Notice2023-10524
Privacy Act of 1974; System of Records
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
May 23, 2023
Issuing agencies
Justice Department
Abstract
Pursuant to the Privacy Act of 1974 and Office of Management and Budget (OMB) Circular No. A-108, notice is hereby given that the Office of Privacy and Civil Liberties (hereinafter OPCL), a component within the United States Department of Justice (DOJ or Department), proposes to develop a new system of records titled Data Protection Review Court Records System, JUSTICE/OPCL-001. The OPCL proposes to establish this system of records to maintain records of matters reviewed by and decisions made by the Data Protection Review Court (DPRC) concerning determinations made by the Civil Liberties Protection Officer of the Office of the Director of National Intelligence in response to complaints that allege certain violations of United States law in the conduct of United States signals intelligence activities.
Full Text
<html>
<head>
<title>Federal Register, Volume 88 Issue 99 (Tuesday, May 23, 2023)</title>
</head>
<body><pre>
[Federal Register Volume 88, Number 99 (Tuesday, May 23, 2023)]
[Notices]
[Pages 33165-33167]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2023-10524]
[[Page 33165]]
-----------------------------------------------------------------------
DEPARTMENT OF JUSTICE
[CPCLO Order No. 001-2023]
Privacy Act of 1974; System of Records
AGENCY: Office of Privacy and Civil Liberties, United States Department
of Justice.
ACTION: Notice of a new system of records.
-----------------------------------------------------------------------
SUMMARY: Pursuant to the Privacy Act of 1974 and Office of Management
and Budget (OMB) Circular No. A-108, notice is hereby given that the
Office of Privacy and Civil Liberties (hereinafter OPCL), a component
within the United States Department of Justice (DOJ or Department),
proposes to develop a new system of records titled Data Protection
Review Court Records System, JUSTICE/OPCL-001. The OPCL proposes to
establish this system of records to maintain records of matters
reviewed by and decisions made by the Data Protection Review Court
(DPRC) concerning determinations made by the Civil Liberties Protection
Officer of the Office of the Director of National Intelligence in
response to complaints that allege certain violations of United States
law in the conduct of United States signals intelligence activities.
DATES: In accordance with 5 U.S.C. 552a(e)(4) and (11), this notice is
effective upon publication, subject to a 30-day period in which to
comment on the routine uses, described below. Please submit any
comments by June 22, 2023.
ADDRESSES: The public, OMB, and Congress are invited to submit any
comments by mail to the United States Department of Justice, Office of
Privacy and Civil Liberties, ATTN: Privacy Analyst, Two Constitution
Square, 145 N St. NE, Suite 8W-300, Washington, DC 20530; by facsimile
at 202-307-0693; or by email at <a href="/cdn-cgi/l/email-protection#bacac8d3ccdbd9c394d9d5d7cad6d3dbd4d9dffacfc9ded5d094ddd5cc"><span class="__cf_email__" data-cfemail="8dfdffe4fbeceef4a3eee2e0fde1e4ece3eee8cdf8fee9e2e7a3eae2fb">[email protected]</span></a>. To ensure
proper handling, please reference the above CPCLO Order No. on your
correspondence.
FOR FURTHER INFORMATION CONTACT: Katherine Harman-Stokes, Director
(Acting), Office of Privacy and Civil Liberties, U.S. Department of
Justice, Two Constitution Square, 145 N St. NE, Suite 8W-300,
Washington, DC 20530; email, <a href="/cdn-cgi/l/email-protection#f8888a918e999b81d69b979588949199969b9db88d8b9c9792d69f978e"><span class="__cf_email__" data-cfemail="9ceceef5eafdffe5b2fff3f1ecf0f5fdf2fff9dce9eff8f3f6b2fbf3ea">[email protected]</span></a>; telephone:
(202) 514-0208; facsimile (202) 307-0693.
SUPPLEMENTARY INFORMATION: On October 7, 2022, the President of the
United States issued Executive Order (E.O.) 14086, Enhancing Safeguards
for United States Signals Intelligence Activities, 87 FR 62283 (Oct.
14, 2022), which directed the Attorney General to establish the DPRC as
the second level of a two-level redress mechanism for alleged
violations of law regarding signals intelligence activities. The
Attorney General issued a regulation on October 7, 2022, now at 28 CFR
201, ``Data Protection Review Court.'' 87 FR 628303 (Oct. 14, 2022).
The redress mechanism will provide for the review of complaints
submitted by individuals through their designated public authorities in
designated countries and regional economic integration organizations,
alleging certain violations of United States law concerning United
States signals intelligence activities covered in E.O. 14086 (``covered
violation''). The E.O. 14086 implements commitments made by the United
States as part of the EU-U.S. Data Privacy Framework announced in March
2022 to foster trans-Atlantic data flows.
The first level of the new redress mechanism established by E.O.
14086 is the investigation and review of complaints by the Office of
the Director of National Intelligence Civil Liberties Protection
Officer (ODNI CLPO). The ODNI CLPO will conduct an initial review of
the complaint to assess whether it meets the requirements necessary for
a redress review pursuant to E.O. 14086, i.e., whether the complaint is
a ``qualifying complaint.'' Upon confirming a complaint is qualified,
the ODNI CPLO will determine whether a covered violation occurred, and,
where necessary, the appropriate remediation. As a second level, the
complainant or an element of the Intelligence Community, as defined in
E.O. 14086 section 4(g), may seek review by the DPRC of the ODNI CLPO's
determination.
The DPRC has been established within the Department, it and will
consist of individuals chosen as judges and ``special advocates'' from
outside the Executive Branch of the United States Government to provide
independent and impartial adjudication of applications for review of
determinations of the ONDI CLPO described above. Exercising the
Attorney General's delegated authority under 28 U.S.C. 511 and 512 to
provide advice and opinion on questions of law, as well as the
authority of the DPRC under E.O. 14086, the DPRC will review whether
the ODNI CLPO's determination regarding the occurrence of a covered
violation was legally correct and supported by substantial evidence and
whether, in the event of a covered violation, the ODNI CLPO's
determination as to the appropriate remediation was consistent with
E.O. 14086 or other applicable laws. Each application will be reviewed
by a three-judge panel of the DPRC convened by the Department's Office
of Privacy and Civil Liberties (OPCL), which will provide
administrative support to the DPRC.
The regulations require the DPRC and OPCL, in support of the DPRC,
to maintain records of the DPRC's activities. For each application for
review, OPCL will maintain all records pertaining to the DPRC's review,
including submissions from the complainant, the Special Advocate, or an
element of the intelligence community. 28 CFR 201.9(j), see also 28 CFR
201.5, et seq.
Pursuant to 28 CFR 201.9(i), certain classified information in the
system indicating a violation of any authority subject to the oversight
of the Foreign Intelligence Surveillance Court (``FISC'') will be
shared with the Assistant Attorney General for National Security, who
shall report violations to the FISC as required by law and in
accordance with its rules of procedure. Similarly, information in the
system will be accessible to the Privacy and Civil Liberties Oversight
Board (``PCLOB'') as necessary to conduct the annual review of the
redress process described in section 3(e) of E.O. 14086, consistent
with the protection of intelligence sources and methods.
In accordance with 5 U.S.C. 552a(r), the Department has provided a
report to OMB and Congress on this new system of records.
Dated: May 10, 2023.
Peter A. Winn,
Chief Privacy and Civil Liberties Officer (Acting), United States
Department of Justice.
JUSTICE/OPCL-001
SYSTEM NAME AND NUMBER:
Data Protection Review Court Records System, JUSTICE/OPCL-001.
SECURITY CLASSIFICATION:
The majority of information in this system of records is
classified. The remaining information is sensitive but unclassified.
SYSTEM LOCATION:
United States Department of Justice, 950 Pennsylvania Ave. NW,
Washington, DC 20530-0001.
SYSTEM MANAGER(S):
Director, Office of Privacy and Civil Liberties, U.S. Department of
Justice, Two Constitution Square, 145 N St. NE, Suite 8W-300,
Washington, DC 20530; email, <a href="/cdn-cgi/l/email-protection#e9999b809f888a90c78a868499858088878a8ca99c9a8d8683c78e869f"><span class="__cf_email__" data-cfemail="8bfbf9e2fdeae8f2a5e8e4e6fbe7e2eae5e8eecbfef8efe4e1a5ece4fd">[email protected]</span></a>;
[[Page 33166]]
telephone: (202) 514-0208; facsimile (202) 307-0693.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
Authority for maintaining this system exists under 5 U.S.C. 301; 28
U.S.C. 509, 510-512; 28 CFR 0.72; 28 CFR part 201; Executive Order
14086 and other applicable executive order(s) governing foreign
intelligence surveillance and classified national security information.
PURPOSE(S) OF THE SYSTEM:
The purpose of the system is to maintain records of the information
received, reviewed, or created by the DPRC for each application for
review and decision of a DPRC panel handling a specific matter; to make
records available for consideration as non-binding precedent to future
panels of the DPRC; to provide reports, when appropriate, to the
Assistant Attorney General for National Security, other relevant DOJ
officials, and members of the Intelligence Community; for related
litigation, if applicable; to provide information to the PCLOB as
necessary to conduct the annual review of the redress process described
in section 3(e) of E.O. 14086; for DPRC personnel, and OPCL personnel
supporting the DPRC, to prepare, process and track applications for
review and perform other functions as needed.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
Individual complainants seeking review pursuant to E.O. 14086 and
Department of Justice regulation 28 CFR 201 of an Office of the
Director of National Intelligence Civil Liberties Protection Officer
(ODNI CLPO) determination in response to qualifying complaints;
individuals who did not submit a qualifying complaint but who are
identified in connection with the qualifying complaint, including for
example, the individual complainant's counsel, if any, and personnel
with the public authority of a designated state; members of the United
States Government workforce, including personnel of elements of the
Intelligence Community involved in investigating and reviewing
complaints or involved in signals intelligence activities related to a
complaint, and individuals serving as Judges on the DPRC or Special
Advocates.
CATEGORIES OF RECORDS IN THE SYSTEM:
The system consists of all records relating to applications for
review of an ODNI CLPO determination in response to complaints
submitted through the redress mechanism established pursuant to section
3 of E.O. 14086; including all information received, reviewed, and
created by the DPRC in the adjudication of an application for review;
the decisions of the DPRC; and records created and maintained for
administrative or operational purposes for the DPRC. This also includes
the records received from, generated by, or about, ODNI CLPO, elements
of the Intelligence Community, the complainant and counsel through the
public authority of a qualifying state, and from the Special Advocates.
The records in this system also include communications between ODNI
CLPO, DPRC Judges and Special Advocates, PCLOB, public authority in the
designated country or regional economic integration organization, the
complainant, and OPCL personnel supporting the DPRC. The system will
also contain records related to the appointment of DPRC Judges and
Special Advocates, DPRC's rules of procedures and processes for filing
an application for review, and other administrative or operational
records.
RECORD SOURCE CATEGORIES:
The system contains records that originated from Department of
Justice personnel involved in the administration of the DPRC and the
implementation and execution of the two-level redress mechanism
described in E.O. 14086, and records originating from ODNI, PCLOB,
elements of the Intelligence Community, the complainant and counsel,
DPRC Judges and Special Advocates, and the public authority of a
designated country or regional economic integration organization.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND THE PURPOSES OF SUCH USES:
In addition to those disclosures generally permitted under 5 U.S.C.
552a(b), all or a portion of the records or information contained in
this system of records may be disclosed for the purposes described
below, to the extent such disclosures are compatible with the purposes
for which the information was collected:
A. To any person or entity that the Department has reason to
believe possesses information regarding a matter within the
jurisdiction of the DPRC, to the extent deemed to be necessary by the
DPRC or OPCL in order to elicit such information or cooperation from
the recipient for use in the performance of an authorized activity.
B. Where a record, either alone or in conjunction with other
information, indicates a violation or potential violation of law--
criminal, civil, or regulatory in nature--the relevant records may be
referred to the appropriate Federal, State, local, Territorial, Tribal,
or foreign law enforcement authority or other appropriate entity
charged with the responsibility for investigating or prosecuting such
violation or charged with enforcing or implementing such law.
C. In an appropriate proceeding before a court, grand jury, or
administrative or adjudicative body, when the Department determines
that the records are relevant to the proceeding in accordance with
applicable laws, rules, and Department policies.
D. To the news media and the public, including disclosures pursuant
to 28 CFR 50.2, unless it is determined that release of the specific
information in the context of a particular case would constitute an
unwarranted invasion of personal privacy, with the concurrence of the
Department's Chief Privacy and Civil Liberties Officer.
E. To contractors, grantees, experts, consultants, students, and
others performing or working on a contract, service, grant, cooperative
agreement, or other assignment for the Federal Government, when
necessary to accomplish an agency function related to this system of
records.
F. To a former employee of the Department for purposes of:
responding to an official inquiry by a Federal, State, or local
government entity or professional licensing authority, in accordance
with applicable Department regulations; or facilitating communications
with a former employee that may be necessary for personnel-related or
other official purposes where the Department requires information and/
or consultation assistance from the former employee regarding a matter
within that person's former area of responsibility.
G. To a Member of Congress or staff acting upon the Member's behalf
when the Member or staff requests the information on behalf of, and at
the request of, the individual who is the subject of the record,
whether the individual is residing in the United States or abroad at
the time of the request.
H. To the National Archives and Records Administration for purposes
of records management inspections conducted under the authority of 44
U.S.C. 2904 and 2906.
I. To appropriate agencies, entities, and persons when (1) the
Department suspects or has confirmed that there has been a breach of
the system of records; (2) the Department has determined that as a
result of the suspected or confirmed breach there is a risk of harm to
[[Page 33167]]
individuals, the Department (including its information systems,
programs, and operations), the Federal Government, or national
security; and (3) the disclosure made to such agencies, entities, and
persons is reasonably necessary to assist in connection with the
Department's efforts to respond to the suspected or confirmed breach or
to prevent, minimize, or remedy such harm.
J. To another Federal agency or entity, when the Department
determines that information from this system of records is reasonably
necessary to assist the recipient agency or entity in (1) responding to
a suspected or confirmed breach, or (2) preventing, minimizing, or
remedying the risk of harm to individuals, the recipient agency or
entity (including its information systems, programs, and operations),
the Federal Government, or national security, resulting from a
suspected or confirmed breach.
K. To any agency, organization, or individual for the purpose of
performing authorized audit or oversight operations of the DPRC or OPCL
and meeting related reporting requirements.
L. To such recipients and under such circumstances and procedures
as are mandated by Federal statute or treaty.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Records in this system are stored on paper and/or in electronic
form. Records are stored securely in accordance with applicable laws,
regulations, and policies. Records that contain classified national
security information are stored in accordance with applicable executive
orders, statutes, and agency implementing regulations.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Information is retrieved by the unique case number assigned to the
application for review, the name of the complainant, the public
authority that submitted the complaint for the complainant, or the
designated country or regional economic integration organization.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
Records in this system are maintained and disposed of in accordance
with all applicable statutory and regulatory requirements.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
Information in this system in electronic or hard copy form is
subject to administrative, technical, and physical safeguards in
accordance with applicable laws, rules, and policies, including the
Department's automated systems security and access policies. Classified
information is appropriately stored in safes and on secure servers in
accordance with other applicable requirements. Records and technical
equipment are maintained in a secured area with restricted access.
Internet connections are protected by multiple firewalls and data is
encrypted in accordance with applicable laws, rules, and Department
policies. Security personnel conduct periodic vulnerability scans using
DOJ-approved software to ensure security compliance and security logs
are enabled for computers to assist in troubleshooting and forensics
analysis during incident investigations. Users of individual computers
can only gain access to data through a multi-factor authentication
process; direct access to certain information is restricted depending
on a user's role and responsibility within the organization and system.
RECORD ACCESS PROCEDURES:
A major part of this system is exempted from this requirement;
specifically, this system is exempt from Privacy Act subsections (c)(3)
and (4); (d); (e)(1), (2), (3), (4)(G), (H) and (I), (5) and (8); (f);
(g); and (h) of the Privacy Act pursuant to 5 U.S.C. 552a(j)(2),
(k)(1), (2), and (5). An individual who is the subject of a record in
this system of records may access those records that are not exempt
from access. A determination as to exemption shall be made at the time
a request for access is received. A request for access to records
contained in this system shall be made in writing and clearly marked
``Privacy Act Access Request.'' The request should include the full
name of the individual involved, the individual's current address, date
and place of birth, and their signature which shall be notarized or
made pursuant to 28 U.S.C. 1746 as an unsworn declaration. The request
must describe the records sought in sufficient detail to enable
Department personnel to locate them with a reasonable amount of effort.
Requests should be directed to the Office of Information Policy. See
<a href="https://www.justice.gov/oip/make-foia-request-doj">https://www.justice.gov/oip/make-foia-request-doj</a>.
Although no specific form is required, you may obtain forms for
this purpose from the FOIA/Privacy Act Mail Referral Unit, United
States Department of Justice, 950 Pennsylvania Avenue NW, Washington,
DC 20530, or on the Department of Justice website at <a href="https://www.justice.gov/oip/oip-request.html">https://www.justice.gov/oip/oip-request.html</a>.
More information regarding the Department's procedures for
accessing records in accordance with the Privacy Act can be found at 28
CFR part 16 subpart D, ``Protection of Privacy and Access to Individual
Records Under the Privacy Act of 1974.''
CONTESTING RECORD PROCEDURES:
Individuals seeking to contest or amend records maintained in this
system of records must direct their requests to the address indicated
in the ``RECORD ACCESS PROCEDURES'' section, above. All requests to
contest or amend records must be in writing and clearly marked
``Privacy Act Amendment Request.'' All requests must state clearly and
concisely what record is being contested, the reasons for contesting
it, and the proposed amendment to the record. Some information may be
exempt from the amendment provisions as described in the ``EXEMPTIONS
PROMULGATED FOR THE SYSTEM'' section, below. An individual who is the
subject of a record in this system of records may contest or amend
those records that are not exempt. A determination of whether a record
is exempt from the amendment provisions will be made after a request is
received.
More information regarding the Department's procedures for amending
or contesting records in accordance with the Privacy Act can be found
at 28 CFR 16.46, ``Requests for Amendment or Correction of Records.''
NOTIFICATION PROCEDURES:
Individuals may be notified if a record in this system of records
pertains to them when the individuals request information utilizing the
same procedures as those identified in the ``RECORD ACCESS PROCEDURES''
section, above.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
The Attorney General has exempted this system from subsections
(c)(3) and (4); (d); (e)(1), (2), (3), (4)(G), (H) and (I), (5) and
(8); (f); (g); and (h) of the Privacy Act pursuant to 5 U.S.C.
552a(j)(2), (k)(1), (2), and (5). Rules are in the process of being
promulgated in accordance with the requirements of 5 U.S.C. 553(b), (c)
and (e), and are in the process of being published in the Federal
Register. These exemptions apply only to the extent that information in
the system is subject to exemption pursuant to 5 U.S.C. 552a(j)(2),
(k)(1), (2) or (5). A determination as to exemption shall be made at
the time a request for access or amendment is received.
HISTORY:
None.
[FR Doc. 2023-10524 Filed 5-22-23; 8:45 am]
BILLING CODE 4410-PJ-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on May 23, 2023.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.