[Federal Register Volume 75, Number 181 (Monday, September 20, 2010)]
[Rules and Regulations]
[Pages 57163-57167]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2010-23320]


=======================================================================
-----------------------------------------------------------------------

OFFICE OF THE DIRECTOR OF NATIONAL INTELLIGENCE

32 CFR Part 1701


Privacy Act Systems of Records

AGENCY: Office of the Director of National Intelligence.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Office of the Director of National Intelligence (ODNI) is 
issuing a final rule exempting fourteen (14) new systems of records 
from subsections (c)(3); (d)(1), (2), (3), (4); (e)(1) and (e)(4)(G), 
(H), (I); and (f) of the Privacy Act, pursuant to 5 U.S.C. 552a(k). The 
ODNI published a notice and a proposed rule implementing these 
exemptions on April 2, 2010. The enumerated exemptions will be invoked 
on a case-by-case basis, as necessary to preclude interference with 
investigatory, intelligence and counterterrorism functions and 
responsibilities of the ODNI. This document addresses comments received 
regarding the proposed rule as applied to the fourteen new systems of 
records.

DATES: This final rule is effective September 20, 2010.

FOR FURTHER INFORMATION CONTACT: Mr. John F. Hackett, Director, 
Information Management, 703-275-2215.

SUPPLEMENTARY INFORMATION:

Background

    On April 2, 2010, the Office of the Director of National 
Intelligence (ODNI) published notice of fourteen new Privacy Act 
systems of records: Manuscript, Presentation and Resume Review Records 
(ODNI-01), Executive Secretary Action Management System Records (ODNI-
02), Public Affairs Office Records (ODNI-03), Office of Legislative 
Affairs Records (ODNI-04), ODNI Guest Speaker Records (ODNI-05), Office 
of General Counsel Records (ODNI-06), Analytic Resources Catalog (ODNI-
07), Intelligence Community Customer Registry Records, (ODNI-09), EEO 
and Diversity Office Records (ODNI-10), Office of Protocol Records 
(ODNI-11), IC Security Clearance and Access Approval Repository (ODNI-
12), Security Clearance Reform Research Records (ODNI-13), Civil 
Liberties and Privacy Office Complaint Records (ODNI-14), National 
Intelligence Council Consultation Records (ODNI-15). These systems of 
records contain records that range from Unclassified to Top Secret. 
Accordingly, in conjunction with publication of these systems notices, 
the ODNI initiated a rulemaking to exempt the systems, in relevant 
part, from various provisions of the Privacy

[[Page 57164]]

Act (enumerated above), pursuant to exemption authority afforded the 
head of the agency by subsection (j) of the Privacy Act. The systems 
notices and proposed exemption rule are published at 75 FR 16853 and 
16698.

Public Comments

    The ODNI received comments on its proposed rule and notice of 
fourteen systems of records from the Electronic Privacy Information 
Center (EPIC). EPIC's concerns and ODNI's responses are set forth 
below. The full text of EPIC's comments are posted at that 
organization's Web site, http://www.EPIC.org. In general, EPIC 
questions the appropriateness of the ODNI's proposal on national 
security grounds to exempt these systems of records from various 
provisions of the Privacy Act that embody fundamental tenets of 
information privacy.
    In light of EPIC's comments, the ODNI re-examined the systems 
notices, the nature of the records maintained, and the exemptions 
proposed. ODNI is sensitive to EPIC's view that the fourteen new system 
notices on their face do not obviously implicate intelligence equities, 
including the counterterrorism mission of one of ODNI's major 
components, the National Counterterrorism Center (NCTC). However we 
conclude that EPIC has not considered the possible inclusion of 
classified records in these systems, which the exemptions invoked are 
intended to protect.
    ODNI has determined that the comments received do not warrant 
changing the proposed exemptions or systems notices prior to 
implementation. Read in conjunction with the ODNI's Exemption Policies, 
as set forth in section 1701.20 of the ODNI's Privacy Act Regulations, 
published at 32 CFR part 1701, the fourteen new systems notices reflect 
that ODNI seeks to serve, whenever feasible, the dual imperatives of 
maximizing individual record subjects' participation in maintenance of 
the records and of protecting important intelligence equities.

Detailed Response

    EPIC's comments reflect concern about ODNI's action to exempt the 
new systems of records from the accounting, access, amendment, redress 
and accuracy provisions of the Privacy Act, as well as from the 
requirements to establish and make public the procedures by which 
individuals may seek access to records about themselves. EPIC observes 
that the referenced provisions of the Privacy Act fulfill the important 
objective of promoting accountability, responsibility, oversight and 
openness with respect to the federal government's maintenance of 
personal information. The ODNI also supports fair information 
principles and, as a matter of published policy, honors these 
principles to the full extent circumstances permit.
    ODNI maintains that its proposed rule is consistent with privacy 
principles for the following reasons:
    1. ODNI policy is to apply exemptions narrowly.
    EPIC's main concern is that ODNI will rely on the stated exemptions 
to exempt apparently non-sensitive records on a blanket basis, thus 
denying record subjects important provisions of the Privacy Act.
    On initial review, and as confirmed on re-examination, we have 
determined that these systems of records may contain sensitive records. 
Therefore, in practice, claiming the exemption is a prophylactic 
measure enabling the ODNI to protect intelligence equities (e.g., 
sources, methods, subjects of intelligence interest) when national 
security considerations dictate. However, record subjects will still be 
able to obtain access to non-sensitive records. Each published system 
notice expansively describes notification procedures, record access 
procedures, contesting record procedures and record source categories. 
In addition, each systems notice references the ODNI Privacy Act 
Regulation, which also fully describes these procedures. 32 CFR Part 
1701.
    Published ODNI policy on exercising exemptions provides that an 
asserted exemption applies only to records that meet the exemption 
criteria, and that, even then, discretion is retained to supersede the 
exemption where complying with a request for access would not interfere 
with or adversely affect a counterterrorism or law enforcement 
interest, or otherwise violate applicable law.\1\
---------------------------------------------------------------------------

    \1\ See Sec.  1701.20 of ODNI's Privacy Act Regulation (32 CFR).
    Additionally, in its Notice to Establish Systems of Records (75 
FR 16853, April 2, 2010), ODNI indicated in the Supplementary 
Information section of the Notice that it would apply the exemption 
only as specifically necessary, and not as a blanket exclusion: ``To 
protect classified and sensitive personnel or law enforcement 
information contained in these systems, the Director of National 
Intelligence is proposing to exempt these systems of records from 
certain portions of the Privacy Act where necessary, as permitted by 
law.''
---------------------------------------------------------------------------

    The ODNI Office of Information Management (IM) conducts access/
disclosure reviews under the Privacy Act and the Freedom of Information 
Act, as well as pre-publication review pursuant to IC elements' secrecy 
agreements. IM personnel are trained classification specialists who 
conduct detailed reviews to ensure record subject/requester access to 
information in accordance with this policy and fair information 
principles, to include an accounting of disclosures under subsection 
(c)(3).
    The systems notices, read in conjunction with the Privacy Act 
regulation, show that ODNI intends to provide record subjects access to 
records about them to the extent feasible on a case-by-case basis, and 
not to rely on a blanket assertion of an exemption to preclude access.
    2. Material may be classified for national security reasons 
pursuant to Executive Order.
    As noted, the fourteen new system notices potentially include 
records specifically authorized under criteria established by an 
Executive order to be kept secret in the interest of national defense 
or foreign policy or that are in fact properly classified pursuant to 
such Executive order. Such records are exempt from the operation of 
Section 552 of Title 5 of the United States Code, see 5 U.S.C. 
552(b)(1), and subsection (k)(1) of the Privacy Act specifically 
contemplates exemption under this circumstance.
    EPIC cites the Public Affairs Office Records, the Executive 
Secretary Action Management System Records and the Civil Liberties and 
Privacy Office Complaint Records as examples of ODNI's excessive use of 
exemption authority. Our review has determined that each of these 
systems of records, as well as the other eleven, could contain 
classified records retrieved by a record subject's name or unique 
identifier.
    The exemption permits ODNI to protect access to the classified 
material and thereby prevent compromise of sensitive national security-
related information. ODNI policy would be to provide the record subject 
access to the entirety of non-classified records (subject to the 
``mosaic'' analysis),\2\ as well as to portions of classified records 
that, upon line-by-line review, have been determined not to implicate 
national security interests.
---------------------------------------------------------------------------

    \2\ Non-classified data points that, taken together, create a 
mosaic disclosing a matter properly classifiable under an Executive 
Order would be withheld from access.
---------------------------------------------------------------------------

    3. No per se exclusion from redress.
    EPIC comments that ODNI inappropriately seeks to bar record 
subjects from challenging denial of an access request. The Privacy Act, 
subsection (g)(1)(B), does not permit agencies to exempt themselves 
from access challenges; ODNI agrees that

[[Page 57165]]

precluding individuals from challenging the basis of a denial to a 
request for access to information would violate information fairness 
principles. Subsection (g)(3)(A) of the Privacy Act provides for de 
novo review of such denial, including in camera examination of records 
to ensure consistency with the claimed basis for exemption from access, 
i.e., that the records reflect a national security interest subject to 
classification under Executive order, or that access would disclose to 
the subject the identity of a confidential source of information in the 
record (judgments contemplated by subsections (k)(1), (2) and (5) of 
the Act). ODNI does not seek to deny record subjects the basic right to 
challenge access determinations.
    However, EPIC's position that ODNI should afford redress for all 
amendment denials demands the impractical result of requiring the 
agency to permit ``correction'' of records to which it properly has 
denied the subject access based on expert judgments regarding national 
security or witness/source identification. This practice would afford 
individuals ``back-door'' access to records via amendment challenges. 
Accordingly, ODNI will narrowly construe the proposed exemption from 
redress to apply only to denials to amend exempt records (i.e., records 
that are classified, or determined to be not disclosable under other 
provisions of subsection (k)).
    4. ODNI does not use these systems of records for decision-making 
about record subjects.
    EPIC articulates a concern that subjects' inability to access and 
amend exempt records undermines the fundamental principle (under 
subsection (e)(5) of the Privacy Act) that records used in making 
agency determinations about record subjects must be sufficiently 
accurate, relevant, timely and complete to ensure fairness to the 
individual.
    ODNI does not in fact propose to exempt its fourteen new SORNs from 
the (e)(5) requirement. Indeed, subsection (k) of the Privacy Act does 
not permit exemption from subsection (e)(5).\3\ Additionally, records 
maintained in these systems are not used in personalized agency 
determinations of the kind for which access and amendment rights are 
intended to ensure data accuracy and relevance. With the possible 
exception of the Civil Liberties and Privacy Office Complaint Records, 
the Equal Employment Opportunity and Diversity Office Records and the 
Office of General Counsel records, the recently published notices 
reflect agency internal administrative functions, but not activities 
``affecting the rights, benefits, entitlements or opportunities 
(including employment) of the individual).'' \4\ By and large, the 
systems at issue permit the agency to track communications and external 
relations using the record subjects' name as an easy ``handle.'' They 
are record-keeping files, not decision-making files. Where claims are 
involved (civil liberties/privacy, disability accommodations, or 
actions against the agency), it is the record subject who determines 
what facts to report in the first instance, obviating his/her need for 
a check on accuracy. Nonetheless, the claimant/litigant would receive 
all official administrative or court filings, and obtain access to 
other non-exempt records in the pertinent system.
---------------------------------------------------------------------------

    \3\ Subsection (k) states that the head of any agency may 
promulgate rules to exempt any system of records with the agency 
from subsection (c)(3). (d). (e)(1), (e)(4)(G)(H), and (I) and (f) 
of that section.
    \4\ Office of Management and Budget, Privacy Act Implementation, 
Guidelines and Responsibilities, Standards of Accuracy, Subsection 
(e)(5), 40 FR 28948, 28964 (July 9, 1975).
---------------------------------------------------------------------------

    5. ``Necessary and relevant'' is a fluid standard, properly subject 
to exemption.
    The provision from which ODNI does seek exemption is (e)(1): 
``Maintain [in agency] records only such information about an 
individual as is relevant and necessary to accomplish a purpose of the 
agency required to be accomplished by statute or by executive order of 
the President.'' The purposes which these systems serve are authorized 
by the National Security Act of 1947 as amended by the Intelligence 
Reform and Terrorism Prevention Act of 2004, and generally reflect 
routine agency functions. Because of the transactional nature of most 
of these systems, relevance is a function of happenstance, i.e., 
whatever communication is received or transmitted, and can not be 
determined once and for all time. The information collected will not 
likely be the same for every individual who is the subject of a record 
in the system. With respect to claims requiring investigation (e.g., 
Civil Liberties/Privacy complaints) relevance often can not be 
determined until all materials have been collected and analyzed. 
Moreover, because these systems of records generally are house-keeping-
type files, and not likely to be disclosed outside the agency or serve 
for decision-making purposes, the importance of ``relevance'' as a data 
quality criterion is diminished.
    6. Exemptions do not curtail subjects' access to complaint status 
or disposition.
    EPIC is especially troubled by ODNI's proposal to exempt the Civil 
Liberties and Privacy Office Complaint Records (alleging violations of 
civil liberties or privacy arising from an ODNI or IC program or 
activity), and argues that:

    [A]n individual who submitted a complaint would not be able to 
view any records pertaining to his complaint, such as records of 
review, investigation, or acknowledgement or disposition of 
allegations received. A complainant would be left without any means 
to inquire about the status of his complaint or to help facilitate 
the resolution of his complaint.

    EPIC posits that, by virtue merely of their being maintained in the 
exempt system, all records would be shielded from the subject's access, 
including the agency's acknowledgment of receipt of the complaint and 
any disposition of the complaint. However, complainants routinely 
receive acknowledgement of receipt of their complaints, a copy of which 
is maintained as part of the complainants' official records in the 
noticed Privacy Act system of records. Similarly, complainants receive 
notice of resolution or disposition of their cases, with as much 
specificity as is feasible under the circumstances. The Civil Liberties 
and Privacy Office articulates in writing why the allegation is, or is 
not, sustained by the facts as presented by the complainant and as 
investigated by the agency, and what the ODNI's follow-on action may be 
(for example, remedying a flaw or gap in agency process that the 
complaint has brought to light). The written disposition is also 
maintained as part of the official record in the noticed Privacy Act 
system of records. ODNI would provide access to these acknowledgement 
and disposition records at the complainant's request. The complainant 
would obtain access to other portions of the complaint file as well, to 
the extent they do not implicate national security interests, and do 
not reveal the identity of individuals providing statements or 
information to the investigation pursuant to assurances of 
confidentiality.
    ODNI believes that current policies address EPIC's concern that 
``the complainant is left without any means to inquire about the status 
of his complaint.'' Complainants may at any time amend their 
statements, provide additional facts or seek explanation about the 
operative law, regulation or policy allegedly violated. Indeed, the 
exemption framework does not preclude a complainant from inquiring 
about, or learning of, the status of his complaint. Nor does it 
preclude the ODNI from seeking additional input from claimants.

[[Page 57166]]

Final Rule: Implementation of Exemption Rule and Systems Notices

    After consideration of the public comments, the ODNI has determined 
to issue the proposed exemption rule in final form and to implement the 
fourteen new systems of records without change. The exemptions proposed 
for the fourteen noticed systems of records are necessary and 
appropriate to protect intelligence equities undergirding ODNI's 
mission and functions and narrowly applied, they do so consistent with 
privacy principles. By restrictively construing the exemptions to apply 
only to records that satisfy thresholds articulated in subsection (k), 
ODNI achieves the goal of balancing intelligence-related equities with 
fair information principles and values.

Regulatory Flexibility Act

    This rule affects only the manner in which ODNI collects and 
maintains information about individuals. ODNI certifies that this 
rulemaking does not impact small entities and that analysis under the 
Regulatory flexibility Act, 5 U.S.C. 601-612, is not required.

Small Entity Inquiries

    The Small Business Regulatory enforcement Fairness Act (SBREFA) of 
1996 requires the ODNI to comply with small entity requests for 
information and advice about compliance with statutes and regulations 
within the ODNI jurisdiction. Any small entity that has a question 
regarding this document may address it to the information contact 
listed above. Further information regarding SBREFA is available on the 
Small Business Administration's web page at http://www.sba.gov/advo/laws/law-lib.html.

Paperwork Reduction Act

    The Paperwork Reduction Act of 1995 944 U.S.C. 3507(d)) requires 
that the ODNI consider the impact of paperwork and other burdens 
imposed on the public associated with the collection of information. 
There are no information collection requirements associated with this 
rule and therefore no analysis of burden is required.

Executive Order 12866, Regulatory Planning and Review

    This rule is not a ``significant regulatory action,'' within the 
meaning of Executive Order 12866. This rule will not adversely affect 
the economy or a sector of the economy in a material way; will not 
create inconsistency with or interfere with other agency action; will 
not materially alter the budgetary impact of entitlements, grants, fees 
or loans or the right and obligations of recipients thereof; or raise 
legal or policy issues arising out of legal mandates, the President's 
priorities or the principles set forth in the Executive Order. 
Accordingly, further regulatory evaluation is not required.

Unfunded Mandates

    Title II of the Unfunded Mandates Reform Act of 1995 (UMRA), Public 
Law 104-4, 109 Stat. 48 (Mar. 22, 1995), requires Federal agencies to 
assess the effects of certain regulatory actions on State, local and 
tribal governments, and the private sector. This rule imposes no 
Federal mandate on any State, local or tribal government or on the 
private sector. Accordingly, no UMRA analysis of economic and 
regulatory alternatives is required.

Executive Order 13132, Federalism

    Executive Order 13132 requires agencies to examine the implications 
for the distribution of power and responsibilities among the various 
levels of government resulting from their rules. ODNI concludes that 
this rule does not affect the rights, roles and responsibilities of the 
States, involves no preemption of State law and does not limit state 
policymaking discretion. This rule has no federalism implications as 
defined by the Executive Order.

Environmental Impact

    This rulemaking will not have a significant effect on the human 
environment under the provisions of the National Environmental Policy 
Act of 1969 (NEPA), 42 U.S.C. 4321-4347.

Energy Impact

    This rulemaking is not a major regulatory action under the 
provisions of the Energy Policy and Conservation Act (EPCA), Public Law 
94-163) as amended, 42 U.S.C. 6362.

List of Subjects in 32 CFR Part 1701

    Records and Privacy Act.

0
For the reasons set forth above, ODNI amends 32 CFR part 1701 as 
follows:

PART 1701--ADMINISTRATION OF RECORDS UNDER THE PRIVACY ACT OF 1974

0
1. The authority citation for part 1701 continues to read as follows:

    Authority: 50 U.S.C. 401-442; 5 U.S.C. 552a.

Subpart B--[AMENDED]

0
2. Add Sec.  1701.24 to subpart B to read as follows:


Sec.  1701.24  Exemption of Office of the Director of National 
Intelligence (ODNI) systems of records.

    (a) The ODNI exempts the following systems of records from the 
requirements of subsections (c)(3); (d)(1),(2),(3) and (4); (e)(1); 
(e)(4)(G),(H),(I); and (f) of the Privacy Act to the extent that 
information in the system is subject to exemption pursuant subsections 
(k)(1), (k)(2) or (k)(5) of the Act as noted in the individual systems 
notices:
    (1) Manuscript, Presentation and Resume Review Records (ODNI-01).
    (2) Executive Secretary Action Management System Records (ODNI-02).
    (3) Public Affairs Office Records (ODNI-03).
    (4) Office of Legislative Affairs Records (ODNI-04).
    (5) ODNI Guest Speaker Records (ODNI-05).
    (6) Office of General Counsel Records (ODNI-06).
    (7) Analytic Resources Catalog (ODNI-07).
    (8) Intelligence Community Customer Registry (ODNI-09).
    (9) EEO and Diversity Office Records (ODNI-10).
    (10) Office of Protocol Records (ODNI-11).
    (11) IC Security Clearance and Access Approval Repository (ODNI-
12).
    (12) Security Clearance Reform Research Records (ODNI-13).
    (13) Civil Liberties and Privacy Office Complaint Records (ODNI-
14).
    (14) National Intelligence Council Records (ODNI-15).
    (b) Exemption of records in theses systems from any or all of the 
enumerated requirements may be necessary for the following reasons:
    (1) From subsection (c)(3) (accounting of disclosures) because an 
accounting of disclosures from records concerning the record subject 
would specifically reveal an intelligence or investigative interest on 
the part of the ODNI or recipient agency and could result in release of 
properly classified national security or foreign policy information.
    (2) From subsections (d)(1), (2), (3) and (4) (record subject's 
right to access and amend records) because affording access and 
amendment rights could alert the record subject to the investigative 
interest of intelligence or law enforcement agencies or compromise 
sensitive information classified in the interest of national security. 
In the absence of a national security basis for exemption, records in 
this system may be exempted from access and amendment to the extent 
necessary to honor promises of

[[Page 57167]]

confidentiality to persons providing information concerning a candidate 
for position. Inability to maintain such confidentiality would restrict 
the free flow of information vital to a determination of a candidate's 
qualifications and suitability.
    (3) From subsection (e)(1) (maintain only relevant and necessary 
records) because it is not always possible to establish relevance and 
necessity before all information is considered and evaluated in 
relation to an intelligence concern. In the absence of a national 
security basis for exemption under subsection (k)(1), records in this 
system may be exempted from the relevance requirement pursuant to 
subsection (k)(5) because it is not possible to determine in advance 
what exact information may assist in determining the qualifications and 
suitability of a candidate for position. Seemingly irrelevant details, 
when combined with other data, can provide a useful composite for 
determining whether a candidate should be appointed.
    (4) From subsections (e)(4)(G) and (H) (publication of procedures 
for notifying subjects of the existence of records about them and how 
they may access records and contest contents) because the system is 
exempted from subsection (d) provisions regarding access and amendment, 
and from the subsection (f) requirement to promulgate agency rules. 
Nevertheless, the ODNI has published notice concerning notification, 
access, and contest procedures because it may in certain circumstances 
determine it appropriate to provide subjects access to all or a portion 
of the records about them in a system of records.
    (5) From subsection (e)(4)(I) (identifying sources of records in 
the system of records) because identifying sources could result in 
disclosure of properly classified national defense or foreign policy 
information, intelligence sources and methods, and investigatory 
techniques and procedures. Notwithstanding its proposed exemption from 
this requirement, ODNI identifies record sources in broad categories 
sufficient to provide general notice of the origins of the information 
it maintains in its systems of records.
    (6) From subsection (f) (agency rules for notifying subjects to the 
existence of records about them, for accessing and amending records, 
and for assessing fees) because the system is exempt from subsection 
(d) provisions regarding access and amendment of records by record 
subjects. Nevertheless, the ODNI has published agency rules concerning 
notification of a subject in response to his request if any system of 
records named by the subject contains a record pertaining to him and 
procedures by which the subject may access or amend the records. 
Notwithstanding exemption, the ODNI may determine it appropriate to 
satisfy a record subject's access request.

    Dated: September 10, 2010.
John F. Kimmons,
Lieutenant General, USA, Director of the Intelligence Staff.
[FR Doc. 2010-23320 Filed 9-17-10; 8:45 am]
BILLING CODE P