§ 16.43 - Responses to a Privacy Act requests for access to records.

§ 16.43 Responses to a Privacy Act requests for access to records.

(a) Acknowledgements of requests. On receipt of a request, a component ordinarily shall send an acknowledgement letter to the requester which shall confirm the In general. Components should, to the extent practicable, communicate with requesters who have access to the internet using electronic means, such as through email or a web portal. A component shall honor a requester's preference for receiving a record in a particular form or format where it is readily reproducible by the component in the form or format requested.

(b) Acknowledgement of requests. The component responsible for responding to the request must acknowledge, in writing, receipt of a Privacy Act request for access. A component shall initially respond to the requester by acknowledging the Privacy Act request for access, assigning the request an individualized tracking number, and, if applicable, confirming, in writing, the requester's agreement to pay fees

under

in accordance with § 16.

41

49.

(c)

and provide an assigned request number for further reference. (b) Grants of requests for access.

Timing of responses to a Privacy Act request for access.

(1) Components ordinarily will respond to Privacy Act requests for access according to their order of receipt. The response time will commence on the date that the request is received by the proper component's office designated to receive requests, but in any event not later than ten (10) working days after the request is first received by any component's office designated by this subpart to receive requests.

(2) A component may designate multiple processing tracks that distinguish between simple and more complex Privacy Act requests for access, based on the estimated amount of work or time needed to process the request. Among the factors a component may consider are the number of pages involved in processing the request and the need for consultations or referrals. Components may advise requesters of the track into which their request falls and, when appropriate, may offer requesters an opportunity to narrow their request so that it can be placed in a different processing track.

(d) Granting a Privacy Act request for access. Once a component makes a determination to grant a Privacy Act request for access, in whole or in part, it shall notify the requester in writing. The component shall inform the requester in the notice of any fee charged under § 16.49 and shall disclose records to the requester promptly on payment of any applicable fee.

If a request is made in person, the component may disclose records to the requester directly, in a manner not unreasonably disruptive of its operations, on payment of any applicable fee and with a written record made of the grant of the request. If a requester is accompanied by another person, the requester shall be required to authorize in writing any discussion of the records in the presence of the other person. (c) Adverse determinations of requests

(e) Adverse determination to a Privacy Act request for access. A component

making

that makes an adverse determination

denying

to a Privacy Act request for access

in any respect

, in whole or in part, shall notify the requester of

that

the adverse determination in writing.

Adverse determinations, or denials of requests, consist of: A determination to withhold any requested record in whole or in part; a determination that a

An adverse determination to a Privacy Act request for access includes a determination by the component that: the request did not reasonably describe the record sought; the information requested is not a record subject to the Privacy Act; the requested record is not maintained in a system of records; the requested record is exempt, in whole or in part, from a Privacy Act request for access under applicable exemption(s); the requested record does not exist

or

, cannot be located

; a determination that what

, or has been

requested

destroyed; the record is not

a record subject to the Privacy Act; a determination on any disputed fee matter; and a denial of a request for expedited treatment. The notification letter

readily reproducible in a comprehensible form; or there is a matter regarding disputed fees.

(f) Content of adverse determination response. An adverse determination to a Privacy Act request for access, in whole or in part, shall be signed by the head of the component, or the component head's designee, and shall include:

(1) The name and title or position of the person responsible for the

denial

adverse determination to the Privacy Act request for access;

(2) A brief statement of the reason(s) for the

denial

adverse determination to the Privacy Act request for access, including any Privacy Act exemption(s) applied by the component

in denying the request; and (3

;

(3) An estimate of the volume of any records or information withheld, if applicable, such as the number of pages or some other reasonable form of estimation, although such an estimate is not required if the volume is otherwise indicated or if providing an estimate would harm an interest protected by an applicable exemption; and

(4) A statement that the

denial

adverse determination to the Privacy Act request for access may be appealed under § 16.45

(a)

, and a description of the requirements

of

set forth in § 16.45

(a)

.