Federal Register / Vol. 78, No. 163 / Thursday, August 22, 2013 / Proposed Rules 52117 

addressing an increased caseload within 

constrained resources while at the same 

time meeting the expectations of its 

external stakeholders.’’ In addition to 

Indiana University’s study of the 

Settlement Part program at the judges’ 

level, the Commission held a public 

meeting on August 30, 2012, to explore 

ways to enhance efficiency and 

effectiveness in resolving cases at the 

review level. During the public meeting, 

there were expert panelists and 

members of the public who spoke in 

favor of implementing an ADR program 

at the review level. 

In light of the success of the 

Settlement Part program at the judges’ 

level and the comments received at the 

public meeting, the Commission is 

considering creating an ADR program at 

the review level. At this stage, the 

Commission seeks public input on 

whether it should develop such a 

program and, if so, how the program 

should operate. 

Specifically, the Commission invites 

public comment on the following list of 

questions: 

1. Should the Commission develop an 

ADR program at the review level? 

a. Why or why not? 

b. Do parties have sufficient 

incentives at the review level to 

participate in ADR? What are the 

potential benefits of, and deterrents to, 

participation in the ADR program at the 

review level? 

c. What types of ADR processes 

should a potential program incorporate? 

2. If an ADR program is developed, 

should certain types of cases be 

included or excluded, and how should 

eligibility for ADR at the review level be 

determined? 

a. Should placement into ADR be 

decided by a Commission vote? 

b. Should participation in an ADR 

program be mandatory or voluntary? 

c. Should the Commission evaluate 

cases for participation in the ADR 

program at the review level based on 

any criteria, such as the total dollar 

amount of penalties, the number of 

citation items, the characterization of 

violations, or any other issues? 

d. Regarding cases where the parties 

participated in the Settlement Part 

program at the trial level, should the 

Commission use different criteria when 

considering these cases for participation 

in the ADR program at the review level? 

If these cases are placed into ADR at the 

review level, should they be treated 

differently in any way? 

e. Is ADR appropriate for cases with 

pro se parties? If so, should the 

Commission offer any assistance or 

guidance to pro se parties in the ADR 

process? 

3. When should the ADR process 

begin? 

a. Should the process begin before or 

after the Commission issues a briefing 

notice? 

b. If ADR begins after issuance of a 

briefing notice when parties know what 

issues the Commission is most 

interested in, should briefing be 

suspended during the ADR process so 

that the parties may avoid briefing 

costs? 

c. Should an ADR program allow 

flexibility as to when the process starts 

in each case? 

4. Where should dispute resolution 

proceedings be held? 

5. Should telephone or video 

conferencing be an option for ADR 

discussions? If so, should its use be 

limited to certain circumstances? 

6. Who should the Commission select 

to serve as potential third-party 

neutrals? 

a. In addition to possessing ADR 

training and skills, would third-party 

neutrals benefit from having subject 

matter expertise in OSH law or other 

related fields such as labor law? If so, 

should third-party neutrals be required 

to have such expertise? 

b. Should the Commission use its own 

employees as third-party neutrals if they 

are excluded from any subsequent 

involvement in cases they participate in 

as third-party neutrals? 

c. Are there any reasons not to use 

former Commissioners, ALJs, or 

practitioners as third-party neutrals? 

d. Should the Commission seek out 

third-party neutrals from any other 

potential source, such as the Federal 

Mediation and Conciliation Service or 

regional federal court third-party neutral 

rosters? 

e. Should the parties be able to select 

the third-party neutral, or reject one the 

Commission selects? 

7. What responsibilities should a 

third-party neutral have? 

a. Should a third-party neutral be able 

to require parties to file pre-conference 

confidential statements? 

b. Should a third-party neutral have 

the power to suspend the ADR process 

and report any misconduct to the 

Commission, such as a party’s failure to 

be present at a scheduled ADR 

conference? Should the Commission 

consider any reported misconduct 

consistent with Commission Rule 101, 

29 CFR 2200.101 (Failure to obey rules)? 

c. Should a third-party neutral have 

the power to require that a 

representative for each party with full 

authority to resolve the case be present 

at an ADR conference? 

d. Should the third-party neutral 

require strict confidentiality of all ADR 

discussions and any other matters 

subject to a specific confidentiality 

agreement? 

8. Should a specified amount of time 

be allotted to the ADR process before a 

case is returned to conventional 

proceedings? 

a. Should a third-party neutral have 

the authority to make a request to the 

Commission to extend the timeframe for 

the ADR process? 

b. If so, should there be defined 

criteria for granting an extension and/or 

a specified limit to any extension? 

9. What other considerations should 

the Commission evaluate in determining 

whether to develop an ADR program at 

the review level? 

The Review Commission welcomes 

any other comments or suggestions 

regarding an ADR program at the 

Commission’s review level. 

Dated: August 19, 2013. 

John X. Cerveny, 

Deputy Executive Secretary. 

[FR Doc. 2013–20526 Filed 8–21–13; 8:45 am] 

BILLING CODE 7600–01–P 

DEPARTMENT OF DEFENSE 

Office of the Secretary 

32 CFR Part 310 

[Docket ID: DOD–2013–OS–0023] 

RIN 0790–AJ03 

DoD Privacy Program 

AGENCY: Director of Administration and 

Management, DoD. 

ACTION: Proposed rule; amendment. 

SUMMARY: This rule updates the 

established policies, guidance, and 

assigned responsibilities of the DoD 

Privacy Program pursuant to The 

Privacy Act and Office of Management 

and Budget (OMB) Circular No. A–130; 

authorizes the Defense Privacy Board 

and the Defense Data Integrity Board; 

prescribes uniform procedures for 

implementation of and compliance with 

the DoD Privacy Program; and delegates 

authorities and responsibilities for the 

effective administration of the DoD 

Privacy Program. 

DATES: Comments must be received by 

October 21, 2013. 

ADDRESSES: You may submit comments, 

identified by docket number and/or RIN 

number and title, by any of the 

following methods: 

• Federal Rulemaking Portal: http://

www.regulations.gov. Follow the 

instructions for submitting comments. 

• Mail: Federal Docket Management 

System Office, 4800 Mark Center Drive, 


tkelley on DSK3SPTVN1PROD with PROPOSALS
52118 Federal Register / Vol. 78, No. 163 / Thursday, August 22, 2013 / Proposed Rules 

East Tower, Suite 02G09, Alexandria 

VA 22350–3100. 

Instructions: All submissions received 

must include the agency name and 

docket number or Regulatory 

Information Number (RIN) for this 

Federal Register document. The general 

policy for comments and other 

submissions from members of the public 

is to make these submissions available 

for public viewing on the Internet at 

http://www.regulations.gov as they are 

received without change, including any 

personal identifiers or contact 

information. 

FOR FURTHER INFORMATION CONTACT: 

Samuel P. Jenkins, 703–571–0070. 

SUPPLEMENTARY INFORMATION: 

Executive Summary 

I. Purpose of the Regulatory Action 

a. The need for the regulatory action 

and how the action will meet that need. 

An individual’s privacy is a 

fundamental legal right that must be 

respected and protected. This regulatory 

action ensures that DoD’s need to 

collect, use, maintain, or disseminate 

personally identifiable information (PII) 

about individuals for purposes of 

discharging its statutory responsibilities 

will be balanced against their right to be 

protected against unwarranted privacy 

invasions. This regulatory action also 

describes the rules of conduct and 

responsibilities of DoD personnel DoD 

contractors, and DoD contractor 

personnel to ensure that any PII 

contained in a system of records that 

they access and use to conduct official 

business will be protected so that the 

security and confidentiality of the 

information is preserved. 

b. Succinct statement of legal 

authority for the regulatory action 

(explaining, in brief, the legal authority 

laid out later in the preamble). 

Authority: 5 U.S.C. 552a, OMB Circular 

No. A–130. 

II. Summary of the Major Provisions of 

the Regulatory Action in Question 

This rule: 

a. Establishes rules of conduct for 

DoD personnel and DoD contractors 

involved in the design, development, 

operation, or maintenance of any system 

of records. 

b. Establishes appropriate 

administrative, technical, and physical 

safeguards to ensure the security and 

confidentiality of records and to protect 

against any anticipated threats or 

hazards to their security or integrity that 

could result in substantial harm, 

embarrassment, inconvenience, or 

unfairness to any individual about 

whom information is maintained. 

c. Ensures that guidance, assistance, 

and subject matter expert support are 

provided to the combatant command 

privacy officers in the implementation 

and execution of and compliance with 

the DoD Privacy Program. 

d. Ensures that laws, policies, 

procedures, and systems for protecting 

individual privacy rights are 

implemented throughout DoD. 

III. Costs and Benefits 

This regulatory action imposes no 

monetary costs to the Agency or public. 

The benefit to the public is the accurate 

reflection of the Agency’s Privacy 

Program to ensure that policies and 

procedures are known to the public. The 

revisions to this rule are part of DoD’s 

retrospective plan under EO 13563 

completed in August 2011. DoD’s full 

plan can be accessed at http://exchange.

regulations.gov/exchange/topic/eo13563. 

Executive Order 12866, ‘‘Regulatory 

Planning and Review’’ and Executive 

Order 13563, ‘‘Improving Regulation 

and Regulatory Review’’ 

It has been certified that 32 CFR part 

310 does not: 

(1) Have an annual effect on the 

economy of $100 million or more or 

adversely affect in a material way the 

economy; a section of the economy; 

productivity; competition; jobs; the 

environment; public health or safety; or 

State, local, or tribal governments or 

communities; 

(2) Create a serious inconsistency or 

otherwise interfere with an action taken 

or planned by another Agency; 

(3) Materially alter the budgetary 

impact of entitlements, grants, user fees, 

or loan programs, or the rights and 

obligations of recipients thereof; or 

(4) Raise novel legal or policy issues 

arising out of legal mandates, the 

President’s priorities, or the principles 

set forth in these Executive Orders. 

Section 202, Public Law 104–4, 

‘‘Unfunded Mandates Reform Act’’ 

It has been certified that 32 CFR part 

310 does not contain a Federal mandate 

that may result in expenditure by State, 

local and tribal governments, in 

aggregate, or by the private sector, of 

$100 million or more in any one year. 

Public Law 96–354, ‘‘Regulatory 

Flexibility Act’’ (5 U.S.C. 601) 

It has been certified that 32 CFR part 

310 is not subject to the Regulatory 

Flexibility Act (5 U.S.C. 601) because it 

would not, if promulgated, have a 

significant economic impact on a 

substantial number of small entities. 

Public Law 96–511, ‘‘Paperwork 

Reduction Act’’ (44 U.S.C. Chapter 35) 

It has been certified that 32 CFR part 

310 does not impose reporting or 

recordkeeping requirements under the 

Paperwork Reduction Act of 1995. 

Executive Order 13132, ‘‘Federalism’’ 

It has been certified that 32 CFR part 

310 does not have federalism 

implications, as set forth in Executive 

Order 13132. This rule does not have 

substantial direct effects on: 

(1) The States; 

(2) The relationship between the 

National Government and the States; or 

(3) The distribution of power and 

responsibilities among the various 

levels of Government. 

List of Subjects in 32 CFR Part 310 

Privacy. 

Accordingly 32 CFR part 310 is 

proposed to be amended to read as 

follows: 

PART 310—[AMENDED] 

■ 1. The authority citation for 32 CFR 

part 310 is revised to read as follows: 

Authority: 5 U.S.C. 552a, OMB Circular 

No. A–130. 

■ 2. Section 310.2 is revised to read as 

follows: 

§ 310.2 Purpose. 

This part: 

(a) Updates the established policies, 

guidance, and assigned responsibilities 

of the DoD Privacy Program pursuant to 

5 U.S.C. 552a (also known and referred 

to in this part as ‘‘The Privacy Act’’) and 

Office of Management and Budget 

(OMB) Circular No. A–130. 

(b) Authorizes the Defense Privacy 

Board and the Defense Data Integrity 

Board. 

(c) Prescribes uniform procedures for 

implementation of and compliance with 

the DoD Privacy Program. 

(d) Delegates authorities and 

responsibilities for the effective 

administration of the DoD Privacy 

Program. 

■ 3. Section 310.3 is revised to read as 

follows: 

§ 310.3 Applicability and scope. 

(a) This part applies to the Office of 

the Secretary of Defense (OSD), the 

Military Departments, the Office of the 

Chairman of the Joint Chiefs of Staff and 

the Joint Staff, the combatant 

commands, the Office of the Inspector 

General of the Department of Defense, 

the Defense Agencies, the DoD Field 

Activities, and all other organizational 

entities within the DoD (referred to 


tkelley on DSK3SPTVN1PROD with PROPOSALS
Federal Register / Vol. 78, No. 163 / Thursday, August 22, 2013 / Proposed Rules 52119 

5See footnote 1 to § 310.1. 

collectively in this part as the ‘‘DoD 

Components’’). 

(b) For the purposes of subsection (i), 

Criminal penalties, of The Privacy Act, 

any DoD contractor and any employee 

of such a contractor will be considered 

to be an employee of DoD when DoD 

provides by a contract for the operation 

by or on behalf of DoD of a system of 

records to accomplish a DoD function. 

DoD will, consistent with its authority, 

cause the requirements of section (m) of 

The Privacy Act to be applied to such 

systems. 

■ 4. Section 310.4 is revised to read as 

follows: 

§ 310.4 Definitions. 

(a)Access. The review of a record or 

a copy of a record or parts thereof in a 

system of records by any individual. 

(b)Agency. For the purposes of 

disclosing records subject to the Privacy 

Act among the DoD Components, the 

Department of Defense is considered a 

single agency. For all other purposes to 

include requests for access and 

amendment, denial of access or 

amendment, appeals from denials, and 

record keeping as relating to release of 

records to non-DoD Agencies, each DoD 

Component is considered an agency 

within the meaning of the Privacy Act. 

(c) Breach. A loss of control, 

compromise, unauthorized disclosure, 

unauthorized acquisition, unauthorized 

access, or any similar term referring to 

situations where persons other than 

authorized users and for an other than 

authorized purpose have access or 

potential access to personally 

identifiable information (PII), whether 

physical or electronic. 

(d)Computer matching. The 

computerized comparison of two or 

more automated systems of records or a 

system of records with non-federal 

records. Manual comparisons are not 

covered. 

(e) Confidential source. A person or 

organization who has furnished 

information to the Federal Government 

under an express promise, if made on or 

after September 27, 1975, that the 

person’s or the organization’s identity 

shall be held in confidence or under an 

implied promise of such confidentiality 

if this implied promise was made on or 

before September 26, 1975. 

(f) Disclosure. The information 

sharing or transfer of any PII from a 

system of records by any means of 

communication (such as oral, written, 

electronic, mechanical, or actual review) 

to any person, government agency, or 

private entity other than the subject of 

the record, the subject’s designated 

agent, or the subject’s legal guardian. 

(g) DoD contractor. Any individual or 

other legal entity that: 

(1) Directly or indirectly (e.g., through 

an affiliate) submits offers for or is 

awarded, or reasonably may be expected 

to submit offers for or be awarded, a 

government contract, including a 

contract for carriage under government 

or commercial bills of lading, or a 

subcontract under a government 

contract; or 

(2) Conducts business, or reasonably 

may be expected to conduct business, 

with the federal government as an agent 

or representative of another contractor. 

(h) DoD personnel. Service members 

and federal civilian employees. 

(i) Federal benefit program. A 

program administered or funded by the 

Federal Government, or by any agent or 

State on behalf of the Federal 

Government, providing cash or in-kind 

assistance in the form of payments, 

grants, loans, or loan guarantees to 

individuals. 

(j) Federal personnel. Officers and 

employees of the Government of the 

United States, members of the 

uniformed services (including members 

of the Reserve Components), individuals 

entitled to receive immediate or 

deferred retirement benefits under any 

retirement program of the United States 

(including survivor benefits). 

(k) Individual. A living person who is 

a U.S. citizen or an alien lawfully 

admitted for permanent residence. The 

parent of a minor or the legal guardian 

of any individual also may act on behalf 

of an individual, except as otherwise 

provided in this part. Members of the 

Military Services are ‘‘individuals.’’ 

Corporations, partnerships, sole 

proprietorships, professional groups, 

businesses, whether incorporated or 

unincorporated, and other commercial 

entities are not ‘‘individuals’’ when 

acting in an entrepreneurial capacity 

with the DoD, but persons employed by 

such organizations or entities are 

‘‘individuals’’ when acting in a personal 

capacity (e.g., security clearances, 

entitlement to DoD privileges or 

benefits). 

(l) Individual access. Access to 

information pertaining to the individual 

by the individual or his or her 

designated agent or legal guardian. 

(m) Information sharing environment. 

Defined in Public Law 108–458, ‘‘The 

Intelligence Reform and Terrorism 

Prevention Act of 2004’’. 

(n) Lost, stolen, or compromised 

information. Actual or possible loss of 

control, unauthorized disclosure, or 

unauthorized access of personal 

information where persons other than 

authorized users gain access or potential 

access to such information for an other 

than authorized purpose where one or 

more individuals will be adversely 

affected. Such incidents also are known 

as breaches. 

(o) Maintain. The collection, 

maintenance, use, or dissemination of 

records contained in a system of 

records. 

(p) Member of the public. Any 

individual or party acting in a private 

capacity to include Federal employees 

or military personnel. 

(q) Mixed system of records. Any 

system of records that contains 

information about individuals as 

defined by the Privacy Act and non-U.S. 

citizens and/or aliens not lawfully 

admitted for permanent residence. 

(r) Non-Federal agency. Any state or 

local government, or agency thereof, 

which receives records contained in a 

system of records from a source agency 

for use in a computer matching 

program. 

(s) Official use. Within the context of 

this part, this term is used when 

officials and employees of a DoD 

Component have a demonstrated a need 

for the record or the information 

contained therein in the performance of 

their official duties, subject to DoD 

5200.1–R.5

(t) Personally identifiable information 

(PII). Information used to distinguish or 

trace an individual’s identity, such as 

name, social security number, date and 

place of birth, mother’s maiden name, 

biometric records, home phone 

numbers, other demographic, personnel, 

medical, and financial information. PII 

includes any information that is linked 

or linkable to a specified individual, 

alone, or when combined with other 

personal or identifying information. For 

purposes of this part, the term PII also 

includes personal information and 

information in identifiable form. 

(u) Privacy Act request. A request 

from an individual for notification as to 

the existence of, access to, or 

amendment of records pertaining to that 

individual. These records must be 

maintained in a system of records. 

(v) Protected health information 

(PHI). Defined in DoD 6025.18–R, ‘‘DoD 

Health Information Privacy Regulation’’ 

(available at http://www.dtic.mil/whs/

directives/corres/pdf/602518r.pdf). 

(w) Recipient agency. Any agency, or 

contractor thereof, receiving records 

contained in a system of records from a 

source agency for use in a computer 

matching program. 

(x) Record. Any item, collection, or 

grouping of information in any media 

(e.g., paper, electronic), about an 

individual that is maintained by a DoD 


tkelley on DSK3SPTVN1PROD with PROPOSALS
52120 Federal Register / Vol. 78, No. 163 / Thursday, August 22, 2013 / Proposed Rules 

Component, including, but not limited 

to, education, financial transactions, 

medical history, criminal or 

employment history, and that contains 

the name, or identifying number, 

symbol, or other identifying particular 

assigned to the individual, such as a 

fingerprint, a voice print, or a 

photograph. 

(y) Risk assessment. An analysis 

considering information sensitivity, 

vulnerabilities, and cost in safeguarding 

personal information processed or 

stored in the facility or activity. 

(z) Routine use. The disclosure of a 

record outside the Department of 

Defense for a use that is compatible with 

the purpose for which the information 

was collected and maintained by the 

Department of Defense. The routine use 

must be included in the published 

system notice for the system of records 

involved. 

(aa) Source agency. Any agency which 

discloses records contained in a system 

of records to be used in a computer 

matching program, or any state or local 

government, or agency thereof, which 

discloses records to be used in a 

computer matching program. 

(bb) Statistical record. A record 

maintained only for statistical research 

or reporting purposes and not used in 

whole or in part in making 

determinations about specific 

individuals. 

(cc) System of records. A group of 

records under the control of a DoD 

Component from which PII is retrieved 

by the individual’s name or by some 

identifying number, symbol, or other 

identifying particular uniquely assigned 

to an individual. 

(dd) System of records notice (SORN). 

A notice published in the Federal 

Register that constitutes official 

notification to the public of the 

existence of a system of records. 

■ 5. Section 310.5 is revised to read as 

follows: 

§ 310.5 Policy. 

It is DoD policy that: 

(a) An individual’s privacy is a 

fundamental legal right that must be 

respected and protected. 

(1) The DoD’s need to collect, use, 

maintain, or disseminate (also known 

and referred to in this part as 

‘‘maintain’’) PII about individuals for 

purposes of discharging its statutory 

responsibilities will be balanced against 

their right to be protected against 

unwarranted privacy invasions. 

(2) The DoD protects individual’s 

rights, consistent with federal laws, 

regulations, and policies, when 

maintaining their PII. 

(3) DoD personnel and DoD 

contractors have an affirmative 

responsibility to protect an individual’s 

privacy when maintaining his or her PII. 

(4) Consistent with section 1016(d) of 

Public Law 108–458 and section 1 of 

Executive Order 13388, ‘‘Further 

Strengthening the Sharing of Terrorism 

Information to Protect Americans,’’ the 

DoD will protect information privacy 

and provide other protections relating to 

civil liberties and legal rights in the 

development and use of the information 

sharing environment. 

(b) The DoD establishes rules of 

conduct for DoD personnel and DoD 

contractors involved in the design, 

development, operation, or maintenance 

of any system of records. DoD personnel 

and DoD contractors will be trained 

with respect to such rules and the 

requirements of this section and any 

other rules and procedures adopted 

pursuant to this section and the 

penalties for noncompliance. The DoD 

Rules of Conduct are established in 

§ 310.8. 

(c) DoD personnel and DoD 

contractors conduct themselves 

consistent with the established rules of 

conduct in § 310.8, so that records 

maintained in a system of records will 

only be maintained as authorized by 5 

U.S.C. 552a and this part. 

(d) DoD legislative, regulatory, or 

other policy proposals will be evaluated 

to ensure consistency with the 

information privacy requirements of this 

part. 

(e) Pursuant to The Privacy Act, no 

record will be maintained on how an 

individual exercises rights guaranteed 

by the First Amendment to the 

Constitution of the United States 

(referred to in this part as ‘‘the First 

Amendment’’), except: 

(1) When specifically authorized by 

statute. 

(2) When expressly authorized by the 

individual that the record is about. 

(3) When the record is pertinent to 

and within the scope of an authorized 

law enforcement activity, including an 

authorized intelligence or 

administrative investigation. 

(f) Disclosure of records pertaining to 

an individual from a system of records 

is prohibited except with his or her 

consent or as otherwise authorized by 5 

U.S.C. 552a and this part or 32 CFR part 

286. When DoD Components make such 

disclosures, the individual may, to the 

extent authorized by 5 U.S.C. 552a and 

this part, obtain a description of such 

disclosures from the Component 

concerned. 

(g) Disclosure of records pertaining to 

personnel of the National Security 

Agency, the Defense Intelligence 

Agency, the National Reconnaissance 

Office, and the National GeospatialIntelligence Agency is prohibited to the 

extent authorized by Public Law 86–36, 

‘‘National Security Agency-Officers and 

Employees’’ and 10 U.S.C. 424. 

Disclosure of records pertaining to 

personnel of overseas, sensitive, or 

routinely deployable units is prohibited 

to the extent authorized by 10 U.S.C. 

130b. 

(h) The DoD establishes appropriate 

administrative, technical, and physical 

safeguards to ensure the security and 

confidentiality of records and to protect 

against any anticipated threats or 

hazards to their security or integrity that 

could result in substantial harm, 

embarrassment, inconvenience, or 

unfairness to any individual about 

whom information is maintained. 

(i) Disclosure of PHI will be consistent 

with DoD 6025.18–R. 

(j) All DoD personnel and DoD 

contractors will be provided training 

pursuant to 5 U.S.C. 552a and OMB 

Circular No. A–130. 

(k) PII collected, used, maintained, or 

disseminated will be: 

(1) Relevant and necessary to 

accomplish a lawful DoD purpose 

required by statute or Executive Order. 

(2) Collected to the greatest extent 

practicable directly from the individual. 

He or she will be informed as to why the 

information is being collected, the 

authority for collection, how it will be 

used, whether disclosure is mandatory 

or voluntary, and the consequences of 

not providing that information. 

(3) Relevant, timely, complete, and 

accurate for its intended use. 

(4) Protected using appropriate 

administrative, technical, and physical 

safeguards based on the media (e.g., 

paper, electronic) involved. Protection 

will ensure the security of the records 

and prevent compromise or misuse 

during maintenance, including working 

at authorized alternative worksites. 

(l) Individuals are permitted, to the 

extent authorized by 5 U.S.C. 552a and 

this part, to: 

(1) Upon request by an individual, 

gain access to records or to any 

information pertaining to the individual 

which is contained in a system of 

records. 

(2) Obtain a copy of such records, in 

whole or in part. 

(3) Correct or amend such records 

once it has been determined that the 

records are not accurate, relevant, 

timely, or complete. 

(4) Appeal a denial for a request to 

access or a request to amend a record. 

(m) Non-U.S. citizens and aliens not 

lawfully admitted for permanent 

residence may request access to and 


tkelley on DSK3SPTVN1PROD with PROPOSALS
Federal Register / Vol. 78, No. 163 / Thursday, August 22, 2013 / Proposed Rules 52121 

amendment of records pertaining to 

them; however, this part does not create 

or extend any right pursuant to The 

Privacy Act to them. 

(n) SORNs and notices of proposed or 

final rulemaking are published in the 

Federal Register (FR), and reports are 

submitted to Congress and OMB, in 

accordance with 5 U.S.C. 552a, OMB 

Circular No. A–130, and this part, DoD 

8910.1–M, ‘‘Department of Defense 

Procedures for Management of 

Information Requirements’’ (available at 

http://www.dtic.mil/whs/directives/ 

corres/pdf/891001m.pdf), and DoD 

Instruction 5545.02, ‘‘DoD Policy for 

Congressional Authorization and 

Appropriations Reporting 

Requirements’’ (available at http:// 

www.dtic.mil/whs/directives/corres/pdf/ 

554502p.pdf). Information about an 

individual maintained in a new system 

of records will not be collected until the 

required SORN publication and review 

requirements are satisfied. 

(o) All DoD personnel must make 

reasonable efforts to inform an 

individual, at their last known address, 

when any record about him or her is 

disclosed: 

(1) Due to a compulsory legal process. 

(2) In a manner that will become a 

matter of public record. 

(p) Individuals must be notified in a 

timely manner, consistent with the 

requirements of this part, if there is a 

breach of their PII. 

(q) At least 30 days prior to disclosure 

of information pursuant to subparagraph 

(e)(4)(D) (routine uses) of The Privacy 

Act, the DoD will publish an FR notice 

of any new use or intended use of the 

information in the system, and provide 

an opportunity for interested people to 

submit written data, views, or 

arguments to the agency. 

(r) Computer matching programs 

between the DoD Components and 

federal, state, or local governmental 

agencies are conducted in accordance 

with the requirements of 5 U.S.C. 552a, 

OMB Circular No. A–130, and this part. 

(s) The DoD will publish in the FR 

notice any establishment or revision of 

a matching program at least 30 days 

prior to conducting such program of 

such establishment or revision if any 

DoD Component is a recipient agency or 

a source agency in a matching program 

with a non-federal agency. 

■ 6. Revise § 310.6 to read as follows: 

§ 310.6 Responsibilities. 

(a) The Director of Administration 

and Management (DA&M): 

(1) Serves as the Senior Agency 

Official for Privacy (SAOP) for the DoD. 

These duties, in accordance with OMB 

Memorandum M–05–08, ‘‘Designation 

of Senior Agency Officials for Privacy’’ 

(available at http:// 

www.whitehouse.gov/sites/default/files/ 

omb/assets/omb/memoranda/fy2005/ 

m05-08.pdf), include: 

(i) Ensuring DoD implementation of 

information privacy protections, 

including full compliance with federal 

laws, regulations, and policies relating 

to information privacy. 

(ii) Overseeing, coordinating, and 

facilitating DoD privacy compliance 

efforts. 

(iii) Ensuring that DoD personnel and 

DoD contractors receive appropriate 

training and education programs 

regarding the information privacy laws, 

regulations, policies, and procedures 

governing DoD-specific procedures for 

handling of PII. 

(2) Provides rules of conduct and 

policy for, and coordinates and oversees 

administration of, the DoD Privacy 

Program to ensure compliance with 

policies and procedures in 5 U.S.C. 552a 

and OMB Circular No. A–130. 

(3) Publishes this part and other 

guidance to ensure timely and uniform 

implementation of the DoD Privacy 

Program. 

(4) Serves as the chair of the Defense 

Privacy Board and the Defense Data 

Integrity Board. 

(5) As requested, ensures that 

guidance, assistance, and subject matter 

expert support are provided to the 

combatant command privacy officers in 

the implementation and execution of 

and compliance with the DoD Privacy 

Program. 

(6) Acts as The Privacy Act Access 

and Amendment appellate authority for 

OSD and the Office of the Chairman of 

the Joint Chiefs of Staff when an 

individual is denied access to or 

amendment of records pursuant to The 

Privacy Act and DoD Directive 5105.53, 

‘‘Director of Administration and 

Management (DA&M)’’ (available at 

http://www.dtic.mil/whs/directives/ 

corres/pdf/510553p.pdf). 

(b) The Director, Defense Privacy and 

Civil Liberties Office (DPCLO), under 

the authority, direction, and control of 

the DA&M: 

(1) Ensures that laws, policies, 

procedures, and systems for protecting 

individual privacy rights are 

implemented throughout DoD. 

(2) Oversees and provides strategic 

direction for the DoD Privacy Program. 

(3) Assists the DA&M in performing 

the responsibilities in paragraphs (a)(1) 

through (a)(6) of this section. 

(4) Reviews DoD legislative, 

regulatory, and other policy proposals 

that contain information privacy issues 

relating to how the DoD keeps its PII. 

These reviews must include any 

proposed legislation, testimony, and 

comments having privacy implications 

in accordance with DoD Directive 

5500.01, ‘‘Preparing, Processing, and 

Coordinating Legislation, Executive 

Orders, Proclamations, Views Letters, 

and Testimony’’ (available at http:// 

www.dtic.mil/whs/directives/corres/pdf/ 

550001p.pdf). 

(5) Reviews proposed new, altered, 

and amended systems of records. 

Submits required SORNs for publication 

in the Federal Register (FR) and, when 

required, provides advance notification 

to OMB and Congress consistent with 5 

U.S.C. 552a, OMB Circular No. A–130, 

and this part. 

(6) Reviews proposed DoD 

Component privacy exemption rules. 

Submits the exemption rules for 

publication in the FR, and submits 

reports to OMB and Congress consistent 

with 5 U.S.C. 552a, OMB Circular No. 

A–130, and this part. 

(7) Develops, coordinates, and 

maintains all DoD computer matching 

agreements. Submits required match 

notices for publication in the FR and 

provides advance notification to OMB 

and Congress consistent with 5 U.S.C. 

552a, OMB Circular No. A–130, and this 

part. 

(8) Provides guidance, assistance, and 

support to the DoD Components in their 

implementation of the DoD Privacy 

Program to ensure that: 

(i) All requirements developed to 

maintain PII conform to the DoD Privacy 

Program standards. 

(ii) Appropriate procedures and 

safeguards are developed and 

implemented to protect PII when it is 

collected, used, maintained, or 

disseminated in any media. 

(iii) Specific procedures and 

safeguards are developed and 

implemented when PII is collected and 

maintained for research purposes. 

(9) Compiles data in support of the 

DoD Chief Information Officer (DoD 

CIO) submission of the Federal 

Information Security Management Act 

(FISMA) Privacy Reports, pursuant to 

OMB Memorandum M–06–15, 

‘‘Safeguarding Personally Identifiable 

Information’’ (available at http:// 

www.whitehouse.gov/sites/default/files/ 

omb/memoranda/fy2006/m-06-15.pdf); 

the Biennial Matching Activity Report 

to OMB, in accordance with OMB 

Circular No. A–130 and this part; the 

quarterly Section 803 report in 

accordance with 42 U.S.C. 2000ee and 

2000ee–1; and other reports as required. 

(10) Reviews and coordinates on DoD 

Component privacy program 

implementation rules to ensure they are 

in compliance with the DoD-level 

guidance. 


tkelley on DSK3SPTVN1PROD with PROPOSALS
52122 Federal Register / Vol. 78, No. 163 / Thursday, August 22, 2013 / Proposed Rules 

(11) Provides operational and 

administrative support to the Defense 

Privacy Board and the Defense Data 

Integrity Board. 

(c) The General Counsel of the 

Department of Defense (GC DoD): 

(1) Provides advice and assistance on 

all legal matters related to the 

administration of the DoD Privacy 

Program. 

(2) Appoints a designee to serve as a 

member of the Defense Privacy Board 

and the Defense Data Integrity Board. 

(3) When a DoD Privacy Program 

group is created, appoints a designee to 

serve as a member. 

(d) The DoD Component heads: 

(1) Provide adequate funding and 

personnel to establish and support an 

effective DoD Privacy Program. 

(2) Establish DoD Component-specific 

procedures in compliance with this part 

and publish these procedures as well as 

rules of conduct in the FR. 

(3) Establish and implement 

appropriate administrative, physical, 

and technical safeguards and 

procedures prescribed in this part and 

other DoD Privacy Program guidance. 

(4) Ensure Component compliance 

with supplemental guidance and 

procedures in accordance with all 

applicable federal laws, regulations, 

policies, and procedures. 

(5) Appoint a Component senior 

official for privacy (CSOP) to support 

the SAOP in carrying out the SAOP’s 

duties identified in OMB Memorandum 

M–05–08. 

(6) Appoint a Component privacy 

officer to administer the DoD Privacy 

Program, on behalf of the CSOP. 

(7) Ensure DoD personnel and DoD 

contractors having primary 

responsibility for implementing the DoD 

Privacy Program receive appropriate 

privacy training. This training must be 

consistent with the requirements of this 

part and will address the provisions of 

5 U.S.C. 552a, OMB Circular No. A–130, 

and this part. 

(8) Ensure that all DoD Component 

legislative, regulatory, or other policy 

proposals are evaluated to ensure 

consistency with the information 

privacy requirements of this part. 

(9) Assess the impact of technology on 

the privacy of PII and, when feasible, 

adopt privacy-enhancing technology to: 

(i) Preserve and protect PII contained 

in a DoD Component system of records. 

(ii) Audit compliance with the 

requirements of this part. 

(10) Ensure that officials who have 

specialized knowledge of the DoD 

Privacy Program periodically review 

Component implementation of and 

compliance with the DoD Privacy 

Program. 

(11) Submit reports, consistent with 

the requirements of this part, in 

accordance with 5 U.S.C. 552a and OMB 

Circular No. A–130, and as otherwise 

directed by the Director, DPCLO. 

(e) Secretaries of the Military 

Departments. In addition to the 

responsibilities in paragraph (d) of this 

section, the Secretaries of the Military 

Departments provide program and 

financial support to the combatant 

commands as identified in DoD 

Directive 5100.03, ‘‘Support to the 

Headquarters of Combatant and 

Subordinate Unified Commands’’ 

(available at http://www.dtic.mil/whs/ 

directives/corres/pdf/510003p.pdf) to 

fund, without reimbursement, the 

administrative and logistic support 

required by combatant and subordinate 

unified command headquarters to 

perform their assigned missions 

effectively. 

§ 310.7 [Removed and Reserved] 

■ 7. Section 310.7 is removed and 

reserved. 

■ 8. Section 310.8 is revised to read as 

follows: 

§ 310.8 Rules of conduct. 

In accordance with section (e)(9) of 

The Privacy Act, this section provides 

DoD rules of conduct for the 

development, operation, and 

maintenance of systems of records. DoD 

personnel and DoD contractor personnel 

will: 

(a) Take action to ensure that any PII 

contained in a system of records that 

they access and use to conduct official 

business will be protected so that the 

security and confidentiality of the 

information is preserved. 

(b) Not disclose any PII contained in 

any system of records, except as 

authorized by The Privacy Act, or other 

applicable statute, Executive order, 

regulation, or policy. Those willfully 

making any unlawful or unauthorized 

disclosure, knowing that disclosure is 

prohibited, may be subject to criminal 

penalties or administrative sanctions. 

(c) Report any unauthorized 

disclosures of PII from a system of 

records to the applicable Privacy point 

of contact (POC) for the respective DoD 

Component. 

(d) Report the maintenance of any 

system of records not authorized by this 

part to the applicable Privacy POC for 

the respective DoD Component. 

(e) Minimize the collection of PII to 

that which is relevant and necessary to 

accomplish a purpose of the DoD. 

(f) Not maintain records describing 

how any individual exercises rights 

guaranteed by the First Amendment, 

except: 

(1) When specifically authorized by 

statute. 

(2) When expressly authorized by the 

individual that the record is about. 

(3) When the record is pertinent to 

and within the scope of an authorized 

law enforcement activity, including 

authorized intelligence or 

administrative activities. 

(g) Safeguard the privacy of all 

individuals and the confidentiality of all 

PII. 

(h) Limit the availability of records 

containing PII to DoD personnel and 

DoD contractors who have a need to 

know in order to perform their duties. 

(i) Prohibit unlawful possession, 

collection, or disclosure of PII, whether 

or not it is within a system of records. 

(j) Ensure that all DoD personnel and 

DoD contractors who either have access 

to a system of records or develop or 

supervise procedures for handling 

records in a system of records are aware 

of their responsibilities and are properly 

trained to safeguard PII being 

maintained under the DoD Privacy 

Program. 

(k) Prepare any required new, 

amended, or altered SORN for a given 

system of records and submit the SORN 

through their DoD Component Privacy 

POC to the Director, DPCLO, for 

coordination and submission for 

publication in the Federal Register (FR). 

(l) Not maintain any official files on 

individuals, which are retrieved by the 

name of the individual or by some 

identifying number, symbol, or other 

identifying particular assigned to the 

individual, also known as a system of 

records, without first ensuring that a 

notice has been published in the FR. 

Any official who willfully maintains a 

system of records without meeting the 

publication requirements as prescribed 

by this part and The Privacy Act may be 

subject to criminal penalties or 

administrative sanctions. 

(m) Maintain all records in a mixed 

system of records as if all the records in 

such a system are subject to The Privacy 

Act. 

■ 9. Amend § 310.9 by revising 

paragraphs (a) and (b) to read as follows: 

§ 310.9 Privacy boards and office, 

composition and responsibilities. 

(a) The Defense Privacy Board—(1) 

Membership. The Board consists of: 

(i) Voting Members. Representatives 

designated by the Secretaries of the 

Military Departments and the following 

officials or their designees: 

(A) The DA&M, who serves as the 

chair. 

(B) The Director, DPCLO. 

(C) The Director for Privacy, DPCLO, 

who serves as the Executive Secretary 

and as a member. 


tkelley on DSK3SPTVN1PROD with PROPOSALS
Federal Register / Vol. 78, No. 163 / Thursday, August 22, 2013 / Proposed Rules 52123 

(D) The Under Secretary of Defense 

for Personnel and Readiness. 

(E) The Assistant Secretary of Defense 

for Health Affairs. 

(F) The DoD CIO. 

(G) The Director, Defense Manpower 

Data Center. 

(H) The Director, Executive Services 

Directorate, Washington Headquarters 

Services (WHS). 

(I) The GC DoD. 

(J) The Chief of the National Guard 

Bureau. 

(ii) Non-Voting Members. Non-voting 

members are the Director, Enterprise 

Information Technology Services 

Directorate (EITSD), WHS; and the 

representatives designated by Defense 

Agency and DoD Field Activity 

directors. 

(2) Responsibilities. The Board: 

(i) Serves as the primary DoD policy 

forum for matters involving the DoD 

Privacy Program, meeting as necessary 

to address issues of common concern to 

ensure that consistent policy is adopted 

and followed by the DoD Components. 

The Board issues advisory opinions, as 

necessary, on the DoD Privacy Program 

to promote uniform and consistent 

application of 5 U.S.C. 552a, OMB 

Circular No. A–130, and this part. 

(ii) Establishes and convenes 

committees as necessary. 

(iii) Establishes working groups 

whose membership is composed of DoD 

Component privacy officers and others 

as necessary. 

(b) The Defense Data Integrity 

Board—(1) Membership. The Board 

consists of: 

(i) The DA&M, who serves as the 

chair. 

(ii) The Director, DPCLO. 

(iii) The Director for Privacy, DPCLO, 

who serves as the Executive Secretary. 

(iv) The representatives designated by 

the Secretaries of the Military 

Departments; the DoD CIO; the GC DoD; 

the Inspector General of the Department 

of Defense, who is a non-voting advisory 

member; the Director, EITSD; and the 

Director, Defense Manpower Data 

Center. 

(2) Responsibilities. The Board: 

(i) Oversees and coordinates, 

consistent with the requirements of 5 

U.S.C. 552a, OMB Circular No. A–130, 

and this part, all computer matching 

agreements involving personal records 

contained in systems of records 

maintained by the DoD Components. 

(ii) Reviews and approves all 

computer matching agreements between 

the DoD and other federal, state, or local 

governmental agencies, as well as any 

memorandums of understanding, when 

the match is internal to the DoD. This 

review ensures that, in accordance with 

5 U.S.C. 552a, OMB Circular No. A–130, 

and this part, appropriate procedural 

and due process requirements are 

established before engaging in computer 

matching activities. 

* * * * * 

■ 10. Amend § 310.10 by revising 

paragraph (a)(1) to read as follows: 

§ 310.10 General. 

(a) * * * 

(1) Consist of ‘‘records’’ (as defined in 

§ 310.4) that are retrieved by the name 

of an individual or some other personal 

identifier; and 

* * * * * 

Dated: August 19, 2013. 

Aaron Siegel, 

Alternate OSD Federal Register Liaison 

Officer, Department of Defense. 

[FR Doc. 2013–20515 Filed 8–21–13; 8:45 am] 

BILLING CODE 5001–06–P 

DEPARTMENT OF COMMERCE 

National Oceanic and Atmospheric 

Administration 

50 CFR Part 635 

RIN 0648–XC812 

Atlantic Highly Migratory Species; 

2006 Consolidated Highly Migratory 

Species Fishery Management Plan; 

Amendment 7 

AGENCY: National Marine Fisheries 

Service (NMFS), National Oceanic and 

Atmospheric Administration (NOAA), 

Department of Commerce. 

ACTION: Notice of public hearings. 

SUMMARY: NMFS will publish a 

proposed rule for Draft Amendment 7 to 

the 2006 Consolidated Highly Migratory 

Species (HMS) Fishery Management 

Plan (FMP) to control bluefin incidental 

catch (landings and dead discards) in 

the pelagic longline fishery, enhance 

reporting in all categories, and ensure 

U.S. compliance with the ICCATrecommend quota. As described in the 

proposed rule, the proposed measures 

include Allocation measures, AreaBased measures, Bluefin Quota 

Controls, Enhanced Reporting measures, 

and other measures that modify rules 

with respect to how the various quota 

categories utilize quota. In this notice, 

NMFS announces the dates and logistics 

for 10 public hearings to provide 

additional opportunities for members of 

the public to comment on the bluefin 

management measures proposed in 

Draft Amendment 7. NMFS will also 

consult with the HMS Advisory Panel 

during its meeting scheduled September 

9–12, 2013. There will be opportunities 

for public comment during open 

sessions held each day of the Advisory 

Panel meeting. 

DATES: Written comments will be 

accepted until October 23, 2013. Public 

hearings, an advisory panel meeting, 

and council consultations will be held 

between August 1, 2013 to October 31, 

2013, to present information about 

Amendment 7 and to provide 

opportunities for the submission of 

public comment regarding the proposed 

rule. See SUPPLEMENTARY INFORMATION

for meeting dates, times, and locations. 

ADDRESSES: A total of ten public 

hearings will be held along the Atlantic 

and Gulf coasts to provide the 

opportunity for public comment. NMFS 

will also hold an HMS Advisory Panel 

meeting in Silver Spring, MD, during 

which there will be opportunities for 

public comment (78 FR 44095). See 

SUPPLEMENTARY INFORMATION for dates, 

times, and locations. 

You may submit comments on the 

proposed rule identified by ‘‘NOAA– 

NMFS–2013–0101,’’ by any of the 

following methods: 

• Electronic Submissions: Submit all 

electronic public comments via the 

Federal eRulemaking Portal. Go to 

www.regulations.gov/ 

#!docketDetail;D=NOAA-NMFS-2013- 

0101, click the ‘‘Comment Now!’’ icon, 

complete the required fields, and enter 

or attach your comments. Do not submit 

electronic comments to individual 

NMFS staff 

• Mail: Submit written comments to: 

Thomas Warren, Highly Migratory 

Species Management Division, NMFS, 

55 Great Republic Drive, Gloucester, 

MA 01930. Please mark the outside of 

the envelope ‘‘Comments on 

Amendment 7 to the HMS FMP.’’ 

• Fax: 978–281–9347, Attn: Thomas 

Warren. 

• Instructions: Comments must be 

submitted by one of the above methods 

to ensure that the comments are 

received, documented, and considered 

by NMFS. Comments sent by any other 

method, to any other address or 

individual, or received after the end of 

the comment period, may not be 

considered. All comments received are 

a part of the public record and generally 

will be posted for public viewing on 

www.regulations.gov without change. 

All Personal Identifying Information (for 

example, name, address, etc.), 

confidential business information, or 

otherwise sensitive information 

submitted voluntarily by the sender will 

be publicly accessible. Do not submit 

Confidential Business Information or 

otherwise sensitive or protected 


tkelley on DSK3SPTVN1PROD with PROPOSALS