2023-24233. Privacy Act Regulations for EPA-100

AGENCY:

Office of Inspector General, Environmental Protection Agency (EPA).

ACTION:

Direct final rule.

SUMMARY:

The Environmental Protection Agency (EPA) is taking direct final action to revise the Agency's Privacy Act regulations to exempt a new system of records, EPA–100, OIG Data Analytics Enterprise, from certain requirements of the Privacy Act. In this rulemaking, the Agency exempts portions of this system from certain provisions of the Privacy Act because of law enforcement requirements and to avoid interference during the conduct of criminal, civil, or administrative actions or investigations. Additionally, EPA is taking direct final action to revise the Agency's Privacy Act regulations to update the names of systems of records with general and specific exemptions, change wording to reflect that the Office of Inspector General (OIG) is an independent component of EPA, incorporate the revised citation for the Inspector General Act of 1978 and to remove specific systems of record which are no longer exempt.

DATES:

This rule is effective on February 6, 2024 without further notice, unless EPA receives adverse comment by December 8, 2023. If EPA receives adverse comment, we will publish a timely withdrawal in the Federal Register informing the public that the rule will not take effect.

ADDRESSES:

Submit your comments, identified by Docket ID No. EPA–HQ–OMS–2023–0020, at https://www.regulations.gov. Follow the online instructions for submitting comments. Once submitted, comments cannot be edited or removed from Regulations.gov. The EPA may publish any comment received to its public docket. Do not submit electronically any information you consider to be Confidential Business Information (CBI) or other information whose disclosure is restricted by statute. Multimedia submissions (audio, video, etc.) must be accompanied by a written comment. The written comment is considered the official comment and should include discussion of all points you wish to make. The EPA will generally not consider comments or comment contents located outside of the primary submission ( i.e., on the web, cloud, or other file sharing system). For additional submission methods, the full EPA public comment policy, information about CBI or multimedia submissions, and general guidance on making effective comments, please visit https://www.epa.gov/​dockets/​commenting-epa-dockets.

FOR FURTHER INFORMATION CONTACT:

Daniel Porter, Director, Data Analytics Directorate, Office of Inspector General, Environmental Protection Agency, 1200 Pennsylvania Avenue NW, Washington, DC 20004; telephone number: 202–309–6449; email address: [e-mail].

SUPPLEMENTARY INFORMATION:

I. Why is EPA using a direct final rule?

The EPA is publishing this rule without a prior proposed rule because we view this as a noncontroversial action and anticipate no adverse comment. However, in the “Proposed Rules” section of this Federal Register , we are publishing a separate document that will serve as the proposed rule to exempt a new system of records, EPA–100, the OIG Data Analytics Enterprise Tracking System, from certain requirements of the Privacy Act if adverse comments are received on this direct final rule. We will not institute a second comment period on this action. Any parties interested in commenting must do so at this time. For further information about commenting on this rule, see the ADDRESSES section of this document.

If EPA receives adverse comment, we will publish a timely withdrawal in the Federal Register informing the public that this direct final rule will not take effect. We would address all public comments in any subsequent final rule based on the proposed rule.

EPA is also revising the Agency's Privacy Act regulations to update the names of systems of records with general and specific exemptions. Specifically, 40 CFR 16.11, will be modified to update the name of EPA–17 from OCEFT Criminal Investigative Index and Files to Online Criminal Enforcement Activities Network (OCEAN) and EPA–40 from Inspector General's Operation and Reporting (IGOR) System Investigative Files to Inspector General Enterprise Management System (IGEMS) Investigative Module and to add EPA–100 OIG Data Analytics Enterprise. Likewise, 40 CFR 16.12 will also be modified to update the names of EPA–17 from OCEFT Criminal Investigative Index and Files to Online Criminal Enforcement Activities Network (OCEAN), EPA–21 from External Compliance Program Discrimination Complaint Files to External Compliance Case Tracking System (EXCATS), EPA–30 from OIG Hotline Allegation System to Inspector General Enterprise Management System (IGEMS) Hotline Module and EPA–40 from Inspector General's Operation and Reporting (IGOR) System Investigative Files to Inspector General Enterprise Management System (IGEMS) Investigative Module. Additionally, § 16.12 will be modified to add EPA–100 OIG Data Analytics Enterprise and to remove reference to EPA–41 because the system of records is no longer exempt.

II. General Information

The EPA will use this system of records to develop data models and analyses in order to identify fraud, waste and abuse, and programmatic problems and deficiencies. This system of records will allow the EPA OIG to identify correlations between existing EPA data sets and other government agency data sets so as to identify patterns and correlations that indicate fraud and issues of program waste and abuse. EPA OIG will apply analytics and data modeling principles within this system of records to identify problems or failures in the implementation or performance of internal controls within the EPA. The records may be used in the course of performing audits, evaluations, and inspections; investigating individuals and entities suspected of criminal, civil, or administrative misconduct and in supporting related judicial and administrative proceedings; or in conducting preliminary inquiries undertaken to determine whether to commence an audit, evaluation, inspection, or investigation.

The EPA compiles and maintains the records in the OIG Data Analytics Enterprise for use in criminal and civil investigations and actions. This system of records, EPA–100, is maintained by the Office of Inspector General. This component of EPA performs as its principal function, activities pertaining to the enforcement of criminal laws.

The Privacy Act allows Federal agencies to exempt eligible records in a system of records from certain provisions of the Act, including those that provide individuals with a right to request access to and amendment of their own records. If an agency intends to exempt a particular system of records, it must first go through the rulemaking process pursuant to 5 U.S.C. 553(b)(1)–(3), (c), and (e). This rule explains why an exemption is being claimed for this system of records and invites public comment, which EPA will consider.

Under 5 U.S.C. 552a(j)(2), the head of any agency may exempt any system of records within the agency from certain provisions of the Privacy Act, if the agency or component that maintains the system performs as its principal function any activities pertaining to the enforcement of criminal laws. The Inspector General Act mandates that the Inspector General recommend policies for, and conduct, supervise, and coordinate activities in the Agency and between the Agency and other Federal, State, and local government agencies with respect to all matters relating to the prevention and detection of fraud in programs and operations administered or financed by the Agency, and to the identification and prosecution of participants in such fraud. Under the Inspector General Act, whenever the Inspector General has reasonable grounds to believe that there has been a violation of Federal criminal law, the Inspector General must report the matter expeditiously to the Attorney General. In addition to these principal functions pertaining to the enforcement of criminal laws, the Inspector General may receive and investigate complaints on information from various sources concerning the possible existence of activities constituting violations of law, rules, or regulations, or mismanagement, gross waste of funds, abuses of authority, or substantial and specific danger to the public health and safety. To the extent criminal law enforcement information is contained in the system as enumerated in 5 U.S.C. 552a(j)(2), the provisions of the Privacy Act from which exemptions are claimed under 5 U.S.C. 552a(j)(2) are as follows: 5 U.S.C. 552a(c)(3) and (4); 5 U.S.C. 552a(d); 5 U.S.C. 552a(e)(1), (2) and (3); 5 U.S.C. 552a(e)(4)(G) and (H); 5 U.S.C. 552a(e)(5) and (8); 5 U.S.C. 552a(f)(2) through (5); and 5 U.S.C. 552a(g).

EPA is claiming the above exemptions for the following reasons:

(1) From subsection (c)(3), because making available to a named individual an accounting of disclosures of records concerning him/her/them could reveal investigative interest on the part of EPA and/or the Department of Justice. This could allow record subjects to impede the investigation, e.g., destroy evidence, intimidate potential witnesses, or flee the area to avoid inquiries or apprehension by law enforcement personnel. More broadly, the application of this provision could reveal the OIG's investigative interests, which could compromise those investigative interests. Further, such a disclosure could reveal the identity of a confidential source and hamper the Agency's investigation.

(2) From subsection (c)(4), which concerns providing notice to others regarding corrections or disputed information in accordance with subsection (d) of the Privacy Act, because no access to these records is available under subsection (d) of the Act.

(3) From subsection (d), which requires an agency to permit an individual to access, contest or request amendment of records pertaining to him/her/them, because the records contained in this system relate to official Federal investigations. Individual access to these records could compromise ongoing investigations, reveal confidential informants and/or sensitive investigative techniques used in particular investigations, or constitute unwarranted invasions of the personal privacy of third parties who are involved in a certain investigation.

(4) From subsection (e)(1), which requires an agency to maintain only relevant and necessary information about an individual, because the relevance or necessity of information obtained in the course of a law enforcement investigation is not always known when collected. Material that may seem unrelated, irrelevant, or incomplete when collected may take on added meaning or significance as the investigation progresses. Also, in the interest of effective law enforcement, it is appropriate to retain all information that may aid in establishing patterns of criminal activity. Therefore, it would impede the investigative process if it were necessary to assure the relevance and necessity of all information obtained.

(5) From subsection (e)(2), which requires an agency to collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about the individual's rights, benefits, or privileges under Federal programs. Application of this provision could impair investigations and law enforcement by alerting the subject of the investigation to the existence of the investigation. Further, compliance with the requirements of this subsection during the course of an investigation could impede the information gathering process or cause the destruction of evidence, thus hampering the investigation.

(6) From subsection (e)(3), which requires an agency to inform those supplying information of its authority to collect the information, its plans for using or sharing that information, and the effects of not providing the requested information. The application of this provision could provide the subject of the investigation with substantial information about the nature of the investigation, which could interfere with the investigation. To comply with the requirements of this subsection during the course of an investigation could impede the information gathering process especially when undercover operations or confidential sources are used, thus hampering the investigation.

(7) From subsections (e)(4)(G) and (H), which require an agency to publish—in the Federal Register —procedures concerning access to records, because no access to these records is available under subsection (d) of the Privacy Act, for the reasons explained above in the discussion of subsection (d).

(8) From subsection (e)(5), which requires an agency to maintain its records with accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual, because it is not possible to determine in advance what information is accurate, relevant, timely, and complete. Facts are first gathered and then placed into a logical order to prove or disprove objectively the criminal behavior of an individual. Material that may seem unrelated, irrelevant, or incomplete when collected may take on added meaning or significance as the investigation progresses. The restrictions of this provision could interfere with the preparation of a complete investigative report, thereby impeding effective law enforcement.

(9) From subsection (e)(8), which requires notice to an individual whenever a record on such individual is made available to others under compulsory legal process, because complying with this provision could prematurely reveal an ongoing criminal investigation to the subject of the investigation.

(10) From subsections (f)(2), (f)(3), (f)(4), and (f)(5), concerning agency rules for obtaining access to records under subsection (d), because this system is exempt from the access and amendment provisions of subsection (d). Since EPA is exempting this system of records from subsection (d) of the Act, concerning access to records, the requirements of subsections (f)(2) through (5) of the Act, concerning agency rules for obtaining access to such records, are inapplicable and are exempted to the extent that this system of records is exempted from subsection (d) of the Act.

(11) From subsection (g), which provides for civil remedies if an agency fails to comply with certain requirements of the Act applicable to a nonexempt system of records, because EPA is exempting this system of records from subsections (c)(3) and (4); (d); (e)(1), (2), (3), (4)(G), and (H), (5), and (8); and (f)(2) through (5) of the Act. The provisions of subsection (g) of the Act are inapplicable to the extent that this system of records is exempted from those subsections of the Act.

The EPA also compiles and maintains the records in the OIG Data Analytics Enterprise for use in civil and administrative investigations and actions. In those cases, the system again is maintained by the Office of Inspector General. 5 U.S.C. 552a(k)(2) states that the head of an agency may promulgate regulations to exempt the system from certain provisions of the Act if the system “is investigatory material compiled for law enforcement purposes, other than material within the scope of subsection (j)(2)” of 5 U.S.C. 552a. Accordingly, to the extent investigatory records are not covered under the exemptions in subsection (j)(2), the following provisions of the Privacy Act are exempt pursuant to 5 U.S.C. 552a(k)(2): 5 U.S.C. 552a(c)(3), 5 U.S.C. 552a(d), 5 U.S.C. 552a(e)(1), 5 U.S.C. 552a(e)(4)(G) and (H) and 5 U.S.C. 552a(f)(2) through (5):

(1) From subsection (c)(3) because making available to named individual an accounting of disclosures of records concerning him/her/them could reveal investigative interest on the part of EPA and/or the Department of Justice. This could allow record subjects to impede the investigation, e.g., destroy evidence, intimidate potential witnesses, or flee the area to avoid inquiries or apprehension by law enforcement personnel. More broadly, the application of this provision could reveal the OIG's investigative interests, which could compromise those investigative interests. Further, such a disclosure could reveal the identity of a confidential source and hamper the Agency's investigation.

(2) From subsection (d), which requires an agency to permit an individual to access, contest or request amendment of records pertaining to him/her/them, because the records contained in this system relate to official Federal investigations. Individual access to these records could compromise ongoing investigations, reveal confidential informants and/or sensitive investigative techniques used in particular investigations, or constitute unwarranted invasions of the personal privacy of third parties who are involved in a certain investigation.

(3) From subsection (e)(1), which requires each agency to maintain only such information about an individual as is relevant and necessary to accomplish a purpose of the agency, because in the course of law enforcement investigations information may occasionally be obtained or introduced the accuracy of which is unclear or which is not strictly relevant or necessary to a specific investigation. In the interests of effective law enforcement, it is appropriate to retain all information that may aid in establishing patterns of criminal activity. Moreover, it would impede any investigative process, whether civil or criminal, if it were necessary to assure the relevance, accuracy, timeliness and completeness of all information obtained.

(4) From subsections (e)(4)(G) and (H), which require an agency to publish—in the Federal Register —procedures concerning access to records, because no access to these records is available under subsection (d) of the Privacy Act, for the reasons explained above in the discussion of subsection (d).

(5) From subsection (f)(2), (f)(3), (f)(4), and (f)(5), concerning agency rules for obtaining access to records under subsection (d), because this system is exempt from the access and amendment provisions of subsection (d). Since EPA is exempting this system of records from subsection (d) of the Act, concerning access to records, the requirements of subsections (f)(2) through (5) of the Act, concerning agency rules for obtaining access to such records, are inapplicable and are exempted to the extent that this system of records is exempted from subsection (d) of the Act.

The EPA also compiles and maintains the records in the OIG Data Analytics Enterprise, EPA–100, for the purpose of determining suitability, eligibility, or qualifications for Federal civilian employment, military service, Federal contracts, or access to classified information. In those cases, the system again is maintained by the Office of Inspector General. The statute at 5 U.S.C. 552a(k)(5) states that the head of any agency may by rule exempt any system of records within the agency from certain provisions of the Privacy Act, if the system of records is investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for Federal civilian employment, military service, Federal contracts, or access to classified information, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence. Accordingly, to the extent any records would disclose source-identifying information, all such information in the OIG Data Analytics Enterprise, EPA–100, are exempt from 5 U.S.C. 552a(c)(3) and 5 U.S.C. 552a(d):

(1) From subsection (c)(3) because making available to named individual an accounting of disclosures of records concerning him/her/them could reveal investigative interest on the part of EPA and/or the Department of Justice. This could allow record subjects to impede the investigation, e.g., destroy evidence, intimidate potential witnesses, or flee the area to avoid inquiries or apprehension by law enforcement personnel. More broadly, the application of this provision could reveal the OIG's investigative interests, which could compromise those investigative interests. Further, such a disclosure could reveal the identity of a confidential source and hamper the Agency's investigation.

(2) From subsection (d), which requires an agency to permit an individual to access, contest or request amendment of records pertaining to him/her/them, because the records contained in this system relate to official Federal investigations. Individual access to these records could compromise ongoing investigations, reveal confidential informants and/or sensitive investigative techniques used in particular investigations, or constitute unwarranted invasions of the personal privacy of third parties who are involved in a certain investigation.

III. Statutory and Executive Orders Reviews

Additional information about these statutes and Executive orders can be found at https://www.epa.gov/​laws-regulations/​laws-and-executive-orders.

A. Executive Order 12866: Regulatory Planning and Review and Executive Order 13563: Improving Regulation and Regulatory Review

This action was submitted to the Office of Management and Budget (OMB) for review and reviewed without comment.

B. Paperwork Reduction Act (PRA)

This action does not impose an information collection burden under the PRA. This action contains no provisions constituting a collection of information under the PRA.

C. Regulatory Flexibility Act (RFA)

I certify that this action will not have a significant economic impact on a substantial number of small entities under the RFA. This action will not impose any requirements on small entities.

D. Unfunded Mandates Reform Act (UMRA)

This action does not contain any unfunded mandate as described in UMRA, 2 U.S.C. 1531–1538, and does not significantly or uniquely affect small governments.

E. Executive Order 13132 (Federalism)

This action does not have federalism implications. It will not have substantial direct effects on the states, on the relationship between the National Government and the states, or on the distribution of power and responsibilities among the various levels of government.

F. Executive Order 13175: Consultation and Coordination With Indian Tribal Governments

This action does not have tribal implications as specified in Executive Order 13175. Thus, Executive Order 13175 does not apply to this action.

G. Executive Order 13045: Protection of Children From Environmental Health Risks and Safety Risks

The EPA interprets Executive Order 13045 as applying only to those regulatory actions that concern environmental health or safety risks that the EPA has reason to believe may disproportionately affect children, per the definition of “covered regulatory action” in section 2–202 of the Executive order. This action is not subject to Executive Order 13045 because it does not concern an environmental health risk or safety risk.

H. Executive Order 13211: Actions Concerning Regulations That Significantly Affect Energy Supply, Distribution, or Use

This action is not subject to Executive Order 13211, because it is not a significant regulatory action under Executive Order 12866.

I. National Technology Transfer and Advancement Act

This rulemaking does not involve technical standards.

J. Executive Order 12898: Federal Actions To Address Environmental Justice in Minority Populations and Low-Income Populations

The EPA believes that this action does not have disproportionately high and adverse human health or environmental effects on minority populations, low-income populations and/or indigenous peoples, as specified in Executive Order 12898 (59 FR 7629, February 16, 1994).

List of Subjects in 40 CFR Part 16

• Environmental protection
• Administrative practice and procedure
• Confidential business information
• Government employees
• Privacy

Kimberly Y. Patrick,

Principal Deputy Assistant Administrator, Office of Mission Support.

For the reasons set forth in the preamble, EPA amends 40 CFR part 16 as follows:

PART 16—IMPLEMENTATION OF PRIVACY ACT OF 1974

1. The authority citation for part 16 continues to read as follows:

Authority: 5 U.S.C. 301, 552a (as revised).

2. Amend § 16.11 by:

a. Revising paragraph (a) and (c)(2);

b. Adding paragraph (c)(6); and

c. Revising paragraph (d) and the introductory text of paragraph (e).

The revisions and addition read as follows:

§ 16.11

General exemptions.

(a) Systems of records affected. (1) EPA–17 Online Criminal Enforcement Activities Network (OCEAN).

(2) EPA–40 Inspector General Enterprise Management System (IGEMS) Investigative Module.

(3) EPA–63 eDiscovery Enterprise Tool Suite.

(4) EPA–79 NEIC Master Tracking System.

(5) EPA–100 OIG Data Analytics Enterprise.

* * * * *

(c) * * *

(2) The Agency's system of records, EPA–40 is maintained by the Office of Inspector General (OIG), an independent component of EPA that performs as its principal function activities pertaining to the enforcement of criminal laws. Authority for the criminal law enforcement activities of the OIG's Office of Investigations is the Inspector General Act of 1978, as amended, 5 U.S.C. 401–424.

* * * * *

(6) The Agency's system of records, EPA–100 system of records is maintained by the Office of Inspector General, an independent component of EPA which performs as its principal function activities pertaining to the enforcement of criminal laws. Authority for the criminal law enforcement activities of the Office of Inspector General is the Inspector General Act of 1978, as amended, 5 U.S.C. 401–424.

(d) Scope of exemption. EPA systems of records 17, 40, 63, 79, and 100 are exempted from the following provisions of the PA: 5 U.S.C. 552a(c)(3) and (4); (d); (e)(1), (2), (3), (4)(G), and (H), (5), and (8); (f)(2) through (5); and (g). To the extent that the exemption for EPA systems of records 17, 40, 63, 79 and 100 claimed under 5 U.S.C. 552a(j)(2) is held to be invalid, then an exemption under 5 U.S.C. 552a(k)(2) is claimed for these systems of records from (c)(3), (d), (e)(1), (e)(4)(G) and (H), and (f)(2) through (5). For Agency's system of records, EPA system 40, an exemption is separately claimed under 5 U.S.C. 552(k)(5) from (c)(3), (d), (e)(1), (e)(4)(G), (4)(H), and (f)(2) through (5). For Agency's system of records, EPA system 100, an exemption is separately claimed under 5. U.S.C. 552(k)(5) from (c)(3) and (d).

(e) Reasons for exemption. EPA systems of records 17, 40, 63, 79, and 100 are exempted from the provisions of the PA in paragraph (d) of this section for the following reasons:

* * * * *

3. Amend § 16.12 by revising paragraph (a)(1), the first sentence in paragraph (a)(4)(i), paragraph (a)(4)(iii), the introductory text of paragraph (a)(5), paragraphs (b)(1) and (4), and the introductory text of paragraph (b)(5) to read as follows:

§ 16.12

Specific exemptions.

(a) * * *

(1) Systems of records affected. (i) EPA–17 Online Criminal Enforcement Activities Network (OCEAN).

(ii) EPA–21 External Compliance Case Tracking System (EXCATS).

(iii) EPA–30 Inspector General Enterprise Management System (IGEMS) Hotline Module.

(iv) EPA–40 Inspector General Enterprise Management System (IGEMS) Investigative Module.

(v) EPA–63 eDiscovery Enterprise Tool Suite.

(vi) EPA–79 NEIC Master Tracking System.

(vii) EPA–100 OIG Data Analytics Enterprise.

* * * * *

(4) * * *

(i) EPA systems of records 17, 30, 40, 63, 79, and 100 are exempted from the following provisions of the PA, subject to the limitations set forth in 5 U.S.C. 552a(k)(2): 5 U.S.C. 552a(c)(3); (d); (e)(1), (4)(G) and (4)(H); and (f)(2) through (5). * * *

* * * * *

(iii) EPA–17 Online Criminal Enforcement Activities Network (OCEAN), EPA–40 Inspector General Enterprise Management System (IGEMS) Investigative Module, EPA–79 NEIC Master Tracking System, and EPA–100 OIG Data Analytics Enterprise are exempted under 5 U.S.C. 552a(j)(2), and these systems are exempted under 5 U.S.C. 552a(k)(2) only to the extent that the (j)(2) exemption is held to be invalid.

(5) Reasons for exemption. EPA systems of records 17, 21, 30, 40, 63, 79, and 100 are exempted from the provisions of the PA in paragraph (a)(4) of this section for the following reasons:

* * * * *

(b) * * *

(1) Systems of records affected. (i) EPA 36 Research Grant, Cooperative Agreement, and Fellowship Application Files.

(ii) EPA 40 Inspector General Enterprise Management System (IGEMS) Investigative Module.

(iii) EPA 100 OIG Data Analytics Enterprise.

* * * * *

(4) Scope of exemption. (i) EPA 36 and 100 are exempted from 5 U.S.C. 552a(c)(3) and (d). EPA 40 is exempted from the following provisions of the PA, subject to the limitations of 5 U.S.C. 552a(k)(5); 5 U.S.C. 552a(c)(3); (d); (e)(1), (4)(H); and (f)(2) through (5).

(ii) To the extent that records in EPA 40 and 100 reveal a violation or potential violation of law, then an exemption under 5 U.S.C. 552a(k)(2) is also claimed for these records. EPA 40 and 100 are also exempt under 5 U.S.C. 552a(j)(2).

(5) Reasons for exemption. EPA 36, 40, and 100 are exempted from the above provisions of the PA for the following reasons:

* * * * *