Comment Letter to DHS – Notice of Modified Privacy Act System of Records

REPORT

The Immigration and Nationality Law Committee sent a letter to the U.S. Department of Homeland Security commenting on its Notice of Modified Privacy Act System of Records published on September 18, 2017. The Notice describes DHS’s proposed modifications to its system of records containing information used primarily in adjudicating requests for immigration benefits, investigating violations of immigration law, and enforcing immigration law. Among the modifications announced in the Notice are: changes to the categories of persons covered by the system, modifications to the categories of records maintained including social media information, and modifications to “routine uses” of system information. The Committee expressed concern about the procedure involved in the promulgation of the Notice, including that the notice and comment period were insufficient; that the terms of the Notice require greater clarity and specificity; and that greater assurances as to the quality, accuracy, and integrity of system data are needed. The Committee is also troubled by the potential overreach of the Notice, particularly as it appears to implicate fundamental rights including privacy concerns, and cast a wide net over immigrants (including naturalized citizens) and “associates” (including lawyers).

SUMMARY

Jonathan R. Cantor
Acting Chief Privacy Officer
Department of Homeland Security
Washington, DC 20528–0655
Fax: 202-343-4010
Via Federal e-Rulemaking Portal: http://www.regulations.gov.

RE:    Notice of Modified Privacy Act System of Records, Docket No. DHS–2017–0038

Dear Mr. Cantor:

The Immigration and Nationality Law Committee (the Committee) of the New York City Bar Association (“City Bar”) appreciates the opportunity to submit comments on the Notice of Modified Privacy Act System of Records (the “Notice”) published on September 18, 2017 by the Department of Homeland Security. With over 24,000 members, the City Bar has a longstanding mission to equip and mobilize the legal profession to practice with excellence, promote reform of the law, and advocate for access to justice in support of a fair society.  The Immigration and Nationality Law Committee represents a cross-section of the immigration legal community, and we base these comments on our expertise and experience counseling our immigrant clients who range from naturalized citizens to undocumented immigrants. Accordingly, the City Bar and its members have a strong interest in the integrity, accuracy, and transparency of the system entitled “Department of Homeland Security U.S. Citizenship and Immigration Services, U.S. Immigration and Customs Enforcement, U.S. Customs and Border Protection—001 Alien File, Index, and National File Tracking System of Records” (hereinafter, the “System”).

The Notice describes DHS’s proposed modifications to its system of records containing information used primarily in adjudicating requests for immigration benefits, investigating violations of immigration law, and enforcing immigration law. (FR 43556). Additional purposes of the System are immigration processing, and protection of national security. (FR 43559). DHS maintains the information in paper files and a number of electronic systems. (FR 43558). Among the modifications announced in the Notice are: modifications to the categories of persons covered by the System; modifications to the categories of records maintained including social media information; modifications to the categories of sources of system information; and modifications to “routine uses” of system information, as defined in the Privacy Act of 1974, 5 USC § 552a (hereinafter, the “Privacy Act”).

As an initial matter, the Committee is concerned with the procedure involved with the promulgation of the Notice: the notice and comment period were insufficient; there is a need for greater clarity and specificity in the terms of the Notice; and there is a need for greater assurances as to the quality, accuracy, and integrity of system data.  If DHS intends to pursue this expanded collection, maintenance and use of social media through agency action, we urge DHS to reissue the Notice and to take into account the recommendations below.

Secondly, the Committee is troubled by the lack of clarity and potential overreach of this Notice, particularly as it appears to implicate fundamental rights. We respectfully recommend that the Notice be rescinded, and that the Department seek Congressional authority for the proposed modifications. If Congress determines there is a need to address the issues covered in the Notice, it may propose legislation and hold hearings on the issues presented, including to determine how fundamental rights of Americans and immigrants can be safeguarded and balanced against whatever interest in security the Department of Homeland Security (DHS) feels these modifications would advance.

I.                  The Notice Appears, at Best, Minimally Adequate Under Privacy Act Standards, and the Thirty-Day Comment Period is Inadequate Given the Scope of the Notice and Level of Public Interest.   

This Notice, like a predecessor notice in November 2013 describing a previous version of the System,[1] affords the public a window of just 30 days to comment on System revisions that became effective upon publication. FR 43556.  The Notice states that “[n]ew or modified routine uses will become effective October 18, 2017.” Id. This is at best minimally satisfactory under the requirements of the Privacy Act of 1974.

The Privacy Act requires publication of notice in the Federal Register of a revision of a system of records, and specifies certain required content for such notice. 5 USC § 552a (e)(4). Among other things, such a notice “shall include . . . each routine use of the records contained in the system, including the categories of users and the purpose of such use.” Id. at (D).  The Privacy Act further mandates that “at least 30 days prior to publication of information” on each routine use of the records, an agency “publish in the Federal Register notice of any new use or intended use of the information in the system, and provide an opportunity for interested persons to submit written data, views, or arguments to the agency.” 5 USC § 552a (e)(11), emphasis added. The Notice enumerates some 41 routine uses, several of them modified. It does not appear that the Department, at any time prior to publishing the Notice, published notice of the intended modifications in the Federal Register, nor offered the public an opportunity for comment.[2] FR 4355Under the heading “Supplementary Information,” the Notice discloses that routine use E has been “updated” to comply with new policy (FR 43557), yet fails to disclose that language describing at least two other routine uses has also been modified (see, e.g., routine uses G and K, FR 43561-62; compare with FR 69864-65 (identifying modifications to routine uses)). While it is arguable that a modified routine use is not a new routine use, the Department did not make such a distinction in the Notice, see 6. The Department’s chosen approach of a single notice, with no prior notice of modified routine uses, is not consistent with the spirit of the Privacy Act, even if it complies with the letter of the law.

Despite the length and density of the Notice, the Department offered no supporting documents to illuminate the changes made since the prior notice of November 2013. Cf., e.g., Table of Changes, Instructions, Docket No. USCIS-2009-0020 (March 20, 2016), available at https://www.regulations.gov/document?D=USCIS-2009-0020-0091 (redline of proposed changes to instructions to revised USCIS Form I-485). Given this absence of transparency, the extensive reach of the System,[3] the expansion of “Record Source Categories,”[4] and the sensitivity of the collected data, a 30-day comment period following the effective date of the Notice is inadequate notice to the affected persons and the public. One indication of the depth of the public’s level of interest in this System is that over 2400 commenters, including many individuals, had submitted feedback through the Federal Register comments page as of October 11. Scores of those commenters objected to the scope and detail of the information maintained in the System, or questioned the constitutionality of the data collection. See https://www.regulations.gov/docketBrowser?rpp=50&so=DESC&sb=postedDate&po=0&dct=PS&D=DHS-2017-0038.[5] Such public skepticism could be remedied by revising the Notice to address ambiguities such as those described below, and extending the comment period to provide meaningful opportunity for feedback before implementation. Certainly, the trust and confidence of the public is a worthwhile goal for any governmental system of records, but especially one with such far-reaching impact on the lives of so many categories of stakeholders.

II.               The Department Should Reissue the Notice to Remedy Its Lack of Clarity and Specificity.

As noted above, the current Notice lacks clarity as to changes made since the previous System notice; it also perpetuates, without addressing, ambiguous and otherwise objectionable terms of the earlier notice. The Notice, like its predecessor notice, is marred by imprecise use of terms of art, and references to complex statutory authority. If DHS intends to make these sweeping changes, it should follow proper procedure and it should clarify the terms of its own Notice.

Categories of Individuals Covered by the System 

Among the “Categories of Individuals Covered by the System,” FR 43559, four newly added categories are:  legal guardians, representatives of persons with disabilities and impairments, civil surgeons, and law enforcement officers who certify requestor cooperation (which appears twice, confusingly). Applicants for benefits and other persons subject to the INA depend upon the good offices of these persons and other previously listed categories like relatives, “associates” (an ambiguous term never defined in the Notice), preparers, interpreters, and attorneys. Id. Yet the Notice threatens to chill the willingness of such participants, by failing to specify whether all “Categories of Records in the System” may be maintained as to all “Categories of Individuals Covered by the System.”  For example, does the Department intend to maintain family history, medical information, and the fruits of social media searches on attorneys, preparers, interpreters, civil surgeons, “associates,” and certifying law enforcement agents?[6] Nothing in the Notice specifies any relevant limits as to covered individuals or uses. Adding further significance to the question, the Notice specifies that the records are retained for long periods, in some cases permanently.  FR 43564.

Further, the System covers the vague category of persons “suspected” of violating various criminal or civil laws, including provisions of Executive Orders and Presidential Proclamations (id.) — although the Notice does not suggest how private individuals can be accountable for compliance with proclamations or orders of the Executive.  Other categories include: those “who were investigated by DHS in the past” and “are under investigation by DHS for possible national security threats or threats to public safety” which are also too vague to give individuals notice they may be subject to this scrutiny.

Moreover, targeting naturalized U.S. citizens for social media monitoring would effectively create two classes of citizens—those who are naturalized and those who are born citizens—and treat them disparately. Creating two classes of citizens offends the Fourteenth Amendment of the U.S. Constitution. See Boustani v. Blackwell, 460 F.Supp.2d 822, 824 (N.D. Ohio 2006) (state voting statute authorizing different treatment of native-born and naturalized citizens is unconstitutional).

Categories of Records in the System

           The Notice states that the System may include “[s]ocial media handles and aliases, associated identifiable information, and search results” (FR 43560) – a sweeping category that appears more intrusive than probative, and lacks indicia of reliability. A DHS Office of Inspector General report states that DHS pilot programs to expand the use of social media in applicant screening lacked clear and measurable objectives and standards.[7] The Inspector General’s report also identified challenges in how the Department would match social media accounts to travelers.

Further, without explanation, the Notice dropped qualifying limitations from the record category “[m]edical information” (FR 43560), which is no longer limited to information “relevant to an individual’s application for benefits under the INA before DHS or the immigration court, an individual’s removability from and/or admissibility to the United States, or an individual’s competency before the immigration court” (FR 69867). We recommend that this reasonable limitation be restored.

Record Source Categories

The Notice significantly expands the sources from which DHS may draw System information, to include “publicly available information obtained from the Internet, public records, public institutions, interviewees, [or] commercial data aggregators,” and “information shared through information sharing agreements.” FR 43561. These source descriptions are remarkably ill-defined, and raise serious concerns about the integrity and accuracy of System data, and the decisions based on it. There is no clarification in the Notice as to how social media will be used. For example, it is unclear whether the fact that an individual has “liked” or “reacted” to someone else’s post could be used against them. Similarly, there is no guidance about when and whether inconsistencies between an individual’s social media posts and what he or she states in an application can be used against him or her. We recommend that the Record Source Categories section of the Notice be reconsidered.

Exemptions Promulgated for the System

           The Notice omits much of the public disclosure called for by the Privacy Act on the basis of extensive exemptions claimed by the Secretary of Homeland Security.[8] FR 43565. Each of the many claimed exemptions rests in whole or in part on a Privacy Act provision that applies when the information is maintained by an agency “which performs as its principal function any activity pertaining to the enforcement of criminal laws.” 5 USC § 552a (j)(2), emphasis added. The assertion of this (j)(2) exemption is not consistent with the Department’s own description of its functions and the purposes of its System:

“DHS implements U.S. immigration law and policy through USCIS’ processing and adjudication of applications and petitions submitted for citizenship, asylum, and other immigration benefits. USCIS also supports national security by preventing individuals from fraudulently obtaining immigration benefits and by denying applications from individuals who pose national security or public safety threats. DHS implements U.S. immigration policy and law through ICE’s law enforcement activities and CBP’s inspection and border security processes.” FR 43557.

“DHS primarily maintains information relating to the adjudication of benefits, investigation of immigration violations, and enforcement actions in Alien Files (A-Files).” FR 43556.

The Department’s law enforcement functions are not its principal function, and are primarily civil rather than criminal. Thus, the applicability of the (j)(2) exemption is far from clear from the information provided. We recommend that the Department either share the legal opinion or research, if any, that demonstrates the availability of the claimed exemptions,[9] or retract the claim of exemption and give notice of a policy for making the appropriate disclosures.

III.            The Department Should Reissue the Notice to Offer Assurances as to the Quality, Accuracy, and Integrity of System Data

The Notice describes multiple System Locations (FR 43558), and redefines the Alien File as comprising a paper file, an electronic record, or a combination of both (FR 43556). Given the potential for a single individual’s information to be retained in multiple locations and formats, the Notice should make clear how the Department will ascertain that retrieved data constitutes the complete record on the subject – for example, for purposes such as adjudicating an application for benefits, responding to a DOJ request in connection with litigation (routine use A, FR 43561), or responding to an attorney’s request on behalf of a covered individual (routine use M, FR 435462).

The Notice describes cumbersome “Records Access Procedures” that require an individual seeking disclosure of records to “[e]xplain why you believe the Department would have information on you” and “[i]dentify which component(s) of the Department you believe may have the information about you,” a difficult threshold made even more inaccessible by the sweeping exemptions from Privacy Act disclosure requirements, discussed above. The use of those exemptions further reduces opportunities to uncover factual errors and omissions in data created or collected by the Department. Because data integrity serves the interests of both the Department and the public, we urge the promulgation of much more robust procedures for notification, access, and modification of records.

The Committee recognizes the important role of the System in the fair and efficient administration of immigration benefits and the enforcement of immigration law. We appreciate the Department’s dedication to ensuring that the law is fairly and faithfully executed. We believe that the recommended changes will help to ensure that all persons whose data is collected and maintained in the System are treated with respect and fairness, that unnecessary incursions on privacy are kept to a minimum, and that the public receives a full and clear disclosure of the scope and purpose of the System’s functioning.

Respectfully,

Victoria Neilson, Chair

Immigration & Nationality Law Committee