Privacy Act; Systems of Records
Federal Register: February 25, 2008 (Volume 73, Number 37)
Rules and Regulations
Page 9947-9949
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
DOCID:fr25fe08-4
DEPARTMENT OF JUSTICE 28 CFR Part 16
CPCLO Order No.: 001-2008
Privacy Act of 1974; System of Records
AGENCY: Federal Bureau of Investigation, Department of Justice.
ACTION: Final rule.
SUMMARY: The Federal Bureau of Investigation (FBI), a component agency of the Department of Justice (DOJ), is issuing a final rule exempting a new Privacy Act system of records, the Law Enforcement National Data
Exchange. The FBI published a system of records notice for N-DEx and a proposed rule implementing these exemptions on October 4, 2007. The listed exemptions are necessary to avoid interference with the law enforcement functions and responsibilities of the FBI. This document addresses public comments on the proposed rule.
DATES: This final rule is effective February 25, 2008.
FOR FURTHER INFORMATION CONTACT: Kirsten J. Moncada, Director, Office of Privacy and Civil Liberties, 950 Pennsylvania Avenue, NW.,
Washington, DC 20530, or facsimile 202-616-9627.
SUPPLEMENTARY INFORMATION:
On October 4, 2007, the FBI issued a system of records notice at 72
FR 56793, for a new Privacy Act records system, JUSTICE/FBI-020, the
Law Enforcement National Data Exchange (N-DEx), and a notice of proposed rulemaking, at 72 FR 56704, to exempt it from subsections
(c)(3) and (4); (d)(1), (2), (3), and (4); (e)(1), (2), (3), (5), and
(8); and (g) of the Privacy Act. The FBI explained that the exemptions were necessary in order to avoid interference with the FBI's law enforcement functions and responsibilities.
Two thoughtful comments from individuals were received on the proposed exemptions. One commenter supported the claimed exemptions, observing that they were ``most
Page 9948
assuredly necessary.'' While noting that the exemptions were ``an admirable attempt at balancing privacy and safety interests,'' the other commenter expressed concern about the FBI's exemption of the system from the amendment/correction provisions of subsection (d) of the Privacy Act. This commenter provided two suggestions for ways to permit amendment of N-DEx records. While the FBI appreciates the suggestions, the second one, amending the current law, would require legislation which is the purview of Congress and not the Executive
Branch. The other suggestion, to apply the exemption for a temporal period only (such as the 30-day period envisioned in subsection (d)(3) for responding to Privacy Act requests or some longer period), would place the FBI in the administratively untenable position of having to verify with multiple law enforcement entities the status of any investigation, whether at the state, local or Federal level. The FBI notes that under the operating procedures of N-DEx, any entity that wishes to use information from the system for a law enforcement purpose is required to verify the accuracy of the data with the submitter, which provides a mechanism for ensuring that the information is accurate and timely. The FBI also notes that although it has proposed to exempt the system from the access and amendment provisions of the
Privacy Act, FBI information in the system can be requested under the
Freedom of Information Act. Consequently, individuals potentially have a means to obtain data from closed investigations and can still submit letters of disagreement if some information is determined to be incorrect. See 28 CFR 16.46. The FBI agrees with the commenter that having accurate law enforcement information is necessary, but believes that the system has built-in mechanisms to ensure that the information to be maintained--and more importantly used--is correct, and that the burdens from allowing access and amendment, coupled with the other reasons underlying the exemption, outweigh the benefit to be gained in this case.
The FBI's claim of exemption from the access and amendment provisions of the Privacy Act is consistent with the principles of public policy reflected in the Privacy Act, which allows an agency to exempt itself from certain Privacy Act rules in order to avoid
``undesirable and often unacceptable effects upon agencies in the conduct of necessary public business.'' See Office of Management and
Budget, Privacy Act Implementation Guidelines and Responsibilities, 40
FR 28948, 28971 (July 9, 1975). After careful consideration of the public comments, the FBI has determined that no substantive changes are warranted in the proposed rule and that it should be issued in final form. The FBI, however, is making two minor typographical changes in the final rule: the insertion of subparagraph letters for paragraph 7 and the renumbering of subparagraph (10) to fix a numeration error.
Regulatory Flexibility Act
This rule relates to individuals, as opposed to small business entities. Nevertheless, pursuant to the requirements of the Regulatory
Flexibility Act, the rule will not have a significant economic impact on a substantial number of small entities.
Small Entity Inquiries
The Small Business Regulatory Enforcement Fairness Act (SBREFA) of 1996 requires the FBI to comply with small entity requests for information and advice about compliance with statutes and regulations within FBI jurisdiction. Any small entity that has a question regarding this document may contact the person listed in FOR FURTHER INFORMATION
CONTACT. Persons can obtain further information regarding SBREFA on the
Small Business Administration's Web page at http://www.sba.gov/advo/ laws/law_lib.html.
Paperwork Reduction Act
The Paperwork Reduction Act of 1995 requires that the FBI consider the impact of paperwork and other information collection burdens imposed on the public. There are no current or new information collection requirements associated with this rule.
Analysis of Regulatory Impacts
This rule is not a ``significant regulatory action'' within the meaning of Executive Order 12886. Because the economic impact should be minimal, further regulatory evaluation is not necessary. Moreover, the
Attorney General certifies that this rule would not have a significant economic impact on a substantial number of small entities, because the reporting requirements themselves are not changed and because it applies only to information on individuals.
Unfunded Mandates
Title II of the Unfunded Mandates Reform Act of 1995 (UMRA) requires Federal agencies to assess the effects of certain regulatory actions on State, local, and tribal governments, and the private sector. UMRA requires a written statement of economic and regulatory alternatives for proposed and final rules that contain Federal mandates. A ``Federal mandate'' is a new or additional enforceable duty, imposed on any State, local, or tribal government, or the private sector. If any Federal mandate causes those entities to spend, in aggregate, $100 million or more in any one year the UMRA analysis is required. This rule would not impose Federal mandates on any State, local, or tribal government or the private sector.
Executive Order 13132, Federalism
The FBI has analyzed this rule under the principles and criteria of
Executive Order 13132, Federalism. This action will not have a substantial direct effect on the States, on the relationship between the national Government and the States, or on the distribution of power and responsibilities among the various levels of government, and therefore, will not have federalism implications.
Environmental Analysis
The FBI has reviewed this action for purposes of the National
Environmental Policy Act of 1969 (NEPA) and has determined that this action will not have a significant effect on the human environment.
Energy Impact
The energy impact of this action has been assessed in accordance with the Energy Policy and Conservation Act (EPCA), as amended (42
U.S.C. 6362). This rulemaking is not a major regulatory action under the provisions of the EPCA.
List of Subjects in 28 CFR Part 16
Administrative Practices and Procedures, Courts, Freedom of
Information Act, Government in the Sunshine Act, and the Privacy Act. 0
Pursuant to the authority vested in the Attorney General by 5 U.S.C. 552a and delegated to me by Attorney General Order 793-78, 28 CFR part 16 is amended as follows:
PART 16--[AMENDED]
Subpart E--Exemption of Records Systems Under the Privacy Act 0 1. The authority citation for part 16 continues to read as follows:
Authority: 5 U.S.C. 301, 552, 552a, 552b(g), 553; 18 U.S.C. 4203(a)(1); 28 U.S.C. 509, 510, 524; 31 U.S.C. 3717, 9701. 0 2. Section 16.96 is amended to add new paragraphs (t) and (u) as follows:
Page 9949
Sec. 16.96 Exemption of Federal Bureau of Investigation Systems-- limited access.
* * * * *
(t) The following system of records is exempt from 5 U.S.C. 552a(c)(3) and (4); (d)(1), (2), (3) and (4); (e)(1), (2), (3), (5) and
(8); and (g) of the Privacy Act:
(1) Law Enforcement National Data Exchange (N-DEx), (JUSTICE/FBI- 020).
(2) These exemptions apply only to the extent that information in this system is subject to exemption pursuant to 5 U.S.C. 552a(j)(2).
Where compliance would not appear to interfere with or adversely affect the law enforcement purposes of this system, or the overall law enforcement process, the applicable exemption may be waived by the FBI in its sole discretion.
(u) Exemptions from the particular subsections are justified for the following reasons:
(1) From subsection (c)(3) because this system is exempt from the access provisions of subsection (d). Also, because making available to a record subject the accounting of disclosures from records concerning him/her would specifically reveal any investigative interest in the individual. Revealing this information may thus compromise ongoing law enforcement efforts. Revealing this information may also permit the record subject to take measures to impede the investigation, such as destroying evidence, intimidating potential witnesses or fleeing the area to avoid the investigation.
(2) From subsection (c)(4) because this system is exempt from the access and amendment provisions of subsection (d).
(3) From subsections (d)(1), (2), (3), and (4), because these provisions concern individual access to and amendment of investigatory records, compliance with which could alert the subject of an investigation of the fact and nature of the investigation, and/or the investigative interest of the FBI and other law enforcement agencies; interfere with the overall law enforcement process by leading to the destruction of evidence, improper influencing of witnesses, fabrication of testimony, and/or flight of the subject; possibly identify a confidential source or disclose information which would constitute an unwarranted invasion of another's personal privacy; reveal a sensitive investigative or intelligence technique; or constitute a potential danger to the health or safety of law enforcement personnel, confidential informants, and witnesses. Amendment of these records would interfere with ongoing investigations and other law enforcement activities and impose an impossible administrative burden by requiring investigations, analyses, and reports to be continuously reinvestigated and revised.
(4) From subsection (e)(1) because it is not always possible to know in advance what information is relevant and necessary for law enforcement purposes and, in fact, a major tenet of the N-DEx information sharing system is that the relevance of certain information may not always be evident in the absence of the ability to correlate that information with other existing law enforcement data.
(5) From subsection (e)(2) because application of this provision could present a serious impediment to efforts to solve crimes and improve homeland security in that it would put the subject of an investigation on notice of that fact, thereby permitting the subject to engage in conduct intended to frustrate or impede that activity.
(6) From subsection (e)(3) because disclosure would put the subject of an investigation on notice of that fact and would permit the subject to engage in conduct intended to thwart that activity.
(7)(i) From subsection (e)(5) because many of the records in this system are records contributed by other agencies and the restrictions imposed by (e)(5) would limit the utility of the N-DEx system. All data contributors are expected to ensure that information they share is relevant, timely, complete and accurate. In fact, rules for use of the
N-DEx system will require that information be updated periodically and not be used as a basis for action or disseminated beyond the recipient without the recipient first obtaining permission from the record owner/ contributor. These rules will be enforced through robust audit procedures. The existence of these rules should ameliorate any perceived concerns about the integrity of the information in the N-DEx system. Nevertheless, exemption from this provision is warranted in order to reduce the administrative burden on the FBI to vouch for compliance with the provision by all N-DEx data contributors and to encourage those contributors to share information the significance of which may only become apparent when combined with other information in the N-DEx system.
(ii) The FBI is also exempting the N-DEx from subsection (e)(5) in order to block the use of a challenge under subsection (e)(5) as a collateral means to obtain access to records in the N-DEx. The FBI has exempted these records from the access and amendment requirements of subsection (d) of the Privacy Act in order to protect the integrity of law enforcement investigations. Exempting the N-DEx system from subsection (e)(5) complements this exemption and will provide the FBI with the ability to prevent the assertion of challenges to a record's accuracy, timeliness, completeness and/or relevance under subsection
(e)(5) to circumvent the exemption claimed from subsection (d).
(8) From subsection (e)(8), because to require individual notice of disclosure of information due to compulsory legal process would pose an impossible administrative burden on the FBI and may alert the subjects of law enforcement investigations to the fact of those investigations, when not previously known.
(9) From subsection (g) to the extent that the system is exempt from other specific subsections of the Privacy Act.
Dated: February 14, 2008.
Kenneth P. Mortensen,
Acting Chief Privacy and Civil Liberties Officer, Department of
Justice. 8
FR Doc. E8-3433 Filed 2-22-08; 8:45 am
BILLING CODE 4410-02-P
