Privacy Act of 1974: Implementation of Exemptions

AGENCY:

U.S. Department of Energy.

ACTION:

Notice of proposed rulemaking.

SUMMARY:

The Department of Energy (DOE, the Department) is giving notice of a newly established System of Records pursuant to the Privacy Act of 1974 for the Department of Energy—DOE–78 Data Analytics Program Records in this proposed rulemaking. The Department proposes to exempt portions of the System of Records from one or more provisions of the Privacy Act because of criminal, civil, and administrative enforcement requirements.

DATES:

To be assured of consideration, written comments on this proposed rulemaking must be received at one of the addresses listed in the ADDRESSES section, on or before December 27, 2023. Comments received following the aforementioned date may be considered if it is practical to do so. Please refer to section IV (Public Participation—Submission of Comments) for additional information on the comment period.

ADDRESSES:

You may submit comments identified by docket number DOE–HQ–2023–0058, as follows:

Federal eRulemaking Portal: www.regulations.gov. Include the docket number DOE–HQ–2023–0058 in the “Enter Keyword or ID” field and click on “Search.” On the next web page, click on “Submit a Comment” action and follow the instructions in the portal.

Mail/Hand Delivery/Courier [for paper, disk, or CD-ROM submissions] to: Ken Hunt, U.S. Department of Energy, 1000 Independence Avenue SW, Office 8H–085, Washington, DC 20585.

Comments received, including any personal information, will be posted without change to www.regulations.gov.

Docket: The docket, which includes Federal Register notices, comments, and other supporting documents/materials, is available for review at www.regulations.gov. All documents in the docket are listed in the www.regulations.gov index. However, some documents listed in the index, such as those containing information that is exempt from public disclosure, may not be publicly available. The www.regulations.gov web page contains instructions on how to access all documents, including public comments, in the docket. See section IV of this document for further information on how to submit comments through www.regulations.gov.

FOR FURTHER INFORMATION CONTACT:

Kyle David, U.S. Department of Energy, 1000 Independence Avenue SW, Office 8H–085, Washington, DC 20585; facsimile: (202) 586–8151; email: kyle.david@hq.doe.gov, telephone: (240) 686–9485.

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Authority and Background

A. Authority

B. Background

II. Discussion

III. Procedural Issues and Regulatory Review

A. Review Under Executive Orders 12866, 13563, and 14094

B. Review Under the Regulatory Flexibility Act

C. Review Under the Paperwork Reduction Act of 1995

D. Review Under the National Environmental Policy Act of 1969

E. Review Under Executive Order 12988

F. Review Under Executive Order 13132

G. Review Under Executive Order 13175

H. Review Under the Unfunded Mandates Reform Act of 1995

I. Review Under Executive Order 12360

J. Review Under Executive Order 13211

K. Review Under the Treasury and General Government Appropriations Act, 1999

L. Review Under the Treasury and General Government Appropriations Act, 2001

IV. Public Participation—Submission of Comments

V. Approval by the Office of the Secretary of Energy

I. Authority and Background

A. Authority

DOE has broad authority to manage the agency's collection, use, processing, maintenance, storage, and disclosure of Personally Identifiable Information (PII) pursuant to the following authorities: 42 United States Code (U.S.C.) 7101 et seq., 50 U.S.C. 2401 et seq., 5 U.S.C. 1104, 5 U.S.C. 552, 5 U.S.C. 552a, 42 U.S.C. 7254, 5 U.S.C. 301, and 42 U.S.C. 405 note.

B. Background

The Privacy Act of 1974 (the Act) (5 U.S.C. 552a) embodies fair information practice principles in a statutory framework governing the means by which the U.S. Government collects, maintains, uses, and disseminates personally identifiable information. The Privacy Act applies to information that is maintained in a “System of Records.” A “System of Records” is a group of any records under the control of an agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual. In the Privacy Act, an individual is defined to encompass U.S. citizens and lawful permanent residents.

The Privacy Act allows government agencies to exempt certain records from the access and amendment provisions. If an agency claims an exemption, it must issue a Notice of Proposed Rulemaking to make clear to the public the reasons why a particular exemption is claimed.

II. Discussion

DOE is claiming exemptions from certain requirements of the Privacy Act for one System of Records: DOE–78 Data Analytics Program Records.

DOE–78 Data Analytics Program Records will aggregate, store, and use data that the Office of the Inspector General (OIG) has the legal authority to collect and maintain to perform statistical analytics, data science, link analysis, and other mathematical techniques. The primary goal of this work is to identify anomalies that may indicate systemic or specific risks as well as activities that indicate mismanagement, fraud, abuse, waste, unlawful or unethical activity in DOE programs and operations. The analysis may support other parts of OIG by helping to identify specific areas for OIG attention or the development of risk indicators. Other parts of OIG may use the analytic output of the system to determine predication or indication for audits, inspections, evaluations, and investigations, including joint refinement of preliminary analysis, under their specific authorities.

For this System of Records, DOE claims exemptions to paragraphs (c)(3) and (4); (d)(1) through (4); (e)(1) through (3), (4)(G), (4) (H), and (4)(I); (e)(5) and (8); and (g) of the Privacy Act pursuant to 5 U.S.C. 552a(j)(2). In addition, the system has been exempted from the Privacy Act, pursuant to 5 U.S.C. 552a(k)(1), (k)(2) and (k)(5). These exemptions are needed to protect information relating to DOE activities from disclosure to subjects or others related to these activities. Specifically, the exemptions are required to preclude subjects of these activities from frustrating these processes; to avoid disclosure of activity techniques; to protect the identities and physical safety of confidential informants and law enforcement personnel; to ensure DOE's ability to obtain information from third parties and other sources; and to protect the privacy of third parties; to safeguard classified information. Disclosure of information to the subject of the inquiry could also permit the subject to avoid detection or apprehension.

The exemptions proposed here are standard law enforcement and national security exemptions exercised by many federal law enforcement and intelligence agencies. In appropriate circumstances, where compliance would not appear to interfere with or adversely affect the law enforcement purposes of this system and overall law enforcement process, the applicable exemptions may be waived on a case-by-case basis.

A System of Records Notice for DOE–78 Data Analytics Program Records is also published in this issue of the Federal Register .

Exemptions for DOE–78 Data Analytics Program Records from these particular paragraphs of the Act are justified, on a case-by-case basis to be determined at the time a request is made for the following reasons:

From paragraphs (c)(3) and (4) (Accounting for Disclosures) because release of the accounting of disclosures could alert the subject of an investigation of an actual or potential criminal, civil, or regulatory violation to the existence of that investigation and reveal investigative interest on the part of DOE as well as the recipient agency. Disclosure of the accounting would therefore present a serious impediment to law enforcement efforts or efforts to preserve national security. Disclosure of the accounting would also permit the individual who is the subject of a record to impede the investigation, to tamper with witnesses or evidence, and to avoid detection or apprehension, which would undermine the entire investigative process.

From paragraph (d) (Access to Records) because access to the records contained in this System of Records could inform the subject of an investigation of an actual or potential criminal, civil, or regulatory violation to the existence of that investigation and reveal investigative interest on the part of DOE or another agency. Access to the records could permit the individual who is the subject of a record to impede the investigation, to tamper with witnesses or evidence, and to avoid detection or apprehension. Amendment of the records could interfere with ongoing investigations and law enforcement activities and would impose an unreasonable administrative burden by requiring investigations to be continually reinvestigated. In addition, permitting access and amendment to such information could disclose security-sensitive information that could be detrimental to nuclear or energy sector security.

From paragraph (e)(1) (Relevancy and Necessity of Information) because in the course of investigations into potential violations of federal law, the accuracy of information obtained or introduced occasionally may be unclear, or the information may not be strictly relevant or necessary to a specific investigation. In the interests of effective law enforcement, it is appropriate to retain all information that may aid in establishing patterns of unlawful activity.

From paragraph (e)(2) (Collection of Information from Individuals) because requiring that information be collected from the subject of an investigation would alert the subject to the nature or existence of the investigation, thereby interfering with that investigation and related law enforcement activities.

From paragraph (e)(3) (Notice to Subjects) because providing such detailed information could impede law enforcement by compromising the existence of a confidential investigation or reveal the identity of witnesses or confidential informants.

From paragraphs (e)(4)(G), (e)(4)(H), and (e)(4)(I) (Agency Requirements) and (f) (Agency Rules), because portions of this system are exempt from the individual access provisions of paragraph (d) for the reasons noted above, and therefore DOE is not required to establish requirements, rules, or procedures with respect to such access. Providing notice to individuals with respect to existence of records pertaining to them in the System of Records or otherwise setting up procedures pursuant to which individuals may access and view records pertaining to themselves in the system would undermine investigative efforts and reveal the identities of witnesses, and potential witnesses, and confidential informants.

From paragraph (e)(5) (Collection of Information) because with the collection of information for law enforcement purposes, it is impossible to determine in advance what information is accurate, relevant, timely, and complete. Compliance with paragraph (e)(5) would preclude DOE agents from using their investigative training and exercise of good judgment to both conduct and report on investigations.

From paragraph (e)(8) (Notice on Individuals) because compliance would interfere with DOE's ability to obtain, serve, and issue subpoenas, warrants, and other law enforcement mechanisms that may be filed under seal and could result in disclosure of investigative techniques, procedures, and evidence.

From paragraph (g) (Civil Remedies) to the extent that the system is exempt from other specific paragraphs of the Privacy Act.

III. Procedural Issues and Regulatory Review

A. Review Under Executive Order 12866, 13563, and 14094

Executive Order (“E.O.”) 12866, “Regulatory Planning and Review,” 58 FR 51735 (Oct. 4, 1993), as supplemented and reaffirmed by E.O. 13563, “Improving Regulation and Regulatory Review,” 76 FR 3821 (Jan. 21, 2011) and amended by E.O. 14094, “Modernizing Regulatory Review,” 88 FR 21879 (April 11, 2023), requires agencies, to the extent permitted by law, to (1) propose or adopt a regulation only upon a reasoned determination that its benefits justify its costs (recognizing that some benefits and costs are difficult to quantify); (2) tailor regulations to impose the least burden on society, consistent with obtaining regulatory objectives, taking into account, among other things, and to the extent practicable, the costs of cumulative regulations; (3) select, in choosing among alternative regulatory approaches, those approaches that maximize net benefits (including potential economic, environmental, public health and safety, and other advantages; distributive impacts; and equity); (4) to the extent feasible, specify performance objectives, rather than specifying the behavior or manner of compliance that regulated entities must adopt; and (5) identify and assess available alternatives to direct regulation, including providing economic incentives to encourage the desired behavior, such as user fees or marketable permits, or providing information upon which choices can be made by the public. DOE emphasizes as well that E.O. 13563 requires agencies to use the best available techniques to quantify anticipated present and future benefits and costs as accurately as possible. In its guidance, the Office of Information and Regulatory Affairs (OIRA) has emphasized that such techniques may include identifying changing future compliance costs that might result from technological innovation or anticipated behavioral changes. For the reasons stated in the preamble, this proposed regulatory action is consistent with these principles.

Section 6(a) of E.O. 12866 requires agencies to submit “significant regulatory actions” to OIRA for review. OIRA has determined that this proposed regulatory action is not a “significant regulatory action” within the scope of E.O. 12866. Accordingly, this action is not subject to review under E.O. 12866 by OIRA of the Office of Management and Budget (OMB).

B. Review Under the Regulatory Flexibility Act

The Regulatory Flexibility Act of 1980 (5 U.S.C. 601 et seq.) requires that an agency prepare an initial regulatory flexibility analysis for any regulation for which a general notice of proposed rulemaking is required, unless the agency certifies that the rule, if promulgated, will not have a significant economic impact on a substantial number of small entities (5 U.S.C. 605(b)). As required by Executive Order 13272, Proper Consideration of Small Entities in Agency Rulemaking,67 FR 53461 (Aug. 16, 2002), DOE published procedures and policies on February 19, 2003, to ensure that the potential impacts of its rules on small entities are properly considered during the rulemaking process. 68 FR 7990. DOE has made its procedures and policies available on the Office of the General Counsel's website ( www.energy.gov/gc/office-general-counsel ).

DOE reviewed this proposed rule under the provisions of the Regulatory Flexibility Act and the procedures and policies published on February 19, 2003. DOE certifies that the proposed rule, if adopted, would not have significant economic impact on a substantial number of small entities. The factual basis for this certification is set forth below.

This proposed rule would update DOE's policies and procedures concerning the disclosure of records held within a System of Records pursuant to the Privacy Act of 1974. This proposed rule would apply only to activities conducted by DOE's federal employees and contractors, who would be responsible for implementing the rule requirements. DOE does not expect there to be any potential economic impact of this proposed rule on small businesses. Small businesses, therefore, should not be adversely impacted by the requirements in this proposed rule. For these reasons, DOE certifies that this proposed rule, if promulgated, would not have a significant economic impact on a substantial number of small entities, and therefore, no regulatory flexibility analysis has been prepared.

C. Review Under the Paperwork Reduction Act of 1995

This proposed rule does not impose a collection of information requirement subject to review and approval by OMB under the Paperwork Reduction Act (44 U.S.C. 3501 et seq.).

D. Review Under the National Environmental Policy Act of 1969

Pursuant to the National Environmental Policy Act of 1969 (NEPA), DOE has analyzed this proposed action in accordance with NEPA and DOE's NEPA implementing regulations (10 CFR part 1021). DOE's regulations include a categorical exclusion (CX) for rulemakings interpreting or amending an existing rule or regulation that does not change the environmental effect of the rule or regulation being amended. 10 CFR part 1021, subpart D, appendix A5. DOE has determined that this proposed rule is covered under the CX found in DOE's NEPA regulations at paragraph A.5 of appendix A to subpart D, 10 CFR part 1021, because it is an amendment to an existing regulation that does not change the environmental effect of the amended regulation and, therefore, meets the requirements for the application of this CX. See10 CFR 1021.410. Therefore, DOE has determined that this proposed rule is not a major Federal action significantly affecting the quality of the human environment within the meaning of NEPA and does not require an Environmental Assessment or an Environmental Impact Statement.

E. Review Under Executive Order 12988

With respect to the review of existing regulations and the promulgation of new regulations, Section 3(a) of Executive Order 12988, “Civil Justice Reform,” 61 FR 4729 (February 7, 1996), imposes on Federal agencies the general duty to adhere to the following requirements: (1) eliminate drafting errors and ambiguity; (2) write regulations to minimize litigation; (3) provide a clear legal standard for affected conduct rather than a general standard; and (4) promote simplification and burden reduction. Section 3(b) of Executive Order 12988 specifically requires that executive agencies make every reasonable effort to ensure the regulation: (1) clearly specifies the preemptive effect, if any; (2) clearly specifies any effect on existing Federal law or regulation; (3) provides a clear legal standard for the affected conduct while promoting simplification and burden reduction; (4) specifies the retroactive effect, if any; (5) adequately defines key terms; (6) specifies whether administrative proceedings are to be required before parties may file suit in court and, if so, describes those proceedings and requires the exhaustion of administrative remedies; and (7) addresses other important issues affecting clarity and general draftsmanship under any guidelines issued by the Attorney General. Section 3(c) of Executive Order 12988 requires Executive agencies to review regulations in light of applicable standards in section 3(a) and section 3(b) to determine whether they are met or it is unreasonable to meet one or more of the standards. DOE has completed the required review and determined that, to the extent permitted by law, this proposed rule meets the relevant standards of Executive Order 12988.

F. Review Under Executive Order 13132

Executive Order 13132, “Federalism,” 64 FR 43255 (August 10, 1999) imposes certain requirements on agencies formulating and implementing policies or regulations that preempt State law or that have federalism implications. Agencies are required to examine the constitutional and statutory authority supporting any action that would limit the policymaking discretion of the States and carefully assess the necessity for such actions. The Executive order also requires agencies to have an accountable process to ensure meaningful and timely input by State and local officials in the development of regulatory policies that have federalism implications. On March 14, 2000, DOE published a statement of policy describing the intergovernmental consultation process it will follow in the development of such regulations. 65 FR 13735. DOE has examined this proposed rule and has tentatively determined that it would not preempt State law and would not have a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government. No further action is required by Executive Order 13132.

G. Review Under Executive Order 13175

Under Executive Order 13175 (65 FR 67249, November 6, 2000) on “Consultation and Coordination with Indian Tribal Governments,” DOE may not issue a discretionary rule that has “Tribal” implications and imposes substantial direct compliance costs on Indian Tribal governments. DOE has determined that the proposed rule would not have such effects and concluded that Executive Order 13175 does not apply to this proposed rule.

H. Review Under the Unfunded Mandates Reform Act of 1995

Title II of the Unfunded Mandates Reform Act (UMRA) of 1995 (Pub. L. 104–4) requires each Federal agency to assess the effects of a Federal regulatory action on State, local, and Tribal governments, and the private sector. (Pub. L. 104–4, sec. 201 et seq. (codified at 2 U.S.C. 1531 et seq.)). For a proposed regulatory action likely to result in a rule that may cause the expenditure by State, local, and Tribal governments, in the aggregate, or by the private sector of $100 million or more in any one year (adjusted annually for inflation), section 202 of UMRA requires a Federal agency to publish a written statement that estimates the resulting costs, benefits, and other effects on the national economy. (2 U.S.C. 1532(a), (b)) UMRA also requires a Federal agency to develop an effective process to permit timely input by elected officers of State, local, and Tribal governments on a proposed “significant Federal intergovernmental mandate,” and requires an agency plan for giving notice and opportunity for timely input to potentially affected small governments before establishing any requirements that might significantly or uniquely affect them. On March 18, 1997, DOE published a statement of policy on its process for intergovernmental consultation under UMRA. (62 FR 12820) (This policy is also available at: www.energy.gov/gc/guidance-opinions under “Guidance & Opinions” (Rulemaking)). DOE examined the proposed rule according to UMRA and its statement of policy and has determined that the rule contains neither an intergovernmental mandate, nor a mandate that may result in the expenditure by State, local, and Tribal governments, in the aggregate, or by the private sector, of $100 million or more in any year. Accordingly, no further assessment or analysis is required under UMRA.

I. Review Under Executive Order 12630

DOE has determined, under Executive Order 12630, “Governmental Actions and Interference with Constitutionally Protected Property Rights” 53 FR 8859 (March 18, 1988), that this proposed regulation would not result in any takings that might require compensation under the Fifth Amendment to the U.S. Constitution.

J. Review Under Executive Order 13211

Executive Order 13211, “Actions Concerning Regulations That Significantly Affect Energy Supply, Distribution, or Use,” 66 FR 28355 (May 22, 2001) requires Federal agencies to prepare and submit to the OIRA, which is part of OMB, a Statement of Energy Effects for any proposed significant energy action. A “significant energy action” is defined as any action by an agency that promulgates or is expected to lead to promulgation of a final rule, and that: (1)(i) is a significant regulatory action under Executive Order 12866, or any successor order; and (ii) is likely to have a significant adverse effect on the supply, distribution, or use of energy, or (2) is designated by the Administrator of OIRA as a significant energy action. For any proposed significant energy action, the agency must give a detailed statement of any adverse effects on energy supply, distribution, or use should the proposal be implemented, and of reasonable alternatives to the action and their expected benefits on energy supply, distribution, and use. This proposed regulatory action is not a significant energy action. Accordingly, DOE has not prepared a Statement of Energy Effects.

K. Review Under the Treasury and General Government Appropriations Act, 1999

Section 654 of the Treasury and General Government Appropriations Act, 1999 (Pub. L. 105–277) requires Federal agencies to issue a Family Policymaking Assessment for any proposed rule that may affect family well-being. This proposed rule would not have any impact on the autonomy or integrity of the family as an institution. Accordingly, DOE has concluded that it is not necessary to prepare a Family Policymaking Assessment.

L. Review Under the Treasury and General Government Appropriations Act, 2001

Section 515 of the Treasury and General Government Appropriations Act, 2001 (44 U.S.C. 3516) provides for Federal agencies to review most disseminations of information to the public under guidelines established by each agency pursuant to general guidelines issued by OMB. OMB's guidelines were published at 67 FR 8452 (February 22, 2002), and DOE's guidelines were published at 67 FR 62446 (October 7, 2002). Pursuant to OMB Memorandum M–19–15, Improving Implementation of the Information Quality Act (April 24, 2019), DOE published updated guidelines which are available at: www.energy.gov/sites/prod/files/2019/12/f70/DOE%20Final%20Updated%20IQA%20Guidelines%20Dec%202019.pdf.

DOE has reviewed this proposed rule and will ensure that information produced under this regulation remains consistent with the applicable OMB and DOE guidelines.

IV. Public Participation—Submission of Comments

DOE will accept comments, data, and information regarding this proposed rule before or no later than the date provided in the DATES section at the beginning of this proposed rule. Interested individuals are invited to participate in this proceeding by submitting data, views, or arguments with respect to this proposed rule using the method described in the ADDRESSES section at the beginning of this proposed rule. To help the Department review the submitted comments, commenters are requested to reference the paragraph(s), ( e.g., § 1008.22(d)), to which they refer where possible.

1. Submitting comments www.regulations.gov. The www.regulations.gov web page will require you to provide your name and contact information. Your contact information will be viewable by DOE's Office of Privacy Management and Compliance staff only. Your contact information will not be publicly viewable except for your first and last names, organization name (if any), and submitter representative name (if any). If your comment is not processed properly because of technical difficulties, DOE will use this information to contact you. If DOE cannot read your comment due to technical difficulties and cannot contact you for clarification, DOE may not be able to consider your comment. However, your contact information will be publicly viewable if you include it in the comment itself or in any documents attached to your comment. Any information that you do not want to be publicly viewable should not be included in your comment, nor in any document attached to your comment. Persons viewing comments will see only first and last names, organization names, correspondence containing comments, and any documents submitted with the comments.

Do not submit to www.regulations.gov information for which disclosure is restricted by statute, such as trade secrets and commercial or financial information (hereinafter referred to as Confidential Business Information (CBI)). Comments submitted through www.regulations.gov cannot be claimed as CBI. Comments received through www.regulations.gov will waive any CBI claims for the information submitted. For information on submitting CBI, see the Confidential Business Information section.

DOE processes submissions made through www.regulations.gov before posting. Normally, comments will be posted within a few days of being submitted. However, if large volumes of comments are being processed simultaneously, your comment may not be viewable for up to several weeks. Please keep the comment tracking number that www.regulations.gov provides after you have successfully uploaded your comment.

Comments, data, and other information submitted to DOE electronically should be provided in PDF (preferred), Microsoft Word or Excel, WordPerfect, or text (ASCII) file format. Provide documents that are not secured, that are written in English, and that are free of any defects or viruses. Documents should not contain special characters or any form of encryption and, if possible, they should carry the electronic signature of the author.

2. Confidential Business Information. Pursuant to the provisions of 10 CFR 1004.11, anyone submitting information or data he or she believes to be confidential and exempt by law from public disclosure should submit two well-marked copies: one copy of the document marked “CONFIDENTIAL” including all the information believed to be confidential, and one copy of the document marked “NON–CONFIDENTIAL” with the information believed to be confidential deleted. Submit these documents via email. DOE will make its own determination as to the confidentiality of the information and treat it according to its determination.

It is DOE's policy that all comments may be included in the public docket, without change and as received, including any personal information provided in the comments (except information deemed to be exempt from public disclosure).

3. Campaign form letters. Please submit campaign form letters by the originating organization in batches of between 50 to 500 form letters per PDF or as one form letter with a list of supporters' names compiled into one or more PDFs. This reduces comment processing and posting time.

V. Approval by the Office of the Secretary of Energy

The Secretary of Energy has approved publication of this notice of proposed rulemaking.

List of Subjects in 10 CFR Part 1008

• Administration practice and procedure
• Freedom of information
• Privacy
• Reporting and recordkeeping requirements

Signing Authority

This document of the Department of Energy was signed on November 9, 2023, by Ann Dunkin, Senior Agency Official for Privacy, pursuant to delegated authority from the Secretary of Energy. That document with the original signature and date is maintained by DOE. For administrative purposes only, and in compliance with requirements of the Office of the Federal Register, the undersigned DOE Federal Register Liaison Officer has been authorized to sign and submit the document in electronic format for publication, as an official document of the Department of Energy. This administrative process in no way alters the legal effect of this document upon publication in the Federal Register .

For the reasons set forth in the preamble, the Department of Energy proposes to amend part 1008 of chapter X of title 10 of the Code of Federal Regulations as set forth below:

PART 1008—RECORDS MAINTAINED ON INDIVIDUALS (PRIVACY ACT)

1. The authority citation for part 1008 continues to read as follows:

Authority: 42 U.S.C. 7101 et seq.; 50 U.S.C. 2401 et seq.; 5 U.S.C. 552a.

2. Amend § 1008.12 by adding paragraphs (a)(2)(iii); (b)(1)(ii)(N); (b)(2)(ii)(Q) and (b)(3)(ii)(S) to read as follows: