Privacy Act of 1974; System of Records, 9947-9949 [E8-3433]

Agencies

• Department of Justice

[Federal Register Volume 73, Number 37 (Monday, February 25, 2008)]
[Rules and Regulations]
[Pages 9947-9949]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E8-3433]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF JUSTICE

28 CFR Part 16

[CPCLO Order No.: 001-2008]


Privacy Act of 1974; System of Records

AGENCY: Federal Bureau of Investigation, Department of Justice.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Federal Bureau of Investigation (FBI), a component agency 
of the Department of Justice (DOJ), is issuing a final rule exempting a 
new Privacy Act system of records, the Law Enforcement National Data 
Exchange. The FBI published a system of records notice for N-DEx and a 
proposed rule implementing these exemptions on October 4, 2007. The 
listed exemptions are necessary to avoid interference with the law 
enforcement functions and responsibilities of the FBI. This document 
addresses public comments on the proposed rule.

DATES: This final rule is effective February 25, 2008.

FOR FURTHER INFORMATION CONTACT: Kirsten J. Moncada, Director, Office 
of Privacy and Civil Liberties, 950 Pennsylvania Avenue, NW., 
Washington, DC 20530, or facsimile 202-616-9627.

SUPPLEMENTARY INFORMATION: 
    On October 4, 2007, the FBI issued a system of records notice at 72 
FR 56793, for a new Privacy Act records system, JUSTICE/FBI-020, the 
Law Enforcement National Data Exchange (N-DEx), and a notice of 
proposed rulemaking, at 72 FR 56704, to exempt it from subsections 
(c)(3) and (4); (d)(1), (2), (3), and (4); (e)(1), (2), (3), (5), and 
(8); and (g) of the Privacy Act. The FBI explained that the exemptions 
were necessary in order to avoid interference with the FBI's law 
enforcement functions and responsibilities.
    Two thoughtful comments from individuals were received on the 
proposed exemptions. One commenter supported the claimed exemptions, 
observing that they were ``most

[[Page 9948]]

assuredly necessary.'' While noting that the exemptions were ``an 
admirable attempt at balancing privacy and safety interests,'' the 
other commenter expressed concern about the FBI's exemption of the 
system from the amendment/correction provisions of subsection (d) of 
the Privacy Act. This commenter provided two suggestions for ways to 
permit amendment of N-DEx records. While the FBI appreciates the 
suggestions, the second one, amending the current law, would require 
legislation which is the purview of Congress and not the Executive 
Branch. The other suggestion, to apply the exemption for a temporal 
period only (such as the 30-day period envisioned in subsection (d)(3) 
for responding to Privacy Act requests or some longer period), would 
place the FBI in the administratively untenable position of having to 
verify with multiple law enforcement entities the status of any 
investigation, whether at the state, local or Federal level. The FBI 
notes that under the operating procedures of N-DEx, any entity that 
wishes to use information from the system for a law enforcement purpose 
is required to verify the accuracy of the data with the submitter, 
which provides a mechanism for ensuring that the information is 
accurate and timely. The FBI also notes that although it has proposed 
to exempt the system from the access and amendment provisions of the 
Privacy Act, FBI information in the system can be requested under the 
Freedom of Information Act. Consequently, individuals potentially have 
a means to obtain data from closed investigations and can still submit 
letters of disagreement if some information is determined to be 
incorrect. See 28 CFR 16.46. The FBI agrees with the commenter that 
having accurate law enforcement information is necessary, but believes 
that the system has built-in mechanisms to ensure that the information 
to be maintained--and more importantly used--is correct, and that the 
burdens from allowing access and amendment, coupled with the other 
reasons underlying the exemption, outweigh the benefit to be gained in 
this case.
    The FBI's claim of exemption from the access and amendment 
provisions of the Privacy Act is consistent with the principles of 
public policy reflected in the Privacy Act, which allows an agency to 
exempt itself from certain Privacy Act rules in order to avoid 
``undesirable and often unacceptable effects upon agencies in the 
conduct of necessary public business.'' See Office of Management and 
Budget, Privacy Act Implementation Guidelines and Responsibilities, 40 
FR 28948, 28971 (July 9, 1975). After careful consideration of the 
public comments, the FBI has determined that no substantive changes are 
warranted in the proposed rule and that it should be issued in final 
form. The FBI, however, is making two minor typographical changes in 
the final rule: the insertion of subparagraph letters for paragraph 7 
and the renumbering of subparagraph (10) to fix a numeration error.

Regulatory Flexibility Act

    This rule relates to individuals, as opposed to small business 
entities. Nevertheless, pursuant to the requirements of the Regulatory 
Flexibility Act, the rule will not have a significant economic impact 
on a substantial number of small entities.

Small Entity Inquiries

    The Small Business Regulatory Enforcement Fairness Act (SBREFA) of 
1996 requires the FBI to comply with small entity requests for 
information and advice about compliance with statutes and regulations 
within FBI jurisdiction. Any small entity that has a question regarding 
this document may contact the person listed in FOR FURTHER INFORMATION 
CONTACT. Persons can obtain further information regarding SBREFA on the 
Small Business Administration's Web page at https://www.sba.gov/advo/
laws/law_lib.html.

Paperwork Reduction Act

    The Paperwork Reduction Act of 1995 requires that the FBI consider 
the impact of paperwork and other information collection burdens 
imposed on the public. There are no current or new information 
collection requirements associated with this rule.

Analysis of Regulatory Impacts

    This rule is not a ``significant regulatory action'' within the 
meaning of Executive Order 12886. Because the economic impact should be 
minimal, further regulatory evaluation is not necessary. Moreover, the 
Attorney General certifies that this rule would not have a significant 
economic impact on a substantial number of small entities, because the 
reporting requirements themselves are not changed and because it 
applies only to information on individuals.

Unfunded Mandates

    Title II of the Unfunded Mandates Reform Act of 1995 (UMRA) 
requires Federal agencies to assess the effects of certain regulatory 
actions on State, local, and tribal governments, and the private 
sector. UMRA requires a written statement of economic and regulatory 
alternatives for proposed and final rules that contain Federal 
mandates. A ``Federal mandate'' is a new or additional enforceable 
duty, imposed on any State, local, or tribal government, or the private 
sector. If any Federal mandate causes those entities to spend, in 
aggregate, $100 million or more in any one year the UMRA analysis is 
required. This rule would not impose Federal mandates on any State, 
local, or tribal government or the private sector.

Executive Order 13132, Federalism

    The FBI has analyzed this rule under the principles and criteria of 
Executive Order 13132, Federalism. This action will not have a 
substantial direct effect on the States, on the relationship between 
the national Government and the States, or on the distribution of power 
and responsibilities among the various levels of government, and 
therefore, will not have federalism implications.

Environmental Analysis

    The FBI has reviewed this action for purposes of the National 
Environmental Policy Act of 1969 (NEPA) and has determined that this 
action will not have a significant effect on the human environment.

Energy Impact

    The energy impact of this action has been assessed in accordance 
with the Energy Policy and Conservation Act (EPCA), as amended (42 
U.S.C. 6362). This rulemaking is not a major regulatory action under 
the provisions of the EPCA.

List of Subjects in 28 CFR Part 16

    Administrative Practices and Procedures, Courts, Freedom of 
Information Act, Government in the Sunshine Act, and the Privacy Act.

0
Pursuant to the authority vested in the Attorney General by 5 U.S.C. 
552a and delegated to me by Attorney General Order 793-78, 28 CFR part 
16 is amended as follows:

PART 16--[AMENDED]

Subpart E--Exemption of Records Systems Under the Privacy Act

0
1. The authority citation for part 16 continues to read as follows:

    Authority: 5 U.S.C. 301, 552, 552a, 552b(g), 553; 18 U.S.C. 
4203(a)(1); 28 U.S.C. 509, 510, 524; 31 U.S.C. 3717, 9701.


0
2. Section 16.96 is amended to add new paragraphs (t) and (u) as 
follows:

[[Page 9949]]

Sec.  16.96  Exemption of Federal Bureau of Investigation Systems--
limited access.

* * * * *
    (t) The following system of records is exempt from 5 U.S.C. 
552a(c)(3) and (4); (d)(1), (2), (3) and (4); (e)(1), (2), (3), (5) and 
(8); and (g) of the Privacy Act:
    (1) Law Enforcement National Data Exchange (N-DEx), (JUSTICE/FBI-
020).
    (2) These exemptions apply only to the extent that information in 
this system is subject to exemption pursuant to 5 U.S.C. 552a(j)(2). 
Where compliance would not appear to interfere with or adversely affect 
the law enforcement purposes of this system, or the overall law 
enforcement process, the applicable exemption may be waived by the FBI 
in its sole discretion.
    (u) Exemptions from the particular subsections are justified for 
the following reasons:
    (1) From subsection (c)(3) because this system is exempt from the 
access provisions of subsection (d). Also, because making available to 
a record subject the accounting of disclosures from records concerning 
him/her would specifically reveal any investigative interest in the 
individual. Revealing this information may thus compromise ongoing law 
enforcement efforts. Revealing this information may also permit the 
record subject to take measures to impede the investigation, such as 
destroying evidence, intimidating potential witnesses or fleeing the 
area to avoid the investigation.
    (2) From subsection (c)(4) because this system is exempt from the 
access and amendment provisions of subsection (d).
    (3) From subsections (d)(1), (2), (3), and (4), because these 
provisions concern individual access to and amendment of investigatory 
records, compliance with which could alert the subject of an 
investigation of the fact and nature of the investigation, and/or the 
investigative interest of the FBI and other law enforcement agencies; 
interfere with the overall law enforcement process by leading to the 
destruction of evidence, improper influencing of witnesses, fabrication 
of testimony, and/or flight of the subject; possibly identify a 
confidential source or disclose information which would constitute an 
unwarranted invasion of another's personal privacy; reveal a sensitive 
investigative or intelligence technique; or constitute a potential 
danger to the health or safety of law enforcement personnel, 
confidential informants, and witnesses. Amendment of these records 
would interfere with ongoing investigations and other law enforcement 
activities and impose an impossible administrative burden by requiring 
investigations, analyses, and reports to be continuously reinvestigated 
and revised.
    (4) From subsection (e)(1) because it is not always possible to 
know in advance what information is relevant and necessary for law 
enforcement purposes and, in fact, a major tenet of the N-DEx 
information sharing system is that the relevance of certain information 
may not always be evident in the absence of the ability to correlate 
that information with other existing law enforcement data.
    (5) From subsection (e)(2) because application of this provision 
could present a serious impediment to efforts to solve crimes and 
improve homeland security in that it would put the subject of an 
investigation on notice of that fact, thereby permitting the subject to 
engage in conduct intended to frustrate or impede that activity.
    (6) From subsection (e)(3) because disclosure would put the subject 
of an investigation on notice of that fact and would permit the subject 
to engage in conduct intended to thwart that activity.
    (7)(i) From subsection (e)(5) because many of the records in this 
system are records contributed by other agencies and the restrictions 
imposed by (e)(5) would limit the utility of the N-DEx system. All data 
contributors are expected to ensure that information they share is 
relevant, timely, complete and accurate. In fact, rules for use of the 
N-DEx system will require that information be updated periodically and 
not be used as a basis for action or disseminated beyond the recipient 
without the recipient first obtaining permission from the record owner/
contributor. These rules will be enforced through robust audit 
procedures. The existence of these rules should ameliorate any 
perceived concerns about the integrity of the information in the N-DEx 
system. Nevertheless, exemption from this provision is warranted in 
order to reduce the administrative burden on the FBI to vouch for 
compliance with the provision by all N-DEx data contributors and to 
encourage those contributors to share information the significance of 
which may only become apparent when combined with other information in 
the N-DEx system.
    (ii) The FBI is also exempting the N-DEx from subsection (e)(5) in 
order to block the use of a challenge under subsection (e)(5) as a 
collateral means to obtain access to records in the N-DEx. The FBI has 
exempted these records from the access and amendment requirements of 
subsection (d) of the Privacy Act in order to protect the integrity of 
law enforcement investigations. Exempting the N-DEx system from 
subsection (e)(5) complements this exemption and will provide the FBI 
with the ability to prevent the assertion of challenges to a record's 
accuracy, timeliness, completeness and/or relevance under subsection 
(e)(5) to circumvent the exemption claimed from subsection (d).
    (8) From subsection (e)(8), because to require individual notice of 
disclosure of information due to compulsory legal process would pose an 
impossible administrative burden on the FBI and may alert the subjects 
of law enforcement investigations to the fact of those investigations, 
when not previously known.
    (9) From subsection (g) to the extent that the system is exempt 
from other specific subsections of the Privacy Act.

    Dated: February 14, 2008.
Kenneth P. Mortensen,
Acting Chief Privacy and Civil Liberties Officer, Department of 
Justice. 8
 [FR Doc. E8-3433 Filed 2-22-08; 8:45 am]
BILLING CODE 4410-02-P