§ 317.95 - Providing due process to matching subjects.

(a) Independent verification and notice. Subjects of record of matching programs shall be afforded certain due process procedures when a match uncovers any disqualifying or adverse information about them. No recipient agency, non-Federal agency, or source agency shall take any adverse action against an individual until such agency has independently verified such information and the individual has received a notice from the agency containing a statement of its findings and gives the individual the opportunity to contest the findings before making a final determination. The agency shall not take any adverse action based on the raw results of a computer matching program. Adverse information developed by a match must be investigated and verified prior to any action being taken.

(b) Waiver of independent verification procedures. Program officials may request the Data Integrity Board waive the independent verification requirement after they have identified the type of matching data eligible for a waiver and conducted a thorough determination of the data's accuracy. The only data eligible for waiver is that which identifies the individual and the amount of benefits paid under a federal benefit program. The data must not be ambiguous. After the Data Integrity Board determines that the data qualifies for the waiver procedure, the program official must present convincing evidence to the Data Integrity Board of the recipient agency to permit the Board to assert a high degree of confidence in the accuracy of the data. The following elements are examples of evidence which will assist a Board in making such a determination: A description of the databases involved including how the information is acquired and maintained; the system manager's overall assessment of the reliability of the systems and the accuracy of the data they contain; the results of any assessments or audits conducted; any material or significant weaknesses under various statutes; security controls in place; previous security assessments; any historical data relating to program error rates; and any information relating to the currency of the data. If the Board approves the waiver, it will notify the source agency and the program officials.

(c) Independent investigation. Conservation of resources dictates that the procedures for affording due process be flexible and suited to the data being verified and the consequences to the individual of making a mistake. If the source agency has established a high degree of confidence in the quality of its data and it can demonstrate that its quality control processes are rigorous, the recipient agency may choose to expend fewer resources in independently verifying the data. Absolute confirmation is not required. The agency should bring some degree of reasonableness to the process of verifying data. Some methods to consider are:

(1) The individual subject of record who is the best source where practical, and

(2) Researching source documents.

(d) Notice and opportunity to contest. The agency is required to notify matching subjects of adverse information uncovered during a matching program and give them an opportunity to contest and explain before the agency makes a final determination. Recipients already receiving benefits may not have them suspended or reduced pending expiration of the contest period. Individuals have 30 days to respond to a notice of adverse action, unless a statute or regulation grants a longer period. The period runs from the date of the notice until 30 calendar days. The agency shall allow an additional five days for mailing time before ending the notice period. If an individual contacts the agency within the notice period (35 days) and indicates his or her acceptance of the validity of the adverse information, the agency may take immediate action to deny or terminate. The agency may also take action if the period expires without a response.

(e) Combining verification and notice requirements. It may be appropriate to combine the verification and notice requirements into a single step, especially if the subject of record is the best source for verification. In this manner, the adverse finding and notice of the opportunity to contest are compressed into a single action. This method is dependent upon the confidence, reliability and quality of the data. Careful thought should be given as to when to apply this method. It may be applicable in special cases, but should not be considered as a routine process. To ensure that this consideration takes place, it shall be the responsibility of the Defense Data Integrity Board to make a formal determination as to when it is appropriate to compress the verification and notice into a single period.

(f) Individual status pending due process. The agency may not make a final determination as to applicants for Federal benefit programs whose eligibility is being verified through a matching program until they have completed the due process steps the Act requires. This does not require placing an applicant on the rolls pending a determination, but only that the agency not make a final determination. However, if a subject is already receiving benefits, the benefits shall not be suspended or reduced until due process steps have been completed. If the specific Federal benefit program involved in the match has its own due process requirements, those requirements may suffice for the purposes of the Privacy Act, provided the Defense Data Integrity Board determines that they are at least as strong as the Privacy Act's provisions.

(g) Exclusion. (1) If the agency determines a potentially significant effect on public health or safety is likely, it may take appropriate action, notwithstanding these due process requirements.

(2) In such cases, the agency shall include the possibility of suspension of due process for this reason in its matching program agreement.