[Federal Register Volume 90, Number 244 (Tuesday, December 23, 2025)]
[Rules and Regulations]
[Pages 59945-59948]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2025-23783]
========================================================================
Rules and Regulations
Federal Register
________________________________________________________________________
This section of the FEDERAL REGISTER contains regulatory documents
having general applicability and legal effect, most of which are keyed
to and codified in the Code of Federal Regulations, which is published
under 50 titles pursuant to 44 U.S.C. 1510.
The Code of Federal Regulations is sold by the Superintendent of Documents.
========================================================================
Federal Register / Vol. 90, No. 244 / Tuesday, December 23, 2025 /
Rules and Regulations
[[Page 59945]]
DEPARTMENT OF HOMELAND SECURITY
Office of the Secretary
6 CFR Part 5
[Docket No. DHS-2021-0020]
RIN 1601-AB21
Privacy Act of 1974
AGENCY: Office of the Secretary, Department of Homeland Security.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: The Department of Homeland Security (DHS or Department) is
updating its regulations related to the procedures for submitting
Freedom of Information Act (FOIA) and Privacy Act of 1974 requests to
clarify that requesters must generally submit their Freedom of
Information Act (FOIA) requests and Privacy Act requests
electronically.
DATES: This final rule is effective January 22, 2026.
FOR FURTHER INFORMATION CONTACT: Roman Jankowski, Chief Privacy
Officer, Privacy Office, Department of Homeland Security, Washington,
DC 20528, (202) 343-1717, [email protected].
SUPPLEMENTARY INFORMATION:
I. Background
The Secretary of Homeland Security has authority under 5 U.S.C.
301, 552, and 552a, and 6 U.S.C. 112(e) to issue Freedom of Information
Act and Privacy Act regulations. That authority has been delegated to
the Chief Privacy Officer of the Department pursuant to 6 U.S.C. 142
and DHS Del. No. 13001, Rev. 01 (June 2, 2020). Most recently, DHS
updated its procedures implementing the Freedom of Information Act and
Privacy Act, 5 U.S.C. 552a., at 6 CFR part 5, subparts A and B on
November 16, 2022 (87 FR 68599) and February 27, 2024 (89 FR 14369).
II. Discussion of Changes
This rule updates Title 6, part 5, paragraphs 5.3(a)(2) and
5.21(a)(6), which provide instructions to requesters on how and where
to make FOIA and Privacy Act (and Judicial Redress Act (JRA) if
applicable) requests for DHS records. The rule generally requires
requesters to submit their Freedom of Information Act (FOIA) requests
and Privacy Act requests electronically through the web portal at
https://www.dhs.gov/foia or other acceptable Federal Government or DHS
Component websites. DHS and its components will generally no longer
accept FOIA or Privacy Act/JRA requests mailed to the DHS Privacy
Office, or other DHS components, or via fax or email. By accepting
requests only through DHS's or its components' websites, DHS will
ensure requests are sent to the correct DHS Headquarters office or DHS
component. In addition, this will reduce the time to interact with
requesters and also expedite the time requesters will receive
responsive records to their requests. In addition, this change will
allow the Department to respond to requesters quickly and efficiently
to correct any mistakes made in submitting their requests or clarifying
their requests. Upon request, DHS FOIA public liaisons may facilitate,
in limited circumstances (e.g., incarceration), an alternative method
to submit requests for requesters who are unable to submit electronic
requests. Requesters who are unable to submit electronic requests
should contact the Office or DHS Component they wish to seek records
from.
III. Regulatory History
DHS did not publish a notice of proposed rulemaking for this rule.
Under 5 U.S.C. 553(b)(A), this final rule is exempt from notice and
public comment rulemaking requirements because the change involves
rules of agency organization, procedure, or practice. In addition,
under 5 U.S.C. 553(b)(B), an agency may bypass notice and comment
requirements if it finds, for good cause, that notice and comment is
impracticable, unnecessary, or contrary to the public interest. DHS
finds that notice and comment is unnecessary here because the change to
the manner of submitting FOIA and Privacy Act requests is an agency
procedural update that will have minimal substantive effect on the
public. Specifically, DHS believes that submitting a request through a
publicly accessible web portal is a routine and accepted method of
seeking information in today's society, and the vast majority of
requesters already submit their requests this way. Furthermore, DHS
will continue to consider requests for exceptions in limited
circumstances for requesters who lack internet access. In addition, the
rule is procedural because it changes only the manner in which the
public presents FOIA and Privacy requests to DHS, and not the substance
of those requests. Notice and comment is unnecessary because the public
has come to accept using web pages to submit information and generally
does so routinely. Electronic submission via web portal is also more
efficient than using the U.S. Postal Service. and allows for better
tracking of the submission and quicker response by the Government.
III. Regulatory Analyses
A. Executive Orders 12866 (Regulatory Planning and Review), 13563
(Improving Regulation and Regulatory Review), and 14192 (Unleashing
Prosperity Through Deregulation)
Executive Orders 13563 and 12866 direct agencies to assess the
costs and benefits of available regulatory alternatives and, if
regulation is necessary, to select regulatory approaches that maximize
net benefits. Executive Order 13563 emphasizes the importance of
quantifying both costs and benefits, of reducing costs, of harmonizing
rules, and of promoting flexibility. Executive Order 14192 establishes
a policy that the executive branch be ``prudent and financially
responsible in the expenditure of funds, from both public and private
sources, and [ ] alleviate unnecessary regulatory burdens placed on the
American people.''
The Office of Management and Budget (OMB) has not designated this
rule a ``significant regulatory action,'' under section 3(f) of
Executive Order 12866. Accordingly, OMB has not reviewed this rule.
This rule is also not subject to Executive Order 14192 because the rule
is not significant under Executive Order 12866 and because it is
related to agency organization, management, or personnel. See OMB
Memorandum M-25-20, ``Guidance Implementing
[[Page 59946]]
Section 3 of Executive Order 14192, titled `Unleashing Prosperity
Through Deregulation'' (Mar. 26, 2025).
DHS has considered the costs and benefits of this rule. This rule
will not impose any new costs on the government or the public. The
rule's benefits include increased efficiency in processing and
responding to FOIA and Privacy Act/JRA requests and decreased lag times
for handling requests that would otherwise come from non-portal
sources. Specifically, the rule allows DHS FOIA personnel to spend less
time on data entry and administrative tasks if the requester submits
through the electronic portal rather than through email, fax or
physical mail. Spending less time on initial data entry and
administrative tasks will allow DHS FOIA personal to spend more time
searching and reviewing records to respond to the requests.
Unfunded Mandates Reform Act of 1995
This rule will not result in the expenditure by state, local, and
tribal governments, in the aggregate, or by the private sector, of
$100,000,000 or more in any one year, and it will not significantly or
uniquely affect small governments. Therefore, no written statement was
deemed necessary under the provisions of the Unfunded Mandates Reform
Act of 1995.
Regulatory Flexibility Act
Under the Regulatory Flexibility Act (RFA), 5 U.S.C. 601-612, and
section 213(a) of the Small Business Regulatory Enforcement Fairness
Act of 1996, 5 U.S.C. 601 note, agencies must consider the impact of
their rulemakings on ``small entities'' (small businesses, small
organizations, and local governments). The term ``small entities''
comprises small businesses, not-for-profit organizations that are
independently owned and operated and are not dominant in their fields,
and governmental jurisdictions with populations of less than 50,000.
DHS has reviewed this regulation and by approving it certifies that
this regulation will not have a significant economic impact on a
substantial number of small entities. DHS does not believe this rule
imposes any additional direct costs on small entities.
Small Business Regulatory Enforcement Fairness Act of 1996
This rule is not a major rule as defined by section 251 of the
Small Business Regulatory Enforcement Fairness Act of 1996 (as
amended), 5 U.S.C. 804(2). The Office of Management and Budget's Office
of Information and Regulatory Affairs has not found that this rule is
likely to result in an annual effect on the economy of $100,000,000 or
more; a major increase in costs or prices; or significant adverse
effects on competition, employment, investment, productivity,
innovation, or on the ability of United States-based companies to
compete with foreign-based companies in domestic and export markets.
National Environmental Policy Act
DHS reviews regulatory actions to determine whether the National
Environmental Policy Act (NEPA) applies to them and, if so, what degree
of analysis is required. DHS Directive 023-01 Rev. 01 (Directive) and
Instruction Manual 023-01-001-01 Rev. 01 (Instruction Manual) establish
the procedures that DHS and its components use to comply with NEPA.
NEPA allows Federal agencies to establish, in their NEPA
implementing procedures, categories of actions (``categorical
exclusions'') that experience has shown do not, individually or
cumulatively, have a significant effect on the human environment and,
therefore, do not require an environmental assessment or environmental
impact statement. The Instruction Manual, Appendix A, lists the DHS
categorical exclusions.
Under DHS NEPA implementing procedures, for an action to be
categorically excluded, it must satisfy each of the following three
conditions: (1) the entire action clearly fits within one or more of
the categorical exclusions; (2) the action is not a piece of a larger
action; and (3) no extraordinary circumstances exist that create the
potential for a significant environmental effect.
This rule is strictly procedural and is limited to updating the
method by which requesters may submit requests for information under
FOIA and the Privacy Act/JRA. DHS has reviewed this rule and finds that
it clearly fits within categorical exclusion A3(a) as an administrative
or procedural rule that will have no significant effect on the
environment, is not part of a larger Federal action, and does not
present extraordinary circumstances that create the potential for
significant environmental impacts. Therefore, the rule is categorically
excluded from further NEPA review.
List of Subjects in 6 CFR Part 5
Classified Information, Courts, Freedom of information, Government
employees, Privacy.
For the reasons stated in the preamble, DHS amends Chapter I part 5
of Title 6, Code of Federal Regulations, as follows:
PART 5--DISCLOSURE OF RECORDS AND INFORMATION
0
1. The authority citation for Part 5 continues to read as follows:
Authority: 6 U.S.C. 101 et seq.; Pub. L. 107-296, 116 Stat.
2135; 5 U.S.C. 301; 6 U.S.C. 142; DHS Del. No. 13001, Rev. 01 (June
2, 2020).
Subpart A also issued under 5 U.S.C. 552.
Subpart B also issued under 5 U.S.C. 552a and 552 note.
0
2. Amend Sec. 5.3 by revising paragraphs (a)(2) and (c) to read as
follows:
Sec. 5.3 Requirements for making requests.
(a) * * *
(2) A requester may send their request to the Privacy Office, U.S.
Department of Homeland Security, via the internet at https://www.dhs.gov/foia or for any of the Headquarters Offices of the
Department of Homeland Security listed in Appendix A to Subpart 5, or
https://www.foia.gov/. Upon request, DHS FOIA public liaisons may
facilitate, in limited circumstances (e.g., incarceration), an
alternative method to submit requests for requesters who are unable to
submit electronic requests. Please direct such requests to the liaison
of the Office or DHS Component you wish to seek records from, which can
be found listed in Appendix A to Subpart 5 or found here: https://www.dhs.gov/foia-contact-information. In addition, if a requester does
not know which DHS component may maintain responsive records to a
request, the requester may explicitly ask for assistance from the DHS
Privacy Office with identifying the proper component that most likely
maintains any potential responsive records. Upon a request for
assistance and based on information provided in the FOIA request and by
the requester, the Privacy Office will forward the request to the DHS
component(s) that it determines to be most likely, as of the date of
the request for information, to maintain the records that are sought.
The Privacy Office will notify the requester that it is forwarding the
request, including identifying the component(s) where the request has
been sent, provide the FOIA Public Liaison contact information for the
respective component(s), and provide administrative appeal rights in
the response. If the requester does not agree with the Privacy Office's
determination regarding which components would likely have records
responsive to the request, the requester must submit a timely appeal of
the Privacy Office's determination. Although these are not to
[[Page 59947]]
be considered misdirected requests, the recipient DHS component shall
be granted the same number of days to respond as permitted by 6 CFR
5.4(c) and 5.5(a).
* * * * *
(c) If a request does not adequately describe the records sought,
DHS may at its discretion either seek additional information from the
requester, or administratively close the request. Requests for
clarification or more information will be made in writing
electronically whenever possible (either via electronic mail or portal
message) except when DHS requests to speak on the phone to discuss the
request. If DHS communicates via a phone call, DHS will summarize the
call in a follow up electronic mail or portal message. If DHS
corresponds only electronically via electronic mail or portal message,
requesters must respond to requests for additional information also by
electronic mail or portal message in the same medium as the DHS
correspondence. In order to be considered timely, responses to requests
for additional information must be received by electronic mail or
portal message within 30 working days of the electronic mail or portal
message request for additional information. If the requester does not
respond to a request for additional information within 30 working days,
the request may be administratively closed at DHS's discretion. This
administrative closure does not prejudice the requester's ability to
submit a new request for further consideration with additional
information. Upon request, DHS FOIA public liaisons may facilitate, in
limited circumstances (e.g., incarceration), an alternative method to
submit requests for requesters who are unable to submit electronic
requests. Please direct such requests to the liaison of the Office or
DHS Component you wish to seek records from, which can be found listed
in Appendix A to Subpart 5 or found here: https://www.dhs.gov/foia-
contact-information.
0
3. Amend Sec. 5.21 by revising paragraphs (a)(6) and (c) to read as
follows:
Sec. 5.21 Requests for access to records.
(a) * * *
(6) An individual may send a request to the Privacy Office via the
internet at https://www.dhs.gov/foia for any of the Headquarters
Offices of the Department of Homeland Security listed Appendix A to
Subpart 5, or https://www.foia.gov/. Upon request, DHS FOIA public
liaisons may facilitate, in limited circumstances (e.g.,
incarceration), an alternative method to submit requests for requesters
who are unable to submit electronic requests. Please direct such
requests to the liaison of the Office or DHS Component you wish to seek
records from, which can be found listed in Appendix A to Subpart 5 or
here: https://www.dhs.gov/foia-contact-information. In addition, if a
requester does not know which DHS component may maintain responsive
records to a request, the requester may explicitly ask for assistance
from the DHS Privacy Office with identifying the proper component that
most likely maintains any potential responsive records citing this
section of the regulations. Upon a request for assistance and based on
information provided in the FOIA request and by the requester, the
Privacy Office will forward the request to the DHS component(s) that it
determines to be most likely, as of the date of the request for
information, to maintain the records that are sought. The Privacy
Office will notify the requester that it is forwarding the request,
including identifying the component(s) where the request has been sent,
provide the FOIA Public Liaison contact information for the respective
component(s), and provide administrative appeal rights in the response.
If the requester does not agree with the Privacy Office's determination
regarding which components would likely have records responsive to the
request, the requester must submit a timely appeal of the Privacy
Office's determination. For the quickest possible handling, the
requester should mark the request letter ``Privacy Act Request'' or
``Judicial Redress Act Request.''
* * * * *
(c) Description of records sought. A requester must describe the
records sought in sufficient detail to enable Department personnel to
locate the system of records covering them with a reasonable amount of
effort. Whenever possible, the request should describe the records
sought, the time periods in which the requester believes they were
compiled, the office or location in which the requester believes the
records are kept, and the name or identifying number of each system of
records in which the requester believes they are kept. The Department
publishes notices in the Federal Register that describe its components'
systems of records. These notices can be found on the Department's
website here: https://www.dhs.gov/system-records-notices-sorns. If a
request does not adequately describe the records sought, DHS may at its
discretion either seek additional information from the requester or
administratively close the request. Requests for clarification or more
information must be made in writing via electronic mail. To be
considered timely, responses to requests for additional information
must be received by electronic mail within 30 working days of the
electronic mail request for additional information. If the requester
does not respond timely, the request may be administratively closed at
DHS's discretion. This administrative closure does not prejudice the
requester's ability to submit a new request for further consideration
with additional information.
0
4. Revise Appendix A to Part 5 to read as follows:
Appendix A to Part 5--FOIA/Privacy Act Offices of the Department of
Homeland Security
I. For Headquarters Offices of the Department of Homeland
Security, FOIA and Privacy Act (or JRA if applicable) requests
should be submitted electronically via https://foiarequest.dhs.gov/.
For a listing of Headquarters Offices and contact information,
please see https://www.dhs.gov/foia-contact-information. Additional
contact information for questions: Phone: 202-343-1743 or 866-431-
0486, Fax: 202-343-4011, or Email: [email protected]. The Public
Liaison may also be contacted using this information.
II. For the following components and offices of the Department
of Homeland Security, FOIA and Privacy Act (or JRA if applicable)
requests should also be submitted electronically by way of
instructions at https://www.dhs.gov/foia-contact-information or
through an alternative dedicated DHS component website. For each
component, the Public Liaison may also be contacted using the
information below for questions about submission of requests. The
components are:
Cybersecurity and Infrastructure Security Agency (CISA)
Additional contact information for questions: Phone: 202-343-
1743 or 866-431-0486, Fax: 202-343-4011, or Email:
[email protected].
U.S. Customs and Border Protection (CBP)
Additional contact information for questions: Phone: 202-325-
0150 or Email: [email protected].
Federal Emergency Management Agency (FEMA)
Additional contact information for questions: Phone: 202-646-
3323, Fax: 202-646-3347, or Email: [email protected].
Federal Law Enforcement Training Center (FLETC)
Additional contact information for questions: Phone: 912-267-
3103, Fax: 912-267-3113, or Email: [email protected].
[[Page 59948]]
Immigration and Customs Enforcement (ICE)
Additional contact information for questions: Phone: 866-633-
1182, Fax: 202-732-4265, or Email: [email protected].
Office of Inspector General
Additional contact information for questions: Phone: 202-981-
6100, or Email: [email protected].
Transportation Security Administration (TSA)
Additional contact information for questions: Phone: 1-866-FOIA-
TSA or 571-227-2300, or Email: [email protected].
U.S. Citizenship and Immigration Services (USCIS)
Additional contact information for questions: Phone: 1-800-375-
5283, USCIS Contact Center, or Email: [email protected].
U.S. Coast Guard (USCG)
Additional contact information for questions: Phone: 202-475-
3522, Fax: 202-372-8413, or Email: [email protected].
U.S. Secret Service (USSS)
Additional contact information for questions: Phone: 202-406-
6370, Fax: 202-406-5586, or Email: [email protected].
Roman Jankowki,
Chief Privacy Officer, Department of Homeland Security.
[FR Doc. 2025-23783 Filed 12-22-25; 8:45 am]
BILLING CODE 9110-9L-P