Privacy Act: Proposed Exemptions

AGENCY:

Federal Retirement Thrift Investment Board.

ACTION:

Notice of proposed rulemaking.

SUMMARY:

In accordance with the Privacy Act of 1974, the Federal Retirement Thrift Investment Board (FRTIB) proposes to exempt five systems of records from certain requirements of the Act. FRTIB has previously published System of Records Notices (SORNs) for these systems.

DATES:

Comments on this notice of proposed rulemaking must be received by September 13, 2021.

ADDRESSES:

You may submit written comments to FRTIB through the following methods:

• Federal eRulemaking Portal: https://www.regulations.gov . Follow the website instructions for submitting comments.
• Fax: 202-942-1676.
• Mail or Hand Delivery: Office of General Counsel, Federal Retirement Thrift Investment Board, 77 K Street NE, Suite 1000, Washington, DC 20002.

FOR FURTHER INFORMATION CONTACT:

Dharmesh Vashee, General Counsel and Senior Agency Official for Privacy, Federal Retirement Thrift Investment Board, Office of General Counsel, 77 K Street NE, Suite 1000, Washington, DC 20002, (202) 942-1600.

SUPPLEMENTARY INFORMATION:

FRTIB proposes to revise its Privacy Act regulations at 5 CFR part 1630 to exempt five of its systems of records, FRTIB-2, FRTIB-13, FRTIB-14, FRTIB-15, and FRTIB-23, from certain requirements of the Privacy Act, 5 U.S.C. 552a. The FRTIB is promulgating exemptions to the Privacy Act for these five systems of records in accordance with subsection (k)(2) and subsection (k)(5).

Subsection (k)(2) of the Privacy Act authorizes the head of an agency to exempt a system of records from the applicable subsections if investigatory records are compiled for law enforcement purposes; provided, however if an individual is denied any right, privilege, or benefit that he or she would otherwise be entitled by Federal law, or for which he or she would otherwise be eligible, as a result of the maintenance of such material, such material shall be provided to such individual, except to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence. Subsection (k)(5) of the Privacy Act authorizes the head of an agency to exempt a system of records from the applicable subsections if investigatory records are compiled solely for the purpose of determining suitability, eligibility, or qualifications for Federal civilian employment, military service, Federal contracts, or access to classified information, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence.

Under the Privacy Act, individuals have a right of access to information pertaining to them which is contained in a system of records. At the same time, the Privacy Act permits certain types of systems to be exempt from some Privacy Act requirements. If an agency claims an exemption, however, it must issue a Notice of Proposed Rulemaking to make clear to the public the reasons why a particular exemption is being claimed.

As indicated in the Agency's accompanying Privacy Act system of records notices proposing and modifying these systems of records, these five systems of records contain information collected by the Agency in the course of carrying out its duties under 5 U.S.C. 8401.

The FRTIB is promulgating exemptions under subsections (k)(2) and (k)(5) for FRTIB-2, Personnel Security Investigation Files. FRTIB-2 contains information compiled by the Agency in order to document and support decisions regarding clearance for access to sensitive FRTIB information and the suitability, eligibility, and fitness for service of applicants for federal employment and contract positions. FRTIB has previously published a SORN for this system in the Federal Register, 85 FR 43654, 43655 (July 21, 2020). FRTIB's personnel investigations records fall under the exemption stated within subsection (k)(2) of the Privacy Act because these records may be used to help streamline and make more efficient the investigations and adjudications process, and may be used to document security violations and actions taken in response to such violations. FRTIB's personnel investigations records also fall under the exemption stated within subsection (k)(5) of the Privacy Act because these records are compiled for the purpose of determining suitability, eligibility, or qualifications for Federal civilian employment, military service, Federal contracts, or access to classified information. FRTIB proposes to exempt eligible records contained within FRTIB-2 from the requirements of subsections (c)(3); (d); (e)(1); (e)(4)(G), (H), (I); and (f), which require agencies to provide an accounting of disclosures; provide notification, access, and amendment rights, rules, and procedures; maintain only relevant and necessary information; and identify categories of record sources. Exempting records from this system is necessary and appropriate to maintain the integrity of personnel investigations and to ensure that FRTIB's efforts to obtain accurate and objective information will be successful. To the extent that FRTIB uses investigatory material within this system of records as a basis for denying an individual any right, privilege, or benefit to which an individual would be entitled in the absence of that record, FRTIB will grant that individual access to the material except to the extent that access would reveal the identity of a source promised confidentiality.

The FRTIB is promulgating exemptions under subsection (k)(2) for FRTIB-13, Fraud and Forgery Records. FRTIB-13 contains information compiled by the Agency in the course of carrying out its fiduciary duties to detect and prevent fraudulent activity against participant accounts. FRTIB has previously published a SORN for this system in the Federal Register, 84 FR 12249 (April 1, 2019), and a notice of proposed rulemaking for the exemptions, 84 FR 12954 (April 3, 2019). This notice of proposed rulemaking supersedes the previous notice. FRTIB's fraud and forgery records fall under the exemption stated within subsection (k)(2) of the Privacy Act because these records are compiled for law enforcement purposes. FRTIB proposes to exempt eligible records contained within FRTIB-13 from the requirements of subsections (c)(3); (d); (e)(1); (e)(4)(G), (H), (I); and (f), which require agencies to provide an accounting of disclosures; provide notification, access, and amendment rights, rules, and procedures; maintain only relevant and necessary information; and identify categories of record sources. Exempting records from this system is necessary and appropriate to maintain the integrity of FRTIB's investigations into allegations of fraud or forgery and to ensure that FRTIB's efforts to obtain accurate and objective information will be successful. To the extent that FRTIB uses investigatory material within this system of records as a basis for denying an individual any right, privilege, or benefit to which an individual would be entitled in the absence of that record, FRTIB will grant that individual access to the material except to the extent that access would reveal the identity of a source promised confidentiality.

The FRTIB is promulgating exemptions under subsection (k)(2) for FRTIB-14, Legal Case Files. FRTIB-14 contains information compiled by the Agency in the course of its duties to provide legal advice to FRTIB personnel and respond appropriately to claims and litigation. FRTIB has previously published a SORN for this system in the Federal Register, 85 FR 43654, 43666 (July 21, 2020). FRTIB's legal case files fall under the exemption stated within subsection (k)(2) of the Privacy Act because these records may be compiled for law enforcement purposes. FRTIB proposes to exempt eligible records contained within FRTIB-14 from the requirements of subsections (c)(3); (d); (e)(1); (e)(4)(G), (H), (I); and (f), which require agencies to provide an accounting of disclosures; provide notification, access, and amendment rights, rules, and procedures; maintain only relevant and necessary information; and identify categories of record sources. Exempting records from this system is necessary and appropriate to maintain the integrity of FRTIB's legal case files and to ensure that FRTIB's efforts to obtain accurate and objective information will be successful. To the extent that FRTIB uses investigatory material within this system of records as a basis for denying an individual any right, privilege, or benefit to which an individual would be entitled in the absence of that record, FRTIB will grant that individual access to the material except to the extent that access would reveal the identity of a source promised confidentiality.

The FRTIB is promulgating exemptions under subsection (k)(2) for FRTIB-15, Internal Investigations of Harassment and Hostile Work Environment Allegations. FRTIB-15 contains information compiled by the Agency in the course of upholding FRTIB's policy to provide for a work environment free from all forms of harassment. FRTIB has previously published a SORN for this system in the Federal Register, 85 FR 43654, 43669 (July 21, 2020). FRTIB's internal investigations and hostile work environment allegations files fall under the exemption stated within subsection (k)(2) of the Privacy Act because these records may be compiled for law enforcement purposes. FRTIB proposes to exempt eligible records contained within FRTIB-15 from the requirements of subsections (c)(3); (d); (e)(1); (e)(4)(G), (H), (I); and (f), which require agencies to provide an accounting of disclosures; provide notification, access, and amendment rights, rules, and procedures; maintain only relevant and necessary information; and identify categories of record sources. Exempting records from this system is necessary and appropriate to maintain the integrity of FRTIB's legal case files and to ensure that FRTIB's efforts to obtain accurate and objective information will be successful. To the extent that FRTIB uses investigatory material within this system of records as a basis for denying an individual any right, privilege, or benefit to which an individual would be entitled in the absence of that record, FRTIB will grant that individual access to the material except to the extent that access would reveal the identity of a source promised confidentiality.

The FRTIB is promulgating exemptions under subsection (k)(2) for FRTIB-23, Insider Threat Program Records. FRTIB-23 contains information compiled by the Agency in the course of performing insider threat program functions. The FRTIB has published a SORN for this system in the Federal Register, 86 FR 40564 (July 28, 2021). Insider threat program records fall under the exemption stated within subsection (k)(2) of the Privacy Act because these records are compiled for law enforcement purposes. FRTIB proposes to exempt eligible records contained within FRTIB-23 from the requirements of subsections (c)(3); (d); (e)(1); (e)(4)(G), (H), (I); and (f), which require agencies to provide an accounting of disclosures; provide notification, access, and amendment rights, rules, and procedures; maintain only relevant and necessary information; and identify categories of record sources. Exempting records from this system is necessary and appropriate to maintain the integrity of FRTIB's investigations into allegations of insider threats and to ensure that FRTIB's efforts to obtain accurate and objective information will be successful. To the extent that FRTIB uses investigatory material within this system of records as a basis for denying an individual any right, privilege, or benefit to which an individual would be entitled in the absence of that record, FRTIB will grant that individual access to the material except to the extent that access would reveal the identity of a source promised confidentiality.

These exemptions apply only to the extent that information in this system is subject to exemption pursuant to 5 U.S.C. 552a(k). Where FRTIB determines compliance would not appear to interfere with or adversely affect the purpose of this system to investigate and prevent insider threats, the applicable exemption may be waived by FRTIB in its sole discretion.

Exemptions from the particular subsections are necessary and appropriate, and justified for the following reasons:

• 5 U.S.C. 552a(c)(3) (the requirement to provide accountings of disclosures) and 5 U.S.C. 552a(d)(1)-(4) (requirements addressing notification, access, and amendment rights, collectively referred to herein as access requirements). Providing individuals with notification, access, and amendment rights with respect to allegations and investigations into personnel investigations, fraud against participant accounts, legal case files, internal investigations of harassment and hostile work environment allegations, or investigations of potential insider threats could reveal the existence of an investigation; investigative interest; investigative techniques; details about an investigation; security-sensitive information, such as information about security measures and security vulnerabilities; information that must remain non-public to protect personal privacy; identities of law enforcement personnel; or other sensitive or Privacy Act-protected information. Revealing such information to individuals could compromise or otherwise impede pending and future law enforcement investigations and efforts to protect sensitive information. Revealing such information could also violate personal privacy. Additionally, revealing this information could enable individuals to evade detection and apprehension by security and law enforcement personnel; destroy, conceal, or tamper with evidence or fabricate testimony; or harass, intimidate, harm, coerce, or retaliate against witnesses, complainants, investigators, security personnel, law enforcement personnel, or their family members, their employees, or other individuals. With respect to investigatory material compiled for law enforcement purposes, the exemption pursuant to 5 U.S.C. 552a(k)(2) from access requirements in subsection (d) of the Act is statutorily limited. If any individual is denied a right, privilege, or benefit to which the individual would otherwise be entitled by Federal law or for which the individual would otherwise be eligible, access will be granted, except to the extent that the disclosure would reveal the identity of a source who furnished the information to the Government under an express promise of confidentiality.
• 5 U.S.C. 552a(e)(1) (the requirement to maintain only relevant and necessary information authorized by statute or Executive Order). It will not always be possible to determine at the time information is received or compiled in these systems of records whether the information is or will be relevant and necessary to a law enforcement investigation. For example, a tip or lead that does not initially appear relevant or necessary may prove useful when combined with other information that reveals a pattern or that comes to light later.
• 5 U.S.C. 552a(e)(4)(G) and (H) (the requirements to describe procedures by which subjects may be notified of whether the system of records contains records about them and seek access or amendment of a record). These requirements concern individual access to records, and the records are exempt under subsections (c) and (d) of the Act, as described above. To the extent that subsection (e)(4)(G) and (H) are interpreted to require the Agency to promulgate more detailed procedures regarding record notification, access, or amendment than have been published in the Federal Register, exemption from those provisions is necessary for the same rationale as applies to subsections (c) and (d).
• 5 U.S.C. 552a(e)(4)(I) (the requirement to describe the categories of record sources). To the extent that this subsection is interpreted to require a more detailed description regarding the record sources in this system than has been published in the Federal Register, exemption from this provision is necessary to protect the sources of law enforcement and intelligence information and to protect the privacy and safety of witnesses and informants and others who provide information to FRTIB or as part of the Thrift Savings Plan (TSP). Further, because records used to complete personnel investigations, investigate and prosecute allegations of fraud and forgery against participant accounts, pursue legal claims, pursue internal investigations of harassment or hostile work environment allegations, or investigate and prosecute allegations of insider threats could come from any source, it is not possible to know every category in advance in order to list them all in FRTIB's accompanying SORN. Some record source categories may not be appropriate to make public in the SORN if, for example, revealing them could enable individuals to discover investigative techniques and devise ways to bypass them to evade detection and apprehension.
• 5 U.S.C. 552a(f) (the requirement to promulgate rules to implement provisions of the Privacy Act). To the extent that this subsection is interpreted to require agency rules addressing the aforementioned exempted requirements, exemption from this provision is also necessary to protect the sources of law enforcement and intelligence information and to protect the privacy and safety of witnesses and informants and others who provide information to FRTIB or as part of the TSP.

Regulatory Flexibility Act

FRTIB certifies that this proposed regulation will not have a significant economic impact on a substantial number of small entities under the Regulatory Flexibility Act (5 U.S.C. 601, et seq.). This rulemaking does not impose a requirement for small businesses to report or keep records on any of the requirements contained in this proposed rule. The exemptions to the Privacy Act apply to individuals, and individuals are not covered entities under the Regulatory Flexibility Act.

Paperwork Reduction Act

I certify that these proposed regulations do not require additional reporting under the criteria of the Paperwork Reduction Act.

Unfunded Mandates Reform Act of 1995

Pursuant to the Unfunded Mandates Reform Act of 1995, 2 U.S.C. 602, 632, 653, 1501 1571, the effects of this proposed regulation on state, local, and tribal governments and the private sector have been assessed. This proposed regulation will not compel the expenditure in any one year of $100 million or more by state, local, and tribal governments, in the aggregate, or by the private sector. Therefore, a statement under § 1532 is not required.

List of Subjects in 5 CFR Part 1630

• Privacy

Accordingly, FRTIB proposes to amend 5 CFR part 1630 as follows:

PART 1630—PRIVACY ACT REGULATIONS

1. The authority citation for part 1630 continues to read as follows:

Authority: 5 U.S.C. 552a.

2. Amend § 1630.15 by revising paragraph (b) to read as follows: