The Interagency Council on Statistical Policy's Recommendation for a Standard Application Process (SAP) for Requesting Access to Certain Confidential Data Assets, 2459-2462 [2022-00620]

Agencies

• Management and Budget Office

[Federal Register Volume 87, Number 10 (Friday, January 14, 2022)]
[Notices]
[Pages 2459-2462]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-00620]


-----------------------------------------------------------------------

OFFICE OF MANAGEMENT AND BUDGET


The Interagency Council on Statistical Policy's Recommendation 
for a Standard Application Process (SAP) for Requesting Access to 
Certain Confidential Data Assets

AGENCY: Office of Information and Regulatory Affairs, Office of 
Management and Budget, Executive Office of the President.

ACTION: Notice of solicitation of comments.

-----------------------------------------------------------------------

SUMMARY: As part of the implementation of the Foundations for Evidence-
Based Policymaking Act of 2018, the Office of Management and Budget 
(OMB) requests comments on the Interagency Council on Statistical 
Policy's recommendation for a Standard Application Process (SAP) for 
requesting access to certain confidential data assets. The SAP is to be 
a process through which agencies, the Congressional Budget Office, 
State, local, and Tribal governments, researchers, and other 
individuals, as appropriate, may apply to access confidential data 
assets accessed or acquired by a statistical agency or unit for the 
purposes of developing evidence. This new process would be implemented 
while maintaining stringent controls to protect confidentiality and 
privacy, as required by the law.

DATES: To ensure consideration of comments on this Notice, comments 
must be provided in writing no later than 60 days from the publication 
date of this notice. Because of delays in the receipt of regular mail 
related to security screening, respondents are encouraged to send 
comments electronically (see ADDRESSES, below).

ADDRESSES: Comments may be sent via www.regulations.gov--a Federal E-
Government website that allows the public to find, review, and submit 
comments on documents that agencies have published in the Federal 
Register and that are open for comment. Simply type ``OMB-2022-0001'' 
(in quotes) in the Comment or Submission search box, click Go, and 
follow the instructions for submitting comments. Comments received by 
the date specified above will be included as part of the official 
record.
    Comments submitted in response to this notice may be made available 
to the public and are subject to disclosure under the Freedom of 
Information Act. For this reason, please do not include in your 
comments information of a confidential nature, such as sensitive 
personal information or proprietary information. If you send an email 
comment, your email address will be automatically captured and included 
as part of the comment that is placed in the public docket; however, 
www.regulations.gov does include the option of commenting anonymously. 
Please note that responses to this public comment request containing 
any routine notice about the confidentiality of the communication will 
be treated as public comments that may be made available to the public 
notwithstanding the inclusion of the routine notice.
    Electronic Availability: Federal Register notices are available 
electronically at www.federalregister.gov/.

FOR FURTHER INFORMATION CONTACT: For information about this request for 
comments, contact Rochelle Martinez, OMB, 
[email protected], 9242 New Executive Office Building, 
725 17th St. NW, Washington, DC 20503, telephone (202) 395-5897.

SUPPLEMENTARY INFORMATION: OMB is issuing a request for comment under 
the Foundations for Evidence-Based Policymaking Act of 2018, Public Law 
115-435, 132 stat. 5529 (2019), hereafter referred to as the Evidence 
Act.
    Specifically, the Evidence Act requires OMB to establish a process 
through which agencies, the Congressional Budget Office, State, local, 
and Tribal governments, researchers, and other individuals, as 
appropriate, may apply for access to confidential data assets accessed 
or acquired by a statistical agency or unit.\1\ This new process would 
be implemented while maintaining stringent controls to protect 
confidentiality and privacy, as required by the law. In addition, under 
the Paperwork Reduction Act, the Interagency Council on Statistical 
Policy (ICSP) is to advise and assist the Director of OMB in 
coordinating the Federal statistical system and setting statistical 
policy.\2\ The ICSP is chaired by the Chief Statistician of the United 
States and membership includes the heads of the 13 recognized 
statistical agencies, or in the case of an agency that does not have a 
statistical agency or unit, the agency's Statistical Official.\3\
---------------------------------------------------------------------------

    \1\ 44 U.S.C. 3583(a). ``Statistical agencies or units'' are 
those agencies or organizational units designated by the Director of 
OMB pursuant to 44 U.S.C. 3562(a).
    \2\ 44 U.S.C. 3504(e).
    \3\ 5 U.S.C. 314.
---------------------------------------------------------------------------

    In that capacity, and in order for the statistical system to comply 
with this Evidence Act requirement, the ICSP submitted a set of 
recommendations to OMB for a policy that would establish a standard 
application process (SAP) for requesting access to certain confidential 
data assets accessed or acquired by designated statistical agencies and 
units.
    OMB's Office of the Chief Statistician, within the Office of 
Information and Regulatory Affairs (OIRA), relies on public comment and 
subject matter expertise across the Federal government when 
establishing OMB policies or guidance for efficient coordination of 
Federal statistics. Accordingly, OMB is seeking public comment on the 
ICSP's recommendations.

Applicability

    The proposed policy would impose requirements on all recognized

[[Page 2460]]

statistical agencies and units under 44 U.S.C. 3561(11) and 3562. As a 
result, all persons seeking access to data under U.S.C. 3583 would 
apply for such access under the requirements of this policy. At the 
time of this proposal, there are sixteen designated statistical 
agencies and units: Bureau of Economic Analysis (Department of 
Commerce); Bureau of Justice Statistics (Department of Justice); Bureau 
of Labor Statistics (Department of Labor); Bureau of Transportation 
Statistics (Department of Transportation); Census Bureau (Department of 
Commerce); Center for Behavioral Health Statistics and Quality, 
Substance Abuse and Mental Health Services Administration (Department 
of Health and Human Services); Economic Research Service (Department of 
Agriculture); Energy Information Administration (Department of Energy); 
Microeconomic Surveys Unit (Board of Directors of the Federal Reserve 
System); National Agricultural Statistical Service (Department of 
Agriculture); National Animal Health Monitoring System, Animal and 
Plant Health Inspection Service (Department of Agriculture); National 
Center for Education Statistics (Department of Education); National 
Center for Health Statistics (Department of Health and Human Services); 
National Center for Science and Engineering Statistics (National 
Science Foundation); Office of Research, Evaluation, and Statistics 
(Social Security Administration); and Statistics of Income Division 
(Department of the Treasury).
    In the future, if the Director of OMB recognizes an agency or 
organizational unit as a statistical agency or unit, then it would 
become subject to this policy and shall adopt the SAP.
    Under the proposal, other Executive branch agencies or 
organizational units may, at their discretion, and with the concurrence 
of the SAP Governance Body, utilize the SAP to accept applications for 
access to confidential data for the purpose of developing evidence. 
Agencies facilitate access to confidential data by enabling applicants 
to submit proposals through the SAP. When making use of the SAP to 
accept such proposals, it is proposed that an Agency must adopt and 
abide by the entirety of this policy for those data assets, including 
use of the data inventory, common application, review criteria, 
timelines, appeals process, progress tracking, and reporting, with 
appropriate exceptions for legal and regulatory requirements as allowed 
for in the proposed policy.

Background

    Data accessed or acquired by statistical agencies and units is 
vital for developing evidence on conditions, characteristics, and 
behaviors of the public and on the operations and outcomes of public 
programs and policies. This evidence can benefit the stakeholders in 
the programs, the broader public, and policymakers and program managers 
at the local, State, Tribal, and National levels. Some evidence may be 
built upon public versions of data that were initially collected under 
a statistical confidentiality protection statute, but where some type 
of disclosure limitation methods have been applied, such as the removal 
of Personal Identifying Information (PII) and aggregation of 
information, to prevent the risk of disclosing the identities of 
individuals. However, some evidence-building activities have long 
required or benefited greatly from the use of properly and strongly 
protected confidential data. Such uses are conducted in a manner that 
maintains the confidentiality of the data and the public trust.
    Again, these arrangements have long been established by contract or 
by entering into a special agreement, where a statistical agency or 
unit may allow approved individuals (hereafter, referred to as agents) 
to perform exclusively statistical activities on an approved project 
using confidential data, subject to appropriate control, supervision, 
and agreement to comply with all relevant legal provisions. CIPSEA 
authorizes data accessed or acquired by a statistical agency or unit 
under a pledge of confidentiality to be shared with such agents, and 
subjects such agents to the same fines and penalties, including 
potential criminal penalties, for willful and unauthorized disclosures 
as statistical agency or unit employees and officers. Such arrangements 
have been used successfully even prior to CIPSEA's enactment in 2002 
for the purpose of facilitating the generation of evidence.
    However, the process for an individual to become a designated agent 
authorized to access a confidential data asset for an approved 
statistical activity often varies across Federal statistical agencies. 
Moreover, the trusted status that agents obtain from one agency may not 
transfer to another agency, requiring the potential duplication of 
costly and time-consuming clearance processes. The variety of 
applications and clearance procedures used across the Federal 
statistical system for confidential data access potentially impacts the 
ability of agents to generate evidence that could inform the efficiency 
of government policies and programs, as well as the availability of 
evidence to inform non-Federal decision making. Evidence building 
opportunities would be enhanced, while maintaining data protections and 
ensuring appropriate use, by the design and construction of a standard 
application process (SAP) for access to confidential data.
    Recognizing this potential, in 2016, the U.S. Congress established 
the Commission on Evidence-Based Policymaking (CEP) to explore how to 
increase the availability and use of evidence in the Federal government 
while protecting privacy and confidentiality. In the September 7, 2017 
report on its findings, the CEP provided a series of recommendations in 
response to its charge. As part of its findings, the CEP highlighted 
the heterogeneity in application processes for confidential data as an 
important challenge for those seeking to access confidential data from 
multiple agencies to build evidence. The CEP further noted that 
``inefficiencies in the [confidential] data access processes create 
administrative expenses and researcher burdens that can impede 
Federally-funded research.'' \4\ Federally-funded research, while not 
the only type of research that would be supported by the SAP, today 
represents a large share of data-access demand.
---------------------------------------------------------------------------

    \4\ https://bipartisanpolicy.org/wp-content/uploads/2019/03/Full-Report-The-Promise-of-Evidence-Based-Policymaking-Report-of-the-Comission-on-Evidence-based-Policymaking.pdf.
---------------------------------------------------------------------------

    The CEP report directly influenced the Evidence Act. Informed by 
the findings of the CEP,\5\ the Evidence Act requires that the Director 
of OMB establish an SAP that will be adopted by statistical agencies 
and units and allow agencies, the Congressional Budget Office, State, 
local, and Tribal governments, researchers, and other individuals, as 
appropriate, to apply to access certain confidential data accessed or 
acquired by statistical agencies or units.\6\ Specifically, the 
Evidence Act requires that each statistical agency or unit establish an 
`identical' application process, which includes not just the 
application form but also the criteria for determining whether to grant 
an applicant access to the confidential data

[[Page 2461]]

asset, timeframes for prompt determinations, an appeals process for 
adverse determinations, and reporting requirements for full 
transparency. While the adoption of the SAP is required for statistical 
agencies and units recognized under CIPSEA, it is understood that other 
agencies and organizational units within the Executive branch may 
benefit from the adoption of the SAP to accept applications for access 
to confidential data assets available for the purpose of developing 
evidence.
---------------------------------------------------------------------------

    \5\ H.R. Rep No. 115-411 (2017).
    \6\ 44 U.S.C. 3583(a). Agencies, the Congressional Budget 
Office, State, local, and Tribal governments may, for the purposes 
of developing evidence, apply to access confidential data accessed 
or acquired by statistical agencies and units by applying for an 
employee(s) of those organizations to be designated as agents to 
conduct a specific statistical activity.
---------------------------------------------------------------------------

    In 2019, a subset of statistical agencies and units associated with 
the Federal Statistical Research Data Centers established a pilot 
project that provided researchers with a common, online application 
form and metadata inventory for requesting access to certain 
confidential data assets (www.researchdatagov.com). Two key lessons 
learned from the pilot were that the standard application process 
requires clear policy guidelines and a central capacity to guide 
implementation and standardization. As the number of participating 
agencies increases, as well as the complexity of the SAP program 
itself, a policy that guides decision making and establishes clear 
roles and responsibilities becomes increasingly important. Based on the 
pilot experience and subsequent, in 2021 OMB designated the Standard 
Application Process program as a government-wide shared service and 
established the role of Program Management Office (PMO) as a managing 
partner of the program.
    In order to provide needed guidance and recommendations, in 2020 
the ICSP established a subcommittee on the SAP. The subcommittee sought 
to build on the earlier pilot project and the lessons learned by 
engaging in outreach to researchers and data providers likely to use 
the SAP. Initial feedback from stakeholders had common themes. For 
example, stakeholders indicated that application processes are often 
long and cumbersome, that transparency of requirements and timely 
approvals are important, and that they would like to see more 
standardization of processes across agencies.
    Guided by the requirements of the Evidence Act and the stakeholder 
feedback, the ICSP SAP subcommittee drafted a policy for the 
establishment of an SAP. The draft policy went through multiple rounds 
of review by ICSP member agencies and units to ensure the requirements 
align with the requirements of Evidence Act, the additional statutory 
and regulatory requirements governing certain data assets or 
statistical agencies and units, and the practical conditions affecting 
an approved research project's lifecycle. In July 2021, the ICSP voted 
to send the draft policy to OMB as a recommendation for establishing an 
SAP consistent with the Evidence Act requirements.

Interagency Council on Statistical Policy Recommendation

    OMB seeks comment on this proposal. We have made a preliminary 
determination that the proposal also meets the requirements of the 
Evidence Act (44 U.S.C. 3583), and has the potential to reduce the 
burden to applicants while maintaining currently strong access and 
confidentiality protections.
    In summary, the application process begins with an applicant 
identifying a confidential data asset for which a statistical agency or 
unit is accepting applications for the purpose of developing evidence, 
and ends with the agency or unit's determination whether to grant 
access to the applicant. In the case of an adverse determination, the 
application process ends with the conclusion of an appeals process if 
the applicant elects to appeal the adverse determination. The scope of 
this proposal excludes decisions about the mode of access to 
confidential data or methods by which data are protected from 
unauthorized disclosure.\7\
---------------------------------------------------------------------------

    \7\ Those decisions fall within the scope of a regulation that 
OMB will promulgate under 44 U.S.C. 3582.
---------------------------------------------------------------------------

    The implementation of the proposed SAP would include an online 
portal that serves as the primary location for researchers and others 
seeking to identify and apply for access to confidential data available 
for evidence building purposes. The SAP Portal would include an SAP 
Data Inventory and searchable metadata on confidential data assets for 
which evidence-building applications are being accepted, and would be 
populated by statistical agencies and units. The goal of the policy is 
for the metadata to be sufficient to facilitate data identification and 
ensure that potential applicants can find and access adequate 
documentation on available data assets. The SAP Portal would also 
include a common application form that is standardized across 
statistical agencies and units and datasets, except where unique legal 
or regulatory requirements create a need for additional fields.
    Upon receipt of a completed application, statistical agencies and 
units would apply a common set of criteria when reviewing both the 
proposed project and the applicant. When reviewing a proposed project, 
statistical agencies and units would ensure that the data use is for 
exclusively statistical purposes; the use is allowed under relevant 
statutes, regulations, notices, agreements, and other requirements 
governing the use of the data; that appropriate statistical disclosure 
limitations could be applied to the relevant data; there is a 
demonstrated need for the data; the project is feasible; and the public 
trust can be maintained. When required by statute or regulation, 
statistical agencies or units may consider additional criteria as 
appropriate.
    The proposed policy would establish a set of four authorization 
levels that define the level of applicant review required. For example, 
Authorization Level 1 would require evaluation of the applicant's 
identity and completion of training, Authorization Level 2 would have 
the additional requirement of a non-disclosure or other agreement(s) to 
be completed, and Authorization Levels 3 and 4 would require two levels 
of background investigations. The authorization level required for an 
applicant would be determined by the data asset and mode of data access 
requested in the project proposal, and would be listed in the SAP Data 
Inventory itself. The authorization levels are generally consistent 
with current practices for given modes of data access. For example, 
Authorization Level 1 would be consistent with the level of access that 
is usually associated with indirect access to confidential data using a 
secure web-based query system and Authorization Level 4 would be 
consistent with practices at the Federal Statistical Research Data 
Centers.
    The timeline for review of applications would be standardized 
across statistical agencies and units under the proposal. For 
applications involving a single agency it is proposed that review of 
project should occur within twelve (12) weeks, and for applications 
involving requests for data access from multiple agencies the review 
should occur within twenty-four (24) weeks to allow for the additional 
complexity and coordination. Agencies who cannot meet the required 
timing would be able to seek an extension when appropriate. Requests 
that require the statistical agency or unit to obtain approval from 
entities not subject to the proposed policy are not subject to the 
timeframes. Under the proposal, review of applicants should occur no 
later than three (3) weeks after a project receives approval, unless 
the review requires a new background investigation.
    Upon receipt of an adverse determination, it is proposed that

[[Page 2462]]

applicants have the opportunity to appeal the decision to a review body 
within the statistical agency or unit, when the grounds for the adverse 
determination are under the control of the relevant statistical 
agencies or units. The result of the appeals process would be 
communicated with the applicant within eight (8) weeks of the appeal 
request submission. Under the proposal applicants would also have the 
opportunity to file an appeal of alleged noncompliance with the policy 
directly with the Chief Statistician at OMB, who would review the 
allegation and, if appropriate, take steps to facilitate compliance 
with the policy.\8\
---------------------------------------------------------------------------

    \8\ The proposal describes a procedural appeal, which would not 
extend to review of the substantive decision.
---------------------------------------------------------------------------

    The SAP Portal will provide applicants with up-to-date tracking of 
applications throughout the review process. The SAP Portal will also 
provide public reporting of key information with regard to the 
operation of the SAP, such as the review status and final determination 
for every project, as required by the Evidence Act.
    The full text of the ICSP policy recommendation may be found in the 
docket (OMB-2022-0001).

Desired Focus of Comments

    OMB is particularly interested in receiving comments on the 
specific areas of interest described below. To provide the most useful 
feedback, responders should read the SAP policy draft before addressing 
the posed questions. We also recommend that responses be concise, 
include citations if summarizing or depending on published work, and 
provide any links to related research. In addition, a fuller 
consideration of comments would be facilitated by clear identification 
of the question(s) being addressed. Each question provides a link to 
the related discussion within the policy draft. The full text of the 
ISCP SAP policy recommendations is available as a supplemental document 
on www.regulations.gov in docket number ``OMB-2022-0001''.
    OMB welcomes comment on any and all aspects of this policy. We have 
also identified specific areas of interest for comment, including:
    Metadata standards:
     To provide flexibility over time, the proposed policy 
would require the SAP Program Management Office (PMO) to develop and 
maintain a set of metadata standards subject to approval by the SAP 
Governance Body.
    1. Should key metadata elements be considered as part of the 
policy? If so, which?
    2. What are the key metadata elements that the PMO should consider 
in its development of the metadata standards?
    3. Would it be valuable for the metadata standards to comply with 
any other existing metadata standards? If so, which?
    Application windows:
     The proposed policy would allow each individual 
statistical agency or unit to establish their own time window during 
which applications will be accepted for a given data asset as a way to 
manage resource constraints. This approach is designed to maximize 
services from higher capacity statistical agencies, which have 
resources to keep an application window open all year in many cases, 
but at the potential expense of standardization across statistical 
agencies, because some lower capacity statistical agencies may not have 
the resources to review applications on a constant flow basis.
    4. How could this proposed approach be improved, if at all?
     If instead the policy were to require all agencies to 
align to a common fixed-length window, we believe that has the 
potential to lead to a decrease in availability for higher capacity 
agencies.
    5. How could this policy be implemented in a way that maximizes its 
usefulness? How could the following aspects help:
    i. Frequency of windows for accepting applications (e.g., annual, 
quarterly)?
    ii. Minimum number of days for accepting applications (e.g., 60 
days) for each window?
    iii. Alignment of acceptance windows across statistical agencies or 
products?
    iv. Any other features to assist applicants seeking data from 
multiple statistical agencies for a single project?
    Applicant evaluation:
     The proposed policy would introduce four standardized 
authorization levels and four standard review criteria against which 
applicant(s) will be evaluated. The authorization levels are designed 
to align generally with currently used access modes as described above. 
They will also need to align with accessibility levels to be defined in 
an upcoming OMB regulation required under 44 U.S.C. 3582. The standard 
review criteria would respond to the requirement for an explicit, 
consistent, and identical review process.
    6. Is the proposal an appropriate framework, and should it differ 
in any manner between Federal and non-Federal applicants? If not, what 
additional levels or criteria should guide the applicant review process 
to improve the efficiency of the SAP?
    Appeals process:
     The proposed policy would provide applicants the ability 
to file an appeal in the event their application receives a negative 
disposition. Under this process, the appeal is reviewed by three 
officials at the statistical agency or unit, including the statistical 
agency or unit head or delegate, and a consensus decision is required 
to reverse the original determination.
    7. What additional aspects should be considered to ensure that the 
process is fair, equitable, and transparent?
    8. How, if at all, should processes vary for applications that 
would use data from multiple agencies?
    Public reporting:
     The Evidence Act (44 U.S.C. 3583(a)(6)) requires public 
reporting on the status and disposition of each application to promote 
transparency.
    9. What additional information should be considered as part of the 
proposed public reporting requirements beyond what the proposal 
suggests?
    In addition, OMB welcomes more general comment on the merit of the 
proposed SAP both in technical terms and as statistical policy, 
including whether any elements should be modified in support of 
technical improvement or to improve statistical policy. The technical 
implications of the proposed SAP involve the feasibility, cost, and 
effectiveness of its structure and processes. The statistical policy 
implications relate to how well the proposed SAP supports the missions 
of statistical agencies and units by serving the information and 
research needs of policymakers and the public, while protecting the 
privacy and confidentiality of individuals who provide data.
    Authority: 44 U.S.C. 3583.

Shalanda D. Young,
Acting Director, Office of Management and Budget.
[FR Doc. 2022-00620 Filed 1-13-22; 8:45 am]
BILLING CODE 3110-01-P