On November 17, 2016, FERC issued a final rule amending and clarifying its regulations to implement provisions of the Fixing America’s Surface Transportation Act (the “FAST Act”) regarding the designation, protection, and sharing of Critical Energy/Electric Infrastructure Information (“CEII”). In doing so, FERC established criteria and procedures for the designation of CEII, prohibited unauthorized disclosure of CEII, created sanctions for the unauthorized disclosure of CEII by FERC personnel, and permitted the voluntary sharing of CEII among appropriate entities.
The FAST Act, signed into law on December 4, 2015, requires FERC to issue regulations aimed at securing and sharing sensitive infrastructure information. On July 5, 2016, FERC issued a Notice of Proposed Rulemaking (the “NOPR”) to implement the provisions of the FAST Act. In the NOPR, FERC proposed several amendments to its existing regulations, including the creation of criteria and procedures for the designation of information as CEII, a specific prohibition on authorized disclosure of that information, sanctions for knowing and willful disclosure of CEII by certain federal personnel, a process for voluntary sharing of CEII, and changes to the existing process for requesting CEII treatment.
In the final rule, FERC adopted most of the proposals in the NOPR. In doing so, FERC determined that the proposals comply with the FAST Act’s requirements and help improve the secure treatment of CEII. Among other revisions and clarifications, FERC:
- Confirmed that the definition of CEII includes all “Critical Energy Infrastructure Information” and declined to limit CEII to only electric infrastructure information;
- Provided a mechanism for other federal agencies to consult with FERC’s CEII Coordinator regarding the treatment or designation of CEII;
- Clarified that while information submitted to FERC as CEII will not be legally designated CEII until the CEII Coordinator makes such a determination, such information will be handled and treated as CEII until the determination is made;
- Decided that, despite the statutory five-year designation period, FERC will treat expired CEII as non-public until a re-designation is made;
- Explained that parties requesting CEII must provide specific information to demonstrate a legitimate need for the information;
- Created sanctions for unauthorized disclosures of CEII by FERC personnel;
- Detailed the instances in which FERC may voluntarily share CEII in order to ensure infrastructure is protected;
- Clarified that FERC’s regulations only govern the receipt of CEII from FERC, and that entities voluntarily sharing CEII outside the FERC process are not governed by FERC’s regulations; and
- Clarified that FERC will continue to “balance the requestor’s need for the information against the sensitivity of the information.”
A copy of the final rule is available here.