Consistent with the discretion afforded by the APA, Regulations.gov and agency-specific comment websites use required and optional fields on comment forms to collect some identity information from commenters. In addition to the text of the comment, agencies may choose to collect identity information by requiring commenters to fill in other fields, such as name, address, and email address before they are able to submit a comment. Regardless of the fields required by the comment form, the selected agencies all accept anonymous comments in practice. Further, because the APA does not require agencies to authenticate submitted identity information, neither Regulations.gov nor the agency-specific comment websites contain mechanisms to check the validity of identity information that commenters submit through comment forms. Regulations.gov and agency-specific comment websites also collect some information about public users’ interaction with their websites through application event logs and proxy server logs, though the APA does not require agencies to collect or verify it as part of the rulemaking process. This information, which can include a public user’s Internet Protocol (IP) address, browser type and operating system, and the time and date of webpage visits, is collected separately from the comment submission process as part of routine information technology management of system security and performance, and cannot be reliably connected to specific comments. Seven of 10 selected agencies have documented some internal guidance associated with the identity of commenters during the three phases of the public comment process: intake, analysis, and response to comments. However, the focus and substance of this guidance varies by agency and phase of the comment process. As shown in table 1, for selected agencies that have guidance associated with the identity of commenters, the guidance most frequently relates to the comment intake or response to comment phases of the public comment process. The guidance for these phases addresses activities such as managing duplicate comments (those with identical or near-identical comment text but varied identity information) or referring to commenters in a final rule. Agencies are not required by the APA to develop internal guidance associated with the public comment process generally, or identity information specifically. Within the discretion afforded by the APA, the 10 selected agencies’ treatment of identity information during the comment intake, comment analysis, and response to comments phases of the public comment process varies. Selected agencies differ in how they treat identity information during the comment intake phase, particularly in terms of how they post duplicate comments, which can lead to identity information being inconsistently presented to public users of comment systems. With regard to the comment intake phase in particular, the variation in how agencies identify duplicate comments and post comments results in identity information being inconsistently presented on Regulations.gov or the agency-specific websites. Generally, officials told us that their agencies either (1) maintain all comments within the comment system or (2) maintain some duplicate comment records outside of the comment system, for instance, in email file archives. For example, according to officials of one participating agency—the Wage and Hour Division (WHD)—all duplicate comments are stored in Regulations.gov. Our analysis of WHD comments did not suggest that any comments were missing from Regulations.gov. However, in one example, almost 18,000 duplicate comments were included in attachments under one individual’s name in the comment title. While all of the comments are included within 10 separate attachments, none of the identity information included with these comments can be easily found without manually opening and searching all 10 attachments, most of which contain approximately 2,000 individual comments. Selected agencies’ treatment of identity information during the comment analysis phase also varies. Specifically, program offices with the responsibility for analyzing comments place varied importance on identity information during the analysis phase. Finally, all agencies draft a response to comments with their final rule, but the extent to which the agencies identify commenters or commenter types in their response also varies across the selected agencies. Our analysis of Regulations.gov and agency-specific comment websites shows that the varied comment posting practices of the 10 selected agencies are not always documented or clearly communicated to public users of the websites. In part to facilitate effective public participation in the rulemaking process, the E-Government Act of 2002 requires that all public comments and other materials associated with a given rulemaking should be made “publicly available online to the extent practicable.” Additionally, key practices for transparently reporting open government data state that federal government websites—like those used to facilitate the public comment process—should fully describe the data that are made available to the public, including by disclosing data sources and limitations. We found that the selected agencies we reviewed do not effectively communicate the limitations and inconsistencies in how they post identity information associated with public comments. As a result, public users of the comment websites lack information related to data availability and limitations that could affect their ability to use and make informed decisions about the comment data and effectively participate in the rulemaking process themselves. Public users of Regulations.gov seeking to submit a comment are provided with a blanket disclosure statement related to how their identity information may be disclosed, and are generally directed to individual agency websites for additional detail about submitting comments. While additional information is provided in the Privacy Notice, User Notice, and Privacy Impact Assessment for Regulations.gov, public users are not provided any further detail on Regulations.gov regarding what information, including identity information, they should expect to find in the comment data. Additionally, there is not enough information to help public users determine whether all of the individual comments and associated identity information are posted. Available resources on Regulations.gov direct public users to participating agencies’ websites for additional information about agency-specific review and posting policies. Seven of the eight participating agencies’ websites direct public users back to Regulations.gov and the Federal Register, either on webpages that are about the public comment process in general, or on pages containing information about specific NPRMs. Three of these participating agencies—the Environmental Protection Agency (EPA), Fish and Wildlife Service (FWS), and Food and Drug Administration (FDA)—do provide public users with information beyond directing them back to Regulations.gov or the Federal Register, but only FDA provides users with details about posting practices that are not also made available on Regulations.gov. The eighth participating agency—the Employee Benefits Security Administration (EBSA)—does not direct public users back to Regulations.gov, and instead re-creates all rulemaking materials for each NPRM on its own website, including individual links to each submitted comment. However, these links go directly to comment files, and do not link to Regulations.gov. While EBSA follows departmental guidance associated with posting duplicate comments, which allows some discretion in posting practices, the agency does not have a policy for how comments are posted to Regulations.gov or its own website. Further, in the examples we reviewed, the content of the NPRM-specific pages on EBSA’s website does not always match what is posted to Regulations.gov. Because participating agencies are not required to adhere to standardized posting practices, Regulations.gov directs public users to participating agency websites for additional information about posting practices and potential data limitations. However, these websites do not describe the limitations associated with the identity information contained in publicly posted comments. As allowed for under the APA, all of the participating agencies in our review vary in the way in which they post identity information associated with comments—particularly duplicate comments. However, the lack of accompanying disclosures may potentially lead users to assume, for example, that only one entity has weighed in on an issue when, actually, that comment represents 500 comments. Without better information about the posting process, the inconsistency in the way in which duplicate comments are presented to public users of Regulations.gov limits public users’ ability to explore and use the data and could lead users to draw inaccurate conclusions about the public comments that were submitted and how agencies considered them during the rulemaking process. Both nonparticipating agencies use comment systems other than Regulations.gov and follow standardized posting processes associated with public comments submitted to their respective comment systems, but the Securities and Exchange Commission (SEC) has not clearly communicated these practices to the public. Although it appears to users of the SEC website that the agency follows a consistent process for posting duplicate comments, at the time of our June 2019 report, this practice had not been documented or communicated to public users of its website. In contrast, FCC identifies its policies for posting comments and their associated identity information in a number of places on the FCC.gov website, and on its Electronic Comment Filing System (ECFS) web page within the general website. Regarding comments submitted to rulemaking proceedings through ECFS, public users are informed that all information submitted with comments, including identity information, will be made public. Our review of ECFS comment data did not identify discrepancies with this practice. Although the public comment process allows interested parties to state their views about prospective rules, the lack of communication with the public about the way in which agencies treat identity information during the posting process, particularly for duplicate comments, may inhibit users’ meaningful participation in the rulemaking process. While the APA does not include requirements for commenters to provide identity information, or for agency officials to include commenters’ identity as part of their consideration of comments, key practices for transparently reporting open government data state that federal government websites— like those used to facilitate the public comment process—should fully describe the data that are made available to the public, including by disclosing data sources and limitations. In our June 2019 report, we made eight recommendations. Specifically, we recommended that five of the selected agencies establish a policy for posting comments, and that those five agencies plus three others take action to more clearly communicate their policies for posting comments, particularly with regard to identity information and duplicate comments. The eight agencies generally agreed with our recommendations and identified actions they planned to take in response, such as developing policies for posting duplicate comments and communicating those in various ways to public users. Since issuing our June 2019 report, SEC has taken action that is responsive to the recommendation we made to it. Specifically, in September 2019, SEC issued a memorandum that reflects SEC’s internal policies for posting duplicate comments and associated identity information. In addition, SEC has communicated these policies to public users on the SEC.gov website by adding a disclaimer on the main comment posting page that describes how the agency posts comments. Chairmen Portman and Lankford, Ranking Members Carper and Sinema, and Members of the Subcommittees, this concludes my prepared remarks. I would be happy to answer any questions you may have at this time. For further information regarding this testimony, please contact Seto J. Bagdoyan, (202) 512-6722 or bagdoyans@gao.gov. In addition, contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals who made key contributions to this testimony are David Bruno (Assistant Director), Elizabeth Kowalewski (Analyst in Charge), and Dahlia Darwiche. Other individuals who also contributed to the report on which this testimony is based include Enyinnaya David Aja, Gretel Clarke, Lauren Kirkpatrick, James Murphy, Alexandria Palmer, Carl Ramirez, Shana Wallace, and April Yeaney. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Federal agencies publish on average 3,700 proposed rules yearly and are generally required to provide interested persons (commenters) an opportunity to comment on these rules. In recent years, some high-profile rulemakings have received extremely large numbers of comments, raising questions about how agencies manage the identity information associated with comments. While the APA does not require the disclosure of identifying information from a commenter, agencies may choose to collect this information. This testimony summarizes GAO's June 2019 report on public comment posting practices (GAO-19-483). In that report, GAO examined (1) the identity information collected by comment websites; (2) the guidance agencies have related to the identity of commenters; (3) how selected agencies treat identity information; and (4) the extent to which selected agencies clearly communicate their practices associated with identity information. The agencies were selected on the basis of the volume of public comments they received on rulemakings. For this testimony, GAO obtained updates on the status of recommendations made to the selected agencies. The Administrative Procedure Act (APA) governs the process by which many federal agencies develop and issue regulations, which includes the public comment process (see figure). In June 2019, GAO found that Regulations.gov and agency-specific comment websites collect some identity information—such as name, email, or address—from commenters who choose to provide it during the public comment process. The APA does not require commenters to disclose identity information when submitting comments. In addition, agencies have no obligation under the APA to verify the identity of such parties during the rulemaking process. GAO found in the June 2019 report that seven of 10 selected agencies have some internal guidance associated with the identity of commenters, but the substance varies. This reflects the differences in the way that the selected agencies handle commenter identity information internally. GAO also found that the selected agencies' practices for posting public comments to comment websites vary considerably, particularly for duplicate comments (identical or near-identical comment text but varied identity information). For example, one agency posts a single example of duplicate comments and indicates the total number of comments received, but only the example is available to public users of Regulations.gov. In contrast, other agencies post all comments individually. As a result, identity information submitted with comments is inconsistently presented on public websites. The APA allows agencies discretion in how they post comments, but GAO found that selected agencies do not clearly communicate their practices for how comments and identity information are posted. GAO's key practices for transparently reporting government data state that federal government websites should disclose data sources and limitations to help public users make informed decisions about how to use the data. If not, public users of the comment websites could reach inaccurate conclusions about who submitted a particular comment, or how many individuals commented on an issue. In June 2019, GAO made recommendations to eight of the selected agencies regarding implementing and communicating public comment posting policies. The agencies generally agreed with the recommendations and identified action they planned to take in response. Since the June 2019 report, one agency has implemented GAO's recommendation.