, entitled “Employee Suitability Security Investigations Containing Adverse Information,” consists of adverse information about NCUA employees that had been obtained as a result of routine U.S. Office of Personnel Management (OPM) security Investigations. To the extent that NCUA maintains records in this system pursuant to OPM guidelines that may require retrieval of information by use of individual identifiers, those records are encompassed by and included in the OPM Central system of records number Central-9 entitled, “Personnel Investigations Records,” and thus are subject to the exemptions promulgated by OPM. * * *

(2) System NCUA-8, entitled, “Investigative Reports Involving Any Crime or Suspicious Activity Against a Credit Union, NCUA,” consists of investigatory or enforcement records about individuals suspected of involvement in violations of laws or regulations, whether criminal or administrative. * * *

* * * * *

(4) System NCUA-13, entitled, “Litigation Case Files,” consists of investigatory materials compiled for law enforcement purposes. Records in the Litigation Case Files system are used in connection with the execution of NCUA's legal and enforcement responsibilities. Because the system covers investigatory materials compiled for law enforcement purposes, it is eligible for exemption under subsection (k)(2) of the Privacy Act. 5 U.S.C. 552a(k)(2). The Litigation Case Files system is exempt from subsections (c)(3), (d), (e)(1), (e)(4)(G), (H), (I) and (f) of the Privacy Act. 5 U.S.C. 552a (c)(3), (d), (e)(1), (e)(4)(G), (H), (I) and (f). However, if an individual is denied any right, privilege, or benefit to which he would otherwise be entitled by federal law, or for which he otherwise would be eligible, as a result of the maintenance of such records, the records or information will be made available to him, provided the identity of a confidential source is not disclosed.

* * * * *

12. Amend § 792.69 by revising the first sentence of paragraph (a) to read as follows:

§ 792.69

Training and employee standards of conduct with regard to privacy.

(a) The Director of the Office of Training and Development, with advice from the General Counsel, is responsible for training NCUA employees in the obligations imposed by the Privacy Act and this subpart.* * *

* * * * *