<?xml version="1.0" encoding="UTF-8"?>


<pai>
<agency toc="yes">
<name>National Capital Planning Commission</name>
<abbrev>
NCPC
</abbrev>
<section id="ncpc1" toc="yes">
<systemNumber>-1</systemNumber>
<subsection type="systemName">Mailing Lists--NCPC.
</subsection>
<subsection type="systemLocation"><xhtmlContent><p>National Capital Planning Commission, 801 Pennsylvania Avenue, NW, Washington, DC 20576.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent><p>Federal, State, and local government officials, neighborhood groups, and private citizens in the National Capital Region.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Names and addresses of individuals and, where applicable, the organization, group, institution represented by the individual.
</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent><p>The National Capital Planning Act of 1952, as amended (40 U.S.C. 71a(c)).
</p></xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent><p>See appendix; also to provide information on Commission policy, procedures and meeting agendas to interested parties and persons.
</p></xhtmlContent></subsection>
<subsection type="policiesAndPractices"><xhtmlContent><p>Storage: </p><p>Paper.
</p></xhtmlContent></subsection>
<subsection type="retrievability"><xhtmlContent><p>Name.
</p></xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent><p>Stored in guarded building in locked files; released only to authorized personnel such as clerical staff preparing mailings to those on the list.
</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>At direction of those on list.
</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent><p>Secretariat, National Capital Planning Commission, 801 Pennsylvania Avenue, NW, Washington, DC 20576.
</p></xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent><p>Same as above.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Generally by submitting written request to the System Manager. A copy of the Commission?s Privacy Act procedures will be sent upon request.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Generally by submitting written request to the System Manager. A copy of the Commission?s Privacy Act procedures will be sent upon request.
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Individuals on whom records are maintained.
</p></xhtmlContent></subsection></section>
<section id="ncpc2" toc="yes">
<systemNumber>-2</systemNumber>
<subsection type="systemName">Personnel/Payroll-NCPC.
</subsection>
<subsection type="systemLocation"><xhtmlContent><p>General Services Administration, Region 3, 7th and D Streets, SW, Washington, DC 20407; copies held by Commission (GSA holds records for the Commission under Memorandum of Agreement).
</p></xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent><p>Commission Employees and Commission Members and Alternates.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>Payroll records including time and attendance cards, payment vouchers, comprehensive listings of employees, health benefits and Government life insurance records, requests for deductions, tax forms, W-2 forms, leave data, retirement records, notification of personnel actions.
</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent><p>Title 31, U.S.C. generally, and National Capital Planning Act of 1952 as amended (40 U.S.C. 71a(c)).
</p></xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent><p>Preparation of salary checks and maintenance of leave records; records are also released to GAO for audits, to the IRS for investigations, to Office of Personnel Management (OPM) concerning pay, benefits, retirement deductions and other information necessary for the OPM to carry out its Government wide personnel management functions. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. Routine uses of records maintained in this system shall include providing a copy of an employee?s Department of the Treasury Form W-2, Wage and Tax Statement, to the State, city, or other local jurisdiction which is authorized to tax the employee?s compensation. The record will be provided in accordance with a withholding agreement between the state, city or other local jurisdiction and the Department of the Treasury pursuant to 5 U.S.C. 5515, 5517, or 5520, on in the absence thereof, in response to a written request from an appropriate official of the taxing jurisdiction of the Executive Officer, Administration, National Capital Planning Commission, 801 Pennsylvania Avenue, NW, Washington, DC 20576. The request must include a copy of the applicable statute or ordinance authorizing the taxation of compensation and should indicate whether the authority of the jurisdiction to tax the employee is based on place of residence, place of employment, or both.
</p><p>Pursuant to a withholding agreement between a city and the Department of the Treasury (5 U.S.C. 5520), copies of executed city tax withholding certificates shall be furnished the city in response to a written request from an appropriate city official to the Executive Officer (Administration).
</p><p>In the absence of a withholding agreement, the social security number will be furnished only to a taxing jurisdiction which has furnished this agency with evidence of its independent authority to compel disclosure of the social security number, in accordance with section 7 of the Privacy Act, Pub. L. 93-579.
</p><p>Also see appendix.
</p></xhtmlContent></subsection>
<subsection type="policiesAndPractices"><xhtmlContent><p> Storage:
</p><p>NCPC files consist of paper records maintained in folders, and on automated data storage devices.
</p></xhtmlContent></subsection>
<subsection type="retrievability"><xhtmlContent><p>Name and/or Social Security Number.
</p></xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent><p>Stored in secured building in locked files, code control computers; released only to authorized personnel in Administrative Office responsible for maintaining these files.
</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>In accordance with the GSA General Records Schedule 2 and the GAO Manual for Guidance of Federal Agencies.
</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent><p>Executive Officer, Administration, National Capital Planning Commission, 801 Pennsylvania Avenue, NW, Washington, DC 20576.
</p></xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent><p>Same as above.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>Generally by submitting written request to the System Manager. A copy of the Commission?s Privacy Act procedures will be sent upon request.
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Generally by submitting written request to the System Manager. A copy of the Commission?s Privacy Act procedures will be sent upon request.
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Individuals on whom records are maintained.
</p></xhtmlContent></subsection>
<subsection type="exemptionsClaimed"><xhtmlContent><p>None.
</p></xhtmlContent></subsection></section>
<section id="ncpc3" toc="yes">
<systemNumber>-3</systemNumber>
<subsection type="systemName">Grievance Records.
</subsection>
<subsection type="systemLocation"><xhtmlContent><p>These records are located in the Administrative Office of the National Capital Planning Commission.
</p></xhtmlContent></subsection>
<subsection type="categoriesOfIndividuals"><xhtmlContent><p>Current or former employees of the National Capital Planning Commission who have submitted grievances in accordance with part 771 of the regulations of the U.S. Office of Personnel Management (5 CFR part 771).
</p></xhtmlContent></subsection>
<subsection type="categoriesOfRecords"><xhtmlContent><p>The system contains records relating to grievances filed by agency employees under part 771 of regulations issued by the U.S. Office of Personnel Management (OPM). These case files contain all documents related to the grievance, including statements of witnesses, reports of interviews and hearings, examiner?s findings and recommendations, a copy of the original and final decision, and related correspondence and exhibits.
</p></xhtmlContent></subsection>
<subsection type="authorityForMaintenance"><xhtmlContent><p>5 U.S.C. 1302, 3301, 3302, E.O. 10577, 3 CFR 1954-1958 Comp., p. 218, E.O. 10987, 3 CFR 1959-1963 Comp., p. 519, agency employees, for personal relief in a matter of concern or dissatisfaction which is subject to the control of agency management.
</p></xhtmlContent></subsection>
<subsection type="routineUsesOfRecords"><xhtmlContent><p>These records and information in these records may be used:
</p><p>(a) To disclose pertinent information to the appropriate Federal, state or local agency responsible for investigating, prosecuting, enforcing or implementing a statute, rule, regulation, or order, where the disclosing agency becomes aware of an indication of a violation or potential violation of civil or criminal law or regulation.
</p><p>(b) To disclose information to any source from which additional information is requested in the course of processing a grievance, to the extent necessary to identify the individual, inform the source of the purpose(s) of the request, and identify the type of information requested.
</p><p>(c) To disclose information to a Federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the conducting of a security or suitability investigation of an individual, the classifying of jobs, the letting of a contract or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the information is relevant and necessary to requesting the agency?s decision on the matter.
</p><p>(d) To provide information to a congressional office from the record of an individual in response to an inquiry from that congressional office made at the request of that individual.
</p><p>(e) To disclose information to another Federal agency or to a court when the Government is party to a judicial proceeding before the court.
</p><p>(f) By the National Archives and Records Administration (General Services Administration) in records management inspections conducted under authority of 44 U.S.C. 2904 and 2906.
</p><p>(g) By the Commission or by the U.S. Office of Personnel Management (OPM) in the production of summary descriptive statistics and analytical studies in support of the function for which the records are collected and maintained, or for related work force studies. While published statistics and studies do not contain individual indentifiers, in some instances the selection of elements of data included in the study may be structured in such a way as to make the data individually identifiable by inference.
</p><p>(h) To disclose information to officials of the Merit Systems Protection Board, including the Office of the Special Counsel; the Federal Labor Relations Authority and its General Counsel, or the Equal Employment Opportunity Commission when requested in performance of their authorized duties.
</p><p>(i) To disclose in response to a request for discovery or for appearance of a witness, information that is relevant to the subject matter involved in a pending judicial or administrative proceeding.
</p><p>(j) To provide information to officials of labor organizations reorganized under the Civil Service Reform Act when relevant and necessary to their duties of exclusive representation concerning personnel policies, practices, and matters affecting work conditions.
</p></xhtmlContent></subsection>
<subsection type="policiesAndPractices"><xhtmlContent><p>Storage: </p><p>These records are maintained in file folders.
</p></xhtmlContent></subsection>
<subsection type="retrievability"><xhtmlContent><p>These records are retrieved by the names of the individuals on whom they are maintained.
</p></xhtmlContent></subsection>
<subsection type="safeguards"><xhtmlContent><p>These records are maintained in lockable metal filing cabinets to which only authorized personnel have access.
</p></xhtmlContent></subsection>
<subsection type="retentionAndDisposal"><xhtmlContent><p>These records are disposed of 3 years after closing of the case. Disposal is by shredding or burning.
</p></xhtmlContent></subsection>
<subsection type="systemManager"><xhtmlContent><p>Executive Officer, National Capital Planning Commission, 801 Pennsylvania Avenue, NW, Washington, DC 20576.
</p></xhtmlContent></subsection>
<subsection type="notificationProcedure"><xhtmlContent><p>It is required that individuals submitting grievances be provided a copy of the record under the grievance process. They may, however, also contact the agency administrative office regarding the existence of such records on them. They must furnish the following information for their records to be located and identified:
</p><p>(a) Name
</p><p>(b) Date of birth
</p><p>(c) Approximate date of closing of the case and kind of action taken
</p><p>(d) Organizational component involved.
</p></xhtmlContent></subsection>
<subsection type="recordAccessProcedures"><xhtmlContent><p>It is required that individuals submitting grievances be provided a copy of the record under the grievance process. However, after the action has been closed, an individual may request access to the official copy of the grievance file by contacting the agency administrative office.
</p><p>Individuals must provide the following information for their records to be located and identified.
</p><p>(a) Name
</p><p>(b) Date of birth
</p><p>(c) Approximate date of closing of the case and kind of action taken
</p><p>(d) Organizational component involved.
</p><p>Individuals requesting access must also follow the Privacy Act regulations of the U.S. Office of Personnel Management regarding access to records and verification of identity (5 CFR 297.203 or 297.201).
</p></xhtmlContent></subsection>
<subsection type="contestingRecordProcedures"><xhtmlContent><p>Review of requests from individuals seeking amendment of their records which have been the subject of a judicial or quasi-judicial action will be limited in scope. Review of amendment requests of these records will be restricted to determining if the record accurately documents the action of the agency ruling on the case, and will not include a review of the merits of the action, determination, or finding.
</p><p>Individuals wishing to request amendment to their records to correct factual errors should contact the agency administrative office. Individuals must furnish the following information for their records to be located and identified;
</p><p>(a) Name
</p><p>(b) Date of birth
</p><p>(c) Approximate date of closing of the case and kind of action taken
</p><p>(d) Organizational component involved.
</p><p>Individuals requesting amendment must also follow the Privacy Act regulations of the U.S. Office of Personnel Management regarding amendment to records and verification of identity (5 CFR 297.208 and 297.201).
</p></xhtmlContent></subsection>
<subsection type="recordSourceCategories"><xhtmlContent><p>Information in this system of records is provided:
</p><p>(a) By the individual on whom the record is provided:
</p><p>(b) By testimony of witnesss
</p><p>(c) By agency officials
</p><p>(d) From related correspondence from organizations or persons.
</p></xhtmlContent></subsection></section>

<appendix id="app" toc="yes">
<title>NCPC</title>
<xhtmlContent><p>In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rules or order issued pursuant thereto, the relevant records in the system of records may be referred, as a "routine use", to the appropriate agency, whether Federal, State, local, or foreign, charged with the responsibility of investigating or prosecuting such violations or charged with enforcing or implemening the statute, or rule, regulation or order issued pursuant thereto.
</p><p>A record from this system of records may be disclosed as a "routine use" to a Federal, State, or local agency maintaining civil, criminal or other relevant enforcement information or other pertinent information, such as current licenses, if necessary, to obtain information relevant to an agency decision concerning the hiring or retention of any employee, the issuance of a security clearance, the letting of a contract or the issuance of a license, grant or other benefit.
</p><p>A record from this system of records may be disclosed to a Federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the information is relevant and necessary to the requesting agency?s decision in the matter.
</p><p>A record from this system or records may be disclosed to an authorized appeal grievance examiner, formal complaints examiner, equal employment opportunity investigator, arbitrator, or other duly authorized official engaged in investigation or settlement of a grievance, complaint, or appeal filed by an employee. A record from this system of records may be disclosed to the United States Civil Service Commission in accordance with the agency?s responsibility for evaluation and oversight of Federal personnel management.
</p><p>A record from this system of records may be disclosed to officers and employees of a Federal agency for purposes of audit.
</p><p>A record from this system of records may be disclosed as a "routine use" to a Member of Congress or to a congressional staff member in response to an inquiry of the congressional office made at the request of the individual about whom the record is maintained.
</p><p>A record from this system of records may be disclosed to officers and employees of the General Services Administration in connection with administrative services provided to this agency under agreement with GSA.
</p></xhtmlContent></appendix>
<regulations id="reg" toc="yes">
<regulationsTitle number="1">
<heading> General Provisions </heading>
<regulationsChapter number="VI">
<heading> National Capital Planning Commission </heading>
<regulationsPart number="603">
<heading> PRIVACY ACT REGULATIONS
</heading>
<xhtmlContent>
    <p>        Sec.

    </p>
    <p>
        603.1 Purpose and scope.

    </p>
    <p>
        603.2 Definitions.

    </p>
    <p>
        603.3 Privacy Act program responsibilities.

    </p>
    <p>
        603.4 Standard used to Maintain Records.

    </p>
    <p>
        603.5 Notice to Individuals supplying information.

    </p>
    <p>
        603.6 System of Records Notice or SORN.

    </p>
    <p>
        603.7 Procedures to safeguard Records.

    </p>
    <p>
        603.8 Employee conduct.

    </p>
    <p>
        603.9 Government contracts.

    </p>
    <p>
        603.10 Conditions of disclosure.

    </p>
    <p>
        603.11 Accounting for disclosures.

    </p>
    <p>
        603.12 Requests for notification of the existence of Records.

    </p>
    <p>
        603.13 Requests for access to Records.

    </p>
    <p>
        603.14 Requests for Amendment or Correction of Records.

    </p>
    <p>
        603.15 Requests for Accounting of Record disclosures.

    </p>
    <p>
        603.16 Appeals of Adverse Determinations.

    </p>
    <p>
        603.17 Fees.

    </p>
    <p>
        603.18 Privacy Impact Assessments.


    </p>
    <p><b>Authority:  </b>5 U.S.C. 552a as amended and 44 U.S.C. ch. 36.
    </p>

    <p><b>Source:</b> 82 FR 44046, Sept. 20, 2017, unless otherwise noted.
    </p>


    <p>
        <b>&#167;  603.1   Purpose and scope. </b>
    </p>
    <p>
        (a) This part contain the rules the National Capital Planning Commission (NCPC) shall follow to implement a privacy program as required by the Privacy Act of 1974, 5 U.S.C. 552a (Privacy Act or Act) and the privacy provisions of the E-Government Act of 2002 (44 U.S.C. ch. 36) (E-Government Act).  These rules should be read together with the Privacy Act and the privacy related provisions of the E-Government Act, which provide additional information respectively about Records maintained on individuals and protections for the privacy of personal information as agencies implement citizen-centered electronic Government.
    </p>
    <p>
        (b) Consistent with the requirements of the Privacy Act, the rules in this part apply to
        all Records maintained by NCPC in a System of Records; the responsibilities of the
        NCPC to safeguard this information; the procedures by which Individuals may request
        notification of the existence of a record, request access to Records about themselves,
        request an amendment to or correction of those Records, and request an accounting of
        disclosures of those Records by the NCPC; and the procedures by which an Individual
        may appeal an Adverse Determination.
    </p>
    <p>
        (c) Consistent with the privacy related requirements of the E-Government Act, the
        rules in this part also address the conduct of a privacy impact assessment prior to
        developing or procuring information technology that collects, maintains, or disseminates
        information in an identifiable form, initiating a new electronic collection of information
        in identifiable form for 10 or more persons excluding agencies, instrumentalities or
        employees of the federal government, or changing an existing System that creates new
        privacy risks.
    </p>
    <p>
        (d) In addition to the rules in this part, the NCPC shall process all Privacy Act
        Requests for Access to Records in accordance with the Freedom of Information Act
        (FOIA), 5 U.S.C. 552, and part 602 of this chapter.
    </p>
    <p>
        <b>&#167; 603.2 Definitions. </b>
    </p>
    <p>
        For purposes of this part, the following definitions shall apply:
    </p>
    <p>
        <i>Adverse Determination </i>shall mean a decision to withhold any requested Record in
        whole or in part; a decision that the requested Record does not exist or cannot be located;
        a decision that the requested information is not a Record subject to the Privacy Act; a

        decision that a Record, or part thereof, does not require amendment or correction; a

        decision to refuse to disclose an accounting of disclosure; and a decision to deny a fee

        waiver.  The term shall also encompass a challenge to NCPC’s determination that

        Records have not been described adequately, that there are no responsive Records or that

        an adequate search has been conducted.

    </p>
    <p>
        <i> E-Government Act of 2002 </i>shall mean Pub. L. 107–347, Dec. 17, 2002, 116 Stat. 2899,

        the privacy portions of which are set out as a note under section 3501 of title 44.

    </p>
    <p>
        <i>Individual </i>shall mean a citizen of the United States or an alien lawfully admitted for

        permanent residence.

    </p>
    <p>
        <i>Information in Identifiable Form (IIF) </i>shall mean information in an Information

        Technology system or an online collection that directly identifies an individual, e.g.,

        name, address, social security number or other identifying number or code, telephone

        number, e-mail address and the like; or information by which the NCPC intends to

        identify specific individuals in conjunction with other data elements, e.g., indirect

        identification that may include a combination of gender, race, birth date, geographic

        identifiers, and other descriptions.

    </p>
    <p><i> Information Technology (IT) </i>shall mean, as defined in the Clinger Cohen Act (40

        U.S.C. 11101(6)), any equipment, software or interconnected system or subsystem that is

        used in the automatic acquisition, storage, manipulation, management, movement,

        control, display, switching, interchange, transmission or reception of data.

    </p>
    <p>
        <i>Maintain </i>shall include maintain, collect, use or disseminate a Record.

    </p>
    <p>
        <i>Privacy Act Officer</i> shall mean the individual within the NCPC charged with

        responsibility for coordinating and implementing NCPC’s Privacy Act program.

    </p>
    <p>
        <i> Privacy Act or Act </i>shall mean the Privacy Act of 1974, as amended and codified at 5

        U.S.C. 552a.

    </p>
    <p><i>Privacy Impact Assessment (PIA) </i> shall mean an analysis of how information is handled

        to ensure handling conforms to applicable legal, regulatory, and policy requirements

        regarding privacy; to determine the risks and effects of collecting, maintaining and

        disseminating information in identifiable form in an electronic system; and to examine

        and evaluate protections and alternative processes for handling information to mitigate

        potential privacy risks.

    </p>
    <p>
        <i> Record </i>shall mean any item, collection, or grouping of information about an Individual

        that is Maintained by the NCPC, including, but not limited to, an Individual’s education,

        financial transactions, medical history, and criminal or employment history and that

        contains a name, or identifying number, symbol, or other identifying particular assigned

        to the Individual, such as a finger or voice print or photograph.

    </p>
    <p><i> Requester</i> shall mean an Individual who makes a Request for Access to a Record, a

        Request for Amendment or Correction of a Record, or a Request for Accounting of a

        Record under the Privacy Act.

    </p>
    <p><i>Request for Access to a Record </i>shall mean a request by an Individual made to the

        NCPC pursuant to subsection (d)(1) of the Privacy Act to gain access to his/her Records

        or to any information pertaining to him/her in the system and to permit him/her, or a

        person of his/her choosing, to review and copy all or any portion thereof.

    </p>
    <p>
        <i> Request for Amendment or Correction of a Record </i>shall mean a request made by an

        Individual to the NCPC pursuant to subsection (d)(2) of the Privacy Act to amend or

        correct a Record pertaining to him/her.

    </p>
    <p><i> Routine Use </i>shall mean with respect to disclosure of a Record, the use of such Record

        for a purpose which is compatible with the purpose for which the Record is collected.

    </p>
    <p><i>Senior Agency Official for Privacy </i> (SAOP) shall mean the individual within NCPC

        responsible for establishing and overseeing the NCPC’s Privacy Act program.

    </p>
    <p>
        <i> System of Records or System </i> (SOR or Systems) shall mean a group of any Records

        under the control of the NCPC from which information is retrieved by the name of the

        individual or by some identifying number, symbol, or other identifying particular

        assigned to the individual.

    </p>
    <p><i>System of Record Notice (SORN) </i>shall mean a notice published in the Federal Register

        by the NCPC for each new or revised System of Records intended to solicit public

        comment on the System prior to implementation.

    </p>
    <p>
        <i> Workday </i>shall mean a regular Federal workday excluding Saturday, Sunday and legal

        Federal holidays when the federal government is closed.
    </p>


    <p>
        <b>&#167;  603.3   Privacy Act program responsibilities. </b>
    </p>
    <p>
        (a) The NCPC shall designate a Senior Agency Official for Privacy (SAOP) to

        establish and oversee the NCPC’s Privacy Act Program and ensure compliance with

        privacy laws, regulations and the NCPC’s privacy policies.   Specific responsibilities of

        the SAOP shall include:

    </p>
    <p>
        (1) Reporting to the Office of Management and Budget (OMB) and Congress on the

        establishment of or revision to Privacy Act Systems;

    </p>
    <p>
        (2) Reporting periodically to OMB on Privacy Act activities as required by law and

        OMB;

    </p>
    <p>
        (3) Signing Privacy Act SORNS for publication in the Federal Register;

    </p>
    <p>
        (4) Approving and signing PIAs; and

    </p>
    <p>
        (5) Serving as head of the agency response team when responding to a large-scale

        information breach.

    </p>
    <p>
        (b) The NCPC shall designate a Privacy Act Officer (PAO) to coordinate and

        implement the NCPC’s Privacy Act program.   Specific responsibilities of the PAO shall

        include:

    </p>
    <p>
        (1) Developing, issuing and updating, as necessary, the NCPC’s Privacy Act policies,

        standards, and procedures;

    </p>
    <p>
        (2) Maintaining Privacy Act program Records and documentation;

    </p>
    <p>
        (3) Responding to Privacy Act Requests for Records and coordinating appeals of

        Adverse Determinations for Requests for access to Records, Requests for Amendment or

        Correction of Records, and Requests for accounting for disclosures;

    </p>
    <p>
        (4) Informing Individuals of information disclosures;

    </p>
    <p>
        (5) Working with the NCPC’s Division Directors or designated staff to develop an

        appropriate form for collection of Privacy Act information and including in the form a

        Privacy Act statement explaining the purpose for collecting the information, how it will

        be used, the authority for such collection, its routine uses, and the effect upon the

        Individual of not providing the requested information;

    </p>
    <p>
        (6) Assisting in the development of new or revised SORNs;

    </p>
    <p>
        (7) Developing SORN reports for OMB and Congress;

    </p>
    <p>
        (8) Submitting new or revised SORNS to the Federal Register for publication;

    </p>
    <p>
        (9) Assisting in the development of computer matching systems;

    </p>
    <p>
        (10) Preparing Privacy Act, Computer Matching, and other reports to OMB as

        required;  and

    </p>
    <p>
        (11) Evaluating PIA to ensure compliance with E-Government Act requirements.

    </p>
    <p>
        (c) Other Privacy related responsibilities shall be shared by the NCPC Division

        Directors, the NCPC Chief Information Officer (CIO), the NCPC System Developers and

        Designers, the NCPC Configuration Control Board, the NCPC employees, and the

        Chairman of the Commission.

    </p>
    <p>
        (1) The NCPC Division Directors shall be responsible for coordinating with the PAO

        the implementation of the requirements set forth in this part for Systems of Records

        applicable to their area of management and the preparation of PIA prior to development

        or procurement of new systems that collect, maintain or disseminate IIF.  Specific

        responsibilities include:

    </p>
    <p>
        (i) Reviewing existing SOR for need, relevance, and purpose for existence,

        and proposing SOR changes to the PAO as necessary in response to altered

        circumstances;

    </p>
    <p>
        (ii) Reviewing existing SOR to ensure information is accurate, complete and up

        to date;

    </p>
    <p>
        (iii) Coordinating with the PAO the preparation of new or revised SORN;

    </p>
    <p>
        (iv) Coordinating with the PAO the development of an appropriate form for collection

        of Privacy Act information and including in the form a Privacy Act statement explaining

        the purpose for collecting the  information, how it will be used, the authority for such

        collection, its routine uses, and the effect upon the Individual of not providing the

        requested information;

    </p>
    <p>
        (v) Collecting information directly from individuals whenever possible;

    </p>
    <p>
        (vi) Assisting the PAO with providing access to Individuals who request information

        in accordance with the procedures established in §§603.12, 603.13, 603.14 and 603.15.

    </p>
    <p>
        (vii) Amending Records if and when appropriate, and working with the PAO to inform

        recipients of former Records of such amendments;

    </p>
    <p>
        (viii) Ensuring that System information is used only for its stated purpose;

    </p>
    <p>
        (ix) Establishing and overseeing appropriate administrative, technical, and physical

        safeguards to ensure security and confidentiality of Records; and

    </p>
    <p>
        (x) Working with the SAOP, the PAO and Configuration Control Board (CCB) on

        SORs, preparing a PIA, if needed, and obtaining SAOP approval for a PIA prior to its

        publication on the NCPC website.

    </p>
    <p>
        (2) The CIO shall be responsible for implementing IT security management to include

        security for information protected by the Privacy Act and the E-Government Act of 2002.

        Specific responsibilities include:

    </p>
    <p>
        (i) Overseeing security policy for privacy data; and

    </p>
    <p>
        (ii) Reviewing PIAs prepared for information security considerations.

    </p>
    <p>
        (3) The NCPC System Developers and Designers shall be responsible for ensuring that

        the IT system design and specifications conform to privacy standards and requirements

        and that technical controls are in place for safeguarding personal information from

        unauthorized access.

    </p>
    <p>
        (4) The NCPC CCB shall, among other responsibilities, verify that a PIA has been

        prepared prior to approving a request to develop or procure information technology that

        collects, maintains, or disseminates Information in Identifiable Form.

    </p>
    <p>
        (5) The NCPC employees shall ensure that any personal information they use in the

        conduct of their official responsibilities is protected in accordance with the rules set forth

        in this part.

    </p>
    <p>
        (6) The Chairman of the Commission shall be responsible for acting on all appeals of

        Adverse Determinations.
    </p>

    <p>
        <b>&#167; 603.4 Standards used to Maintain Records. </b>
    </p>
    <p>

        (a) Records Maintained by the NCPC shall contain only such information about an

        Individual as is relevant and necessary to accomplish a purpose NCPC must accomplish

        to comply with relevant statutes or Executive Orders of the President.

    </p>
    <p>
        (b) Records Maintained by the NCPC and used to make a determination about an

        Individual shall be accurate, relevant, timely, and complete to assure a fair determination.

    </p>
    <p>
        (c) Information used by the NCPC in making a determination about an Individual’s

        rights, benefits, and privileges under federal programs shall be collected, to the greatest

        extent practicable, directly from the Individual.  In deciding whether collection of

        information about an Individual, as opposed to a third party is practicable, the NCPC

        shall consider the following:

    </p>
    <p>
        (1) Whether the information sought can only be obtained from a third party;

    </p>
    <p>
        (2) Whether the cost to collect the information from an Individual is unreasonable

        compared to the cost of collecting the information from a third party;

    </p>
    <p>
        (3) Whether there is a risk of collecting inaccurate information from a third party that

        could result in a determination adverse to the Individual concerned;

    </p>
    <p>
        (4) Whether the information collected from an Individual requires verification by a

        third party; and

    </p>
    <p>
        (5) Whether the Individual can verify information collected from third parties.

    </p>
    <p>
        (d) The NCPC shall not Maintain Records describing how an Individual exercises

        rights guaranteed by the First Amendment to the Constitution unless the maintenance of

        the Record is expressly authorized by statute or by the Individual about whom the Record

        is Maintained or pertinent to and within the scope of an authorized law enforcement

        activity.
    </p>


    <p>
        <b>&#167; 603.5 Notice to Individuals supplying information. </b>
    </p>
    <p>
        (a) Each Individual asked to supply information about himself/herself to be added to a

        System of Records shall be informed by the NCPC of the basis for requesting the

        information, its potential use, and the consequences, if any, of not supplying the

        information.  Notice to the Individual shall state at a minimum:

    </p>
    <p>
        (1) The legal authority for NCPC’s solicitation of the information and whether

        disclosure is mandatory or voluntary;

    </p>
    <p>
        (2) The principal purpose(s) for which the NCPC intends to use the information;

    </p>
    <p>
        (3) The potential routine uses of the information by the NCPC as published in a

        Systems of Records Notice; and

    </p>
    <p>
        (4) The effects upon the individual, if any, of not providing all or any part of the

        requested Information to the NCPC.

    </p>
    <p>
        (b) When NCPC collects information on a standard form, the notice to the Individual

        shall either be provided on the form, on a tear off sheet attached to the form, or on a

        separate form, whichever is deemed the most practical by the NCPC.

    </p>
    <p>
        (c) NCPC may ask an Individual to acknowledge, in writing, receipt of the notice

        required by this section.
    </p>

    <p>
        <b>&#167; 603.6 System of Records Notice or SORN. </b>
    </p>
    <p>
        (a) The NCPC shall publish a notice in the Federal Register describing each System of

        Records 40-days prior to the establishment of a new or revision to an existing System of

        Records.

    </p>
    <p>
        (b) The SORN shall include:

    </p>
    <p>
        (1) The name and location of the System of Records.  The name shall identify the

        general purpose, and the location shall include whether the system is located on the

        NCPC’s main server or central files.  The physical address of either shall also be

        included.

    </p>
    <p>
        (2) The categories or types of Individuals on whom NCPC Maintains Records in the

        System of Records;

    </p>
    <p>
        (3) The categories or types of Records in the System;

    </p>
    <p>
        (4) The statutory or Executive Order authority for Maintenance of the System;

    </p>
    <p>
        (5) The purpose(s) or explanation of why the NCPC collects the particular Records

        including identification of all internal and routine uses;

    </p>
    <p>
        (6) The policies and practices of the NCPC regarding storage, retrieval, access

        controls, retention and disposal of Records;

    </p>
    <p>
        (7) The title and business address of the agency official responsible for the identified

        System of Records;

    </p>
    <p>
        (8) The NCPC procedures for notification to an Individual who requests if a System of

        Records contains a Record about the Individual; and

    </p>
    <p> (9) The NCPC sources of Records in the System.</p>

    <p>
        <b>&#167; 603.7 Procedures to safeguard Records. </b>
    </p>
    <p>
        (a) The NCPC shall implement the procedures set forth in this section to insure sufficient administrative, technical and physical safeguards exist to protect the security and confidentiality of Records.  The enumerated procedures shall also protect against any anticipated threats or hazards to the security of Records with the potential to cause substantial harm, embarrassment, inconvenience, or unfairness to any Individual on whom information is Maintained.
    </p>
    <p>
        (b) Manual Records subject to the Privacy Act shall be maintained by the NCPC in a

        manner commensurate with the sensitivity of the information contained in the Records.

        The following minimum safeguards or safeguards affording comparable protection shall

        apply to manual Systems of Records:

    </p>
    <p>
        (1) The NCPC shall post areas where Records are maintained or regularly used with an

        appropriate warning sign stating access to the Records shall be limited to authorized

        persons.  The warning shall also advise that the Privacy Act prescribes criminal penalties

        for unauthorized disclosure of Records subject to the Act.

    </p>
    <p>
        (2) During work hours, the NCPC shall protect areas in which Records are Maintained

        or regularly used by restricting occupancy of the area to authorized persons or storing the

        Records in a locked container and room.

    </p>
    <p>
        (3) During non-working hours, access to Records shall be restricted by their storage in

        a locked storage container and room.

    </p>
    <p>
        (4) Any lock used to secure a room where Records are stored shall not be capable of

        being disengaged with a master key that opens rooms other than those in which Records

        are stored.

    </p>
    <p>
        (c) Computerized Records subject to the Privacy Act shall be maintained, at a

        minimum, subject to the safeguards recommended by the National Institute of Standards

        and Technology (NIST) Special Publications 800-53, Recommended Security Controls

        for Federal Information Systems and Organizations as revised from time to time or any

        superseding guidance offered by NIST or other federal agency charged with the

        responsibility for providing recommended safeguards for computerized Records subject

        to the Privacy Act.

    </p>
    <p>
        (d) NCPC shall maintain a System of Records comprised of Office of Personnel

        Management (OPM) personnel Records in accordance with standards prescribed by OPM

        and published at 5 CFR 293.106 - 293.107.
    </p>

    <p>
        <b>&#167; 603.8 Employee conduct. </b>
    </p>
    <p>
        (a) Employees with duties requiring access to and handling of Records shall, at all

        times, take care to protect the integrity, security, and confidentiality of the Records.

    </p>
    <p>
        (b) No employee of the NCPC shall disclose Records unless disclosure is permitted by

        § 603.10(b), by part 602 of this chapter, or disclosed to the Individual to

        whom the Record pertains.

    </p>
    <p>
        (c) No employee of the NCPC shall alter or destroy a Record unless such Record or

        destruction is undertaken in the course of the employee’s regular duties or such alteration

        or destruction is allowed pursuant to regulations published by the National Archives and

        Records Administration (NARA) or required by a court of competent jurisdiction.

        Records shall not be destroyed or disposed of while they are the subject of a pending

        request, appeal or lawsuit under the Privacy Act.
    </p>

    <p>
        <b>&#167;  603.9 Government contracts. </b>
    </p>
    <p>
        (a) When a contract provides for third party operation of a SOR on behalf of the NCPC

        to accomplish a NCPC function, the contract shall require that the requirements of the

        Privacy Act and the rules in this part be applied to such System.

    </p>
    <p>
        (b) The Division Director responsible for the contract shall designate a NCPC

        employee to oversee and manage the SOR operated by the contractor.
    </p>

    <p>
        <b>&#167; 603.10 Conditions for disclosure. </b>
    </p>
    <p>
        (a) Except as set forth in paragraph (b) of this section, no Record contained in a SOR shall be disclosed by any means of communication to any person, or to another agency, unless prior written consent is obtained from the Individual to whom the Record pertains.
    </p>
    <p>
        (b) The limitations on disclosure contained in paragraph (a) of this section shall not apply when disclosure of a Record is:
    </p>
    <p>
        (1) To employees of the NCPC for use in the performance of their duties;

    </p>
    <p>
        (2) Required by the Freedom of Information Act (FOIA), 5 U.S.C. 555;

    </p>
    <p>
        (3) For a Routine Use as described in a SORN;

    </p>
    <p>
        (4) To the Bureau of Census for statistical purposes, provided that the Record must be

        transferred in a form that precludes individual identification;

    </p>
    <p>
        (5) To an Individual who provides NCPC adequate written assurance that the Record

        shall be used solely for  statistical or research purposes, provided that the Record must be

        transferred in a form that precludes Individual identification;

    </p>
    <p>
        (6) To the NARA because the Record warrants permanent retention because of

        historical or other national value as determined by NARA or to permit NARA to

        determine whether the Record has such value;

    </p>
    <p>
        (7) To a law enforcement agency for a civil or criminal law enforcement activity,

        provided that the law enforcement agency must submit a written request to the NCPC

        specifying the Record(s) sought and the purpose for which they will be used;

    </p>
    <p>
        (8) To any person upon demonstration of compelling information that an Individual’s

        health or safety is at stake and provided that upon disclosure, notification is given to the

        Individual to whom the Record pertains at that Individual’s last known address;

    </p>
    <p>
        (9) To either House of Congress, and any committee or subcommittee thereof, to

        include joint committees of both houses and any subcommittees thereof, when a Record

        falls within their jurisdiction;

    </p>
    <p>
        (10) To the Comptroller General, or any of his authorized representatives, to allow the

        Government Accountability Office to perform its duties;

    </p>
    <p>
        (11) Pursuant to a court order by a court of competent jurisdiction; and

    </p>
    <p>
        (12) To a consumer reporting agency trying to collect a claim of the government as

        authorized by 31 U.S.C. 3711(e).
    </p>

    <p>
        <b>&#167; 603.11 Accounting of disclosures. </b>
    </p>
    <p>
    </p>
    <p>
        (a) Except for disclosures made under §§ 603.10 (b)(1)-(2), when a Record is disclosed

        to any person, or to another agency, NCPC shall prepare an accounting of the disclosure.

        The accounting shall Record the date, nature, and purpose of the disclosure and the name

        and address of the person or agency to whom the disclosure was made.  The NCPC shall

        maintain all accountings for a minimum of five years or the life of the Record, whichever

        is greatest, after the disclosure is made.

    </p>
    <p>
        (b) Except for disclosures under § 603.10(b)(7), accountings of all disclosures shall be

        made available to the Individual about whom the disclosed Records pertains at his/her

        request.  Such request shall be made in accordance with the requirements of § 603.15.

    </p>
    <p>
        (c) For any disclosure for which an accounting is made, if a subsequent amendment or

        correction or notation of dispute is made to a Record by the NCPC in accordance with the

        requirements of § 603.14, the Individual and/or agency to whom the Record was

        originally disclosed shall be informed.
    </p>

    <p>
        <b>&#167; 603.12 Requests for notification of the existence of Records. </b>
    </p>
    <p>
        (a) An Individual seeking to determine whether a System of Records contains Records pertaining to him/her shall do so by appearing in person at NCPC’s official place of business or by written correspondence to the NCPC PAO.  In-person requests shall be by appointment only with the PAO on a Workday during regular office hours. Written
        requests sent via the U.S. mail shall be directed to the Privacy Act Officer at NCPC’s
        official address listed at www.ncpc.gov.  If sent via e-mail or facsimile, the request shall

        be directed to the e-mail address or facsimile number indicated on the NCPC web-site.

        To expedite internal handling of Privacy Act Requests, the words Privacy Act Request

        shall appear prominently on the envelop or the subject line of an e-mail or facsimile

        cover sheet.

    </p>
    <p>
        (b) The Request shall state that the Individual is seeking information concerning the

        existence of Records about himself/herself and shall supply information describing the

        System where such Records might be maintained as set forth in a System of Record

        Notice.

    </p>
    <p>
        (c) The NCPC PAO shall notify the Requester in writing within 20 Workdays of the

        Request whether a System contains Records pertaining to him/her unless the Records

        were compiled in reasonable anticipation of a civil action or proceeding or the Records

        are NCPC employee Records under the jurisdiction of the OPM. In both of the later cases

        the Request shall be denied.  If the Request is denied because the Record(s) is/are under

        the jurisdiction of the OPM, the response shall advise the Requester to contact OPM.  If

        the PAO denies the Request, the response shall state the reason for the denial and advise

        the Requester of the right to appeal the decision within 60 days of the date of the letter

        denying the request in accordance with the requirements set forth in § 603.16.
    </p>

    <p>
        <b>&#167; 603.13 Requests for access to Records. </b>
    </p>
    <p>
        (a) An Individual seeking access to Records about himself/herself shall do so by

        appearing in person at NCPC’s official place of business or by written  correspondence to

        the NCPC Privacy Act Officer.  In-person requests shall be by appointment only with the

        Privacy Act Officer on a Workday during regular office hours.  For written requests sent

        via the U.S. mail, the Request shall be directed to the Privacy Act Officer at NCPC’s

        official address listed at www.ncpc.gov.  If sent via e-mail or facsimile, the request shall

        be directed to the e-mail address or facsimile number indicated on the NCPC web-site.

        To expedite internal handling of Privacy Act Requests, the words Privacy Act Request

        shall appear prominently on the envelop or the subject line of an e-mail or facsimile

        cover sheet.

    </p>
    <p>
        (b) The Request shall:

    </p>
    <p>
        (1) State the Request is made pursuant to the Privacy Act;

    </p>
    <p>
        (2) Describe the requested Records in sufficient detail to enable their location

        including, without limitation, the dates the Records were compiled and the name or

        identifying number of each System of Record in which they are kept as identified in the

        list of NCPC’s SORNs published on its website; and

    </p>
    <p>
        (3) State pursuant to the fee schedule in set forth in § 603.17 a willingness to pay all

        fees associated with the Privacy Act Request or the maximum fee the Requester is willing

        to pay.

    </p>
    <p>
        (c) The NCPC shall require identification as follows before releasing Records to an

        Individual:

    </p>
    <p>
        (1) An Individual Requesting Privacy Act Records in person shall present a valid,

        photographic form of identification such as a driver’s license, employee identification

        card, or passport that  renders it possible for the PAO to verify that the Individual is the

        same Individual as contained in the requested Records.

    </p>
    <p>
        (2) An Individual Requesting Privacy Act Records by mail shall state their full name,

        address and date of birth in their correspondence.  The Request must be signed and the

        signature must either be notarized or submitted with a statement signed and dated as

        follows:  I declare under penalty of perjury that the foregoing facts establishing my

        identification are true and correct.

    </p>
    <p>
        (d) The PAO shall determine within 20 Workdays whether to grant or deny an

        Individual’s Request for Access to the requested Record(s) and notify the Individual in

        writing accordingly.  The PAO’s response shall state his/her determination and the

        reasons therefor.  If the Request is denied because the Record(s) is/are under the

        jurisdiction of the OPM, the response shall advise the Requester to contact OPM.  In the

        case of an Adverse Determination, the written notification shall advise the Individual of

        his/her right to appeal the Adverse Determination in accordance with the requirements of

        &#167;   603.16.
    </p>

    <p>
        <b>&#167;  603.14 Requests for Amendment or Correction of Records. </b>
    </p>
    <p>
        (a) An Individual seeking to amend or correct a Record pertaining to him/her that

        he/she believes to be inaccurate, irrelevant, untimely or incomplete shall submit a written

        request to the PAO at the address listed on NCPC’s official website www.ncpc.gov. If

        sent via e-mail or facsimile, the Request shall be directed to the e-mail address or

        facsimile number indicated on the NCPC web-site.  To expedite internal handling, the

        words Privacy Act Request shall appear prominently on the envelop or the subject line of

        an e-mail or facsimile cover sheet.

    </p>
    <p>
        (b) The Request shall:

    </p>
    <p>
        (1) State the Request is made pursuant to the Privacy Act;

    </p>
    <p>
        (2) Describe the requested Record in sufficient detail to enable its location including,

        without limitation, the dates the Records was compiled and the name or identifying

        number of the System of Record in which the Record is kept as identified in the list of

        NCPC’s SORNs published on its website;

    </p>
    <p>
        (3) State in detail the reasons why the Record, or objectionable portion(s) thereof,

        is/are not accurate, relevant, timely or complete.

    </p>
    <p>
        (4) Include copies of documents or evidence relied upon in support of the Request for

        Amendment or Correction; and

    </p>
    <p>
        (5) State specifically, and in detail, the changes sought to the Record, and if the

        changes include rewriting the Record, or portions thereof, or adding new language, the

        Individual shall propose specific language to implement the requested changes.

    </p>
    <p>
        (c)  A request to Amend or Correct a Record shall be submitted only if the Requester

        has previously requested and been granted access to the Record and has inspected or been

        given a copy of the Record.

    </p>
    <p>
        (d) The PAO shall render a decision within 20 Workdays.  If the Request for an

        Amendment or Correction fails to meet the requirements of paragraphs (b)(1)-(5) of this section, the PAO shall advise the Individual of the deficiency and advise what additional
        information is required to act upon the Request.  The timeframe for a decision on the

        Request shall be tolled (stopped) during the pendency of a request for additional

        information and shall resume when the additional information is received.  If the

        Requester fails to submit the requested additional information within a reasonable time,

        the PAO shall reject the Request.

    </p>
    <p>
        (e) The PAO’s decision on a Request for Amendment or Correction shall be in writing

        and state the basis for the decision.  If the Request is denied because the Record(s) is/are

        under the jurisdiction of the OPM, the response shall advise the Requester to contact

        OPM.  In the event of an Adverse Determination, the written notification shall advise the

        Individual of his/her right to appeal the Adverse Determination in accordance with the

        requirements of &#167;  603.16.

    </p>
    <p>
        (f) If the PAO approves the Request for Amendment or Correction, the PAO shall

        ensure that subject Record is amended or corrected, in whole or in part.  If the PAO

        denies the Request for Amendment or Correction, a notation of dispute shall be noted on

        the Record. If an accounting of disclosure has been made pursuant to § 603.11, the

        PAO shall advise all previous recipients of the Record that an amendment or correction

        or notation of dispute has been made and, if applicable, the substance of the change.
    </p>


    <p>
        <b>&#167; 603.15 Requests for Accounting of Record disclosures. </b>
    </p>
    <p>

        (a) An Individual seeking information regarding an accounting of disclosure of a

        Record pertaining to him/her made in accordance with &#167;  603.11 shall submit a written

        request  to the PAO at the address listed on NCPC’s official website www.ncpc.gov. If

        sent via e-mail or facsimile, the Request shall be directed to the e-mail address or

        facsimile number indicated on the NCPC web-site.  To expedite internal handling, the

        words Privacy Act Request shall appear prominently on the envelop or the subject line of

        an e-mail or facsimile cover sheet.

    </p>
    <p>
        (b) The Request shall:

    </p>
    <p>
        (1) State the Request is made pursuant to the Privacy Act;  and
    </p>
    <p>
        (2) Describe the requested Record in sufficient detail to determine whether it is or is not  contained in an accounting of disclosure.

    </p>
    <p>
        (c) The NCPC PAO shall notify the Requester in writing within 20 Workdays of the

        Request and advise if the Record was included in an accounting of disclosure.  In the

        event of a disclosure, the response shall include the date, nature, and purpose of the

        disclosure and the name and address of the person or agency to whom the disclosure was

        made.   If the Request is denied because the Record(s) is/are under the jurisdiction of the

        OPM, the response shall advise the Requester to contact OPM.  In the event of an

        Adverse Determination, the written notification shall advise the Individual of his/her right

        to appeal the Adverse Determination in accordance with the requirements of &#167;   603.16.
    </p>


    <p>
        <b>&#167; 603.16 Appeals of Adverse Determinations. </b>
    </p>
    <p>

        (a) Except for appeals pursuant to paragraph (d) of this section, an appeal of an Adverse Determination shall be made in writing addressed to the Chairman (Chairman) of the National Capital Planning Commission at the address listed on NCPC’s official website www.ncpc.gov.  If sent via e-mail or facsimile, the Request shall be directed to the e-mail address or facsimile number indicated on the NCPC web-site.  To expedite internal handling, the words Privacy Act Request shall appear prominently on the envelop or the subject line of an e-mail or facsimile cover sheet.  An appeal of an Adverse Determination shall be made within 30 Workdays of the date of the decision.
    </p>
    <p>
        (b) An appeal of an Adverse Determination shall include a statement of the legal,

        factual or other basis for the Requester’s objection to an Adverse Determination; a

        daytime phone number or e-mail where the Requester can be reached if the Chairman

        requires additional information or clarification regarding the appeal; copies of the initial

        request and the PAO’s written response; and for an Adverse Determination regarding a

        fee waiver, a demonstration of compliance with part 602 of this chapter.

    </p>
    <p>
        (c) The Chairman shall respond to an appeal of an Adverse Determination in writing

        within 20 Workdays of receipt of the appeal.  If the Chairman grants the appeal, the

        Chairman shall notify the Requester, and the NCPC shall take prompt action to respond

        affirmatively to the original Request upon receipt of any fees that may be required.  If the

        Chairman denies the appeal, the letter shall state the reason(s) for the denial, a statement

        that the decision is final, and advise the Requester of the right to seek judicial review of

        the denial in the District Court of the United States in either the district in which the

        Requester resides, the district in which the Requester has his/her principal place of

        business or the District of Columbia.

    </p>
    <p>
        (d) The appeal of an Adverse Determination based on OPM jurisdiction of the Records

        shall be made to OPM pursuant to 5 CFR 297.306.

    </p>
    <p>
        (e) The NCPC shall not act on an appeal of an Adverse Determination if the underlying

        Request becomes the subject of litigation.

    </p>
    <p>
        (f) A party seeking court review of an Adverse Determination must first appeal the

        Adverse Determination under this section.
    </p>

    <p>
        <b>&#167; 603.17 Fees. </b>
    </p>
    <p>
        (a) The NCPC shall charge for the duplication of Records under this subpart in

        accordance with the schedule of fees set forth in part 602 of this chapter.  The NCPC

        shall not charge duplication fees when the Requester asks to inspect the Records

        personally but is provided copies at the discretion of the agency.

    </p>
    <p>
        (b) The NCPC shall not charge any fees for the search for or review of Records

        requested by an Individual.
    </p>

    <p>
        <b>&#167; 603.18  Privacy Impact Assessments. </b>
    </p>
    <p>

        (a) Consistent with the requirements of the E-Government Act and OMB Memorandum

        M-03-22, the NCPC shall conduct a PIA before:

    </p>
    <p>
        (1) Developing or procuring IT systems or projects that collect, maintain, or

        disseminate IIF; or

    </p>
    <p>
        (2) Installing a new collection of information that will be collected, maintained, or

        disseminated using IT and includes IIF for 10 or more persons (excluding agencies,

        instrumentalities or employees of the federal government).

    </p>
    <p>
        (b) The PIA shall be prepared through the coordinated effort of the NCPC’s privacy

        Officers (SAOP, PAO), Division Directors, CIO, and IT staff.

    </p>
    <p>
        (c) As a general rule, the level of detail and content of a PIA shall be commensurate

        with the nature of the information to be collected and the size and complexity of the IT

        system involved.  Specifically, a PIA shall analyze and describe:

    </p>
    <p>
        (1) The information to be collected;

    </p>
    <p>
        (2) The reason the information is being collected;

    </p>
    <p>
        (3) The intended use for the information;

    </p>
    <p>
        (4) The identity of those with whom the information will be shared;

    </p>
    <p>
        (5) The opportunities Individuals have to decline to provide the information or to

        consent to particular uses and how to consent;

    </p>
    <p>
        (6) The manner in which the information will be secured; and

    </p>
    <p>
        (7) The extent to which the system of records is being created under the Privacy Act.

    </p>
    <p>
        (d)  In addition to the information specified in paragraphs (b)(1)-(7) of this section, the PIA must also identify the choices NCPC made regarding an IT system or collection of information as result of preparing the PIA.
    </p>
    <p>
        (e) The CCB shall verify that a PIA has been prepared prior to approving a request to

        develop or procure information technology that collects, maintains, or disseminates

        Information in Identifiable Form.

    </p>
    <p>
        (f) The SAOP shall approve and sign the NCPC’s PIA.  If the SAOP is the Contracting

        Officer for the IT system that necessitated preparation of the PIA, the Executive Director

        shall approve and sign the PIA.

    </p>
    <p>
        (g) Following approval of the PIA, the NCPC shall post the PIA document on the

        NCPC website located at <i>www.ncpc.gov. </i>
    </p>

</xhtmlContent>
</regulationsPart>
</regulationsChapter>
</regulationsTitle>
</regulations>
</agency>
</pai>
