2019-14998. Implementation of the Privacy Act of 1974

AGENCY:

National Endowment for the Humanities.

ACTION:

Final rule.

SUMMARY:

The National Endowment for the Humanities (“NEH”) is issuing regulations to implement the Privacy Act of 1974 (the “Privacy Act”). These regulations establish procedures by which an individual may determine whether a system of records maintained by NEH contains a record pertaining to him or her; gain access to such records; and request correction or amendment of such records. These regulations also establish exemptions from certain Privacy Act requirements for all or part of certain systems of records maintained by NEH.

DATES:

Effective August 19, 2019.

FOR FURTHER INFORMATION CONTACT:

Elizabeth Voyatzis, Deputy General Counsel, Office of the General Counsel, National Endowment for the Humanities, 400 Seventh Street SW, Room 4060, Washington, DC 20506; [phone]; [e-mail].

SUPPLEMENTARY INFORMATION:

1. Background

NEH operates as part of the National Foundation on the Arts and the Humanities (the “Foundation”) under the National Foundation of the Arts and the Humanities Act of 1965, as amended (20 U.S.C. 951 et seq.). The Foundation consists of the Federal Council on the Arts and the Humanities (“FCAH”), the Institute of Museum and Library Services (“IMLS”), the National Endowment for the Arts (“NEA”), and NEH. NEH currently follows Foundation regulations implementing the Privacy Act, located at part 1115 within Subchapter A of 45 CFR Chapter XI.

The regulations found within 45 CFR Chapter XI, Subchapter A apply to the entire Foundation. On April 30, 2019, NEH published a notice of proposed rulemaking (“NPRM”) to add NEH-specific Privacy Act regulations to 45 CFR Chapter XI, Subchapter D (45 CFR part 1169), replacing the Foundation's Privacy Act regulations with regard to NEH. IMLS and NEA have already added IMLS- and NEA-specific Privacy Act regulations to 45 CFR XI, Subchapters B and E (45 CFR parts 1159 & 1182), respectively, which replaced the Foundation's Privacy Act regulations with regard to IMLS and NEA. FCAH, which relies upon NEA and NEH for its administration, does not maintain any systems of records of its own, and hence has no need or obligation to publish Privacy Act regulations. See 5 U.S.C. 552a(f) (requiring only that an agency that “maintain[s] a system of records shall promulgate rules” implementing the Privacy Act).

In the preamble of the NPRM, NEH explained that its new agency-specific Privacy Act regulations will be substantively similar to the Foundation's Privacy Act regulations, but will put into place current contact information, as well as update and clarify the procedures NEH will follow when granting access to, or amending or correcting, a record contained within a system of records. NEH will also add a new exemption covering its system of records entitled “Office of Inspector General (“OIG”) Investigative Files,” which did not exist when the Foundation published its Privacy Act regulations.

Because NEH is the only agency that continues to use the Foundation regulations at 45 CFR Chapter XI, Subchapter A, rather than amend the Foundation regulations—which, along with future amendments, requires coordination with IMLS and NEA—NEH has chosen instead to issue its own Privacy Act regulations. Upon the effective date of this final rule, NEH will seek NEA and IMLS's consent to publish a joint rulemaking removing the Foundation's Privacy Act regulations at 45 CFR part 1115, as those regulations will no longer apply to any of the Foundation's constituent agencies.

2. Public Comment and Changes From Proposed Rule

NEH did not receive any comments from the public in response to its proposed rule. Accordingly, NEH is adopting the proposed rule with no changes.

3. Regulatory Analyses

Executive Order 12866: Regulatory Planning and Review and Executive Order 13563: Improving Regulation and Regulatory Review

This action is not a significant regulatory action and was therefore not submitted to the Office of Management and Budget (OMB) for review.

Executive Order 13771: Reducing Regulations and Controlling Regulatory Costs

This action is not expected to be an Executive Order 13771 regulatory action because this action is not significant under Executive Order 12866.

Paperwork Reduction Act of 1995 (“PRA”)

This action does not impose an information collection burden under the PRA. This action contains no provisions constituting a collection of information under the PRA.

Regulatory Flexibility Act of 1980 (“RFA”)

This action will not have a significant economic impact on a substantial number of small entities under the RFA. This action will not impose any requirements on small entities.

Unfunded Mandates Reform Act of 1995 (“UMRA”)

This action does not contain any unfunded mandate as described in the UMRA, 2 U.S.C. 1531-1538, and does not significantly or uniquely affect small governments.

Executive Order 13132 (Federalism)

This action does not have federalism implications. It will not have substantial direct effects on the states, on the relationship between the national government and the states, or on the distribution of power and responsibilities among the various levels of government.

Executive Order 13175: Consultation and Coordination With Indian Tribal Governments

This action does not have tribal implications as specified in Executive Order 13175. Thus, Executive Order 13175 does not apply to this action.

List of Subjects in 45 CFR Part 1169

• Administrative practice and procedure
• Privacy

For the reasons stated in the preamble, the National Endowment for the Humanities amends 45 CFR Chapter XI Subchapter D by adding part 1169 as follows:

PART 1169—PRIVACY ACT REGULATIONS

1169.1

Purpose and scope.

1169.2

Definitions.

1169.3

Inquiries about NEH's systems of records or implementation of the Privacy Act.

1169.4

Procedures for determining if an individual is the subject of an NEH record.

1169.5

Procedures for acquiring access to NEH records pertaining to an individual.

1169.6

Identification required when requesting access to NEH records pertaining to an individual.

1169.7

Procedures for amending or correcting an individual's NEH record.

1169.8

The appeals process.

1169.9

Fees charged to locate, review, or copy records.

1169.10

NEH systems of records that are covered by exemptions under the Privacy Act.

1169.11

Penalties for obtaining an NEH record under false pretenses.

Authority: 5 U.S.C. 552a(f).

§ 1169.1

Purpose and scope.

The regulations in this part set forth NEH's procedures under the Privacy Act, as required by 5 U.S.C. 552a(f), with respect to systems of records maintained by NEH. These regulations establish procedures by which an individual may exercise the rights granted by the Privacy Act to determine whether an NEH system of records contains a record pertaining to him or her; gain access to such records; and request correction or amendment of such records. The regulations also set identification requirements; establish procedures by which an individual may appeal within NEH an adverse agency determination; prescribe fees which NEH will charge for copying records; and establish exemptions from certain requirements of the Privacy Act for certain NEH systems of records or parts thereof.

§ 1169.2

Definitions.

The definitions of the Privacy Act apply to this part. In addition, as used in this part:

Agency means any executive department, military department, Government corporation, or other establishment in the executive branch of the Federal government, including the Executive Office of the President or any independent regulatory agency.

Business day means a calendar day, excluding Saturdays, Sundays, and legal public holidays.

Chairperson means the Chairperson of NEH, or his or her designee.

General Counsel means the General Counsel of NEH, or his or her designee;

Individual means any citizen of the United States or an alien lawfully admitted for permanent residence.

Maintain means to collect, use, store, or disseminate records, as well as any combination of these recordkeeping functions. The term also includes exercise of control over and, therefore, responsibility and accountability for, systems of records.

NEH means the National Endowment for the Humanities.

NEH system means a system of records maintained by NEH.

Privacy Act means the Privacy Act of 1974, as amended (5 U.S.C. 552a).

Record means any item, collection, or grouping of information about an individual, including, but not limited to, information regarding an individual's education, financial transactions, medical history, and criminal or employment history and that contains the individual's name or another identifying particular, such as a number or symbol assigned to the individual, or his or her fingerprints, voice print, or photograph.

Routine use means, with respect to disclosure of a record, the use of a record for a purpose that is compatible with the purpose for which it was collected.

System of records means a group of records under the control of NEH from which NEH retrieves information by use of an individual's name or by some number, symbol, or other identifying particular assigned to an individual.

§ 1169.3

Inquiries about NEH's systems of records or implementation of the Privacy Act.

Inquiries about NEH's systems of records or implementation of the Privacy Act should be sent by email to [e-mail] or by mail to the following address: National Endowment for the Humanities, Office of the General Counsel, 400 Seventh Street SW, Room 4060, Washington, DC 20506.

§ 1169.4

Procedures for determining if an individual is the subject of an NEH record.

(a) NEH has published notice of its systems of records in the Federal Register and also has made such information available on the privacy program page of the NEH website. Any individual desiring to know whether a specific system of records contains a record pertaining to him or her should address such inquiries in writing to the Office of the General Counsel at the email or physical address identified in § 1169.3.

(b) The written inquiry described in § 1169.4(a) should refer to the specific system or systems of records listed in the NEH Notice of Systems of Records, or describe the type of record in sufficient detail reasonably to identify the relevant system of records.

(c) At a minimum, the request should contain sufficient identifying information to allow NEH to determine if there is a record pertaining to the individual making the request in a particular system of records. NEH reserves the right to solicit from an individual submitting such inquiry proof of identification, depending upon the sensitivity of the request.

(d) NEH will attempt to respond to an inquiry regarding whether a record exists within 10 business days of receiving the inquiry, or 10 business days from the time any required identification is established, whichever is later. Such a response will contain or reference the procedures that the individual must follow in order to gain access to any such records.

§ 1169.5

Procedures for acquiring access to NEH records pertaining to an individual.

(a) An individual may request access to his or her own records contained within an NEH system of records by writing to the Office of the General Counsel at the email or physical address identified in § 1169.3. The individual making the request should include his or her full name, address, email address, and telephone number. The individual making the request should also specifically indicate whether he or she wishes to review such records in person.

(b) The request for access to a record within a system of records should refer to the specific system or systems of records listed in the NEH Notice of Systems of Records within which NEH may retrieve the individual's records, or describe the type of record in sufficient detail such that NEH may reasonably identify the relevant system of records. The request should further state that it is made pursuant to the Privacy Act. In addition, the request should include any other information which may permit NEH to identify the record for which access is being requested, such as maiden name, dates of employment, etc.

(c) Where an individual requests records pertaining to himself or herself, NEH will process such request under both these regulations and NEH's regulations implementing the Freedom of Information Act (“FOIA”), set forth in 45 CFR part 1171, so as to provide the greatest degree of lawful access.

(d) Upon receipt of any such request, NEH will determine whether the records identified by the requester exist and whether they are subject to any exemption under § 1169.10. Should NEH determine that the records are releasable under the Privacy Act and these regulations, and upon verifying the individual's identity per § 1169.6, NEH will provide access to copies of the records by transmitting them to the requester at the mailing or email address provided by the requester, or by permitting the requester to inspect the records at NEH's offices should the requester ask for in-person inspection or where the requester is a current NEH employee.

(e) NEH will acknowledge a request for access as soon as practicable, and in no event in less than 5 business days. Consistent with the agency's FOIA regulations, NEH will otherwise substantively answer a request for access in no less than 20 business days, except when NEH determines otherwise, in which case NEH will inform the person making the request of the reasons for the delay and the estimated date by which NEH will answer the request. When NEH can answer the request within 20 business days, the response shall include the following:

(1) A statement that there is no record as requested or a statement that there is no such record in the systems of records maintained by NEH;

(2) A statement as to whether NEH will grant access by providing a copy of the record through the mail or email; or, where an individual requests in-person inspection, the address of the location and the date and time at which the record may be examined. In the event the person requesting access is unable to meet the specified date and time, he or she may make alternative arrangements with NEH;

(3) The amount of fees charged, if any (see § 1169.9);

(4) Any documentation required by NEH to verify the identity of the person making the request.

(f) NEH will provide only one copy of each requested record, based on the fee schedule in § 1169.9.

(g) Per 5 U.S.C. 552a(h), a parent of a minor, upon presenting suitable personal identification, may act on behalf of the minor to gain access to any record pertaining to the minor maintained by NEH in a system of records. A legal guardian may similarly act on behalf of an individual declared to be incompetent due to physical or mental incapacity or age by a court of competent jurisdiction, upon the presentation of the documents authorizing the legal guardian to so act, and upon suitable personal identification of the guardian.

(h) In the event NEH gains access to a record by permitting in-person inspection, the individual to which the record pertains may be accompanied by a person of his or her choice to review the record. Under such circumstances, NEH may require that the individual who is the subject of the record furnish a written statement authorizing discussion of the record in the accompanying person's presence.

(i) In accordance with this provision, NEH will disclose medical or psychological records pertaining to an individual to whom they pertain unless NEH determines, in consultation with a physician, that disclosure of such records might adversely affect the individual to whom they pertain. Under these circumstances, NEH will disclose this information to a licensed physician designated by such individual in writing.

§ 1169.6

Identification required when requesting access to NEH records pertaining to an individual.

(a) Before granting access to personal information under the Privacy Act, NEH may require that the individual requesting such access provide reasonable proof of his or her identity.

(b) Except in the case of NEH employees and those individuals who request in-person inspection, NEH generally will endeavor to provide access to records via mail or email. In such instances, NEH will first confirm that the physical and/or email addresses provided by the requester match those contained with the NEH system of records. Depending upon the sensitivity of the records requested, and whether the addresses match as described in the preceding sentence, NEH may also request that the individual verify his or her identity by providing certain minimum identifying data, such as date or place of birth and/or copies of a valid driver's license or passport. Where the information sought is of a particularly sensitive nature, and/or where the individual cannot provide minimum identifying data, NEH may require that the individual seeking access submit a notarized statement of identity or a signed statement asserting and acknowledging that knowingly or willfully seeking or obtaining access to records about another person under false pretenses may result in a fine of up to $5,000.

(c) NEH will provide access by in-person examination to NEH employees as well as to individuals who specifically request disclosure in person. In such instances, the individual requesting disclosure may prove identity by producing an employee identification card, driver's license, or other license, permit or pass used for routine identification purposes. If the individual is unable to provide suitable documentation or identification, NEH may require that he or she stipulate, in writing, that knowingly or willingly seeking or obtaining access to records about another person under false pretenses is punishable by a fine of up to $5,000.

(d) Identity verification procedures shall not:

(1) Be so complicated as to discourage unnecessarily individuals from seeking access to information about themselves;

(2) Be required of an individual seeking access to records that normally would be available under FOIA (see 45 CFR part 1171);

(3) Require, as a condition to access, the provision of a social security number, unless a social security number is the only means by which NEH may retrieve the records that are the subject of the request.

(4) Require that the individual explain or justify his or her need for access to any record under this part.

§ 1169.7

Procedures for amending or correcting an individual's NEH record.

(a) Individuals are entitled to request amendments or corrections of records pertaining to themselves pursuant to 5 U.S.C. 552a(d)(2). Normally, amendments to this part are limited to correcting factual matters and not matters of official judgment, such as grant proposal evaluations, performance ratings, promotion potential, and job performance appraisals. An individual seeking action under this provision bears the burden of demonstrating to NEH that a record should be amended or corrected.

(b) Individuals may request the amendment of records pertaining to themselves by submitting a letter in writing to the NEH Office of the General Counsel at the email or physical address identified in § 1169.3. Such letter shall include the following information:

(1) Identification of the particular record to be amended or corrected;

(2) The NEH system from which the record was retrieved;

(3) The precise correction or amendment sought, preferably in the form of an edited copy of the record reflecting the desired modification;

(4) Reasons for requesting amendment or correction of the record, including copies of available documentary evidence supporting the request, where applicable.

(c) NEH will acknowledge a request for amendment or correction as soon as practicable, and in no event less than 5 business days.

(d) When NEH has previously verified the individual's identity pursuant to §§ 1169.6(b) or 1169.6(c), it will not require further verification of identity so long as the request for amendment or correction does not suggest a need for additional verification. If NEH has not previously verified the individual's identity, it may require that the individual validate his or her identity as described in §§ 1169.6(b) or 1169(c).

(e) To the extent possible, NEH will render a decision upon a request to amend a record no less than 20 business days after receiving such a request. In the event NEH cannot render a decision within that time frame, it will so inform the individual who made the request and provide an expected date for a decision. Any such decision will include the following information:

(1) NEH's decision whether to grant in whole, or deny any part of, the request to amend or correct the record;

(2) The reasons for the determination for any portion of the request which is denied;

(3) A statement that any denial may be appealed pursuant to the procedures set forth in § 1169.8; and

(4) The name and address of the official to whom an individual may submit an appeal of denial.

(f) NEH will forward requests to amend or correct a record governed by the regulations of another agency to such agency for processing, and inform the person who submitted such request in writing of its referral.

§ 1169.8

The appeals process.

(a) An individual whose request for access to, or correction or amendment of, a record is initially denied by NEH and who wishes to appeal that denial may do so by sending a letter within 90 days of receipt of the initial denial to the Chairperson. If an appeal concerns records retrieved from the OIG's Investigative Files, the OIG will act on the appeal and will carry out all responsibilities with respect to Privacy Act appeals otherwise assigned to the Chairperson under this section.

(b) The appeal letter must:

(1) Specify the records subject to the appeal;

(2) Include the information specified in § 1169.7(b);

(3) Include copies of the correspondence from NEH in which it initially denied the request for access, or for amendment or correction; and

(4) Explain why NEH's denial of access, amendment or correction was erroneous.

(b) Appeals should be directed to the NEH Office of the General Counsel at the physical address or email address identified in § 1169.3. The Office of the General Counsel will refer the appeal letter to the Chairperson (or his or his or her designee), or in the case of records retrieved from NEH's OIG Investigative Files, will refer the appeal letter to the NEH OIG.

(c) The Chairperson will review the initial request for access to, or amendment or correction of, the record, NEH's refusal, and any other pertinent material relating to the appeal. NEH will not hold a hearing on the appeal.

(d) The Chairperson will render a final decision on the appeal within 30 business days of its receipt by NEH, unless the Chairperson, for good cause shown, extends the 30-day period. Should the Chairperson extend the 30-day period, NEH will inform the requester of the extension and the circumstances of the delay.

(e) In conducting appeals under this provision, the Chairperson will be guided by the requirements of 5 U.S.C. 552a(e)(1) and (e)(5).

(f) NEH will notify a requester, in writing, when the Chairperson determines to grant an appeal in whole or in part, and will grant the requester access to his or her record, or correct or amend the record, in accordance with the Chairperson's determination.

(g) When the Chairperson determines to deny an appeal, in whole or in part, NEH will notify the requester in writing of the following:

(1) The basis for the decision;

(2) That the requester may submit to NEH a concise statement setting forth the reasons for disagreeing with NEH's decision.

(3) The procedures for filing such statement of disagreement.

(4) That, in a case where the Chairperson refuses a request to amend or correct a record, NEH will make such statements of disagreement available in subsequent disclosures of the record, together with a statement from NEH (if deemed appropriate) summarizing the agency's refusal.

(5) The requester's right to seek judicial review under 5 U.S.C. 552a(g)(1)(a).

§ 1169.9

Fees charged to locate, review, or copy records.

(a) NEH will not charge fees for the search or review of requested records, or the amendment or correction of records.

(b) NEH will not charge fees for providing the first copy of a record or any portion of a record to whom the record pertains. NEH will otherwise charge copying fees at the same rate, and using the same procedures, that NEH has established for FOIA requests.

§ 1169.10

NEH systems of records that are covered by exemptions under the Privacy Act.

(a) Pursuant to and limited by 5 U.S.C. 552a(j)(2), the NEH system entitled “Office of the Inspector General Investigative Files” shall be exempted from the provisions of 5 U.S.C. 552a, except for subsections (b); (c)(1) and (2); (e)(4)(A) through (F); (e)(6), (7), (9), (10), and (11); and (i), insofar as that NEH system contains information pertaining to criminal law enforcement investigations. NEH has implemented this exemption because application of these provisions of the Privacy Act might alert investigation subjects to the existence or scope of investigations; lead to suppression, alteration, fabrication, or destruction of evidence; disclose investigative techniques or procedures; reduce the cooperativeness or safety of witnesses; or otherwise impair investigations.

(b) Pursuant to and limited by 5 U.S.C. 552a(k)(2), the NEH system entitled “Office of the Inspector General Investigative Files” shall be exempted from 5 U.S.C. 552a(c)(3); (d); (e)(1); (e)(4)(G), (H), and (I); and (f), insofar as that NEH system consists of investigatory material compiled for law enforcement purposes, other than material within the scope of the exemption at 5 U.S.C. 552a(j)(2).

(c) Pursuant to and limited by 5 U.S.C. 552a(k)(5), the NEH system entitled “Grants and Cooperative Agreements: Electronic Grant Management System” shall be exempted from 5 U.S.C. 552a(c)(3); (d); (e)(1); (e)(4)(G), (H), and (I); and (f), insofar as that NEH system consists of materials which would reveal the identity of references for fellowship or grant applicants.

(d) Records on applicants for employment at NEH are covered by the Office of Personnel Management government-wide system notice “Recruiting, Examining, and Placement Records.” These records are exempted as claimed in 5 CFR 297.501(b)(7).

(e) Pursuant to 5 U.S.C. 552a(d)(5), nothing within these regulations shall allow an individual access to any information compiled in reasonable anticipation of a civil action or proceeding.

(f) NEH may also assert exemptions for records received from another agency that could properly be claimed by that agency in responding to a request.

§ 1169.11

Penalties for obtaining an NEH record under false pretenses.

Under 5 U.S.C. 552a(i)(3), any person who knowingly and willfully requests or obtains any record from NEH concerning an individual under false pretenses shall be guilty of a misdemeanor and fined not more than $5,000.

Dated: July 8, 2019.

Elizabeth Voyatzis,

Deputy General Counsel, National Endowment for the Humanities.