§ 16.42 - Responsibility for responding to Privacy Act requests for access to records.

§ 16.42 Responsibility for responding to Privacy Act requests for access to records.

(a) In general. Except as stated in paragraphs (c), through (df), and (e) of this section, the component that first receives a Privacy Act request for access to a record, and has possession of that record, is the component responsible for responding to the request. In determining which records are responsive to a request, a component ordinarily shall will include only those records in its possession it maintained as of the date the component begins its search for them. If any other date is used, the component shall inform the requester of that date.

(b) Authority to grant or deny requests. The head of a component, or the component head's designee, is authorized to grant or deny any Privacy Act request for access to a record of records maintained by that component.

(c) Re-routing of misdirected requests. When a component's FOIA/Privacy Act office determines that a request was misdirected within the Department, the receiving component's FOIA/Privacy Act office shall route the request to the FOIA/Privacy Act office of the proper component(s).

(d) Consultations, referrals, and

referrals

coordination. When a component receives a Privacy Act request for access to a record in its possession, it shall determine whether another component, or another agency of the Federal Government, is better able to determine whether the record is exempt from access under the Privacy Act. If the receiving component determines that it is best able to process the record in response to the request, then it shall do so. If the receiving component determines that it is not best able to process the record, then it shall

either:

(1) Respond to the request regarding that record, after consulting with the component or agency best able to determine whether the record is exempt from access and with any other component or agency that has a substantial interest in it; or

(2) Refer the responsibility for responding to the request regarding that record to the component best able to determine whether it is exempt from access, or to another agency that originated the record (but only if that agency is subject to the Privacy Act). Ordinarily, the component or agency that originated a record will be presumed to be best able to determine whether it is exempt from access.

(d) Law enforcement information. Whenever a request is made for access to a record follow the consultation, referral, and coordination procedures under § 16.4, subject to the requirements in this section. Components may make agreements with other components or agencies to eliminate the need for consultations or referrals for particular types of records.

(e) Consultations, referrals, and coordination concerning law enforcement information. When a component receives a Privacy Act request for access to a record in its possession containing information that relates to an investigation of a possible violation of law and that

was

originated

by

with another component or agency of the Federal Government, the receiving component shall either refer the responsibility for responding to the request regarding that information to that other component or agency or shall consult with that other component or agency.

(

e) Classified information. Whenever a request is made

f) Consultations, referrals, and coordination concerning classified information.

(1) When a component receives a Privacy Act request for access to a record containing information that has been classified

by

or may be appropriate for classification by another component or agency under

Executive Order 12958 or any other executive

any applicable Executive order concerning the classification of records, the receiving component shall consult with or refer the responsibility for responding to the request regarding that information to the component or agency that classified the information, or that should consider the information for classification

, or has the primary interest in it, as appropriate. Whenever a record contains

.

(2) When a component receives a Privacy Act request for access to a record containing information that has been derivatively classified

by a component because it contains information classified by another component or agency

, the receiving component shall consult with or refer the responsibility for responding to that portion of the request

regarding that information

to the component or agency that classified the underlying information.

(f) Notice of referral. Whenever a component refers all or any part of the responsibility for responding to a request to another component or agency, it ordinarily shall notify the requester of the referral and inform the requester of the name of each component or agency to which the request has been referred and of the part of the request that has been referred.

(g) Timing of responses to consultations and referrals. All consultations and referrals shall be handled according to the date the Privacy Act access request was initially received by the first component or agency, not any later date.

(h) Agreements regarding consultations and referrals. Components may make agreements with other components or agencies to eliminate the need for consultations or referrals for particular types of records.

[Order No. 2156–98, 63 FR 29600, June 1, 1998; 63 FR 34965, June 26, 1998; 63 FR 51401, Sept. 25, 1998]