Reissuance of OMB Circular No. A-108, “Federal Agency Responsibilities for Review, Reporting, and Publication Under the Privacy Act”

AGENCY:

Office of Management and Budget, Executive Office of the President.

ACTION:

Notice of availability.

SUMMARY:

The Office of Management and Budget (OMB) has reissued OMB Circular A-108, “Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act.” The reissued Circular revises and relocates the guidance that previously had been included in Circular A-130, “Management of Federal Information Resources,” Appendix I, “Federal Agency Responsibilities for Maintaining Records About Individuals.” The reissued Circular replaces the November 28, 2000 version of Appendix I to Circular A-130 and supplements and clarifies existing OMB guidance.

DATES:

Effective upon publication as of December 23, 2016, OMB is making reissued Circular A-108 available to the public at https://www.whitehouse.gov/omb/inforeg_infopoltech.

FOR FURTHER INFORMATION CONTACT:

Kevin Herms, Office of Management and Budget, Office of Information and Regulatory Affairs, at privacy-oira@omb.eop.gov

SUPPLEMENTARY INFORMATION:

Background

The Privacy Act of 1974, which has been in effect since September 27, 1975, sets forth a series of requirements governing Federal agency practices with respect to certain information about individuals. Although the Privacy Act places principal responsibility for compliance on agencies, the statute requires the Director of OMB to develop guidelines and provide continuing assistance to and oversight of implementation by agencies. See 5 U.S.C. 552a(v). The reissuance of Circular A-108 describes agency responsibilities for implementing the review, reporting, and publication requirements of the Privacy Act of 1974 and related OMB policies. It supplements and clarifies existing OMB guidance, including OMB Circular No. A-130, “Managing Information as a Strategic Resource,” “Privacy Act Implementation: Guidelines and Responsibilities,” “Implementation of the Privacy Act of 1974: Supplementary Guidance,” and “Final Guidance Interpreting the Provisions of Public Law 100-503, the Computer Matching and Privacy Protection Act of 1988.” All OMB guidance is available on the OMB Web site at https://www.whitehouse.gov/omb/inforeg_infopoltech.

Comments

On October 7, 2016, OMB requested public comment (81 FR 69871) and posted the proposed Circular A-108 on its Web site. Although some commenters were critical of specific aspects of the proposed policy, the commenters were generally supportive of the overall Circular and the approaches taken.

While OMB carefully considered all of the comments submitted, some of them were beyond the scope of the Circular. Several of the comments criticized agency compliance with Privacy Act legal and policy requirements, while others appeared to be inconsistent with certain statutory provisions or other OMB policy requirements, or would have the effect of modifying certain statutory provisions or prohibiting certain legally permissible agency actions. The reissuance of Circular A-108 and the supplementary guidance and clarification it provides are intended to assist agencies in their implementation of, and facilitate their compliance with, the Privacy Act's review, reporting, and publication requirements. The Circular is meant to establish general standards and it would be beyond the scope of the Circular to address specific agency practices or compliance efforts or to accept comments that may be inconsistent with other legal or policy requirements.

Several comments identified areas in which the guidance could be modified to improve the quality of notice provided to the public in agency system of records notices. Based on OMB's consideration and responses to the public comments, the revised Circular A-108:

• Revises the routine use section of the guidance to state that agency routine uses that only apply to certain records in a system of records should indicate their limited scope. In addition, a subheading in the section of the Circular describing the scope of a system of records was revised to better emphasize the need to consider routine uses when determining the scope of a system.
• Requires that the description of linkages between different systems be in the “Policies and Practices for Retrieval of Records” section of the notice, which is included in the Privacy Act Issuances. In addition, the language describing the requirement to describe linkages between different systems was clarified so that agencies better understand the requirement and public notice will be improved.
• Includes a “History” section in the system of records notice templates for agencies to provide citations to the last full Federal Register notice, as well as any subsequent notices of revision. This will improve transparency and assist the public in learning about systems of records as they are established and revised over time.