§ 317.93 - Matching program exclusions.

The following are not included under the definition of a matching program. The agency is not required to comply with the computer matching provisions of the Privacy Act, although it may be required to comply with any other applicable provisions of the Act and this part.

(a) Statistical matches whose purpose is solely to produce aggregate data stripped of personal identifiers. This does not mean that the data bases used in the match must be stripped prior to the match, but only that the results of the match must not contain data identifying any individual. Implicit in this exception is that this kind of match is not done to take action against specific individuals.

(b) Statistical matches whose purpose is in support of any research or statistical project. The results of these matches need not be stripped of identifiers, but they must not be used to make decisions that affect the rights, benefits or privileges of specific individuals.

(c) Pilot matches. This exclusion covers small scale sampling matches whose purpose is to gather cost-benefit data on which to premise a decision about engaging in a full-fledged matching program. Pilot matches must be retained in a statistical information gathering channel. It is at this point that the component can decide whether to conduct a statistical data gathering match without consequences to the subjects of record or a full-fledged program where results will be used to take specific action against them. To avoid possible misuse of pilot matches and to ensure full compliance with the Privacy Act, these matches must be approved by the Defense Data Integrity Board.

(d) Law enforcement investigative matches whose purpose is to gather evidence against a named person or persons in an existing investigation. (1) To be eligible for the exclusion the match must be performed by an activity of a component whose principal function involves enforcement of criminal laws, i.e., an activity that is authorized to exempt certain of its systems of records under subsection (j)(2) of the Privacy Act.

(2) The match must flow from an investigation already underway which focuses on a named person or persons. Subjects identified generically, e.g., “program beneficiaries,” are not eligible.

(3) The investigation may be into either criminal or civil law violations.

(4) In the context of this exclusion only, person or persons could include subjects that are other than individuals as defined in the Privacy Act, such as corporations or other business entities. For example, a business entity could be named subject of the investigation and records matched could be those of customers or clients.

(5) The match must be for the purpose of gathering evidence against the named person or persons.

(e) Tax administration matches. (1) Matches involving disclosures of taxpayer return information to state or local tax officials pursuant to section 6103(d) of the Internal Revenue Code.

(2) Tax refund offset matches accomplished pursuant to the Deficit Reduction Act of 1984.

(3) Matches done for tax administration pursuant to section 6103(b)(4) of the Internal Revenue Code.

(4) Tax refund offset matches conducted pursuant to other statutes provided approval of the Office of Management and Budget is obtained.

(f) Routine administrative matches using Federal personnel records. These are matches between the agency and other Federal agencies or between the agency and non-Federal agencies for administrative purposes that use data bases that contain records predominantly relating to Federal personnel. The term “predominantly” means that the percentage of records in the system that are about Federal employees must be greater than of any other category contained therein. For the purpose of disclosing records subject to the Privacy Act, the Department of Defense is considered a single agency.

(1) The purpose of the match must not be intended to result in an adverse action. Matches whose purpose is to take any adverse financial, personnel, disciplinary or other adverse action against Federal personnel whose records are involved in the match, are not excluded from the Act's coverage.

(2) An example of a match that is excluded is an agency's disclosure of time and attendance information on all agency employees to the Department of the Treasury in order to prepare the agency's payroll.

(3) This exclusion does not bring under the Act's coverage matches that may ultimately result in an adverse action. It only requires that their purpose not be intended to result in an adverse action.

(g) Internal matches using only records from DoD systems of records. (1) Internal matches (conducted within the Department of Defense) are excluded on the same basis as Federal personnel record matching provided no adverse intent as to a Federal employee motivates the match.

(2) This exclusionary provision does not disturb subsection (b)(1) of the Act permitting disclosure to DoD employees on an official need-to-know basis.

(3) The purpose of the internal match must not be to take any adverse financial, personnel, disciplinary, or other adverse action against Federal personnel.

(h) Background investigation and foreign counterintelligence matches. Matches done in the course of performing a background check for security clearances of Federal personnel or Federal contractor personnel are not covered. Matches done for the purpose of foreign counterintelligence are also not covered.