01-31340. Privacy Act; Implementation

AGENCY:

National Archives and Records Administration (NARA).

ACTION:

Final rule.

SUMMARY:

NARA is rewriting our Privacy Act regulations to update the procedures for making a Privacy Act request, and to reflect the President's memorandum of June 1, 1998, Plain Language in Government Writing. This rule will affect individuals and entities seeking access or disclosure of information contained in NARA Privacy Act systems of records and subject individuals covered by a NARA Privacy Act system.

EFFECTIVE DATE:

January 22, 2002.

FOR FURTHER INFORMATION CONTACT:

Nancy Allard at telephone number 301-713-7360, ext. 226, or fax number 301-713-7270.

SUPPLEMENTARY INFORMATION:

NARA published a notice of proposed rulemaking in the June 5, 2001 Federal Register (66 FR 30134) for a 60-day comment period. No comments were received. However, we have determined that one of the Privacy Act systems cited in §§ 1202.92 and 1202.94, General Law Files, should not be exempt under 5 U.S.C. 552a(k)(2) and (k)(5) of the Privacy Act. We have therefore removed references to this system of records. In addition, minor editorial corrections to legal citations have been made.

This final rule is not a significant regulatory action for the purposes of Executive Order 12866 and has not been reviewed by the Office of Management and Budget. As required by the Regulatory Flexibility Act, I certify that this rule will not have a significant impact on a substantial number of small entities because it only affects individuals and entities seeking access or disclosure of information contained in NARA Privacy Act systems of records. This rule does not have any federalism implications. This rule is not a major rule.

List of Subjects in 36 CFR Part 1202

• Privacy

For the reason set forth in the preamble, part 1202 of title 36, Code of Federal Regulations, is revised to read as follows:

PART 1202—REGULATIONS IMPLEMENTING THE PRIVACY ACT OF 1974

Subpart A—General Information About the Privacy Act

1202.1

What does this part cover?

1202.2

What this part does not cover.

1202.4

Definitions.

1202.6

Whom should I contact for Privacy Act matters at NARA?

1202.8

How does NARA handle records that are in Government-wide Privacy Act systems?

1202.10

Does NARA handle access to and disclosure of records of defunct agencies in the custody of NARA?

Subpart B—Collecting Information

1202.18

How does NARA collect information about individuals?

1202.20

What advisory information does NARA provide before collecting information from me?

1202.22

Will NARA need my Social Security Number?

1202.24

Will NARA ever request information about me from someone else?

1202.26

Who will make sure that my record is accurate?

1202.28

What rules do NARA employees follow in managing personal information?

1202.30

How does NARA safeguard its systems of records?

Subpart C—Individual Access to Records

1202.40

How can I gain access to NARA records about myself?

1202.42

How are requests for access to medical records handled?

1202.44

How long will it take for NARA to process my request?

1202.46

In what ways will NARA provide access?

1202.48

Will I have to pay for copies of records?

1202.50

Does NARA require prepayment of fees?

1202.52

How do I pay?

1202.54

On what grounds can NARA deny my Privacy Act request?

1202.56

How do I appeal a denial of my Privacy Act request?

1202.58

How are appeals processed?

Subpart D—Disclosure of Records

1202.60

When does NARA disclose a record in a Privacy Act system of records?

1202.62

What are the procedures for disclosure of records to a third party?

1202.64

How do I appeal a denial of disclosure?

1202.66

How does NARA keep account of disclosures?

Subpart E—Request to Amend Records

1202.70

Whom should I contact at NARA to amend records about myself?

1202.72

How does NARA handle requests to amend records?

1202.74

How will I know if NARA approved my amendment request?

1202.76

Can NARA deny my request for amendment?

1202.78

How do I accept an alternative amendment?

1202.80

How do I appeal the denial of a request to amend a record?

1202.82

How do I file a Statement of Disagreement?

1202.84

Can I seek judicial review?

Subpart F—Exemptions

1202.90

What NARA systems of records are exempt from release under the National Security Exemption of the Privacy Act?

1202.92

What NARA systems of records are exempt from release under the Law Enforcement Exemption of the Privacy Act?

1202.94

What NARA systems of records are exempt from release under the Investigatory Information Material Exemption of the Privacy Act?

Authority: 5 U.S.C. 552a; 44 U.S.C. 2104(a).

Subpart A—General Information About the Privacy Act

§ 1202.1

What does this part cover?

(a) This part covers requests under the Privacy Act (5 U.S.C. 552a) for NARA operational records and records of defunct agencies stored in NARA record centers.

(b) This part explains how NARA collects, uses and maintains records about you that are filed by your name or other personal identifiers and which are contained in a “system of records” as defined by 5 U.S.C. 552a(a)(5).

(c) This part describes the procedures to gain access to and contest the contents of your records, and the conditions under which NARA discloses such records to others.

§ 1202.2

What this part does not cover.

This part does not cover:

(a) Records that have been transferred into the National Archives of the United States for permanent preservation. Archival records that are contained in systems of records that become part of the National Archives of the United States are exempt from most provisions of the Privacy Act (see 5 U.S.C. 552a(l)(2) and (l)(3)). See subchapter C of this chapter for rules governing access to these type records.

(b) Records of other agencies that are stored in NARA record centers on behalf of that agency are governed by the Privacy Act rules of the transferring agency. Send your request for those records directly to those agencies.

(c) Personnel and medical records held by the National Personnel Records Center (NPRC) on behalf of the Department of Defense and the Office of Personnel Management. Privacy Act requests for these records should come to the NPRC.

§ 1202.4

Definitions.

For the purposes of this part, the term:

(a) Access means a transfer of a record, a copy of a record, or the information in a record to the subject individual, or the review of a record by the subject individual.

(b) Agency means any executive department, military department, Government corporation, Government-controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of the President), or any independent regulatory agency.

(c) Defunct agency means an agency that has ceased to exist, and has no successor in function.

(d) Defunct agency records means the records in a Privacy Act system of a defunct agency that are stored in a NARA records center.

(e) Disclosure means a transfer by any means of a record, a copy of a record, or the information contained in a record to a recipient other than the subject individual, or the review of a record by someone other than the subject individual.

(f) Individual means a citizen of the United States or an alien lawfully admitted for permanent residence.

(g) Maintain includes maintain, collect, use, or disseminate.

(h) NARA Privacy Act Appeal Official means the Deputy Archivist of the United States for appeals of denials of access to or amendment of records maintained in a system of records, except where the system manager is the Inspector General; then the term means the Archivist of the United States.

(i) Record means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his or her education, financial transactions, medical history and criminal or employment history, and that contains his or her name or an identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint, voiceprint, or photograph. For purposes of this part, “record” does not mean archival records that have been transferred to the National Archives of the United States.

(j) Routine use means, with respect to the disclosure of a record, the use of that record for a purpose which is compatible with the purpose for which it was collected.

(k) Solicitation means a request by a NARA employee or contractor that an individual provide information about himself or herself.

(l) Statistical record means a record in a system of records maintained for statistical research or reporting purposes only and not used in whole or in part in making any determination about an identifiable individual, except as provided by 13 U.S.C. 8.

(m) Subject individual means the individual named or discussed in a record or the individual to whom a record otherwise pertains.

(n) System manager means the NARA employee who is responsible for the maintenance of a system of records and for the collection, use, and dissemination of information in that system of records.

(o) System of records means a group of records from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifier assigned to that individual.

§ 1202.6

Whom should I contact for Privacy Act matters at NARA?

Contact the NARA Privacy Act Officer, National Archives and Records Administration (NGC), Room 3110, 8601 Adelphi Road, College Park, MD 20740-6001, for guidance in making a Privacy Act request, or if you need assistance with an existing request. The Privacy Act Officer will refer you to the responsible system manager. Details about what to include in your Privacy Act request are discussed in Subpart C of this part.

§ 1202.8

How does NARA handle records that are in Government-wide Privacy Act systems?

Records in the custody of NARA in a Government-wide Privacy Act system are the primary responsibility of another agency, e.g., the Office of Personnel Management (OPM) or the Office of Government Ethics (OGE). These records are governed by the regulations established by that agency pursuant to the Privacy Act. NARA provides access using that agency's regulations.

§ 1202.10

Does NARA handle access to and disclosure of records of defunct agencies in the custody of NARA?

Yes, records of defunct agencies in the custody of NARA at a NARA record center are covered by the provisions of this part.

Subpart B—Collecting Information

§ 1202.18

How does NARA collect information about individuals?

Any information that is used in making a determination about your rights, benefits, or privileges under NARA programs is collected directly from you—the subject individual— to the greatest extent possible.

§ 1202.20

What advisory information does NARA provide before collecting information from me?

(a) Before collecting information from you, NARA will advise you of:

(1) The authority for collecting the information and whether providing the information is mandatory or voluntary;

(2) The purpose for which the information will be used;

(3) The routine uses of the information; and

(4) The effect on you, if any, of not providing the information.

(b) NARA ensures that forms used to record the information that you provide are in compliance with the Privacy Act and this part.

§ 1202.22

Will NARA need my Social Security Number?

(a) Before a NARA employee or NARA contractor asks you to provide your social security number (SSN), he or she will ensure that the disclosure is required by Federal law or under a Federal law or regulation adopted before January 1, 1975.

(b) If you are asked to provide your SSN, the NARA employee or contractor must first inform you:

(1) Whether the disclosure is mandatory or voluntary;

(2) The statute or authority under which your SSN is solicited; and

(3) How your SSN will be used.

§ 1202.24

Will NARA ever request information about me from someone else?

NARA will make every effort to gather information from you directly. When NARA solicits information about you from someone else, NARA will explain to that person the purpose for which the information will be used.

§ 1202.26

Who will make sure that my record is accurate?

The system manager ensures that all records used by NARA to make a determination about any individual are maintained with such accuracy, relevancy, timeliness, and completeness as is reasonably possible to ensure fairness to you.

§ 1202.28

What rules do NARA employees follow in managing personal information?

All NARA employees and contractors involved in the design, development, operation or maintenance of any system of records must review the provisions of the Privacy Act and the regulations in this part. NARA employees and contractors must conduct themselves in accordance with the rules of conduct concerning the protection of nonpublic information in the Standards of Ethical Conduct for Employees of the Executive Branch, 5 CFR 2635.703.

§ 1202.30

How does NARA safeguard its systems of records?

(a) The system manager ensures that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of records. In order to protect against any threats or hazards to their security or loss of integrity, paper records are maintained in areas accessible only to authorized NARA personnel. Electronic records are protected in accordance with the Computer Security Act, OMB Circular A-11 requiring privacy analysis in reporting to OMB, and are accessed via passwords from terminals located in attended offices. After hours, buildings have security guards and/or doors are secured and all entrances are monitored by electronic surveillance equipment.

(b) The system manager, at his/her discretion, may designate additional safeguards similar to or greater than those described in paragraph (a) of this section for unusually sensitive records.

(c) The system manager only permits access to and use of automated or manual personnel records to persons whose official duties require such access, or to you or to a representative designated by you.

Subpart C—Individual Access to Records

§ 1202.40

How can I gain access to NARA records about myself?

(a) If you wish to request access to information about yourself contained in a NARA Privacy Act system of records, you must notify the NARA Privacy Act Officer, National Archives and Records Administration, Rm. 3110, 8601 Adelphi Rd., College Park, MD 20740-6001. If you wish to allow another person to review or obtain a copy of your record, you must provide authorization for that person to obtain access as part of your request.

(b) Your request must be in writing and the letter and the envelope must be marked “Privacy Act Request.” Your request letter must contain:

(1) The complete name and identifying number of the NARA system as published in the Federal Register;

(2) A brief description of the nature, time, place, and circumstances of your association with NARA;

(3) Any other information, which you believe, would help NARA to determine whether the information about you is included in the system of records;

(4) If you are authorizing another individual to have access to your records, the name of that person; and

(5) A Privacy Act certification of identity. When you make a request for access to records about yourself, you must verify your identity. You must sign your request and your signature must either be notarized or submitted by you under 28 U.S.C. 1746, a law that permits statements to be made under penalty of perjury as a substitute for notarization. While no specific form is required, you may obtain a Certification of Identity form for this purpose from the NARA Privacy Act Officer. The following information is required:

(i) Your full name;

(ii) An acknowledgment that you understand the criminal penalty in the Privacy Act for requesting or obtaining access to records under false pretenses (5 U.S.C. 552a(i)(3)); and

(iii) A declaration that your statement is true and correct under penalty of perjury (18 U.S.C. 1001).

(c) The procedure for accessing an accounting of disclosure is identical to the procedure for access to a record as set forth in this section.

§ 1202.42

How are requests for access to medical records handled?

When NARA receives a request for access to medical records, if NARA believes that disclosure of medical and/or psychological information directly to you could have an adverse effect on you, you may be asked to designate in writing a physician or mental health professional to whom you would like the records to be disclosed, and disclosure that otherwise would be made to you will instead be made to the designated physician or mental health professional.

§ 1202.44

How long will it take for NARA to process my request?

(a) NARA will acknowledge your request within 10 workdays of its receipt by NARA and if possible, will make the records available to you at that time. If NARA cannot make the records immediately available, the acknowledgment will indicate when the system manager will make the records available.

(b) If NARA anticipates more than a 10 workday delay in making a record you requested available, NARA also will explain in the acknowledgment specific reasons for the delay.

(c) If your request for access does not contain sufficient information to permit the system manager to locate the records, NARA will request additional information from you. NARA will have 10 workdays following receipt of the additional information in which to make the records available or to acknowledge receipt of the request and to indicate when the records will be available.

§ 1202.46

In what ways will NARA provide access?

(a) At your request, NARA will provide you, or a person authorized by you, a copy of the records by mail or by making the records available in person during normal business hours at the NARA facility where the records are located. If you are seeking access in person, the system manager will permit you to examine the original record, will provide you with a copy of the records, or both.

(b) When obtaining access to the records in person at a NARA facility, you must provide proof of identification either by producing at least one piece of identification bearing a name or signature and either a photograph or physical description (e.g., a driver's license or employee identification card) or by signing the Certification of Identity form described in § 1204.40 (b)(5). NARA reserves the right to ask you to produce additional pieces of identification to assure NARA of your identity. You will also be asked to sign an acknowledgement that you have been given access.

§ 1202.48

Will I have to pay for copies of records?

Yes. However NARA will waive fees for the first 100 pages copied or when the cost to collect the fee will exceed the amount collected. When a fee is charged, the charge per copy is $0.20 per page if NARA makes the copy or $0.15 per page if you make the copy on a NARA self-service copier. Fees for other reproduction processes are computed upon request.

§ 1202.50

Does NARA require prepayment of fees?

If the system manager determines that the estimated total fee is likely to exceed $250, NARA will notify you that the estimated fee must be prepaid before you can have copies of the records. If the final fee is less than the amount you prepaid, NARA will refund the difference.

§ 1202.52

How do I pay?

You must pay by check or money order. Make your check or money order payable to the National Archives and Records Administration and send it to the NARA Privacy Act Officer, Room 3110, 8601 Adelphi Road, College Park, MD 20740-6001.

§ 1202.54

On what grounds can NARA deny my Privacy Act request?

(a) NARA can deny your Privacy Act request for records if the records are maintained in an exempt systems of records are described in subpart F of this part.

(b) A system manager may deny your request for access to your records only if:

(1) NARA has published rules in the Federal Register exempting the pertinent system of records from the access requirement; and

(2) The record is exempt from disclosure under the Freedom of Information Act (FOIA).

(c) Upon receipt of a request for access to a record which is contained within an exempt system of records, NARA will:

(1) Review the record to determine whether all or part of the record must be released to you in accordance with § 1202.40, notwithstanding the inclusion of the record within an exempt system of records; and

(2) Provide access to the record (or part of the record, if it is not fully releasable) in accordance with § 1202.46 or notify you that the request has been denied in whole or in part.

(d) If your request is denied in whole or in part, NARA's notice will include a statement specifying the applicable Privacy Act and FOIA exemptions and advising you of the right to appeal the decision as explained in § 1202.56.

§ 1202.56

How do I appeal a denial of my Privacy Act request?

(a) If you are denied access in whole or in part to records pertaining to yourself, you may file with NARA an appeal of that denial. Your appeal letter must be post marked no later than 35 calendar days after the date of the denial letter from NARA.

(1) Address appeals involving denial of access to Office of Inspector General records to NARA Privacy Act Appeal Official (N), National Archives and Records Administration, Room 4200, 8601 Adelphi Road, College Park, MD 20740-6001.

(2) Address all other appeals to the NARA Privacy Act Appeal Official (ND), National Archives and Records Administration, Room 4200, 8601 Adelphi Road, College Park, MD 20740-6001.

(b) All appeals of denial of access to the NARA Privacy Act Appeal Official must be in writing. Mark both the envelope and the appeal “Privacy Act “ Access Appeal.”

§ 1202.58

How are appeals processed?

(a) Upon receipt of your appeal, the NARA Privacy Act Appeal Official will consult with the system manager, legal counsel, and such other officials as may be appropriate. If the NARA Privacy Act Appeal Official determines that the records you requested are not exempt from release, NARA grants you access and so notifies you.

(b) If the NARA Privacy Act Appeal Official determines that your appeal must be rejected, NARA will immediately notify you in writing of that determination. This decision is final and cannot be appealed further within NARA. NARA's notification to you will include:

(1) The reason for the rejection of the appeal; and

(2) Notice of your right to seek judicial review of NARA's final determination, as described in 36 CFR 1202.84.

(c) NARA will make its final determination no later than 30 workdays from the date on which NARA receives your appeal. NARA may extend this time limit by notifying you in writing before the expiration of the 30 workdays. This notification will include an explanation of the reasons for the time extension.

Subpart D—Disclosure of Records

§ 1202.60

When does NARA disclose a record in a Privacy Act system of records?

NARA will not disclose any records in a Privacy Act system of records to any person or to another agency without the express written consent of the subject individual unless the disclosure is:

(a) To NARA employees who have a need for the information in the official performance of their duties;

(b) Required by the provisions of the Freedom of Information Act, as amended;

(c) For a routine use that has been published in a notice in the Federal Register;

(d) To the Bureau of Census for purposes of planning or carrying out a census or survey or related activity pursuant to title 13 U.S.C.;

(e) To a person who has provided NARA with advance adequate written assurance as specified in § 1202.62(a) that the record will be used solely as a statistical research or reporting record. (Personal identifying information is deleted from the record released for statistical purposes. The system manager ensures that the identity of the individual cannot reasonably be deduced by combining various statistical records.)

(f) To the National Archives of the United States as a record which has sufficient historical or other value to warrant its continued preservation by the United States Government or for evaluation by the Archivist or the designee of the Archivist to determine whether the record has such value;

(g) To another agency or any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or his or her other designated representative has made a written request to NARA specifying the particular portion desired and the law enforcement activity for which the record is sought;

(h) To a person showing compelling circumstances affecting the health or safety of an individual, and not necessarily the individual to whom the record pertains. A disclosure of this nature is followed by a notification to the last known address of the subject individual;

(i) To either House of Congress or to a committee or subcommittee (joint or of either House), in the course of the performance of official legislative activities;

(j) To the Comptroller General or any of his authorized representatives in the course of the performance of the duties of the General Accounting Office;

(k) Pursuant to the order of a court of competent jurisdiction; or

(l) To a consumer reporting agency in accordance with 31 U.S.C. 3711(e).

§ 1202.62

What are the procedures for disclosure of records to a third party?

(a) To obtain access to records about a person other than yourself, address the request to the NARA Privacy Act Officer, National Archives and Records Administration, Room 3110, 8601 Adelphi Rd., College Park, MD 20740-6001. If you are requesting access for statistical research as described in § 1202.60(e), you must submit a written statement that includes as a minimum:

(1) A statement of the purpose for requesting the records; and

(2) Certification that the records will be used only for statistical purposes.

(b) NARA will acknowledge your request within 10 workdays and will make a decision within 30 workdays, unless NARA notifies you that the time limit must be extended for good cause.

(c) Upon receipt of your request, NARA will verify your right to obtain access to documents pursuant to § 1202.60. Upon verification, the system manager will make the requested records available to you.

(d) If NARA determines that the disclosure is not permitted under § 1202.60, the system manager will deny your request in writing. NARA will inform you of the right to submit a request for review of the denial and a final determination to the appropriate NARA Privacy Act Appeal Officer.

§ 1202.64

How do I appeal a denial of disclosure?

(a) Your request for a review of the denial of disclosure to records maintained by the Office of the Inspector General must be addressed to the NARA Privacy Act Appeal Officer (N), National Archives and Records Administration, Room 4200, 8601 Adelphi Rd., College Park, MD 20740-6001.

(b) Requests for a review of a denial of disclosure to all other NARA records must be addressed to the NARA Privacy Act Appeal Officer (ND), National Archives and Records Administration, Room 4200, 8601 Adelphi Rd., College Park, MD 20740-6001.

§ 1202.66

How does NARA keep account of disclosures?

(a) Except for disclosures made to NARA employees in the course of the performance of their duties or when required by the Freedom of Information Act (see § 1202.60(a) and (b)), NARA keeps an accurate accounting of each disclosure and retains it for 5 years after the disclosure or for the life of the record, whichever is longer. The accounting includes the:

(1) Date of disclosure;

(2) Nature, and purpose of each disclosure; and

(3) Name and address of the person or agency to which the disclosure is made.

(b) The system manager also maintains with the accounting of disclosures:

(1) A full statement of the justification for the disclosures;

(2) All documentation surrounding disclosure of a record for statistical or law enforcement purposes; and

(3) Evidence of written consent by the subject individual to a disclosure, if applicable.

(c) Except for the accounting of disclosures made for a law enforcement activity (see § 1202.60(g)) or of disclosures made from exempt systems (see subpart F of this part), the accounting of disclosures will be made available to the subject individual upon request. Procedures for requesting access to the accounting of disclosures are in subpart C.

Subpart E—Request To Amend Records

§ 1202.70

Whom should I contact at NARA to amend records about myself?

If you believe that a record that NARA maintains about you is not accurate, timely, relevant or complete, you may request that the record be amended. Write to the NARA Privacy Act Officer, Room 3110, 8601 Adelphi Rd, College Park, MD 20470-6001. Employees of NARA who desire to amend their personnel records should write to the Director, Human Resources Services Division. You should include as much information, documentation, or other evidence as needed to support your request to amend the pertinent record. Mark both the envelop and the letter with the phrase “Privacy Act—Request To Amend Record.”

§ 1202.72

How does NARA handle requests to amend records?

(a) NARA will acknowledge receipt of a request to amend a record within 10 workdays. If possible, the acknowledgment will include the system manager's determination either to amend the record or to deny your request to amend as provided in § 1202.76.

(b) When reviewing a record in response to your request to amend, the system manager will assess the accuracy, relevance, timeliness, and completeness of the existing record in light of your proposed amendment to determine if your request to amend is justified. If you request the deletion of information, the system manager also will review your request and the existing record to determine whether the information is relevant and necessary to accomplish NARA's purpose, as required by law or Executive order.

§ 1202.74

How will I know if NARA approved my amendment request?

If NARA approves your amendment request, the system manager will promptly make the necessary amendment to the record and will send a copy of the amended record to you. NARA will also advise all previous recipients of the record, using the accounting of disclosures, that an amendment has been made and give the substance of the amendment. Where practicable, NARA will also send a copy of the amended record to previous recipients.

§ 1202.76

Can NARA deny my request for amendment?

If the system manager denies your request to amend or determines that the record should be amended in a manner other than that requested by you, NARA will advise you in writing of the decision. The denial letter will state:

(a) The reasons for the denial of your amendment request;

(b) Proposed alternative amendments, if appropriate;

(c) Your right to appeal the denial; and

(d) The procedures for appealing the denial.

§ 1202.78

How do I accept an alternative amendment?

If your request to amend a record is denied and NARA suggested alternative amendments, and you agree to those alternative amendments, you must notify the Privacy Act Officer who will then make the necessary amendments in accordance with § 1202.74.

§ 1202.80

How do I appeal the denial of a request to amend a record?

(a) If you disagree with a denial of your request to amend a record, you can file an appeal of that denial.

(1) Address your appeal of the denial to amend records signed by a system manager other than the Inspector General, to the NARA Privacy Act Appeal Official (ND), Room 3110, 8601 Adelphi Road, College Park, MD, 20740-6001.

(2) Address the appeal of the denial to amend records signed by the Inspector General to the NARA Privacy Act Appeal Official (N), Room 3110, 8601 Adelphi Road, College Park, MD, 20740-6001.

(3) For current NARA employees if the denial to amend concerns a record maintained in the employee's Official Personnel Folder or in another Government-wide system maintained by NARA on behalf of another agency, NARA will provide the employee with name and address of the appropriate appeal official in that agency.

(b) Appeals to NARA must be in writing and must be postmarked no later than 35 calendar days from the date of the NARA denial of a request to amend. Your appeal letter and envelope must be marked “Privacy Act—Appeal”.

(c) Upon receipt of an appeal, the NARA Privacy Act Appeal Official will consult with the system manager, legal counsel, and such other officials as may be appropriate. If the appeal official determines that the record should be amended, he or she will instruct the system manager to amend the record in accordance with § 1202.74 and will notify you of that action.

(d) If, after consulting with officials specified in paragraph (c) of this section, the NARA Privacy Act Appeal Official determines that your appeal should be rejected, the NARA Privacy Act Appeal Official will notify you in writing of that determination. This notice serves as NARA's final determination on your request to amend a record. The letter to you will include:

(1) The reason for the rejection of your appeal;

(2) Proposed alternative amendments, if appropriate, which you may accept (see 36 CFR 1202.78 for the procedure);

(3) Notice of your right to file a Statement of Disagreement for distribution in accordance with § 1202.82; and

(4) Notice of your right to seek judicial review of the NARA final determination, as provided in § 1202.84.

(e) The NARA final determination will be made no later than 30 workdays from the date on which the appeal is received by the NARA Privacy Act Appeal Official. In extraordinary circumstances, the NARA Privacy Act Appeal Official may extend this time limit by notifying you in writing before the expiration of the 30 workdays. The notification will include a justification for the extension of time.

§ 1202.82

How do I file a Statement of Disagreement?

If you receive a NARA final determination denying your request to amend a record, you may file a Statement of Disagreement with the appropriate system manager. The Statement of Disagreement must include an explanation of why you believe the record to be inaccurate, irrelevant, untimely, or incomplete. The system manager will maintain your Statement of Disagreement in conjunction with the pertinent record. The System Manager will send a copy of the Statement of Disagreement to any person or agency to whom the record has been disclosed, only if the disclosure was subject to the accounting requirements of § 1202.60.

§ 1202.84

Can I seek judicial review?

Yes, within 2 years of receipt of a NARA final determination as provided in § 1202.54 or § 1202.80, you may seek judicial review of that determination. You may file a civil action in the Federal District Court:

(a) In which you reside or have a principal place of business;

(b) In which the NARA records are located; or

(c) In the District of Columbia.

Subpart F—Exemptions

§ 1202.90

What NARA systems of records are exempt from release under the National Security Exemption of the Privacy Act?

(a) The Investigative Case Files of the Inspector General (NARA-23) and the Personnel Security Case Files (NARA-24) systems of records are eligible for exemption under 5 U.S.C. 552a(k)(1) because the records in these systems:

(1) Contain information specifically authorized under criteria established by an Executive Order to be kept secret in the interest of national defense or foreign policy and

(2) Are in fact properly classified pursuant to such Executive Order.

(b) The systems described in paragraph (a) are exempt from 5 U.S.C. 552a (c)(3), (d), (e)(1), and (e)(4)(G) and (H). Exemptions from the particular subsections are justified for the following reasons:

(1) From subsection (c)(3) because accounting for each disclosure could result in the release of properly classified information which would compromise the national defense or disrupt foreign policy.

(2) From the access and amendment provisions of subsection (d) because access to the records in these systems of records could result in the release of properly classified information which would compromise the national defense or disrupt foreign policy. Amendment of either of these series of records would interfere with ongoing investigations and law enforcement or national security activities and impose an impossible administrative burden by requiring investigations to be continuously reinvestigated.

(3) From subsection (e)(1) because verification of the accuracy of all information to the records could result in the release of properly classified information which would compromise the national defense or disrupt foreign policy.

(4) From subsection (e)(4)(G) and (H) because these systems are exempt from the access and amendment provisions of subsection (d), pursuant to subsection (k)(1) of the Privacy Act.

§ 1202.92

What NARA systems of records are exempt from release under the Law Enforcement Exemption of the Privacy Act?

(a) The Investigative Files of the Inspector General (NARA-23) system of records is eligible for exemption under 5 U.S.C. 552a(k)(2) because this record system contains investigatory material of actual, potential or alleged criminal, civil or administrative violations, compiled for law enforcement purposes other than within the scope of subsection (j)(2) of 5 USC 552a. If you are denied any right, privilege or benefit that you would otherwise be entitled by Federal law, or for which you would otherwise be eligible, as a result of the record, NARA will make the record available to you, except for any information in the record that would disclose the identity of a confidential source as described in 5 U.S.C. 552a(k)(2).

(b) The system described in paragraph (a) of this section is exempt from 5 U.S.C. 552a (c)(3), (d), (e)(1) and (e)(4) (G) and (H), and (f). Exemptions from the particular subsections are justified for the following reasons:

(1) From subsection (c)(3) because release of disclosure accounting could alert the subject of an investigation about the alleged violations, to the existence of the investigation and to the fact that they are being investigated by the Office of Inspector General (OIG) or another agency. Release of such information could provide significant information concerning the nature of the investigation, resulting in the tampering or destruction of evidence, influencing of witnesses, danger to individuals involved, and other activities that could impede or compromise the investigation.

(2) From the access and amendment provisions of subsection (d) because access to the records contained in this system of records could inform the subject of an investigation of an actual or potential criminal, civil, or administrative violation, of the existence of that investigation; of the nature and scope of the information and evidence obtained as to his/her activities; of the identity of confidential sources, witnesses, and law enforcement personnel; and of information that may enable the subject to avoid detection or apprehension. These factors would present a serious impediment to effective law enforcement where they prevent the successful completion of the investigation, endanger the physical safety of confidential sources, witnesses, and law enforcement personnel, and/or lead to the improper influencing of witnesses, the destruction of evidence, or the fabrication of testimony. In addition, granting access to such information could disclose security-sensitive or confidential business information or information that would constitute an unwarranted invasion of the personal privacy of third parties. The amendment of these records could allow the subject to avoid detection or apprehension and interfere with ongoing investigations and law enforcement activities.

(3) From subsection (e)(1) because the application of this provision could impair investigations and interfere with the law enforcement responsibilities of the OIG or another agency for the following reasons:

(i) It is not possible to detect relevance or need for specific information in the early stages of an investigation, case or matter. After the information is evaluated, relevance and necessity may be established.

(ii) During an investigation, the OIG may obtain information about other actual or potential criminal, civil or administrative violations, including those outside the scope of its jurisdiction. The OIG should retain this information, as it may aid in establishing patterns of inappropriate activity, and can provide valuable leads for Federal and other law enforcement agencies.

(iii) In interviewing individuals or obtaining other forms of evidence during an investigation, information may be supplied to an investigator, which relates to matters incidental to the primary purpose of the investigation but which may relate also to matters under the investigative jurisdiction of another agency. Such information cannot readily be segregated.

(iv) From subsection (e)(4)(G) and (H) because this system is exempt from the access and amendment provisions of subsection (d), pursuant to subsection (k)(2) of the Privacy Act.

(v) From subsection (f) because this system is exempt from the access and amendment provisions of subsection (d), pursuant to subsection (k)(2) of the Privacy Act.

§ 1202.94

What NARA systems of records are exempt from release under the Investigatory Information Material exemption of the Privacy Act?

(a) The Personnel Security Case Files (NARA-24) system of records is eligible for exemption under 5 U.S.C. 552a(k)(5) because it contains investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for federal employment or access to classified information. The only information exempt under this provision is that which would disclose the identity of a confidential source described in 5 U.S.C. 552a(k)(2).

(b) The system of records described in paragraph (a) of this section is exempt from 5 U.S.C. 552a(d)(1). Exemption from the particular subsection is justified as access to records in the system would reveal the identity(ies) of the source(s) of information collected in the course of a background investigation.

Dated: December 14, 2001.

John W. Carlin,

Archivist of the United States.