Loading (50 kb)...'

(continued)

(c) This subpart applies to all components of the Department. Components may promulgate supplementary orders and rules not inconsistent with this subpart.

(d) The Assistant Secretary for Administration is delegated responsibility for maintaining this subpart, for issuing such orders and directives internal to the Department as are necessary for full compliance with the Act, and for publishing all required notices concerning systems of records.

(e) Matters outside the scope of this subpart include:

(1) Requests for records that do not pertain to the requester, or to the individual about whom the request is made if the requester is the parent or guardian of the individual;

(2) Requests involving information pertaining to an individual that is in a record or file but not within the scope of a system of records notice published in the Federal Register;

(3) Requests to correct a record if a grievance procedure is available to the individual either by regulation or through a provision in a collective bargaining agreement with the Department or a component of the Department, and the individual has initiated, or expressed in writing the intention of initiating, such a grievance procedure; and

(4) Requests for employee-employer services and counseling that were routinely granted prior to enactment of the Act, including, but not limited to, test calculations of retirement benefits, explanations of health and life insurance programs, and explanations of tax withholding options.

(f) Any request for records that pertains to the requester, or to the individual about whom the request is made if the requester is the parent or guardian of the individual, shall be processed under the Act and this subpart and under the Freedom of Information Act and the Department's implementing regulations at subpart A of this part, regardless whether the Act or the Freedom of Information Act is mentioned in the request.

§ 4.22 Definitions.
top
(a) All terms used in this subpart which are defined in 5 U.S.C. 552a shall have the same meaning herein.

(b) As used in this subpart:

(1) Act means the “Privacy Act of 1974, as amended (5 U.S.C. 552a)”.

(2) Appeal means a request by an individual to review and reverse an initial denial of a request from that individual for correction or amendment.

(3) Component means any office, division, bureau or other unit of the Department listed in Appendix A to this part (except that a regional office of a larger office or other unit does not constitute a separate component).

(4) Department means the Department of Commerce.

(5) Inquiry means either a request for general information regarding the Act and this subpart or a request from an individual (or that individual's parent or guardian) that the Department determine whether it has any record in a system of records that pertains to that individual.

(6) Person means any human being and also shall include, but is not limited to, corporations, associations, partnerships, trustees, receivers, personal representatives, and public or private organizations.

(7) Privacy Officer means those officials, identified in Appendix B to this part, who are authorized to receive and act upon inquiries, requests for access, and requests for correction or amendment.

(8) Request for access means a request from an individual or an individual's parent or guardian to see a record pertaining to that individual in a particular system of records.

(9) Request for correction or amendment means a request from an individual or an individual's parent or guardian that the Department change (by correction, amendment, addition or deletion) a particular record pertaining to that individual in a system of records.

§ 4.23 Procedures for making inquiries.
top
(a) Any individual, regardless of age, who is a citizen of the United States or an alien lawfully admitted for permanent residence into the United States may submit an inquiry to the Department. The inquiry should be made either in person or by mail addressed to the appropriate component identified in Appendix A to this part or to the official identified in the notification procedures paragraph of the systems of records notice published in the Federal Register. 2 If an individual believes the Department maintains a record pertaining to him or her but does not know which system of records might contain such a record and/or which component of the Department maintains the system of records, assistance in person or by mail will be provided at the first address listed in Appendix A to this part.

2 The United States Patent and Trademark Office (USPTO), which is established as an agency of the United States within the Department of Commerce, operates under its own PA regulations at 37 CFR part 102, subpart B. Accordingly, requests concerning records maintained by the USPTO should be sent directly to the USPTO.

(b) Inquiries submitted by mail should include the words “PRIVACY ACT INQUIRY” in capital letters at the top of the letter and on the face of the envelope. If the inquiry is for general information regarding the Act and this subpart, no particular information is required. The Department reserves the right to require compliance with the identification procedures appearing at §4.24(d). If the inquiry is a request that the Department determine whether it has a record pertaining to the individual, the following information should be submitted:

(1) Name of individual whose record is sought;

(2) Statement that individual whose record is sought is either a U.S. citizen or an alien lawfully admitted for permanent residence;

(3) Identifying data that will help locate the record (for example, maiden name, occupational license number, period or place of employment, etc.);

(4) Record sought, by description and by record system name, if known;

(5) Action requested (that is, sending information on how to exercise rights under the Act; determining whether requested record exists; gaining access to requested record; or obtaining copy of requested record);

(6) Copy of court guardianship order or minor's birth certificate, as provided in §4.24(d)(3), but only if requester is guardian or parent of individual whose record is sought;

(7) Requester's name (printed), signature, address, and (optional) telephone number;

(8) Date; and,

(9) Certification of request by notary or other official, but only if

(i) Request is for notification that requested record exists, for access to requested record, or for copy of requested record;

(ii) Record is not available to any person under 5 U.S.C. 552; and

(iii) Requester does not appear before an employee of the Department for verification of identity.

(c) Any inquiry which is not addressed as specified in paragraph (a) of this section or which is not marked as specified in paragraph (b) of this section will be so addressed and marked by Department personnel and forwarded immediately to the responsible Privacy Officer. An inquiry which is not properly addressed by the individual will not be deemed to have been “received” for purposes of measuring the time period for response until actual receipt by the Privacy Officer. In each instance when an inquiry so forwarded is received, the Privacy Officer shall notify the individual that his or her inquiry was improperly addressed and the date the inquiry was received at the proper address.

(d)(1) Each inquiry received shall be acted upon promptly by the responsible Privacy Officer. Every effort will be made to respond within ten working days (i.e., excluding Saturdays, Sundays and legal public holidays) of the date of receipt at the proper address. If a response cannot be made within ten working days, the Privacy Officer shall send an acknowledgment during that period providing information on the status of the inquiry and asking for such further information as may be necessary to process the inquiry. The first correspondence sent by the Privacy Officer to the requester shall contain the Department's control number assigned to the request, as well as a statement that the requester should use that number in all future contacts with the Department. The Department shall use that control number in all subsequent correspondence.

(2) If the Privacy Officer fails to send an acknowledgment within ten working days, as provided in paragraph (d)(1) of this section, the requester may ask the Assistant General Counsel for Administration to take corrective action. No failure of a Privacy Officer to send an acknowledgment shall confer administrative finality for purposes of judicial review.

(e) An individual shall not be required to state a reason for or otherwise justify his or her inquiry.

(f) Special note should be taken that certain agencies are responsible for publishing notices of systems of records having Government-wide application to other agencies, including the Department. The agencies known to be publishing these general notices and the types of records covered therein appear in Appendix C to this part. These general notices do not identify the Privacy Officers in the Department to whom inquiries should be presented or mailed. The provisions of this section, and particularly paragraph (a) of this section, should be followed in making inquiries with respect to such records. Such records in the Department are subject to the provisions of this part to the extent indicated in Appendix C to this part. The exemptions, if any, determined by the agency publishing a general notice shall be invoked and applied by the Department after consultation, as necessary, with that other agency.

§ 4.24 Procedures for making requests for records.
top
(a) Any individual, regardless of age, who is a citizen of the United States or an alien lawfully admitted for permanent residence into the United States may submit a request to the Department for access to records. The request should be made either in person or by mail addressed to the appropriate office listed in Appendix A to this part.

(b) Requests submitted by mail should include the words “PRIVACY ACT REQUEST” in capital letters at the top of the letter and on the face of the envelope. Any request which is not addressed as specified in paragraph (a) of this section or which is not marked as specified in this paragraph will be so addressed and marked by Department personnel and forwarded immediately to the responsible Privacy Officer. A request which is not properly addressed by the individual will not be deemed to have been “received” for purposes of measuring time periods for response until actual receipt by the Privacy Officer. In each instance when a request so forwarded is received, the Privacy Officer shall notify the individual that his or her request was improperly addressed and the date the request was received at the proper address.

(c) If the request follows an inquiry under §4.23 in connection with which the individual's identity was established by the Department, the individual need only indicate the record to which access is sought, provide the Department control number assigned to the request, and sign and date the request. If the request is not preceded by an inquiry under §4.23, the procedures of this section should be followed.

(d) The requirements for identification of individuals seeking access to records are:

(1) In person. Each individual making a request in person shall be required to present satisfactory proof of identity. The means of proof, in the order of preference and priority, are:

(i) A document bearing the individual's photograph (for example, driver's license, passport or military or civilian identification card);

(ii) A document, preferably issued for participation in a Federally-sponsored program, bearing the individual's signature (for example, unemployment insurance book, employer's identification card, national credit card, and professional, craft or union membership card); and,

(iii) A document bearing neither the photograph nor the signature of the individual, preferably issued for participation in a Federally-sponsored program (for example, Medicaid card). If the individual can provide no suitable documentation of identity, the Department will require a signed statement asserting the individual's identity and stipulating that the individual understands the penalty provision of 5 U.S.C. 552a(i)(3) recited in §4.32(a). In order to avoid any unwarranted disclosure of an individual's records, the Department reserves the right to determine the adequacy of proof of identity offered by any individual, particularly if the request involves a sensitive record.

(2) Not in person. If the individual making a request does not appear in person before a Privacy Officer or other employee authorized to determine identity, a certification of a notary public or equivalent officer empowered to administer oaths must accompany the request under the circumstances prescribed in §4.23(b)(9). The certification in or attached to the letter must be substantially in accordance with the following text:


City of ____ County of ____.ss (Name of individual), who affixed (his) (her) signature below in my presence, came before me, a (title), in and for the aforesaid County and State, this __ day of ___, 20_, and established (his) (her) identity to my satisfaction.

My commission expires ____.

(Signature) ________________________________


(3) Parents of minors and legal guardians. An individual acting as the parent of a minor or the legal guardian of the individual to whom a record pertains shall establish his or her personal identity in the same manner prescribed in either paragraph (d)(1) or (d)(2) of this section. In addition, such other individual shall establish his or her identity in the representative capacity of parent or legal guardian. In the case of the parent of a minor, the proof of identity shall be a certified or authenticated copy of the minor's birth certificate. In the case of a legal guardian of an individual who has been declared incompetent due to physical or mental incapacity or age by a court of competent jurisdiction, the proof of identity shall be a certified or authenticated copy of the court's order. For purposes of the Act, a parent or legal guardian may represent only a living individual, not a decedent. A parent or legal guardian may be accompanied during personal access to a record by another individual, provided the provisions of §4.25(f) are satisfied.

(e) If the provisions of this subpart are alleged to impede an individual in exercising his or her right to access, the Department will consider, from an individual making a request, alternative suggestions regarding proof of identity and access to records.

(f) An individual shall not be required to state a reason for or otherwise justify his or her request for access to a record.

§ 4.25 Disclosure of requested records to individuals.
top
(a)(1) The responsible Privacy Officer shall act promptly upon each request. Every effort will be made to respond within ten working days (i.e., excluding Saturdays, Sundays and legal public holidays) of the date of receipt. If a response cannot be made within ten working days due to unusual circumstances, the Privacy Officer shall send an acknowledgment during that period providing information on the status of the request and asking for any further information that may be necessary to process the request. “Unusual circumstances” shall include circumstances in which:

(i) A search for and collection of requested records from inactive storage, field facilities or other establishments is required;

(ii) A voluminous amount of data is involved;

(iii) Information on other individuals must be separated or expunged from the particular record; or

(iv) Consultations with other agencies having a substantial interest in the determination of the request are necessary.

(2) If the Privacy Officer fails to send an acknowledgment within ten working days, as provided in paragraph (a)(1) of this section, the requester may ask the Assistant General Counsel for Administration to take corrective action. No failure of a Privacy Officer to send an acknowledgment shall confer administrative finality for purposes of judicial review.

(b) Grant of access: (1) Notification. An individual shall be granted access to a record pertaining to him or her, unless the provisions of paragraph (g)(1) of this section apply. The Privacy Officer shall notify the individual of a determination to grant access, and provide the following information:

(i) The methods of access, as set forth in paragraph (b)(2) of this section;

(ii) The place at which the record may be inspected;

(iii) The earliest date on which the record may be inspected and the period of time that the records will remain available for inspection. In no event shall the earliest date be later than thirty calendar days from the date of notification;

(iv) The estimated date by which a copy of the record will be mailed and the fee estimate pursuant to §4.31. In no event shall the estimated date be later than thirty calendar days from the date of notification;

(v) The fact that the individual, if he or she wishes, may be accompanied by another individual during personal access, subject to the procedures set forth in paragraph (f) of this section; and,

(vi) Any additional prerequisites for granting access to a specific record.

(2) Methods of access. The following methods of access to records by an individual may be available depending on the circumstances of a given situation:

(i) Inspection in person may be had in the office specified by the Privacy Officer granting access, during the hours indicated in Appendix A to this part;

(ii) Transfer of records to a Federal facility more convenient to the individual may be arranged, but only if the Privacy Officer determines that a suitable facility is available, that the individual's access can be properly supervised at that facility, and that transmittal of the records to that facility will not unduly interfere with operations of the Department or involve unreasonable costs, in terms of both money and manpower; and,

(iii) Copies may be mailed at the request of the individual, subject to payment of the fees prescribed in §4.31. The Department, at its own initiative, may elect to provide a copy by mail, in which case no fee will be charged the individual.

(c) Access to medical records is governed by the provisions of §4.26.

(d) The Department shall supply such other information and assistance at the time of access as to make the record intelligible to the individual.

(e) The Department reserves the right to limit access to copies and abstracts of original records, rather than the original records. This election would be appropriate, for example, when the record is in an automated data medium such as tape or disc, when the record contains information on other individuals, and when deletion of information is permissible under exemptions (for example, 5 U.S.C. 552a(k)(2)). In no event shall original records of the Department be made available to the individual except under the immediate supervision of the Privacy Officer or his or her designee.

(f) Any individual who requests access to a record pertaining to that individual may be accompanied by another individual of his or her choice. “Accompanied” includes discussing the record in the presence of the other individual. The individual to whom the record pertains shall authorize the presence of the other individual in writing. The authorization shall include the name of the other individual, a specific description of the record to which access is sought, the Department control number assigned to the request, the date, and the signature of the individual to whom the record pertains. The other individual shall sign the authorization in the presence of the Privacy Officer. An individual shall not be required to state a reason or otherwise justify his or her decision to be accompanied by another individual during personal access to a record.

(g) Initial denial of access: (1) Grounds. Access by an individual to a record that pertains to that individual will be denied only upon a determination by the Privacy Officer that:

(i) The record is exempt under §4.33 or 4.34, or exempt by determination of another agency publishing notice of the system of records, as described in §4.23(f);

(ii) The record is information compiled in reasonable anticipation of a civil action or proceeding;

(iii) The provisions of §4.26 pertaining to medical records temporarily have been invoked; or,

(iv) The individual unreasonably has failed to comply with the procedural requirements of this part.

(2) Notification. The Privacy Officer shall give notice of denial of access to records to the individual in writing, and the notice shall include the following information:

(i) The Privacy Officer's name and title or position;

(ii) The date of the denial;

(iii) The reasons for the denial, including citation to the appropriate section of the Act and this part;

(iv) The individual's opportunities, if any, for further administrative consideration, including the identity and address of the responsible official. If no further administrative consideration within the Department is available, the notice shall state that the denial is administratively final; and,

(v) If stated to be administratively final within the Department, the individual's right to judicial review provided under 5 U.S.C.552a(g)(1), as limited by 5 U.S.C. 552a(g)(5).

(3) Administrative review. If a Privacy Officer issues an initial denial of a request, the individual's opportunities for further consideration shall be as follows:

(i) As to denial under paragraph (g)(1)(i) of this section, two opportunities for further consideration are available in the alternative:

(A) If the individual contests the application of an exemption to the records, the review procedures in §4.25(g)(3)(ii) shall apply; or,

(B) If the individual challenges the validity of the exemption itself, the individual must file a petition for the issuance, amendment, or repeal of a rule under 5 U.S.C. 553(e). If the exemption was determined by the Department, such petition shall be filed with the Assistant Secretary for Administration. If the exemption was determined by another agency (as described in §4.23(f)), the Department will provide the individual with the name and address of the other agency and any relief sought by the individual shall be that provided by the regulations of the other agency. Within the Department, no such denial is administratively final until such a petition has been filed by the individual and disposed of on the merits by the Assistant Secretary for Administration.

(ii) As to denial under paragraphs (g)(1)(ii) of this section, (g)(1)(iv) of this section or (to the limited extent provided in paragraph (g)(3)(i)(A) of this section) paragraph (g)(1)(i) of this section, the individual may file for review with the Assistant General Counsel for Administration, as indicated in the Privacy Officer's initial denial notification. The individual and the Department shall follow the procedures in §4.28 to the maximum extent practicable.

(iii) As to denial under paragraph (g)(1)(iii) of this section, no further administrative consideration within the Department is available because the denial is not administratively final until expiration of the time period indicated in §4.26(a).

(h) If a request is partially granted and partially denied, the Privacy Officer shall follow the appropriate procedures of this section as to the records within the grant and the records within the denial.

§ 4.26 Special procedures: Medical records.
top
(a) No response to any request for access to medical records from an individual will be issued by the Privacy Officer for a period of seven working days (i.e., excluding Saturdays, Sundays and legal public holidays) from the date of receipt.

(b) For every request from an individual for access to medical records, the Privacy Officer shall:

(1) Inform the individual of the waiting period prescribed in paragraph (a) of this section;

(2) Seek from the individual the name and address of the individual's physician and/or psychologist;

(3) Seek from the individual written consent for the Department to consult the individual's physician and/or psychologist, if the Department believes such consultation is advisable;

(4) Seek written consent from the individual for the Department to provide the medical records to the individual's physician or psychologist, if the Department believes access to the record by the individual is best effected under the guidance of the individual's physician or psychologist; and,

(5) Forward the individual's medical record to the Department's medical officer for review and a determination on whether consultation with or transmittal of the medical records to the individual's physician or psychologist is warranted. If consultation with or transmittal of such records to the individual's physician or psychologist is determined to be warranted, the Department's medical officer shall so consult or transmit. Whether or not such a consultation or transmittal occurs, the Department's medical officer shall provide instruction to the Privacy Officer regarding the conditions of access by the individual to his or her medical records.

(c) If an individual refuses in writing to give the names and consents set forth in paragraphs (c)(2) through (c)(4) of this section, the Department shall give the individual access to said records by means of a copy, provided without cost to the requester, sent registered mail, return receipt requested.

§ 4.27 Procedures for making requests for correction or amendment.
top
(a) Any individual, regardless of age, who is a citizen of the United States or an alien lawfully admitted for permanent residence into the United States may submit a request for correction or amendment to the Department. The request should be made either in person or by mail addressed to the Privacy Officer who processed the individual's request for access to the record, and to whom is delegated authority to make initial determinations on requests for correction or amendment. The offices of Privacy Officers are open to the public between the hours of 9 a.m. and 4 p.m. Monday through Friday (excluding Saturdays, Sundays, and legal public holidays).

(b) Requests submitted by mail should include the words “PRIVACY ACT REQUEST” in capital letters at the top of the letter and on the face of the envelope. Any request that is not addressed as specified in paragraph (a) of this section or that is not marked as specified in this paragraph will be so addressed and marked by Department personnel and forwarded immediately to the responsible Privacy Officer. A request that is not properly addressed by the individual will not be deemed to have been “received” for purposes of measuring the time period for response until actual receipt by the Privacy Officer. In each instance when a request so forwarded is received, the Privacy Officer shall notify the individual that his or her request was improperly addressed and the date the request was received at the proper address.

(c) Since the request, in all cases, will follow a request for access under §4.25, the individual's identity will be established by his or her signature on the request and use of the Department control number assigned to the request.

(d) A request for correction or amendment should include the following:

(1) Specific identification of the record sought to be corrected or amended (for example, description, title, date, paragraph, sentence, line and words);

(2) The specific wording to be deleted, if any;

(3) The specific wording to be inserted or added, if any, and the exact place at which it is to be inserted or added; and,

(4) A statement of the basis for the requested correction or amendment, with all available supporting documents and materials that substantiate the statement. The statement should identify the criterion of the Act being invoked, that is, whether the information in the record is unnecessary, inaccurate, irrelevant, untimely or incomplete.

§ 4.28 Agency review of requests for correction or amendment.
top
(a)(1)(i) Not later than ten working days (i.e., excluding Saturdays, Sundays and legal public holidays) after receipt of a request to correct or amend a record, the Privacy Officer shall send an acknowledgment providing an estimate of time within which action will be taken on the request and asking for such further information as may be necessary to process the request. The estimate of time may take into account unusual circumstances as described in §4.25(a). No acknowledgment will be sent if the request can be reviewed, processed and the individual notified of the results of review (either compliance or denial) within the ten working days. Requests filed in person will be acknowledged in writing at the time submitted.

(ii) If the Privacy Officer fails to send the acknowledgment within ten working days, as provided in paragraph (a)(1)(i) of this section, the requester may ask the Assistant General Counsel for Administration to take corrective action. No failure of a Privacy Officer to send an acknowledgment shall confer administrative finality for purposes of judicial review.

(2) Promptly after acknowledging receipt of a request, or after receiving such further information as might have been requested, or after arriving at a decision within the ten working days, the Privacy Officer shall either:

(i) Make the requested correction or amendment and advise the individual in writing of such action, providing either a copy of the corrected or amended record or, in cases in which a copy cannot be provided (for example, erasure of information from a record maintained only in magnetically-recorded computer files), a statement as to the means by which the correction or amendment was effected; or,

(ii) Inform the individual in writing that his or her request is denied and provide the following information:

(A) The Privacy Officer's name and title or position;

(B) The date of the denial;

(C) The reasons for the denial, including citation to the appropriate sections of the Act and this subpart; and,

(D) The procedures for appeal of the denial as set forth in §4.29, including the address of the Assistant General Counsel for Administration.

(3) The term promptly in this section means within thirty working days (i.e., excluding Saturdays, Sundays and legal public holidays). If the Privacy Officer cannot make the determination within thirty working days, the individual will be advised in writing of the reason for the delay and of the estimated date by which the determination will be made.

(b) Whenever an individual's record is corrected or amended pursuant to a request from that individual, the Privacy Officer shall notify all persons and agencies to which the corrected or amended portion of the record had been disclosed prior to its correction or amendment, if an accounting of such disclosure required by the Act was made. The notification shall require a recipient agency maintaining the record to acknowledge receipt of the notification, to correct or amend the record, and to apprise any agency or person to which it had disclosed the record of the substance of the correction or amendment.

(c) The following criteria will be considered by the Privacy Officer in reviewing a request for correction or amendment:

(1) The sufficiency of the evidence submitted by the individual;

(2) The factual accuracy of the information to be corrected or amended;

(3) The relevance and necessity of the information in terms of the purpose for which it was collected;

(4) The timeliness and currency of the information in light of the purpose for which it was collected;

(5) The completeness of the information in terms of the purpose for which it was collected;

(6) The degree of risk that denial of the request could unfairly result in determinations adverse to the individual;

(7) The character of the record sought to be corrected or amended; and,

(8) The propriety and feasibility of complying with the specific means of correction or amendment requested by the individual.

(d) The Department will not undertake to gather evidence for the individual, but does reserve the right to verify the evidence the individual submits.

(e) Correction or amendment of a record requested by an individual will be denied only upon a determination by the Privacy Officer that:

(1) The individual has failed to establish, by a preponderance of the evidence, the propriety of the correction or amendment in light of the criteria set forth in paragraph (c) of this section;

(2) The record sought to be corrected or amended is part of the official record in a terminated judicial, quasi-judicial or quasi-legislative proceeding to which the individual was a party or participant;

(3) The information in the record sought to be corrected or amended, or the record sought to be corrected or amended, is the subject of a pending judicial, quasi-judicial or quasi-legislative proceeding to which the individual is a party or participant;

(4) The correction or amendment would violate a duly enacted statute or promulgated regulation; or,

(5) The individual unreasonably has failed to comply with the procedural requirements of this part.

(f) If a request is partially granted and partially denied, the Privacy Officer shall follow the appropriate procedures of this section as to the records within the grant and the records within the denial.

§ 4.29 Appeal of initial adverse agency determination on correction or amendment.
top
(a) If a request for correction or amendment is denied initially under §4.28, the individual may submit a written appeal within thirty working days (i.e., excluding Saturdays, Sundays and legal public holidays) of the date of the initial denial. If an appeal is submitted by mail, the postmark is conclusive as to timeliness.

(b) An appeal should be addressed to the Assistant General Counsel for Administration, U.S. Department of Commerce, Room 5875, 14th and Constitution Avenue, NW., Washington, DC 20230. An appeal should include the words “PRIVACY APPEAL” in capital letters at the top of the letter and on the face of the envelope. An appeal not addressed and marked as provided herein will be so marked by Department personnel when it is so identified, and will be forwarded immediately to the Assistant General Counsel for Administration. An appeal which is not properly addressed by the individual will not be deemed to have been “received” for purposes of measuring the time periods in this section until actual receipt by the Assistant General Counsel for Administration. In each instance when an appeal so forwarded is received, the Assistant General Counsel for Administration shall notify the individual that his or her appeal was improperly addressed and the date on which the appeal was received at the proper address.

(c) The individual's appeal shall be signed by the individual, and shall include a statement of the reasons why the initial denial is believed to be in error, and the Department's control number assigned to the request. The Privacy Officer who issued the initial denial shall furnish to the Assistant General Counsel for Administration the record the individual requests to be corrected or amended, and all correspondence between the Privacy Officer and the requester. Although the foregoing normally will comprise the entire record on appeal, the Assistant General Counsel for Administration may seek any additional information necessary to ensure that the final determination is fair and equitable and, in such instances, disclose the additional information to the individual to the greatest extent possible, and provide an opportunity for comment thereon.

(d) No personal appearance or hearing on appeal will be allowed.

(e) The Assistant General Counsel for Administration shall act upon the appeal and issue a final determination in writing not later than thirty working days (i.e., excluding Saturdays, Sundays and legal public holidays) from the date on which the appeal is received, except that the Assistant General Counsel for Administration may extend the thirty days upon deciding that a fair and equitable review cannot be made within that period, but only if the individual is advised in writing of the reason for the extension and the estimated date by which a final determination will issue. The estimated date should not be later than the sixtieth working day after receipt of the appeal unless unusual circumstances, as described in §4.25(a), are met.

(f) If the appeal is determined in favor of the individual, the final determination shall include the specific corrections or amendments to be made and a copy thereof shall be transmitted promptly to the individual and to the Privacy Officer who issued the initial denial. Upon receipt of such final determination, the Privacy Officer shall promptly take the actions set forth in §4.28(a)(2)(i) and (b).

(g) If the appeal is denied, the final determination shall be transmitted promptly to the individual and state the reasons for the denial. The notice of final determination also shall inform the individual that:

(1) The individual has a right under the Act to file with the Assistant General Counsel for Administration a concise statement of reasons for disagreeing with the final determination. The statement ordinarily should not exceed one page and the Department reserves the right to reject an excessively lengthy statement. It should provide the Department control number assigned to the request, indicate the date of the final determination and be signed by the individual. The Assistant General Counsel for Administration shall acknowledge receipt of such statement and inform the individual of the date on which it was received;

(2) Any such disagreement statement submitted by the individual would be noted in the disputed record, and filed with it;

(3) The purposes and uses to which the statement would be put are those applicable to the record in which it is noted, and that a copy of the statement would be provided to persons and agencies to which the record is disclosed subsequent to the date of receipt of such statement;

(4) The Department would append to any such disagreement statement a copy of the final determination or summary thereof, which also would be provided to persons and agencies to which the disagreement statement is disclosed; and

(5) The individual has a right to judicial review of the final determination under 5 U.S.C. 552a(g)(1)(A), as limited by 5 U.S.C. 552a(g)(5).

(h) In making the final determination, the Assistant General Counsel for Administration shall employ the criteria set forth in §4.28(c) and shall deny an appeal only on the grounds set forth in §4.28(e).

(i) If an appeal is partially granted and partially denied, the Assistant General Counsel for Administration shall follow the appropriate procedures of this section as to the records within the grant and the records within the denial.

(j) Although a copy of the final determination or a summary thereof will be treated as part of the individual's record for purposes of disclosure in instances where the individual has filed a disagreement statement, it will not be subject to correction or amendment by the individual.

(k) The provisions of paragraphs (g)(1) through (g)(3) of this section satisfy the requirements of 5 U.S.C. 552a(e)(3).

§ 4.30 Disclosure of record to person other than the individual to whom it pertains.
top
(a) The Department may disclose a record pertaining to an individual to a person other than the individual to whom it pertains only in the following instances:

(1) Upon written request by the individual, including authorization under §4.25(f);

(2) With the prior written consent of the individual;

(3) To a parent or legal guardian under 5 U.S.C. 552a(h);

(4) When required by the Act and not covered explicitly by the provisions of 5 U.S.C. 552a(b); and

(5) When permitted under 5 U.S.C. 552a(b)(1) through (12), as follows: 3

3 5 U.S.C. 552a(b)(4) has no application within the Department.

(i) To those officers and employees of the agency that maintains the record who have a need for the record in the performance of their duties;

(ii) Required under 5 U.S.C. 552;

(iii) For a routine use as defined in 5 U.S.C. 552a(a)(7);

(iv) To the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of Title 13 of the U.S. Code;

(v) To a requester who has provided the agency with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable;

(vi) To the National Archives and Records Administration as a record that has sufficient historical or other value to warrant its continued preservation by the United States Government, or for evaluation by the Archivist of the United States, or the designee of the Archivist, to determine whether the record has such value;

(vii) To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency which maintains the record, specifying the particular portion desired and the law enforcement activity for which the record is sought;

(viii) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if upon such disclosure notification is transmitted to the last known address of such individual;

(ix) To either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee;

(x) To the Comptroller General, or any of his or her authorized representatives, in the course of the performance of the duties of the General Accounting Office;

(xi) Pursuant to the order of a court of competent jurisdiction; or

(xii) To a consumer reporting agency in accordance with 31 U.S.C. 3711(e).

(b) The situations referred to in paragraph (a)(4) of this section include the following:

(1) 5 U.S.C. 552a(c)(4) requires dissemination of a corrected or amended record or notation of a disagreement statement by the Department in certain circumstances;

(2) 5 U.S.C. 552a(d) requires disclosure of records to the individual to whom they pertain, upon request; and

(3) 5 U.S.C. 552a(g) authorizes civil action by an individual and requires disclosure by the Department to the court.

(c) The Privacy Officer shall make an accounting of each disclosure by him of any record contained in a system of records in accordance with 5 U.S.C. 552a(c)(1) and (2). Except for a disclosure made under 5 U.S.C. 552a(b)(7), the Privacy Officer shall make such accounting available to any individual, insofar as it pertains to that individual, upon any request submitted in accordance with §4.24. The Privacy Officer shall make reasonable efforts to notify any individual when any record in a system of records is disclosed to any person under compulsory legal process, promptly upon being informed that such process has become a matter of public record.

[66 FR 65632, Dec. 20, 2001, as amended at 67 FR 60282, Sept. 25, 2002]

§ 4.31 Fees.
top
(a) The only fee to be charged to an individual under this part is for duplication of records at the request of the individual. Components shall charge a fee for duplication of records under the Act in the same way in which they charge a duplication fee under §4.11, except as provided in this section. Accordingly, no fee shall be charged or collected for: search, retrieval, or review of records; copying at the initiative of the Department without a request from the individual; transportation of records; or first-class postage.

(b) The Department shall provide an individual one copy of each record corrected or amended pursuant to the individual's request without charge as evidence of the correction or amendment.

(c) As required by the United States Office of Personnel Management in its published regulations implementing the Act, the Department shall charge no fee for a single copy of a personnel record covered by that agency's Government-wide published notice of systems of records.

§ 4.32 Penalties.
top
(a) The Act provides, in pertinent part:


Any person who knowingly and willfully requests or obtains any record concerning an individual from an agency under false pretenses shall be guilty of a misdemeanor and fined not more than $5,000. (5 U.S.C. 552a(i)(3)).


(b) A person who falsely or fraudulently attempts to obtain records under the Act also may be subject to prosecution under such other criminal statutes as 18 U.S.C. 494, 495 and 1001.

§ 4.33 General exemptions.
top
(a) Individuals may not have access to records maintained by the Department but which were provided by another agency which has determined by regulation that such information is subject to general exemption under 5 U.S.C. 552a(j). If such exempt records are within a request for access, the Department will advise the individual of their existence and of the name and address of the source agency. For any further information concerning the record and the exemption, the individual must contact that source agency.

(b) The general exemptions determined to be necessary and proper with respect to systems of records maintained by the Department, including the parts of each system to be exempted, the provisions of the Act from which they are exempted, and the justification for the exemption, are as follows:

(1) Individuals identified in Export Transactions—COMMERCE/ITA–1. Pursuant to 5 U.S.C. 552a(j)(2), these records are hereby determined to be exempt from all provisions of the Act, except 5 U.S.C. 552a(b), (c)(1) and (2), (e)(4) (A) through (F), (e) (6), (7), (9), (10), and (11), and (i). These exemptions are necessary to ensure the proper functioning of the law enforcement activity, to protect confidential sources of information, to fulfill promises of confidentiality, to maintain the integrity of the law enforcement process, to avoid premature disclosure of the knowledge of criminal activity and the evidentiary bases of possible enforcement actions, to prevent interference with law enforcement proceedings, to avoid disclosure of investigative techniques, and to avoid endangering law enforcement personnel. Section 12(c) of the Export Administration Act of 1979, as amended, also protects this information from disclosure.

(2) Fisheries Law Enforcement Case Files—COMMERCE/NOAA–5. Pursuant to 5 U.S.C. 552a(j)(2), these records are hereby determined to be exempt from all provisions of the Act, except 5 U.S.C. 552a (b), (c) (1) and (2), (e) (4) (A) through (F), (e) (6), (7), (9), (10), and (11), and (i). These exemptions are necessary to ensure the proper functioning of the law enforcement activity, to protect confidential sources of information, to fulfill promises of confidentiality, to prevent interference with law enforcement proceedings, to avoid the disclosure of investigative techniques, to avoid the endangering of law enforcement personnel, to avoid premature disclosure of the knowledge of criminal activity and the evidentiary bases of possible enforcement actions, and to maintain the integrity of the law enforcement process.

(3) Investigative and Inspection Records—COMMERCE/DEPT–12. Pursuant to 5 U.S.C. 552a(j)(2), these records are hereby determined to be exempt from all provisions of the Act, except 5 U.S.C. 552a (b), (c) (1) and (2), (e)(4) (A) through (F), (e) (6), (7), (9), (10), and (11), and (i). These exemptions are necessary to ensure the proper operation of the law enforcement activity, to protect confidential sources of information, to fulfill promises of confidentiality, to prevent interference with law enforcement proceedings, to avoid the disclosure of investigative techniques, to avoid the endangering of law enforcement personnel, to avoid premature disclosure of the knowledge of criminal activity and the evidentiary bases of possible enforcement actions, and to maintain the integrity of the law enforcement process.

§ 4.34 Specific exemptions.
top
(a)(1) Certain systems of records under the Act that are maintained by the Department may occasionally contain material subject to 5 U.S.C. 552a(k)(1), relating to national defense and foreign policy materials. The systems of records published in the Federal Register by the Department that are within this exemption are: (continued)