2023-03772. Privacy Act-NASA Regulations

AGENCY:

National Aeronautics and Space Administration (NASA).

ACTION:

Direct final rule.

SUMMARY:

This direct final rule makes changes to NASA's rules governing implementation of the Privacy Act by providing for electronic access to records and, most significantly, exempting NASA's harassment investigative case files system of records notice (SORN) from specific subsections in the Privacy Act. The rule also makes several non-substantive changes to correct titles and minor provide clarifications.

DATES:

This rule is effective on April 28, 2023, unless adverse comments are received by March 29, 2023. If adverse comments are received, NASA will publish a timely withdrawal of the rule in the Federal Register .

ADDRESSES:

Comments must be identified with RIN 2700-AE64 and may be sent to NASA via the Federal E-Rulemaking Portal: https://www.regulations.gov. Follow the online instructions for submitted comments. Please note that NASA will post all comments on the internet with changes, including any personal information provided.

FOR FURTHER INFORMATION CONTACT:

Corey Portalatin-Berrien, Office of the Chief Information Officer, 202-358-4787.

SUPPLEMENTARY INFORMATION:

Background

Part 1212 establishes procedures for individuals to access their Privacy Act records and to request amendment of information in records concerning them. This rule was last published as a direct final rule in the Federal Register at 77 FR 60620, October 4, 2012, to make non-substantive changes to NASA rules governing implementation of the Privacy Act by updating statute citations, position titles, terminology, and adjusting appellate responsibility for records held by the NASA Office of the Inspector General. However, correction to these amendments were published in the Federal Register at 78 FR 8963, February 7, 2013, to add the responsibility of NASA's Freedom of Information Act Office that processes request for individual records. NASA is currently amending the rule to make changes to provide for electronic access to records. Furthermore, NASA is exempting its system of records (SOR) for Harassment Report Case Files/NASA 10RCF, under 5 U.S.C. 552a(k)(2) (k)(5) from the following subsections of the Privacy Act of 1974, 5 U.S.C. 552a:

• Subsection (c)(3) relating to access to the disclosure accounting.
• Subsection (d) relating to access to the records.
• Subsection (e)(1) relating to the type of information maintained in the records.
• Subsections (e)(4)(G), (H) and (I) relating to publishing in the annual system notice information as to agency procedures for access and correction and information as to the categories of sources of records.
• Subsection (f) relating to developing agency rules for gaining access and making corrections.

The determination to exempt these records was made because it is necessary for NASA to continue to investigate violations of law, regulation, and policy and also to determine continue suitability for Federal employment. In accordance with Federal anti-discrimination laws, the Equal Employment Opportunity Commission (EEOC) requires that all Federal agencies have an Antiharassment policy and program. NASA's specific policy prohibits harassment by all employees, provides an avenue for individuals to report allegations of harassment, and a process by which NASA fact-finders conduct inquiries/investigations. Furthermore, NASA's policy prohibits retaliation against individuals for raising allegations of harassment or participating in the process. In order for NASA to promptly address and resolve potential violations of law, regulation, or NASA policy, individuals who are participating in this process must be assured that their statements will be kept confidential consistent with law. Some investigations have been hindered by witnesses' lack of willingness to come forward fearful that their statements or identities would be revealed. Other agencies, including the EEOC, have exempted these records from certain provisions of the Privacy Act.

This SORN relies on multiple legal authorities to support exempting these records under 5 U.S.C. 552a(K)(2) and (K)(5), including, NASA's Antiharassment Policy, which states that NASA has an affirmative obligation to maintain a harassment-free workplace and to take prompt and effective action when allegations arise. NASA's policy encourages all employees to report concerns and for NASA to address such conduct before it becomes “severe or pervasive” within the meaning of the anti-discrimination laws. Additional authoritative sources include the EEOC, anti-discrimination laws, and Supreme Court precedent that require agencies to take prompt and effective action if an individual is alleging harassment by a NASA employee. Additionally, the investigatory material compiled by this system of records may be used to determine a putative harasser's suitability for continued NASA employment and such records would be exempt from release under certain provisions of the Privacy Act but only in cases where the disclosure of such information would reveal the identity of a source who provided information to NASA under the condition of anonymity.

Non-substantive changes will also be made to correct typos and titles and provide clarity.

Direct Final Rule Adverse Comments

NASA has determined this rulemaking meets the criteria for a direct final rule because it involves two substantive changes, one to address electronic access to records as required by Creating Advanced Streamlined Electronic Services for Constituents Act of 2019; the second to add an exemption for an Agency system of records. No opposition to the changes and no significant adverse comments are expected. However, if the Agency receives a significant adverse comment, it will withdraw this direct final rule by publishing a document in the Federal Register . A significant adverse comment is one that explains: (1) why the direct final rule is inappropriate, including challenges to the rule's underlying premise or approach; or (2) why the direct final rule will be ineffective or unacceptable without a change. In determining whether a comment necessitates withdrawal of this direct final rule, NASA will consider whether it warrants a substantive response in a notice and comment process.

Statutory Authority

The National Aeronautics and Space Act (the Space Act), 51 U.S.C. 20101(a), authorizes the NASA Administrator to make, promulgate, issue, rescind, and amend rules and regulations governing the manner of its operations and the exercise of the powers vested in it by law.

Regulatory Analysis

Executive Order 12866, Regulatory Planning and Review and Executive Order 13563, Improvement Regulation and Regulation Review

Executive Orders 13563 and 12866 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). Executive Order 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. This rule has been designated as “administrative” under section 3(f) of Executive Order 12866. Accordingly, the rule has been reviewed by the Office of Management and Budget.

Review Under the Regulatory Flexibility Act

The Regulatory Flexibility Act (5 U.S.C. 601 et seq.) requires an agency to prepare an initial regulatory flexibility analysis to be published at the time the proposed rule is published. This requirement does not apply if the agency “certifies that the rule will not, if promulgated, have a significant economic impact on a substantial number of small entities” (5 U.S.C. 603). This rule does not have any economic impact on small entities.

Review Under the Paperwork Reduction Act

This direct final rule does not contain any information collection requirements subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.).

Review Under Executive Order of 13132

Executive Order 13132, “Federalism,” 64 FR 43255 (August 4, 1999), requires regulations be reviewed for federalism effects on the institutional interest of states and local governments, and, if the effects are sufficiently substantial, preparation of the Federal assessment is required to assist senior policy makers. The amendments will not have any direct effects on state and local governments within the meaning of the Executive order. Therefore, no federalism assessment is required.

List of Subjects in 14 CFR Part 1212

• Privacy
• Procedural rules

For reasons discussed in the preamble, NASA amends 14 CFR part 1212 as follows:

PART 1212—PRIVACY ACT—NASA REGULATIONS

1. The authority citation for part 1212 continues to read as follows:

Authority: 51 U.S.C. 20101 et seq.;5 U.S.C. 552a; Pub. L. 115-59, 131 Stat. 1152 (42 U.S.C. 405 note).

Subpart 1212.2—Requests for Access to Records

2. Revise § 1212.201 to read as follows:

§ 1212.201

Requesting a record.

(a) Individuals may request access to their Privacy Act records, either in person, in writing, or electronically.

(b) Individuals may also authorize a third party to have access to their Privacy Act records. This authorization shall be in writing, signed by the individual, or submitted electronically. Requests must contain the individual's address or email address, as well as the name, address or email address of the representative being authorized access. The identities of both the subject individual and the representative must be verified in accordance with the procedures set forth in § 1212.202.

(c)(1) In-person or written requests must be directed to the appropriate system manager, or, if unknown, to the Center Privacy Manager or Freedom of Information Act (FOIA) Office at NASA Headquarters or Field Center. The request should be identified clearly on the envelope and on the letter as a “Request Under the Privacy Act.”

(2) Electronic requests may be initiated online at https://www.nasa.gov/​about/​highlights/​HP_​Privacy.html.

(3) Where possible, requests should contain the following information to ensure timely processing:

(i) Name and address of subject.

(ii) Email address of subject, for electronic requests only.

(iii) Identity of the system of records.

(iv) Nature of the request.

(v) Identifying information specified in the applicable system notice to assist in identifying the request, such as location of the record, if known, full name, birth date, time periods in which the records are believed to have been compiled, etc.

(d) NASA has no obligation to comply with a nonspecific request for access to information concerning an individual, e.g., a request to provide copies of “all information contained in your files concerning me,” although a good faith effort will be made to locate records if there is reason to believe NASA has records on the individual. If the request is so incomplete or incomprehensible that the requested record cannot be identified, additional information or clarification will be requested in the acknowledgement, and assistance to the individual will be offered as appropriate.

(e) If the Center Privacy Manager receives a request for access, the Privacy Manager will record the date of receipt and immediately forward the request to the responsible system manager for handling.

(f) If the Center FOIA Office receives a first party request for records or access, the FOIA Office will process the request under the Privacy Act pursuant to this part.

(g) Normally, the system manager shall respond to a request for access within 10 business days of receipt of the request and the access shall be provided within 30 business days of receipt.

(1) In response to a request for access, the system manager or Privacy Act Officer shall:

(i) Notify the requester that there is no record on the individual in the system of records and inform the requester of the procedures to follow for appeal (see § 1212.4);

(ii) Notify the requester that the record is exempt from disclosure, cite the appropriate exemption, and inform the requester of the procedures to follow for appeal (see § 1212.4);

(iii) Upon request, promptly provide copies of the record, subject to the fee requirements (see § 1212.204); or

(iv) Make the individual's record available for personal inspection in the presence of a NASA representative.

(2) Unless the system manager agrees to another location, personal inspection of the record shall be at the location of the record as identified in the system notice.

(3) When an individual requests records in a system of records maintained on a third party, the request shall be processed as a FOIA request under 14 CFR part 1206. If the records requested are subject to release under FOIA (5 U.S.C. 552(b)), then a Privacy Act exemption may not be invoked to deny access.

(4) When an individual requests records in a system of records maintained on the individual, the request shall be processed under this part. NASA will not rely on exemptions contained in FOIA to withhold any record which is otherwise accessible to the individual under this part.

3. Revise § 1212.202 to read as follows:

§ 1212.202

Identification procedures.

(a) The system manager will release records to the requester or representative in person only upon production of satisfactory identification which includes the individual's name, signature, and photograph or physical description.

(b) The system manager will release records to the requester or representative electronically via a NASA provided temporary secure storage space, after the identities of both are validated by the Agency's identity authorization process.

(c) The system manager will release copies of records by mail only when the circumstances indicate that the requester and the subject of the record are the same. The system manager may require that the requester's signature be notarized or witnessed by two individuals unrelated to the requester.

(d) Identity procedures more stringent than those required in this section may be prescribed in the system notice when the records are medical or otherwise sensitive.

§ 1212.204

[Amended]

4. Amend § 1212.204 in paragraph (b) by adding the words “hard-copy” before the word “duplication.”

§ 1212.205

[Amended]

5. Amend § 1212.205 in paragraph (b) by removing the word “manages” and adding in its place the word “manager.”

Subpart 1212.4—Appeals and Related Matters

§ 1212.400

[Amended]

6. Amend § 1212.400 in paragraphs (b), (c)(1), and (e) by removing the words “Associate Deputy Administrator” and adding in their place the words “Associate Administrator.”

Subpart 1212.5—Exemptions to Individuals' Rights of Access

§ 1212.500

[Amended]

7. Amend § 1212.500 in paragraph (b) by removing the words “Associate Deputy Administrator” and adding in their place the words “Associate Administrator.”

8. Amend § 1212.501 by adding paragraph (c) to read as follows:

§ 1212.501

Record systems determined to be exempt.

* * * * *

(c) Harassment Report Case Files —(1) Sections of the Act from which exempted. Harassment Report Case Files records are exempt under 5 U.S.C. 552a(k)(2) from the following sections of the Privacy Act (5 U.S.C. 552a): subsection (c)(3) relating to access to the disclosure accounting; subsection (d) relating to access to the records; subsection (e)(1) relating to the type of information maintained in the records; subsections (e)(4)(G), (H), and (I) relating to publishing in the annual system notice information as to agency procedures for access and correction and information as to the categories of sources of records; and subsection (f) relating to developing agency rules for gaining access and making corrections.

(2) Reason for exemption —(i) Subsection (c)(3). The release of the disclosure accounting to the individual who is the subject of the investigation/fact-finding would present a serious impediment to NASA's ability to conduct fact-findings into potential violations of law or policy.

(ii) Subsection (d). Access to records contained in this system would inform the subject of an actual or potential investigation, of the existence of that investigation, of the nature and scope of the investigation, of the information and evidence obtained as to their activities, and of the identity of witnesses. Such access would impede a fact-finder/investigator's ability to freely investigate such cases, including concerns that some witnesses have been promised confidentiality and would not want their statements provided to the subject of the investigation. Amendment of the records would interfere with the ongoing fact-finding process.

(iii) Subsection (e)(1). Under the provision of (e)(1), the agency must only maintain such information that is relevant and necessary. It is difficult to know during the course of an investigation what is relevant and necessary. In this connection, facts or evidence may not seem relevant at first, but later in the investigation, their relevance is borne out.

(iv) Subsections (e)(4)(G) and (H). These subsections are inapplicable to the extent that these systems are exempt from the access provisions of subsection (d) and the rules provisions of subsection (f).

(v) Subsection (e)(4)(I). The categories of sources of the records in these systems have been published in the Federal Register in broad generic terms in the belief that this is all that subsection (e)(4)(I) of the Act requires. In the event, however, that this subsection should be interpreted to require more detail as to the identity of sources of the records in this system, exemption from this provision is necessary to protect the confidentiality of the sources of criminal and related law enforcement information. Such exemption is further necessary to protect the privacy and physical safety of witnesses and informants.

(vi) Subsection (f). Procedures for notice to an individual pursuant to subsection (f)(1) as to existence of records pertaining to the individual dealing with an actual or potential criminal, civil, or regulatory investigation or prosecution must be exempted because such notice to an individual would be detrimental to the successful conduct and/or completion of an investigation or case, pending or future. In addition, mere notice of the fact of an investigation could inform the subject or others that their activities are under investigation or may become the subject of an investigation and could enable the subjects to avoid detection, to influence witnesses improperly, to destroy evidence, or to fabricate testimony. Since an exemption is being claimed for subsection (d) of the Act, the rules required pursuant to subsections (f)(2) through (5) are inapplicable to these systems of records to the extent that these systems of records are exempted from subsection (d).

(3) Determination. NASA has determined that the exemption of this system of records from subsections (c)(3), (d), (e)(1), (e)(4)(G), (e)(4)(H), (e)(4)(I), and (f) of the Privacy Act is necessary for the Agency's law enforcement efforts to address and eradicate harassment in its workplace.

Subpart 1212.7—NASA Authority and Responsibilities

9. Amend § 1212.701 by revising the section heading and introductory text to read as follows:

§ 1212.701

Associate Administrator.

The Associate Administrator is responsible for:

* * * * *

§ 1212.705

[Amended]

9. Amend § 1212.705 in paragraph (a)(3) by removing the words “Associate Deputy Administrator” and adding in their place the words “Associate Administrator.”

Nanette Smith,

Team Lead, NASA Directives and Regulations.