Notice2022-00620
The Interagency Council on Statistical Policy's Recommendation for a Standard Application Process (SAP) for Requesting Access to Certain Confidential Data Assets
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
January 14, 2022
Issuing agencies
Management and Budget Office
Abstract
As part of the implementation of the Foundations for Evidence- Based Policymaking Act of 2018, the Office of Management and Budget (OMB) requests comments on the Interagency Council on Statistical Policy's recommendation for a Standard Application Process (SAP) for requesting access to certain confidential data assets. The SAP is to be a process through which agencies, the Congressional Budget Office, State, local, and Tribal governments, researchers, and other individuals, as appropriate, may apply to access confidential data assets accessed or acquired by a statistical agency or unit for the purposes of developing evidence. This new process would be implemented while maintaining stringent controls to protect confidentiality and privacy, as required by the law.
Full Text
<html>
<head>
<title>Federal Register, Volume 87 Issue 10 (Friday, January 14, 2022)</title>
</head>
<body><pre>
[Federal Register Volume 87, Number 10 (Friday, January 14, 2022)]
[Notices]
[Pages 2459-2462]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2022-00620]
-----------------------------------------------------------------------
OFFICE OF MANAGEMENT AND BUDGET
The Interagency Council on Statistical Policy's Recommendation
for a Standard Application Process (SAP) for Requesting Access to
Certain Confidential Data Assets
AGENCY: Office of Information and Regulatory Affairs, Office of
Management and Budget, Executive Office of the President.
ACTION: Notice of solicitation of comments.
-----------------------------------------------------------------------
SUMMARY: As part of the implementation of the Foundations for Evidence-
Based Policymaking Act of 2018, the Office of Management and Budget
(OMB) requests comments on the Interagency Council on Statistical
Policy's recommendation for a Standard Application Process (SAP) for
requesting access to certain confidential data assets. The SAP is to be
a process through which agencies, the Congressional Budget Office,
State, local, and Tribal governments, researchers, and other
individuals, as appropriate, may apply to access confidential data
assets accessed or acquired by a statistical agency or unit for the
purposes of developing evidence. This new process would be implemented
while maintaining stringent controls to protect confidentiality and
privacy, as required by the law.
DATES: To ensure consideration of comments on this Notice, comments
must be provided in writing no later than 60 days from the publication
date of this notice. Because of delays in the receipt of regular mail
related to security screening, respondents are encouraged to send
comments electronically (see ADDRESSES, below).
ADDRESSES: Comments may be sent via <a href="http://www.regulations.gov">www.regulations.gov</a>--a Federal E-
Government website that allows the public to find, review, and submit
comments on documents that agencies have published in the Federal
Register and that are open for comment. Simply type ``OMB-2022-0001''
(in quotes) in the Comment or Submission search box, click Go, and
follow the instructions for submitting comments. Comments received by
the date specified above will be included as part of the official
record.
Comments submitted in response to this notice may be made available
to the public and are subject to disclosure under the Freedom of
Information Act. For this reason, please do not include in your
comments information of a confidential nature, such as sensitive
personal information or proprietary information. If you send an email
comment, your email address will be automatically captured and included
as part of the comment that is placed in the public docket; however,
<a href="http://www.regulations.gov">www.regulations.gov</a> does include the option of commenting anonymously.
Please note that responses to this public comment request containing
any routine notice about the confidentiality of the communication will
be treated as public comments that may be made available to the public
notwithstanding the inclusion of the routine notice.
Electronic Availability: Federal Register notices are available
electronically at <a href="http://www.federalregister.gov/">www.federalregister.gov/</a>.
FOR FURTHER INFORMATION CONTACT: For information about this request for
comments, contact Rochelle Martinez, OMB,
<a href="/cdn-cgi/l/email-protection#faa98e9b8e93898e93999b96a5be93889f998e938c9f89ba959798d49f958ad49d958c"><span class="__cf_email__" data-cfemail="590a2d382d302a2d303a3835061d302b3c3a2d302f3c2a1936343b773c3629773e362f">[email protected]</span></a>, 9242 New Executive Office Building,
725 17th St. NW, Washington, DC 20503, telephone (202) 395-5897.
SUPPLEMENTARY INFORMATION: OMB is issuing a request for comment under
the Foundations for Evidence-Based Policymaking Act of 2018, Public Law
115-435, 132 stat. 5529 (2019), hereafter referred to as the Evidence
Act.
Specifically, the Evidence Act requires OMB to establish a process
through which agencies, the Congressional Budget Office, State, local,
and Tribal governments, researchers, and other individuals, as
appropriate, may apply for access to confidential data assets accessed
or acquired by a statistical agency or unit.\1\ This new process would
be implemented while maintaining stringent controls to protect
confidentiality and privacy, as required by the law. In addition, under
the Paperwork Reduction Act, the Interagency Council on Statistical
Policy (ICSP) is to advise and assist the Director of OMB in
coordinating the Federal statistical system and setting statistical
policy.\2\ The ICSP is chaired by the Chief Statistician of the United
States and membership includes the heads of the 13 recognized
statistical agencies, or in the case of an agency that does not have a
statistical agency or unit, the agency's Statistical Official.\3\
---------------------------------------------------------------------------
\1\ 44 U.S.C. 3583(a). ``Statistical agencies or units'' are
those agencies or organizational units designated by the Director of
OMB pursuant to 44 U.S.C. 3562(a).
\2\ 44 U.S.C. 3504(e).
\3\ 5 U.S.C. 314.
---------------------------------------------------------------------------
In that capacity, and in order for the statistical system to comply
with this Evidence Act requirement, the ICSP submitted a set of
recommendations to OMB for a policy that would establish a standard
application process (SAP) for requesting access to certain confidential
data assets accessed or acquired by designated statistical agencies and
units.
OMB's Office of the Chief Statistician, within the Office of
Information and Regulatory Affairs (OIRA), relies on public comment and
subject matter expertise across the Federal government when
establishing OMB policies or guidance for efficient coordination of
Federal statistics. Accordingly, OMB is seeking public comment on the
ICSP's recommendations.
Applicability
The proposed policy would impose requirements on all recognized
[[Page 2460]]
statistical agencies and units under 44 U.S.C. 3561(11) and 3562. As a
result, all persons seeking access to data under U.S.C. 3583 would
apply for such access under the requirements of this policy. At the
time of this proposal, there are sixteen designated statistical
agencies and units: Bureau of Economic Analysis (Department of
Commerce); Bureau of Justice Statistics (Department of Justice); Bureau
of Labor Statistics (Department of Labor); Bureau of Transportation
Statistics (Department of Transportation); Census Bureau (Department of
Commerce); Center for Behavioral Health Statistics and Quality,
Substance Abuse and Mental Health Services Administration (Department
of Health and Human Services); Economic Research Service (Department of
Agriculture); Energy Information Administration (Department of Energy);
Microeconomic Surveys Unit (Board of Directors of the Federal Reserve
System); National Agricultural Statistical Service (Department of
Agriculture); National Animal Health Monitoring System, Animal and
Plant Health Inspection Service (Department of Agriculture); National
Center for Education Statistics (Department of Education); National
Center for Health Statistics (Department of Health and Human Services);
National Center for Science and Engineering Statistics (National
Science Foundation); Office of Research, Evaluation, and Statistics
(Social Security Administration); and Statistics of Income Division
(Department of the Treasury).
In the future, if the Director of OMB recognizes an agency or
organizational unit as a statistical agency or unit, then it would
become subject to this policy and shall adopt the SAP.
Under the proposal, other Executive branch agencies or
organizational units may, at their discretion, and with the concurrence
of the SAP Governance Body, utilize the SAP to accept applications for
access to confidential data for the purpose of developing evidence.
Agencies facilitate access to confidential data by enabling applicants
to submit proposals through the SAP. When making use of the SAP to
accept such proposals, it is proposed that an Agency must adopt and
abide by the entirety of this policy for those data assets, including
use of the data inventory, common application, review criteria,
timelines, appeals process, progress tracking, and reporting, with
appropriate exceptions for legal and regulatory requirements as allowed
for in the proposed policy.
Background
Data accessed or acquired by statistical agencies and units is
vital for developing evidence on conditions, characteristics, and
behaviors of the public and on the operations and outcomes of public
programs and policies. This evidence can benefit the stakeholders in
the programs, the broader public, and policymakers and program managers
at the local, State, Tribal, and National levels. Some evidence may be
built upon public versions of data that were initially collected under
a statistical confidentiality protection statute, but where some type
of disclosure limitation methods have been applied, such as the removal
of Personal Identifying Information (PII) and aggregation of
information, to prevent the risk of disclosing the identities of
individuals. However, some evidence-building activities have long
required or benefited greatly from the use of properly and strongly
protected confidential data. Such uses are conducted in a manner that
maintains the confidentiality of the data and the public trust.
Again, these arrangements have long been established by contract or
by entering into a special agreement, where a statistical agency or
unit may allow approved individuals (hereafter, referred to as agents)
to perform exclusively statistical activities on an approved project
using confidential data, subject to appropriate control, supervision,
and agreement to comply with all relevant legal provisions. CIPSEA
authorizes data accessed or acquired by a statistical agency or unit
under a pledge of confidentiality to be shared with such agents, and
subjects such agents to the same fines and penalties, including
potential criminal penalties, for willful and unauthorized disclosures
as statistical agency or unit employees and officers. Such arrangements
have been used successfully even prior to CIPSEA's enactment in 2002
for the purpose of facilitating the generation of evidence.
However, the process for an individual to become a designated agent
authorized to access a confidential data asset for an approved
statistical activity often varies across Federal statistical agencies.
Moreover, the trusted status that agents obtain from one agency may not
transfer to another agency, requiring the potential duplication of
costly and time-consuming clearance processes. The variety of
applications and clearance procedures used across the Federal
statistical system for confidential data access potentially impacts the
ability of agents to generate evidence that could inform the efficiency
of government policies and programs, as well as the availability of
evidence to inform non-Federal decision making. Evidence building
opportunities would be enhanced, while maintaining data protections and
ensuring appropriate use, by the design and construction of a standard
application process (SAP) for access to confidential data.
Recognizing this potential, in 2016, the U.S. Congress established
the Commission on Evidence-Based Policymaking (CEP) to explore how to
increase the availability and use of evidence in the Federal government
while protecting privacy and confidentiality. In the September 7, 2017
report on its findings, the CEP provided a series of recommendations in
response to its charge. As part of its findings, the CEP highlighted
the heterogeneity in application processes for confidential data as an
important challenge for those seeking to access confidential data from
multiple agencies to build evidence. The CEP further noted that
``inefficiencies in the [confidential] data access processes create
administrative expenses and researcher burdens that can impede
Federally-funded research.'' \4\ Federally-funded research, while not
the only type of research that would be supported by the SAP, today
represents a large share of data-access demand.
---------------------------------------------------------------------------
\4\ <a href="https://bipartisanpolicy.org/wp-content/uploads/2019/03/Full-Report-The-Promise-of-Evidence-Based-Policymaking-Report-of-the-Comission-on-Evidence-based-Policymaking.pdf">https://bipartisanpolicy.org/wp-content/uploads/2019/03/Full-Report-The-Promise-of-Evidence-Based-Policymaking-Report-of-the-Comission-on-Evidence-based-Policymaking.pdf</a>.
---------------------------------------------------------------------------
The CEP report directly influenced the Evidence Act. Informed by
the findings of the CEP,\5\ the Evidence Act requires that the Director
of OMB establish an SAP that will be adopted by statistical agencies
and units and allow agencies, the Congressional Budget Office, State,
local, and Tribal governments, researchers, and other individuals, as
appropriate, to apply to access certain confidential data accessed or
acquired by statistical agencies or units.\6\ Specifically, the
Evidence Act requires that each statistical agency or unit establish an
`identical' application process, which includes not just the
application form but also the criteria for determining whether to grant
an applicant access to the confidential data
[[Page 2461]]
asset, timeframes for prompt determinations, an appeals process for
adverse determinations, and reporting requirements for full
transparency. While the adoption of the SAP is required for statistical
agencies and units recognized under CIPSEA, it is understood that other
agencies and organizational units within the Executive branch may
benefit from the adoption of the SAP to accept applications for access
to confidential data assets available for the purpose of developing
evidence.
---------------------------------------------------------------------------
\5\ H.R. Rep No. 115-411 (2017).
\6\ 44 U.S.C. 3583(a). Agencies, the Congressional Budget
Office, State, local, and Tribal governments may, for the purposes
of developing evidence, apply to access confidential data accessed
or acquired by statistical agencies and units by applying for an
employee(s) of those organizations to be designated as agents to
conduct a specific statistical activity.
---------------------------------------------------------------------------
In 2019, a subset of statistical agencies and units associated with
the Federal Statistical Research Data Centers established a pilot
project that provided researchers with a common, online application
form and metadata inventory for requesting access to certain
confidential data assets (<a href="http://www.researchdatagov.com">www.researchdatagov.com</a>). Two key lessons
learned from the pilot were that the standard application process
requires clear policy guidelines and a central capacity to guide
implementation and standardization. As the number of participating
agencies increases, as well as the complexity of the SAP program
itself, a policy that guides decision making and establishes clear
roles and responsibilities becomes increasingly important. Based on the
pilot experience and subsequent, in 2021 OMB designated the Standard
Application Process program as a government-wide shared service and
established the role of Program Management Office (PMO) as a managing
partner of the program.
In order to provide needed guidance and recommendations, in 2020
the ICSP established a subcommittee on the SAP. The subcommittee sought
to build on the earlier pilot project and the lessons learned by
engaging in outreach to researchers and data providers likely to use
the SAP. Initial feedback from stakeholders had common themes. For
example, stakeholders indicated that application processes are often
long and cumbersome, that transparency of requirements and timely
approvals are important, and that they would like to see more
standardization of processes across agencies.
Guided by the requirements of the Evidence Act and the stakeholder
feedback, the ICSP SAP subcommittee drafted a policy for the
establishment of an SAP. The draft policy went through multiple rounds
of review by ICSP member agencies and units to ensure the requirements
align with the requirements of Evidence Act, the additional statutory
and regulatory requirements governing certain data assets or
statistical agencies and units, and the practical conditions affecting
an approved research project's lifecycle. In July 2021, the ICSP voted
to send the draft policy to OMB as a recommendation for establishing an
SAP consistent with the Evidence Act requirements.
Interagency Council on Statistical Policy Recommendation
OMB seeks comment on this proposal. We have made a preliminary
determination that the proposal also meets the requirements of the
Evidence Act (44 U.S.C. 3583), and has the potential to reduce the
burden to applicants while maintaining currently strong access and
confidentiality protections.
In summary, the application process begins with an applicant
identifying a confidential data asset for which a statistical agency or
unit is accepting applications for the purpose of developing evidence,
and ends with the agency or unit's determination whether to grant
access to the applicant. In the case of an adverse determination, the
application process ends with the conclusion of an appeals process if
the applicant elects to appeal the adverse determination. The scope of
this proposal excludes decisions about the mode of access to
confidential data or methods by which data are protected from
unauthorized disclosure.\7\
---------------------------------------------------------------------------
\7\ Those decisions fall within the scope of a regulation that
OMB will promulgate under 44 U.S.C. 3582.
---------------------------------------------------------------------------
The implementation of the proposed SAP would include an online
portal that serves as the primary location for researchers and others
seeking to identify and apply for access to confidential data available
for evidence building purposes. The SAP Portal would include an SAP
Data Inventory and searchable metadata on confidential data assets for
which evidence-building applications are being accepted, and would be
populated by statistical agencies and units. The goal of the policy is
for the metadata to be sufficient to facilitate data identification and
ensure that potential applicants can find and access adequate
documentation on available data assets. The SAP Portal would also
include a common application form that is standardized across
statistical agencies and units and datasets, except where unique legal
or regulatory requirements create a need for additional fields.
Upon receipt of a completed application, statistical agencies and
units would apply a common set of criteria when reviewing both the
proposed project and the applicant. When reviewing a proposed project,
statistical agencies and units would ensure that the data use is for
exclusively statistical purposes; the use is allowed under relevant
statutes, regulations, notices, agreements, and other requirements
governing the use of the data; that appropriate statistical disclosure
limitations could be applied to the relevant data; there is a
demonstrated need for the data; the project is feasible; and the public
trust can be maintained. When required by statute or regulation,
statistical agencies or units may consider additional criteria as
appropriate.
The proposed policy would establish a set of four authorization
levels that define the level of applicant review required. For example,
Authorization Level 1 would require evaluation of the applicant's
identity and completion of training, Authorization Level 2 would have
the additional requirement of a non-disclosure or other agreement(s) to
be completed, and Authorization Levels 3 and 4 would require two levels
of background investigations. The authorization level required for an
applicant would be determined by the data asset and mode of data access
requested in the project proposal, and would be listed in the SAP Data
Inventory itself. The authorization levels are generally consistent
with current practices for given modes of data access. For example,
Authorization Level 1 would be consistent with the level of access that
is usually associated with indirect access to confidential data using a
secure web-based query system and Authorization Level 4 would be
consistent with practices at the Federal Statistical Research Data
Centers.
The timeline for review of applications would be standardized
across statistical agencies and units under the proposal. For
applications involving a single agency it is proposed that review of
project should occur within twelve (12) weeks, and for applications
involving requests for data access from multiple agencies the review
should occur within twenty-four (24) weeks to allow for the additional
complexity and coordination. Agencies who cannot meet the required
timing would be able to seek an extension when appropriate. Requests
that require the statistical agency or unit to obtain approval from
entities not subject to the proposed policy are not subject to the
timeframes. Under the proposal, review of applicants should occur no
later than three (3) weeks after a project receives approval, unless
the review requires a new background investigation.
Upon receipt of an adverse determination, it is proposed that
[[Page 2462]]
applicants have the opportunity to appeal the decision to a review body
within the statistical agency or unit, when the grounds for the adverse
determination are under the control of the relevant statistical
agencies or units. The result of the appeals process would be
communicated with the applicant within eight (8) weeks of the appeal
request submission. Under the proposal applicants would also have the
opportunity to file an appeal of alleged noncompliance with the policy
directly with the Chief Statistician at OMB, who would review the
allegation and, if appropriate, take steps to facilitate compliance
with the policy.\8\
---------------------------------------------------------------------------
\8\ The proposal describes a procedural appeal, which would not
extend to review of the substantive decision.
---------------------------------------------------------------------------
The SAP Portal will provide applicants with up-to-date tracking of
applications throughout the review process. The SAP Portal will also
provide public reporting of key information with regard to the
operation of the SAP, such as the review status and final determination
for every project, as required by the Evidence Act.
The full text of the ICSP policy recommendation may be found in the
docket (OMB-2022-0001).
Desired Focus of Comments
OMB is particularly interested in receiving comments on the
specific areas of interest described below. To provide the most useful
feedback, responders should read the SAP policy draft before addressing
the posed questions. We also recommend that responses be concise,
include citations if summarizing or depending on published work, and
provide any links to related research. In addition, a fuller
consideration of comments would be facilitated by clear identification
of the question(s) being addressed. Each question provides a link to
the related discussion within the policy draft. The full text of the
ISCP SAP policy recommendations is available as a supplemental document
on <a href="http://www.regulations.gov">www.regulations.gov</a> in docket number ``OMB-2022-0001''.
OMB welcomes comment on any and all aspects of this policy. We have
also identified specific areas of interest for comment, including:
Metadata standards:
<bullet> To provide flexibility over time, the proposed policy
would require the SAP Program Management Office (PMO) to develop and
maintain a set of metadata standards subject to approval by the SAP
Governance Body.
1. Should key metadata elements be considered as part of the
policy? If so, which?
2. What are the key metadata elements that the PMO should consider
in its development of the metadata standards?
3. Would it be valuable for the metadata standards to comply with
any other existing metadata standards? If so, which?
Application windows:
<bullet> The proposed policy would allow each individual
statistical agency or unit to establish their own time window during
which applications will be accepted for a given data asset as a way to
manage resource constraints. This approach is designed to maximize
services from higher capacity statistical agencies, which have
resources to keep an application window open all year in many cases,
but at the potential expense of standardization across statistical
agencies, because some lower capacity statistical agencies may not have
the resources to review applications on a constant flow basis.
4. How could this proposed approach be improved, if at all?
<bullet> If instead the policy were to require all agencies to
align to a common fixed-length window, we believe that has the
potential to lead to a decrease in availability for higher capacity
agencies.
5. How could this policy be implemented in a way that maximizes its
usefulness? How could the following aspects help:
i. Frequency of windows for accepting applications (e.g., annual,
quarterly)?
ii. Minimum number of days for accepting applications (e.g., 60
days) for each window?
iii. Alignment of acceptance windows across statistical agencies or
products?
iv. Any other features to assist applicants seeking data from
multiple statistical agencies for a single project?
Applicant evaluation:
<bullet> The proposed policy would introduce four standardized
authorization levels and four standard review criteria against which
applicant(s) will be evaluated. The authorization levels are designed
to align generally with currently used access modes as described above.
They will also need to align with accessibility levels to be defined in
an upcoming OMB regulation required under 44 U.S.C. 3582. The standard
review criteria would respond to the requirement for an explicit,
consistent, and identical review process.
6. Is the proposal an appropriate framework, and should it differ
in any manner between Federal and non-Federal applicants? If not, what
additional levels or criteria should guide the applicant review process
to improve the efficiency of the SAP?
Appeals process:
<bullet> The proposed policy would provide applicants the ability
to file an appeal in the event their application receives a negative
disposition. Under this process, the appeal is reviewed by three
officials at the statistical agency or unit, including the statistical
agency or unit head or delegate, and a consensus decision is required
to reverse the original determination.
7. What additional aspects should be considered to ensure that the
process is fair, equitable, and transparent?
8. How, if at all, should processes vary for applications that
would use data from multiple agencies?
Public reporting:
<bullet> The Evidence Act (44 U.S.C. 3583(a)(6)) requires public
reporting on the status and disposition of each application to promote
transparency.
9. What additional information should be considered as part of the
proposed public reporting requirements beyond what the proposal
suggests?
In addition, OMB welcomes more general comment on the merit of the
proposed SAP both in technical terms and as statistical policy,
including whether any elements should be modified in support of
technical improvement or to improve statistical policy. The technical
implications of the proposed SAP involve the feasibility, cost, and
effectiveness of its structure and processes. The statistical policy
implications relate to how well the proposed SAP supports the missions
of statistical agencies and units by serving the information and
research needs of policymakers and the public, while protecting the
privacy and confidentiality of individuals who provide data.
Authority: 44 U.S.C. 3583.
Shalanda D. Young,
Acting Director, Office of Management and Budget.
[FR Doc. 2022-00620 Filed 1-13-22; 8:45 am]
BILLING CODE 3110-01-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on January 14, 2022.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.