On July 7, 2026, the Department of Commerce's U.S. Census Bureau and U.S. Bureau of Economic Analysis (BEA) issued a notice in the Federal Register. This notice invites public comment on a proposed extension of their information collection regarding 'Data Security Requirements for Accessing Confidential Data.' This action is a direct consequence of the Foundations for Evidence-Based Policymaking Act of 2018, often referred to as the Evidence Act. It marks a crucial juncture for researchers, policymakers, and other authorized individuals who rely on federal data for vital evidence building. The public has until September 8, 2026, to weigh in on these requirements.
The Evidence Act's Mandate and the SAP Portal
The Evidence Act established a Standard Application Process (SAP) Portal, a common platform for entities like federal agencies, the Congressional Budget Office, state, local, and Tribal governments, and researchers to request access to confidential data assets held by statistical agencies or units. The foundational purpose of this legislation is to enhance the use of federal data for evidence-based policymaking, fostering a more informed approach to public programs and policies. However, the Act simultaneously mandates stringent controls to protect the confidentiality and privacy of the data. This dual objective necessitates a robust set of security protocols, which the Census Bureau and BEA are now refining through public input.
Navigating Confidential Data Access Requirements
Once an application for confidential data access receives a positive determination through the SAP Portal, individuals must then fulfill specific data security requirements. These are not merely bureaucratic hurdles but essential safeguards consistent with the legal obligations of statistical agencies like the Census Bureau and BEA. The process involves collecting additional information to place applicants in a 'trusted category.' This categorization often includes successful completion of background investigations, comprehensive confidentiality training, and the execution of non-disclosure and data use agreements. The rigorous nature of these requirements underscores the sensitive nature of the data involved and the agencies' commitment to protecting individual privacy.
Detailed Security Protocols and Training
The security requirements are extensive, encompassing a range of forms and mandatory annual training. Applicants may be required to complete forms such as BC-1759 (Special Sworn Status for U.S. Census Bureau), OF-306 (Declaration for Federal Employment), Fair Credit Release, Selective Service Form, BC-4002 (Foreign National Residence History), BC-4003 (Initial Information Sheet), and BC-4004 (Researcher Semi-Annual Contact Information and Travel History Update) for the Census Bureau. BEA applicants may also need to complete a Sworn Statement (Affirmation) of Nondisclosure for Consultant to BEA.
Beyond paperwork, a significant component involves annual training. These sessions cover critical areas including Data Stewardship and Controlled Unclassified Information (CUI), Title 13 Awareness Course, Title 26 Awareness Training, Cybersecurity Awareness and Protection Course, and Records Management Training. BEA additionally requires annual Data Stewardship and IT Security Training, Records Management 101 Training, Active Shooter Training, and Employees Safety Training. These educational components are designed to ensure that data users understand their responsibilities and the protocols necessary to maintain the integrity and confidentiality of the sensitive information they access.
Assessing the Burden and Soliciting Feedback
Recognizing that these requirements impose a time burden, the Census Bureau and BEA have provided estimates for public review. The agencies project an average time per response of 57 minutes for BEA-related activities and 433 minutes for Census Bureau activities, which includes both paperwork and training. These estimates are for individuals who have already received a positive determination from the SAP Portal. The total estimated annual burden across all respondents is 2,450 hours. Notably, the only cost to the public is the time spent complying with these requirements, as there are no direct financial fees. The agencies explicitly seek public comments on the accuracy of these burden estimates, the utility of the information collected, and methods to enhance clarity and minimize reporting burden. The electronic method of collection through the internet is intended to streamline the process, though efforts to further optimize efficiency remain a focus.
The Path Forward for Federal Data Access
This public comment period is a vital opportunity for stakeholders to influence the practical implementation of the Evidence Act. The balance between maximizing access to data for public good and rigorously protecting individual privacy is delicate. The ongoing refinement of these data security requirements reflects the federal government's commitment to both transparency and safeguarding sensitive information. As the September 8, 2026, deadline approaches, the feedback received will directly inform the final framework. This will shape how researchers, policymakers, and the public interact with confidential federal data for years to come. The ultimate goal remains fostering a robust, evidence-based policy environment while upholding the public's trust in data security.
