2024-12469. Privacy Act; Implementation

AGENCY:

National Institutes of Health (NIH), Department of Health and Human Services (HHS).

ACTION:

Notice of proposed rulemaking.

SUMMARY:

In accordance with subsections (j)(2) and (k)(2) of the Privacy Act of 1974, as amended (the Privacy Act or the Act), the Department of Health and Human Services (HHS or Department) is proposing to exempt a new system of records maintained by the National Institutes of Health (NIH), System No. 09-25-0224, “NIH Police Records,” from certain requirements of the Act. The new system of records will cover criminal and non-criminal law enforcement investigatory material maintained by the NIH Division of Police, a component of NIH which performs criminal law enforcement as its principal function. The exemptions are necessary and appropriate to protect the integrity of law enforcement proceedings and records compiled in the course of NIH Division of Police activities, prevent disclosure of investigative techniques, and protect the identity of confidential sources involved in those activities. Elsewhere in the Federal Register , HHS/NIH has published a System of Records Notice (SORN) for System No. 09-25-0224 for public notice and comment which describes the new system of records in more detail.

DATES:

Submit either electronic or written comments regarding this document by August 6, 2024.

ADDRESSES:

Submit comments, identified by Docket No NIH-2022-0002, by any of the following methods:

Electronic Submissions

Submit electronic comments in the following way:

• Federal eRulemaking Portal: https://www.regulations.gov. Follow the instructions for submitting comments.

Written Submissions

Submit written submissions in the following ways:

• Fax: [phone] (not a toll-free number).
• Mail: Daniel Hernandez, NIH Regulations Officer, Office of Management Assessment, National Institutes of Health, 6705 Rockledge Drive, (RK1) 601-U, Rockville, MD 20892-7901.

To ensure timelier processing of comments, HHS/NIH is no longer accepting comments submitted to the agency by email. HHS/NIH encourages you to continue to submit electronic comments by using the Federal eRulemaking Portal, as described previously, in the ADDRESSES portion of this document under Electronic Submissions.

Instructions: All submissions received must include the agency name and Docket No. for this rulemaking. All comments received may be posted without change to https://www.regulations.gov, including any personal information provided.

Docket: For access to the docket to read background documents or comments received, go to https://www.regulations.gov and follow the instructions provided for conducting a search, using the docket number(s) found in brackets in the heading of this document.

FOR FURTHER INFORMATION CONTACT:

General questions about the exemptions may be submitted to Daniel Hernandez, NIH Regulations Officer, Office of Management Assessment, National Institutes of Health, 6705 Rockledge Drive, (RK1) 601-U, Rockville, MD 20892-7901, telephone [phone], fax [phone], email [e-mail].

SUPPLEMENTARY INFORMATION:

I. Background on the NIH Police Division and New System of Records 09-25-0224

Elsewhere in the Federal Register , HHS/NIH has published notice of its establishment of a new system of records 09-25-0224, “NIH Police Records.” The purpose of this rulemaking is to exempt that system of records from certain requirements of the Privacy Act as permitted by 5 U.S.C. 552a(j)(2) and (k)(2). The new system of records will cover records maintained by the NIH Division of Police, Office of Research Services (ORS), in the NIH Office of the Director. The Division of Police was established in 1968 to provide an immediate and primary law enforcement program for the NIH and derives its authority from Memorandum from the Assistant Secretary for Administration, OS, to the Director, NIH, June 13, 1968; Memorandum from the Assistant Secretary for Administration, OS, to the Director, NIH, June 13, 1968, entitled: Delegation of Authority to Assist in Controlling Violations of Law at Certain HEW Facilities Located in Montgomery County, Maryland; 40 U.S.C. 1315 (Law enforcement authority of Secretary of Homeland Security for protection of public property; a Department of Homeland Security (DHS) delegation of authority to HHS/NIH; and an NIH delegation of authority to the NIH Division of Police); General Administrative Delegation of Authority Number 08, Control of Violations of Law at Certain NIH Facilities (Sept. 1, 2020). Based on that establishing authority, the Division of Police performs criminal law enforcement as its principal function. However, the Division of Police conducts both criminal and non-criminal ( e.g., civil, administrative, regulatory) law enforcement investigations.

The NIH Division of Police is directly responsible for the provision of daily law enforcement and criminal and civil investigative activities required to protect the life, safety, and property of NIH employees, contractors, patients, and visitors at NIH. To perform these responsibilities, the NIH Division of Police compiles and maintains records of complaints of incidents, inquiries, investigative findings, arrest records, and court dispositions which are retrieved by personal identifiers and therefore constitute a “system of records” as defined by the Privacy Act at 5 U.S.C. 552a(a)(5). The primary purposes for which the records are used are to: (1) record incidents of crime, civil disturbance, and traffic accidents on the NIH enclave, and the investigation of such incidents; (2) maintain information essential to the protection of life, safety, and property at NIH; (3) provide official records of law enforcement investigative efforts for use in administrative, criminal and/or civil proceedings; and (4) document criminal and civil law enforcement investigations.

II. Eligible Records and Exemptions

The new system of records will include both criminal and non-criminal ( e.g., civil, administrative, regulatory) law enforcement investigatory records which will be retrieved by subject individuals' personal identifiers. Such records are eligible to be exempted from certain Privacy Act requirements, as follows:

• Subsection (j)(2) of the Privacy Act (5 U.S.C. 552a(j)(2)) allows an agency head to exempt from certain Privacy Act provisions a system of records maintained by the agency or component thereof which performs as its principal function any activity pertaining to the enforcement of criminal laws.
• Subsection (k)(2) of the Act (5 U.S.C. 552a(k)(2)) allows an agency head to exempt from certain Privacy Act provisions a system of records containing investigatory material compiled for law enforcement purposes, other than material within the scope of subsection (j)(2) (for example, material compiled for a civil, administrative, or regulatory law enforcement purpose, or material compiled for a criminal law enforcement purpose by an agency component that does not perform criminal law enforcement as its principal function). This exemption's effect on the subject individual's access rights is qualified in that if any individual is denied any right, privilege, or benefit to or for which the individual otherwise would be entitled by Federal law, or for which the individual would otherwise be eligible, as a result of the maintenance of the system of records, the individual must be provided the requested materials except to the extent that disclosure would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence.

HHS/NIH is establishing the following exemptions for the records:

• Based on5 U.S.C. 552a(k)(2), HHS/NIH is exempting non-criminal ( e.g., civil, administrative, regulatory) law enforcement investigatory material in System No. 09-25-0224 from the requirements in subsections (c)(3), (d)(1) through (4), (e)(1), (e)(4)(G) through (I), and (f) of the Privacy Act, which require the agency to provide an accounting of disclosures; provide notification, access, and amendment rights; maintain only relevant and necessary information authorized by a statute or Executive order; establish and describe procedures whereby an individual can be notified if a system of records contains information pertaining to that individual and how to gain access to pertinent records; identify categories of record sources; and promulgate rules regarding these procedures. The effect of this exemption on a subject individual's access rights will be limited as required by subsection (k)(2) to information that would reveal the identity of a source who was expressly promised confidentiality in cases in which maintenance of the records results in denial of a Federal right, privilege, or benefit to or for which the individual would otherwise be entitled or eligible.
• Based on subsection5 U.S.C. 552a(j)(2), HHS/NIH is exempting criminal law enforcement investigatory material in System No. 09-25-0224 from the same requirements identified above, and from these additional subsections:

○ (c)(4), requiring the agency to inform disclosure recipients of corrections and notations of dispute affecting disclosed records;

○ (e)(2) and (3), requiring the agency to collect information directly from the subject individual to the greatest extent practicable and to provide a Privacy Act notice to the individual at the time of collection;

○ (e)(5), requiring the agency to maintain records used in agency determinations with sufficient accuracy, relevance, timeliness, and completeness to ensure fairness to individuals;

○ (e)(8), requiring the agency to attempt to notify an individual when a record about the individual is disclosed under compulsory legal process; and

○ (g), subjecting the agency to civil action and civil remedies for noncompliance with access, amendment, and accuracy, relevance, timeliness, and completeness requirements, and for noncompliance that adversely affects an individual.

Notwithstanding the establishment of these exemptions, individual record subjects may submit accounting, access, notification, and correction requests, and HHS/NIH will consider such requests on a case-by-case basis. Only information that is not factually accurate, or is not relevant, timely, or complete may be contested.

In addition to the exemptions that HHS/NIH is establishing for system of records 09-25-0224 in this proposed rule, if any law enforcement investigatory material compiled in that system of records is from another system of records in which such material was exempted from access and other requirements of the Privacy Act based on 5 U.S.C. 5525a(j)(2), it will be exempt in system of records 09-25-0224 on the same basis ( i.e.,5 U.S.C. 552a(j)(2)) and from the same requirements as in the source system.

III. Exemption Rationales

The following specific rationales explain why each exemption is necessary and appropriate for law enforcement investigation records maintained by the NIH Division of Police, in order to prevent interference with and protect the integrity of pending, closed, and future investigations, including related investigations. All subsections referenced are subsections of 5 U.S.C. 552a.

• Subsection (c)(3) (Provide Accountings of Disclosures). This exemption will apply to both criminal and non-criminal law enforcement investigatory material. Providing an accounting of disclosures to an individual record subject could reveal the existence of a pending or prior investigation or present or past investigative interest on the part of NIH or another agency. This would pose a serious impediment to law enforcement efforts and undermine the investigative process by enabling a subject individual or others in concert with that individual to harass, intimidate, or collude with witnesses, destroy, conceal, or tamper with evidence, threaten or endanger law enforcement personnel, alter patterns of behavior, and avoid detection or apprehension by law enforcement authorities.
• Subsection (c)(4) (Inform Disclosure Recipients of Corrections and Notations of Dispute). This exemption applies to only criminal law enforcement investigatory material. Because system of records 09-25-0224 will be exempt from amendment requirements in subsection (d) and HHS/NIH's compliance with amendment requirements therefore will be voluntary, it is necessary and appropriate that HHS/NIH's compliance with the requirement in subsection (c)(4) be voluntary also. This will give HHS/NIH the flexibility to decide which cases warrant expending resources to meet those administratively burdensome requirements.
• Subsection (d)(1) through (4) (Provide Notification, Access, and Amendment Rights). These exemptions apply to both criminal and non-criminal law enforcement investigatory material. Providing subject individuals with the right to be notified of whether the system of records contains a record about them and to access and amend such records could reveal the existence of a pending or prior investigation or present or past investigative interest by NIH or another agency and details about the investigation, including identities of sources of information, personal information about third parties, and sensitive investigative techniques. This could impair pending and future investigations by chilling or deterring sources of information from providing information to investigators (particularly if they are not certain of its accuracy or fear retribution), by providing an opportunity for subject individuals and others acting in concert with subject individuals to tamper with witnesses or evidence, and by allowing individuals to alter their behavior to defeat investigative techniques and avoid detection or apprehension. Complying with amendment requirements could significantly delay investigations while attempts are made to resolve questions of accuracy, relevance, timeliness, and completeness and would impose an impossible administrative burden by requiring investigations to be continuously reinvestigated. In the case of criminal investigations, since the system of records will be exempt from having to maintain records that are accurate, relevant, timely, and complete, the exemption from amendments seeking to correct to those standards is also appropriate.
• Subsection (e)(1) (Maintain Only Relevant and Necessary Information Authorized by Statute or Executive order). This exemption applies to both criminal and non-criminal law enforcement investigatory material. In the course of a law enforcement investigation, and especially in the early stages of an investigation, the relevance and necessity of information obtained or introduced may be unclear or the information may not be strictly relevant or necessary to a specific investigation but may lead to discovery of relevant information. In the interests of effective law enforcement, it is appropriate to retain all information that may aid in establishing patterns of unlawful activity.
• Subsections (e)(2) and (3) (Collect Information Directly From the Subject Individual to the Greatest Extent Practicable, and Provide a Privacy Act Notice). These exemptions apply to only criminal law enforcement investigatory material. It is not always practicable to collect information sought in a criminal law enforcement investigation directly from subject individuals. Individuals who could be adversely affected by an investigation may intentionally provide unreliable information to avoid being implicated in criminal activity. Questioning subject individuals and providing a Privacy Act notice to them (i.e., informing them of the purposes for which information collected from them will be used and disclosed and how providing or not providing it could affect them), could inappropriately reveal the existence, nature, scope, and details of the investigation. This would provide an opportunity for the subject individual or others acting in concert with that individual to conceal evidence, alter patterns of behavior, or take other actions that could thwart investigative efforts; reveal the identity of witnesses in investigations, thereby providing an opportunity for the subjects of the investigations or others to harass, intimidate, or otherwise interfere with the collection of evidence or other information from such witnesses; or reveal the identity of confidential or other informants who provide information to investigators, which would negatively affect an informant's usefulness in any ongoing or future investigations and discourage members of the public from cooperating with future investigations.
• Subsections (e)(4)(G) and (H) (Describe Procedures for Notification, Access, and Amendment). These exemptions apply to both criminal and non-criminal law enforcement investigatory material. Because system of records 09-25-0224 will be exempt from request requirements in subsection (d)(1) through (4) (Provide Notification, Access, and Amendment Rights) and HHS/NIH's compliance with those request requirements will therefore be voluntary, it is appropriate that HHS/NIH's compliance with the requirements in subsection (e)(4)(G) and (H) to provide request procedures be voluntary also. Notwithstanding these exemptions, HHS/NIH has included request procedures in the SORN for system of records 09-25-0224 because, notwithstanding the exemptions, individual record subjects may submit access and amendment requests, and HHS/NIH will consider such requests on a case-by-case basis.
• Subsection (e)(4)(I) (Identify Categories of Record Sources in the SORN). This exemption applies to both criminal and non-criminal law enforcement investigatory material. Because the information in these records may come from any source, it is not possible to know every category in advance in order to include them all in the SORN. Further, some record source categories would not be appropriate to publish in the SORN if, for example, revealing them could thwart or impede pending and future law enforcement investigations by enabling record subjects or other individuals to discover sensitive investigative techniques and devise ways to bypass or defeat them to evade detection and apprehension.
• Subsection (e)(5) (Maintain Records Used in Agency Determinations with Sufficient Accuracy, Relevance, Timeliness, and Completeness to Ensure Fairness). This exemption applies to only criminal law enforcement investigatory material. It is not always possible to know whether criminal law enforcement investigation information is accurate, relevant, timely, and complete. With regard to relevance, in the course of a law enforcement investigation, and especially in the early stages of an investigation, the relevance of information obtained or introduced may be unclear or the information may not be strictly relevant to a specific investigation. Compliance with (e)(5) would preclude NIH agents from using their investigative training and exercise of good judgment to both conduct and report on investigations.
• Subsection (e)(8) (Make Reasonable Efforts to Provide Notice of Disclosures Made Under Compulsory Legal Process When Such Process Becomes A Matter of Public Record). This exemption applies to only criminal law enforcement investigatory material. Compliance with this requirement would risk revealing an ongoing criminal investigation to the target of an investigation who otherwise might not be aware of it, defeating a law enforcement advantage in those cases. Compliance with this requirement would also risk revealing a criminal investigation by mistake or inappropriately in cases in which an investigation was not in fact a matter of public record or was not intended to be made public.
• Subsection (g) (Civil Liability for Noncompliance with Notification, Access, Amendment, and Accuracy, Relevance, Timeliness, and Completeness Requirements, or for Noncompliance That Causes an Adverse Effect). This exemption applies to only criminal law enforcement investigatory material. The exemption would prevent a subject individual from bringing a civil action against the agency for violations of Privacy Act requirements as to those records; this would include violations of the preceding requirements, from which the agency would be exempt anyway (which violations therefore would be unlikely to support a successful civil action), and any other violations causing an adverse effect on the individual. Any civil action (even an untenable one) could interfere with, delay, and undermine pending and prospective investigations, reveal sensitive investigative techniques and evidence, cause unwarranted invasions of personal privacy, and reveal identities of witnesses, potential witnesses, and confidential sources.

Other Federal agencies have promulgated the same or similar exemptions for their law enforcement investigatory systems of records based on rationales that are the same or similar to those stated for this system of records. See, e.g., the Final Rules published at 68 FR 4923 (Jan. 31, 2003) and 74 FR 42578 (Aug. 24, 2009) by the Department of Justice for Criminal Investigation Report System, Justice/ATF-003, and by the Department of Homeland Security for Security Facility and Perimeter Access Control and Visitor Management, DHS/ALL-024, respectively. For the same reasons, HHS/NIH believes that the exemptions authorized in 5 U.S.C. 552a(j)(2) and (k)(2) are essential to system of records 09-25-0224 to ensure that law enforcement investigatory material in NIH Division of Police files is not disclosed inappropriately to subject individuals. In NIH's past experience, access to such material by record subjects has led to the destruction, fabrication, alteration, or creation of information. The proposed exemptions will help prevent such problems from recurring in the future.

Accordingly, HHS proposes to exempt both criminal and non-criminal law enforcement investigatory material in system of records 09-25-0224 NIH Police Records from the requirements in subsections (c)(3), (d)(1) through (4), (e)(1), (e)(4)(G) through (I), and (f) of the Privacy Act, based on 5 U.S.C. 552a(j)(2) and (k)(2), and to exempt criminal law enforcement investigatory material in the same system of records from the additional requirements in subsections (c)(4), (e)(2) and (3), (e)(5), (e)(8), and (g) of the Privacy Act, based on 5 U.S.C. 552a(j)(2).

Analysis of Impacts

I. Review Under Executive Orders 12866, 13563, and 14094

The agency believes that this proposed rule is not a significant rule under Executive Orders 12866, Regulatory Planning and Review; 13563, Improving Regulation and Regulatory Review; or 14094, Modernizing Regulatory Review, because it will not (1) have an annual effect on the economy of $200 million or more; or adversely affect in a material way the economy, a sector of the economy, productivity, competition, jobs, the environment, public health or safety, or State, local or Tribal governments or communities; (2) create a serious inconsistency or otherwise interfere with any action taken or planned by another agency; (3) materially alter the budgetary impact of entitlements, grants, user fees or loan programs, or the rights and obligations of recipients thereof; or (4) raise legal or policy issues for which centralized review would meaningfully further the President's priorities or the principles set forth in these Executive orders. This proposed rule renders certain Privacy Act requirements inapplicable to certain records (in this case, law enforcement investigatory records) in accordance with criteria established in the Privacy Act based on a showing that agency compliance with those requirements with respect to those records would harm the effectiveness or integrity of the agency function or process for which the records are maintained (in this case, law enforcement investigations). However, the Office of Management and Budget (OMB) has reviewed this regulation under its Privacy Act oversight authority.

II. Review Under the Regulatory Flexibility Act (5 U.S.C. 601-612)

The Regulatory Flexibility Act requires agencies to analyze regulatory options that would minimize any significant impact of a rule on small entities. Because the proposed rule concerns records about individuals, it imposes no duties or obligations on small entities; the agency therefore certifies that the proposed rule will not have a significant economic impact on a substantial number of small entities.

III. Review under the Unfunded Mandates Reform Act of 1995 (Section 202, Pub. L. 104-4)

Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires that agencies prepare a written statement, which includes an assessment of anticipated costs and benefits, before proposing “any rule that includes any Federal mandate that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more (adjusted annually for inflation) in any one year.” The current inflation-adjusted statutory threshold is approximately $156 million based on the Bureau of Labor Statistics inflation calculator. The agency does not expect that this proposed rule will result in any one-year expenditure that would meet or exceed this amount.

IV. Review Under the Paperwork Reduction Act of 1995 (44 U.S.C. 35-1 et seq.)

This proposed rule does not contain any information collection requirements subject to the Paperwork Reduction Act.

V. Review Under Executive Order 13132, Federalism

This proposed rule will not have any direct effects on States, on the relationship between the National Government and the States, or on the distribution of power and responsibilities among the various levels of government. Therefore, no federalism assessment is required.

List of Subjects in 45 CFR Part 5b

• Privacy

For the reasons set out in the preamble, the Department of Health and Human Services proposes to amend 45 CFR part 5b as follows:

PART 5b—PRIVACY ACT REGULATIONS

1. The authority citation for part 5b continues to read as follows:

Authority: 5 U.S.C. 301, 5 U.S.C. 552a.

2. Amend § 5b.11 by adding paragraph (b)(2)(ix) to read as follows:

§ 5b.11

Exempt systems.

* * * * *

(b) * * *

(2) * * *

(ix) Pursuant to subsections (j)(2) and (k)(2) of the Act:

(A) NIH Police Records, 09-25-0224. (All law enforcement investigatory records are exempt from subsections (c)(3), (d)(1) through (4), (e)(1), (e)(4)(G) through (I), and (f) of the Act; criminal law enforcement investigatory records are exempt from additional subsections (c)(4), (e)(2) and (3), (e)(5), (e)(8), and (g); the access exemption for non-criminal law enforcement investigatory records is limited as provided in subsection (k)(2).)

(B) [Reserved]

* * * * *

Xavier Becerra,

Secretary, Department of Health and Human Services.