Privacy Act-NASA Regulations, 12147-12149 [2023-03772]

Agencies

• National Aeronautics and Space Administration

[Federal Register Volume 88, Number 38 (Monday, February 27, 2023)]
[Rules and Regulations]
[Pages 12147-12149]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-03772]



[[Page 12147]]

-----------------------------------------------------------------------

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

14 CFR Part 1212

[Document Number NASA-21-091; Docket Number-NASA-2021-0007]
RIN 2700-AE64


Privacy Act--NASA Regulations

AGENCY: National Aeronautics and Space Administration (NASA).

ACTION:  Direct final rule.

-----------------------------------------------------------------------

SUMMARY:  This direct final rule makes changes to NASA's rules 
governing implementation of the Privacy Act by providing for electronic 
access to records and, most significantly, exempting NASA's harassment 
investigative case files system of records notice (SORN) from specific 
subsections in the Privacy Act. The rule also makes several non-
substantive changes to correct titles and minor provide clarifications.

DATES: This rule is effective on April 28, 2023, unless adverse 
comments are received by March 29, 2023. If adverse comments are 
received, NASA will publish a timely withdrawal of the rule in the 
Federal Register.

ADDRESSES: Comments must be identified with RIN 2700-AE64 and may be 
sent to NASA via the Federal E-Rulemaking Portal: https://www.regulations.gov. Follow the online instructions for submitted 
comments. Please note that NASA will post all comments on the internet 
with changes, including any personal information provided.

FOR FURTHER INFORMATION CONTACT: Corey Portalatin-Berrien, Office of 
the Chief Information Officer, 202-358-4787.

SUPPLEMENTARY INFORMATION: 

Background

    Part 1212 establishes procedures for individuals to access their 
Privacy Act records and to request amendment of information in records 
concerning them. This rule was last published as a direct final rule in 
the Federal Register at 77 FR 60620, October 4, 2012, to make non-
substantive changes to NASA rules governing implementation of the 
Privacy Act by updating statute citations, position titles, 
terminology, and adjusting appellate responsibility for records held by 
the NASA Office of the Inspector General. However, correction to these 
amendments were published in the Federal Register at 78 FR 8963, 
February 7, 2013, to add the responsibility of NASA's Freedom of 
Information Act Office that processes request for individual records. 
NASA is currently amending the rule to make changes to provide for 
electronic access to records. Furthermore, NASA is exempting its system 
of records (SOR) for Harassment Report Case Files/NASA 10RCF, under 5 
U.S.C. 552a(k)(2) (k)(5) from the following subsections of the Privacy 
Act of 1974, 5 U.S.C. 552a:
     Subsection (c)(3) relating to access to the disclosure 
accounting.
     Subsection (d) relating to access to the records.
     Subsection (e)(1) relating to the type of information 
maintained in the records.
     Subsections (e)(4)(G), (H) and (I) relating to publishing 
in the annual system notice information as to agency procedures for 
access and correction and information as to the categories of sources 
of records.
     Subsection (f) relating to developing agency rules for 
gaining access and making corrections.
    The determination to exempt these records was made because it is 
necessary for NASA to continue to investigate violations of law, 
regulation, and policy and also to determine continue suitability for 
Federal employment. In accordance with Federal anti-discrimination 
laws, the Equal Employment Opportunity Commission (EEOC) requires that 
all Federal agencies have an Antiharassment policy and program. NASA's 
specific policy prohibits harassment by all employees, provides an 
avenue for individuals to report allegations of harassment, and a 
process by which NASA fact-finders conduct inquiries/investigations. 
Furthermore, NASA's policy prohibits retaliation against individuals 
for raising allegations of harassment or participating in the process. 
In order for NASA to promptly address and resolve potential violations 
of law, regulation, or NASA policy, individuals who are participating 
in this process must be assured that their statements will be kept 
confidential consistent with law. Some investigations have been 
hindered by witnesses' lack of willingness to come forward fearful that 
their statements or identities would be revealed. Other agencies, 
including the EEOC, have exempted these records from certain provisions 
of the Privacy Act.
    This SORN relies on multiple legal authorities to support exempting 
these records under 5 U.S.C. 552a(K)(2) and (K)(5), including, NASA's 
Antiharassment Policy, which states that NASA has an affirmative 
obligation to maintain a harassment-free workplace and to take prompt 
and effective action when allegations arise. NASA's policy encourages 
all employees to report concerns and for NASA to address such conduct 
before it becomes ``severe or pervasive'' within the meaning of the 
anti-discrimination laws. Additional authoritative sources include the 
EEOC, anti-discrimination laws, and Supreme Court precedent that 
require agencies to take prompt and effective action if an individual 
is alleging harassment by a NASA employee. Additionally, the 
investigatory material compiled by this system of records may be used 
to determine a putative harasser's suitability for continued NASA 
employment and such records would be exempt from release under certain 
provisions of the Privacy Act but only in cases where the disclosure of 
such information would reveal the identity of a source who provided 
information to NASA under the condition of anonymity.
    Non-substantive changes will also be made to correct typos and 
titles and provide clarity.

Direct Final Rule Adverse Comments

    NASA has determined this rulemaking meets the criteria for a direct 
final rule because it involves two substantive changes, one to address 
electronic access to records as required by Creating Advanced 
Streamlined Electronic Services for Constituents Act of 2019; the 
second to add an exemption for an Agency system of records. No 
opposition to the changes and no significant adverse comments are 
expected. However, if the Agency receives a significant adverse 
comment, it will withdraw this direct final rule by publishing a 
document in the Federal Register. A significant adverse comment is one 
that explains: (1) why the direct final rule is inappropriate, 
including challenges to the rule's underlying premise or approach; or 
(2) why the direct final rule will be ineffective or unacceptable 
without a change. In determining whether a comment necessitates 
withdrawal of this direct final rule, NASA will consider whether it 
warrants a substantive response in a notice and comment process.

Statutory Authority

    The National Aeronautics and Space Act (the Space Act), 51 U.S.C. 
20101(a), authorizes the NASA Administrator to make, promulgate, issue, 
rescind, and amend rules and regulations governing the manner of its 
operations and the exercise of the powers vested in it by law.

[[Page 12148]]

Regulatory Analysis

Executive Order 12866, Regulatory Planning and Review and Executive 
Order 13563, Improvement Regulation and Regulation Review

    Executive Orders 13563 and 12866 direct agencies to assess all 
costs and benefits of available regulatory alternatives and, if 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, distributive impacts, and equity). Executive 
Order 13563 emphasizes the importance of quantifying both costs and 
benefits, of reducing costs, of harmonizing rules, and of promoting 
flexibility. This rule has been designated as ``administrative'' under 
section 3(f) of Executive Order 12866. Accordingly, the rule has been 
reviewed by the Office of Management and Budget.

Review Under the Regulatory Flexibility Act

    The Regulatory Flexibility Act (5 U.S.C. 601 et seq.) requires an 
agency to prepare an initial regulatory flexibility analysis to be 
published at the time the proposed rule is published. This requirement 
does not apply if the agency ``certifies that the rule will not, if 
promulgated, have a significant economic impact on a substantial number 
of small entities'' (5 U.S.C. 603). This rule does not have any 
economic impact on small entities.

Review Under the Paperwork Reduction Act

    This direct final rule does not contain any information collection 
requirements subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 
3501 et seq.).

Review Under Executive Order of 13132

    Executive Order 13132, ``Federalism,'' 64 FR 43255 (August 4, 
1999), requires regulations be reviewed for federalism effects on the 
institutional interest of states and local governments, and, if the 
effects are sufficiently substantial, preparation of the Federal 
assessment is required to assist senior policy makers. The amendments 
will not have any direct effects on state and local governments within 
the meaning of the Executive order. Therefore, no federalism assessment 
is required.

List of Subjects in 14 CFR Part 1212

    Privacy, Procedural rules.

    For reasons discussed in the preamble, NASA amends 14 CFR part 1212 
as follows:

PART 1212--PRIVACY ACT--NASA REGULATIONS

0
1. The authority citation for part 1212 continues to read as follows:

    Authority:  51 U.S.C. 20101 et seq.; 5 U.S.C. 552a; Pub. L. 115-
59, 131 Stat. 1152 (42 U.S.C. 405 note).

Subpart 1212.2--Requests for Access to Records

0
2. Revise Sec.  1212.201 to read as follows:


Sec.  1212.201  Requesting a record.

    (a) Individuals may request access to their Privacy Act records, 
either in person, in writing, or electronically.
    (b) Individuals may also authorize a third party to have access to 
their Privacy Act records. This authorization shall be in writing, 
signed by the individual, or submitted electronically. Requests must 
contain the individual's address or email address, as well as the name, 
address or email address of the representative being authorized access. 
The identities of both the subject individual and the representative 
must be verified in accordance with the procedures set forth in Sec.  
1212.202.
    (c)(1) In-person or written requests must be directed to the 
appropriate system manager, or, if unknown, to the Center Privacy 
Manager or Freedom of Information Act (FOIA) Office at NASA 
Headquarters or Field Center. The request should be identified clearly 
on the envelope and on the letter as a ``Request Under the Privacy 
Act.''
    (2) Electronic requests may be initiated online at https://www.nasa.gov/about/highlights/HP_Privacy.html.
    (3) Where possible, requests should contain the following 
information to ensure timely processing:
    (i) Name and address of subject.
    (ii) Email address of subject, for electronic requests only.
    (iii) Identity of the system of records.
    (iv) Nature of the request.
    (v) Identifying information specified in the applicable system 
notice to assist in identifying the request, such as location of the 
record, if known, full name, birth date, time periods in which the 
records are believed to have been compiled, etc.
    (d) NASA has no obligation to comply with a nonspecific request for 
access to information concerning an individual, e.g., a request to 
provide copies of ``all information contained in your files concerning 
me,'' although a good faith effort will be made to locate records if 
there is reason to believe NASA has records on the individual. If the 
request is so incomplete or incomprehensible that the requested record 
cannot be identified, additional information or clarification will be 
requested in the acknowledgement, and assistance to the individual will 
be offered as appropriate.
    (e) If the Center Privacy Manager receives a request for access, 
the Privacy Manager will record the date of receipt and immediately 
forward the request to the responsible system manager for handling.
    (f) If the Center FOIA Office receives a first party request for 
records or access, the FOIA Office will process the request under the 
Privacy Act pursuant to this part.
    (g) Normally, the system manager shall respond to a request for 
access within 10 business days of receipt of the request and the access 
shall be provided within 30 business days of receipt.
    (1) In response to a request for access, the system manager or 
Privacy Act Officer shall:
    (i) Notify the requester that there is no record on the individual 
in the system of records and inform the requester of the procedures to 
follow for appeal (see Sec.  1212.4);
    (ii) Notify the requester that the record is exempt from 
disclosure, cite the appropriate exemption, and inform the requester of 
the procedures to follow for appeal (see Sec.  1212.4);
    (iii) Upon request, promptly provide copies of the record, subject 
to the fee requirements (see Sec.  1212.204); or
    (iv) Make the individual's record available for personal inspection 
in the presence of a NASA representative.
    (2) Unless the system manager agrees to another location, personal 
inspection of the record shall be at the location of the record as 
identified in the system notice.
    (3) When an individual requests records in a system of records 
maintained on a third party, the request shall be processed as a FOIA 
request under 14 CFR part 1206. If the records requested are subject to 
release under FOIA (5 U.S.C. 552(b)), then a Privacy Act exemption may 
not be invoked to deny access.
    (4) When an individual requests records in a system of records 
maintained on the individual, the request shall be processed under this 
part. NASA will not rely on exemptions contained in FOIA to withhold 
any record which is otherwise accessible to the individual under this 
part.

0
3. Revise Sec.  1212.202 to read as follows:

[[Page 12149]]

Sec.  1212.202  Identification procedures.

    (a) The system manager will release records to the requester or 
representative in person only upon production of satisfactory 
identification which includes the individual's name, signature, and 
photograph or physical description.
    (b) The system manager will release records to the requester or 
representative electronically via a NASA provided temporary secure 
storage space, after the identities of both are validated by the 
Agency's identity authorization process.
    (c) The system manager will release copies of records by mail only 
when the circumstances indicate that the requester and the subject of 
the record are the same. The system manager may require that the 
requester's signature be notarized or witnessed by two individuals 
unrelated to the requester.
    (d) Identity procedures more stringent than those required in this 
section may be prescribed in the system notice when the records are 
medical or otherwise sensitive.


Sec.  1212.204  [Amended]

0
4. Amend Sec.  1212.204 in paragraph (b) by adding the words ``hard-
copy'' before the word ``duplication.''


Sec.  1212.205  [Amended]

0
5. Amend Sec.  1212.205 in paragraph (b) by removing the word 
``manages'' and adding in its place the word ``manager.''

Subpart 1212.4--Appeals and Related Matters


Sec.  1212.400  [Amended]

0
6. Amend Sec.  1212.400 in paragraphs (b), (c)(1), and (e) by removing 
the words ``Associate Deputy Administrator'' and adding in their place 
the words ``Associate Administrator.''

Subpart 1212.5--Exemptions to Individuals' Rights of Access


Sec.  1212.500  [Amended]

0
7. Amend Sec.  1212.500 in paragraph (b) by removing the words 
``Associate Deputy Administrator'' and adding in their place the words 
``Associate Administrator.''

0
8. Amend Sec.  1212.501 by adding paragraph (c) to read as follows:


Sec.  1212.501  Record systems determined to be exempt.

* * * * *
    (c) Harassment Report Case Files--(1) Sections of the Act from 
which exempted. Harassment Report Case Files records are exempt under 5 
U.S.C. 552a(k)(2) from the following sections of the Privacy Act (5 
U.S.C. 552a): subsection (c)(3) relating to access to the disclosure 
accounting; subsection (d) relating to access to the records; 
subsection (e)(1) relating to the type of information maintained in the 
records; subsections (e)(4)(G), (H), and (I) relating to publishing in 
the annual system notice information as to agency procedures for access 
and correction and information as to the categories of sources of 
records; and subsection (f) relating to developing agency rules for 
gaining access and making corrections.
    (2) Reason for exemption--(i) Subsection (c)(3). The release of the 
disclosure accounting to the individual who is the subject of the 
investigation/fact-finding would present a serious impediment to NASA's 
ability to conduct fact-findings into potential violations of law or 
policy.
    (ii) Subsection (d). Access to records contained in this system 
would inform the subject of an actual or potential investigation, of 
the existence of that investigation, of the nature and scope of the 
investigation, of the information and evidence obtained as to their 
activities, and of the identity of witnesses. Such access would impede 
a fact-finder/investigator's ability to freely investigate such cases, 
including concerns that some witnesses have been promised 
confidentiality and would not want their statements provided to the 
subject of the investigation. Amendment of the records would interfere 
with the ongoing fact-finding process.
    (iii) Subsection (e)(1). Under the provision of (e)(1), the agency 
must only maintain such information that is relevant and necessary. It 
is difficult to know during the course of an investigation what is 
relevant and necessary. In this connection, facts or evidence may not 
seem relevant at first, but later in the investigation, their relevance 
is borne out.
    (iv) Subsections (e)(4)(G) and (H). These subsections are 
inapplicable to the extent that these systems are exempt from the 
access provisions of subsection (d) and the rules provisions of 
subsection (f).
    (v) Subsection (e)(4)(I). The categories of sources of the records 
in these systems have been published in the Federal Register in broad 
generic terms in the belief that this is all that subsection (e)(4)(I) 
of the Act requires. In the event, however, that this subsection should 
be interpreted to require more detail as to the identity of sources of 
the records in this system, exemption from this provision is necessary 
to protect the confidentiality of the sources of criminal and related 
law enforcement information. Such exemption is further necessary to 
protect the privacy and physical safety of witnesses and informants.
    (vi) Subsection (f). Procedures for notice to an individual 
pursuant to subsection (f)(1) as to existence of records pertaining to 
the individual dealing with an actual or potential criminal, civil, or 
regulatory investigation or prosecution must be exempted because such 
notice to an individual would be detrimental to the successful conduct 
and/or completion of an investigation or case, pending or future. In 
addition, mere notice of the fact of an investigation could inform the 
subject or others that their activities are under investigation or may 
become the subject of an investigation and could enable the subjects to 
avoid detection, to influence witnesses improperly, to destroy 
evidence, or to fabricate testimony. Since an exemption is being 
claimed for subsection (d) of the Act, the rules required pursuant to 
subsections (f)(2) through (5) are inapplicable to these systems of 
records to the extent that these systems of records are exempted from 
subsection (d).
    (3) Determination. NASA has determined that the exemption of this 
system of records from subsections (c)(3), (d), (e)(1), (e)(4)(G), 
(e)(4)(H), (e)(4)(I), and (f) of the Privacy Act is necessary for the 
Agency's law enforcement efforts to address and eradicate harassment in 
its workplace.

Subpart 1212.7--NASA Authority and Responsibilities

0
9. Amend Sec.  1212.701 by revising the section heading and 
introductory text to read as follows:


Sec.  1212.701  Associate Administrator.

    The Associate Administrator is responsible for:
* * * * *


Sec.  1212.705  [Amended]

0
9. Amend Sec.  1212.705 in paragraph (a)(3) by removing the words 
``Associate Deputy Administrator'' and adding in their place the words 
``Associate Administrator.''

Nanette Smith,
Team Lead, NASA Directives and Regulations.
[FR Doc. 2023-03772 Filed 2-24-23; 8:45 am]
BILLING CODE 7510-13-P