Proposed Rule2026-08979
Privacy Act Regulations
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
May 6, 2026
Issuing agencies
Commodity Futures Trading Commission
Abstract
The Commodity Futures Trading Commission (CFTC or Commission) is establishing a new Insider Risk Program, the records of which are included in a new Privacy Act system of records, CFTC-59, Insider Risk Program Records (CFTC-59), published concurrently in this Federal Register. The Commission proposes here to update its regulations to exempt CFTC-59 from certain provisions of the Privacy Act in accordance with the requirements of the Privacy Act and the guidance contained in Office of Management and Budget (OMB) Circular A-108, Federal Agency Responsibilities for Review, Reporting, and Publication Under the Privacy Act (OMB A-108) in order to maintain the integrity of insider risk investigations and to keep confidential the identity of confidential sources. If the Commission adopts this proposal, the records in CFTC-59 will be exempt from those provisions of the Privacy Act pertaining to an individual's right to access and request amendment of their records.
Full Text
<html>
<head>
<title>Federal Register, Volume 91 Issue 87 (Wednesday, May 6, 2026)</title>
</head>
<body><pre>
[Federal Register Volume 91, Number 87 (Wednesday, May 6, 2026)]
[Proposed Rules]
[Pages 24377-24379]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2026-08979]
========================================================================
Proposed Rules
Federal Register
________________________________________________________________________
This section of the FEDERAL REGISTER contains notices to the public of
the proposed issuance of rules and regulations. The purpose of these
notices is to give interested persons an opportunity to participate in
the rule making prior to the adoption of the final rules.
========================================================================
Federal Register / Vol. 91, No. 87 / Wednesday, May 6, 2026 /
Proposed Rules
[[Page 24377]]
COMMODITY FUTURES TRADING COMMISSION
17 CFR Part 146
RIN 3038-AF47
Privacy Act Regulations
AGENCY: Commodity Futures Trading Commission.
ACTION: Notice of proposed rulemaking.
-----------------------------------------------------------------------
SUMMARY: The Commodity Futures Trading Commission (CFTC or Commission)
is establishing a new Insider Risk Program, the records of which are
included in a new Privacy Act system of records, CFTC-59, Insider Risk
Program Records (CFTC-59), published concurrently in this Federal
Register. The Commission proposes here to update its regulations to
exempt CFTC-59 from certain provisions of the Privacy Act in accordance
with the requirements of the Privacy Act and the guidance contained in
Office of Management and Budget (OMB) Circular A-108, Federal Agency
Responsibilities for Review, Reporting, and Publication Under the
Privacy Act (OMB A-108) in order to maintain the integrity of insider
risk investigations and to keep confidential the identity of
confidential sources. If the Commission adopts this proposal, the
records in CFTC-59 will be exempt from those provisions of the Privacy
Act pertaining to an individual's right to access and request amendment
of their records.
DATES: Please submit comments on or before June 5, 2026.
ADDRESSES: You may submit comments identified as pertaining to
``Privacy Act Exemption--CFTC-59'' by any of the following methods:
<bullet> <a href="http://Regulations.gov">Regulations.gov</a>: Go to <a href="https://www.regulations.gov">https://www.regulations.gov</a> and
press the ``Search'' button, then proceed as follows:
1. Under Refine Documents Results--check the box to ``Only show
documents open for comment''
2. Under Agency--select ``See More'' and check the box for
``Commodity Futures Trading Commission,'' then press the Apply button;
3. Identify this proposal in the list of CFTC documents open for
comment, press the ``Comment'' button to open the submission form, and
follow the instructions on the form.
Alternatively, if you are viewing this proposal on
<a href="http://www.federalregister.gov">www.federalregister.gov</a>, click the ``Submit A Public Comment'' button
at the top of the page to open the comment form. Follow the
instructions on the form to submit your comment to <a href="http://Regulations.gov">Regulations.gov</a>.
<bullet> Mail: Send to--Christopher Kirkpatrick, Secretary of the
Commission, Commodity Futures Trading Commission, Three Lafayette
Centre, 1155 21st Street NW, Washington, DC 20581.
<bullet> Hand Delivery/Courier: Address to--CFTC Comment
Submission, Attn: Christopher Kirkpatrick, Secretary of the Commission,
Commodity Futures Trading Commission, Three Lafayette Centre, 1155 21st
Street NW, Washington, DC 20581.
Please submit your comments using only one of these methods. To
avoid possible delays with mail or in-person deliveries, submissions
through <a href="http://Regulations.gov">Regulations.gov</a> are encouraged.
All comments must be submitted in English or, if not, accompanied
by an English translation. Do not include in your comment text or
attachments any personal identifying information or business
information that you do not want published online. Comments (regardless
of submission method) will be published without review for, and without
removal of, any personal identifying information or information your
business may consider confidential.
If you wish to submit confidential information for the Commission's
consideration, please contact the CFTC personnel listed in this Notice
under FOR FURTHER INFORMATION CONTACT before making any submission.
Please also carefully review the Commission's procedures in 17 CFR
145.9 for requesting confidential treatment under the Freedom of
Information Act (FOIA) of information submitted to the Commission.
The CFTC reserves the right, but shall have no obligation, to
review, pre-screen, filter, or redact all or any part of your comment
submission. The CFTC also reserves the right, without further
notification, to refuse to publish or to remove from public view all or
any part of your submission to the extent it contains content
inappropriate for publication in a comment file, such as--without
limitation--obscene language, threats of violence, solicitations for
commercial sales or illegal activity, or obvious spam. If a submission
that is refused for or withdrawn from publication because of
inappropriate content also contains comments on the merits of this
proposal, such submission will be retained in the record for the matter
and will be considered as required under the Administrative Procedure
Act and other applicable laws, and may be accessible under the FOIA.
FOR FURTHER INFORMATION CONTACT: Kellie Cosgrove Riley, Chief Privacy
Officer, <a href="/cdn-cgi/l/email-protection#a9d9dbc0dfc8cad0e9cacfddca87cec6df"><span class="__cf_email__" data-cfemail="403032293621233900232634236e272f36">[email protected]</span></a>, 202-418-5610, Office of the General Counsel,
Commodity Futures Trading Commission, Three Lafayette Centre, 1155 21st
Street NW, Washington, DC 20581.
SUPPLEMENTARY INFORMATION:
I. Background
A. The Privacy Act
The Privacy Act of 1974 \1\ establishes a code of fair information
practice principles that govern Federal agencies' collection,
maintenance, use, and dissemination of an individual's personal
information. The Privacy Act applies to information that is maintained
in a ``system of records,'' defined as a group of any records under the
control of an agency from which information is retrieved by the name of
the individual or by some identifying number, symbol, or other
identifying particular assigned to the individual.\2\
---------------------------------------------------------------------------
\1\ 5 U.S.C. 552a.
\2\ 5 U.S.C. 552a(a)(5).
---------------------------------------------------------------------------
In addition to establishing a code of fair information practice
principles, the Privacy Act restricts disclosure of records containing
personal information that an agency maintains.\3\ The Privacy Act also
grants individuals an increased right of access to records maintained
about themselves as well as the right to request amendment of those
records upon a showing that they are not accurate, relevant, timely, or
complete.\4\
---------------------------------------------------------------------------
\3\ 5 U.S.C. 552a(b).
\4\ 5 U.S.C. 552a(d).
---------------------------------------------------------------------------
[[Page 24378]]
B. Privacy Act Exemptions
The Privacy Act permits agencies, where certain requirements are
met and subject to limitations set forth in the Privacy Act, to
specifically exempt systems of records from certain provisions of the
Privacy Act, mainly pertaining to an individual's right to access and
request amendment of their records.\5\ In order to claim an exemption,
however, the agency must engage in a rulemaking process pursuant to the
APA \6\ and make clear to the public why particular exemptions are
being invoked.\7\
---------------------------------------------------------------------------
\5\ 5 U.S.C. 552a(j) and (k).
\6\ 5 U.S.C. 553.
\7\ 5 U.S.C. 552a(j) and (k).
---------------------------------------------------------------------------
Part 146 of the Commission's regulations,\8\ entitled ``Records
Maintained on Individuals,'' contains the rules of the Commission
implementing the Privacy Act. Commission regulation Sec. 146.12 \9\
(the Privacy Act regulation) currently asserts exemptions for certain
of the Commission's systems of records that contain records relating to
the Commission's investigatory mission and personal security
obligations. The Commission proposes to amend Commission regulation
Sec. 146.12 to add new subsection (h) identifying CFTC-59 as a system
of records for which the Commission would assert an exemption and to
specify the rationale for the exemption in compliance with subsection
(k) of the Privacy Act \10\ and the corresponding guidance in OMB
Circular A-108.\11\ OMB A-108, issued in 2016, provides that, at a
minimum, an agency's Privacy Act exemption regulations should include
the specific name of any systems of records that will be exempt
pursuant to the regulations, the specific provisions of the Privacy Act
from which the system of records will be exempt and the reasons
therefor, and an explanation of why the exemption is necessary and
appropriate.\12\
---------------------------------------------------------------------------
\8\ 17 CFR 146.
\9\ 17 CFR 146.12.
\10\ 5 U.S.C. 552a(j) and (k).
\11\ OMB A-108 at page 25.
\12\ OMB A-108 at page 25.
---------------------------------------------------------------------------
C. CFTC-59
The Commission is publishing a new Privacy Act system of records,
CFTC-59, Insider Risk Program Records (CFTC-59), concurrent with this
notice of proposed rulemaking and is proposing here to exempt CFTC-59
from certain provisions of the Privacy Act. CFTC-59 contains records
related to the Commission's Insider Risk Program investigations. An
Insider is any person who has or had authorized access to or knowledge
of the CFTC's resources, including employees, facilities, information,
equipment, networks, and systems. An Insider Risk is a risk that an
insider will use their authorized access, wittingly or unwittingly, to
harm the security of organizational operations and assets, individuals,
other organizations, or the Nation. Records in CFTC-59 are collected to
detect, deter, and mitigate the unauthorized disclosure of information
by an insider and to protect individuals, facilities, information,
equipment, networks, and systems from insider risks. The Commission is
proposing to exempt this system of records from certain provisions of
the Privacy Act because the records are compiled to investigate actual
or potential insider risks. As such, the records must be protected from
disclosure to maintain the integrity of the investigative process and
not provide to any individual an opportunity to access records and
compromise that process, such as through the destruction of evidence,
interference with witnesses, or otherwise. In addition, the Commission
is proposing to exempt this system of records to keep confidential the
identity of sources who provided information to the Commission during
the course of investigations under an express promise that their
identities would remain confidential. If an individual can access the
identities of confidential sources, those sources may be unwilling to
provide information that the Commission needs for its insider risk
investigative activities. Specifically, the Commission is proposing to
exempt CFTC-59, pursuant to subsection (k)(2) of the Privacy Act \13\
and subject to the requirements and limitations set forth therein, from
the following provisions of the Privacy Act: 5 U.S.C. 552a (c)(3);
(d)(1), (2), (3), and (4); (e)(1); (e)(4)(G), (H), and (I); and (f).
---------------------------------------------------------------------------
\13\ 5 U.S.C. 552a(k)(2).
---------------------------------------------------------------------------
Request for Comment
The Commission requests comment on the justification for and scope
of the proposed CFTC-59 exemptions.
II. Related Matters
A. Regulatory Flexibility Act
The Regulatory Flexibility Act (RFA) requires federal agencies to
consider whether the rules they propose will have a significant
economic impact on a substantial number of small entities and, if so,
to provide a regulatory flexibility analysis regarding the economic
impact on those entities.\14\
---------------------------------------------------------------------------
\14\ 5 U.S.C. 601 et seq.
---------------------------------------------------------------------------
The proposed regulations, issued under the Privacy Act, exempt a
system of records maintained by the Commission from certain provisions
of the Privacy Act, primarily those provisions related to an
individual's right to access and seek amendment of those records.
Individuals are defined in the Privacy Act as United States citizens or
aliens lawfully admitted to the United States for permanent
residence.\15\ Small entities, as defined in the RFA, are not
individuals under the Privacy Act and are not provided rights
thereunder; therefore, small entities are outside the scope of the
proposed regulations. Accordingly, the Chairman, on behalf of the
Commission, hereby certifies pursuant to 5 U.S.C. 605(b), that this
proposed rule will not have a significant economic impact on a
substantial number of small entities.
---------------------------------------------------------------------------
\15\ 5 U.S.C. 552a(a)(2).
---------------------------------------------------------------------------
B. Paperwork Reduction Act
The Paperwork Reduction Act (``PRA'') imposes certain requirements
on federal agencies in connection with their conducting or sponsoring
any collection of information.\16\ The Commission may not conduct or
sponsor, and a respondent is not required to respond to, a request for
collection of information unless the information collection request
displays a currently valid control number issued by OMB. This proposed
rule does not contain a ``collection of information,'' as defined in
the PRA. Accordingly, the requirements imposed by the PRA are not
applicable to this proposed rule.
---------------------------------------------------------------------------
\16\ 5 U.S.C. 3501 et seq.
---------------------------------------------------------------------------
C. Cost-Benefit Considerations
Section 15(a) of the Commodity Exchange Act (CEA) provides that,
before promulgating a regulation under the CEA or issuing an order, the
Commission shall consider the costs and benefits of the action of the
Commission.\17\ Section 15(a) further specifies that the costs and
benefits shall be evaluated in light of five broad areas of market and
public concern: (1) protection of market participants and the public;
(2) efficiency, competitiveness, and financial integrity of the futures
markets; (3) price discovery; (4) sound risk management practices; and
(5) other public interest considerations.\18\ The proposed rule is
being promulgated under the Privacy Act and pertains to the rights of
[[Page 24379]]
individuals with respect to records the Commission maintains about
them. The proposed rules are not being promulgated under the CEA.
Therefore, the Commission preliminarily finds that the considerations
enumerated in Section 15(a)(2) of the CEA are not applicable here.
---------------------------------------------------------------------------
\17\ 7 U.S.C. 19(a).
\18\ 7 U.S.C. 19(a)(2).
---------------------------------------------------------------------------
Request for Comment
The Commission requests comment on whether its preliminary finding
is correct.
D. Antitrust Considerations
Section 15(b) of the CEA requires the Commission to ``take into
consideration the public interest to be protected by the antitrust laws
and endeavor to take the least anticompetitive means of achieving the
purposes of this Act, in issuing any order or adopting any Commission
rule or regulation (including any exemption under section 4(c) or
4c(b)), or in requiring or approving any bylaw, rule, or regulation of
a contract market or registered futures association established
pursuant to section 17 of this Act.'' \19\ The Commission believes that
the public interest to be protected by the antitrust laws is generally
to protect competition. The Commission has considered the proposed rule
to determine whether it is anticompetitive and has preliminarily
identified no anticompetitive effects.
---------------------------------------------------------------------------
\19\ 7 U.S.C. 19(b).
---------------------------------------------------------------------------
Because the Commission has preliminarily determined that the
proposed rule is not anticompetitive and has no anticompetitive
effects, the Commission has not identified any less anticompetitive
means of achieving the purposes of the Act.
Request for Comment
The Commission requests comment on whether the proposed rule is
anticompetitive and, if it is, what the anticompetitive effects are and
whether there are less anticompetitive means of achieving the relevant
purposes of the Act that would otherwise be served by adopting the
proposed rule. The Commission also requests comment on whether the
proposed rule implicates any other specific public interest to be
protected by the antitrust laws.
List of Subjects in 17 CFR Part 146
Privacy.
For the reasons stated in the preamble, the Commodity Futures
Trading Commission proposes to amend Part 146 of Title 17, of the Code
of Federal Regulations, as follows:
PART 146--RECORDS MAINTAINED ON INDIVIDUALS [AMENDED]
0
1. The authority cited for Part 146 continues to read as follows:
Authority: 88 Stat. 1896 (5 U.S.C. 552a), as amended; 88 Stat.
1389 (7 U.S.C. 4a(j)).
0
2. Add paragraph (h) to Sec. 146.12 to read as follows:
Sec. 146.12 Exemptions
* * * * *
(h) CFTC-59 Insider Risk Program Records. The system of records
identified as CFTC-59, Insider Risk Program Records, contains records
collected to detect, deter, and mitigate the unauthorized disclosure of
information by CFTC staff, including employees and contractors, and to
protect individuals, facilities, information, equipment, networks, and
systems from insider risks. These risks can include damage caused
through espionage, terrorism, or unauthorized disclosure of privileged
information or through the loss or degradation of Commission resources
or capabilities. Pursuant to 5 U.S.C. 552a(k)(2) and subject to the
requirements and limitations set forth therein, the Commission is
exempting this system of records from the following provisions of the
Privacy Act: 5 U.S.C. 552a(c)(3); (d)(1), (2), (3), and (4); (e)(1);
(e)(4)(G), (H), and (I); and (f), and from the following corresponding
sections of these rules: 146.3; 146.5; 146.6(d); 146.11(a)(7), (8), and
(9); and 146.7(a). Exemptions from these particular subsections of the
Privacy Act are justified for the following reasons:
(1) From section (c)(3) (Accounting of Certain Disclosures),
because release of the accounting of certain disclosures could alert
the subject of an investigation to the existence and extent of that
investigation and reveal the investigative interests of the Commission
and the recipient entity. Release of such information to the subject of
an investigation could reasonably be anticipated to impede and
interfere with the Commission's efforts to identify and investigate
unlawful activities.
(2) From section (d)(1), (2), (3), and (4) (Access and Amendment),
because individual access to these records could alert the subject of
an investigation to the existence and extent of that investigation and
reveal the investigative interests of the Commission and others.
Providing a subject with access to these records could impair the
effectiveness of the Commission's investigations and could
significantly impede the investigation by providing the opportunity for
the subject to destroy documentary evidence, improperly influence
witnesses and confidential sources, fabricate testimony, and engage in
other activities that could compromise the investigation. Allowing the
subject of the investigation to amend records in this system of records
could likewise interfere with ongoing law enforcement proceedings and
impose an impossible administrative burden by requiring law enforcement
investigations to be continuously reinvestigated.
(3) From section (e)(1) (Relevancy and Necessity of Information),
because in the course of investigations, the significance of certain
information may not be clear or the information may not be strictly
relevant or necessary to a specific investigation; but, effective
investigations require the retention of all information that may aid in
the investigation or aid in establishing patterns of activity and
provide investigative leads.
(4) From section (e)(4)(G), (H), and(I) (Agency Requirements) and
(f) (Agency Rules), because the Commission is not required to establish
requirements, rules, or procedures related to access and amendment of
records in a system of records that is exempt from the individual
access and amendment provisions in subsection (d) of the Privacy Act.
* * * * *
Issued in Washington, DC, on May 4, 2026, by the Commission.
Robert Sidman,
Deputy Secretary of the Commission.
Note: The following appendix will not appear in the Code of
Federal Regulations.
Privacy Act Regulations--Commission Voting Summary
On this matter, Chairman Selig voted in the affirmative. No
Commissioner voted in the negative.
[FR Doc. 2026-08979 Filed 5-5-26; 8:45 am]
BILLING CODE 6351-01-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on May 6, 2026.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.