Office of the Comptroller of the Currency; Privacy Act of 1974; Proposed Implementation

AGENCY:

Office of the Comptroller of the Currency, Treasury.

ACTION:

Notice of proposed rulemaking.

SUMMARY:

With the concurrence of the Department of the Treasury (Department), the Office of the Comptroller of the Currency (OCC) issues a proposed rulemaking to amend this part to exempt five Privacy Act systems of records from certain provisions of the Privacy Act of 1974 pursuant to 5 U.S.C. 552a(j)(2) and/or 5 U.S.C. 552a(k)(2).

DATES:

Comments will be accepted until November 26, 2001.

ADDRESSES:

You should direct comments to the Office of the Comptroller of the Currency, Public Information Room, Docket No. 01-19, 250 E Street, SW., Mailstop 1-5, Washington, DC 20219. You may inspect comments received at the same location. You may send your comments by facsimile transmission to FAX number 202-874-4448 or by electronic mail to regs.comments@occ.treas.gov.

FOR FURTHER INFORMATION CONTACT:

Harold J. Hansen, Assistant Director, Administrative and Internal Law Division, (202) 874-4460 or Ellen S. Warwick, Special Counsel, Administrative and Internal Law Division, (202) 874-4460.

SUPPLEMENTARY INFORMATION:

Under the Privacy Act of 1974, 5 U.S.C. 552a, as amended, a Federal agency is required, among other things, to: (1) Maintain only information about an individual that is relevant and necessary to accomplish an authorized purpose; (2) Notify an individual whether information about him or her is maintained in a system of records; (3) Provide an individual with access to the records containing information about him or her, including an accounting of disclosures made of that information; (4) Permit an individual to request amendment of records about him or her; and (5) Describe in system notices the sources of information maintained about individuals and the procedures under which notice, access and amendment rights may be exercised. Under certain circumstances, however, the head of a Federal agency may issue rules to exempt a particular system of records from these requirements (5 U.S.C. 552a(j) and (k)). Two of the six systems that the OCC proposes to alter are currently exempt from certain of the Privacy Act's requirements pursuant to 5 U.S.C. 552a(j)(2) and (k)(2). These systems, Treasury/Comptroller .013-Enforcement and Compliance Information System (to be renamed “Reports of Suspicious Activities”) and Treasury/Comptroller .500-Chief Counsel's Management Information System will remain exempt from certain of the Privacy Act's requirements.

Notices of Proposed New and Altered Systems of Records

The Department and the OCC have published separately in the Federal Register a notice establishing five new systems of records, and a notice altering six existing systems of records.

In further regard to the proposal to alter six existing systems, the OCC proposes by this rulemaking to exempt two of the remaining four systems from certain of the Privacy Act's requirements pursuant to 5 U.S.C. 552a(j)(2) and/or (k)(2). These systems are: (1) Treasury/Comptroller .510-Litigation Information System; and (2) Treasury/Comptroller .600-Consumer Complaint and Inquiry Information System.

Additionally, the OCC has proposed to establish five new systems of records, three of which are proposed by this rulemaking to be exempted from certain of the Privacy Act's requirements pursuant to 5 U.S.C. 552a(j)(2) and/or (k)(2). The new systems of records that are proposed to be exempted by this rulemaking are: (1) Treasury/Comptroller .100—Enforcement Action Report System; (2) Treasury/Comptroller .120—Bank Fraud Information System; and (3) Treasury/Comptroller .220—Section 914 Tracking System.

Proposed Exemptions

The systems of records that are proposed to be exempted under 5 U.S.C. 552a(j)(2) are: (1) Treasury/Comptroller .510—Litigation Information System; and (2) Treasury/Comptroller .120—Bank Fraud Information System.

The provisions of the Privacy Act of 1974 from which exemption is proposed pursuant to 5 U.S.C. 552a(j)(2) are:

5 U.S.C. 552a(c)(3) and (4);

5 U.S.C. 552a(d)(1), (2), (3), and (4);

5 U.S.C. 552a(e)(1), (2), and (3);

5 U.S.C. 552a(e)(4)(G), (H), and (I);

5 U.S.C. 552a(f); and

5 U.S.C. 552a(g).

The systems of records that are proposed to be exempted under 5 U.S.C. 552a(k)(2) are: (1) Treasury/Comptroller .100—Enforcement Action Report System; (2) Treasury/Comptroller .120—Bank Fraud System; (3) Treasury/Comptroller .220—Section 914 Tracking System; (4) Treasury/Comptroller .510—Litigation Information System; and (5) Treasury/Comptroller .600—Consumer Complaint and Inquiry Information System.

The provisions of the Privacy Act of 1974 from which exemption is proposed pursuant to 5 U.S.C. 552a(k)(2) are:

5 U.S.C. 552a(c)(3);

5 U.S.C. 552a(d)(1), (2), (3), and (4);

5 U.S.C. 552a(e)(1); (e)(4)(G), (H), and (I); and

5 U.S.C. 552a(f).

Reasons for Exemptions Under 5 U.S.C. 552a(j)(2) and (k)(2)

(1) 5 U.S.C. 552a(e)(4)(G) and (f)(1) enable individuals to inquire whether a system of records contains records pertaining to them. Application of these provisions to the systems of records would allow individuals to learn whether they have been identified as suspects or subjects of investigation. Access to such knowledge would impair the OCC's ability to carry out its mission, since individuals could:

(a) Take steps to avoid detection;

(b) Inform associates that an investigation is in process;

(c) Learn the nature of the investigation;

(d) Learn whether they are only suspects or identified as law violators;

(e) Begin, continue, or resume illegal conduct upon learning that they are not identified in the system of records; or

(f) Destroy evidence needed to prove the violation.

(2)(a) 5 U.S.C. 552a(d)(1), (e)(4)(H) and (f)(2), (3) and (5) grant individuals access to records pertaining to them. The application of these provisions to the systems of records would compromise the OCC's ability to utilize and provide useful tactical and strategic information to law enforcement agencies.

(b) Permitting access to records contained in the systems of records would provide individuals with information concerning the nature of any current investigations and would enable them to avoid detection or apprehension by:

(i) Discovering the facts that would form the basis for their detection or apprehension;

(ii) Enabling them to destroy or alter evidence of illegal conduct that would form the basis for their detection or apprehension;

(iii) Using knowledge that investigators had reason to believe that a violation of law was about to be committed, to delay the commission of the violation or commit it at a location that might not be under surveillance;

(c) Permitting access to either on-going or closed investigative files would also reveal investigative techniques and procedures, the knowledge of which could enable individuals planning illegal acts to structure their operations so as to avoid detection or apprehension;

(d) Permitting access to investigative files and records could, moreover, disclose the identity of confidential sources and informers and the nature of the information supplied and thereby endanger the physical safety of those sources by exposing them to possible reprisals for having provided the information. Confidential sources and informers might refuse to provide investigators with valuable information unless they believed that their identities would not be revealed through disclosure of their names or the nature of the information they supplied. Loss of access to such sources would seriously impair the OCC's ability to carry out its mandate.

(e) Furthermore, providing access to records contained in the systems of records could reveal the identities of undercover law enforcement officers or other persons who compiled information regarding the individual's illegal activities and thereby endanger the physical safety of those officers, persons, or their families by exposing them to possible reprisals.

(f) By compromising the law enforcement value of the systems of records for the reasons outlined in paragraphs (b) through (e) of this section, permitting access in keeping with these provisions would discourage other law enforcement and regulatory agencies, foreign and domestic, from freely sharing information with the OCC and thus would restrict the OCC's access to information necessary to accomplish its mission most effectively.

(g) Finally, the dissemination of certain information that the OCC may maintain in the systems of records is restricted by law.

(3) 5 U.S.C. 552a(d)(2), (3), and (4), (e)(4)(H), and (f)(4) permit an individual to request amendment of a record pertaining to him or her and require the agency either to amend the record, or to note the disputed portion of the record and to provide a copy of the individual's statement of disagreement with the agency's refusal to amend a record to persons or other agencies to whom the record is thereafter disclosed. Since these provisions depend on the individual's having access to his or her records, and since these rules exempt the systems of records from the provisions of 5 U.S.C. 552a relating to access to records, for the reasons set out in subparagraphs (b) through (g) of paragraph (2), above, these provisions should not apply to the systems of records.

(4)(a) 5 U.S.C. 552a(c)(3) requires an agency to make accountings of disclosures of a record available to the individual named in the record upon his or her request. The accountings must state the date, nature, and purpose of each disclosure of the record and the name and address of the recipient.

(b) The application of this provision would impair the ability of the OCC, the Department, and law enforcement agencies outside the Department of the Treasury to make effective use of information maintained by the OCC. Making accountings of disclosures available to the subjects of an investigation would alert them to the fact that an agency is conducting an investigation into their illegal activities and could reveal the geographic location of the investigation, the nature and purpose of that investigation, and the dates on which that investigation was active. Violators possessing such knowledge would be able to take measures to avoid detection or apprehension by altering their operations, by transferring their illegal activities to other geographical areas, or by destroying or concealing evidence that would form the basis for detection or apprehension.

(c) Providing accountings to the subjects of investigations would alert them to the fact that the OCC has information regarding their illegal activities and could inform them of the general nature of that information. Access to such information could reveal the operation of the OCC's information gathering and analysis systems and permit violators to take steps to avoid detection or apprehension.

(5)(a) 5 U.S.C. 552a(e)(1) requires an agency to maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or executive order. The term “maintain” as defined in 5 U.S.C. 552a(a)(3), includes “collect” and “disseminate.” The application of this provision to the system of records could impair the OCC's ability to collect, utilize, and disseminate valuable law enforcement information.

(b) At the time that the OCC collects information, it often lacks sufficient time to determine whether the information is relevant and necessary to accomplish an OCC purpose.

(c) In many cases, especially in the early stages of investigation, it may be impossible immediately to determine whether information collected is relevant and necessary, and information that initially appears irrelevant and unnecessary often may, upon further evaluation or upon collation with information developed subsequently, prove particularly relevant to a law enforcement program.

(d) Not all violations of law discovered by OCC analysts fall within the investigative jurisdiction of the OCC. To promote effective law enforcement, the OCC will have to disclose such violations to other law enforcement agencies, including State, local, and foreign agencies that have jurisdiction over the offenses to which the information relates. Otherwise, the OCC might be placed in the position of having to ignore information relating to violations of law not within its jurisdiction when that information comes to the OCC's attention during the collation and analysis of information in its records.

(6) 5 U.S.C. 552a(e)(4)(I) requires an agency to publish a general notice listing the categories of sources for information contained in a system of records. The application of this provision to the systems of records could compromise the OCC's ability to complete or continue investigations or inquiries or to provide useful information to law enforcement agencies, since revealing sources for the information could:

(a) Disclose investigative techniques and procedures;

(b) Result in threats or reprisals against informers by the subjects of an investigation; and

(c) Cause informers to refuse to give full information to investigators for fear of having their identities as sources disclosed.

Reasons for Additional Exemptions Claimed Solely Under 5 U.S.C. 552a(j)(2)

(1) 5 U.S.C. 552a(c)(4) requires an agency to inform any person or other agency about any correction or notation of dispute that the agency made in accordance with 5 U.S.C. 552a(d) to any record that the agency disclosed to the person or agency if an accounting of the disclosure was made. Since this provision depends on an individual's having access to and an opportunity to request amendment of records pertaining to him or her, and since these rules exempt the systems of records from the provisions of 5 U.S.C. 552a relating to access to and amendment of records, this provision should not apply to the systems of records.

(2)(a) 5 U.S.C. 552a(e)(2) requires an agency to collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual's rights, benefits, and privileges under Federal programs. The application of this provision to the systems of records would impair the OCC's ability to collate, analyze, utilize, and disseminate investigative, intelligence, and enforcement information.

(b) Most information collected about an individual under criminal investigation is obtained from third parties, such as witnesses and informants. It is usually not feasible to rely upon the subject of the investigation as a source for information regarding his or her criminal activities.

(c) An attempt to obtain information from the subject of a criminal investigation will often alert that individual to the existence of an investigation, thereby affording the individual an opportunity to attempt to conceal his criminal activities so as to avoid apprehension.

(d) In certain instances, the subject of a criminal investigation is not required to supply information to investigators as a matter of legal duty.

(e) During criminal investigations it is often a matter of sound investigative procedure to obtain information from a variety of sources to verify information already obtained.

(3)(a) 5 U.S.C. 552a(e)(3) requires an agency to inform each individual whom it asks to supply information, on the form that it uses to collect the information or on a separate form that the individual can retain, of the agency's authority for soliciting the information; whether disclosure of information is voluntary or mandatory; the principal purposes for which the agency will use the information; the routine uses that may be made of the information; and the effects on the individual of not providing all or part of the information. The systems of records should be exempted from this provision to avoid impairing the OCC's ability to collect and collate investigative and enforcement information. Confidential sources or law enforcement officials often obtain information under circumstances in which it is necessary to keep the true purpose of their actions secret so as not to let the subject of the investigation or his or her associates know that a criminal investigation is in progress.

(c) Providing a confidential source of information with written evidence that he or she was a source, as required by this provision, could increase the likelihood that the source of information would be subject to retaliation by the subject of the investigation.

(d) Individuals may be contacted during preliminary information gathering before any individual is identified as the subject of an investigation. Informing the individual of the matters required by this provision would impede or compromise subsequent investigations.

(e) Finally, application of this provision could result in an unwarranted invasion of the personal privacy of the subject of the criminal investigation, particularly where further investigation reveals that the subject was not involved in any criminal activity.

(4)(a) 5 U.S.C. 552a(e)(5) requires an agency to maintain all records it uses in making any determination about any individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the determination.

(b) Since 5 U.S.C. 552a(a)(3) defines “maintain” to include “collect” and “disseminate,” application of this provision to the systems of records would hinder the initial collection of any information that could not, at the moment of collection, be determined to be accurate, relevant, timely, and complete. Similarly, application of this provision would seriously restrict the OCC's ability to disseminate information pertaining to a possible violation of law to law enforcement and regulatory agencies. In collecting information during a criminal investigation, it is often impossible or unfeasible to determine accuracy, relevance, timeliness, or completeness prior to collection of the information. In disseminating information to law enforcement and regulatory agencies, it is often impossible to determine accuracy, relevance, timeliness, or completeness prior to dissemination, because the OCC may not have the expertise with which to make such determinations.

(c) Information that may initially appear inaccurate, irrelevant, untimely, or incomplete may, when collated and analyzed with other available information, become more pertinent as an investigation progresses. In addition, application of this provision could seriously impede criminal investigators in the exercise of their judgment in reporting results obtained during criminal investigations.

(5) 5 U.S.C. 552a(e)(8) requires that an agency make reasonable efforts to serve notice on an individual when the agency makes any record on the individual available to any person under compulsory legal process, when such process becomes a matter of public record. The systems of records should be exempted from this provision to avoid revealing investigative techniques and procedures outlined in those records and to prevent revelation of the existence of an ongoing investigation where there is need to keep the existence of the investigation secret.

(6) 5 U.S.C. 552a(g) provides for civil remedies to an individual when an agency wrongfully refuses to amend a record or to review a request for amendment, when an agency wrongfully refuses to grant access to a record, when an agency fails to maintain accurate, relevant, timely, and complete records which are used to make a determination adverse to the individual, and when an agency fails to comply with any other provision of 5 U.S.C. 552a so as to adversely affect the individual. The system of records should be exempted from this provision to the extent that the civil remedies may relate to provisions of 5 U.S.C. 552a from which these rules exempt the systems of records, since there should be no civil remedies for failure to comply with provisions from which the OCC is exempted. Exemption from this provision will also protect the OCC from baseless civil court actions that might hamper its ability to collate, analyze, utilize, and disseminate investigative, intelligence, and law enforcement data.

The Regulatory Flexibility Act (RFA) requires Federal agencies either to certify that a proposed rule would not, if adopted in final form, have a significant impact on a substantial number of small entities or to prepare an initial regulatory flexibility analysis of the proposal and publish the analysis for comment (5 U.S.C. 603, 605). This regulation will exempt five systems of records from the Privacy Act. Because this regulation affects only internal agency administration, these exemptions are not expected to generate any costs for banks of any size. Therefore, the OCC and the Department certify that the proposed rule, if adopted in final form, will not have a significant economic impact on a substantial number of small entities.

In accordance with the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.), the OCC and the Department have determined that this proposed rule would not impose new recordkeeping, application, reporting, or other types of information collection requirements.

Section 202 of the Unfunded Mandates Reform Act of 1995, Pub. L. 104-4 (Unfunded Mandates Act), requires that an agency prepare a budgetary impact statement before promulgating a rule that includes a Federal mandate that may result in expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100 million or more in any one year. If a budgetary impact statement is required, section 205 of the Unfunded Mandates Act also requires an agency to identify and consider a reasonable number of regulatory alternatives before promulgating a rule. The OCC and the Department have determined that the proposed rule will not result in expenditures by State, local, or tribal governments or by the private sector of $100 million or more. Accordingly, the OCC and Department have not prepared a budgetary impact statement or specifically addressed the regulatory alternatives considered.

The OCC and the Department have determined that this proposed rule, if adopted as a final rule, would not constitute a “significant regulatory action” under Executive Order 12866 and, therefore, does not require a Regulatory Impact Analysis.

List of Subjects in 31 CFR Part 1

• Privacy

Part 1, Subpart C of Title 31 of the Code of Federal Regulations is amended as follows:

PART 1—[AMENDED]

1. The authority citation for part 1 continues to read as follows:

Authority: 5 U.S.C. 301 and 31 U.S.C. 321. Subpart A also issued under 5 U.S.C. 552 as amended. Subpart C also issued under 5 U.S.C. 552a.

2. Section 1.36 of Subpart C is amended as follows:

a. Paragraph (c)(1)(iii) is amended by adding “CC .120 Bank Fraud Information System” and “CC .510 Litigation Information System” to the table in numerical order.

b. Paragraph (g)(1)(iii) is amended by adding “CC .100 Enforcement Action Report System,” “CC .120 Bank Fraud Information System,” “CC .220 Section 914 Tracking System,” “CC .510 Litigation Information System,” and “CC .600 Consumer Complaint and Inquiry Information System” to the table in numerical order.

The additions to § 1.36 read as follows: