Federal Rulemaking: Selected Agencies Should Clearly Communicate Practices Associated with Identity Information in the Public Comment Process

Federal agencies publish on average 3,700 proposed rules yearly and are generally required to provide interested persons (commenters) an opportunity to comment on these rules. In recent years, some high-profile rulemakings have received extremely large numbers of comments, raising questions about how agencies manage the identity information associated with comments. While the APA does not require the disclosure of identifying information from a commenter, agencies may choose to collect this information. This report examines (1) the identity information collected by Regulations.gov and agency-specific comment websites; (2) the guidance agencies have related to the identity of commenters; (3) how selected agencies treat identity information; and (4) the extent to which selected agencies clearly communicate their practices associated with identity information.

GAO selected a nongeneralizable sample of 10 federal agencies on the basis of large comment volume. GAO surveyed 52 program offices within these agencies about their comment process; and reviewed comment websites, agency guidance, and posted comment data. GAO also interviewed relevant agency officials.

The Administrative Procedure Act (APA) governs the process by which many federal agencies develop and issue regulations, which includes the public comment process (see figure below).

Regulations.gov and agency-specific comment websites collect some identity information—such as name, email, or address—from commenters who choose to provide it during the public comment process. The APA does not require commenters to disclose identity information when submitting comments. In addition, agencies have no obligation under the APA to verify the identity of such parties during the rulemaking process.

GAO found that seven of 10 selected agencies have some internal guidance associated with the identity of commenters, but the substance varies, reflecting the differences among the agencies. The guidance most frequently relates to the comment intake or response to comment phases of the public comment process.

With the discretion afforded by the APA, selected agencies' treatment of commenters' identity information varies, particularly when posting duplicate comments (identical or near-identical comment text but varied identity information). Generally, officials told GAO that their agencies (1) post all comments within the comment system; or (2) maintain some comments outside of the system, such as in email file archives. For instance, one agency posts a single example of duplicate comments and indicates the total number of comments received. However, within these broad categories, posting practices vary considerably—even within the same agency—and identity information is inconsistently presented on public websites.

Selected agencies do not clearly communicate their practices for how comments and identity information are posted. GAO's key practices for transparently reporting government data state that federal government websites should disclose data sources and limitations to help public users make informed decisions about how to use the data. As a result, public users of the comment websites could reach inaccurate conclusions about who submitted a particular comment, or how many individuals commented on an issue.

GAO is making a total of eight recommendations to the selected agencies to more clearly communicate to the public their policies for posting comments and associated identity information to Regulations.gov and agency-specific comment websites. The selected agencies generally agreed with the recommendations.

Regulations are the means by which federal agencies establish legally  binding requirements and are rooted in agencies’ statutory authority.  Typically, regulations require regulated parties to take specified actions or  prohibit them from taking certain actions. Agencies use regulations to  carry out statutory directives to achieve public policy goals such as  protecting the health and safety of the public and the environment and  facilitating the effective functioning of financial markets. The  Administrative Procedure Act (APA) governs the process by which many  federal agencies develop and issue regulations. The APA establishes  procedures and broadly applicable federal requirements for informal  rulemaking, also known as notice-and-comment rulemaking. Federal  agencies publish an average of 3,700 proposed rules, or Notices of  Proposed Rulemaking (NPRM), each year as part of informal rulemaking  pursuant to the APA.

Among other things, the APA generally requires agencies to publish an  NPRM in the Federal Register and provide interested persons  (commenters) an opportunity to comment on the proposed rule.  Agencies must give consideration to any significant comments submitted  during the comment period when drafting the final rule. This process  provides, among other things, the public an opportunity to present  information to agencies on the potential effects of a rule, or to suggest  alternatives. To fulfill the notice-and-comment process requirements of  the APA, agencies may rely on Regulations.gov or their own comment  websites to receive public input on proposed rules. During the course of  the notice-and-comment process, agencies may choose to collect  information associated with the identity of the commenters, such as  name, email, or address (identity information).

In recent years, some high-profile rulemakings have received extremely  large numbers of comments. For example, during the public comment  period for an Environmental Protection Agency (EPA) 2014 rulemaking on  greenhouse gas emissions, the agency reported that it received more  than 4 million total comments. Similarly, during the public comment  period for the Federal Communications Commission’s (FCC) 2017  Restoring Internet Freedom NPRM, FCC received more than 22 million  comments through its public comment website. Subsequently, media  and others reported that some of the comments submitted to FCC were  suspected to have been submitted using false identity information.

You asked us to review issues related to identity information associated  with public comments on proposed rulemakings. This report examines (1)  the identity information selected agencies collect through Regulations.gov  and agency-specific comment websites, (2) the internal guidance  selected agencies have related to the identity of commenters, (3) how  selected agencies treat identity information collected during the public  comment process, and (4) the extent to which selected agencies clearly  communicate their practices associated with posting identity information  collected during the public comment process.

To address these objectives, we selected 10 agencies (selected  agencies) as case studies that received a high volume of public  comments during the course of rulemaking proceedings from January 1,  2013, through December 31, 2017, including eight agencies that use  Regulations.gov as their agency’s comment website (“participating  agencies”) and two agencies that operate agency-specific comment  websites (“nonparticipating agencies”). We identified agencies based on  the lists of participating and nonparticipating agencies provided on  Regulations.gov. Six of the selected agencies are component agencies  within a larger department, as indicated below. The selected agencies are  as follows:

Bureau of Land Management (BLM), Department of the Interior;

Centers for Medicare & Medicaid Services (CMS), Department of  Health and Human Services;

Consumer Financial Protection Bureau (CFPB);

Employee Benefits Security Administration (EBSA), Department of  Labor (DOL);

Fish and Wildlife Service (FWS), Department of the Interior;

Food and Drug Administration (FDA), Department of Health and

Federal Communications Commission (FCC); and

Securities and Exchange Commission (SEC).

All 10 agencies were selected based on the total number of rulemaking  comments that Regulations.gov and other agency-specific comment  websites reported they received from January 1, 2013, through December  31, 2017. We selected this period to include comments submitted to  rulemakings across two presidential administrations and five complete  calendar years. At the time our review began, 2017 was the most recent  complete calendar year. The selected agencies represent a  nongeneralizable sample, and findings from this report cannot be  generalized to all agencies that receive public comments as part of their  rulemaking proceedings. However, as reported by Regulations.gov, the  comments submitted to the eight participating agencies we selected  represent more than 90 percent of all comments submitted to all  participating agencies during the 5-year period.

To select participating agencies, we obtained publicly available data from  Regulations.gov for all agencies that had rulemaking dockets—the  repository of documents related to a particular rulemaking—where  comments were submitted from January 1, 2013, through December 31,  2017. On the basis of the comment numbers reported by the website,  we selected the eight participating agencies with more than 500,000  comments submitted to dockets that accepted comments during this time.  As of March 2018, there were 128 nonparticipating agencies, most of  which issued less than one NPRM per year during the 5-year period. To  identify nonparticipating agencies that received a high volume of  comments, we obtained a list of rules submitted to GAO for review under  the Congressional Review Act from January 1, 2007, through December  31, 2017. We identified four agencies with more than 10 rules submitted  during the period (at least one rule per year). We then contacted these  agencies to determine how many total comments were submitted to the  agencies from January 1, 2013, through December 31, 2017, on all  rulemakings. Two of the four agencies were unable to provide us with the  total number of comments received over the 5-year period; accordingly,  we selected the two that provided us with comment numbers, FCC and  SEC. Both FCC and SEC received a number of comments comparable to  the selected participating agencies. Within the 10 selected agencies, we  identified 52 program offices with regulatory responsibilities and sent  them survey questionnaires related to the public comment process in  October 2018. All 52 program offices responded to the questionnaire, but  the responses cannot be generalized to program offices outside of the  selected agencies. For additional detail about the program offices we  identified and survey development and administration, see appendix I.

To determine what identity information the selected agencies collect  during the public comment process, we reviewed the data fields agencies  require to be submitted with public comments and the optional data fields  available to commenters on Regulations.gov and the agency-specific  comment systems. We reviewed relevant system documentation for  Regulations.gov and the agency-specific comment systems, such as user  guides, system architecture documentation, and system logs. We also  reviewed documentation associated with system modernization or  reengineering efforts. In addition, we interviewed relevant information  technology officials from the eRulemaking Program Management Office  (PMO), FCC, and SEC and surveyed program offices about the  information that is collected from public users of the comment systems as  well as agency practices associated with anonymous comments. Public  users are members of the public interested in participating in the  rulemaking process via Regulations.gov or agency-specific websites.  They may or may not submit a comment.

To determine what internal guidance selected federal agencies have  related to the identity of commenters in the federal rulemaking process,  we first determined whether each of the selected agencies had any  documented policies, procedures, or guidance associated with each  phase of the comment process generally. For those agencies that did, we  reviewed these documents to determine whether they explicitly included  requirements associated with identity information. We also included  questions about guidance in our survey of program offices. On the basis  of the responses, we followed up directly with program offices to obtain  additional informal guidance that is used at the program office level,  rather than agency-wide.

To determine how selected agencies treat identity information associated  with public comments, our survey of all 52 program offices with regulatory  responsibilities included questions about their practices associated with  comment intake (including identifying duplicate comments and posting  comments to the public website), comment analysis (including reviewing  comments and considering their content), and response to comments.  We obtained comment data for all rulemakings within the 10 selected  agencies that accepted comments from January 1, 2013, through  December 31, 2017, and reviewed them to determine the ways in which  agencies treat the identity information submitted with comments. To  assess the reliability of these data, we reviewed related documentation,  interviewed knowledgeable agency officials, and traced selections to the  source documents. We determined these data to be reliable for the  purposes of selecting case study agencies and identifying comments that  could help us understand how the selected agencies publicly post  comments. We also interviewed relevant officials at the selected  agencies, as well as officials from the eRulemaking PMO, to better  understand the data; Regulations.gov and FDMS; and agency-specific  comment systems.

To determine the extent to which the selected agencies clearly  communicate their practices associated with posting identity information  collected during the public comment process, we reviewed  Regulations.gov, agency-specific comment websites, and the selected  agencies’ websites for any information provided to public users. We then  compared this information to key practices for transparently reporting  open government data. We also interviewed relevant officials from the  eRulemaking PMO and the selected agencies about how they  communicate with public users.

We conducted this performance audit from February 2018 through June  2019 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Under the APA, agencies engage in three basic phases of the rulemaking  process: they initiate rulemaking actions, develop proposed rulemaking  actions, and develop final rulemaking actions. Built into agencies’  rulemaking processes are opportunities for internal and external  deliberations, reviews, and public comments. Figure 1 provides an  overview of the rulemaking process.

The public comment portion of the rulemaking process generally  comprises three phases:  1.  Comment Intake: During this phase, agencies administratively  process comments. This may include identifying duplicate comments  (those with identical or near-identical comment text, but unique  identity information), posting comments to the agency’s public  website, and distributing comments to agency subject-matter experts  within responsible program offices for analysis.  2.  Comment Analysis: During this phase, subject-matter experts  analyze and consider submitted comments. This may include the use  of categorization tools within FDMS or outside software systems.  3.  Comment Response: During this phase, agencies prepare publicly  available responses to the comments in accordance with any  applicable requirements. Agencies are required to provide some  response to the comments in the final rule, but in some cases, an  agency may also prepare a separate report to respond to the  comments.

As illustrated in figure 1 above, the public has the opportunity to provide  input during the development of agencies’ rules. Among other things, the  APA generally requires agencies to publish an NPRM in the Federal Register; allow any interested party an opportunity to comment on the  rulemaking process by providing “written data, views, or arguments”;  issue a final rule accompanied by a statement of its basis and  purpose; and publish the final rule at least 30 days before it becomes effective.

The APA requires agencies to allow any interested party to comment on  NPRMs. The APA does not require the disclosure of identifying  information from an interested party that submits a comment. Agencies  therefore have no obligation under the APA to verify the identity of such  parties during the rulemaking process. Instead, the APA and courts  require agencies to consider relevant and substantive comments, and  agencies must explain their general response to them in a concise overall  statement of basis and purpose, which in practice forms part of the  preamble of the final rule. Courts have explained that significant  comments are comments that raise relevant points and, if true or if  adopted, would require a change in the proposed rule. However, courts  have held that agencies are not required to respond to every comment  individually. Agencies routinely offer a single response to multiple  identical or similar comments. As explained by Regulations.gov’s “Tips for  Submitting Effective Comments,” “the comment process is not a vote,”  and “agencies make determinations for a proposed action based on  sound reasoning and scientific evidence rather than a majority of votes. A  single, well-supported comment may carry more weight than a thousand  form letters.”

The APA includes provisions on the scope of judicial review that  establishes the bases under which a court shall find an agency’s action  unlawful. Among these APA bases are when the court finds that agency  action, findings, and conclusions were “arbitrary, capricious, an abuse of  discretion, or otherwise not in accordance with law” and “without  observance of procedure required by law.” How an agency managed  and considered public comments may be relevant during judicial review.  For example, one basis for a court’s reversal of an agency action has  been that, upon review of the statement of basis and purposes, the court  concludes the agency failed to consider or respond to relevant and  significant comments. Conversely, courts have upheld agency rules  when the courts have found the statement of basis and purposes  demonstrate the agency considered the commenter’s arguments.

The E-Government Act of 2002 requires agencies, to the extent practical,  to accept comments “by electronic means” and to make available online  the public comments and other materials included in the official  rulemaking docket. Executive Order 13563 further states that  regulations should be based, to the extent feasible, on the open  exchange of information and perspectives. To promote this open  exchange, to the extent feasible and permitted by law, most agencies are  required to provide the public with a meaningful opportunity to participate  in the regulatory process through the internet, to include timely online  access to the rulemaking docket in an open format that can be easily  searched and downloaded.

Most agencies meet these responsibilities through Regulations.gov, a  rulemaking website where users can find rulemaking materials and  submit their comments, but all agencies are not required to use that  platform. In October 2002, the eRulemaking Program was established as  a cross-agency E-Government initiative and is currently based within  EPA. The eRulemaking PMO leads the eRulemaking Program and is  responsible for developing and implementing Regulations.gov, the public- facing comment website, and FDMS, which is the agency-facing side of  the comment system used by participating agencies.

As of March 2018, Regulations.gov identified 180 participating and 128  nonparticipating agencies. These agencies may be components of larger  departmental agencies. Some nonparticipating agencies, including FCC  and SEC, have their own agency-specific websites for receiving public  comments. The comment systems within the scope of this report are as  follows:

FDMS and Regulations.gov: FDMS is federal government-wide  document management system structured by dockets (or file folders)  that offer an adaptable solution to service a wide range of regulatory  activities routinely performed by federal agencies. The public-facing  website of FDMS is Regulations.gov, which is an interactive website  that allows the public to make comments on regulatory documents,  review comments submitted by others, and access federal regulatory  information. Regulations.gov allows commenters to submit comments  to rulemakings by entering information directly in an electronic form on  the Regulations.gov website. This form also allows commenters to  attach files as part of their comment submission, and can be  customized by each participating agency. Appendix II provides an  example of one comment form from Regulations.gov. Additionally, all  participating agencies allow comments to be submitted by mail or  hand delivery. At their discretion, some participating agencies also  allow comments to be submitted via email. See table 1.

FCC’s Electronic Comment Filing System (ECFS): ECFS is a web- based application that allows anyone with access to the internet to  submit comments to FCC rulemaking proceedings. ECFS allows  commenters to submit comments to rulemakings through two main  avenues: brief text comments submitted as Express filings, and long- form comments submitted as Standard filings. Both types of filings  can be submitted through an ECFS comment form, which requires  commenters to enter information directly into an electronic form on the  ECFS website. See appendix III for examples of the comment forms  used by ECFS. Additionally, interested parties with the appropriate  technical capabilities can submit either type of filing directly to ECFS  via a direct application programming interface (API) or through a  public API that is registered with the website Data.gov. Filing  comments through an API allows interested parties the ability to file a  large number of comments without having to submit multiple individual  comment forms. Finally, to accommodate a large volume of comment  submissions for the 2015 Open Internet rulemaking, FCC allowed  interested parties to submit Express comment filings in bulk through  formatted CSV files that were submitted via a dedicated email  address and then uploaded into ECFS. Similarly, for the 2017  Restoring Internet Freedom rulemaking, FCC allowed commenters to  submit Express comment filings in bulk through a dedicated file- sharing website, and the comments were then uploaded into ECFS.  With the exception of these two rulemakings, FCC does not allow  comments to be submitted electronically outside of ECFS. Figure 2  shows how ECFS facilitates public commenting by using the  processes discussed above.

SEC’s Comment Letter Log: When SEC requests public comments  on SEC rule proposals, the public can submit comments to  rulemakings through an online form, which requires commenters to  enter information in an electronic form on SEC’s website. This form  also allows commenters to attach files as part of their submission.  When commenters submit a comment, it is sent to SEC staff as an  email. SEC also allows comments to be submitted via email and mail.  After review, staff upload the comment and any associated data into  the Comment Letter Log, which is the internal database that SEC staff  use to manage the public comment process, and post the comment to  the public website. See appendix IV for an example of a comment  form on SEC’s website.

Selected Agencies Collect Some Information from Commenters and Accept Anonymous Comments through Regulations.gov and Agency-Specific Websites Selected Agencies Collect Some Identity Information through Comment Forms

Consistent with the discretion afforded by the APA, Regulations.gov and  agency-specific comment websites use required and optional fields on  comment forms to collect some identity information from commenters. In  addition to the text of the comment, each participating agency may  choose to collect identity information from the Regulations.gov comment  form by requiring commenters to fill in other fields, such as name,  address, and email address before they are able to submit a comment.  Participating agencies may also choose to collect additional identity  information through optional fields. For example, while EPA does not  make any fields associated with identity information available to  commenters, CFPB makes all fields available and requires that  commenters enter something into the first name, last name, and  organization name fields before a comment can be submitted. Table 2  shows the fields on Regulations.gov in which each of the participating  agencies we analyzed require commenters to enter information and the  optional fields available for commenters to voluntarily enter information.

FCC requires that all commenters complete the following fields on both  the Standard and Express comment forms in ECFS: (1) name, (2) postal  address, and (3) the docket proceeding number to which they are  submitting a comment. The ECFS comment form also allows  commenters to voluntarily provide additional information in optional fields,  such as email address. Similarly, SEC’s comment forms require  commenters to provide (1) first and last name, (2) email address, and (3)  the comment content, before a comment can be successfully submitted.  The comment form also allows commenters to voluntarily provide other  information in optional fields, such as their city and state.

Regardless of the fields required by the comment form, the selected  agencies all accept anonymous comments in practice. Specifically, in the  comment forms on Regulations.gov, ECFS, and SEC’s website, a  commenter can submit a comment under the name “Anonymous  Anonymous,” enter a single letter in each required field, or provide a  fabricated address. In each of these scenarios, as long as a character or  characters are entered into the required fields, the comment will be  accepted. Further, because the APA does not require agencies to  authenticate submitted identity information, neither Regulations.gov nor  the agency-specific comment websites contain mechanisms to check the  validity of identity information that commenters submit through comment  forms.

As part of the Regulations.gov modernization effort, the Office of  Information and Regulatory Affairs (within the Office of Management and  Budget) and the Department of Justice proposed language for a  disclosure statement on every comment form that would require the  commenter to acknowledge that they are not using, without lawful  authority, a means of identification of another person with any comment  they are submitting. Commenters would be required to acknowledge their  agreement with the statement before their comment could be submitted.

According to PMO officials, even with this disclosure statement,  anonymous comments would still be permitted and accepted by  Regulations.gov. This disclosure statement was proposed in response to  allegations of comments being submitted to rulemakings on behalf of  individuals without their permission. As of April 2019, this proposed  language has not yet been approved by the Executive Steering  Committee for Regulations.gov. However, the proposed disclosure  statement would be provided on the Regulations.gov comment form, and  it is unclear whether similar information would be made available to  commenters submitting comments via email or mail.

In contrast to the other selected agencies, according to FCC officials,  FCC rules require the submission of the commenter’s name and mailing  address, or the name and mailing address of an attorney of record.  However, in March 2002, FCC initiated a rulemaking related to the  submission of truthful statements to the commission. Among other  issues, FCC sought comment on whether rulemaking proceedings should  be subject to an already existing rule that prohibited the submission of  written misrepresentations or material omissions from entities that are  subject to FCC regulation. In its final rule, issued in March 2003, FCC  decided to continue to exempt comments to rulemakings from this rule  because of the potential that such a requirement would hinder full and  robust public participation in such policy-making proceedings by  encouraging disputes over the truthfulness of the parties’ statements.  According to FCC officials, to comply with APA requirements, the  commission tries to minimize barriers that could prevent or discourage  commenters from participating in the commenting process, and in  practice accepts anonymous comments. See figure 3 for an example of  an anonymous comment in ECFS.

Additionally, in our survey of program offices with rulemaking  responsibilities at selected agencies, 39 of 52 offices reported that they  received anonymous comments on some rulemakings for which their  office has been responsible since 2013. The remaining 13 offices  responded that they did not receive or were unaware of receiving  anonymous comments, though most of these offices do not have high  levels of rulemaking activity or receive a high volume of comments.

Regulations.gov and Agency-Specific Comment Websites Collect Some Information about Public Users’ Interaction

Regulations.gov and agency-specific comment websites also collect  some information about public users’ interaction with their websites  through application event logs and proxy server logs. This information,  which can include a public user’s Internet Protocol (IP) address, browser  type and operating system, and the time and date of webpage visits, is  collected separately from the comment submission process as part of  routine information technology management of system security and  performance. The APA does not require agencies to collect or verify this  type of information as part of the rulemaking process.

Regulations.gov collects some information from commenters accessing  the website but it is never linked to any specific comment. In  Regulations.gov, proxy server logs capture information such as the  country from which a user accesses the site, the user’s browser type and  operating system, and the time and date of each page visit on the  website. According to PMO officials, this information is provided to the  eRulemaking PMO in summary statistics that are used to assess what  information is of least interest to Regulations.gov visitors, determine  technical design specifications of the website, and identify system  performance problems. This information is collected about all public users  visiting Regulations.gov, regardless of whether they submit a comment.  Further, because the PMO receives this information in the form of  summary statistics, it cannot be connected to any specific comment. The  eRulemaking PMO also monitors IP addresses that interact with  Regulations.gov via security firewalls, but, according to PMO officials, the  web application firewall (WAF) logs (a type of application event log) have  never been connected to specific comments, though in some cases the  URL the blocked user was attempting to access may be captured in the  log.

FCC officials stated that the current ECFS application architecture does  not facilitate FCC identifying the source IP address of the submitter of a  specific comment filed in ECFS. FCC collects information about public  users’ interactions with ECFS through its web-based application proxy  server logs, including the IP address from which a user accesses the site  and the date and time of the user’s interaction. However, ECFS does not  obtain or store IP addresses as part of the comment data it collects when  a public user ultimately submits a comment. Within the current  architecture, ECFS would require officials to match date and time stamps  from the proxy server log to the ECFS comment data to connect a given  IP address to a specific comment.

SEC officials stated it would be difficult to match the large number of daily  hits to their general website to the much smaller number of comments  submitted to their rulemaking proceedings. SEC collects information  about public users’ interactions with the SEC.gov website through proxy  server logs, including the IP address from which a user accesses the  website and the user’s date, time, and URL requests. However, according  to officials, a public user never directly interacts with the Comment Letter  Log, and none of the information from the proxy log is included as part of  the data it collects in association with comment submissions. Despite  this difficulty, SEC officials stated that linking the proxy log data from the  general SEC.gov website to a specific comment in the Comment Letter  Log could be done on a case-by-case basis.

Most Selected Agencies Have Some Internal Guidance Related to Commenter Identity

Seven of 10 selected agencies have documented some internal guidance  associated with the identity of commenters during the three phases of the  public comment process, but the substance of this guidance varies,  reflecting the differences among the agencies and their respective  program offices. For example, as shown in table 3, BLM has no internal  guidance related to identity information, while CFPB has internal  guidance related to the comment intake and response to comments  phases.

For selected agencies that have guidance associated with the identity of  commenters, it most frequently relates to the comment intake or response  to comment phases of the public comment process. The guidance for  these phases addresses activities such as managing duplicate comments  (those with identical or near-identical comment text but varied identity  information) or referring to commenters in a final rule. In addition, some  agencies have guidance related to the use of identity information during  comment analysis. Agencies are not required by the APA to develop  internal guidance associated with the public comment process generally,  or identity information specifically. For the three selected agencies that  did not have identity-related guidance for the public comment process,  cognizant officials told us such guidance has not been developed  because identity information is not used as part of their rulemaking  process. For example, BLM officials stated that the only instance in which  identity information would be considered is when threatening comments  are referred to law-enforcement agencies.

Identity-Related Guidance for Comment Intake

According to our analysis of the internal guidance the selected agencies  provided, five of the 10 agencies have documented identity-related  guidance associated with the comment intake phase. (See table 4.)  Identity-related guidance for the comment intake phase addresses  posting comments and their associated identity information to public  comment websites. The guidance generally falls into two categories: (1)  the treatment of duplicate comments (those comments with identical or  near-identical content, but unique identity information) and (2) the  management of comments reported to have been submitted using false  identity information.

Four of the 10 selected agencies have documented guidance on defining  and posting duplicate comments, which may also be referred to as mass  mail campaigns. However, in accordance with the discretion afforded  them under the APA, agency definitions of duplicate comments and  recommendations on how to manage them during comment intake vary.  Specifically, for EBSA and WHD—the selected agencies within the  Department of Labor (DOL)—one comment letter with multiple signers is  considered one comment, while the same comment submitted by multiple  signers as separate letters is counted separately. In both cases, however,  each individual signer may provide unique identity information. In  contrast, EPA guidance states that mass mail submissions often include  attachments containing either bundled duplicate messages or a single  comment with multiple signatures. For EPA, each signature is counted as  a duplicate comment submission.

As of February 2019, CFPB’s draft guidance does not explicitly define  duplicate comments, but it does note that “duplicate identical  submissions” are not subject to the agency’s policy of posting all  comments. Instead, the official responsible for managing the docket  during comment intake may remove duplicate comments from posting or  decide not to post them. According to CFPB officials, this policy is only  applicable to comments that contain entirely identical comment content  and identity information, and does not apply to mass mailing campaigns.  Similarly, when DOL agencies receive duplicate comments as part of  mass mail campaigns, the agency can choose to post a representative  sample of the duplicate comment to Regulations.gov along with the tally  of the duplicate or near-duplicate submissions, or post all comments as  submitted. EPA guidance states that duplicate comments submitted as  part of mass mailings are to be posted as a single primary document in  Regulations.gov with a tally of the total number of duplicate comments  received from that campaign. However, as discussed later in this report,  EPA may post all duplicate comments it receives, depending on the  format in which they are submitted.

Comments with Potentially False Identity Information

Five of the 10 selected agencies have documented internal guidance on  how to manage posting comments that may have been submitted by  someone falsely claiming to be the commenter. However, the procedures  related to addressing comments with potentially false identity information  also vary among agencies. For EBSA and WHD, guidance from DOL  states that if a comment was submitted by someone falsely claiming to be  the commenter, the identifying information is to be removed from the  comment and the comment is treated as anonymous and remains  posted. In cases where an individual claims that a comment was  submitted to CFPB or SEC using the individual’s identity information  without his or her consent, both agencies’ guidance provide staff with  discretion to redact, reattribute, or otherwise anonymize the comment  letter in question.

According to internal guidance from CFPB, EPA, and SEC, if agency  officials are able to confirm that a comment was submitted by someone  falsely claiming to be the commenter, such as by the agency sending an  email to the address associated with the comment, the comment may not  be made available to the public. SEC officials stated that although they  have discretion to remove the comment from public posting, the typical  response is to encourage the individual making the claim to submit  another comment correcting the record. Similarly, if a member of the  public contacts EPA claiming that a comment was submitted using his or  her identity information without consent and agency staff cannot confirm  it, EPA guidance directs staff to ask the requester who submitted the  claim to submit another comment to the docket explaining that the original  comment was submitted without the individual’s consent. Both comments  will be included in the docket.

Identity-Related Guidance for Comment Analysis

According to our analysis of the guidance the selected agencies provided,  four of the 10 agencies have identity-related guidance for the comment  analysis phase (see table 5). Identity-related guidance for the comment  analysis phase includes criteria for coding comments for analysis,  including by identifying the type of commenter (such as an individual or  interest group).

CMS guidance states that, during review, comments should be  separated by issue area and tables may be used to assist in the  grouping of comments and preparing briefing materials. While this  guidance notes that these tables may be used to group commenters  based on their identity during review, when summarizing comments  later in the process the guidance indicates that CMS officials should  avoid identifying commenters by name or organization.

FDA training materials address how to prepare comment summaries  to help ensure the agency has properly identified all comments  regarding an issue. To conduct a quality-control check on the  comment review process, FDA sorts the comments by commenter  and reviews the comments from a sample of key stakeholders,  including interested trade associations and consumer or patient  groups, to confirm that relevant issues were identified.

For EBSA and WHD, guidance from DOL recommends attaching the  “organization name” to comments within a docket to improve  transparency and help the agency and public users search for  organizations within Regulations.gov. In addition, DOL guidance  suggests flagging comments for additional review, including at least  one flag based on identity.

Identity-Related Guidance for Responding to Comments

According to our analysis of the guidance the selected agencies provided,  five of the 10 agencies have documented identity-related guidance for  responding to comments. (See table 6.) Identity-related guidance for the  response to comments phase includes guidance for agency officials on  how, if at all, to address identity information related to comments in  developing the final rule.

As discussed previously, during comment analysis, CMS guidance  indicates that officials should avoid identifying commenters by name  or organization when summarizing comments. These summaries may  then be used as a basis for the agency’s formal comment summary  included in the preamble of the final rule.

CFPB guidance states that a summary of the rulemaking process  should be developed for the preamble of the final rule and include  how many comments are received and from which type of  commenter. CFPB is to describe both the commenters and comments  in general terms rather than identify commenters by name or entity.  For example, rather than naming a specific financial institution, CFPB  may refer to “industry commenters” in the final rule.

For EBSA and WHD, guidance from DOL states that when several  commenters suggest the same approach to revising or modifying the  proposed rule, the names of specific commenters can be cited as a  list in a footnote. When choosing which commenter should appear first  in the list, DOL agencies are to select the commenter with the  strongest or most detailed discussion on the issue. However, it is not  necessary to always identify commenters by name, and, according to  DOL officials, the department’s general practice is not to do so.  Instead, the agency may use phrases such as “several commenters,”  or “comments by the ABC Corporation and others.” DOL agencies  may also reference commenters by type rather than name, using  terms including “municipal agency, state workforce agency, employer,  academic representative, agency, and industry,” among others.

FDA training materials recommend that the final rule include a very  brief explanation of the number and scope of comments to the  proposed rule, including who submitted them. Commenters are not  identified as individuals, but rather by commenter type, such as trade  associations, farms, or consumer advocacy organizations, among  others.

Selected Agencies’ Treatment of Identity Information Collected during the Public Comment Process Varies

Within the discretion afforded by the APA, the 10 selected agencies’  treatment of identity information during the comment intake, comment  analysis, and response to comments phases of the public comment  process varies. Selected agencies differ in how they treat identity  information during the comment intake phase, particularly in terms of how  they post duplicate comments, which can lead to identity information  being inconsistently presented to public users of comment systems.  Selected agencies’ treatment of identity information during the comment  analysis phase also varies. Specifically, program offices with  responsibility for analyzing comments place varied importance on identity  information during the analysis phase. All agencies draft a response to  comments with their final rule, but the extent to which the agencies  identify commenters or commenter types in their response also varies  across the selected agencies.

Selected Agencies Vary in Their Treatment of Identity Information during the Comment Intake Phase

Within the discretion afforded by the APA and E-Government Act,  selected agencies vary in how they treat identity information during the  comment intake phase, which includes identifying duplicate comments  and posting comments to the public website. Further, the way in which  the selected agencies treat comments during the comment intake phase  results in identity information being inconsistently presented on the public  website. Generally, officials told us that their agencies either (1) maintain  all comments within the comment system, or (2) maintain some duplicate  comment records outside of the comment system, for instance, in email  file archives. Specifically, officials from four selected agencies (CMS,  FCC, FDA, and WHD) stated that they maintain all submitted comments  in the comment system they use. Officials from the other six agencies  (BLM, CFPB, EBSA, EPA, FWS, and SEC) stated that their agencies  maintain some comment records associated with duplicate comments  outside of the comment system.

Among the four agencies that maintain all submitted comments within  their comment system, our review of comment data showed that practices  for posting duplicate comments led to some identity information or  comment content being inconsistently presented on the public website.  For example, according to CMS officials responsible for comment intake,  CMS may post all duplicate comments individually, or post duplicate  comments in batches. When duplicate comments are posted in batches,  the comment title will include the name of the submitting organization  followed by the total number of comments. However, as discussed  previously, CMS does not have any documented policies or guidance  associated with the comment intake process, and we identified examples  where the practices described by CMS officials differed. On one CMS  docket, for instance, staff entered more than 37,000 duplicate comments  individually, with the commenter’s name and state identified in the  comment title. However, the attached document included with each of the  posted comments was an identical copy of one specific comment  containing a single individual’s identity information. While all the individual  names appear to have been retained in the comment titles, and the count  of total comments is represented, any additional identity information and  any potential modifications made to each duplicate comment submitted  have not been retained either online or outside of FDMS, and are not  presented on the public website. (See fig. 4.)

Similarly, although our analysis of WHD comments did not suggest that  any comments were missing from Regulations.gov, on one WHD docket  almost 18,000 duplicate comments were associated with a single  comment with one individual’s name identified in the comment title. While  all of the comments are included within 10 separate attachments, none of  the identity information included with these comments can be easily found  without opening and searching all 10 attachments, most of which contain  approximately 2,000 individual comments. (See fig. 5.)

Our review of comment data showed that the selected agencies that  maintain some comment records outside of the comment system (six of  10) also follow practices that can inconsistently present some identity  information or comment content associated with duplicate comments. For  BLM and FWS, agency officials responsible for comment intake stated  that all comments received through Regulations.gov are posted, but a  single example may be posted when duplicate paper comments are  received. As discussed previously, neither BLM nor FWS have internal  guidance or policy associated with comment intake. For CFPB, EBSA,  EPA, and SEC, the agency may post a single example along with the  total count of all duplicate comments, but does not necessarily post all  duplicate comments online. Thus, identity information and unique  comment contents for all duplicate comments may not be present on the  public website. For example, on one CFPB comment, the agency posted  an example of a submitted comment containing only the submitter’s  illegible signature. None of the other associated identity information for  the posted sample, or any of the duplicate comments, is included in the  comment data. (See fig. 6.)

Similarly, for all duplicate comments received, SEC posts a single  example for each set of duplicate comments and indicates the total  number of comments received. As a result, the identity information and  any unique comment content beyond the first example are not present on  the public website. (See fig. 7.)

The Importance of Identity Information to Comment Analysis Varies

On the basis of the results from our survey, program offices with  responsibility for analyzing comments differ in the importance they place  on identity information during the analysis phase. Because subject-matter  experts are responsible for reviewing public comments and considering  whether changes to the proposed rule should be made, program offices  generally analyze comments. Officials from all but one of the 52 program  offices we surveyed responded that they were responsible, in whole or in  part, for analyzing public comments.

In our survey of program offices with regulatory responsibilities in the 10  selected agencies, at least one program office in each agency reported  that the identity or organizational affiliation of a commenter is at least  slightly important to comment analysis. Additionally, five of the 10  selected agencies (CMS, EPA, FCC, FDA, and FWS) had at least one  program office that reported that the identity or organizational affiliation of  a commenter is not at all important to comment analysis. None of the 52  program offices we surveyed responded that the identity of an individual  commenter is extremely important to their analysis, while only one  program office responded that the commenter’s organizational affiliation  is extremely important to its analysis. (See fig. 8.)

According to officials we interviewed from eight of the 10 selected  agencies, the substance of the comment is considered during analysis  rather than the submitted identity information. Officials from six of these  agencies emphasized that because the agency accepts anonymous  comments, identity is not relevant to their analysis of comments.  However, officials from four of the eight selected agencies stated that, in  certain instances, identity information may be noted. In the case of FDA,  officials explained that commenters are required to indicate a category to  which they belong, such as “individual consumer” or “academia.”  According to FDA officials, however, these categories were used to assist  in writing the comment response, rather than informing the analysis.  Officials from the Department of the Interior’s Office of the Solicitor  (responsible for part of the comment process at BLM and FWS) stated  that the agency may make particular note of comments submitted by a  law firm, as these comments can help the agency understand the position  of the law firm and to prepare a defense in the event that a lawsuit is filed.  Similarly, officials from EPA stated that they are familiar with many  commenters and their positions on certain issues, due to prior legal  interactions. In another example of how an agency may consider the  identity of a commenter, officials from FWS stated that when scientific  data are provided in support of a comment, subject-matter experts will  verify the data and their source.

Selected Agencies Differ in How They Identify Commenters When Responding to Comments

All selected agencies draft a response to comments with their final rule,  but the extent to which the agencies identify commenters in their  response varies. In our survey of program offices with regulatory  responsibility, officials from 51 of 52 offices stated that they are  responsible in whole or in part for responding to comments. Of those  responsible, at least one program office from eight of the 10 agencies (28  of 52 offices) reported that they identified comments by commenter name,  organization, or comment ID number in the response to comments for at  least some rulemakings since 2013. In the case of WHD, officials we  interviewed explained that when they discuss a specific comment in the  preamble to the final rule, they provide the name of the organization that  submitted the comment so that anyone interested in locating the  response to the comment may do so easily.

We found that EBSA and FCC also identified commenters by individual or  organizational name in their response to comments, while EPA referred to  comments by their comment ID number. For example, in a rule finalized  in 2018, EPA referred to comment ID numbers in the response to  comments: “Two comments: EPA-R06-RCRA-2017-0556-0003 and EPA- R06-RCRA-2017-0556-0005 were submitted in favor of the issuance of  the petition.” EPA officials noted that there is variation within the agency  in terms of how commenters are identified when the agency is responding  to comments, and there may be some situations where the commenter is  identified by name.

Officials from all program offices within CFPB and BLM responded to the  survey that they never identified comments by commenter name,  organization, or comment ID in their responses to public comments. In its  response to comments in a 2014 final rule, for example, CFPB stated that  “industry commenters also emphasized the need to coordinate with the  States,” without specifying the organization or specific comments.  Similarly, in its response to comments document for a 2016 rule, for  example, BLM responded directly to the themes and issues raised by  comments while stating that the issue was raised by “one commenter” or  “some commenters.”

Selected Agencies’ Practices Associated with Posting Identity Information Are Not Clearly Communicated to Public Users of Comment Websites

The 10 selected agencies have implemented varied ways of posting  identity information during the comment intake process, particularly  regarding posting duplicate comments, as allowed by the APA. Our  analysis of Regulations.gov and agency-specific comment websites  shows that these practices are not always documented or clearly  communicated to public users of the websites. Public users are members  of the public interested in participating in the rulemaking process via  Regulations.gov or agency-specific websites. They may or may not  submit a comment. In part to facilitate effective public participation in the  rulemaking process, the E-Government Act requires that all public  comments and other materials associated with the rulemaking docket  should be made “publicly available online to the extent practicable.” There  may be situations where it is not practicable to post all submitted items,  for example when resource constraints prevent the scanning and  uploading of thousands of duplicate paper comments. Because the  content of such comments is still reflected in the administrative record,  such practices are not prohibited by the APA or the E-Government Act.

However, key practices for transparently reporting open government data  state that federal government websites—like those used to facilitate the  public comment process—should fully describe the data that are made  available to the public, including by disclosing data sources and  limitations. This helps public users make informed decisions about how  to use the data provided. In the case of identity information submitted with  public comments, for example, public users may want to analyze identity  information to better understand the geographic location from which  comments are being submitted, and would need information about the  availability of address information to do so. The Administrative  Conference of the United States has made several recommendations  related to managing electronic rulemaking dockets. These include  recommendations that agencies disclose to the public their policies  regarding the treatment of materials submitted to rulemaking dockets,  such as those associated with protecting sensitive information submitted  by the public.

As described earlier in this report, the varied practices that selected  agencies use with regard to identity information during the public  comment process results in the inconsistent presentation of this  information on the public websites, particularly when it is associated with  duplicate comments. Although the APA and E-Government Act do not  include any requirements associated with the collection or disclosure of  identity information, we found that the selected agencies we reviewed do  not effectively communicate the limitations and inconsistencies in how  they post identity information associated with public comments. As a  result, public users of the comment websites lack information related to  data availability and limitations that could affect their ability to use the  comment data and effectively participate in the rulemaking process  themselves.

Selected Agencies’ Practices Associated with Posting Identity Information on Regulations.gov Vary and Are Not Clearly Communicated to Public Users

Public users of Regulations.gov seeking to submit a comment are  provided with a blanket disclosure statement related to how their identity  information may be disclosed, and are generally directed to individual  agency websites for additional detail about submitting comments. The  Regulations.gov disclosure statements and additional agency-specific  details are provided on the comment form, and a user seeking to review  comments (rather than submit a comment) may not encounter them on  Regulations.gov. Regulations.gov provides the following disclosure  statement at the bottom of each comment submission form:  Any information (e.g., personal or contact) you provide on this comment form  or in an attachment may be publicly disclosed and searchable on the Internet  and in a paper docket and will be provided to the Department or Agency  issuing the notice. To view any additional information for submitting  comments, such as anonymous or sensitive submissions, refer to the Privacy  Notice and User Notice, the Federal Register notice on which you are  commenting, and the Web site of the Department or Agency.

Similar information is provided to all public users in the Privacy Notice,  User Notice, and Privacy Impact Assessment for Regulations.gov and the  eRulemaking Program. While all of these note that any information,  personal or otherwise, submitted with comments may be publicly  disclosed, public users are not provided any further detail on  Regulations.gov regarding what information, including identity  information, they should expect find in the comment data.

We found that when Regulations.gov provides public users with additional  agency-specific information about the comment intake process, including  accepting and posting comments, it is typically provided in the context of  the comment form and does not provide public users enough detail to  determine what comment data will be available for use when searching  comments that are already submitted. Specifically, each comment form  contains a pop-up box under the heading “Alternate Ways to Comment,”  which reflects the language associated with comment submission  methods included in the NPRM on which individuals are seeking to  comment. Additionally, three participating agencies in our review (EPA,  FWS, and WHD) provide additional detail about posting practices on the  comment form under the heading “Agency Posting Guidelines.” Both  FWS and WHD indicate that the entire comment, including any identifying  information, may be made available to the public. Although WHD follows  DOL policy associated with posting duplicate comments, which allows  some discretion in posting practices, according to a WHD official, without  exception, all comments are posted to Regulations.gov. In our review of  WHD comment data, we did not identify instances where this practice  was not followed.

The “Agency Posting Guidelines” provided by EPA inform public users  that all versions of duplicate or near-duplicate comments as part of mass  mail campaigns may not be posted; rather a representative sample will be  provided, with a tally of the total number of duplicate comments received.  (See fig. 9.)

However, this information does not provide enough detail to help public  users determine whether all of the individual comments and associated  identity information are posted within this docket, because it indicates that  samples are provided for duplicate comments, rather than all of the  copies submitted. We found that one EPA docket received more than 350  separate sets of duplicate comments comprising a total of more than 4.3  million comments (as reported by Regulations.gov) but there is variation  in how these comments were posted. Specifically, EPA inconsistently  presented duplicate comments: 198 of the 350 duplicate comment sets in  this docket were submitted via email. Of the duplicate comment sets  submitted via email, 45 sets have all comments posted in  Regulations.gov, while 153 sets have a sample of the comments posted.  According to EPA officials, this inconsistency results from the format in  which the comments were submitted. For example, when duplicate  comments are compiled into a single document and submitted to EPA  through one email, all of the comments will be posted, whereas duplicate  comments that are emailed separately will be accounted for in the tally  accompanying a sample comment.

While the APA and the E-Government Act do not require comments to be  posted in any particular way, EPA has established detailed internal  guidance for the comment intake process for its Docket Center staff. This  document is in draft form, but clearly lays out the processes EPA staff are  expected to follow when duplicate comments are submitted in different  ways, and what naming conventions will be used in different instances.  However, EPA does not provide similar information to public users about  the process it uses to determine whether all duplicate comments will be  posted, making it challenging for public users to determine whether all  comments are available on Regulations.gov.

The eRulemaking PMO provides participating agencies with flexibility in  how they choose to use FDMS and Regulations.gov, with each  department or agency responsible for managing its own data within the  website. As a result, Regulations.gov directs public users to participating  agencies’ websites for additional information about agency-specific  review and posting policies. We found that all of the selected participating  agencies provide additional information of some kind about the public  comment process on their own websites. However, the provided  information usually directs users back to Regulations.gov or to the  Federal Register. Further, even when selected participating agencies  include details on their website about the agency’s posting practices or  treatment of identity information associated with public comments, it does  not fully describe data limitations that public users need to make informed  decisions about how to use the data provided.

Specifically, seven of the eight participating agencies (BLM, CMS, CFPB,  EPA, FWS, FDA, and WHD) direct public users back to Regulations.gov  and the Federal Register, either on webpages that are about the public  comment process in general, or on pages containing information about  specific NPRMs. As discussed previously, however, the disclosure  statement on Regulations.gov directs public users to the agency website  for additional information. Although three of these participating agencies  (EPA, FWS, and FDA) do provide public users with information beyond  directing them back to Regulations.gov or the Federal Register, only FDA  provides users with details about posting practices that are not also made  available on Regulations.gov.

EPA: The additional information provided on EPA’s website largely  replicates the “Agency Posting Guidelines” provided on the  Regulations.gov comment form, as shown in figure 9. As discussed  previously, however, the way in which EPA posts duplicate comments  varies, and the provided information does not include details about the  process the agency uses to determine whether all duplicate  comments will be posted.

FWS: One NPRM-specific web page that we identified communicated  to public users that all comments will be posted on Regulations.gov,  including any personal information provided through the process. This  largely replicates the “Agency Posting Guidelines” provided on the  Regulations.gov comment form, as well as language included in the  NPRM itself. However, according to an FWS official, when the agency  receives hard-copy duplicate comments through the mail, only one  sample of the duplicate is posted publicly on Regulations.gov. FWS  does not have any policies related to this practice and the information  FWS provides to public users does not include details about how the  agency determines which comment to post as the sample.

FDA: On its general website, FDA includes a webpage titled, “Posting  of Comments.” On this page, FDA provides users with a detailed  explanation about a policy change the agency made in 2015 related to  the posting of public comments submitted to rulemaking proceedings.  Specifically, prior to October 2015, FDA did not publicly post  comments submitted by individuals in their individual capacity. See  figure 10.

After October 15, 2015, FDA’s policy is to publicly post all comments  to Regulations.gov, to include any identifying information submitted  with the comment. In our review of FDA comments submitted to  dockets opened since October 15, 2015, we did not identify instances  where this policy was not followed.

The one participating agency in our scope (EBSA) that does not direct  public users back to Regulations.gov instead recreates the entire  rulemaking docket on its own website. On the main EBSA webpage  related to regulations, public users can find links to various websites  related to rulemaking, including a “Public Comments” page, but not  Regulations.gov. From the “Public Comments” page, public users can  access pages that are specific to NPRMs and other activities for which  EBSA is requesting public comments. On the NPRM-specific webpages,  the rulemaking docket that can be found on Regulations.gov is  duplicated, including individual links to each submitted comment.  Certain document links, such as those for the proposed rule or final rule,  direct a public user to the Federal Register document, but the comment  links do not direct users to Regulations.gov. While EBSA follows DOL  guidance associated with posting duplicate comments, which allows  some discretion in posting practices, EBSA does not have a policy for  how comments are posted to Regulations.gov or its own website, and in  the examples we reviewed the content of the docket pages does not  always match. According to EBSA officials, the agency began this  practice prior to the development of Regulations.gov, and has continued it  because internal staff and other stakeholders find the webpages useful.  However, we have previously reported that reducing or eliminating  duplicative government activities can help agencies provide more efficient  and effective services.

Further, on EBSA’s “Public Comments” webpage, public users are  informed that comments with inappropriate content will be removed, but  no other information associated with EBSA’s posting practices is provided  on this general page. In one instance on an NPRM-specific webpage,  public users are informed that identity information has been removed from  certain comments due to the inclusion of personal health information, but  most of the NPRM-specific webpages we reviewed did not include this  disclosure. Additionally, duplicate comments are posted on the NPRM- specific webpages under the heading “Petitions,” and are posted with a  number following the title of the comment. While public users are  informed that the number represents the total number of comments  submitted, not all links include a copy of each individual comment. This  practice aligns with DOL guidance, but as a result, the way in which  EBSA posts duplicate comments varies even within dockets, and the  provided information does not include details about the process the  agency uses to determine whether all duplicate comments will be posted.  Additionally, because EBSA recreates rulemaking dockets on its own  website without referencing Regulations.gov or explaining the process,  public users lack assurance about how EBSA’s data sources relate to one  another.

Because participating agencies are not required to adhere to  standardized posting practices, Regulations.gov directs public users to  participating agency websites for additional information about posting  practices and potential data limitations. However, the additional  information provided on the selected agencies’ websites is rarely different  from what is provided on Regulations.gov. Further, it does not describe  the limitations associated with the identity information contained in  publicly posted comments, and in many cases simply directs users back  to Regulations.gov. As allowed for under the APA, all of the participating  agencies in our review vary in the way in which they post identity  information associated with comments—particularly duplicate comments.  However, the lack of accompanying disclosures may potentially lead  users to assume, for example, that only one entity has weighed in on an  issue when, actually, that comment represents 500 comments.

The APA, E-Government Act and relevant Executive Orders establish the  importance of public participation in the rulemaking process, to include  access to electronic rulemaking dockets in formats that can be easily  searched and downloaded. Further, key practices for transparently  reporting open government data state that federal government websites— like those used to facilitate the public comment process—should fully  describe the data that are made available to the public, including by  disclosing data sources and limitations. Without better information about  the posting process, the inconsistency in the way in which duplicate  comments are presented to public users of Regulations.gov limits public  users’ ability to explore and use the data and could lead users to draw  inaccurate conclusions about the public comments that were submitted  and how agencies considered them during the rulemaking process.

Agency-Specific Comment Websites Do Not Clearly Communicate Posting Policies to Public Users

Both SEC and FCC use comment systems other than Regulations.gov  and follow standardized posting processes associated with public  comments submitted to their respective comment systems, but SEC has  not clearly communicated these practices to the public. Although it  appears to users of the SEC website that the agency follows a consistent  process for posting duplicate comments, this practice has not been  documented or communicated to public users of its website. As discussed  earlier, SEC posts a single example for each set of duplicate comments  and indicates the total number of comments received. As a result, the  identity information and any unique comment content beyond the first  example are not accessible to the public online. According to SEC  officials, this practice is not documented in formal policy, and is not  explicitly communicated to public users of the SEC’s comment website.  Although SEC does provide public users with some information on its  “How to Submit Comments” page, this information is limited to informing  public users that all comments will be posted publicly, without any edits to  personal identifying information, and no other information related to  SEC’s posting process is provided. Without clearly communicated policies  for posting comments, public users of SEC.gov do not have information  related to data sources and limitations needed to determine whether and  how they can use the data associated with public comments.

In contrast, FCC identifies its policies for posting comments and their  associated identity information in a number of places on the FCC.gov  website, and on the ECFS web page within the general website.  Regarding comments submitted to rulemaking proceedings through  ECFS, public users are informed that all information submitted with  comments, including identity information, will be made public. According  to FCC officials, all comments are posted directly to ECFS as they are  submitted, without intervention by FCC staff. Further, according to  officials, all duplicate comments remain in ECFS as individual comments,  unless an organization submits a Standard filing with an attached file  containing multiple comments. Our review of ECFS comment data did not  identify discrepancies with this practice.

While the public comment process allows interested parties to state their  views about prospective rules, the lack of communication with the public  about the way in which agencies treat identity information during the  posting process, particularly for duplicate comments, may inhibit users’  meaningful participation in the rulemaking process. While the APA does  not include requirements for commenters to provide identity information,  or for agency officials to include commenter identity as part of their  consideration of comments, key practices for transparently reporting open  government data state that federal government websites—like those used  to facilitate the public comment process—should fully describe the  publicly available data, to include disclosing data sources and limitations.  Without clearly communicating how comments and their associated  identity information are presented in the data, public users could draw  inaccurate conclusions about public comments during the rulemaking  process, limiting their ability to participate in the rulemaking process.

Five selected agencies do not have a policy for posting comments, and  the selected agencies generally do not clearly communicate to public  users about the way in which they publicly post comments and their  associated identity information. In addition, one agency fully duplicates  rulemaking dockets on its own website, without informing users that the  information may be found in a searchable database on Regulations.gov.  Regulations.gov does not provide detailed information about posting  policies, and seven of the eight participating agencies in the scope of our  review direct public users back to Regulations.gov or the Federal Register  on their own websites. Further, the available information is provided on  the comment form, so public users seeking to review comment data that  had been previously submitted may not encounter it. Because all of the  participating agencies in our review vary in the way in which they post  identity information associated with comments—particularly duplicate  comments—the lack of accompanying disclosures may potentially lead  users to reach inaccurate conclusions about who submitted a particular  comment, or how many individuals weighed in on an issue. As a result,  public users of Regulations.gov do not have information related to data  sources and limitations that could affect their ability to effectively use the  comment data and, consequently, participate in the rulemaking process.  Similarly, users of SEC.gov do not have information related to data  sources and limitations needed to determine whether and how they can  use the data associated with public comments, because the agency lacks  a policy for posting duplicate comments and associated identity  information to the public. In short, more clearly communicated information  about posting policies, particularly with regard to identity information and  duplicate comments, could help public users make informed decisions  about how to use the comment data these agencies provide, and how  comments may have informed the rulemaking process.

We are making the following eight recommendations to the Directors of  BLM, CFPB, and FWS; the Administrators of CMS, EPA, and WHD; the  Assistant Secretary of Labor for EBSA; and the Chairman of the SEC,  respectively:  The Director of BLM should create and implement a policy for standard  posting requirements regarding comments and their identity information,  particularly for duplicate comments, and should clearly communicate this  policy to the public on the BLM website. (Recommendation 1)

The Administrator of CMS should create and implement a policy for  standard posting requirements regarding comments and their identity  information, particularly for duplicate comments, and should clearly  communicate this policy to the public on the CMS website.  (Recommendation 2)

The Director of CFPB should finalize its draft policy for posting comments  and their identity information, particularly for duplicate comments, and  clearly communicate it to the public on the CFPB website.  (Recommendation 3)

The Assistant Secretary of Labor for EBSA should  1.  create and implement a policy for standard posting requirements  regarding comments and their identity information, particularly for  duplicate comments;  2.  clearly communicate this policy to the public on the EBSA website;  3.  evaluate the duplicative practice of replicating rulemaking dockets on  the EBSA website, to either discontinue the practice or include a  reference to Regulations.gov and explanation of how the pages relate  to one another. (Recommendation 4)

The Administrator of EPA should finalize its draft policy for posting  comments and their identity information, particularly for duplicate  comments, and clearly communicate it to the public on the EPA website.  (Recommendation 5)

The Director of FWS should create and implement a policy for standard  posting requirements regarding comments and their identity information,  particularly for duplicate comments, and should clearly communicate this  policy to the public on the FWS website. (Recommendation 6)

The Chairman of the SEC should develop a policy for posting duplicate  comments and associated identity information and clearly communicate it  to the public on the SEC website. (Recommendation 7)

The Administrator of WHD should clearly communicate its policy for  posting comments and their identity information, particularly for duplicate  comments, to the public on the WHD website. (Recommendation 8)

We provided drafts of this product for comment to CFPB, EPA, FCC,  SEC, the Department of Health and Human Services, the Department of  the Interior, and DOL. We received written comments from three of the  selected agencies and the three Departments which are reproduced in  appendixes V through X. All of the selected agencies generally agreed  with the recommendations directed to them and indicated that they  intended to take action to more clearly communicate their posting policies  to the public. BLM, EBSA, FWS, and SEC also stated that they intend to  develop written policies associated with posting comments.

In its written comments, the Department of Health and Human Services  stated that CMS already has policies for standard posting requirements.  However, CMS could not provide us with this policy during the course of  our review, and in the accompanying technical comments, officials stated  that guidance associated with posting comments has not been formalized  in a written document. Given that we found significant variation in the way  that CMS posts comments, even within a single docket, we continue to  believe that it is important for CMS to develop and implement a standard  policy for posting comments and their identity information, in addition to  communicating this policy to the public on the CMS website.

CFPB and EPA also stated that they intend to finalize their draft policies  for posting comments and their associated identity information. In  addition, EPA included technical comments in its letter, which we  considered and incorporated in this report as appropriate. FCC had no  comments on the draft report, but provided technical comments, which we  incorporated as appropriate. The remaining selected agencies and  departments also provided technical comments, which we considered and  incorporated in this report as appropriate.

As arranged with your offices, unless you publicly announce the contents  of this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the  appropriate congressional committees; the Director of CFPB; the  Administrator of EPA; the Chairmen of FCC and SEC; and the  Secretaries of Health and Human Services, the Interior, and Labor. In  addition, the report will be available at no charge on GAO’s website at  http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix XI.

Appendix I: Survey of Program Offices with Regulatory Responsibilities within Selected Agencies

To determine how selected agencies treat identity information associated  with public comments, in October 2018 we surveyed and received  responses from 52 program offices within the selected agencies about  their practices associated with comment intake (including identifying  duplicate comments and posting comments to the public website),  comment analysis (including reviewing comments and considering their  content), and response to comments. To select the program offices to  receive survey questionnaires about the public comment process, we first  reviewed agency websites to identify all of the program offices in each of  the selected agencies. We then identified program offices with regulatory  responsibilities described by the websites and that had issued at least  one Notice of Proposed Rulemaking (NPRM) from 2013 through 2017,  and provided these lists to the selected agencies for confirmation. Table 7  lists the program offices we surveyed.

We developed a draft survey questionnaire in conjunction with another  GAO engagement team conducting work on the public comment process,  and pretested it with program office officials from four of the selected  agencies in August and September 2018. We interviewed these officials  to improve the questionnaire and ensure that (1) the questions were clear  and unbiased, (2) the information could be feasibly obtained by program  office officials, (3) the response options were appropriate and reasonable,  and (4) the survey did not create an undue burden on program office  officials. The process of developing the survey was iterative, where we  used the results of one pretest to modify the questionnaire for the next  pretest.

We distributed the questionnaires to the program offices as fillable  Portable Document Format (PDF) forms, in October 2018 requesting that  officials collaborate with others in their office to ensure the responses  were reflective of the program office as a whole, rather than one  individual’s experience. Two agencies, CMS and SEC, have agency-level  administrative offices with centralized responsibilities for certain aspects  of the public comment process. For these agencies, the selected program  offices were instructed to leave certain questions blank, and we provided  separate questionnaires for the administrative offices. All 52 program  offices completed the survey, but the results cannot be generalized to  program offices outside of the selected agencies.

In developing, administering, and analyzing this survey, we took steps to  minimize the potential errors that may result from the practical difficulties  of conducting any survey. Because we surveyed and received responses  from all program offices with regulatory responsibilities in the selected  agencies, our results are not subject to sampling or nonresponse error.  We pretested and reviewed our questionnaire to minimize measurement  error that can arise from differences in how questions are interpreted and  the sources of information available to respondents. We also answered  questions from program offices during the survey, reviewed completed  questionnaires, and conducted follow-up as necessary. On the basis of  this follow-up and with agreement from the responding officials, we edited  responses as needed. For CMS and SEC, we edited the blank questions  in the program office questionnaires with responses from their  administrative offices.

Appendix II: Regulations.gov Comment Form Example

Comments are submitted to Regulations.gov via an electronic comment  form. See figure 11 for an example of a comment form from  Regulations.gov.

Appendix III: Electronic Comment Filing System Comment Forms

The Federal Communications Commission’s (FCC) Electronic Comment  Filing System (ECFS) allows commenters to submit comments to  rulemaking proceedings via a Standard filing and Express filing. A  Standard filing allows commenters to attach a file to their comment. See  figure 12 for an example of a Standard filing.

An Express filing does not allow for files to be attached. See figure 13 for  an example of an Express filing.

Appendix IV: Securities and Exchange Commission Comment Form Example

One way in which comments are submitted to the Securities and  Exchange Commission (SEC) is through an electronic comment form.  See figure 14 for an example of a comment form from SEC.gov.

Appendix V: Agency Comments from the Bureau of Consumer Financial Protection

Appendix VI: Agency Comments from the Environmental Protection Agency

Appendix VII: Agency Comments from the Department of Health and Human Services

Appendix VIII: Agency Comments from the Department of the Interior

Appendix IX: Agency Comments from the Department of Labor

Appendix X: Agency Comments from the Securities and Exchange Commission

Appendix XI: GAO Contact and Staff Acknowledgments

In addition to the contact named above, David Bruno (Assistant Director),  Elizabeth Kowalewski (Analyst in Charge), Enyinnaya David Aja, Gretel  Clarke, Lauren Kirkpatrick, James Murphy, Alexandria Palmer, Carl  Ramirez, Shana Wallace, and April Yeaney made key contributions to this  report. Other contributors include Tim Bober, Dahlia Darwiche, Colin  Fallon, Justin Fisher, James Healy, Katie LeFevre, Barbara Lewis, and  Maria McMullen.

When federal agencies propose new rules, they usually provide an opportunity for public comment, but agencies aren't required to collect or verify commenters' identity information.

Mass mailing campaigns can result in thousands of duplicate comments. Agencies can post them individually, as attachments to a single comment, or as a count of duplicates received. Practices vary among agencies, within agencies, and for each rule.

The variation in how agencies post comments could create an inaccurate view of who submitted public comments. Our recommendations include more clearly communicating agencies' comment policies.