[Federal Register Volume 84, Number 126 (Monday, July 1, 2019)]
[Rules and Regulations]
[Pages 31194-31197]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-12987]


=======================================================================
-----------------------------------------------------------------------

OFFICE OF THE DIRECTOR OF NATIONAL INTELLIGENCE

32 CFR Part 1701


Privacy Act of 1974: System of Records

AGENCY: Office of the Director of National Intelligence.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Office of the Director of National Intelligence (ODNI) 
exempts a new system of records (Continuous Evaluation System) from the 
requirements of the Privacy Act to the extent that information in the 
system is subject to the Privacy Act's exemption provisions. The ODNI 
also adds a new

[[Page 31195]]

section which restores and updates a list of all ODNI systems of 
records that are subject to Privacy Act exemption.

DATES: This rule is effective July 1, 2019.

FOR FURTHER INFORMATION CONTACT: Ms. Patricia Gaviria, Director, 
Information Management Division, (301-243-1054).

SUPPLEMENTARY INFORMATION: In compliance with the Privacy Act, 5 U.S.C. 
552a(e)(4), ODNI has already described in the notice section of the 
Federal Register (83 FR 61395, document 18-25970), published on 
November 29, 2018, the following new system of records: Continuous 
Evaluation System (ODNI/NCSC-003). This new system of records 
facilitates implementation of the National Counterintelligence and 
Security Center (NCSC) Continuous Evaluation system, which conducts 
ongoing automated checks of security-relevant databases to ensure that 
individuals who have been determined to be eligible for access to 
classified information or to hold a sensitive position remain eligible, 
as required by Executive Orders 12968 as amended (Access to Classified 
Information), and 13467 as amended (Reforming Processes Related to 
Suitability for Government Employment, Fitness for Contractor 
Employees, and Eligibility for Access to Classified National Security 
Information). The system of records will contain biographic and 
personnel security-relevant records pertaining to current Executive 
Branch employees, detailees, contractors, and other sponsored 
individuals (enrollees).
    In its final rule, the ODNI exempts the above new system of 
records, Continuous Evaluation System (ODNI/NCSC-003), from certain 
provisions of the Privacy Act to prevent the compromise of classified 
information and to ensure the integrity of any law enforcement, 
counterintelligence, or administrative investigation that may be 
undertaken with respect to the subject of the record.
    In addition, this ODNI final rule restores and updates the list of 
ODNI exempt systems of records at 32 CFR 1701.22, as redesignated. The 
original list had been deleted by final action published at 80 FR 63427 
(October 20, 2015). The restored list reflects the updated break-down 
of exempt systems of records by ODNI component.

Regulatory Flexibility Act

    This final rule affects the manner in which ODNI collects and 
maintains information about individuals. ODNI certifies that this 
rulemaking does not have a significant economic impact on a substantial 
number of small entities. Accordingly, pursuant to the Regulatory 
Flexibility Act, 5 U.S.C. 601-612, no regulatory flexibility analysis 
is required for this rule.

Small Entity Inquiries

    The Small Business Regulatory Enforcement Fairness Act (SBREFA) of 
1996 requires ODNI to comply with small entity requests for information 
and advice about compliance with statutes and regulations within ODNI 
jurisdiction. Any small entity that has a question regarding this 
document may address it to the information contact listed above. 
Further information regarding SBREFA is available on the Small Business 
Administration's web page at http://www.sga.gov/advo/law/law_lib.html.

Paperwork Reduction Act

    The Paperwork Reduction Act of 1995 (44 U.S.C. 3507(d)) requires 
that ODNI consider the impact of paperwork and other burdens imposed on 
the public associated with the collection of information. There are no 
information collection requirements associated with this final rule and 
therefore no analysis of burden is required.

Executive Order 12866, Regulatory Planning and Review

    This final rule is not a ``significant regulatory action'' within 
the meaning of Executive Order 12866. This rule does not have an annual 
effect on the economy of $100 million or more or otherwise adversely 
affect the economy or sector of the economy in a material way; does not 
create inconsistency with, or interfere with, other agency action; does 
not materially alter the budgetary impact of entitlements, grants, 
fees, or loans or the rights and obligations of recipients thereof; and 
does not raise legal or policy issues arising out of legal mandates, 
the President's priorities or the principles set forth in the Executive 
Order. Accordingly, further regulatory evaluation is not required.

Unfunded Mandates

    Title II of the Unfunded Mandates Reform Act of 1995 (UMRA), Public 
Law 104-4, 109 Stat. 48 (Mar. 22, 1995), requires Federal agencies to 
assess the effects of certain regulatory actions on State, local, and 
tribal governments, and the private sector. This final rule imposes no 
Federal mandate on any State, local, or tribal government or on the 
private sector. Accordingly, no UMRA analysis of economic and 
regulatory alternatives is required.

Executive Order 13132, Federalism

    Executive Order 13132 requires ODNI to examine the implications for 
the distribution of power and responsibilities among the various levels 
of government resulting from this final rule. ODNI concludes that the 
final rule does not affect the rights, roles and responsibilities of 
the States, involves no preemption of State law, and does not limit 
State policymaking discretion. This rule has no federalism implications 
as defined by the Executive Order.

Environmental Impact

    ODNI has reviewed this action for purposes of the National 
Environmental Policy Act of 1969 (NEPA), 42 U.S.C. 4321-4347, and has 
determined that this action does not have a significant effect on the 
human environment.

Energy Impact

    The energy impact of this action has been assessed in accordance 
with the Energy Policy and Conservation Act (EPCA), Public Law 94-163, 
as amended, 42 U.S.C. 6362. This rulemaking is not a major regulatory 
action under the provisions of the EPCA.

List of Subjects in 32 CFR Part 1701

    Privacy Act, Records.

    For the reasons set forth above, ODNI amends 32 CFR part 1701 as 
follows:

PART 1701--ADMINISTRATION OF RECORDS UNDER THE PRIVACY ACT OF 1974

0
1. The authority citation for part 1701 continues to read as follows:

    Authority:  50 U.S.C. 3002-3231; 5 U.S.C. 552a.

Subpart B--Exemption of Record Systems Under the Privacy Act


Sec. Sec.  1701.21, 1701.22, and 1701.23   [Removed]

0
2. Remove Sec. Sec.  1701.21 through 1701.23.


Sec.  1701.24  [Redesignated as Sec.  1701.21]

0
3. Redesignate Sec.  1701.24 as Sec.  1701.21 and revise newly 
redesignated Sec.  1701.21 to read as follows:


Sec.  1701.21  Exemption of the Office of the Director of National 
Intelligence (ODNI) systems of records.

    (a) ODNI exempts the systems of records listed in Sec.  1701.22 
from the requirements of paragraphs (c)(3); (d)(1), (2), (3) and (4); 
(e)(1) and (e)(4)(G), (H), and (I); and (f) of the Privacy Act (5 
U.S.C. 552a) to the extent that information in the system is subject to

[[Page 31196]]

exemption pursuant to paragraph (k)(1), (k)(2), or (k)(5) of the Act as 
noted in Sec.  1701.22. ODNI also derivatively preserves the exempt 
status of records it receives from source agencies when the reason for 
the exemption remains valid, as set forth in Sec.  1701.20.
    (b) Systems of records utilized by the Office of the Intelligence 
Community Inspector General (ICIG) are additionally exempted from the 
requirements of paragraphs (c)(4); (e)(2); (e)(3); (e)(5); (e)(8); 
(e)(12); and (g) of the Privacy Act (5 U.S.C. 552a) to the extent that 
information in the system is subject to exemption pursuant to paragraph 
(j)(2) of the Privacy Act (5 U.S.C. 552a).
    (c) Exemption of records in these systems from any or all of the 
enumerated requirements may be necessary for the following reasons:
    (1) From paragraph (c)(3) of the Privacy Act (5 U.S.C. 552a) 
(accounting of disclosures) because an accounting of disclosures from 
records concerning the record subject would specifically reveal an 
intelligence or investigative interest on the part of ODNI or the 
recipient agency and could result in release of properly classified 
national security or foreign policy information.
    (2) From paragraph (c)(4) of the Privacy Act (5 U.S.C. 552a) 
(notice of amendment to record recipients) because the system is 
exempted from the access and amendment provisions of paragraph (d) of 
the Privacy Act.
    (3) From paragraphs (d)(1) through (4) of the Privacy Act (5 U.S.C. 
552a) (record subject's right to access and amend records) because 
affording access and amendment rights could alert the record subject to 
the investigative interest of intelligence or law enforcement agencies 
or compromise sensitive information classified in the interest of 
national security. In the absence of a national security basis for 
exemption, records in this system may be exempted from access and 
amendment to the extent necessary to honor promises of confidentiality 
to persons providing information concerning a candidate for position. 
Inability to maintain such confidentiality would restrict the free flow 
of information vital to a determination of a candidate's qualifications 
and suitability.
    (4) From paragraph (e)(1) of the Privacy Act (5 U.S.C. 552a) 
(maintain only relevant and necessary records) because it is not always 
possible to establish relevance and necessity before all information is 
considered and evaluated in relation to an intelligence concern. In the 
absence of a national security basis for exemption under paragraph 
(k)(1) of the Privacy Act (5 U.S.C. 552a), records in this system may 
be exempted from the relevance requirement pursuant to paragraphs 
(k)(2) and (5) of the Privacy Act (5 U.S.C. 552a) because it is not 
possible to determine in advance what exact information may assist in 
determining the qualifications and suitability of a candidate for 
position. Seemingly irrelevant details, when combined with other data, 
can provide a useful composite for determining whether a candidate 
should be appointed.
    (5) From paragraph (e)(2) of the Privacy Act (5 U.S.C. 552a) 
(collection directly from the individual) because application of this 
provision would alert the subject of a counterterrorism investigation, 
study, or analysis to that fact, permitting the subject to frustrate or 
impede the activity. Counterterrorism investigations necessarily rely 
on information obtained from third parties rather than information 
furnished by subjects themselves.
    (6) From paragraph (e)(3) of the Privacy Act (5 U.S.C. 552a) 
(provide Privacy Act Statement to subjects furnishing information) 
because the system is exempted from requirements in paragraph (e)(2) of 
the Privacy Act to collect information directly from the subject.
    (7) From paragraphs (e)(4)(G) and (H) of the Privacy Act (5 U.S.C. 
552a) (publication of procedures for notifying subjects of the 
existence of records about them and how they may access records and 
contest contents) because the system is exempted from provisions in 
paragraph (d) of the Privacy Act (5 U.S.C. 552a) regarding access and 
amendment, and from the requirement in paragraph (f) of the Privacy Act 
to promulgate agency rules for notification, access, and amendment. 
Nevertheless, ODNI has published notice concerning notification, 
access, and contest procedures because it may in certain circumstances 
determine it appropriate to provide subjects access to all or a portion 
of the records about them in a system of records.
    (8) From paragraph (e)(4)(I) of the Privacy Act (5 U.S.C. 552a) 
(identifying sources of records in the system of records) because 
identifying sources could result in disclosure of properly classified 
national defense or foreign policy information, intelligence sources 
and methods, and investigatory techniques and procedures. 
Notwithstanding its exemption from this requirement, ODNI identifies 
record sources in broad categories sufficient to provide general notice 
of the origins of the information it maintains in its systems of 
records.
    (9) From paragraph (e)(5) of the Privacy Act (5 U.S.C. 552a) 
(maintain timely, accurate, complete and up-to-date records) because 
many of the records in the system are derived from other domestic and 
foreign agency record systems over which ODNI exercises no control. In 
addition, in collecting information for counterterrorism, intelligence, 
and law enforcement purposes, it is not possible to determine in 
advance what information is accurate, relevant, timely, and complete. 
With the passage of time and the development of additional facts and 
circumstances, seemingly irrelevant or dated information may acquire 
significance. The restrictions imposed by paragraph (e)(5) of the 
Privacy Act (5 U.S.C. 552a) would limit the ability of intelligence 
analysts to exercise judgment in conducting investigations and impede 
development of intelligence necessary for effective counterterrorism 
and law enforcement efforts.
    (10) From paragraph (e)(8) of the Privacy Act (5 U.S.C. 552a) 
(notice of compelled disclosures) because requiring individual notice 
of legally compelled disclosure poses an impossible administrative 
burden and could alert subjects of counterterrorism, law enforcement, 
or intelligence investigations to the previously unknown fact of those 
investigations.
    (11) From paragraph (e)(12) of the Privacy Act (public notice of 
matching activity) because, to the extent such activities are not 
otherwise excluded from the matching requirements of the Privacy Act (5 
U.S.C. 552a), publishing advance notice in the Federal Register would 
frustrate the ability of intelligence analysts to act quickly in 
furtherance of analytical efforts.
    (12) From paragraph (f) of the Privacy Act (5 U.S.C. 552a) (agency 
rules for notifying subjects to the existence of records about them, 
for accessing and amending records, and for assessing fees) because the 
system is exempt from provisions in paragraph (d) of the Privacy Act 
regarding access and amendment of records by record subjects. 
Nevertheless, ODNI has published agency rules concerning notification 
of a subject in response to his request if any system of records named 
by the subject contains a record pertaining to him and procedures by 
which the subject may access or amend the records. Notwithstanding 
exemption, ODNI may determine it appropriate to satisfy a record 
subject's access request.
    (13) From paragraph (g) of the Privacy Act (5 U.S.C. 552a) (civil 
remedies) to the extent that the civil remedies relate

[[Page 31197]]

to provisions of 5 U.S.C. 552a from which this rule exempts the system.

0
4. Add new Sec.  1701.22 to read as follows:


Sec.  1701.22  ODNI systems of records subject to exemption.

    (a) ODNI systems of records subject to exemption:
    (1) Manuscript, Presentation, and Resume Review Records (ODNI-01), 
5 U.S.C. 552a(k)(1).
    (2) Executive Secretary Action Management System Records (ODNI-02), 
5 U.S.C. 552a(k)(1).
    (3) Public Affairs Office Records (ODNI-03), 5 U.S.C. 552a(k)(1).
    (4) Office of Legislative Affairs Records (ODNI-04), 5 U.S.C. 
552a(k)(1).
    (5) ODNI Guest Speaker Records (ODNI-05), 5 U.S.C. 552a(k)(1).
    (6) Office of General Counsel Records (ODNI-06), 5 U.S.C. 
552a(k)(1), (2), and (5).
    (7) Intelligence Community Customer Registry (ODNI-09), 5 U.S.C. 
552a(k)(1).
    (8) Office of Intelligence Community Equal Employment Opportunity 
and Diversity Records (ODNI-10), 5 U.S.C. 552a(k)(1), (2), and (5).
    (9) Office of Protocol Records (ODNI-11), 5 U.S.C. 552a(k)(1).
    (10) Intelligence Community Security Clearance and Access Approval 
Repository (ODNI-12), 5 U.S.C. 552a(k)(1), (2), and (5).
    (11) Security Clearance Reform Research and Oversight Records 
(ODNI-13), 5 U.S.C. 552a(k)(1), (2), and (5).
    (12) Civil Liberties and Privacy Office Complaint Records (ODNI-
14), 5 U.S.C. 552a(k)(1), (2), and (5).
    (13) Mission Outreach and Collaboration Records (ODNI-15), 5 U.S.C. 
552a(k)(1).
    (14) ODNI Human Resource Records (ODNI-16), 5 U.S.C. 552a(k)(1).
    (15) ODNI Personnel Security Records (ODNI-17), 5 U.S.C. 
552a(k)(1), (2), and (5).
    (16) ODNI Freedom of Information Act, Privacy Act, and Mandatory 
Declassification Review Request Records (ODNI-18), 5 U.S.C. 552a(k)(1), 
(2), and (5).
    (17) ODNI Information Technology Systems Activity and Access 
Records (ODNI-19), 5 U.S.C. 552a(k)(1), (2), and (5).
    (18) ODNI Security Clearance Reciprocity Hotline Records (ODNI-20), 
5 U.S.C. 552a(k)(1) and (5).
    (19) ODNI Information Technology Network Support, Administration 
and Analysis Records (ODNI-21), 5 U.S.C. 552a(k)(1).
    (20) Insider Threat Program Records (ODNI-22), 5 U.S.C. 552a(k)(1), 
(2), and (5).
    (b) ODNI/National Counterintelligence and Security Center (NCSC) 
systems of records:
    (1) Damage Assessment Records (ODNI/NCIX-001), 5 U.S.C. 552a(k)(1) 
and (2).
    (2) Counterintelligence Trends Analyses Records (ODNI/NCSC-002), 5 
U.S.C. 552a(k)(1) and (2).
    (3) Continuous Evaluation Records (ODNI/NCSC-003), 5 U.S.C. 
552a(k)(1), (2), and (5).
    (c) ODNI/National Counterterrorism Center (NCTC) systems of 
records:
    (1) NCTC Access Authorization Records (ODNI/NCTC-002), 5 U.S.C. 
552a(k)(1).
    (2) NCTC Telephone Directory (ODNI/NCTC-003), 5 U.S.C. 552a(k)(1).
    (3) NCTC Knowledge Repository (ODNI/NCTC-004), 5 U.S.C. 552a(k)(1) 
and (2).
    (4) NCTC Current (ODNI/NCTC-005), 5 U.S.C. 552a(k)(1) and (2).
    (5) NCTC Partnership Management Records (ODNI/NCTC-006), 5 U.S.C. 
552a(k)(1).
    (6) NCTC Tacit Knowledge Management Records (ODNI/NCTC-007), 5 
U.S.C. 552a(k)(1).
    (7) NCTC Terrorism Analysis Records (ODNI/NCTC-008), 5 U.S.C. 
552a(k)(1) and (2).
    (8) Terrorist Identities Records (ODNI/NCTC-009), 5 U.S.C. 
552a(k)(1) and (2).
    (d) ODNI/Office of the Intelligence Community Inspector General 
(ICIG) systems of records:
    (1) OIG Human Resources Records (ODNI/OIG-001), 5 U.S.C. 552a(k)(1) 
and (5).
    (2) OIG Experts Contact Records (ODNI/OIG-002), 5 U.S.C. 552a(k)(1) 
and (5).
    (3) OIG Investigation and Interview Records (ODNI/OIG-003), 5 
U.S.C. 552a(j)(2); (k)(1), (2), and (5).

    Dated: June 12, 2019.
Deirdre M. Walsh,
Chief Operating Officer, Office of the Director of National 
Intelligence.
[FR Doc. 2019-12987 Filed 6-28-19; 8:45 am]
 BILLING CODE 3910-A79-P-P