Rule2026-00332
Privacy Act Exemption; Correction
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
January 12, 2026
Effective
January 12, 2026
Issuing agencies
National Credit Union Administration
Abstract
In accordance with the Privacy Act of 1974, the National Credit Union Administration (NCUA) Board is issuing this interim final rule to make a correction to the numbering of one system of records and to exempt one system of records from certain requirements of the Act. NCUA has previously published System of Records Notices (SORN) for these systems. The Board has found good cause to issue the interim final rule without advance notice-and-comment procedures and with an immediate effective date.
Full Text
<html>
<head>
<title>Federal Register, Volume 91 Issue 7 (Monday, January 12, 2026)</title>
</head>
<body><pre>
[Federal Register Volume 91, Number 7 (Monday, January 12, 2026)]
[Rules and Regulations]
[Pages 1072-1076]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2026-00332]
=======================================================================
-----------------------------------------------------------------------
NATIONAL CREDIT UNION ADMINISTRATION
12 CFR Part 792
RIN 3133-AG06
Privacy Act Exemption; Correction
AGENCY: National Credit Union Administration (NCUA).
ACTION: Interim final rule; request for comments.
-----------------------------------------------------------------------
SUMMARY: In accordance with the Privacy Act of 1974, the National
Credit Union Administration (NCUA) Board is issuing this interim final
rule to make a correction to the numbering of one system of records and
to exempt one system of records from certain requirements of the Act.
NCUA has previously published System of Records Notices (SORN) for
these systems. The Board has found good cause to issue the interim
final rule without advance notice-and-comment procedures and with an
immediate effective date.
DATES: This rule is effective on January 12, 2026. Comments must be
received on or before February 11, 2026.
ADDRESSES: Comments may be submitted in one of the following ways.
(Please send comments by one method only):
<bullet> Federal eRulemaking Portal: <a href="https://www.regulations.gov">https://www.regulations.gov</a>.
The docket number for this proposed rule is NCUA-2026-XXXX. Follow the
``Submit a comment'' instructions. If you are reading this document on
<a href="http://federalregister.gov">federalregister.gov</a>, you may use the green ``SUBMIT A PUBLIC COMMENT''
button beneath this rulemaking's title to submit a comment to the
<a href="http://regulations.gov">regulations.gov</a> docket. A plain language summary of the proposed rule
is also available on the docket website.
<bullet> Mail: Address to Melane Conyers-Ausbrooks, Secretary of
the Board, National Credit Union Administration, 1775 Duke Street,
Alexandria, Virginia 22314-3428.
<bullet> Hand Delivery/Courier: Same as mailing address. Mailed and
hand-delivered comments must be received by the close of the comment
period.
Public Inspection: Please follow the search instructions on <a href="https://www.regulations.gov">https://www.regulations.gov</a> to view the public comments. Do not include any
personally identifiable information (such as name, address, or other
contact information) or confidential business information that you do
not want publicly disclosed. All comments are public records; they are
publicly displayed exactly as received, and will not be deleted,
modified, or redacted. Comments may be submitted anonymously. If you
are unable to access public comments on the internet, you may contact
the NCUA for alternative access by calling (703) 518-6540 or emailing
<a href="/cdn-cgi/l/email-protection#98d7dfdbd5f9f1f4d8f6fbedf9b6fff7ee"><span class="__cf_email__" data-cfemail="8dc2cacec0ece4e1cde3eef8eca3eae2fb">[email protected]</span></a>.
FOR FURTHER INFORMATION CONTACT: Elizabeth Harris, Senior Agency
Official for Privacy, National Credit Union Administration, or Jennifer
Harrison, Senior Counsel, 1775 Duke Street, Alexandria, Virginia 22314-
3428 or by phone at (703) 518-6540.
SUPPLEMENTARY INFORMATION:
I. Background
The Privacy Act of 1974 places requirements on federal agencies
regarding the collection, maintenance, distribution, and security of an
individual's personal information that is contained in an agency's
systems of records. Pursuant to the Privacy Act, NCUA publishes a
Systems of Records Notice (SORN) that informs the public of each system
of records the agency maintains, describes the nature and routine use
of records in the system, identifies the system manager responsible for
the system including contact information, and provides procedures
whereby individuals may determine whether a system contains a record
pertaining to them, gain access to
[[Page 1073]]
records pertaining to them, or seek to amend or correct information in
a record about them. NCUA Systems of Records Notices are published in
the Federal Register and are available at <a href="https://www.ncua.gov/privacy">https://www.ncua.gov/privacy</a>.
The Privacy Act also requires each federal agency to publish rules
describing its Privacy Act procedures and any system of records it
exempts from provisions of the Act, including the reasons for the
exemption. NCUA publishes its rules at part 792, subpart E; the rules
provide individuals with detailed information regarding the exercise of
their rights under the Privacy Act, identify and describe the NCUA
systems of records that are exempt from provisions of the Privacy Act,
and provide standards for NCUA employees regarding collecting, using,
maintaining, or disseminating records.
II. Proposed Changes
The Board is revising its Privacy Act regulations at 12 CFR part
792 to correct the number associated with a system of records, NCUA-11
(previously numbered as NCUA-20). The Board has previously promulgated
exemptions to the Privacy Act for this system of records in accordance
with subsections (k)(2) and (j)(2). The Board is also revising its
Privacy Act regulations at 12 CFR part 792 to exempt one system of
records, NCUA-28, from certain requirements of the Privacy Act in
accordance with subsection (k)(2) of the Privacy Act. The interim final
rule amends 12 CFR 792.66, the provision on exemptions.
A. NCUA-11
The NCUA SORN entitled ``Office of Inspector General (OIG)
Investigative Records'' and currently numbered as NCUA-11, was
originally published at 53 FR 37372 (Sept. 26, 1988) as ``Investigation
Files'' and numbered as NCUA-20. A modified SORN was published at 60 FR
18149 (Apr. 10, 1995), renaming the system ``Office of Inspector
General Investigative Records'' and listing exemptions from certain
provisions of the Privacy Act. Those exemptions were promulgated at 60
FR 31912 (June 19, 1995). The system was renumbered to NCUA-11 at 65 FR
3486 (Feb. 20, 2000). The corresponding reference to the SORN in Sec.
792.66(b)(3) was not updated at that time. Subsequent modifications to
the SORN were published at 71 FR 77807 (Dec. 27, 2006),75 FR 41539
(July 16, 2010), and 88 FR 43152 (July 6, 2023), however the
corresponding reference to the SORN was still not updated. The NCUA is
now updating the SORN number in Sec. 792.66(b)(3) as a technical
correction.
B. NCUA-28
The Board is also adopting exemptions under subsection (k)(2) for
NCUA-28, Anti-Harassment Case Tracking and Records. NCUA has previously
published a SORN for this system in the Federal Register at 88 FR 37584
(June 8, 2023). NCUA-28 contains information collected by the NCUA to
assist the NCUA with conducting internal investigations into
allegations of harassment brought by current NCUA employees and NCUA
contractors and taking appropriate action(s) to address such
allegations.
Subsection (k)(2) of the Privacy Act authorizes the head of an
agency to exempt a system of records from the applicable subsections if
investigatory records are compiled for law enforcement purposes;
provided, however if an individual is denied any right, privilege, or
benefit that he or she would otherwise be entitled by Federal law, or
for which he or she would otherwise be eligible, as a result of the
maintenance of such material, such material shall be provided to such
individual, except to the extent that the disclosure of such material
would reveal the identity of a source who furnished information to the
Government under an express promise that the identity of the source
would be held in confidence. Because of the investigatory nature of
information that is maintained in this system of records, this rule
would add NCUA's Anti-Harassment Case Tracking and Records System to
the list of NCUA systems that are exempt from specific provisions of
the Privacy Act pursuant to 5 U.S.C. 552a(k)(2).
Specifically, the Board is exempting this system of records under 5
U.S.C. 552a(k)(2) from the following provisions of the Privacy Act of
1974:
<bullet> Subsection (c)(3) relating to access to the accounting of
disclosures;
<bullet> Subsection (d) relating to access to the records;
<bullet> Subsection (e)(1) relating to the type of information
maintained in the records;
<bullet> Subsections (e)(4)(G), (H) and (I) relating to publishing
in the annual system notice information as to agency procedures for
access and correction and information as to the categories of sources
of records; and
<bullet> Subsection (f) relating to developing agency rules for
gaining access and making corrections.
The determination to exempt these records was made because it is
necessary for NCUA to continue to investigate alleged violations of
law, regulation, and NCUA policy and also to determine continued
suitability for Federal employment. In accordance with Federal anti-
discrimination laws, the Equal Employment Opportunity Commission (EEOC)
requires that all Federal agencies have an anti-harassment policy and
program. NCUA's specific policy prohibits harassment by all employees,
provides an avenue for individuals to report allegations of harassment,
and a process by which NCUA factfinders conduct inquiries and
investigations. Furthermore, NCUA's policy prohibits retaliation
against individuals for raising allegations of harassment or
participating in the process. For NCUA to promptly address and resolve
potential violations of law, regulation, or NCUA policy, individuals
who are participating in this process must be assured that their
statements will be kept confidential consistent with law. Without this
exemption, the NCUA's ability to address allegations of harassment
would be hindered by witnesses' and/or victims' lack of willingness to
come forward, fearful that their statements or identities may be
revealed. Other agencies, including the EEOC, have exempted similar
records from certain provisions of the Privacy Act.
The Board is promulgating these exemptions on the following bases:
5 U.S.C. 552a(c)(3)--The release of the disclosure accounting to
the individual who is the subject of the investigation would present a
serious impediment to NCUA's ability to conduct inquiries or
investigations into potential violations of law or policy.
5 U.S.C. 552a(d)--Access to records contained in this system would
inform the subject of an actual or potential investigation, of the
existence of that investigation, of the nature and scope of the
investigation, of the information and evidence obtained as to their
activities, and of the identity of witnesses. Such access would impede
an investigator's ability to freely investigate such cases, including
concerns that some witnesses have been promised confidentiality and
would not want their statements provided to the subject of the
investigation. Amendment of the records would interfere with the
ongoing fact-finding process. Furthermore, subject individuals of the
files in this system have access to relevant information as part of the
investigatory process and are given the opportunity to explain or
contradict such information and to submit any responsive evidence of
their own.
5 U.S.C. 552a(e)(1)--Under the provision of (e)(1), the agency must
only maintain such information that is relevant and necessary. It is
difficult to
[[Page 1074]]
know during the course of an investigation what is relevant and
necessary. In this context, facts or evidence may not seem relevant at
first, but later in the investigation, their relevance is borne out.
5 U.S.C. 552a(e)(4)(G) and (H)--These subsections are inapplicable
to the extent that this system is exempt from the access provisions of
subsection (d) and the rules provisions of subsection (f).
5 U.S.C. 552a(e)(4)(I)--The categories of sources of the records in
this system has been published in the Federal Register under the
requirements of the Privacy Act. In the event, however, that this
subsection should be interpreted to require more detail as to the
identity of sources of the records in this system, exemption from this
provision is necessary as the application of this provision could
disclose investigative techniques and procedures and cause sources to
refrain from giving such information because of fear of reprisal, or
fear of breach of promises of anonymity and confidentiality. This would
compromise the ability to conduct investigations, and to make fair and
objective decisions on questions of suitability for Federal employment
and related issues.
5 U.S.C. 552a(f)--Procedures for notice to an individual pursuant
to subsection (f)(1) as to existence of records pertaining to the
individual dealing with an actual or potential criminal, civil, or
regulatory investigation or prosecution must be exempted because such
notice to an individual would be detrimental to the successful conduct
and/or completion of an investigation or case, pending or future. In
addition, mere notice of the fact of an investigation could inform the
subject or others that their activities are under investigation or may
become the subject of an investigation and could enable the subjects to
avoid detection, to influence witnesses improperly, to destroy
evidence, or to fabricate testimony. Since an exemption is being
claimed for subsection (d) of the Act, the rules required pursuant to
subsections (f)(2) through (5) are inapplicable to this system of
records to the extent that this system of records is exempted from
subsection (d).
For these reasons, the listed exemptions are both necessary and
appropriate.
III. Interim Final Rule
The Board is publishing these changes in an interim final rule for
the following reasons:
A. The correction of NCUA-20 to NCUA-11 is a non-substantive
correction. The change merely corrects the system number to match the
current number of the corresponding SORN, which is an administrative
change. No opposition to the changes and no significant adverse
comments are expected. Therefore, the Board finds that prior notice and
comment are unnecessary.
B. The promulgation of exemptions for NCUA-28 concerns ``agency
organization, procedure, and practice'' and is limited to ``agency
organization, management, or personnel matters.'' The exemption from
provisions of the Privacy Act by the interim final rule affects only
current NCUA employees and contractors, as described previously. No
opposition to the changes and no significant adverse comments are
expected. Accordingly, this rule is exempt from notice-and-public
comment requirements under 5 U.S.C. 553(b).
C. NCUA employees and contractors have had notice of the exemptions
for NCUA-28 since Federal Register publication of the SORN on June 8,
2023. At the time of publication, no comments regarding the proposed
exemptions were received. Therefore, even if this portion of the rule
were not exempt from notice-and-comment requirements, the Board would
find prior notice and comment unnecessary for this reason.
Accordingly, the Board finds good cause exists for making the
amendments set forth in this interim final rule effective less than 30
days after publication.
IV. Regulatory Procedures
A. Administrative Procedure Act
The Board is issuing this interim final rule without prior notice
and the opportunity for public comment and the 30-day delayed effective
date ordinarily prescribed by the Administrative Procedure Act
(APA).\1\ Pursuant to the APA, general notice and the opportunity for
public comment are not required with respect to a rulemaking when an
``agency for good cause finds (and incorporates the finding and a brief
statement of reasons therefor in the rules issued) that notice and
public procedure thereon are impracticable, unnecessary, or contrary to
the public interest.'' \2\
---------------------------------------------------------------------------
\1\ 5 U.S.C. 553.
\2\ 5 U.S.C. 553(b)(B).
---------------------------------------------------------------------------
The Board believes that the public interest is best served by
implementing the interim final rule as soon as possible. As discussed
in the previous section of this preamble, one of the corrections is
non-substantive, while the other concerns internal agency organization,
management, or personnel matters, and is thus exempt from notice and
comment requirements. For the reasons noted previously, the Board finds
that there is good cause consistent with the public interest to issue
the rule without advance notice and comment.\3\ Independently, the
change to NCUA-28 is also exempt from the APA's notice-and-comment
requirements as a rule of agency organization, procedure, or practice.
---------------------------------------------------------------------------
\3\ 5 U.S.C. 553(b)(B); 553(d)(3). For the same reasons, the
Board is not providing the usual 60-day comment period before
finalizing this rule. See NCUA Interpretive Ruling and Policy
Statement (IRPS) 87-2, as amended by IRPS 03-2 and IRPS 15-1. 80 FR
57512 (Sept. 24, 2015), available at <a href="https://www.ncua.gov/files/publications/irps/IRPS1987-2.pdf">https://www.ncua.gov/files/publications/irps/IRPS1987-2.pdf</a>.
---------------------------------------------------------------------------
While the Board believes that there is good cause to issue the rule
without advance notice and comment and with an immediate effective
date, it is interested in the views of the public and requests comment
on the interim final rule.
B. Congressional Review Act
For purposes of the Congressional Review Act, the OMB makes a
determination as to whether a final rule constitutes a ``major'' rule.
If a rule is deemed a ``major rule'' by the Office of Management and
Budget (OMB), the Congressional Review Act generally provides that the
rule may not take effect until at least 60 days following its
publication.
The Congressional Review Act defines a ``major rule'' as any rule
that the Administrator of the Office of Information and Regulatory
Affairs of the OMB finds has resulted in or is likely to result in (A)
an annual effect on the economy of $100,000,000 or more; (B) a major
increase in costs or prices for consumers, individual industries,
Federal, State, or local government agencies or geographic regions, or
(C) significant adverse effects on competition, employment, investment,
productivity, innovation, or on the ability of United States-based
enterprises to compete with foreign-based enterprises in domestic and
export markets.
For the same reasons set forth above, the Board is adopting the
interim final rule without the delayed effective date generally
prescribed under the Congressional Review Act. The delayed effective
date required by the Congressional Review Act does not apply to any
rule for which an agency for good cause finds (and incorporates the
finding and a brief statement of
[[Page 1075]]
reasons therefor in the rule issued) that notice and public procedure
thereon are impracticable, unnecessary, or contrary to the public
interest. As discussed above, the Board has concluded there is good
cause to issue the interim final rule without notice-and-comment
procedures.
As required by the Congressional Review Act, the Board will submit
the interim final rule and other appropriate reports to Congress and
the Government Accountability Office for review. The Board believes the
rule is not major.
C. Regulatory Review (Executive Orders 12866 and 13563)
Pursuant to Executive Order 12866 (``Regulatory Planning and
Review''), a determination must be made whether a regulatory action is
significant and therefore subject to review by the Office of Management
and Budget (OMB) in accordance with the requirements of the Executive
Order. OMB has determined that this proposed rule is not a
``significant regulatory action'' as defined in section 3(f) of
Executive Order 12866.
Executive Order 13563 (``Improving Regulations and Regulatory
Review'') directs executive agencies to analyze regulations that are
``outmoded, ineffective, insufficient, or excessively burdensome, and
to modify, streamline, expand, or repeal them in accordance with what
has been learned.'' Executive Order 13563 also directs that, where
relevant, feasible, and consistent with regulatory objectives, and to
the extent permitted by law, agencies are to identify and consider
regulatory approaches that reduce burdens and maintain flexibility and
freedom of choice for the public. This interim final rule does not
govern the operations of regulated parties. It updates two of the
agency's Privacy Act systems and exemptions. This proposed rule is
consistent with Executive Order 13563.
D. Regulatory Costs (Executive Order 14192)
Executive Order 14192 (``Unleashing Prosperity Through
Deregulation'') was issued on January 31, 2025. Section 3(c) of
Executive Order 14192 requires that any new incremental costs
associated with new regulations shall, to the extent permitted by law,
be offset by the elimination of existing costs associated with at least
10 prior regulations. This interim final rule is not expected to be an
Executive Order 14192 regulatory action because it imposes no costs on
regulated parties.
E. Paperwork Reduction Act
The Paperwork Reduction Act of 1995 (PRA) generally provides that
an agency may not conduct or sponsor, and not withstanding any other
provision of law, a person is not required to respond to a collection
of information, unless it displays a currently valid Office of
Management and Budget (OMB) control number.
The PRA applies to rulemakings in which an agency creates new or
amends existing information collection requirements. For purposes of
the PRA, an information-collection requirement may take the form of a
reporting, recordkeeping, or a third-party disclosure requirement. The
NCUA has determined that the changes in the interim final rule do not
create a new information collection or revise an existing information
collection as defined by the PRA.
F. Executive Order 13132
Executive Order 13132 (``Federalism'') encourages certain agencies
to consider the impact of their actions on state and local interests.
The NCUA, an independent regulatory agency as defined in 44 U.S.C.
3502(5), voluntarily complies with the executive order to adhere to
fundamental federalism principles.
This interim final rule does not have substantial direct effects on
the states, on the relationship between the national government and the
states, or on the distribution of power and responsibilities among the
various levels of government. The rule is administrative and largely
governs internal agency procedures. The NCUA has therefore determined
that this rule does not constitute a policy that has federalism
implications for purposes of the executive order.
G. Assessment of Federal Regulations and Policies on Families
The NCUA has determined that this rule will not affect family well-
being within the meaning of Sec. 654 of the Treasury and General
Government Appropriations Act, 1999, Public Law 105-277, 112 Stat. 2681
(1998).
H. Regulatory Flexibility Act
The Regulatory Flexibility Act (RFA) generally requires that when
an agency issues a proposed rule or a final rule pursuant to the APA or
another law, the agency must prepare a regulatory flexibility analysis
that meets the requirements of the RFA and publish such analysis in the
Federal Register. Specifically, the RFA normally requires agencies to
describe the impact of a rulemaking on small entities by providing a
regulatory impact analysis. For purposes of the RFA, the Board
considers credit unions with assets less than $100 million to be small
entities. This rule does not impose any requirements on federally-
insured credit unions or other small entities.
As discussed previously, consistent with the APA, the Board has
determined for good cause that general notice and opportunity for
public comment is unnecessary, and therefore the Board is not issuing a
notice of proposed rulemaking. Rules that are exempt from notice and
comment procedures are also exempt from the RFA requirements, including
conducting a regulatory flexibility analysis, when among other things
the agency for good cause finds that notice and public procedure are
impracticable, unnecessary, or contrary to the public interest.
Accordingly, the Board has concluded that the RFA's requirements
relating to initial and final regulatory flexibility analysis do not
apply.
List of Subjects in 12 CFR Part 792
Administrative practice and procedure, Credit unions, Freedom of
information, Information, Privacy, Records, Systems of records.
By the National Credit Union Administration Board on December
17, 2025.
Melane Conyers-Ausbrooks,
Secretary of the Board.
For the reasons stated in the preamble, the NCUA Board is amending
12 CFR part 792 as set forth below:
PART 792--REQUESTS FOR INFORMATION UNDER THE FREEDOM OF INFORMATION
ACT AND PRIVACY ACT, AND BY SUBPOENA; SECURITY PROCEDURES FOR
CLASSIFIED INFORMATION
0
1. The authority citation for part 792 continues to read as follows:
Authority: 5 U.S.C. 301, 552, 552a, 552b; 12 U.S.C. 1752a(d),
1766, 1789, 1795f; E.O. 12600, 52 FR 23781, 3 CFR, 1987 Comp.,
p.235; E.O. 13526, 75 FR 707, 2009 Comp. p.298.
0
2. Amend Sec. 792.66 by:
0
a. In paragraph (b)(3), removing the text ``NCUA-20'' and adding in its
place the text ``NCUA-11''; and
0
b. Adding paragraph (b)(5).
The addition reads as follows:
Sec. 792.66 Exemptions.
* * * * *
(b) * * *
(5) System NCUA-28, entitled ``Anti-Harassment Case Tracking and
Records'' consists of investigatory materials compiled for law
enforcement purposes.
[[Page 1076]]
Records in the Anti-Harassment Case Tracking and Records system are
used in connection with the execution of NCUA's responsibilities
relating to conducting internal investigations into allegations of
harassment. Because the system covers investigatory materials compiled
for law enforcement purposes, it is eligible for exemption under
subsection (k)(2) of the Privacy Act. The Anti-Harassment Case Tracking
and Records system is exempt from subsections (c)(3), (d), (e)(1),
(e)(4)(G), (e)(4)(H), (e)(4)(I), and (f) of the Privacy Act. However,
if an individual is denied any right, privilege, or benefit to which he
would otherwise be entitled by Federal law, or for which he otherwise
would be eligible, as a result of the maintenance of such records, the
records or information will be made available to him, provided the
identity of a confidential source is not disclosed. NCUA need not make
an accounting of previous disclosures of a record in this system of
records available to its subject, and NCUA need not grant access to any
records in this system of records by their subject. Further, whenever
individuals request records about themselves and maintained in this
system of records, the NCUA will advise the individuals only that no
records available to them pursuant to the Privacy Act of 1974 have been
identified. However, if review of the record reveals that the
information contained therein has been used or is being used to deny
the individuals any right, privilege or benefit for which they are
eligible or to which they would otherwise be entitled under Federal
law, the individuals will be advised of the existence of the
information and will be provided the information, except to the extent
disclosure would identify a confidential source. Where possible,
information that would identify a confidential source will be extracted
or summarized in a manner which protects the source and the summary or
extract will be provided to the requesting individual.
* * * * *
[FR Doc. 2026-00332 Filed 1-9-26; 8:45 am]
BILLING CODE 7535-01-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on January 12, 2026.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.