Privacy Act Regulations
Key claim: The CFTC proposes to exempt its new Insider Risk Program records system (CFTC-59) from certain Privacy Act provisions—including individual access and amendment rights—to protect the integrity of insider risk investigations and the identity of confidential sources.
Abstract
(Proposed Rule · Commodity Futures Trading Commission) The Commodity Futures Trading Commission (CFTC or Commission) is establishing a new Insider Risk Program, the records of which are included in a new Privacy Act system of records, CFTC-59, Insider Risk Program Records (CFTC-59), published concurrently in this Federal Register. The Commission proposes here to update its regulations to exempt CFTC-59 from certain provisions of the Privacy Act in accordance with the requirements of the Privacy Act and the guidance contained in Office of Management and Budget (OMB) Circular A-108, Federal Agency Responsibilities for Review, Reporting, and Publication Under the Privacy Act (OMB A-108) in order to maintain the integrity of insider risk investigations and to keep confidential the identity of confidential sources. If the Commission adopts this proposal, the records in CFTC-59 will be exempt from those provisions of the Privacy Act pertaining to an individual’s right to access and request amendment of their records.
Why this matters
Privacy Act exemptions define the boundary between individuals’ data rights (access, amendment, accounting of disclosures) and agencies’ need to run confidential investigations. Exempting a new insider risk records system reduces subjects’ ability to see or correct information the CFTC holds about them, while giving the agency latitude to collect and retain investigative material—an incremental but recurring pattern across federal agencies that shapes the baseline of federal-employee and contractor data rights.