03-1996. Freedom of Information Act and Privacy Act Procedures

AGENCY:

Office of the Secretary, Homeland Security.

ACTION:

Interim final rule.

SUMMARY:

This interim final rule establishes procedures for the public to obtain information from the Office of the Secretary, Department of Homeland Security, under the Freedom of Information Act and the Privacy Act.

DATES:

This interim final rule is effective January 27, 2003. Written comments may be submitted by February 26, 2003.

ADDRESSES:

Submit written comments (preferably an original and three copies) to Associate General Counsel (General Law), Department of Homeland Security, Washington, DC 20528.

FOR FURTHER INFORMATION CONTACT:

D.E. Ogden, [phone], not a toll free call.

SUPPLEMENTARY INFORMATION:

I. Background

On November 25, 2002, the President signed into law the Homeland Security Act (Pub. L. 107-296), which created the new Department of Homeland Security (DHS). Pursuant to the provisions of the Act, the new Department came into existence on January 24, 2003.

In order to establish procedures to facilitate public interaction with the DHS Office of the Secretary, DHS is issuing an initial series of proposed and interim final regulations.

II. The Interim Final Rule

This interim final rule establishes procedures for the DHS Office of the Secretary necessary to implement the Freedom of Information Act (5 U.S.C. 552) and the Privacy Act (5 U.S.C. 552a). Except to the extent a Department component has adopted separate guidance under FOIA or the Privacy Act, the provisions of this subpart shall to apply each component of the Department.

The Freedom of Information Act provides for the full disclosure of agency records and information to the public unless that information is exempted under clearly delineated statutory language. The Privacy Act serves to safeguard public interest in informational privacy by delineating the duties and responsibilities of federal agencies that collect, store, and disseminate personal information about individuals. The procedures established here ensure that the Department of Homeland Security fully satisfies its responsibility to the public to disclose departmental information while simultaneously safeguarding individual privacy.

The Privacy Act serves to balance the government's need to maintain information about individuals with the rights of individuals to be protected against unwarranted invasions of their privacy stemming from federal agencies' collection, maintenance, use, and disclosure of personal information about them. Agencies are required to issue regulations outlining the agency's rules and procedures for implementation of the Privacy Act and its provisions in the agency. This includes procedures on how individuals may request access to information about themselves, request amendment or correction of those records, and request an accounting of disclosures of their records by the Department.

III. Procedural Requirements

Because the DHS came into existence on January 24, 2003, it is necessary to promptly establish procedures to facilitate the interaction of the public with the Department. Furthermore, this Interim Final Rule generally parallels the procedures currently used by other agencies to implement the Freedom of Information Act and the Privacy Act. Accordingly the Department has determined that notice and public procedure are impracticable, unnecessary and contrary to the public interest pursuant to 5 U.S.C. 553(b)(B). For the same reasons, the Department has determined that this interim rule should be issued without a delayed effective date pursuant to 5 U.S.C. 553 (d)(3).

Because no notice of proposed rulemaking is required, the provisions of the Regulatory Flexibility Act (5 U.S.C. Chapter 6) do not apply. It has been determined that this rulemaking is not a significant regulatory action for the purposes of Executive Order 12866. Accordingly, a regulatory impact analysis is not required.

List of Subjects in 6 CFR Part 5

• Classified information
• Freedom of information
• Privacy

Authority and Issuance

For the reasons set forth above, the Department of Homeland Security establishes 6 CFR Chapter I in new Title 6—Homeland Security, consisting at this time of part 5 to read as set forth below.

Dated: January 24, 2003.

Tom Ridge,

Secretary of Homeland Security.

Title 6—Homeland Security

CHAPTER I—DEPARTMENT OF HOMELAND SECURITY, OFFICE OF THE SECRETARY

PART 5—DISCLOSURE OF RECORDS AND INFORMATION

Subpart A—Freedom of Information Act

5.1

General provisions.

5.2

Public reading rooms.

5.3

Requirements for making requests.

5.4

Responsibility for responding to requests.

5.5

Timing of responses to requests.

5.6

Responses to requests.

5.7

Classified information.

5.8

Business information.

5.9

Appeals.

5.10

Preservation of records.

5.11

Fees.

5.12

Other rights and services.

Subpart B—Privacy Act

5.20

General provisions.

5.21

Requests for access to records.

5.22

Responsibility for responding to requests for access to records.

5.23

Responses to requests for access to records.

5.24

Classified information.

5.25

Appeals.

5.26

Requests for amendment or correction of records.

5.27

Requests for an accounting of record disclosures.

5.28

Preservation of records.

5.29

Fees.

5.30

Notice of court-ordered and emergency disclosures.

5.31

Security of systems of records.

5.32

Contracts for the operation of record systems.

5.33

Use and collection of social security numbers.

5.34

Standards of conduct for administration of the Privacy Act.

5.35

Sanctions and penalties.

5.36

Other rights and services.

Appendix A to Part 5—FOIA/Privacy Act Offices of the Department of Homeland Security

Appendix B to Part 5—Public Reading Rooms of the Department of Homeland Security

Authority: Pub. L. 107-296, 116 Stat. 2135; (6 U.S.C. 101 et seq.); 5 U.S.C. 301. Subpart A also issued under 5 U.S.C. 552. Subpart B also issued under 5 U.S.C. 552a.

Subpart A—Freedom of Information Act

§ 5.1

General provisions.

(a)(1) This subpart A contains the rules that the Department of Homeland Security (Department) follows in processing requests for records under the Freedom of Information Act (FOIA) (5 U.S.C. 552). These rules should be read together with the FOIA, which provides additional information about access to records maintained by the Department. Requests made by individuals for records about themselves under the Privacy Act of 1974 (5 U.S.C. 552a), which are processed under subpart B of this part, are processed under this subpart also. Information routinely provided to the public as part of a regular Department activity (for example, press releases issued by the Assistant Secretary for Public Affairs may be provided to the public without following this subpart).

(2) The provisions established by this subpart shall apply to all Department components that are transferred to the Department. Except to the extent a Department component has adopted separate guidance under FOIA, the provisions of this subpart shall apply to each component of the Department. Departmental components may issue their own guidance under this subpart pursuant to approval by the Department.

(b) As used in this subpart, component means each separate bureau, office, board, division, commission, service, or administration of the Department.

§ 5.2

Public reading rooms.

(a) Records that are required to be maintained by the Department in a public reading room will be made available electronically at www.dhs.gov/​foia. Each Department component will be responsible for determining which of the records it generates are required to be made available and to make those records available either in its own reading room or in the Department's central reading room. Each component shall maintain and make available for public inspection and copying a current subject-matter index of its reading room records. Each index shall be updated regularly, at least quarterly, with respect to newly included records.

(b) The Department components maintain public reading rooms or areas at the locations listed below:

(1) Animal and Plant Health Inspection Service Library, 4700 River Road, Riverdale, MD 20737-1232;

(2) Plum Island Animal Disease Center, the APHIS address above or, USDA-ARS, 5601 Sunnyside Avenue, Building 1, Room 2248, Beltsville, MD 20705-5128;

(3) Critical Infrastructure Assurance Office (A former office of the Bureau of Industry and Security) does not maintain a conventional public reading room. Records that are required to be in the public reading room are available electronically at http://www.bis.doc.gov/​FOIA/​Default.htm;​;

(4) FIRESTAT (formerly the Integrated Hazard Information System of the National Oceanic and Atmospheric Administration), NOAA Public Reference Facility, 1305 East-West Highway (SSMC4), Room 8627, Silver Spring, MD 20910;

(5) National Communication Service (a former component of the Defense Information Systems Agency) does not maintain a conventional public reading room. Records that are required to be in the public reading room are available electronically at http://disa.mil/​gc/​foia/​foia.html;​;

(6) The address for each component and program listed below is: U.S. Department of Energy; 1000 Independence Avenue, SW., Washington, DC 20585:

(i) Energy Assurance Office;

(ii) Environmental Measurements Laboratory;

(iii) Nuclear Incident Response Team;

(iv) The chemical and biological national security and supporting programs and activities of the non-proliferation and verification research and development program;

(v) The life sciences activities related to microbial pathogens of Biological and Environmental Research Program;

(vi) The nuclear smuggling programs and activities within the proliferation detection program of the non-proliferation and verification research and development program;

(vii) The nuclear assessment program and activities of the assessment, detection, and cooperation program of the international materials protection and cooperation program, and the advanced scientific computing research program and activities at Lawrence Livermore National Laboratory; and

(viii) The National Infrastructure Simulation and Analysis Center;

(7) The address for each component and program listed below is: Freedom of Information Act Officer at: Department of Health and Human Services, Freedom of Information Officer, Room 645-F, Hubert H. Humphrey Building, Independence Avenue, SW., Washington, DC 20201:

(i) Metropolitan Medical Response System;

(ii) National Disaster Medical System;

(8) Office of Emergency Preparedness please contact the Strategic National Stockpile Centers for Disease Control and Agency for Toxic Substances and Disease Registry, 1600 Clifton Road, NE., Room 4103, Building 1, Atlanta, GA 30333;

(9) Immigration and Naturalization Service, 111 Massachusetts Avenue, NW., 2nd Floor, ULLICO Building, Washington, DC 20536;

(10) For the National Infrastructure Protection Center, the National Domestic Preparedness Office, and the Domestic Emergency Support Team: Federal Bureau of Investigation, 935 Pennsylvania Avenue, NW., Department of Justice, Washington, DC 20535-0001;

(11) Office of Domestic Preparedness, U.S. Department of Justice, Office of Justice Programs, 810 7th Street, NW., Room 5430, Washington, DC 20531;

(12) Visa Office, Department of State, 2201 C Street, NW., Washington, DC 20520;

(13) Federal Aviation Administration, 800 Independence Avenue, SW., Washington, DC 20591;

(14) Transportation Security Administration, 400 Seventh Street, SW., Washington, DC 20590;

(15) United States Coast Guard Headquarters, 2100 Second Street, SW., Washington, DC 20593-0001 (for district offices, consult your phone book);

(16) The Federal Law Enforcement Training Center does not maintain a conventional public reading room. Records that are required to be in the public reading room are available electronically at http://www.fletc.gov/​irm/​foia/​readingroom.htm;​;

(17) U.S. Customs Service, Freedom of Information Request, 1300 Pennsylvania Avenue, NW., Mint Annex, Washington, DC 20229-0001 (for a list of field office reading room locations please consult 19 CFR 103.1);

(18) U.S. Secret Service, Main Treasury, Freedom of Information Request, 950 H Street, NW., Suite 3000, Washington, DC;

(19) Federal Emergency Management Agency, Federal Center Plaza, 500 C Street, SW., Room 840, Washington, DC 20472 (for regional offices, consult your phone book);

(20) For the Federal Computer Incident Response Center and the Federal Protective Service: Central Office, GSA Headquarters, 1800 F Street, NW (CAI), Washington, DC 20405 (for regional offices, consult the phone book);

(c) Components shall also make reading room records created by the Department on or after November 1, 1996, available electronically via the component web-site. This includes each component's index of its reading room records, which will indicate which records are available electronically.

§ 5.3

Requirements for making requests.

(a) How made and addressed. You may make a request for records of the Department by writing directly to the Department component that maintains those records. For additional information about the FOIA, you may refer directly to the statute. If you are making a request for records about yourself, see § 5.21(d) for additional requirements. If you are making a request for records about another individual, either a written authorization signed by that individual permitting disclosure of those records to you or proof that that individual is deceased (for example, a copy of a death certificate or an obituary) must be submitted. Your request should be sent to the component's FOIA office at the address listed in appendix A to part 5. In most cases, your FOIA request should be sent to a component's central FOIA office. (The functions of each component are summarized elsewhere in this title and in the description of the Department and its components in the “United States Government Manual,” which is issued annually and is available in most libraries, as well as for sale from the Government Printing Office's Superintendent of Documents. This manual also can be accessed electronically at the Government Printing Office's World Wide Web site (which can be found at http://www.access.gpo.gov/​su_​docs).) If you cannot determine where within the Department to send your request, you may send it to the Departmental Disclosure Officer, Department of Homeland Security, Washington, DC 20528. That office will forward your request to the component(s) it believes most likely to have the records that you want. Your request will be considered received as of the date it is received by the proper component's FOIA office. For the quickest possible handling, you should mark both your request letter and the envelope “Freedom of Information Act Request.”

(b) Description of records sought. You must describe the records that you seek in enough detail to enable Department personnel to locate them with a reasonable amount of effort. Whenever possible, your request should include specific information about each record sought, such as the date, title or name, author, recipient, and subject matter of the record. If known, you should include any file designations or descriptions for the records that you want. As a general rule, the more specific you are about the records or type of records that you want, the more likely the Department will be able to locate those records in response to your request. If a component determines that your request does not reasonably describe records, it shall tell you either what additional information is needed or why your request is otherwise insufficient. The component also shall give you an opportunity to discuss your request so that you may modify it to meet the requirements of this section. If your request does not reasonably describe the records you seek, the agency's response to your request may be delayed.

(c) Agreement to pay fees. If you make a FOIA request, it shall be considered a firm commitment by you to pay all applicable fees charged under § 5.11 up to $ 25.00, unless you seek a waiver of fees. In making your FOIA request, please indicate whether you are willing to pay for the request or desire a waiver. The component responsible for responding to your request ordinarily will confirm this commitment in an acknowledgement letter. When making a request, you may specify a willingness to pay a greater or lesser amount. If you are seeking a waiver of fees you must provide a justification for your fee waiver request in accordance with the requirements of § 5.11(k). If your request for a fee waiver is denied, the component will notify you of that decision and will request an agreement from you to pay fees up to $25, or a greater or lesser amount specified by you. Your request shall not be considered received and further work shall not be done on it until you agree to pay fees. If you do not provide a firm commitment to pay the anticipated fee within the time period specified by the component, the request will be administratively closed.

§ 5.4

Responsibility for responding to requests.

(a) In general. Except as stated in paragraphs (c), (d), and (e) of this section, the component that first receives a request for a record and has possession of that record is the component responsible for responding to the request. In determining which records are responsive to a request, a component ordinarily will include only records in its possession as of the date the component begins its search for them. If any other date is used, the component shall inform the requester of that date.

(b) Authority to grant or deny requests. The head of a component, or the component head's designee, is authorized to grant or deny any request for a record of that component.

(c) Consultations and referrals. When a component receives a request for a record in its possession, it shall determine whether another component, or another agency of the Federal Government, is better able to determine whether the record is exempt from disclosure under the FOIA and, if so, whether it should be disclosed as a matter of administrative discretion. If the receiving component determines that it is best able to process the record in response to the request, then it shall do so. If the receiving component determines that it is not best able to process the record, then it shall either:

(1) Respond to the request regarding that record, after consulting with the component or agency best able to determine whether to disclose it and with any other component or agency that has a substantial interest in it; or

(2) Refer the responsibility for responding to the request regarding that record to the component best able to determine whether to disclose it, or to another agency that originated the record (but only if that agency is subject to the FOIA). Ordinarily, the component or agency that originated a record will be presumed to be best able to determine whether to disclose it.

(d) Law enforcement information. Whenever a request is made for a record containing information that relates to an investigation of a possible violation of law and was originated by another component or agency, the receiving component shall either refer the responsibility for responding to the request regarding that information to that other component or agency or consult with that other component or agency.

(e) Classified information. Whenever a request is made for a record containing information that has been classified, or may be appropriate for classification, by another component or agency under Executive Order 12958 or any other executive order concerning the classification of records, the receiving component shall refer the responsibility for responding to the request regarding that information to the component or agency that classified the information, or which should consider the information for classification, or which has the primary interest in it, as appropriate. Whenever a record contains information that has been derivatively classified by a component because it contains information classified by another component or agency, the component shall refer the responsibility for responding to the request regarding that information to the component or agency that classified the underlying information.

(f) Notice of referral. Whenever a component refers all or any part of the responsibility for responding to a request to another component or agency, it ordinarily shall notify the requester of the referral and inform the requester of the name of each component or agency to which the request has been referred and of the part of the request that has been referred.

(g) Timing of responses to consultations and referrals. All consultations and referrals will be handled according to the date the FOIA request initially was received by the first component or agency, not any later date.

(h) Agreements regarding consultations and referrals. Components may make agreements with other components or agencies to eliminate the need for consultations or referrals for particular types of records.

§ 5.5

Timing of responses to requests.

(a) In general. Components ordinarily shall respond to requests according to their order of receipt.

(b) Multitrack processing. (1) A component may use two or more processing tracks by distinguishing between simple and more complex requests based on the amount of work and/or time needed to process the request, including through limits based on the number of pages involved. If a component does so, it shall advise requesters in its slower track(s) of the limits of its faster track(s).

(2) A component using multitrack processing may provide requesters in its slower track(s) with an opportunity to limit the scope of their requests in order to qualify for faster processing within the specified limits of the component's faster track(s). A component doing so will contact the requester either by telephone or by letter, whichever is more efficient in each case.

(c) Unusual circumstances. (1) Where the statutory time limits for processing a request cannot be met because of “unusual circumstances,” as defined in the FOIA, and the component determines to extend the time limits on that basis, the component shall as soon as practicable notify the requester in writing of the unusual circumstances and of the date by which processing of the request can be expected to be completed. Where the extension is for more than ten working days, the component shall provide the requester with an opportunity either to modify the request so that it may be processed within the time limits or to arrange an alternative time period with the component for processing the request or a modified request.

(2) Where a component reasonably believes that multiple requests submitted by a requester, or by a group of requesters acting in concert, constitute a single request that would otherwise involve unusual circumstances, and the requests involve clearly related matters, they may be aggregated. Multiple requests involving unrelated matters will not be aggregated.

(d) Expedited processing. (1) Requests and appeals will be taken out of order and given expedited treatment whenever it is determined that they involve:

(i) Circumstances in which the lack of expedited treatment could reasonably be expected to pose an imminent threat to the life or physical safety of an individual;

(ii) An urgency to inform the public about an actual or alleged federal government activity, if made by a person primarily engaged in disseminating information.

(2) A request for expedited processing may be made at the time of the initial request for records or at any later time. A request for expedited processing must be submitted to the component that maintains the record requested. Requests based on the categories in paragraphs (d)(1)(i), (ii), and (iii) of this section must be submitted to the component that maintains the records requested.

(3) A requester who seeks expedited processing must submit a statement, certified to be true and correct to the best of that person's knowledge and belief, explaining in detail the basis for requesting expedited processing. For example, a requester within the category in paragraph (d)(1)(ii) of this section, if not a full-time member of the news media, must establish that he or she is a person whose main professional activity or occupation is information dissemination, though it need not be his or her sole occupation. A requester within the category in paragraph (d)(1)(ii) of this section also must establish a particular urgency to inform the public about the government activity involved in the request, beyond the public's right to know about government activity generally. The formality of certification may be waived as a matter of administrative discretion.

(4) Within ten calendar days of its receipt of a request for expedited processing, the proper component shall decide whether to grant it and shall notify the requester of the decision. If a request for expedited treatment is granted, the request shall be given priority and shall be processed as soon as practicable. If a request for expedited processing is denied, any appeal of that decision shall be acted on expeditiously.

§ 5.6

Responses to requests.

(a) Acknowledgements of requests. On receipt of a request, a component ordinarily shall send an acknowledgement letter to the requester which shall confirm the requester's agreement to pay fees under § 5.3(c) and provide an assigned request number for further reference.

(b) Grants of requests. Ordinarily, a component shall have twenty business days from when a request is received to determine whether to grant or deny the request. Once a component makes a determination to grant a request in whole or in part, it shall notify the requester in writing. The component shall inform the requester in the notice of any fee charged under § 5.11 and shall disclose records to the requester promptly on payment of any applicable fee. Records disclosed in part shall be marked or annotated to show the amount of information deleted unless doing so would harm an interest protected by an applicable exemption. The location of the information deleted also shall be indicated on the record, if technically feasible.

(c) Adverse determinations of requests. A component making an adverse determination denying a request in any respect shall notify the requester of that determination in writing. Adverse determinations, or denials of requests, consist of: A determination to withhold any requested record in whole or in part; a determination that a requested record does not exist or cannot be located; a determination that a record is not readily reproducible in the form or format sought by the requester; a determination that what has been requested is not a record subject to the FOIA; a determination on any disputed fee matter, including a denial of a request for a fee waiver; and a denial of a request for expedited processing. The denial letter shall be signed by the head of the component, or the component head's designee, and shall include:

(1) The name and title or position of the person responsible for the denial;

(2) A brief statement of the reason(s) for the denial, including any FOIA exemption applied by the component in denying the request;

(3) An estimate of the volume of records or information withheld, in number of pages or in some other reasonable form of estimation. This estimate does not need to be provided if the volume is otherwise indicated through deletions on records disclosed in part, or if providing an estimate would harm an interest protected by an applicable exemption; and

(4) A statement that the denial may be appealed under § 5.9(a) and a description of the requirements of § 5.9(a).

§ 5.7

Classified information.

In processing a request for information that is classified under Executive Order 12958 (3 CFR, 1996 Comp., p. 333) or any other executive order, the originating component shall review the information to determine whether it should remain classified. Information determined to no longer require classification shall not be withheld on the basis of Exemption 1 of the FOIA. On receipt of any appeal involving classified information, the Associate General Counsel (General Law) shall take appropriate action to ensure compliance with Part 7 of this title.

§ 5.8

Business information.

(a) In general. Business information obtained by the Department from a submitter will be disclosed under the FOIA, if otherwise allowable, only under this section.

(b) Definitions. For purposes of this section:

(1) Business information means commercial or financial information obtained by the Department from a submitter that may be protected from disclosure under Exemption 4 of the FOIA.

(2) Submitter means any person or entity from whom the Department obtains business information, directly or indirectly. The term includes, but is not limited to, corporations; state, local, and tribal governments; and foreign governments.

(c) Designation of business information. A submitter of business information will use good-faith efforts to designate, by appropriate markings, either at the time of submission or at a reasonable time thereafter, any portions of its submission that it considers to be protected from disclosure under Exemption 4. These designations will expire ten years after the date of the submission unless the submitter requests, and provides justification for, a longer designation period.

(d) Notice to submitters. A component shall provide a submitter with prompt written notice of a FOIA request or administrative appeal that seeks its business information wherever required under paragraph (e) of this section, except as provided in paragraph (h) of this section, in order to give the submitter an opportunity to object to disclosure of any specified portion of that information under paragraph (f) of this section. The notice shall either describe the business information requested or include copies of the requested records or record portions containing the information. When notification of a voluminous number of submitters is required, notification may be made by posting or publishing the notice in a place reasonably likely to accomplish it.

(e) Where notice is required. Notice shall be given to a submitter wherever:

(1) The information has been designated in good faith by the submitter as information considered protected from disclosure under Exemption 4; or

(2) The component has reason to believe that the information may be protected from disclosure under Exemption 4.

(f) Opportunity to object to disclosure. A component will allow a submitter a reasonable time to respond to the notice described in paragraph (d) of this section and will specify that time period within the notice. If a submitter has any objection to disclosure, it is required to submit a detailed written statement. The statement must specify all grounds for withholding any portion of the information under any exemption of the FOIA and, in the case of Exemption 4, it must show why the information is a trade secret or commercial or financial information that is privileged or confidential. In the event that a submitter fails to respond to the notice within the time specified in it, the submitter will be considered to have no objection to disclosure of the information. Information provided by the submitter that is not received by the component until after its disclosure decision has been made shall not be considered by the component. Information provided by a submitter under this paragraph may itself be subject to disclosure under the FOIA.

(g) Notice of intent to disclose. A component shall consider a submitter's objections and specific grounds for nondisclosure in deciding whether to disclose business information. Whenever a component decides to disclose business information over the objection of a submitter, the component shall give the submitter written notice, which shall include:

(1) A statement of the reason(s) why each of the submitter's disclosure objections was not sustained;

(2) A description of the business information to be disclosed; and

(3) A specified disclosure date, which shall be a reasonable time subsequent to the notice.

(h) Exceptions to notice requirements. The notice requirements of paragraphs (d) and (g) of this section shall not apply if:

(1) The component determines that the information should not be disclosed pursuant to exemption four and/or any other exemption of the FOIA;

(2) The information lawfully has been published or has been officially made available to the public;

(3) Disclosure of the information is required by statute (other than the FOIA) or by a regulation issued in accordance with the requirements of Executive Order 12600 (3 CFR, 1988 Comp., p. 235); or

(4) The designation made by the submitter under paragraph (c) of this section appears obviously frivolous, except that in such a case the component shall, within a reasonable time prior to a specified disclosure date, give the submitter written notice of any final decision to disclose the information.

(i) Notice of FOIA lawsuit. Whenever a requester files a lawsuit seeking to compel the disclosure of business information, the component shall promptly notify the submitter.

(j) Corresponding notice to requesters. Whenever a component provides a submitter with notice and an opportunity to object to disclosure under paragraph (d) of this section, the component shall also notify the requester(s). Whenever a component notifies a submitter of its intent to disclose requested information under paragraph (g) of this section, the component shall also notify the requester(s). Whenever a submitter files a lawsuit seeking to prevent the disclosure of business information, the component shall notify the requester(s).

§ 5.9

Appeals.

(a) Appeals of adverse determinations. (1) If you are dissatisfied with a component's response to your request, you may appeal an adverse determination denying your request, in any respect, to the Associate General Counsel (General Law), Department of Homeland Security, Washington, DC 20528. You must make your appeal in writing and it must be received by the Associate General Counsel (General Law) within 60 days of the date of the letter denying your request. Your appeal letter may include as much or as little related information as you wish, as long as it clearly identifies the component determination (including the assigned request number, if known) that you are appealing. For the quickest possible handling, you should mark your appeal letter and the envelope “Freedom of Information Act Appeal.”

(2) An adverse determination by the Associate General Counsel (General Law) will be the final action of the Department; and

(3) An appeal ordinarily will not be acted on if the request becomes a matter of FOIA litigation.

(b) Responses to appeals. The decision on your appeal will be made in writing. A decision affirming an adverse determination in whole or in part shall contain a statement of the reason(s) for the affirmance, including any FOIA exemption(s) applied, and will inform you of the FOIA provisions for court review of the decision. If the adverse determination is reversed or modified on appeal, in whole or in part, you will be notified in a written decision and your request will be reprocessed in accordance with that appeal decision.

(c) When appeal is required. If you wish to seek review by a court of any adverse determination, you must first appeal it under this section.

§ 5.10

Preservation of records.

Each component shall preserve all correspondence pertaining to the requests that it receives under this subpart, as well as copies of all requested records, until disposition or destruction is authorized by title 44 of the United States Code or the National Archives and Records Administration's General Records Schedule 14. Records will not be disposed of while they are the subject of a pending request, appeal, or lawsuit under the FOIA.

§ 5.11

Fees.

(a) In general. Components shall charge for processing requests under the FOIA in accordance with paragraph (c) of this section, except where fees are limited under paragraph (d) of this section or where a waiver or reduction of fees is granted under paragraph (k) of this section. A component ordinarily shall collect all applicable fees before sending copies of requested records to a requester. Requesters must pay fees by check or money order made payable to the Treasury of the United States.

(b) Definitions. For purposes of this section:

(1) Commercial use request means a request from or on behalf of a person who seeks information for a use or purpose that furthers his or her commercial, trade, or profit interests, which can include furthering those interests through litigation. Components shall determine, whenever reasonably possible, the use to which a requester will put the requested records. When it appears that the requester will put the records to a commercial use, either because of the nature of the request itself or because a component has reasonable cause to doubt a requester's stated use, the component shall provide the requester a reasonable opportunity to submit further clarification.

(2) Direct costs means those expenses that an agency actually incurs in searching for and duplicating (and, in the case of commercial use requests, reviewing) records to respond to a FOIA request. Direct costs include, for example, the salary of the employee performing the work (the basic rate of pay for the employee, plus 16 percent of that rate to cover benefits) and the cost of operating duplication machinery. Not included in direct costs are overhead expenses such as the costs of space and heating or lighting of the facility in which the records are kept.

(3) Duplication means the making of a copy of a record, or of the information contained in it, necessary to respond to a FOIA request. Copies can take the form of paper, microform, audiovisual materials, or electronic records (for example, magnetic tape or disk), among others. Components shall honor a requester's specified preference of form or format of disclosure if the record is readily reproducible with reasonable efforts in the requested form or format by the office responding to the request.

(4) Educational institution means a preschool, a public or private elementary or secondary school, an institution of undergraduate higher education, an institution of graduate higher education, an institution of professional education, or an institution of vocational education, that operates a program of scholarly research. To be in this category, a requester must show that the request is authorized by and is made under the auspices of a qualifying institution and that the records are not sought for a commercial use but are sought to further scholarly research.

(5) Noncommercial scientific institution means an institution that is not operated on a “commercial” basis, as that term is defined in paragraph (b)(1) of this section, and that is operated solely for the purpose of conducting scientific research the results of which are not intended to promote any particular product or industry. To be in this category, a requester must show that the request is authorized by and is made under the auspices of a qualifying institution and that the records are not sought for a commercial use but are sought to further scientific research.

(6) Representative of the news media, or news media requester, means any person actively gathering news for an entity that is organized and operated to publish or broadcast news to the public. The term “news” means information that is about current events or that would be of current interest to the public. Examples of news media entities include television or radio stations broadcasting to the public at large and publishers of periodicals (but only in those instances where they can qualify as disseminators of “news”) who make their products available for purchase or subscription by the general public. For “freelance” journalists to be regarded as working for a news organization, they must demonstrate a solid basis for expecting publication through that organization. A publication contract would be the clearest proof, but components shall also look to the past publication record of a requester in making this determination. To be in this category, a requester must not be seeking the requested records for a commercial use. However, a request for records supporting the news-dissemination function of the requester shall not be considered to be for a commercial use.

(7) Review means the examination of a record located in response to a request in order to determine whether any portion of it is exempt from disclosure. It also includes processing any record for disclosure (for example, doing all that is necessary to redact it and prepare it for disclosure). Review costs are recoverable even if a record ultimately is not disclosed. Review time includes time spent considering any formal objection to disclosure made by a business submitter under § 5.8, but does not include time spent resolving general legal or policy issues regarding the application of exemptions.

(8) Search means the process of looking for and retrieving records or information responsive to a request. It includes page-by-page or line-by-line identification of information within records and also includes reasonable efforts to locate and retrieve information from records maintained in electronic form or format. Components shall ensure that searches are done in the most efficient and least expensive manner reasonably possible. For example, components shall not search line-by-line where duplicating an entire document would be quicker and less expensive.

(c) Fees. In responding to FOIA requests, components shall charge the following fees unless a waiver or reduction of fees has been granted under paragraph (k) of this section:

(1) Search. (i) Search fees shall be charged for all requests other than requests made by educational institutions, noncommercial scientific institutions, or representatives of the news media, subject to the limitations of paragraph (d) of this section. Components may charge for time spent searching even if they do not locate any responsive record or if they withhold the record(s) located as entirely exempt from disclosure.

(ii) Fees for search time are assessed by the hourly wage of the personnel filling the request. These fees are subject to change. Currently, for each quarter hour spent by clerical personnel in searching for and retrieving a requested record, the fee will be $4.00. Where a search and retrieval cannot be performed entirely by clerical personnel (for example, where the identification of records within the scope of a request requires the use of professional personnel) the fee will be $7.00 for each quarter hour of search time spent by professional personnel. Where the time of managerial personnel is required, the fee will be $10.25 for each quarter hour of time spent by those personnel.

(iii) For computer searches of records, requesters will be charged the direct costs of conducting the search, although certain requesters (as provided in paragraph (d)(1) of this section) will be charged no search fee and certain other requesters (as provided in paragraph (d)(3) of this section) will be entitled to the cost equivalent of two hours of manual search time without charge. These direct costs will include the cost of operating a central processing unit for that portion of operating time that is directly attributable to searching for responsive records, as well as the costs of operator/programmer salary apportionable to the search.

(iv) For requests requiring the retrieval of records from any Federal Records Center, certain additional costs may be incurred in accordance with the Transactional Billing Rate Schedule established by the National Archives and Records Administration, effective October 1, 2002.

(2) Duplication. Duplication fees will be charged to all requesters, subject to the limitations of paragraph (d) of this section. For a paper photocopy of a record (no more than one copy of which need be supplied), the fee will be ten cents per page. For copies produced by computer, such as tapes or printouts, components will charge the direct costs, including operator time, of producing the copy. For other forms of duplication, components will charge the direct costs of that duplication.

(3) Review. Review fees will be charged to requesters who make a commercial use request. Review fees will be charged only for the initial record review (the review done when a component determines whether an exemption applies to a particular record or record portion at the initial request level). No charge will be made for review at the administrative appeal level for an exemption already applied. However, records or record portions withheld under an exemption that is subsequently determined not to apply may be reviewed again to determine whether any other exemption not previously considered applies; the costs of that review are chargeable where it is made necessary by such a change of circumstances. Review fees will be charged at the same rates as those charged for a search under paragraph (c)(1)(ii) of this section.

(d) Restrictions on charging fees. (1) No search fee will be charged for requests by educational institutions, noncommercial scientific institutions, or representatives of the news media.

(2) No search fee or review fee will be charged for a quarter-hour period unless more than half of that period is required for search or review.

(3) Except for requesters seeking records for a commercial use, components will provide without charge:

(i) The first 100 pages of duplication (or the cost equivalent); and

(ii) The first two hours of search (or the cost equivalent).

(4) No fee will be charged whenever a total fee calculated under paragraph (c) of this section is less than the agency's cost to process the check. Currently, whenever a total fee calculated under paragraph (c) of this section is $14.00 or less for any request, no fee will be charged.

(5) The provisions of paragraphs (d) (3) and (d)(4) of this section work together. This means that for requesters other than those seeking records for a commercial use, no fee will be charged unless the cost of search in excess of two hours plus the cost of duplication in excess of 100 pages totals more than $14.00.

(e) Notice of anticipated fees in excess of $25.00. When a component determines or estimates that the fees to be charged under this section will amount to more than $25.00, the component shall notify the requester of the actual or estimated amount of the fees, unless the requester has indicated a willingness to pay fees as high as those anticipated. If only a portion of the fee can be estimated readily, the component shall advise the requester that the estimated fee may be only a portion of the total fee. In cases in which a requester has been notified that actual or estimated fees amount to more than $25.00, the request shall not be considered received and further work shall not be done on it until the requester makes a firm commitment to pay the anticipated total fee. Any such agreement should be memorialized by the requester in writing and must be received by the component within a time period specified by the component in its notice to the requester. If the requester does not provide a firm commitment to pay the anticipated fee within the time period specified by the component, the request will be administratively closed. A notice under this paragraph will offer the requester an opportunity to discuss the matter with Department personnel in order to reformulate the request to meet the requester's needs at a lower cost.

(f) Charges for other services. Apart from the other provisions of this section, when a component chooses as a matter of administrative discretion to provide a special service (such as certifying that records are true copies or sending them by other than ordinary mail) the direct costs of providing the service ordinarily will be charged.

(g) Charging interest. Components may charge interest on any unpaid bill starting on the 31st day following the date of billing the requester. Interest charges will be assessed at the rate provided in 31 U.S.C. 3717 and will accrue from the date of the billing until payment is received by the component. Components will follow the provisions of the Debt Collection Act of 1982 (Pub. L. 97-365, 96 Stat. 1749), as amended, and its administrative procedures, including the use of consumer reporting agencies, collection agencies, and offset.

(h) Aggregating requests. Where a component reasonably believes that a requester or a group of requesters acting together is attempting to divide a request into a series of requests for the purpose of avoiding fees, the component may aggregate those requests and charge accordingly. Components may presume that multiple requests of this type made within a 30-day period have been made in order to avoid fees. Where requests are separated by a longer period, components will aggregate them only where there exists a solid basis for determining that aggregation is warranted under all the circumstances involved. Multiple requests involving unrelated matters will not be aggregated.

(i) Advance payments. (1) For requests other than those described in paragraphs (i)(2) and (3) of this section, a component shall not require the requester to make a advance payment before work is begun or continued on a request. Payment owed for work already completed (such as a prepayment before copies are sent to a requester) is not an advance payment.

(2) Where a component determines or estimates that a total fee to be charged under this section will be more than $250.00, it may require the requester to make an advance payment of an amount up to the amount of the entire anticipated fee before beginning to process the request, except where it receives a satisfactory assurance of full payment from a requester that has a history of prompt payment.

(3) Where a requester has previously failed to pay a properly charged FOIA fee to any component or agency within 30 days of the date of billing, a component may require the requester to pay the full amount due, plus any applicable interest, and to make an advance payment of the full amount of any anticipated fee, before the component begins to process a new request or continues to process a pending request from that requester.

(4) In cases in which a component requires advance payment, the request shall not be considered received and further work will not be done on it until the required payment is received.

(j) Other statutes specifically providing for fees. The fee schedule of this section does not apply to fees charged under any statute that specifically requires an agency to set and collect fees for particular types of records. Where records responsive to requests are maintained for distribution by agencies operating such statutorily based fee schedule programs, components will inform requesters of the steps for obtaining records from those sources so that they may do so most economically.

(k) Requirements for waiver or reduction of fees. (1) Records responsive to a request will be furnished without charge or at a charge reduced below that established under paragraph (c) of this section where a component determines, based on all available information, that the requester has demonstrated that:

(i) Disclosure of the requested information is in the public interest because it is likely to contribute significantly to public understanding of the operations or activities of the government; and

(ii) Disclosure of the information is not primarily in the commercial interest of the requester.

(2) To determine whether the first fee waiver requirement is met, components will consider the following factors:

(i) The subject of the request: Whether the subject of the requested records concerns “the operations or activities of the government.” The subject of the requested records must concern identifiable operations or activities of the federal government, with a connection that is direct and clear, not remote or attenuated.

(ii) The informative value of the information to be disclosed: Whether the disclosure is “likely to contribute” to an understanding of government operations or activities. The disclosable portions of the requested records must be meaningfully informative about government operations or activities in order to be “likely to contribute” to an increased public understanding of those operations or activities. The disclosure of information that already is in the public domain, in either a duplicative or a substantially identical form, would not be as likely to contribute to such understanding where nothing new would be added to the public's understanding.

(iii) The contribution to an understanding of the subject by the public likely to result from disclosure: Whether disclosure of the requested information will contribute to “public understanding.” The disclosure must contribute to the understanding of a reasonably broad audience of persons interested in the subject, as opposed to the individual understanding of the requester. A requester's expertise in the subject area and ability and intention to effectively convey information to the public shall be considered. It shall be presumed that a representative of the news media will satisfy this consideration.

(iv) The significance of the contribution to public understanding: Whether the disclosure is likely to contribute “significantly” to public understanding of government operations or activities. The public's understanding of the subject in question, as compared to the level of public understanding existing prior to the disclosure, must be enhanced by the disclosure to a significant extent. Components shall not make value judgments about whether information that would contribute significantly to public understanding of the operations or activities of the government is “important” enough to be made public.

(3) To determine whether the second fee waiver requirement is met, components will consider the following factors:

(i) The existence and magnitude of a commercial interest: Whether the requester has a commercial interest that would be furthered by the requested disclosure. Components shall consider any commercial interest of the requester (with reference to the definition of “commercial use” in paragraph (b)(1) of this section), or of any person on whose behalf the requester may be acting, that would be furthered by the requested disclosure. Requesters shall be given an opportunity in the administrative process to provide explanatory information regarding this consideration.

(ii) The primary interest in disclosure: Whether any identified commercial interest of the requester is sufficiently large, in comparison with the public interest in disclosure, that disclosure is “primarily in the commercial interest of the requester.” A fee waiver or reduction is justified where the public interest standard is satisfied and that public interest is greater in magnitude than that of any identified commercial interest in disclosure. Components ordinarily shall presume that where a news media requester has satisfied the public interest standard, the public interest will be the interest primarily served by disclosure to that requester. Disclosure to data brokers or others who merely compile and market government information for direct economic return shall not be presumed to primarily serve the public interest.

(4) Where only some of the records to be released satisfy the requirements for a waiver of fees, a waiver shall be granted for those records.

(5) Requests for the waiver or reduction of fees should address the factors listed in paragraphs (k)(2) and (3) of this section, insofar as they apply to each request. Components will exercise their discretion to consider the cost-effectiveness of their investment of administrative resources in this decisionmaking process, however, in deciding to grant waivers or reductions of fees.

(l) Payment of outstanding fees. The Department shall not process a FOIA request from persons with an unpaid fee from any previous FOIA request to any Federal agency until that outstanding fee has been paid in full to the agency.

§ 5.12

Other rights and services.

Nothing in this subpart shall be construed to entitle any person, as of right, to any service or to the disclosure of any record to which such person is not entitled under the FOIA.

Subpart B—Privacy Act

§ 5.20

General provisions.

(a) Purpose and scope. (1) This subpart contains the rules that the Department of Homeland Security (Department) follows under the Privacy Act of 1974 (5 U.S.C. 552a). These rules should be read together with the Privacy Act, which provides additional information about records maintained on individuals. The rules in this subpart apply to all records in systems of records maintained by the Department that are retrieved by an individual's name or personal identifier. They describe the procedures by which individuals may request access to records about themselves, request amendment or correction of those records, and request an accounting of disclosures of those by the Department. In addition, the Department processes all Privacy Act requests for access to records under the Freedom of Information Act (FOIA) ( 5 U.S.C. 552), following the rules contained in subpart A of this part, which gives requests the benefit of both statutes.

(2) The provisions established by this subpart shall apply to all Department components that are transferred to the Department. Except to the extent a Department component has adopted separate guidance under the Privacy Act, the provisions of this subpart shall apply to each component of the Department. Departmental components may issue their own guidance under this subpart pursuant to approval by the Department.

(b) Definitions. As used in this subpart:

(1) Component means each separate bureau, office, board, division, commission, service, or administration of the Department.

(2) Request for access to a record means a request made under Privacy Act subsection (d)(1).

(3) Request for amendment or correction of a record means a request made under Privacy Act subsection (d)(2).

(4) Request for an accounting means a request made under Privacy Act subsection (c)(3).

(5) Requester means an individual who makes a request for access, a request for amendment or correction, or a request for an accounting under the Privacy Act.

(c) Authority to request records for a law enforcement purpose. The head of a component or designee thereof is authorized to make written requests under subsection (b)(7) of the Privacy Act for records maintained by other agencies that are necessary to carry out an authorized law enforcement activity.

(d) Notice on Departmental use of (b)(1) exemption. As a general matter, when applying the (b)(1) exemption for disclosures within an agency on a need to know basis, the Department will consider itself a single entity, meaning that information may be disclosed between components of the Department under the (b)(1) exemption.

(e) Interim Retention of Authorities. As an interim solution, all agencies and components under the Department will retain the necessary authority from their original purpose in order to conduct these necessary activities. This includes the authority to maintain Privacy Act systems of records, disseminate information pursuant to existing or new routine uses, and retention of exemption authorities under sections (j) and (k) of the Privacy Act, where applicable. This retention of an agency or component's authorities and information practices will remain in effect until this regulation is promulgated as a final rule, or the Department revises all systems of records notices. This retention of authority is necessary to allow components to fulfill their mission and purpose during the transition period of the establishment of the Department. During this transition period, the Department shall evaluate with the components the existing authorities and information practices and determine what revisions (if any) are appropriate and should be made to these existing authorities and practices. The Department anticipates that such revisions will be made either through the issuance of a revised system of records notices or through subsequent final regulations.

§ 5.21

Requests for access to records.

(a) How made and addressed. You may make a request for access to a Department of Homeland Security record about yourself by appearing in person or by writing directly to the Department component that maintains the record. Your request should be sent or delivered to the component's Privacy Act office at the address listed in appendix A to this part. In most cases, a component's central Privacy Act office is the place to send a Privacy Act request. For records held by a field office of the U.S. Customs Service, U.S. Secret Service, U.S. Coast Guard, or any other Department component with field offices, however, you must write directly to that Customs, Secret Service, Coast Guard, or other field office address, which can be found in most telephone books or by calling the component's central Privacy Act office. (The functions of each component are summarized elsewhere in this title and in the description of the Department and its components in the “United States Government Manual,” which is issued annually and is available in most libraries, as well as for sale from the Government Printing Office's Superintendent of Documents. This manual also can be accessed electronically at the Government Printing Office's World Wide Web site (which can be found at http://www.access.gpo.gov/​su_​docs). Some records are maintained under a government-wide systems of records notice, for example, Official Personnel Files are maintained under the authority of the Office of Personnel Management. In order to access records maintained under a government-wide notice, please send your request to the Privacy Act office of the original department or agency from which the component was transferred to the Department. If you cannot determine where within the Department to send your request, you may send it to the Departmental Disclosure Officer, Department of Homeland Security, Washington, DC 20528, and that office will forward it to the component(s) it believes most likely to have the records that you seek. For the quickest possible handling, you should mark both your request letter and the envelope “Privacy Act Request.”

(b) Description of records sought. You must describe the records that you want in enough detail to enable Department personnel to locate the system of records containing them with a reasonable amount of effort. Whenever possible, your request should describe the records sought, the time periods in which you believe they were compiled, and the name or identifying number of each system of records in which you believe they are kept. The Department publishes notices in the Federal Register that describe its components' systems of records. A description of the Department's systems of records also may be found as part of the “Privacy Act Compilation” published by the National Archives and Records Administration's Office of the Federal Register. This compilation is available in most large reference and university libraries. This compilation also can be accessed electronically at the Government Printing Office's World Wide Web site (which can be found at http://www.access.gpo.gov/​su_​docs).

(c) Agreement to pay fees. If you make a Privacy Act request for access to records, it shall be considered an agreement by you to pay all applicable fees charged under § 5.29, up to $25.00. The component responsible for responding to your request ordinarily shall confirm this agreement in an acknowledgement letter. When making a request, you may specify a willingness to pay a greater or lesser amount.

(d) Verification of identity. When you make a request for access to records about yourself, you must verify your identity. You must state your full name, current address, and date and place of birth. You must sign your request and your signature must either be notarized or submitted by you under 28 U.S.C. 1746, a law that permits statements to be made under penalty of perjury as a substitute for notarization. While no specific form is required, you may obtain forms for this purpose from the Departmental Disclosure Officer, Department of Homeland Security, Washington, DC 20528. In order to help the identification and location of requested records, you may also, at your option, include your social security number.

(e) Verification of guardianship. When making a request as the parent or guardian of a minor or as the guardian of someone determined by a court to be incompetent, for access to records about that individual, you must establish:

(1) The identity of the individual who is the subject of the record, by stating the name, current address, date and place of birth, and, at your option, the social security number of the individual;

(2) Your own identity, as required in paragraph (d) of this section;

(3) That you are the parent or guardian of that individual, which you may prove by providing a copy of the individual's birth certificate showing your parentage or by providing a court order establishing your guardianship; and

(4) That you are acting on behalf of that individual in making the request.

(f) Verification in the case of third party information requests. If you are making a request for records concerning an individual on behalf of that individual, you must provide a statement from the individual verifying the identity of the individual as provided in paragraph (d) of this section. You must also provide a statement from the individual certifying the individual's agreement that records concerning the individual may be released to you.

§ 5.22

Responsibility for responding to requests for access to records.

(a) In general. Except as stated in paragraphs (c), (d), and (e) of this section, the component that first receives a request for access to a record, and has possession of that record, is the component responsible for responding to the request. In determining which records are responsive to a request, a component ordinarily shall include only those records in its possession as of the date the component begins its search for them. If any other date is used, the component shall inform the requester of that date.

(b) Authority to grant or deny requests. The head of a component, or the component head's designee, is authorized to grant or deny any request for access or amendment to a record of that component.

(c) Consultations and referrals. When a component receives a request for access to a record in its possession, it shall determine whether another component, or another agency of the Federal Government, is better able to determine whether the record is exempt from access under the Privacy Act. If the receiving component determines that it is best able to process the record in response to the request, then it shall do so. If the receiving component determines that it is not best able to process the record, then it shall either:

(1) Respond to the request regarding that record, after consulting with the component or agency best able to determine whether the record is exempt from access and with any other component or agency that has a substantial interest in it; or

(2) Refer the responsibility for responding to the request regarding that record to the component best able to determine whether it is exempt from access, or to another agency that originated the record (but only if that agency is subject to the Privacy Act). Ordinarily, the component or agency that originated a record will be presumed to be best able to determine whether it is exempt from access.

(d) Law enforcement information. Whenever a request is made for access to a record containing information that relates to an investigation of a possible violation of law and that was originated by another component or agency, the receiving component shall either refer the responsibility for responding to the request regarding that information to that other component or agency or shall consult with that other component or agency.

(e) Classified information. Whenever a request is made for access to a record containing information that has been classified by or may be appropriate for classification by another component or agency under Executive Order 12958 or any other executive order concerning the classification of records, the receiving component shall refer the responsibility for responding to the request regarding that information to the component or agency that classified the information, should consider the information for classification, or has the primary interest in it, as appropriate. Whenever a record contains information that has been derivatively classified by a component because it contains information classified by another component or agency, the component shall refer the responsibility for responding to the request regarding that information to the component or agency that classified the underlying information.

(f) Release of Medical Records. Pursuant to 5 U.S.C. 552a(f)(3), where requests are made for access to medical records, including psychological records, the decision to release directly to the individual, or to withhold direct release, shall be made by a medical practitioner. Where the medical practitioner has ruled that direct release will cause harm to the individual who is requesting access, normal release through the individual's chosen medical practitioner will be recommended. Final review and decision on appeals of disapprovals of direct release will rest with the General Counsel.

(g) Notice of referral. Whenever a component refers all or any part of the responsibility for responding to a request to another component or agency, it ordinarily shall notify the requester of the referral and inform the requester of the name of each component or agency to which the request has been referred and of the part of the request that has been referred.

(h) Timing of responses to consultations and referrals. All consultations and referrals shall be handled according to the date the Privacy Act access request was initially received by the first component or agency, not any later date.

(i) Agreements regarding consultations and referrals. Components may make agreements with other components or agencies to eliminate the need for consultations or referrals for particular types of records.

§ 5.23

Responses to requests for access to records.

(a) Acknowledgements of requests. On receipt of a request, a component ordinarily shall send an acknowledgement letter to the requester which shall confirm the requester's agreement to pay fees under § 5.21(c) and provide an assigned request number for further reference.

(b) Grants of requests for access. Once a component makes a determination to grant a request for access in whole or in part, it shall notify the requester in writing. The component shall inform the requester in the notice of any fee charged under § 5.29 and shall disclose records to the requester promptly on payment of any applicable fee. If a request is made in person, the component may disclose records to the requester directly, in a manner not unreasonably disruptive of its operations, on payment of any applicable fee and with a written record made of the grant of the request. If a requester is accompanied by another person, the requester shall be required to authorize in writing any discussion of the records in the presence of the other person.

(c) Adverse determinations of requests for access. A component making an adverse determination denying a request for access in any respect shall notify the requester of that determination in writing. Adverse determinations, or denials of requests, consist of: a determination to withhold any requested record in whole or in part; a determination that a requested record does not exist or cannot be located; a determination that what has been requested is not a record subject to the Privacy Act; a determination on any disputed fee matter; and a denial of a request for expedited treatment. The notification letter shall be signed by the head of the component, or the component head's designee, and shall include:

(1) The name and title or position of the person responsible for the denial;

(2) A brief statement of the reason(s) for the denial, including any Privacy Act exemption(s) applied by the component in denying the request; and

(3) A statement that the denial may be appealed under § 5.25(a) and a description of the requirements of § 5.25(a).

§ 5.24

Classified information.

In processing a request for access to a record containing information that is classified under Executive Order 12958 or any other executive order, the originating component shall review the information to determine whether it should remain classified. Information determined to no longer require classification shall not be withheld from a requester on the basis of Exemption (k)(1) of the Privacy Act. On receipt of any appeal involving classified information, the Associate General Counsel (General Law), shall take appropriate action to ensure compliance with Part 7 of this title.

§ 5.25

Appeals.

(a) Appeals. If you are dissatisfied with a component's response to your request for access to records, you may appeal an adverse determination denying your request in any respect to the Associate General Counsel (General Law), Department of Homeland Security, Washington, DC 20528. You must make your appeal in writing and it must be received by the Associate General Counsel (General Law) within 60 days of the date of the letter denying your request. Your appeal letter may include as much or as little related information as you wish, as long as it clearly identifies the component determination (including the assigned request number, if known) that you are appealing. For the quickest possible handling, you should mark both your appeal letter and the envelope “Privacy Act Appeal.”

(b) Responses to appeals. The decision on your appeal will be made in writing. A decision affirming an adverse determination in whole or in part will include a brief statement of the reason(s) for the affirmance, including any Privacy Act exemption applied, and will inform you of the Privacy Act provisions for court review of the decision. If the adverse determination is reversed or modified on appeal in whole or in part, you will be notified in a written decision and your request will be reprocessed in accordance with that appeal decision. An adverse determination by the Associate General Counsel (General Law) will be the final action of the Department.

(c) When appeal is required. If you wish to seek review by a court of any adverse determination or denial of a request, you must first appeal it under this section. An appeal will not be acted on if the request becomes a matter of litigation.

§ 5.26

Requests for amendment or correction of records.

(a) How made and addressed. Unless the record is not subject to amendment or correction as stated in paragraph (f) of this section, you may make a request for amendment or correction of a record of the Department about you by writing directly to the Department component that maintains the record, following the procedures in § 5.21. Your request should identify each particular record in question, state the amendment or correction that you want, and state why you believe that the record is not accurate, relevant, timely, or complete. You may submit any documentation that you think would be helpful. If you believe that the same record is in more than one system of records, you should state that and address your request to each component that maintains a system of records containing the record.

(b) Component responses. Within ten working days of receiving your request for amendment or correction of records, a component shall send you a written acknowledgment of its receipt of your request, and it shall promptly notify you whether your request is granted or denied. If the component grants your request in whole or in part, it shall describe the amendment or correction made and shall advise you of your right to obtain a copy of the corrected or amended record, in disclosable form. If the component denies your request in whole or in part, it shall send you a letter signed by the head of the component, or the component head's designee, that shall state:

(1) The reason(s) for the denial; and

(2) The procedure for appeal of the denial under paragraph (c) of this section, including the name and business address of the official who will act on your appeal.

(c) Appeals. You may appeal a denial of a request for amendment or correction to the Associate General Counsel (General Law) in the same manner as a denial of a request for access to records (see § 5.25) and the same procedures shall be followed. If your appeal is denied, you shall be advised of your right to file a Statement of Disagreement as described in paragraph (d) of this section and of your right under the Privacy Act for court review of the decision.

(d) Statements of Disagreement. If your appeal under this section is denied in whole or in part, you have the right to file a Statement of Disagreement that states your reason(s) for disagreeing with the Department's denial of your request for amendment or correction. Statements of Disagreement must be concise, must clearly identify each part of any record that is disputed, and should be no longer than one typed page for each fact disputed. Your Statement of Disagreement must be sent to the component involved, which shall place it in the system of records in which the disputed record is maintained and shall mark the disputed record to indicate that a Statement of Disagreement has been filed and where in the system of records it may be found.

(e) Notification of amendment/correction or disagreement. Within 30 working days of the amendment or correction of a record, the component that maintains the record shall notify all persons, organizations, or agencies to which it previously disclosed the record, if an accounting of that disclosure was made, that the record has been amended or corrected. If an individual has filed a Statement of Disagreement, the component shall append a copy of it to the disputed record whenever the record is disclosed and may also append a concise statement of its reason(s) for denying the request to amend or correct the record.

(f) Records not subject to amendment or correction. The following records are not subject to amendment or correction:

(1) Transcripts of testimony given under oath or written statements made under oath;

(2) Transcripts of grand jury proceedings, judicial proceedings, or quasi-judicial proceedings, which are the official record of those proceedings;

(3) Presentence records that originated with the courts; and

(4) Records in systems of records that have been exempted from amendment and correction under Privacy Act (5 U.S.C. 552a(j) or (k)) by notice published in the Federal Register.

§ 5.27

Requests for an accounting of record disclosures.

(a) How made and addressed. Except where accountings of disclosures are not required to be kept (as stated in paragraph (b) of this section), you may make a request for an accounting of any disclosure that has been made by the Department to another person, organization, or agency of any record about you. This accounting contains the date, nature, and purpose of each disclosure, as well as the name and address of the person, organization, or agency to which the disclosure was made. Your request for an accounting should identify each particular record in question and should be made by writing directly to the Department component that maintains the record, following the procedures in § 5.21.

(b) Where accountings are not required. Components are not required to provide accountings to you where they relate to:

(1) Disclosures for which accountings are not required to be kept, such as disclosures that are made to employees within the agency and disclosures that are made under the FOIA;

(2) Disclosures made to law enforcement agencies for authorized law enforcement activities in response to written requests from those law enforcement agencies specifying the law enforcement activities for which the disclosures are sought; or

(3) Disclosures made from law enforcement systems of records that have been exempted from accounting requirements.

(c) Appeals. You may appeal a denial of a request for an accounting to the Associate General Counsel (General Law) in the same manner as a denial of a request for access to records (see § 5.25) and the same procedures will be followed.

§ 5.28

Preservation of records.

Each component will preserve all correspondence pertaining to the requests that it receives under this subpart, as well as copies of all requested records, until disposition or destruction is authorized by title 44 of the United States Code or the National Archives and Records Administration's General Records Schedule 14. Records will not be disposed of while they are the subject of a pending request, appeal, or lawsuit under the Act.

§ 5.29

Fees.

(a) Components shall charge fees for duplication of records under the Privacy Act in the same way in which they charge duplication fees under § 5.11.

(b) The Department shall not process a request under the Privacy Act from persons with an unpaid fee from any previous Privacy Act request to any Federal agency until that outstanding fee has been paid in full to the agency.

§ 5.30

Notice of court-ordered and emergency disclosures.

(a) Court-ordered disclosures. When a record pertaining to an individual is required to be disclosed by a court order, the component shall make reasonable efforts to provide notice of this to the individual. Notice shall be given within a reasonable time after the component's receipt of the order, except that in a case in which the order is not a matter of public record, the notice shall be given only after the order becomes public. This notice shall be mailed to the individual's last known address and shall contain a copy of the order and a description of the information disclosed. Notice shall not be given if disclosure is made from a criminal law enforcement system of records that has been exempted from the notice requirement.

(b) Emergency disclosures. Upon disclosing a record pertaining to an individual made under compelling circumstances affecting health or safety, the component shall notify that individual of the disclosure. This notice shall be mailed to the individual's last known address and shall state the nature of the information disclosed; the person, organization, or agency to which it was disclosed; the date of disclosure; and the compelling circumstances justifying the disclosure.

§ 5.31

Security of systems of records.

(a) In general. Each component shall establish administrative and physical controls to prevent unauthorized access to its systems of records, to prevent unauthorized disclosure of records, and to prevent physical damage to or destruction of records. The stringency of these controls shall correspond to the sensitivity of the records that the controls protect. At a minimum, each component's administrative and physical controls shall ensure that:

(1) Records are protected from public view;

(2) The area in which records are kept is supervised during business hours to prevent unauthorized persons from having access to them;

(3) Records are inaccessible to unauthorized persons outside of business hours; and

(4) Records are not disclosed to unauthorized persons or under unauthorized circumstances in either oral or written form.

(b) Procedures required. Each component shall have procedures that restrict access to records to only those individuals within the Department who must have access to those records in order to perform their duties and that prevent inadvertent disclosure of records.

§ 5.32

Contracts for the operation of record systems.

Under 5 U.S.C. 552a(m), any approved contract for the operation of a record system will contain the standard contract requirements issued by the General Services Administration to ensure compliance with the requirements of the Privacy Act for that record system. The contracting component will be responsible for ensuring that the contractor complies with these contract requirements.

§ 5.33

Use and collection of social security numbers.

Each component shall ensure that employees authorized to collect information are aware:

(a) That individuals may not be denied any right, benefit, or privilege as a result of refusing to provide their social security numbers, unless the collection is authorized either by a statute or by a regulation issued prior to 1975; and

(b) That individuals requested to provide their social security numbers must be informed of:

(1) Whether providing social security numbers is mandatory or voluntary;

(2) Any statutory or regulatory authority that authorizes the collection of social security numbers; and

(3) The uses that will be made of the numbers.

§ 5.34

Standards of conduct for administration of the Privacy Act.

Each component will inform its employees of the provisions of the Privacy Act, including the Act's civil liability and criminal penalty provisions. Unless otherwise permitted by law, the Department shall:

(a) Collect from individuals only the information that is relevant and necessary to discharge the responsibilities of the Department;

(b) Collect information about an individual directly from that individual whenever practicable and when the information may result in adverse determinations about an individual's rights, benefits, and privileges under federal programs;

(c) Inform each individual from whom information is collected of:

(1) The legal authority to collect the information and whether providing it is mandatory or voluntary;

(2) The principal purpose for which the Department intends to use the information;

(3) The routine uses the Department may make of the information; and

(4) The effects on the individual, if any, of not providing the information;

(d) Ensure that the component maintains no system of records without public notice and that it notifies appropriate Department officials of the existence or development of any system of records that is not the subject of a current or planned public notice;

(e) Maintain all records that are used by the Department in making any determination about an individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to ensure fairness to the individual in the determination;

(f) Except as to disclosures made to an agency or made under the FOIA, make reasonable efforts, prior to disseminating any record about an individual, to ensure that the record is accurate, relevant, timely, and complete;

(g) Maintain no record describing how an individual exercises his or her First Amendment rights, unless it is expressly authorized by statute or by the individual about whom the record is maintained, or is pertinent to and within the scope of an authorized law enforcement activity;

(h) When required by the Privacy Act, maintain an accounting in the specified form of all disclosures of records by the Department to persons, organizations, or agencies;

(i) Maintain and use records with care to prevent the unauthorized or inadvertent disclosure of a record to anyone.

§ 5.35

Sanctions and penalties.

Under the provisions of the Privacy Act, 5 U.S.C. 552a, civil and criminal penalties may be assessed.

§ 5.36

Other rights and services.

Nothing in this subpart shall be construed to entitle any person, as of right, to any service or to the disclosure of any record to which such person is not entitled under the Privacy Act.

Appendix A to Part 5—FOIA /Privacy Act Offices of the Department of Homeland Security

I. For the following Headquarters components of the Department of Homeland Security, FOIA and Privacy Act requests should be sent to the Departmental Disclosure Office, Department of Homeland Security, Washington, DC 20528. The Headquarters components are:

A

Office of the Secretary

Office of the Deputy Secretary

Office of the Under Secretary for Management

B

Office of the General Counsel

Office of the Inspector General

Office of International Affairs

Office of Legislative Affairs

Office of Public Affairs

Office of National Capital Region Coordination

Office of Professional Responsibility

Office for State and Local Government Coordination

C

Directorate of Border and Transportation Security

Directorate of Emergency Preparedness and Response

Directorate of Information Analysis and Infrastructure Protection

Directorate of Science and Technology

II. Requests made to components that have transferred or will transfer into the Department of Homeland Security, should be sent as follows:

A. Former components of the Department of Agriculture:

1. Animal and Plant Health Inspection Service, USDA, APHIS, LPA, FOIA, 4700 River Road, Unit 50, Riverdale, MD 20737-1232

2. Plum Island Animal Disease Center; Submit request to the APHIS address above or, FOIA Coordinator, USDA-REE-ARS-Information Staff, 5601 Sunnyside Avenue, Bldg. 1, Room 2248, Mail Stop 5128, Beltsville, MD 20705-5128

B. Former components of the Department of Commerce:

1. Critical Infrastructure Assurance Office (A former office of the Bureau of Industry and Security); Freedom of Information Coordinator, Bureau of Industry and Security, Room 6883, U.S. Department of Commerce, Washington, DC 20230

2. FIRESTAT (formerly the Integrated Hazard Information System of the National Oceanic and Atmospheric Administration), National Oceanic and Atmospheric Administration, Public Reference Facility (OFAx2), 1315 East-West Highway (SSMC3), Room 10703, Silver Spring, MD 20910

C. Former components of the Department of Defense:

1. National Communications Service (A former component of the Defense Information Systems Agency), Defense Information Systems Agency, ATTN: RGC/FOIA Officer, 701 S. Courthouse Rd., Arlington, VA 22204-2199

D. Former components and programs of the Department of Energy:

The address for each component and program listed below is: U.S. Department of Energy, 1000 Independence Avenue, SW., Washington, DC 20585

1. Energy Assurance Office

2. Environmental Measurements Laboratory

3. Nuclear Incident Response Team

4. The chemical and biological national security and supporting programs and activities of the non-proliferation and verification research and development program.

5. The life sciences activities related to microbial pathogens of Biological and Environmental Research Program.

6. The nuclear smuggling programs and activities within the proliferation detection program of the non-proliferation and verification research and development program.

7. The nuclear assessment program and activities of the assessment, detection, and cooperation program of the international materials protection and cooperation program, and the advanced scientific computing research program and activities at Lawrence Livermore National Laboratory.

8. National Infrastructure Simulation and Analysis Center

E. Former components of the Department of Health and Human Services:

1. The address for each component and program listed below is: Department of Health and Human Services, Freedom of Information Officer, Room 645-F, Hubert H. Humphrey Building, Independence Avenue, SW., Washington, DC 20201;

a. Metropolitan Medical Response System,

b. National Disaster Medical System, and

c. Office of Emergency Preparedness

d. Strategic National Stockpile

2. Centers for Disease Control and Agency for Toxic Substances and Disease Registry, Attn: FOI Office, MS-D54, 1600 Clifton Road, NE., Atlanta, GA 30333.

F. Former components of the Department of Justice:

1. Immigration and Naturalization Service, Director, Freedom of Information/Privacy Act Program, Department of Justice, 425 Eye Street, NW., 2nd Floor, ULLICO Building, Washington, DC 20536 (for field offices, consult your phone book).

2. The address for each component and program listed below is: Federal Bureau of Investigation, Chief, FOIPA Section, 935 Pennsylvania Avenue, NW., Department of Justice, Washington, DC 20535-0001;

a. National Infrastructure Protection Center,

b. National Domestic Preparedness Office, and

c. Domestic Emergency Support Team.

3. Office of Domestic Preparedness, U.S. Department of Justice, Office of Justice Programs, Office of the General Counsel, Attention: FOIA Staff, 810 7th Street, NW., Room 5400, Washington, DC 20531.

G. Former components of the Department of State:

Visa Office, Information and Privacy Coordinator, Office of Information Resources, Management Programs and Services, A/RPS/IPS, SA-2, Department of State, Washington, DC 20522-6001, Re: Freedom of Information Act Request.

H. Former components of the Department of Transportation:

1. Federal Aviation Administration, National Freedom of Information Act Staff, ARC-40, 800 Independence Avenue, SW., Washington, DC 20591 (for regional centers, consult your phone book).

2. Transportation Security Administration, TSA-1, FOIA Division, 400 Seventh Street, SW., Washington, DC 20590

3. United States Coast Guard, HQ USCG Commandant, G-CIM, 2100 Second Street, SW., Washington, DC 20593-0001 (for district offices, consult your phone book).

I. Former components of the Department of Treasury:

1. Federal Law Enforcement Training Center, Freedom of Information Act Officer, Townhouse 389, Glynco, GA 31524

2. U.S. Customs Service, Freedom of Information Act Request, Mint Annex, 1300 Pennsylvania Avenue, NW., Washington, DC 20229 (for field offices, consult your phone book).

3. U.S. Secret Service, Freedom of Information Act Request, 950 H Street, NW., Suite 3000, Washington, DC 20223, e-mail [e-mail]. Appeals should be addressed to the Deputy Director, United States Secret Service, Freedom of Information and Privacy Act Appeal Officer, at these same contact points.

J. Federal Emergency Management Agency: Federal Emergency Management Agency, Office of General Counsel, 500 C Street, SW., Room 840, Washington, DC 20472 (for regional offices, consult your phone book).

K. Former components of the General Services Administration:

1. For the Federal Computer Incident Response Center and the Federal Protective Service: Chief, FOIA Information Management Branch, GSA (CAIM), 1800 F Street, NW., Washington, DC 20405 (for regional offices, consult your phone book).

Appendix B to Part 5—Public Reading Rooms of the Department of Homeland Security

The Headquarters components of the Department of Homeland Security do not maintain a conventional public reading room. Records that are required to be in the public reading room are available electronically at http://www.dhs.gov/​FOIA.

Entities that will transfer into the Department of Homeland Security maintain public reading rooms as follows:

1. Former components of the Department of Agriculture:

Animal and Plant Health Inspection Service Library, 4700 River Road, Riverdale, MD 20737-1232

Plum Island Animal Disease Center, the APHIS address above or, USDA-ARS, 5601 Sunnyside Avenue, Building 1, Room 2248, Beltsville, MD 20705-5128

2. Former components of the Department of Commerce:

The Critical Infrastructure Assurance Office (A former office of the Bureau of Industry and Security) does not maintain a conventional public reading room. Records that are required to be in the public reading room are available electronically at http://www.bis.doc.gov/​FOIA/​Default.htm

FIRESTAT (formerly the Integrated Hazard Information System of the National Oceanic and Atmospheric Administration), NOAA Public Reference Facility, 1305 East-West Highway (SSMC4), Room 8627, Silver Spring, MD 20910

3. Former components of the Department of Defense:

The National Communication Service (A former component of the Defense Information Systems Agency) does not maintain a conventional public reading room. Records that are required to be in the public reading room are available electronically at http://disa.mil/​gc/​foia/​foia.html

4. Former components and programs of the Department of Energy:

The address for each component and program listed below is: U.S. Department of Energy; 1000 Independence Avenue, SW., Washington, DC 20585

Energy Assurance Office

Environmental Measurements Laboratory

Nuclear Incident Response Team

The chemical and biological national security and supporting programs and activities of the non-proliferation and verification research and development program.

The life sciences activities related to microbial pathogens of Biological and Environmental Research Program.

The nuclear smuggling programs and activities within the proliferation detection program of the non-proliferation and verification research and development program.

The nuclear assessment program and activities of the assessment, detection, and cooperation program of the international materials protection and cooperation program, and the advanced scientific computing research program and activities at Lawrence Livermore National Laboratory.

The National Infrastructure Simulation and Analysis Center

5. Former components of the Department of Health and Human Services:

For the Metropolitan Medical Response System, the National Disaster Medical System, and the Office of Emergency Preparedness please contact the Freedom of Information Act Officer at: Department of Health and Human Services, Freedom of Information Officer, Room 645-F, Hubert H. Humphrey Building, Independence Avenue, SW., Washington, DC 20201

Strategic National Stockpile, Centers for Disease Control and Agency for Toxic Substances and Disease Registry, 1600 Clifton Road, NE., Room 4103, Building 1, Atlanta, GA 30333

6. Former components of the Department of Justice:

Immigration and Naturalization Service, 111 Massachusetts Avenue, NW., 2nd Floor, ULLICO Building, Washington, DC 20536

For the National Infrastructure Protection Center, the National Domestic Preparedness Office, and the Domestic Emergency Support Team: Federal Bureau of Investigation, 935 Pennsylvania Avenue, NW., Department of Justice, Washington, DC 20535-0001

Office of Domestic Preparedness, U.S. Department of Justice, Office of Justice Programs, 810 7th Street, NW., Room 5430, Washington, DC 20531

7. Former components of the Department of State:

Visa Office, Department of State, 2201 C Street, NW., Washington, DC 20520

8. Former components of the Department of Transportation:

Federal Aviation Administration, 800 Independence Avenue, SW., Washington, DC 20591

Transportation Security Administration, 400 Seventh Street, SW., Washington, DC 20590

United States Coast Guard Headquarters, 2100 Second Street, SW., Washington, DC 20593-0001 (for district offices, consult your phone book).

9. Former components of the Department of Treasury:

The Federal Law Enforcement Training Center does not maintain a conventional public reading room. Records that are required to be in the public reading room are available electronically at http://www.fletc.gov/​irm/​foia/​readingroom.htm

U.S. Customs Service, 1300 Pennsylvania Avenue, NW., Washington, DC 20229 (for a list of field office public reading rooms please consult 19 CFR 103.1).

U.S. Secret Service, Main Treasury, 1500 Pennsylvania Avenue, NW., Washington, DC 20220

10. Federal Emergency Management Agency:

Federal Emergency Management Agency, Federal Center Plaza, 500 C Street, SW., Room 840 Washington, DC 20472 (for regional offices, consult your phone book)

11. Former components of the General Services Administration:

For the Federal Computer Incident Response Center and the Federal Protective Service: Central Office, GSA Headquarters, 1800 F Street, NW., (CAI), Washington, DC 20405 (for regional offices, consult your phone book)