Source: https://www.federalregister.gov/documents/2015/01/27/2015-01262/dod-privacy-program
Timestamp: 2018-03-24 06:36:45
Document Index: 91327746

Matched Legal Cases: ['art 310', 'art 310', 'art 310', 'art 310', 'art 310', 'art 310', '§\u2009310', '§\u2009310']

A Rule by the Defense Department on 01/27/2015
This rule is effective February 26, 2015.
4201-4211 (11 pages)
I. The Privacy Act Grants Individuals Judicially Enforceable Rights and Imposes Obligations on Federal Agencies
II. NSA Record Maintenance, Collection, Use, and Dissemination Are Subject to the Privacy Act and DoD Privacy Program Regulations
III. NSA's Maintenance, Collection, Use, and Dissemination of Records From Unpublished System of Records Violate the Privacy Act and DoD Privacy Program Regulations
https://www.federalregister.gov/d/2015-01262 https://www.federalregister.gov/d/2015-01262
Deputy Chief Management Officer, DoD.
This rule is part of DoD's retrospective plan, completed in August 2011, under Executive Order 13563, “Improving Regulation and Regulatory Review.” DoD's full plan and updates can be accessed at: http://exchange.regulations.gov/​exchange/​topic/​eo-13563.
An individual's privacy is a fundamental legal right that must be respected and protected. This regulatory action ensures that DoD's need to collect, use, maintain, or disseminate personally identifiable information (PII) about individuals for purposes of discharging its statutory responsibilities will be balanced against their right to be protected against unwarranted privacy invasions. This regulatory action also describes the rules of conduct and responsibilities of DoD personnel, DoD contractors, and DoD contractor personnel to ensure that any PII contained in a system of records that they access and use to conduct official business will be protected so that the security and confidentiality of the information is preserved.
Authority: 5 U.S.C. 552a, The Privacy Act of 1974, as amended, which requires the implementation of the Act by Federal agencies.
c. Ensures that guidance, assistance, and subject matter expert support are provided to the combatant command Start Printed Page 4202privacy officers in the implementation and execution of and compliance with the DoD Privacy Program.
The Department published a proposed rule on August 22, 2013 (78 FR 52117), with a request for comments. The following comments were received and are addressed below:
Comment 1: An argument against the elimination of the term (and position/role) “System Manager”. Yes, it is every employee's responsibility to ensure PII is properly handled, but the System Manager is the `control valve' for each specific SOR and should continue to have a big say in determining `who' should have access to sensitive material. Much like the world of classified information, being trained and having the `clearance' to access the information is only part of the equation . . . the concept of “need-to-know” is equally important when determining access, and the System Manager is the POC that checks “need-to-know”. In addition, the System Manager knows (or should know) which SORN authorizes the collection of their SOR, they know with whom the info can be shared, they know what should be in the SOR and they verify that info every year, they keep track of disclosure accounting, etc. The average user with access only knows to protect it, and they wouldn't know a SORN if they tripped over it. I would suggest returning the “System Manager” to this document.
DoD Response: This Comment addresses the Rules of Conduct as described under 32 CFR 310.8(b)(1)-(3). These particular requirements have been revised and incorporated into 32 CFR 310.8(j)-(l), and are now applicable to all DoD personnel and DoD contractor personnel, including system mangers. This revision does not eliminate the position/role of system managers.
Comment 2: 32 CFR 310.22. This comment is targeted to a part of 32 CFR part 310 that DoD saw fit to not update, and it is a missed opportunity to clarify current DoD practices. The DoD has gone out of its way to establish that sharing lists of PII with non-DoD requestors is prohibited by FOIA. The DoD has requested that OPM not share DoD personnel information with requestors, and OPM has approved that request. DoD has gone to court (supporting OPM), and won, in its effort to ensure that requests for personnel information of DoD employees is exempt under the FOIA. (see Long v. OPM (Case 5:05-cv-01522-NAM-DEP)). And while the DPCLD continues to state that “there is no DoD FOIA policy denying the release of names of DoD personnel below the Director, O-7, or SES levels. All such decisions to deny names that do not comprise a list must be made by using the Reporters Committee balancing test.”, in fact DoD has issued a policy memorandum (09 Nov 2001) stating exactly that.
Sidebarring whether it is “actual” DoD policy to withhold or not, I think it is fair to say that DoD will likely discourage or prevent release of personnel information (either in lists per the Nov. 2001 memo or not-in-lists via FOIA exemptions). Therefore the contention expressed in 32 CFR 310.22(b)(5)(i)(A) that “. . . personal information regarding DoD civilian employees that normally may be released without a clearly unwarranted invasion of personal privacy” is misleading and disingenuous and should be reworded. As presently constituted, this wording gives the impression that this info is normally released, so either some DoD commands may release it without being aware that DoD, in practice, does exactly the opposite, or some citizens wishing to know how their government works may actually think they have a chance of getting that info from DoD without a court fight.
If the policy memo written just after 9/11 is indeed the new permanent policy and not, as Michael Donley declared, that “it was believed that this would only be a temporary policy”, please change the CFR to reflect that. 12 years of relying on a scrap of paper touting a `temporary policy' and not changing Federal Regulations seems to be circumventing the purpose of the CFR.
DoD Response: This Comment addresses the release of “personal information that is normally releasable” as described in 32 CFR 310.22(b)(5)(i)(A). The commentator objects to the wording “personally information regarding DoD civilian employees that normally may be released without a clear unwarranted invasion of personal privacy,” as “misleading and disingenuous.” Attention should be drawn to the use of the word “may,” as in indicator that it is permissible to release this information, but not required.
Comment 3: 32 CFR 310.4(h). The amendment to the definition of DoD Personnel should also include “dependents of members of armed services registered in DEERS.” Military dependents receive no protection under both the current and proposed versions of the Privacy Program. Aside from ongoing military operations, military dependents are just as likely to depend upon DoD services requiring the use of PII and/or PHI, but are afforded no protections.
Currently, family members are only required to receive notice of PII spillage, but are not afforded any civil remedies, nor is their information protected by criminal action against its malicious use. See DoD 5400.11-R, sec. C10.6.1.2.2. The Federal Tort Claims Act (FTCA) also severely limits any torts arising out of PII spillage by parties to whom the Privacy Program applies. See 28 U.S.C. 2680(h). For military dependents stationed overseas, who are more likely to use federal contractor services and in so doing, place their confidential information in someone else's care, the FTCA might preclude any protections at tort law for military families whatsoever. See 28 U.S.C. 2860(k).
Protecting DEERS dependent information has the added benefits of enhancing national security, providing accountability for dependents' records, and increasing oversight over DoD dependents' data by government contractors. Protecting dependents' privacy enhances national security by preventing another avenue by which malicious actors can exploit service members. During a service member's deployment, DoD dependents on the homefront frequently contact family readiness groups and other on-base agencies for news on their military members, provide information to DoD agencies to qualify for benefits, and join military unit sponsored clubs to relieve the stress of their loved one's absence. While information on the military member would be protected under the Privacy Program, the DoD dependent's information would not be. Thus, a malicious actor could legally request information about a service member's family and use it to exploit a service member's actions in a forward area, or illegally gain it by hacking information that is currently not required to be protected.
Adding this definition also creates accountability for DEERS dependent records. DoD dependents often become highly involved in on-base activities that require sharing private information. Start Printed Page 4203When that DoD dependent changes duty stations with their DoD member, there is no accounting for the disposition of the records the DEERS member left behind. On-base agencies are often the same from one base to the next. A Privacy Program mandated recordkeeping program would allow for more easier integrations of service members and their families from one duty location to the next, by allowing a standardization of the sharing and safekeeping of records between “franchises” at different bases. This in turn allows service members to more rapidly begin work at a new duty station.
Admittedly, such an amendment possibly triggers an economic impact analysis under E.O. 12866, and an unfunded mandates analysis under the Unfunded Mandates Reform Act, due to the increase in costs in archiving additional data and requiring contractor compliance.
However, the benefit to the welfare of our armed services, the eventual elimination of replication of efforts in data collection at different bases, and the savings to DoD family members' lost time and wages in fighting possible identity theft due to PII spillage, will outweigh the burden of such an amendment.
DoD Response: This Comment addresses the classification of DoD Personnel in 32 CFR 310.4(h) and suggests the inclusion of “dependents of members of the armed services registered in DEERS” in this classification. Although military dependents do carry many of the same attributes of military service members, they are not DoD employees and therefore cannot be classified as “DoD Personnel.” The commentator also suggests that military dependents “are afforded no protections” under the Privacy Program. Information concerning dependents of members of the armed services registered in DEERS is maintained by DoD in accordance with the Privacy Act of 1974, as amended, which does provide protection to military dependents. Within the DoD Privacy Program, “family members” are specifically mentioned in 32 CFR 310.14(a)(1) and 32 CFR 310.50(a)(2)(ii) with respect to breach notification and Privacy Act violations.
Comment 4: The Brennan Center is a nonpartisan law and policy institute that seeks to improve our systems of democracy and justice. The Brennan Center's Liberty and National Security Program works to further national security policies that respect constitutional values and the rule of law while protecting our people. Specifically, the Center seeks to restore the proper flow of information between the government and the people, ensure that domestic counterterrorism policies effectively target the terrorist threat, and secure appropriate mechanisms for oversight and accountability.
The Brennan Center recently published a report, What the Government Does with Americans' Data, that explores the federal government's retention of non-criminal information about Americans. The report recommends specific reforms, including reforms to the Privacy Act and limits on the retention of information reflecting the exercise of rights protected by the First Amendment.
With respect to the DoD proposed regulation, we note that a coalition of organizations is submitting a letter urging the DoD to require the National Security Agency, a component of the DoD, to publish System of Records Notices for three NSA databases: (1) A system containing “telephone numbers and electronic communications accounts/addresses/identifiers that NSA has reason to believe are being used by United States persons,” used to distinguish U.S. persons from foreigners in the source of targeting persons for the purpose of surveillance under Section 702 of the Foreign Intelligence Surveillance Act; (2) a database of email address lists and instant messaging “buddy lists” belonging to U.S. citizens and residents; and (3) a database with information about social networks, including data relating to U.S. persons. We endorse this recommendation, and believe it is critically important that the NSA comply with its obligations to provide the notices required by the Privacy Act regarding searchable databases containing information about Americans and legal residents.
DoD Response: This Comment addresses System of Records Notices (SORNs) with respect to the DoD, and with the National Security Agency (NSA) in particular. It is DoD policy to “publish in the Federal Register upon establishment or revision a notice of the existence and character of the system of records . . .” 5 U.S.C. 552a(e)(4). A SORN is required when (1) information about an individual is collected and stored by a DoD Component; and (2) that information is retrievable by a unique personal identifier. 32 CFR 310.10. NSA has twenty-five active SORNS that are publicly available for review. NSA generates SORNs as require by the Privacy Act of 1974 and applicable DoD regulation, 32 CFR 310.10. One NSA SORN, GNSA 18, concerns NSA “collection of operations records.” GNSA 18 covers all individuals, as that term is defined within the Privacy Act to encompass citizens of the United States and lawful permanent residents. The purpose of GNSA 18 is to allow NSA to maintain, as that term is defined by the Privacy Act, records on foreign intelligence, counterintelligence, and information systems security matters relating to the missions of NSA. Specifically, GNSA 18 covers all individuals, as that term is defined by the Privacy Act, who are identified in NSA foreign intelligence, counterintelligence, or information system security reports, including supportive materials. As such, the DoD Privacy Program complies with the Privacy Act of 1974, as amended, and as codified at 5 U.S.C. 552a.
Comment 5: The Policy section of the DoD's Privacy Program currently states that “No record shall be maintained on how an individual exercises rights guaranteed by the First Amendment to the constitution. . . .” There are three enumerated exceptions: When retention is authorized by statute, where the individual has authorized it, or “when the record is pertinent to and within the scope of an authorized law enforcement activity.” Under the proposed rule, the analogous section would expand the third exception to allow information relating to First Amendment-protected speech to be maintained when the records is “pertinent to and within the scope of an authorized intelligence or administrative investigation.” (This same change is reflected in the proposed changes to the Privacy Program's Rules of Conduct as well.)
This exception—both as it stands and as revised—is simultaneously overly broad and vague. To begin with, it is not clear what matters are encompassed by “law enforcement activities”; it seems likely that those activities could include more than an authorized investigation, but it is unknown what other actions might qualify as an “activity” and thus trigger the ability to maintain First Amendment-protected information. The new terms are even more ambiguous. “Intelligence activities” are not defined, and the meaning of “administrative activities” is particularly uncertain; it appears susceptible to being used as a catch-all to permit the retention of First Amendment-protected information in almost any circumstances.
Furthermore, the requirement that the record be “pertinent to and within the scope of” one of the above matters is an extremely low standard, as nearly any record could be found to be “pertinent to” a particular activity. This is particularly true in light of the assertions by the NSA and the DOJ that databases containing nearly all Start Printed Page 4204American's phone records are “relevant” to the NSA's activities because some minute percentage may be germane in the future. A higher standard would be the “relevant and necessary” standard, which is reflected in a proposed change to the Rules of Conduct requiring all users to “minimize the collection of [personally identifiable information] to that which is relevant and necessary to accomplish a purpose of the DoD.”
In short, the exception as proposed would allow First Amendment-related information to remain in an individual's file under almost any circumstances, as long as there is a colorable argument that it is related in some way, or might be related in the future, to some law enforcement, intelligence, or “administrative” matter. Because of the ambiguity of these terms, American citizens are left with little guidance about the actual circumstances under which information about their protected speech or associations may be maintained in DoD files.
Accordingly, we urge the DoD to reject the proposed changes and to significantly narrow this exception. Appropriate steps would include: (1) Adding definitions for “law enforcement activities,” “intelligence activities,” and “administrative activities to 32 CFR 310.4, Definitions; (2) Limiting the retention of information reflecting the exercise of First Amendment-protected rights to circumstances in which it is relevant and necessary to an authorized investigation; (3) Ensuring that at the close of any investigation, First Amendment-protected information is purged. (All information gathered about U.S. persons should be purged if no reasonable suspicion of criminal activity is developed.) If this information must be retained as part of an investigative file that is reasonably maintained in the ordinary course of business, it should be masked to ensure that it is accessible in the future only if strictly relevant and necessary to another authorized investigation; and (4) Specifying the circumstances under which any PII about Americans, including records reflecting First Amendment-protected activities, may be shared with other local, state, or federal agencies, foreign governments, or private parties or entities.
DoD Response: This Comment addresses the terms “law enforcement activities,” “intelligence activities,” and “administrative activities,” and raises First Amendment concerns. The proposed revision to the DoD policy includes that “no record will be maintained on how an individual exercises rights guaranteed by the First Amendment . . . , except (1) when expressly authorized by statute; (2) when expressly authorized by the individual that the record is about; or (3) when the record is pertinent to and within the scope of an authorized law enforcement activity, including an authorized intelligence or administrative investigation.” 32 CFR 310.5(f) (proposed). The Privacy Act of 1974 permits “exception from such requirements with respect to records provided in this Act only in those cases where there is an important public policy need for such exemption as has been determined by specific statutory authority.” Public Law 93-579, Section 2(b)(5). General and Specific Exemptions are provided in 5 U.S.C. 552a(j) and (k). As such, the DoD Privacy Program complies with the Privacy Act of 1974, as amended, and as codified at 5 U.S.C. 552a.
Comment 6: By notice published August 22, 2013, the Department of Defense (“DoD”) proposes to amend its Privacy Program implementing the Privacy Act of 1974. Specifically, DoD proposes to change its “policies, guidance, and assigned responsibilities of the DoD Privacy Program . . . ; authoriz[e] the Defense Privacy Board and the Defense Data Integrity Board; prescrib[e] uniform procedures for implementation of and compliance with the DoD Privacy Program; and delegat[e] authorities and responsibilities for the effective administrative of the DoD Privacy Program.”
The proposed amendments apply to all organizational entities within the DoD, including the Office of the Secretary of Defense, the Military Departments, and the DoD Office of the Inspector General, which the DoD refers to collectively as the “DoD Components.” The National Security Agency (“NSA”) is an organizational entity and agency component within the DoD. Therefore, the DoD's proposal applies to the NSA.
As discussed below, NSA currently maintains at least three unlawful Privacy Act systems of records pertaining to US citizens and permanent residents. These systems of records violate both the Privacy Act and current DoD Privacy Program regulations. Accordingly, pursuant to DoD's notice of proposed rulemaking (“NPRM”), the undersigned privacy, consumer rights, and civil rights organizations [hereinafter “Privacy Commentators”] hereby submit these comments to urge DoD to enjoin the NSA—a DoD component subject to the DoD Privacy Program—from violating the Privacy Act and current DoD Privacy Program regulations.
Although the DoD's Privacy Program NPRM is generally favorable to individual privacy and First Amendment rights and adheres to the Privacy Act, the NSA's current collection, maintenance, and disclosure of records violate the Privacy Act and current DoD Privacy Program regulations. The NSA's activity would also violate DoD's proposal.
Because the NSA is under the purview of the DoD Privacy Program, the DoD must ensure NSA implements “information privacy protections, including full compliance with federal laws, regulations, and policies relating to information privacy” before issuing a final rule. Specifically, the DoD must ensure that the NSA complies with the Privacy Act by publishing additional system of records notices and otherwise adhering to the Privacy Act.
The Privacy Act of 1974 governs federal agency maintenance, collection, use, and dissemination of U.S. citizen and lawful permanent resident “records” contained in a “system of records.” The Act broadly defines “record” to include: Any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph[.]
A “system of records” is: A group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual[.]
When it enacted the Privacy Act of 1974, Congress sought to restrict the amount of personal information that federal agencies could collect and required transparency in agency information practices. Privacy Act legislative history reveals that the Act is intended “to promote accountability, responsibility, legislative oversight, and open government with respect to the use of computer technology in the personal information systems data of the Federal Government [.]” The Act is also intended to guard the privacy interests of citizens and lawful permanent residents against government intrusion. Start Printed Page 4205Congress found that “the privacy of an individual is directly affected by the collection, maintenance, use, and dissemination of personal information by Federal agencies,” and recognized that “the right to privacy is a personal and fundamental right to protected by the Constitution of the United States.” Congress thus sought to “provide certain protections for an individual against an invasion of personal privacy” by establishing a set of procedural and substantive rights These rights, for example, guarantee that individuals:
May request access to records an agency maintains about him or her, as well as have copies made;
may amend a record about him or her; and
must be informed whom the agency asks to supply information;
Importantly, the Privacy Act grants individuals a private right of action and individuals may sue federal agencies for violating the Privacy Act.
In addition to granting individual rights, the Privacy Act also imposes several obligations on federal agencies, including obligations that agencies must:
At least 30 days prior to publication of each record routine, “publish in the Federal Register notice of any new use or intended use of the information in the system, and provide an opportunity for interested persons to submit written data, views, or arguments to the agency”;
not maintain records “describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual about whom the record is maintained or unless pertinent to and within the scope of an authorized law enforcement activity”;
give individuals access to the accounting of disclosure of their records;
make notes of requested amendments within the records;
collect records “about an individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or by executive order of the President”;
“collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual's rights, benefits, and privileges under Federal programs”;
assure that all records used by the agency in making determinations about an individual are accurate, relevant, timely and complete as reasonably necessary to maintain fairness;
make a reasonable effort to notify an individual when a record about him or her is made available to another individual when it is a matter of public record;
promulgate rules establishing procedures that notify an individual in response to record requests pertaining to him or her, including “reasonable times, places, and requirements for identifying an individual”, institute disclosure procedures for medical and psychological records, create procedures to review amendment requests, as well as determine the request, the status of appeals to denial of requests, and establish fees for record duplication, excluding the cost for search and review of the record;
In addition to assessing “reasonable attorney fees and other litigation costs” for noncompliant agencies, courts may order agencies to amend individuals records, as well as “enjoin the agency from withholding records.” The Act also imposes criminal penalties for officers and agency employees who willfully disclose agency records in violation of the Privacy Act or Privacy Act regulations.
The NSA is an “agency” as defined in the Privacy Act. The NSA is also a DoD organizational entity within the DoD. Accordingly, NSA is subject to the Privacy Act, current DoD Privacy Program regulations, and the NPRM. Pursuant to the Privacy Act and DoD Privacy Program regulations, the NSA has published twenty-six systems of records. These are as follows:
GNSA 02 NSA/CSS Applicants (June 5, 2008, 73 FR 31997) (k)(1) and (k)(5).
GNSA 03 NSA/CSS Correspondence, Cases, Complaints, Visitors, Requests (February 22, 1993, 58 FR 10531) (k)(1), (k)(2), (k)(4), (k)(5).
GNSA 05 NSA/CSS Equal Employment Opportunity Data Statistical Data (December 30, 2008, 73 FR 79851) (k)(1), (k)(2), (k)(4).
GNSA 06 NSA/CSS Health, Medical and Safety Files (March 15, 2012, 77 FR 15360) (k)(1), (k)(4), (k)(5), (k)(6).
GNSA 07 NSA/CSS Motor Vehicles and Carpools (July 25, 2008, 73 FR 43411) (k)(1).
GNSA 08 NSA/CSS Payroll Processing File (October 3, 2012, 77 FR 60401) (k)(1) and (k)(2).
GNSA 09 NSA/CSS Personnel File (December 30, 2011, 76 FR 82283) (k)(1), (k)(4), (k)(5), (k)(6).
GNSA 10 NSA/CSS Personnel Security File (June 16, 2009, 74 FR 28483) (k)(1), (k)(2), (k)(5), (k)(6).
GNSA 11 NSA/CSS Key Accountability Records (June 28, 2010, 75 FR 36642) (k)(2).
GNSA 12 NSA/CSS Education, Training and Workforce Development (March 24, 2009, 74 FR 12116) (k)(1), (k)(2), (k)(5), (k)(6).
GNSA 14 NSA/CSS Library Patron File Control System (July 30, 2013, 78 FR 45913) (k)(1) and (k)(4).
GNSA 15 NSA/CSS Computer Users Control System (February 5, 2010, 75 FR 6000) (k)(1) and (k)(2).
GNSA 16 NSA/CSS Drug Testing Program (September 22, 2011, 76 FR 58787)
GNSA 17 NSA/CSS Employee Assistance Service Case Records (November 14, 2011, 76 FR 70427) (j)(2), (k)(1), (k)(2), (k)(4), and (k)(5).
GNSA 18 Operations Records (November 30, 2010, 75 FR 74019). (k)(1), (k)(2), and (k)(5).
GNSA 19 NSA/CSS Child Development Services (December 4, 2009, 74 FR 63732)
GNSA 20 NSA Police Operational Files (April 23, 2010, 75 FR 21250) (k)(2), (k)(4), and (k)(5).
GNSA 21 NSA/CSS Morale, Welfare, and Recreation (MWR) and Non-appropriated Fund Instrumentality (NAFI) Files (May 7, 2010, 75 FR 25215)
GNSA 22 Garnishment Processing Files, (October 25, 2010, 75 FR 65457)
GNSA 24 NSA/CSS Pre-Publication Review Records (September 15, 2010, 75 FR 56079)
GNSA 25 NSA/CSS Travel Records (September 13, 2012, 77 FR 56626) (k)(2), (k)(4).
GNSA 26 NSA/CSS Accounts Receivable, Indebtedness and Claims ( August 19, 2009, 74 FR 41872) (k)(4).
GNSA 27 Information Assurance Scholarship Program (October 5, 2011, 76 FR 61679)
GNSA 28 Freedom of Information Act, Privacy Act and Mandatory Declassification Review Records (January 19, 2011, 76 FR 3098) (k)(1) through (k)(7).
GNSA 29 NSA/CSS Office of Inspector General Investigations and Complaints (May 3, 2012, 77 FR 26254) (j)(2),(k)(2), (k)(5).
GNSA 30 Congressional, Executive, and Political Inquiry Records (September 13, 2012, 77 FR 56628)
Recent Administration admissions and NSA documents reveal that over the last several years, NSA has maintained at least three unpublished system of records that allow the agency to retrieve information by “identifying number[s], symbol[s], or other identifying particular[s] assigned to . . . individual[s].” These groups of records violate the Privacy Act and DoD Privacy Program regulations because they were collected without individual consent, public notice, and other Privacy Act procedural requirements.
The first unlawful NSA system of records contains “telephone numbers and electronic communications accounts/addresses/identifiers that NSA has reason to believe are being used by United States persons.” The NSA uses these “identifying numbers, symbols, and other particulars” to retrieve information to identify if an individual whom the NSA intends to monitor is a U.S. person.
The second unlawful NSA system of records is comprised of contact lists that the NSA retrieves from email address books and instant message “buddy lists.” In this system of records, the NSA gathers email contact lists and instant message buddy lists that traverse global data links. The contact lists and buddy lists include those belonging to U.S. citizens. The lists are maintained within a searchable contact list database that permits the NSA to retrieve information by an “identifying number, symbol, or other identifying particular,”—i.e., email addresses and instant message accounts.
Furthermore, email contact lists, in particular, can contain other identifying information beyond the email address of the contact, such as name, address, business association, and relationship to the contact.
The third unlawful NSA system of records is a database containing information relating to social networks. Within this system of records, the NSA maintains information on social connections (e.g. associates or travel companions), location information, email addresses, phone numbers, and publicly available information from commercial entities, as well as location at certain times among other personal information. The NSA retrieves information in this system of records to perform social network analysis. General Keith Alexander confirmed the social networking analysis, stating that the Supplemental Procedures allow the NSA “to use metadata that [it has] acquired under Executive Order 12-333 and chain, whether it's phone records or emails, it through U.S. selectors to figure out social networks abroad.” General Alexander confirmed that the 2009 Supplemental Procedures are still being used.
All three of the aforementioned NSA systems of records violate the Privacy Act and DoD Privacy Program regulations because the NSA has failed to publish system of records notices for each of the system of records. None of the NSA's twenty-six published SORNs listed above describes the type of data collection or dissemination that the NSA is conducting with these systems of records. Moreover, they violate the Privacy Act and DoD Privacy Program regulations because the records were collected without individual notice, consent, or other Privacy Act rights.
Finally, each of the three unpublished systems of records maintains records describing how individuals exercise their First Amendment rights, including press freedoms, and the rights to freely associate and assemble. The Privacy Act forbids agencies from maintaining these types of records “unless expressly authorized by statute or by the individual about whom the record is maintained or unless pertinent to and within the scope of an authorized law enforcement activity.” In addition to the aforementioned Privacy Act violations, the NSA has violated and continues to violate the Privacy Act by maintaining records describing how individuals exercise their First Amendment rights.
Conclusion. The NSA is currently in violation of the Privacy Act and DoD Privacy Program regulations. The DoD must ensure that the NSA complies with the Privacy Act by publishing additional system of records notices and otherwise adhering to the Privacy Act before it can adopt its current proposal.
DoD Response: This Comment addresses System of Records Notices (SORNs) with respect to the DoD, and with the National Security Agency (NSA) in particular. It is DoD policy to “publish in the Federal Register upon establishment or revision a notice of the existence and character of the system of records . . .” 5 U.S.C. 552a(e)(4). A SORN is required when (1) information about an individual is collected and stored by a DoD Component; and (2) that information is retrievable by a unique personal identifier. 32 CFR 310.10 NSA has twenty-five active SORNS that are publicly available for review. NSA generates SORNs as require by the Privacy Act of 1974 and applicable DoD regulation, 32 CFR 310.10. One NSA SORN, GNSA 18, concerns NSA “collection of operations records.” GNSA 18 covers all individuals, as that term is defined within the Privacy Act to encompass citizens of the United States and lawful permanent residents. The purpose of GNSA 18 is to allow NSA to maintain, as that term is defined by the Privacy Act, records on foreign intelligence, counterintelligence, and information systems security matters relating to the missions of NSA. Specifically, GNSA 18 covers all individuals, as that term is defined by the Privacy Act, who are identified in NSA foreign intelligence, counterintelligence, or information system security reports, including supportive materials. As such, the DoD Privacy Program complies with the Privacy Act of 1974, as amended, and as codified at 5 U.S.C. 552a.
Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distribute impacts, and equity). Executive Order 13563 emphasizes the importance of quantifying both costs Start Printed Page 4207and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. This rule has been designated a “substantive non-significant regulatory action.”
It has been determined that 32 CFR part 310 does not contain a Federal mandate that may result in expenditure by State, local and tribal governments, in aggregate, or by the private sector, of $100 million or more in any one year.
It has been determined that 32 CFR part 310 does not impose reporting or recordkeeping requirements under the Paperwork Reduction Act of 1995.
It has been determined that 32 CFR part 310 does not have federalism implications, as set forth in Executive Order 13132. This rule does not have substantial direct effects on:
Accordingly 32 CFR part 310 is amended as follows:
1. The authority citation for 32 CFR part 310 is revised to read as follows:
Individual. A living person who is a U.S. citizen or an alien lawfully admitted for permanent residence. The parent of a minor or the legal guardian of any individual also may act on behalf of an individual, except as otherwise provided in this part. Members of the Military Services are “individuals.” Corporations, partnerships, sole proprietorships, professional groups, businesses, whether incorporated or Start Printed Page 4208unincorporated, and other commercial entities are not “individuals” when acting in an entrepreneurial capacity with the DoD, but persons employed by such organizations or entities are “individuals” when acting in a personal capacity (e.g., security clearances, entitlement to DoD privileges or benefits).
Official use. Within the context of this part, this term is used when officials and employees of a DoD Component have a demonstrated a need for the record or the information contained therein in the performance of their official duties, subject to DoD 5200.1-R.[3]
Protected health information (PHI). Defined in DoD 6025.18-R, “DoD Health Information Privacy Regulation” (available at http://www.dtic.mil/​whs/​directives/​corres/​pdf/​602518r.pdf).
(e) Pursuant to The Privacy Act, no record will be maintained on how an individual exercises rights guaranteed by the First Amendment to the Constitution of the United States (referred to in this part as “the First Amendment”), except:Start Printed Page 4209
(n) SORNs and notices of proposed or final rulemaking are published in the Federal Register (FR), and reports are submitted to Congress and OMB, in accordance with 5 U.S.C. 552a, OMB Circular No. A-130, and this part, Volume 1 of DoD Manual 8910.01, “DoD Information Collections Manual: Procedures for DoD Internal Information Collections” (available at http://www.dtic.mil/​whs/​directives/​corres/​pdf/​891001m_​vol1.pdf), and DoD Instruction 5545.02, “DoD Policy for Congressional Authorization and Appropriations Reporting Requirements” (available at http://www.dtic.mil/​whs/​directives/​corres/​pdf/​554502p.pdf). Information about an individual maintained in a new system of records will not be collected until the required SORN publication and review requirements are satisfied.
(6) Acts as The Privacy Act Access and Amendment appellate authority for OSD and the Office of the Chairman of Start Printed Page 4210the Joint Chiefs of Staff when an individual is denied access to or amendment of records pursuant to The Privacy Act, DoD Directive 5105.53, “Director of Administration and Management (DA&M)” (available at http://www.dtic.mil/​whs/​directives/​corres/​pdf/​510553p.pdf), and Deputy Secretary of Defense Memorandum, “Reorganization of the Office of the Deputy Chief Management Officer.”
(4) Reviews DoD legislative, regulatory, and other policy proposals that contain information on privacy issues relating to how the DoD keeps its PII. These reviews must include any proposed legislation, testimony, and comments having privacy implications in accordance with DoD Directive 5500.01, “Preparing, Processing, and Coordinating Legislation, Executive Orders, Proclamations, Views Letters, and Testimony” (available at http://www.dtic.mil/​whs/​directives/​corres/​pdf/​550001p.pdf).
(9) Compiles data in support of the DoD Chief Information Officer (DoD CIO) submission of the Federal Information Security Management Act (FISMA) Privacy Reports, pursuant to OMB Memorandum M-06-15, “Safeguarding Personally Identifiable Information” (available at http://www.whitehouse.gov/​sites/​default/​files/​omb/​memoranda/​fy2006/​m-06-15.pdf); the Biennial Matching Activity Report to OMB, in accordance with OMB Circular No. A-130 and this part; the semiannual Section 803 report in accordance with 42 U.S.C. 2000ee and 2000ee-1; and other reports as required.
(e) In addition to the responsibilities in paragraph (d), the Secretaries of the Military Departments provide program and financial support to the Combatant Commands as identified in DoD Directive 5100.03, “Support to the Headquarters of Combatant and Subordinate Unified Commands” (available at http://www.dtic.mil/​whs/​directives/​corres/​pdf/​510003p.pdf) to fund, without reimbursement, the administrative and logistic support required by combatant and subordinate unified command headquarters to perform their assigned missions effectively.
(a) Take action to ensure that any PII contained in a system of records that they access and use to conduct official Start Printed Page 4211business will be protected so that the security and confidentiality of the information is preserved.
9. Amend § 310.9 to revise paragraphs (a) and (b) to read as follows:
(b) The Defense Data Integrity Board— (1) Membership. The Board consists of:
3. See footnote 1 to § 310.1
[FR Doc. 2015-01262 Filed 1-26-15; 8:45 am]