Privacy Act; Implementation
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Issuing agencies
Abstract
In accordance with subsections (j)(2) and (k)(2) of the Privacy Act of 1974, as amended (the Privacy Act or the Act), the Department of Health and Human Services (HHS or Department) is proposing to exempt a new system of records maintained by the National Institutes of Health (NIH), System No. 09-25-0224, "NIH Police Records," from certain requirements of the Act. The new system of records will cover criminal and non-criminal law enforcement investigatory material maintained by the NIH Division of Police, a component of NIH which performs criminal law enforcement as its principal function. The exemptions are necessary and appropriate to protect the integrity of law enforcement proceedings and records compiled in the course of NIH Division of Police activities, prevent disclosure of investigative techniques, and protect the identity of confidential sources involved in those activities. Elsewhere in the Federal Register, HHS/NIH has published a System of Records Notice (SORN) for System No. 09-25-0224 for public notice and comment which describes the new system of records in more detail.
Full Text
<html>
<head>
<title>Federal Register, Volume 89 Issue 111 (Friday, June 7, 2024)</title>
</head>
<body><pre>
[Federal Register Volume 89, Number 111 (Friday, June 7, 2024)]
[Proposed Rules]
[Pages 48536-48540]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2024-12469]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
45 CFR Part 5b
[Docket Number NIH-2022-0002]
RIN 0925-AA69
Privacy Act; Implementation
AGENCY: National Institutes of Health (NIH), Department of Health and
Human Services (HHS).
ACTION: Notice of proposed rulemaking.
-----------------------------------------------------------------------
SUMMARY: In accordance with subsections (j)(2) and (k)(2) of the
Privacy Act of 1974, as amended (the Privacy Act or the Act), the
Department of Health and Human Services (HHS or Department) is
proposing to exempt a new system of records maintained by the National
Institutes of Health (NIH), System No. 09-25-0224, ``NIH Police
Records,'' from certain requirements of the Act. The new system of
records will cover criminal and non-criminal law enforcement
investigatory material maintained by the NIH Division of Police, a
component of NIH which performs criminal law enforcement as its
principal function. The exemptions are necessary and appropriate to
protect the integrity of law enforcement proceedings and records
compiled in the course of NIH Division of Police activities, prevent
disclosure of investigative techniques, and protect the identity of
confidential sources involved in those activities. Elsewhere in the
Federal Register, HHS/NIH has published a System of Records Notice
(SORN) for System No. 09-25-0224 for public notice and comment which
describes the new system of records in more detail.
DATES: Submit either electronic or written comments regarding this
document by August 6, 2024.
ADDRESSES: Submit comments, identified by Docket No NIH-2022-0002, by
any of the following methods:
Electronic Submissions
Submit electronic comments in the following way:
<bullet> Federal eRulemaking Portal: <a href="https://www.regulations.gov">https://www.regulations.gov</a>.
Follow the instructions for submitting comments.
Written Submissions
Submit written submissions in the following ways:
<bullet> Fax: 301-402-0169 (not a toll-free number).
<bullet> Mail: Daniel Hernandez, NIH Regulations Officer, Office of
Management Assessment, National Institutes of Health, 6705 Rockledge
Drive, (RK1) 601-U, Rockville, MD 20892-7901.
To ensure timelier processing of comments, HHS/NIH is no longer
accepting comments submitted to the agency by email. HHS/NIH encourages
you to continue to submit electronic comments by using the Federal
eRulemaking Portal, as described previously, in the ADDRESSES portion
of this document under Electronic Submissions.
Instructions: All submissions received must include the agency name
and Docket No. for this rulemaking. All comments received may be posted
without change to <a href="https://www.regulations.gov">https://www.regulations.gov</a>, including any personal
information provided.
Docket: For access to the docket to read background documents or
comments received, go to <a href="https://www.regulations.gov">https://www.regulations.gov</a> and follow the
instructions provided for conducting a search, using the docket
number(s) found in brackets in the heading of this document.
FOR FURTHER INFORMATION CONTACT: General questions about the exemptions
may be submitted to Daniel Hernandez, NIH Regulations Officer, Office
of Management Assessment, National Institutes of Health, 6705 Rockledge
[[Page 48537]]
Drive, (RK1) 601-U, Rockville, MD 20892-7901, telephone 301-496-4607,
fax 301-402-0169, email <a href="/cdn-cgi/l/email-protection#13777b76617d727d777669537e727a7f3d7d7a7b3d747c65"><span class="__cf_email__" data-cfemail="71151914031f101f15140b311c10181d5f1f18195f161e07">[email protected]</span></a>.
SUPPLEMENTARY INFORMATION:
I. Background on the NIH Police Division and New System of Records 09-
25-0224
Elsewhere in the Federal Register, HHS/NIH has published notice of
its establishment of a new system of records 09-25-0224, ``NIH Police
Records.'' The purpose of this rulemaking is to exempt that system of
records from certain requirements of the Privacy Act as permitted by 5
U.S.C. 552a(j)(2) and (k)(2). The new system of records will cover
records maintained by the NIH Division of Police, Office of Research
Services (ORS), in the NIH Office of the Director. The Division of
Police was established in 1968 to provide an immediate and primary law
enforcement program for the NIH and derives its authority from
Memorandum from the Assistant Secretary for Administration, OS, to the
Director, NIH, June 13, 1968; Memorandum from the Assistant Secretary
for Administration, OS, to the Director, NIH, June 13, 1968, entitled:
Delegation of Authority to Assist in Controlling Violations of Law at
Certain HEW Facilities Located in Montgomery County, Maryland; 40
U.S.C. 1315 (Law enforcement authority of Secretary of Homeland
Security for protection of public property; a Department of Homeland
Security (DHS) delegation of authority to HHS/NIH; and an NIH
delegation of authority to the NIH Division of Police); General
Administrative Delegation of Authority Number 08, Control of Violations
of Law at Certain NIH Facilities (Sept. 1, 2020). Based on that
establishing authority, the Division of Police performs criminal law
enforcement as its principal function. However, the Division of Police
conducts both criminal and non-criminal (e.g., civil, administrative,
regulatory) law enforcement investigations.
The NIH Division of Police is directly responsible for the
provision of daily law enforcement and criminal and civil investigative
activities required to protect the life, safety, and property of NIH
employees, contractors, patients, and visitors at NIH. To perform these
responsibilities, the NIH Division of Police compiles and maintains
records of complaints of incidents, inquiries, investigative findings,
arrest records, and court dispositions which are retrieved by personal
identifiers and therefore constitute a ``system of records'' as defined
by the Privacy Act at 5 U.S.C. 552a(a)(5). The primary purposes for
which the records are used are to: (1) record incidents of crime, civil
disturbance, and traffic accidents on the NIH enclave, and the
investigation of such incidents; (2) maintain information essential to
the protection of life, safety, and property at NIH; (3) provide
official records of law enforcement investigative efforts for use in
administrative, criminal and/or civil proceedings; and (4) document
criminal and civil law enforcement investigations.
II. Eligible Records and Exemptions
The new system of records will include both criminal and non-
criminal (e.g., civil, administrative, regulatory) law enforcement
investigatory records which will be retrieved by subject individuals'
personal identifiers. Such records are eligible to be exempted from
certain Privacy Act requirements, as follows:
<bullet> Subsection (j)(2) of the Privacy Act (5 U.S.C. 552a(j)(2))
allows an agency head to exempt from certain Privacy Act provisions a
system of records maintained by the agency or component thereof which
performs as its principal function any activity pertaining to the
enforcement of criminal laws.
<bullet> Subsection (k)(2) of the Act (5 U.S.C. 552a(k)(2)) allows
an agency head to exempt from certain Privacy Act provisions a system
of records containing investigatory material compiled for law
enforcement purposes, other than material within the scope of
subsection (j)(2) (for example, material compiled for a civil,
administrative, or regulatory law enforcement purpose, or material
compiled for a criminal law enforcement purpose by an agency component
that does not perform criminal law enforcement as its principal
function). This exemption's effect on the subject individual's access
rights is qualified in that if any individual is denied any right,
privilege, or benefit to or for which the individual otherwise would be
entitled by Federal law, or for which the individual would otherwise be
eligible, as a result of the maintenance of the system of records, the
individual must be provided the requested materials except to the
extent that disclosure would reveal the identity of a source who
furnished information to the Government under an express promise that
the identity of the source would be held in confidence.
HHS/NIH is establishing the following exemptions for the records:
<bullet> Based on 5 U.S.C. 552a(k)(2), HHS/NIH is exempting non-
criminal (e.g., civil, administrative, regulatory) law enforcement
investigatory material in System No. 09-25-0224 from the requirements
in subsections (c)(3), (d)(1) through (4), (e)(1), (e)(4)(G) through
(I), and (f) of the Privacy Act, which require the agency to provide an
accounting of disclosures; provide notification, access, and amendment
rights; maintain only relevant and necessary information authorized by
a statute or Executive order; establish and describe procedures whereby
an individual can be notified if a system of records contains
information pertaining to that individual and how to gain access to
pertinent records; identify categories of record sources; and
promulgate rules regarding these procedures. The effect of this
exemption on a subject individual's access rights will be limited as
required by subsection (k)(2) to information that would reveal the
identity of a source who was expressly promised confidentiality in
cases in which maintenance of the records results in denial of a
Federal right, privilege, or benefit to or for which the individual
would otherwise be entitled or eligible.
<bullet> Based on subsection 5 U.S.C. 552a(j)(2), HHS/NIH is
exempting criminal law enforcement investigatory material in System No.
09-25-0224 from the same requirements identified above, and from these
additional subsections:
[cir] (c)(4), requiring the agency to inform disclosure recipients
of corrections and notations of dispute affecting disclosed records;
[cir] (e)(2) and (3), requiring the agency to collect information
directly from the subject individual to the greatest extent practicable
and to provide a Privacy Act notice to the individual at the time of
collection;
[cir] (e)(5), requiring the agency to maintain records used in
agency determinations with sufficient accuracy, relevance, timeliness,
and completeness to ensure fairness to individuals;
[cir] (e)(8), requiring the agency to attempt to notify an
individual when a record about the individual is disclosed under
compulsory legal process; and
[cir] (g), subjecting the agency to civil action and civil remedies
for noncompliance with access, amendment, and accuracy, relevance,
timeliness, and completeness requirements, and for noncompliance that
adversely affects an individual.
Notwithstanding the establishment of these exemptions, individual
record subjects may submit accounting, access, notification, and
correction requests, and HHS/NIH will consider such requests on a case-
by-case basis. Only information that is not factually
[[Page 48538]]
accurate, or is not relevant, timely, or complete may be contested.
In addition to the exemptions that HHS/NIH is establishing for
system of records 09-25-0224 in this proposed rule, if any law
enforcement investigatory material compiled in that system of records
is from another system of records in which such material was exempted
from access and other requirements of the Privacy Act based on 5 U.S.C.
5525a(j)(2), it will be exempt in system of records 09-25-0224 on the
same basis (i.e., 5 U.S.C. 552a(j)(2)) and from the same requirements
as in the source system.
III. Exemption Rationales
The following specific rationales explain why each exemption is
necessary and appropriate for law enforcement investigation records
maintained by the NIH Division of Police, in order to prevent
interference with and protect the integrity of pending, closed, and
future investigations, including related investigations. All
subsections referenced are subsections of 5 U.S.C. 552a.
<bullet> Subsection (c)(3) (Provide Accountings of Disclosures).
This exemption will apply to both criminal and non-criminal law
enforcement investigatory material. Providing an accounting of
disclosures to an individual record subject could reveal the existence
of a pending or prior investigation or present or past investigative
interest on the part of NIH or another agency. This would pose a
serious impediment to law enforcement efforts and undermine the
investigative process by enabling a subject individual or others in
concert with that individual to harass, intimidate, or collude with
witnesses, destroy, conceal, or tamper with evidence, threaten or
endanger law enforcement personnel, alter patterns of behavior, and
avoid detection or apprehension by law enforcement authorities.
<bullet> Subsection (c)(4) (Inform Disclosure Recipients of
Corrections and Notations of Dispute). This exemption applies to only
criminal law enforcement investigatory material. Because system of
records 09-25-0224 will be exempt from amendment requirements in
subsection (d) and HHS/NIH's compliance with amendment requirements
therefore will be voluntary, it is necessary and appropriate that HHS/
NIH's compliance with the requirement in subsection (c)(4) be voluntary
also. This will give HHS/NIH the flexibility to decide which cases
warrant expending resources to meet those administratively burdensome
requirements.
<bullet> Subsection (d)(1) through (4) (Provide Notification,
Access, and Amendment Rights). These exemptions apply to both criminal
and non-criminal law enforcement investigatory material. Providing
subject individuals with the right to be notified of whether the system
of records contains a record about them and to access and amend such
records could reveal the existence of a pending or prior investigation
or present or past investigative interest by NIH or another agency and
details about the investigation, including identities of sources of
information, personal information about third parties, and sensitive
investigative techniques. This could impair pending and future
investigations by chilling or deterring sources of information from
providing information to investigators (particularly if they are not
certain of its accuracy or fear retribution), by providing an
opportunity for subject individuals and others acting in concert with
subject individuals to tamper with witnesses or evidence, and by
allowing individuals to alter their behavior to defeat investigative
techniques and avoid detection or apprehension. Complying with
amendment requirements could significantly delay investigations while
attempts are made to resolve questions of accuracy, relevance,
timeliness, and completeness and would impose an impossible
administrative burden by requiring investigations to be continuously
reinvestigated. In the case of criminal investigations, since the
system of records will be exempt from having to maintain records that
are accurate, relevant, timely, and complete, the exemption from
amendments seeking to correct to those standards is also appropriate.
<bullet> Subsection (e)(1) (Maintain Only Relevant and Necessary
Information Authorized by Statute or Executive order). This exemption
applies to both criminal and non-criminal law enforcement investigatory
material. In the course of a law enforcement investigation, and
especially in the early stages of an investigation, the relevance and
necessity of information obtained or introduced may be unclear or the
information may not be strictly relevant or necessary to a specific
investigation but may lead to discovery of relevant information. In the
interests of effective law enforcement, it is appropriate to retain all
information that may aid in establishing patterns of unlawful activity.
<bullet> Subsections (e)(2) and (3) (Collect Information Directly
From the Subject Individual to the Greatest Extent Practicable, and
Provide a Privacy Act Notice). These exemptions apply to only criminal
law enforcement investigatory material. It is not always practicable to
collect information sought in a criminal law enforcement investigation
directly from subject individuals. Individuals who could be adversely
affected by an investigation may intentionally provide unreliable
information to avoid being implicated in criminal activity. Questioning
subject individuals and providing a Privacy Act notice to them (i.e.,
informing them of the purposes for which information collected from
them will be used and disclosed and how providing or not providing it
could affect them), could inappropriately reveal the existence, nature,
scope, and details of the investigation. This would provide an
opportunity for the subject individual or others acting in concert with
that individual to conceal evidence, alter patterns of behavior, or
take other actions that could thwart investigative efforts; reveal the
identity of witnesses in investigations, thereby providing an
opportunity for the subjects of the investigations or others to harass,
intimidate, or otherwise interfere with the collection of evidence or
other information from such witnesses; or reveal the identity of
confidential or other informants who provide information to
investigators, which would negatively affect an informant's usefulness
in any ongoing or future investigations and discourage members of the
public from cooperating with future investigations.
<bullet> Subsections (e)(4)(G) and (H) (Describe Procedures for
Notification, Access, and Amendment). These exemptions apply to both
criminal and non-criminal law enforcement investigatory material.
Because system of records 09-25-0224 will be exempt from request
requirements in subsection (d)(1) through (4) (Provide Notification,
Access, and Amendment Rights) and HHS/NIH's compliance with those
request requirements will therefore be voluntary, it is appropriate
that HHS/NIH's compliance with the requirements in subsection (e)(4)(G)
and (H) to provide request procedures be voluntary also.
Notwithstanding these exemptions, HHS/NIH has included request
procedures in the SORN for system of records 09-25-0224 because,
notwithstanding the exemptions, individual record subjects may submit
access and amendment requests, and HHS/NIH will consider such requests
on a case-by-case basis.
<bullet> Subsection (e)(4)(I) (Identify Categories of Record
Sources in the SORN). This exemption applies to both
[[Page 48539]]
criminal and non-criminal law enforcement investigatory material.
Because the information in these records may come from any source, it
is not possible to know every category in advance in order to include
them all in the SORN. Further, some record source categories would not
be appropriate to publish in the SORN if, for example, revealing them
could thwart or impede pending and future law enforcement
investigations by enabling record subjects or other individuals to
discover sensitive investigative techniques and devise ways to bypass
or defeat them to evade detection and apprehension.
<bullet> Subsection (e)(5) (Maintain Records Used in Agency
Determinations with Sufficient Accuracy, Relevance, Timeliness, and
Completeness to Ensure Fairness). This exemption applies to only
criminal law enforcement investigatory material. It is not always
possible to know whether criminal law enforcement investigation
information is accurate, relevant, timely, and complete. With regard to
relevance, in the course of a law enforcement investigation, and
especially in the early stages of an investigation, the relevance of
information obtained or introduced may be unclear or the information
may not be strictly relevant to a specific investigation. Compliance
with (e)(5) would preclude NIH agents from using their investigative
training and exercise of good judgment to both conduct and report on
investigations.
<bullet> Subsection (e)(8) (Make Reasonable Efforts to Provide
Notice of Disclosures Made Under Compulsory Legal Process When Such
Process Becomes A Matter of Public Record). This exemption applies to
only criminal law enforcement investigatory material. Compliance with
this requirement would risk revealing an ongoing criminal investigation
to the target of an investigation who otherwise might not be aware of
it, defeating a law enforcement advantage in those cases. Compliance
with this requirement would also risk revealing a criminal
investigation by mistake or inappropriately in cases in which an
investigation was not in fact a matter of public record or was not
intended to be made public.
<bullet> Subsection (g) (Civil Liability for Noncompliance with
Notification, Access, Amendment, and Accuracy, Relevance, Timeliness,
and Completeness Requirements, or for Noncompliance That Causes an
Adverse Effect). This exemption applies to only criminal law
enforcement investigatory material. The exemption would prevent a
subject individual from bringing a civil action against the agency for
violations of Privacy Act requirements as to those records; this would
include violations of the preceding requirements, from which the agency
would be exempt anyway (which violations therefore would be unlikely to
support a successful civil action), and any other violations causing an
adverse effect on the individual. Any civil action (even an untenable
one) could interfere with, delay, and undermine pending and prospective
investigations, reveal sensitive investigative techniques and evidence,
cause unwarranted invasions of personal privacy, and reveal identities
of witnesses, potential witnesses, and confidential sources.
Other Federal agencies have promulgated the same or similar
exemptions for their law enforcement investigatory systems of records
based on rationales that are the same or similar to those stated for
this system of records. See, e.g., the Final Rules published at 68 FR
4923 (Jan. 31, 2003) and 74 FR 42578 (Aug. 24, 2009) by the Department
of Justice for Criminal Investigation Report System, Justice/ATF-003,
and by the Department of Homeland Security for Security Facility and
Perimeter Access Control and Visitor Management, DHS/ALL-024,
respectively. For the same reasons, HHS/NIH believes that the
exemptions authorized in 5 U.S.C. 552a(j)(2) and (k)(2) are essential
to system of records 09-25-0224 to ensure that law enforcement
investigatory material in NIH Division of Police files is not disclosed
inappropriately to subject individuals. In NIH's past experience,
access to such material by record subjects has led to the destruction,
fabrication, alteration, or creation of information. The proposed
exemptions will help prevent such problems from recurring in the
future.
Accordingly, HHS proposes to exempt both criminal and non-criminal
law enforcement investigatory material in system of records 09-25-0224
NIH Police Records from the requirements in subsections (c)(3), (d)(1)
through (4), (e)(1), (e)(4)(G) through (I), and (f) of the Privacy Act,
based on 5 U.S.C. 552a(j)(2) and (k)(2), and to exempt criminal law
enforcement investigatory material in the same system of records from
the additional requirements in subsections (c)(4), (e)(2) and (3),
(e)(5), (e)(8), and (g) of the Privacy Act, based on 5 U.S.C.
552a(j)(2).
Analysis of Impacts
I. Review Under Executive Orders 12866, 13563, and 14094
The agency believes that this proposed rule is not a significant
rule under Executive Orders 12866, Regulatory Planning and Review;
13563, Improving Regulation and Regulatory Review; or 14094,
Modernizing Regulatory Review, because it will not (1) have an annual
effect on the economy of $200 million or more; or adversely affect in a
material way the economy, a sector of the economy, productivity,
competition, jobs, the environment, public health or safety, or State,
local or Tribal governments or communities; (2) create a serious
inconsistency or otherwise interfere with any action taken or planned
by another agency; (3) materially alter the budgetary impact of
entitlements, grants, user fees or loan programs, or the rights and
obligations of recipients thereof; or (4) raise legal or policy issues
for which centralized review would meaningfully further the President's
priorities or the principles set forth in these Executive orders. This
proposed rule renders certain Privacy Act requirements inapplicable to
certain records (in this case, law enforcement investigatory records)
in accordance with criteria established in the Privacy Act based on a
showing that agency compliance with those requirements with respect to
those records would harm the effectiveness or integrity of the agency
function or process for which the records are maintained (in this case,
law enforcement investigations). However, the Office of Management and
Budget (OMB) has reviewed this regulation under its Privacy Act
oversight authority.
II. Review Under the Regulatory Flexibility Act (5 U.S.C. 601-612)
The Regulatory Flexibility Act requires agencies to analyze
regulatory options that would minimize any significant impact of a rule
on small entities. Because the proposed rule concerns records about
individuals, it imposes no duties or obligations on small entities; the
agency therefore certifies that the proposed rule will not have a
significant economic impact on a substantial number of small entities.
III. Review under the Unfunded Mandates Reform Act of 1995 (Section
202, Pub. L. 104-4)
Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires
that agencies prepare a written statement, which includes an assessment
of anticipated costs and benefits, before proposing ``any rule that
includes any Federal mandate that may result in the expenditure by
State, local, and tribal governments, in the aggregate, or by the
private sector, of $100,000,000 or more (adjusted annually for
inflation)
[[Page 48540]]
in any one year.'' The current inflation-adjusted statutory threshold
is approximately $156 million based on the Bureau of Labor Statistics
inflation calculator. The agency does not expect that this proposed
rule will result in any one-year expenditure that would meet or exceed
this amount.
IV. Review Under the Paperwork Reduction Act of 1995 (44 U.S.C. 35-1 et
seq.)
This proposed rule does not contain any information collection
requirements subject to the Paperwork Reduction Act.
V. Review Under Executive Order 13132, Federalism
This proposed rule will not have any direct effects on States, on
the relationship between the National Government and the States, or on
the distribution of power and responsibilities among the various levels
of government. Therefore, no federalism assessment is required.
List of Subjects in 45 CFR Part 5b
Privacy.
For the reasons set out in the preamble, the Department of Health
and Human Services proposes to amend 45 CFR part 5b as follows:
PART 5b--PRIVACY ACT REGULATIONS
0
1. The authority citation for part 5b continues to read as follows:
Authority: 5 U.S.C. 301, 5 U.S.C. 552a.
0
2. Amend Sec. 5b.11 by adding paragraph (b)(2)(ix) to read as follows:
Sec. 5b.11 Exempt systems.
* * * * *
(b) * * *
(2) * * *
(ix) Pursuant to subsections (j)(2) and (k)(2) of the Act:
(A) NIH Police Records, 09-25-0224. (All law enforcement
investigatory records are exempt from subsections (c)(3), (d)(1)
through (4), (e)(1), (e)(4)(G) through (I), and (f) of the Act;
criminal law enforcement investigatory records are exempt from
additional subsections (c)(4), (e)(2) and (3), (e)(5), (e)(8), and (g);
the access exemption for non-criminal law enforcement investigatory
records is limited as provided in subsection (k)(2).)
(B) [Reserved]
* * * * *
Xavier Becerra,
Secretary, Department of Health and Human Services.
[FR Doc. 2024-12469 Filed 6-6-24; 8:45 am]
BILLING CODE 4140-01-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.