Implementation of the Privacy Act of 1974, 34788-34792 [2019-14998]

Agencies

• National Foundation on the Arts and the Humanities
• National Endowment for the Humanities

[Federal Register Volume 84, Number 139 (Friday, July 19, 2019)]
[Rules and Regulations]
[Pages 34788-34792]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-14998]


=======================================================================
-----------------------------------------------------------------------

NATIONAL FOUNDATION ON THE ARTS AND THE HUMANITIES

National Endowment for the Humanities

45 CFR Part 1169

RIN 3136-AA18


Implementation of the Privacy Act of 1974

AGENCY: National Endowment for the Humanities.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The National Endowment for the Humanities (``NEH'') is issuing 
regulations to implement the Privacy Act of 1974 (the ``Privacy Act''). 
These regulations establish procedures by which an individual may 
determine whether a system of records maintained by NEH contains a 
record pertaining to him or her; gain access to such records; and 
request correction or amendment of such records. These regulations also 
establish exemptions from certain Privacy Act requirements for all or 
part of certain systems of records maintained by NEH.

DATES: Effective August 19, 2019.

FOR FURTHER INFORMATION CONTACT:  Elizabeth Voyatzis, Deputy General 
Counsel, Office of the General Counsel, National Endowment for the 
Humanities, 400 Seventh Street SW, Room 4060, Washington, DC 20506; 
(202) 606-8322; [email protected].

SUPPLEMENTARY INFORMATION: 

1. Background

    NEH operates as part of the National Foundation on the Arts and the

[[Page 34789]]

Humanities (the ``Foundation'') under the National Foundation of the 
Arts and the Humanities Act of 1965, as amended (20 U.S.C. 951 et 
seq.). The Foundation consists of the Federal Council on the Arts and 
the Humanities (``FCAH''), the Institute of Museum and Library Services 
(``IMLS''), the National Endowment for the Arts (``NEA''), and NEH. NEH 
currently follows Foundation regulations implementing the Privacy Act, 
located at part 1115 within Subchapter A of 45 CFR Chapter XI.
    The regulations found within 45 CFR Chapter XI, Subchapter A apply 
to the entire Foundation. On April 30, 2019, NEH published a notice of 
proposed rulemaking (``NPRM'') to add NEH-specific Privacy Act 
regulations to 45 CFR Chapter XI, Subchapter D (45 CFR part 1169), 
replacing the Foundation's Privacy Act regulations with regard to NEH. 
IMLS and NEA have already added IMLS- and NEA-specific Privacy Act 
regulations to 45 CFR XI, Subchapters B and E (45 CFR parts 1159 & 
1182), respectively, which replaced the Foundation's Privacy Act 
regulations with regard to IMLS and NEA. FCAH, which relies upon NEA 
and NEH for its administration, does not maintain any systems of 
records of its own, and hence has no need or obligation to publish 
Privacy Act regulations. See 5 U.S.C. 552a(f) (requiring only that an 
agency that ``maintain[s] a system of records shall promulgate rules'' 
implementing the Privacy Act).
    In the preamble of the NPRM, NEH explained that its new agency-
specific Privacy Act regulations will be substantively similar to the 
Foundation's Privacy Act regulations, but will put into place current 
contact information, as well as update and clarify the procedures NEH 
will follow when granting access to, or amending or correcting, a 
record contained within a system of records. NEH will also add a new 
exemption covering its system of records entitled ``Office of Inspector 
General (``OIG'') Investigative Files,'' which did not exist when the 
Foundation published its Privacy Act regulations.
    Because NEH is the only agency that continues to use the Foundation 
regulations at 45 CFR Chapter XI, Subchapter A, rather than amend the 
Foundation regulations--which, along with future amendments, requires 
coordination with IMLS and NEA--NEH has chosen instead to issue its own 
Privacy Act regulations. Upon the effective date of this final rule, 
NEH will seek NEA and IMLS's consent to publish a joint rulemaking 
removing the Foundation's Privacy Act regulations at 45 CFR part 1115, 
as those regulations will no longer apply to any of the Foundation's 
constituent agencies.

2. Public Comment and Changes From Proposed Rule

    NEH did not receive any comments from the public in response to its 
proposed rule. Accordingly, NEH is adopting the proposed rule with no 
changes.

3. Regulatory Analyses

Executive Order 12866: Regulatory Planning and Review and Executive 
Order 13563: Improving Regulation and Regulatory Review

    This action is not a significant regulatory action and was 
therefore not submitted to the Office of Management and Budget (OMB) 
for review.

Executive Order 13771: Reducing Regulations and Controlling Regulatory 
Costs

    This action is not expected to be an Executive Order 13771 
regulatory action because this action is not significant under 
Executive Order 12866.

Paperwork Reduction Act of 1995 (``PRA'')

    This action does not impose an information collection burden under 
the PRA. This action contains no provisions constituting a collection 
of information under the PRA.

Regulatory Flexibility Act of 1980 (``RFA'')

    This action will not have a significant economic impact on a 
substantial number of small entities under the RFA. This action will 
not impose any requirements on small entities.

Unfunded Mandates Reform Act of 1995 (``UMRA'')

    This action does not contain any unfunded mandate as described in 
the UMRA, 2 U.S.C. 1531-1538, and does not significantly or uniquely 
affect small governments.

Executive Order 13132 (Federalism)

    This action does not have federalism implications. It will not have 
substantial direct effects on the states, on the relationship between 
the national government and the states, or on the distribution of power 
and responsibilities among the various levels of government.

Executive Order 13175: Consultation and Coordination With Indian Tribal 
Governments

    This action does not have tribal implications as specified in 
Executive Order 13175. Thus, Executive Order 13175 does not apply to 
this action.

List of Subjects in 45 CFR Part 1169

    Administrative practice and procedure, Privacy.

0
For the reasons stated in the preamble, the National Endowment for the 
Humanities amends 45 CFR Chapter XI Subchapter D by adding part 1169 as 
follows:

PART 1169--PRIVACY ACT REGULATIONS

Sec.
1169.1 Purpose and scope.
1169.2 Definitions.
1169.3 Inquiries about NEH's systems of records or implementation of 
the Privacy Act.
1169.4 Procedures for determining if an individual is the subject of 
an NEH record.
1169.5 Procedures for acquiring access to NEH records pertaining to 
an individual.
1169.6 Identification required when requesting access to NEH records 
pertaining to an individual.
1169.7 Procedures for amending or correcting an individual's NEH 
record.
1169.8 The appeals process.
1169.9 Fees charged to locate, review, or copy records.
1169.10 NEH systems of records that are covered by exemptions under 
the Privacy Act.
1169.11 Penalties for obtaining an NEH record under false pretenses.

    Authority:  5 U.S.C. 552a(f).


Sec.  1169.1   Purpose and scope.

    The regulations in this part set forth NEH's procedures under the 
Privacy Act, as required by 5 U.S.C. 552a(f), with respect to systems 
of records maintained by NEH. These regulations establish procedures by 
which an individual may exercise the rights granted by the Privacy Act 
to determine whether an NEH system of records contains a record 
pertaining to him or her; gain access to such records; and request 
correction or amendment of such records. The regulations also set 
identification requirements; establish procedures by which an 
individual may appeal within NEH an adverse agency determination; 
prescribe fees which NEH will charge for copying records; and establish 
exemptions from certain requirements of the Privacy Act for certain NEH 
systems of records or parts thereof.


Sec.  1169.2  Definitions.

    The definitions of the Privacy Act apply to this part. In addition, 
as used in this part:
    Agency means any executive department, military department, 
Government corporation, or other

[[Page 34790]]

establishment in the executive branch of the Federal government, 
including the Executive Office of the President or any independent 
regulatory agency.
    Business day means a calendar day, excluding Saturdays, Sundays, 
and legal public holidays.
    Chairperson means the Chairperson of NEH, or his or her designee.
    General Counsel means the General Counsel of NEH, or his or her 
designee;
    Individual means any citizen of the United States or an alien 
lawfully admitted for permanent residence.
    Maintain means to collect, use, store, or disseminate records, as 
well as any combination of these recordkeeping functions. The term also 
includes exercise of control over and, therefore, responsibility and 
accountability for, systems of records.
    NEH means the National Endowment for the Humanities.
    NEH system means a system of records maintained by NEH.
    Privacy Act means the Privacy Act of 1974, as amended (5 U.S.C. 
552a).
    Record means any item, collection, or grouping of information about 
an individual, including, but not limited to, information regarding an 
individual's education, financial transactions, medical history, and 
criminal or employment history and that contains the individual's name 
or another identifying particular, such as a number or symbol assigned 
to the individual, or his or her fingerprints, voice print, or 
photograph.
    Routine use means, with respect to disclosure of a record, the use 
of a record for a purpose that is compatible with the purpose for which 
it was collected.
    System of records means a group of records under the control of NEH 
from which NEH retrieves information by use of an individual's name or 
by some number, symbol, or other identifying particular assigned to an 
individual.


Sec.  1169.3  Inquiries about NEH's systems of records or 
implementation of the Privacy Act.

    Inquiries about NEH's systems of records or implementation of the 
Privacy Act should be sent by email to [email protected] or by mail to 
the following address: National Endowment for the Humanities, Office of 
the General Counsel, 400 Seventh Street SW, Room 4060, Washington, DC 
20506.


Sec.  1169.4  Procedures for determining if an individual is the 
subject of an NEH record.

    (a) NEH has published notice of its systems of records in the 
Federal Register and also has made such information available on the 
privacy program page of the NEH website. Any individual desiring to 
know whether a specific system of records contains a record pertaining 
to him or her should address such inquiries in writing to the Office of 
the General Counsel at the email or physical address identified in 
Sec.  1169.3.
    (b) The written inquiry described in Sec.  1169.4(a) should refer 
to the specific system or systems of records listed in the NEH Notice 
of Systems of Records, or describe the type of record in sufficient 
detail reasonably to identify the relevant system of records.
    (c) At a minimum, the request should contain sufficient identifying 
information to allow NEH to determine if there is a record pertaining 
to the individual making the request in a particular system of records. 
NEH reserves the right to solicit from an individual submitting such 
inquiry proof of identification, depending upon the sensitivity of the 
request.
    (d) NEH will attempt to respond to an inquiry regarding whether a 
record exists within 10 business days of receiving the inquiry, or 10 
business days from the time any required identification is established, 
whichever is later. Such a response will contain or reference the 
procedures that the individual must follow in order to gain access to 
any such records.


Sec.  1169.5   Procedures for acquiring access to NEH records 
pertaining to an individual.

    (a) An individual may request access to his or her own records 
contained within an NEH system of records by writing to the Office of 
the General Counsel at the email or physical address identified in 
Sec.  1169.3. The individual making the request should include his or 
her full name, address, email address, and telephone number. The 
individual making the request should also specifically indicate whether 
he or she wishes to review such records in person.
    (b) The request for access to a record within a system of records 
should refer to the specific system or systems of records listed in the 
NEH Notice of Systems of Records within which NEH may retrieve the 
individual's records, or describe the type of record in sufficient 
detail such that NEH may reasonably identify the relevant system of 
records. The request should further state that it is made pursuant to 
the Privacy Act. In addition, the request should include any other 
information which may permit NEH to identify the record for which 
access is being requested, such as maiden name, dates of employment, 
etc.
    (c) Where an individual requests records pertaining to himself or 
herself, NEH will process such request under both these regulations and 
NEH's regulations implementing the Freedom of Information Act 
(``FOIA''), set forth in 45 CFR part 1171, so as to provide the 
greatest degree of lawful access.
    (d) Upon receipt of any such request, NEH will determine whether 
the records identified by the requester exist and whether they are 
subject to any exemption under Sec.  1169.10. Should NEH determine that 
the records are releasable under the Privacy Act and these regulations, 
and upon verifying the individual's identity per Sec.  1169.6, NEH will 
provide access to copies of the records by transmitting them to the 
requester at the mailing or email address provided by the requester, or 
by permitting the requester to inspect the records at NEH's offices 
should the requester ask for in-person inspection or where the 
requester is a current NEH employee.
    (e) NEH will acknowledge a request for access as soon as 
practicable, and in no event in less than 5 business days. Consistent 
with the agency's FOIA regulations, NEH will otherwise substantively 
answer a request for access in no less than 20 business days, except 
when NEH determines otherwise, in which case NEH will inform the person 
making the request of the reasons for the delay and the estimated date 
by which NEH will answer the request. When NEH can answer the request 
within 20 business days, the response shall include the following:
    (1) A statement that there is no record as requested or a statement 
that there is no such record in the systems of records maintained by 
NEH;
    (2) A statement as to whether NEH will grant access by providing a 
copy of the record through the mail or email; or, where an individual 
requests in-person inspection, the address of the location and the date 
and time at which the record may be examined. In the event the person 
requesting access is unable to meet the specified date and time, he or 
she may make alternative arrangements with NEH;
    (3) The amount of fees charged, if any (see Sec.  1169.9);
    (4) Any documentation required by NEH to verify the identity of the 
person making the request.
    (f) NEH will provide only one copy of each requested record, based 
on the fee schedule in Sec.  1169.9.
    (g) Per 5 U.S.C. 552a(h), a parent of a minor, upon presenting 
suitable personal identification, may act on behalf of the minor to 
gain access to any record pertaining to the minor maintained by NEH in 
a system of

[[Page 34791]]

records. A legal guardian may similarly act on behalf of an individual 
declared to be incompetent due to physical or mental incapacity or age 
by a court of competent jurisdiction, upon the presentation of the 
documents authorizing the legal guardian to so act, and upon suitable 
personal identification of the guardian.
    (h) In the event NEH gains access to a record by permitting in-
person inspection, the individual to which the record pertains may be 
accompanied by a person of his or her choice to review the record. 
Under such circumstances, NEH may require that the individual who is 
the subject of the record furnish a written statement authorizing 
discussion of the record in the accompanying person's presence.
    (i) In accordance with this provision, NEH will disclose medical or 
psychological records pertaining to an individual to whom they pertain 
unless NEH determines, in consultation with a physician, that 
disclosure of such records might adversely affect the individual to 
whom they pertain. Under these circumstances, NEH will disclose this 
information to a licensed physician designated by such individual in 
writing.


Sec.  1169.6  Identification required when requesting access to NEH 
records pertaining to an individual.

    (a) Before granting access to personal information under the 
Privacy Act, NEH may require that the individual requesting such access 
provide reasonable proof of his or her identity.
    (b) Except in the case of NEH employees and those individuals who 
request in-person inspection, NEH generally will endeavor to provide 
access to records via mail or email. In such instances, NEH will first 
confirm that the physical and/or email addresses provided by the 
requester match those contained with the NEH system of records. 
Depending upon the sensitivity of the records requested, and whether 
the addresses match as described in the preceding sentence, NEH may 
also request that the individual verify his or her identity by 
providing certain minimum identifying data, such as date or place of 
birth and/or copies of a valid driver's license or passport. Where the 
information sought is of a particularly sensitive nature, and/or where 
the individual cannot provide minimum identifying data, NEH may require 
that the individual seeking access submit a notarized statement of 
identity or a signed statement asserting and acknowledging that 
knowingly or willfully seeking or obtaining access to records about 
another person under false pretenses may result in a fine of up to 
$5,000.
    (c) NEH will provide access by in-person examination to NEH 
employees as well as to individuals who specifically request disclosure 
in person. In such instances, the individual requesting disclosure may 
prove identity by producing an employee identification card, driver's 
license, or other license, permit or pass used for routine 
identification purposes. If the individual is unable to provide 
suitable documentation or identification, NEH may require that he or 
she stipulate, in writing, that knowingly or willingly seeking or 
obtaining access to records about another person under false pretenses 
is punishable by a fine of up to $5,000.
    (d) Identity verification procedures shall not:
    (1) Be so complicated as to discourage unnecessarily individuals 
from seeking access to information about themselves;
    (2) Be required of an individual seeking access to records that 
normally would be available under FOIA (see 45 CFR part 1171);
    (3) Require, as a condition to access, the provision of a social 
security number, unless a social security number is the only means by 
which NEH may retrieve the records that are the subject of the request.
    (4) Require that the individual explain or justify his or her need 
for access to any record under this part.


Sec.  1169.7  Procedures for amending or correcting an individual's NEH 
record.

    (a) Individuals are entitled to request amendments or corrections 
of records pertaining to themselves pursuant to 5 U.S.C. 552a(d)(2). 
Normally, amendments to this part are limited to correcting factual 
matters and not matters of official judgment, such as grant proposal 
evaluations, performance ratings, promotion potential, and job 
performance appraisals. An individual seeking action under this 
provision bears the burden of demonstrating to NEH that a record should 
be amended or corrected.
    (b) Individuals may request the amendment of records pertaining to 
themselves by submitting a letter in writing to the NEH Office of the 
General Counsel at the email or physical address identified in Sec.  
1169.3. Such letter shall include the following information:
    (1) Identification of the particular record to be amended or 
corrected;
    (2) The NEH system from which the record was retrieved;
    (3) The precise correction or amendment sought, preferably in the 
form of an edited copy of the record reflecting the desired 
modification;
    (4) Reasons for requesting amendment or correction of the record, 
including copies of available documentary evidence supporting the 
request, where applicable.
    (c) NEH will acknowledge a request for amendment or correction as 
soon as practicable, and in no event less than 5 business days.
    (d) When NEH has previously verified the individual's identity 
pursuant to Sec. Sec.  1169.6(b) or 1169.6(c), it will not require 
further verification of identity so long as the request for amendment 
or correction does not suggest a need for additional verification. If 
NEH has not previously verified the individual's identity, it may 
require that the individual validate his or her identity as described 
in Sec. Sec.  1169.6(b) or 1169(c).
    (e) To the extent possible, NEH will render a decision upon a 
request to amend a record no less than 20 business days after receiving 
such a request. In the event NEH cannot render a decision within that 
time frame, it will so inform the individual who made the request and 
provide an expected date for a decision. Any such decision will include 
the following information:
    (1) NEH's decision whether to grant in whole, or deny any part of, 
the request to amend or correct the record;
    (2) The reasons for the determination for any portion of the 
request which is denied;
    (3) A statement that any denial may be appealed pursuant to the 
procedures set forth in Sec.  1169.8; and
    (4) The name and address of the official to whom an individual may 
submit an appeal of denial.
    (f) NEH will forward requests to amend or correct a record governed 
by the regulations of another agency to such agency for processing, and 
inform the person who submitted such request in writing of its 
referral.


Sec.  1169.8  The appeals process.

    (a) An individual whose request for access to, or correction or 
amendment of, a record is initially denied by NEH and who wishes to 
appeal that denial may do so by sending a letter within 90 days of 
receipt of the initial denial to the Chairperson. If an appeal concerns 
records retrieved from the OIG's Investigative Files, the OIG will act 
on the appeal and will carry out all responsibilities with respect to 
Privacy Act appeals otherwise assigned to the Chairperson under this 
section.
    (b) The appeal letter must:
    (1) Specify the records subject to the appeal;
    (2) Include the information specified in Sec.  1169.7(b);

[[Page 34792]]

    (3) Include copies of the correspondence from NEH in which it 
initially denied the request for access, or for amendment or 
correction; and
    (4) Explain why NEH's denial of access, amendment or correction was 
erroneous.
    (b) Appeals should be directed to the NEH Office of the General 
Counsel at the physical address or email address identified in Sec.  
1169.3. The Office of the General Counsel will refer the appeal letter 
to the Chairperson (or his or his or her designee), or in the case of 
records retrieved from NEH's OIG Investigative Files, will refer the 
appeal letter to the NEH OIG.
    (c) The Chairperson will review the initial request for access to, 
or amendment or correction of, the record, NEH's refusal, and any other 
pertinent material relating to the appeal. NEH will not hold a hearing 
on the appeal.
    (d) The Chairperson will render a final decision on the appeal 
within 30 business days of its receipt by NEH, unless the Chairperson, 
for good cause shown, extends the 30-day period. Should the Chairperson 
extend the 30-day period, NEH will inform the requester of the 
extension and the circumstances of the delay.
    (e) In conducting appeals under this provision, the Chairperson 
will be guided by the requirements of 5 U.S.C. 552a(e)(1) and (e)(5).
    (f) NEH will notify a requester, in writing, when the Chairperson 
determines to grant an appeal in whole or in part, and will grant the 
requester access to his or her record, or correct or amend the record, 
in accordance with the Chairperson's determination.
    (g) When the Chairperson determines to deny an appeal, in whole or 
in part, NEH will notify the requester in writing of the following:
    (1) The basis for the decision;
    (2) That the requester may submit to NEH a concise statement 
setting forth the reasons for disagreeing with NEH's decision.
    (3) The procedures for filing such statement of disagreement.
    (4) That, in a case where the Chairperson refuses a request to 
amend or correct a record, NEH will make such statements of 
disagreement available in subsequent disclosures of the record, 
together with a statement from NEH (if deemed appropriate) summarizing 
the agency's refusal.
    (5) The requester's right to seek judicial review under 5 U.S.C. 
552a(g)(1)(a).


Sec.  1169.9  Fees charged to locate, review, or copy records.

    (a) NEH will not charge fees for the search or review of requested 
records, or the amendment or correction of records.
    (b) NEH will not charge fees for providing the first copy of a 
record or any portion of a record to whom the record pertains. NEH will 
otherwise charge copying fees at the same rate, and using the same 
procedures, that NEH has established for FOIA requests.


Sec.  1169.10  NEH systems of records that are covered by exemptions 
under the Privacy Act.

    (a) Pursuant to and limited by 5 U.S.C. 552a(j)(2), the NEH system 
entitled ``Office of the Inspector General Investigative Files'' shall 
be exempted from the provisions of 5 U.S.C. 552a, except for 
subsections (b); (c)(1) and (2); (e)(4)(A) through (F); (e)(6), (7), 
(9), (10), and (11); and (i), insofar as that NEH system contains 
information pertaining to criminal law enforcement investigations. NEH 
has implemented this exemption because application of these provisions 
of the Privacy Act might alert investigation subjects to the existence 
or scope of investigations; lead to suppression, alteration, 
fabrication, or destruction of evidence; disclose investigative 
techniques or procedures; reduce the cooperativeness or safety of 
witnesses; or otherwise impair investigations.
    (b) Pursuant to and limited by 5 U.S.C. 552a(k)(2), the NEH system 
entitled ``Office of the Inspector General Investigative Files'' shall 
be exempted from 5 U.S.C. 552a(c)(3); (d); (e)(1); (e)(4)(G), (H), and 
(I); and (f), insofar as that NEH system consists of investigatory 
material compiled for law enforcement purposes, other than material 
within the scope of the exemption at 5 U.S.C. 552a(j)(2).
    (c) Pursuant to and limited by 5 U.S.C. 552a(k)(5), the NEH system 
entitled ``Grants and Cooperative Agreements: Electronic Grant 
Management System'' shall be exempted from 5 U.S.C. 552a(c)(3); (d); 
(e)(1); (e)(4)(G), (H), and (I); and (f), insofar as that NEH system 
consists of materials which would reveal the identity of references for 
fellowship or grant applicants.
    (d) Records on applicants for employment at NEH are covered by the 
Office of Personnel Management government-wide system notice 
``Recruiting, Examining, and Placement Records.'' These records are 
exempted as claimed in 5 CFR 297.501(b)(7).
    (e) Pursuant to 5 U.S.C. 552a(d)(5), nothing within these 
regulations shall allow an individual access to any information 
compiled in reasonable anticipation of a civil action or proceeding.
    (f) NEH may also assert exemptions for records received from 
another agency that could properly be claimed by that agency in 
responding to a request.


Sec.  1169.11  Penalties for obtaining an NEH record under false 
pretenses.

    Under 5 U.S.C. 552a(i)(3), any person who knowingly and willfully 
requests or obtains any record from NEH concerning an individual under 
false pretenses shall be guilty of a misdemeanor and fined not more 
than $5,000.

    Dated: July 8, 2019.
Elizabeth Voyatzis,
Deputy General Counsel, National Endowment for the Humanities.
[FR Doc. 2019-14998 Filed 7-18-19; 8:45 am]
 BILLING CODE 7536-01-P