PART 1321—RESPONSIBILITIES OF RECOGNIZED STATISTICAL AGENCIES AND UNITS Authority: 44 U.S.C. 3563; 44 U.S.C. 3504(e); 31 U.S.C. 1104(d). Source: 89 FR 82473, Oct. 11, 2024, unless otherwise noted. § 1321.1 Purpose. This part is issued under the authority of the Budget and Accounting Procedures Act of 1950; the Paperwork Reduction Act of 1995; the Information Quality Act; title III of the Foundations for Evidence-Based Policymaking Act of 2018 (Evidence Act), also known as the Confidential Information Protection and Statistical Efficiency Act of 2018 (CIPSEA 2018); and other provisions of the Evidence Act. The Office of Management and Budget (OMB), in its role as coordinator of the Federal statistical system under the Paperwork Reduction Act, is required to ensure the efficiency and effectiveness of the system, as well as the integrity, objectivity, impartiality, utility, and confidentiality of information collected or used for statistical purposes. This part is issued to meet the requirements under 44 U.S.C. 3563(c) and to strengthen and support the quality of Federal statistical information. § 1321.2 Definitions. The following terms, as used in this part, are defined as follows: Accurate, Agency executive agency, agency, Chief Statistician of the United States Component Confidential statistical data Confidentiality Core component Data users Dissemination Equitable access Fundamental responsibilities Identifiable form Information Information provider Information system Integrity, Nonstatistical purpose (1) Means the use of data in identifiable form for any purpose that is not a statistical purpose, including any administrative, regulatory, law enforcement, adjudicatory, or other purpose that affects the rights, privileges, or benefits of a particular identifiable respondent; and (2) Includes the disclosure under 5 U.S.C. 552 of data that are acquired for exclusively statistical purposes under an obligation of confidentiality. Objective, Parent agency Parent agency head Recognized Statistical Agency or Unit Reference date Relevant, Respondent Statistical activities Statistical information Statistical laws Statistical press release Statistical products Statistical purpose (1) Means the description, estimation, or analysis of the characteristics of groups, without identifying the individuals or organizations that comprise such groups; and (2) Includes the development, implementation, or maintenance of methods, technical or administrative procedures, or information resources that support the purposes described in paragraph (1) of this definition. Support component Timeliness timely Transparent § 1321.3 General provisions. (a) Complementary application. (b) Responsibility of Recognized Statistical Agency or Unit. (c) Responsibility of parent agency. (d) Deviations. (e) Direct working relationships. (f) Consultation. § 1321.4 Supporting the four fundamental responsibilities. (a) In general. (b) Communication. (c) Development and revision of policies. (1) Not later than December 10, 2026, and consistent with statutory obligations, revise any rules, policies, practices, or organizational structures that impede the Recognized Statistical Agency or Unit's ability to meet its fundamental responsibilities or impede the parent agency's ability to enable, support, and facilitate the Recognized Statistical Agency or Unit in carrying out its fundamental responsibilities, including the parent agency's ability to delegate responsibilities under this part; (2) Consider the fundamental responsibilities when new rules, policies, practices, organizational structures, or budgets are developed; and (3) Ensure that its rules, policies, practices, and agreements support the ability of Recognized Statistical Agencies and Units to: (i) Present and maintain accurate information; and (ii) Make timely corrections or updates to its statistical products or data when the Recognized Statistical Agency or Unit determines such updates are needed; and (iii) Meet its responsibility for producing relevant and timely statistical products. (d) Innovation and burden reduction. (1) Seek to continually improve its statistical products and methods and engage in research to support innovation in data collection, analysis, and dissemination, among other statistical activities; (2) Maximize the utility and minimize duplication of its statistical products; and (3) Minimize the burden on its respondents, including by engaging with other Recognized Statistical Agencies and Units to identify opportunities to better meet these goals. (e) Websites and branding. (1) Participate in the development of coordinated and complementary system-wide branding in collaboration with the Chief Statistician of the United States; (2) Maintain a website clearly branded with the name of the Recognized Statistical Agency or Unit to provide information to information providers, data users, and the general public; (3) Include clear branding with the name of the Recognized Statistical Agency or Unit on all websites, statistical products, and statistical press releases; and (4) Make available to the public on the website required under this paragraph (e): (i) A mission statement that clearly describes the purpose of the Recognized Statistical Agency or Unit's statistical programs and its commitment to each of the fundamental responsibilities; (ii) A strategic plan that is consistent with the requirements in 5 U.S.C. 306, which describes the Recognized Statistical Agency or Unit's goals and provides specific, measurable objectives and performance metrics and is assessed no less than every four years alongside and in alignment with the parent agency's strategic plans; (iii) A list of relevant legislation, rules, and policies or management orders, including those defining organizational placement, that govern the Recognized Statistical Agency or Unit's ability to maintain its commitment to these four fundamental responsibilities; (iv) Each policy or standard required under this part; and (v) Any other information as determined by the head of the Recognized Statistical Agency or Unit. (f) Websites and branding support. (1) Sufficient resources to develop and maintain its website required under paragraph (e) of this section; (2) The necessary authority and autonomy to determine the content, functionality, appearance, and layout of its website required under paragraph (e) of this section; and (3) The capacity to directly update the content, functionality, appearance, and layout of the website required under paragraph (e) of this section without reliance on any parent agency official unless the official is directly assigned to the Recognized Statistical Agency or Unit. (g) Budget formulation. (1) Each parent agency, in coordination with the Recognized Statistical Agency or Unit, must produce a budget request specific to the Recognized Statistical Agency or Unit that is fully compliant with the requirements of Office of Management and Budget Circular No. A-11 and is presented separately ( i.e., (2) Each parent agency must provide to the head of each Recognized Statistical Agency or Unit an opportunity to participate with the parent agency in discussions or engagements with the Office of Management and Budget specific to the Recognized Statistical Agency or Unit's budget request submitted in compliance with paragraph (g)(1) of this section. (3) If a parent agency and a Recognized Statistical Agency or Unit determine that the annual budget submission to the Office of Management and Budget lacks sufficient resources for the Recognized Statistical Agency or Unit to carry out the responsibilities set forth in this part, the parent agency, in coordination with the Recognized Statistical Agency or Unit, must include in the budget submission to the Office of Management and Budget a written explanation of this determination, the programmatic implications, and the tradeoffs that would be necessary to provide the necessary resources to the Recognized Statistical Agency or Unit under the parent agency budget submission. (h) Capacity. (1) If a parent agency and a Recognized Statistical Agency or Unit determine ( e.g., (2) If the Recognized Statistical Agency or Unit determines it does not have the capacity to carry out the fundamental responsibilities set forth in this part, the head of the Recognized Statistical Agency or Unit should submit to the Chief Statistician of the United States and the relevant Resource Management Office in the Office of Management and Budget a written explanation of the capacity deficit, including an estimate of the amount of resources, labor, or other support needed to address the capacity deficit and a detailed description of the anticipated impact of the current capacity. (3) When a Recognized Statistical Agency or Unit relies on a support component from a parent agency: (i) The Recognized Statistical Agency or Unit must, to the greatest extent possible, allocate labor resources to ensure that one or more employees, depending on the size of the Recognized Statistical Agency or Unit, are knowledgeable of the support component, its policies and processes, and best practices for interacting with the support component. (ii) The parent agency must designate at least one employee of each support component to serve as a liaison for the Recognized Statistical Agency and Unit and ensure each designated employee is knowledgeable of the Recognized Statistical Agency or Unit and its fundamental responsibilities and is capable of effective intra-agency communication. (iii) The support component and the Recognized Statistical Agency or Unit must work collaboratively to ensure the support component meets the relevant needs of the Recognized Statistical Agency or Unit in a manner that complies with this part and all applicable laws. (4) When a Recognized Statistical Agency or Unit relies on services or software from a support component: (i) Prior to making or renewing an award for services or software that will directly affect a Recognized Statistical Agency or Unit's ability to meet the fundamental responsibilities, the relevant support component official must coordinate with the head of the Recognized Statistical Agency or Unit to avoid binding actions and decisions that would conflict with the Recognized Statistical Agency or Unit's ability to carry out its fundamental responsibilities. (ii) The relevant support component official must ensure that the service or software is sufficient for the Recognized Statistical Agency or Unit to meet its obligation to carry out its fundamental responsibilities. The head of the Recognized Statistical Agency or Unit must clearly communicate the needs of the Recognized Statistical Agency or Unit to meet its obligation to carry out its fundamental responsibilities. If requested by the relevant support component official, the head of the Recognized Statistical Agency or Unit must provide a written list explicitly defining the requirements needed of the service or software to meet its obligation to carry out its fundamental responsibilities. (iii) If requested by the head of the Recognized Statistical Agency or Unit, the head of the Recognized Statistical Agency or Unit and the head of the support component must enter into a written agreement, and the support component must provide the service or software in accordance with such agreement. (iv) The Recognized Statistical Agency or Unit may obtain the service or software separately from the parent agency or support component if they are unable to reach an agreement or, at any point in time, the service or software is not able to be supplied in accordance with the agreement. (v) If the Recognized Statistical Agency or Unit determines it is necessary to obtain services or software separately from the parent agency, the Recognized Statistical Agency or Unit, in coordination with relevant core component officials, must notify the parent agency head. This notification must include an explanation of why it is necessary to obtain services or software separately and an attestation that the Recognized Statistical Agency or Unit remains in compliance with relevant law and policy. If the parent agency is unable to provide the separate service or software, the parent agency, in coordination with the Recognized Statistical Agency or Unit, must notify the Office of Management and Budget in the written explanation required under paragraph (g)(3) of this section. (i) Decision-making authority. (1) If the Recognized Statistical Agency or Unit determines that delegation is necessary to carry out its fundamental responsibilities, the Recognized Statistical Agency or Unit must notify the parent agency head. (2) In making a determination regarding delegation under this paragraph (i), the parent agency head must: (i) Consider the needs of the Recognized Statistical Agency or Unit and ensure it has all necessary and appropriate authority to carry out its fundamental responsibilities; and (ii) Ensure the decision is consistent with the government-wide application and interpretation of statistical laws, consulting with the Chief Statistician of the United States as appropriate. (3) To the extent permissible under law, the individual to whom a responsibility has been delegated under this paragraph (i) must consult with the delegating official in carrying out such responsibility. (j) Delegation of duties. § 1321.5 Relevance and timeliness. (a) Responsibilities. (1) What statistical products to disseminate, including in the context of the Standard Application Process required under 44 U.S.C. 3583; (2) The content of its statistical products; and (3) The timing of disseminations. (b) Relevance consultations. (1) Each Recognized Statistical Agency and Unit must: (i) Consult with parent agency officials to assess and seek improvements to the relevance of its statistical products to users' needs and to inform what statistical products to produce and disseminate; (ii) Consult, as the head of the Recognized Statistical Agency or Unit determines is appropriate, with other data users, including Congress, other agencies, and State, local, territorial, or Tribal governments, to assess and seek improvements to the relevance of its statistical products to users' needs and to inform what statistical products to produce and disseminate; (iii) Be knowledgeable about programs and policies relating to its subject domains; (iv) Coordinate and communicate across agencies when planning information collections and dissemination activities; and (v) Keep abreast of interests and analytical goals of data users. (2) Each parent agency must: (i) Share relevant policy and program needs with sufficient detail to allow the Recognized Statistical Agency or Unit to be responsive to those needs; (ii) Consult with the Recognized Statistical Agency or Unit as part of the stakeholder engagement process when developing the agency evidence-building plan (learning agenda) required under 5 U.S.C. 312, in alignment with Office of Management and Budget guidance; and (iii) Allow the Recognized Statistical Agency or Unit to establish, determine the membership of, and manage advisory groups or other means of systematic stakeholder engagement, in accordance with applicable law. (c) Maximizing timeliness. (2) Each parent agency must support efforts to maximize timeliness of statistical products by ensuring the Recognized Statistical Agency or Unit is aware of any emerging needs and providing necessary resources to respond to such emerging need. (3) In any instance where a parent agency observes that a Recognized Statistical Agency or Unit is not upholding the timeliness of statistical products, consistent with paragraph (c)(1) of this section, the parent agency, after consultation with the head of the Recognized Agency or Unit, head must notify the Chief Statistician of the United States. (d) Schedule of release dates. (1) Each Recognized Statistical Agency or Unit must: (i) On the website required under § 1321.4, publish a schedule containing the date of release of its regular and recurring statistical products for the next calendar year prior to the beginning of that calendar year; (ii) Publish the date for release of non-regular or non-recurring statistical products on the schedule required under paragraph (d)(1)(i) of this section as soon as the date is established; (iii) Designate a point of contact responsible for information about the release schedule and make its contact information readily available to the public on the website required under § 1321.4; (iv) Minimize changes to the release schedule after it has been published to accommodate only special, unforeseen circumstances; and (v) If the release date of a statistical product is changed after the schedule has been published, publicly announce the change to the schedule as soon as possible, provide a detailed explanation for such change and, for regular and recurring statistical products, notify the Chief Statistician of the United States. (2) Each parent agency must support adherence to the published schedule by: (i) Communicating any parent agency activities or processes that could impact the timing of dissemination activities to the Recognized Statistical Agency or Unit before the schedule is published; and (ii) If involved in dissemination activities, preparing for dissemination of statistical products in accordance with the published schedule. § 1321.6 Credibility and accuracy. (a) Responsibilities of each Recognized Statistical Agency or Unit. (1) Maintain publicly available policies and standards on the quality of the information used by the Recognized Statistical Agency or Unit and the statistical products it disseminates, by: (i) Developing and making available to the public policies and standards to ensure the credibility and accuracy of all statistical products and data disseminated by the Recognized Statistical Agency or Unit; (ii) Regularly reviewing, maintaining, and improving the policies in paragraph (a)(1)(i) of this section and the methods used to implement them to ensure they are current and effective; and (iii) Establishing policies and procedures, in consultation with the parent agency's Chief Data Officer and Evaluation Officer, for assessing the quality of data that is used by the Recognized Statistical Agency or Unit but does not originate from the Recognized Statistical Agency or Unit; (2) Publicly provide documentation for its statistical products, including: (i) Descriptions of methods and procedures used in designing, collecting, processing, editing, compiling, storing, analyzing, and disseminating information to users, as applicable; (ii) Indicators of data quality sufficient to allow data users to assess the fitness of the data for their own purposes; (iii) Descriptions of known limitations or sources of error in the data; (iv) Citation to source materials where feasible; and (v) Identification of errors in the statistical products discovered after their release; (3) Ensure that the Recognized Statistical Agency or Unit lifecycle data management practices adhere to all applicable statutes and standards and guidance issued by the Office of Management and Budget; (4) Adhere to all applicable statutes and current Office of Management and Budget peer review policies when submitting articles to refereed journals, presenting at professional conferences, and engaging in peer review activities, including OMB M-05-03, Final Information Quality Bulletin for Peer Review, (5)(i) Determine the appropriateness of and process for providing professional autonomy to employees of the Recognized Statistical Agency or Unit, including allowing employee engagement in professional development activities such as participating in peer review, publication, or professional associations, and attending and presenting at professional conferences without review or approval from the parent agency, subject to applicable statutes. (ii) When implementing paragraph (a)(5)(i) of this section, ensure all statutory requirements, such as ethics, are met. (b) Responsibilities of each parent agency. (1) Ensure the Recognized Statistical Agency or Unit has sufficient autonomy to maintain its own standards for the quality of the data used and the statistical information it produces and to determine whether its statistical products are of sufficient quality for dissemination. Unless otherwise prohibited by statute, when a statute, rule, or policy authorizes any other agency official to make such determinations, that responsibility must be delegated to the head of the Recognized Statistical Agency or Unit; (2) Prohibit its employees, contractors, and agents, other than those designated by the releasing Recognized Statistical Agency or Unit head, from publicly commenting on any data released by the Recognized Statistical Agency or Unit until after the official release of the data; (3) Permit the Recognized Statistical Agency or Unit to determine whether statistical disseminations, including related statistical press releases or publicity materials not containing policy pronouncements, should be disseminated by or through the parent agency and, if so, ensure that statistical information attributable to the Recognized Statistical Agency or Unit disseminated by or through the parent agency is not altered in any way not authorized by the head of such Recognized Statistical Agency or Unit; and (4) Allow the head of the Recognized Statistical Agency or Unit to determine the appropriateness of and process for providing professional autonomy to employees of the Recognized Statistical Agency or Unit to submit articles that do not address policy, management, or budget issues, and that do not contain legally privileged information or information legally prohibited from disclosure, to refereed journals; present at professional conferences; and engage in peer review activities without requiring approval from outside of the Recognized Statistical Agency or Unit, unless such approval is required by law. When approval outside of the Recognized Statistical Agency or Unit is required, such as ethics approval, the parent agency must either: (i) Assign the support component employee that will conduct these reviews to report to the head of the Recognized Statistical Agency or Unit; or (ii) Ensure that the support component employee conducting the review, in coordination with the liaison designated in § 1321.4, provides sufficient information and advice, including a recommendation if appropriate, to the head of the Recognized Statistical Agency or Unit so that such head may make an informed decision regarding approval. § 1321.7 Objectivity. (a) Responsibilities of each Recognized Statistical Agency and Unit. (1) Produce statistical products that are impartial and free from undue influence and the appearance of undue influence by: (i) Employing transparent and reproducible methods and processes in producing statistical products, to the extent feasible and consistent with the protection of confidential statistical data; (ii) Disseminating impartial statistical products in a clear and complete manner, without limitation or selection to promote a particular policy position or group interest; and (iii) Announcing dissemination activities, such as through statistical press releases or on the Recognized Statistical Agency or Unit's website, in a manner designed to be factual, comprehensive, accurate, easily understood by the public, and without favor to a particular policy position or group interest; (2) Ensure data users have equitable access to its statistical products by: (i) Making public releases available to all data users at the same time, with limited exceptions as allowable in OMB Statistical Policy Directives, in accordance with the scheduled release date; (ii) Disseminating and making available to the public free of charge any statistical product deemed suitable for public dissemination that has been provided to any other data user; and (iii) For confidential statistical data that are not deemed suitable for public dissemination, ensuring policies and procedures for granting access are applied consistently, in accordance with statute, rules and guidance issued by the Office of Management and Budget to implement 44 U.S.C. 3582 and 3583, and other applicable authorities that govern access to confidential statistical data; (3) Determine the necessary qualifications for and allocate available labor resources among different job positions supporting the Recognized Statistical Agency or Unit's lifecycle data management ( e.g., (4) Consistent with applicable law and policy, maintain functional separation from any administrative, regulatory, law enforcement, and policymaking functions at any parent agency or at the Recognized Statistical Agency or Unit by maintaining exclusive authority within the Recognized Statistical Agency or Unit for granting access to its confidential statistical data and the information systems that hold confidential statistical data. (b) Responsibilities of each parent agency. (1) Allow the publication of statistical products without requiring clearance of the content from offices or officials outside of the Recognized Statistical Agency or Unit, and allow the Recognized Statistical Agency and Unit to respond to inquiries from external interested communities and stakeholders, including the media, the Congress, and others, about its statistical products in a manner that ensures appropriate consultation with the parent agency without the parent agency requiring review, approval, or edits to the response, unless responses to those inquiries include matters related to policy, budget, or management issues; legally privileged information; or matters affecting current or future litigation; (2) Support the impartiality of the Recognized Statistical Agency and Unit in its production and dissemination of statistical products by ensuring it is permitted to determine the methods for conducting statistical activities for statistical purposes and for disseminating statistical products. Unless otherwise prohibited by statute, when a statute, rule, or policy authorizes any other agency official to make such determinations, that responsibility must be delegated to the head of the Recognized Statistical Agency or Unit, as described in § 1321.4(b); (3) Ensure compliance with 44 U.S.C. 3520(d); (4) Ensure that the resources of the Recognized Statistical Agency or Unit are managed by the Recognized Statistical Agency or Unit in accordance with the fundamental responsibilities described in this part by allowing the Recognized Statistical Agency or Unit to: (i) Maintain and determine the functional requirements, specifications, and performance capabilities of the information technology it uses to conduct statistical activities and disseminate statistical products; (ii) Determine the presentation of statistical information and the timing of when statistical information is disseminated; (iii) Allocate its labor resources among different job positions; (iv) Develop, explain, and respond directly to queries about resource needs through congressional and executive branch budget processes, as those processes are established through OMB Circular A-11; and (5) Support the autonomy of the Recognized Statistical Agency or Unit to manage and control its data by ensuring that the Recognized Statistical Agency and Unit has the authority to make all determinations regarding: (i) The governance of its data, including the archiving of its data; (ii) Access to its confidential statistical data and the information systems that hold confidential statistical data; and (iii) The approval, direction, and management of the use of its confidential statistical data by external parties for purposes of developing evidence, as defined in the 44 U.S.C. 3561 and relevant Office of Management and Budget policies, including the authority for ensuring compliance with the Standard Application Process required under 44 U.S.C. 3583 and related guidance. § 1321.8 Confidentiality. (a) Responsibilities of each Recognized Statistical Agency and Unit. (1) Secure all confidential statistical data against unauthorized access. This includes: (i) Ensuring that any information systems containing confidential statistical data employ effective barriers to restrict access such that only employees of the Recognized Statistical Agency or Unit or its authorized agents have access to such data. This must be done in accordance with the requirements of the Confidential Information Protection and Statistical Efficiency Act of 2018, codified as amended at 44 U.S.C. 3561-3576; other applicable statistical laws; and policies and guidance issued by the Office of Management and Budget, while also ensuring compliance with the Federal Information Security Modernization Act of 2014, codified as amended at 44 U.S.C. 3551-3558, and other applicable laws and policies; (ii) Ensuring required security policies, configurations, and controls placed on information technology assets are appropriate to protect the confidentiality of confidential statistical data throughout the data lifecycle; (iii) Controlling logical access to data storage assets containing confidential statistical data and restricting access to authorized personnel; and (iv) Complying with paragraph (c) of this section; (2) Ensure that confidential statistical data are not used for any nonstatistical purposes. This includes: (i) Coordinating with the agency Chief Freedom of Information Act Officer to ensure appropriate application of exemptions pertaining to confidential statistical data in response to Freedom of Information Act requests; (ii) Employing current best practices, including statistical disclosure avoidance methods and procedures, to minimize the risk of disclosing confidential statistical data; and (iii) Complying with paragraph (c) of this section; (3) Provide information to the public about the integrity, confidentiality, and impartiality of all confidential statistical data acquired and maintained under its authority, so that it retains the trust of its information providers and data users, by: (i) Making readily accessible, for example, through its website, information about its policies on confidentiality and information security; (ii) Developing and maintaining a comprehensive data inventory as required under 44 U.S.C. 3511 and related guidance; and (iii) Complying with the Standard Application Process required under 44 U.S.C. 3583 and related guidance; (4) Provide sufficient information to respondents to enable them to make an informed decision about whether to provide the requested information by: (i) Providing notification statements to respondents to collections of information sponsored by the Recognized Statistical Agency or Unit consistent with this section, including the intended uses of the information being collected, potential future uses, their relevance for public purposes, and the extent of confidentiality protection that will be provided; and (ii) When acquiring data from another agency, ensuring that any agreement with the providing agency addresses any legal requirements for notice and consent consistent with applicable law and applicable rules implementing 44 U.S.C. 3581; (5) Maintain and develop professional staff, or identify appropriate ways to access professional staff, that are trained in statistical disclosure limitation and restricted access mechanisms to maximize the protection of the confidential statistical data throughout the data lifecycle, including creation or collection, processing, dissemination, use, storage, and disposition; and (6) Inform employees, contractors, and other approved agents of the Recognized Statistical Agency or Unit of their responsibility not to willfully disclose confidential statistical data in an identifiable form, and of the legal consequences of such disclosure, such as the penalty in 44 U.S.C. 3572(f) that provides that any officer, employee, or approved agent of the Recognized Statistical Agency or Unit who willfully discloses such information is subject to fines and penalties, to include being guilty of a class E felony and imprisoned for not more than 5 years, or fined not more than $250,000, or both. (b) Responsibilities of each parent agency. (1) Ensure that the Recognized Statistical Agency or Unit has the sole authority to provide access to its confidential statistical data. Unless otherwise prohibited by statute, when a statute, rule, or policy authorizes any other official to control access to such data, that responsibility must be delegated to the head of the Recognized Statistical Agency or Unit. (2) Ensure that implementation of the Federal Information Technology Acquisition Reform Act, 40 U.S.C. 11319, is consistent with the Recognized Statistical Agency or Unit's responsibility to protect confidential statistical data from unauthorized use or disclosure, by: (i) Ensuring that information technology policies appropriately safeguard and protect the integrity, confidentiality, and availability of confidential statistical data; and (ii) Ensuring that confidential statistical data are protected by any effective security standards established in writing by the Recognized Statistical Agency or Unit. (3) Ensure that the Senior Agency Official for Privacy consults with the Recognized Statistical Agency or Unit when the Senior Agency Official for Privacy performs duties related to the Recognized Statistical Agency or Unit's statistical activities, including under the Privacy Act of 1974, codified as amended at 5 U.S.C. 552a; the E-Government Act of 2002, codified at 44 U.S.C. 3501 note; and other applicable statutory requirements, including: (i) Conducting Privacy Impact Assessments on information technology systems that store and process confidential statistical data, as required by law and Office of Management and Budget guidance; (ii) Responding to Privacy Act requests to access or amend confidential statistical data maintained by the Recognized Statistical Agency or Unit; and (iii) Responding to breaches of confidential statistical data containing personally identifiable information in a way that complies with law and policy and is sensitive to the Recognized Statistical Agency or Unit's need to maintain the public trust. (4) Ensure that the agency Chief Freedom of Information Act Officer coordinates with the Recognized Statistical Agency or Unit to ensure appropriate application of exemptions pertaining to confidential statistical data in response to Freedom of Information Act requests. (c) Responsibilities to protect confidential statistical data. (1) The head of each Recognized Statistical Agency or Unit must: (i) Determine who is authorized to access confidential statistical data; (ii) Ensure that access to confidential statistical data is limited to officers and employees of such Recognized Statistical Agency or Unit and its designated agents; and (iii) Establish written standards and processes by which the head of such Recognized Statistical Agency or Unit designates a person as an agent, which must: (A) Comply with 44 U.S.C. 3572 and other applicable statistical law; (B) Ensure designated agents are fully informed of, and have agreed to comply with, all legal requirements to access confidential statistical data; and (C) Define the scope of such agent's authorization to access confidential statistical data. (2) The parent agency head must: (i) Ensure confidential statistical data are secure from access by any individual unless such individual has been authorized to access such confidential statistical data by the head of the Recognized Statistical Agency or Unit in accordance with paragraph (c)(1) of this section; (ii) Prohibit agency officers or employees from accessing confidential statistical data unless they have been authorized to access such confidential statistical data by the head of the Recognized Statistical Agency or Unit in accordance with paragraph (c)(1) of this section; and (iii) Ensure the Recognized Statistical Agency or Unit has the resources necessary to ensure confidential statistical data are secure from unauthorized access. (3) Nothing in this part authorizes the parent agency head, or anyone else, to access confidential statistical data, unless the head of the Recognized Statistical Agency or Unit has designated such individual as an agent. (4) When a component needs access to confidential statistical data, the head of the component must: (i) Establish policies to prohibit access to confidential statistical data by any individual unless such individual has been authorized by the head of the Recognized Statistical Agency or Unit in accordance with paragraph (c)(1) of this section; (ii) Ensure that any officer or employee that needs to access confidential statistical data meets the written requirements issued by the Recognized Statistical Agency or Unit; (iii) To the greatest extent possible, limit the scope and number of its requests for access to confidential statistical data; (iv) Coordinate with the Recognized Statistical Agency or Unit to determine the number of persons needing access to confidential statistical data; and (v) Provide the Recognized Statistical Agency or Unit with any information necessary for the Recognized Statistical Agency or Unit to make a determination regarding access to confidential statistical data. (5) The head of the Recognized Statistical Agency or Unit must coordinate with the head of the parent agency or any component requesting access to confidential statistical data as described in paragraphs (c)(2) and (4) of this section to identify and designate necessary agents to fulfill the component's responsibilities. (6) If the parent agency head finds that the Recognized Statistical Agency or Unit is unable to designate a sufficient number of agents for the parent agency to fulfill its responsibilities, the parent agency head must consult with the head of the Recognized Statistical Agency or Unit and the Chief Statistician of the United States to resolve the issue. (7) Each Recognized Statistical Agency or Unit must track access to its information systems that contain confidential statistical data and maintain sufficient access logs that detail the individual accessing such data and the time of access. Each Recognized Statistical Agency or Unit must ensure that confidential statistical data hosted outside of its information systems is maintained in a manner such that the host can track access to the confidential statistical data in a way sufficient to detail the individual accessing the data and the time of access and that the Recognized Statistical Agency or Unit is notified in a timely manner of any unauthorized access. The parent agency must ensure the Recognized Statistical Agency or Unit has sufficient technology resources to ensure all access to confidential statistical data is tracked. (i) The Recognized Statistical Agency or Unit must monitor the access log to ensure only authorized persons have accessed confidential statistical data. (ii) If any unauthorized person has accessed confidential statistical data, the Recognized Statistical Agency or Unit must notify the parent agency head and the Chief Statistician of the United States, and the parent agency head and the head of the Recognized Statistical Agency or Unit must: (A) Address any deficiencies that led to such unauthorized access to ensure unauthorized access does not occur in the future; and (B) Provide a written report to the Chief Statistician of the United States within 30 days detailing the remediation efforts. § 1321.9 Compliance review. (a) Compliance review. (b) Frequency of compliance review. (2) The Interagency Council on Statistical Policy (ICSP) may request a compliance review of a Recognized Statistical Agency or Unit and parent agency at any time if the ICSP has reason to believe there is a substantial change in circumstances regarding compliance with this part. (i) The ICSP must submit a written request for a compliance review with a detailed explanation of the reasons there may be a substantial change in compliance with this section to the Inspector General of the parent agency to be reviewed. (ii) The Inspector General must review any request from the ICSP, determine whether a review is appropriate, and provide a written response to the ICSP within 30 days of receiving such request. (c) Compliance review report. (d) Role of the Chief Statistician of the United States. (1) Engage with each Recognized Statistical Agency and Unit and parent agency to address any deficiencies identified in the report; (2) Publicly post a list of recommendations appropriate for public dissemination made to each agency and the status of the agency in addressing each recommendation on https://www.StatsPolicy.gov (3) Make available appropriate materials, training, and other relevant resources to the Council for Inspector General Integrity and Efficiency regarding statistical laws and practices; and (4) Include standards for remedial actions for a Recognized Statistical Agency or Unit for persistent failures to comply with this part in the guidance to implement the Recognized Statistical Agency or Unit designation process required under 44 U.S.C. 3562(a). (e) Council of the Inspectors General on Integrity and Efficiency. (1) Develop and promulgate guidance that specifies procedures for the compliance review, and compliance determinations required under paragraph (a) of this section and a standardized format for reports required under paragraph (c) of this section to ensure consistency across agencies; (2) Establish a working group for Inspectors General responsible for conducting reviews under this section to assist the Inspectors General in developing the expertise in statistical laws and processes necessary to ensure the integrity of statistical agencies; and (3) Regularly consult with the Chief Statistician of the United States on the appropriate interpretation and application of statistical laws and practices.