CFTC Insider Risk Program Privacy Act Exemption (CFTC-59)
Current understanding
The CFTC has proposed a rule to establish a new Privacy Act system of records, CFTC-59, covering its Insider Risk Program, and to exempt that system from several Privacy Act provisions—including individuals’ rights to access records about themselves and to request amendment. The stated rationale is to preserve the integrity of insider threat investigations and protect confidential sources; the action follows established OMB guidance and standard agency practice for law-enforcement/security records systems. Status: proposed rule, pending public comment and finalization.
Evidence log
- 2026-10-15 — Privacy Act of 1974; Implementation: cross-connection with eoir-fraud-abuse-prevention-records: Parallel 2025-era Privacy Act exemption rulemakings for internal investigative systems of records. (novelty: 2)
- 2026-10-06 — Privacy Act Exemptions: cross-connection with treasury-fraud-tip-privacy-act-exemption: Both are agency final rules invoking Privacy Act (j)(2)/(k)(2) law-enforcement exemptions to block subject access and amendment for internal tip/insider-risk systems. (novelty: 2)
- 2026-10-07 — Privacy Act of 1974; Implementation: cross-connection with firearms-rights-restoration-privacy-act-exemption: Parallel Privacy Act exemption rulemaking pattern — comparable curtailment of individual access/amendment rights for a specialized federal records system. (novelty: 2)
- 2026-07-16 — Privacy Act of 1974; Implementation: cross-connection with dod-catch-program-privacy-act-exemption: Both are agency final rules invoking Privacy Act of 1974 exemptions for law-enforcement or investigative systems of records, limiting individual access/amendment rights. (novelty: 2)