[Federal Register Volume 61, Number 190 (Monday, September 30, 1996)]
[Rules and Regulations]
[Pages 51004-51008]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 96-24783]


=======================================================================
-----------------------------------------------------------------------

UNITED STATES INFORMATION AGENCY

22 CFR Part 505


Privacy Act Regulation

AGENCY: United States Information Agency.

ACTION: Interim final rule with request for comments.

-----------------------------------------------------------------------

SUMMARY: This interim final rule will amend the existing Privacy Act 
Regulation implementing the Privacy Act of 1974, as amended. Changes in 
the regulation are to reconcile them with changes in the law and Agency 
policy. The Agency expects the amended regulation will enable Privacy 
Act requesters to better understand how to make requests and how the 
Agency responds to such requests.

DATES EFFECTIVE: October 15, 1996. Comments regarding this interim 
final rule will be accepted until October 30, 1996.

ADDRESSES: Comments may be mailed to the FOIA/Privacy Act Officer, U.S. 
Information Agency, Room M-29, 301 4th Street, SW., Washington, DC. 
20547.

FOR FURTHER INFORMATION CONTACT:
FOIA/PA Unit, U.S. Information Agency, Room M-29, 301 4th Street, SW., 
Washington, DC. 20547; telephone (202) 619-5499.

SUPPLEMENTARY INFORMATION: The privacy of each individual is directly 
affected by the collection, maintenance, use and dissemination of 
personal information by Federal agencies. In order to protect the 
privacy of individuals identified in information systems maintained by 
Federal agencies, it is important to regulate the collection, 
maintenance, use and dissemination of such information by such 
agencies. Therefore it becomes paramount to ensure that regulations 
implementing the law are clear and readily understandable to the 
public.

List of Subjects in 22 CFR Part 505

    Privacy.

    For the reasons given in the preamble, Part 505 of Title 22 is 
revised to read as follows:

PART 505--PRIVACY ACT POLICIES AND PROCEDURES

Sec.
505.1  Purpose and scope.
505.2  Definitions.
505.3  Procedures for requests.
505.4  Requirements and identification for making requests.
505.5  Disclosure of information.
505.6  Medical records.
505.7  Correction or amendment of record.
505.8  Agency review of requests for changes.
505.9  Review of adverse agency determination.
505.10  Disclosure to third parties.
505.11  Fees.
505.12  Civil remedies and criminal penalties.
505.13  General exemptions (Subsection J).
505.14  Specific exemptions (Subsection K).
505.15  Exempt systems of records.

    Authority: Pub. L. 93-579, 88 Stat. 1897; 5 U.S.C. 552a; 55 FR 
31940, Aug. 6, 1990, as amended.


Sec. 505.1  Purpose and scope.

    The United States Information Agency will protect individuals' 
privacy from

[[Page 51005]]

misuse of their records, and grant individuals access to records 
concerning them which are maintained by the Agency's domestic and 
overseas offices, consistent with the provisions of Pub. L. 93-579, 88 
Stat. 1897; 5 U.S.C. 552a, the Privacy Act of 1974, as amended. The 
Agency has also established procedures to permit individuals to amend 
incorrect records, to limit the disclosure of personal information to 
third parties, and to limit the number of sources of personal 
information. The Agency has also established internal rules restricting 
requirements of individuals to provide social security account numbers.


Sec. 505.2  Definitions.

    (a) Access Appeal Committee (AAC)--the body established by and 
responsible to the Director of USIA for reviewing appeals made by 
individuals to amend records held by the Agency.
    (b) Agency or USIA or USIS--The United States Information Agency, 
its offices, divisions, branches and its Foreign Service 
establishments.
    (c) Amend--To make a correction to or expunge any portion of a 
record about an individual which that individual believes is not 
accurate, relevant, timely or complete.
    (d) Individual--A citizen of the United States or an alien lawfully 
admitted for permanent residence.
    (e) Maintain--Collect, use, disseminate or any combination of these 
record-keeping functions; exercise of control over and hence 
responsibility and accountability for systems of records.
    (f) Record--Any information maintained by the Agency about an 
individual that can be reproduced, including finger or voice prints and 
photographs, and which is retrieved by that particular individual's 
name or personal identifier, such as a social security number.
    (g) Routine use--With respect to the disclosure of a record, the 
use of such record for a purpose which is compatible with the purpose 
for which it was collected. The common and ordinary purposes for which 
records are used and all of the proper and necessary uses, even if any 
such uses occur infrequently.
    (h) Statistical record--A record in a system of records maintained 
for statistical research or reporting purposes only and not used in 
whole or in part in making any determination about an identifiable 
individual, except as provided in 13 U.S.C. 8.
    (i) System of records--A group of records under the maintenance and 
control of the Agency from which information is retrieved by the name 
or personal identifier of the individual.
    (j) Personnel record--Any information about an individual that is 
maintained in a system of records by the Agency that is needed for 
personnel management or processes such as staffing, employee 
development, retirement, grievances and appeals.
    (k) Post--Any of the foreign service branches of the Agency.


Sec. 505.3  Procedures for requests.

    (a) The Agency will consider all written requests received from an 
individual for records pertaining to herself/himself as a request made 
under the Privacy Act of 1974, as amended (5 U.S.C. 552a) whether or 
not the individual specifically cites the Privacy Act when making the 
request.
    (b) All requests under the Privacy Act should be directed to the 
USIA, Office of the General Counsel, FOIA/Privacy Act Unit (GC/FOI), 
301 4th Street, SW., Washington, DC 20547, which will coordinate the 
search of all systems of records specified in the request. Requests 
should state name, date of birth, and social security number.
    (c) Requests directed to the Agency's overseas posts which involve 
routine unclassified, administrative and personnel records available 
only at those posts may be released to the individual by the post if 
the post determines that such release is authorized by the Privacy Act. 
All other requests shall be submitted by the post to the Office of the 
General Counsel, FOIA/Privacy Act Unit (GC/FOI), 301 4th Street, SW., 
Washington, DC 20547, and the individual shall be so notified of this 
action in writing, when possible.
    (d) In those instances where an individual requests records 
pertaining to herself/himself, as well as records pertaining to another 
individual, group, or some other category of the Agency's records, only 
that portion of the request which pertains to records concerning the 
individual will be treated as a Privacy Act request. The remaining 
portions of such a request will be processed as a Freedom of 
Information Act request by the office noted in paragraph (b) of this 
section.


Sec. 505.4  Requirements and identification for making requests.

    (a) Individuals seeking access to Agency records may present their 
written request in person or may mail their request to the USIA, Office 
of General Counsel, FOI/Privacy Act (GC/FOI) Unit, 301 4th Street, SW., 
Washington, DC 20547. The GC/FOI Unit may be visited between the hours 
of 9 a.m. and 4 p.m., Monday through Friday, except for legal holidays.
    (b) Individuals, seeking access to Agency records, will be 
requested to present some form of identification. Individuals should 
state their full name, date of birth and a social security number. An 
individual must also include her/his present mailing address and zip 
code, and if possible a telephone number.
    (c) When signing a statement confirming one's identity, individuals 
should understand that knowingly and willfully seeking or obtaining 
access to records about another individual under false pretenses is 
punishable by a fine of up to $5,000.


Sec. 505.5  Disclosure of information.

    (a) In order to locate the system of records that an individual 
believes may contain information about herself/himself, an individual 
should first obtain a copy of the Agency's Notice of Systems of Records 
as republished in the Federal Register (Vol. 55, No. 151), on August 6, 
1990. By identifying a particular record system and by furnishing all 
the identifying information requested by that record system, it will 
enable the Agency to locate those records which actually pertain to the 
individual. At a minimum, any request should include the information 
specified in Sec. 505.4(b) above.
    (b) In certain circumstances, it may be necessary for the Agency to 
request additional information from the individual to ensure that the 
retrieved record does, in fact, pertain to the individual.
    (c) All requests for information on whether or not the Agency's 
system(s) of records contain information about the individual will be 
acknowledged within ten working days of receipt of the request. The 
requested records will be provided as soon as possible thereafter.
    (d) If the Agency determines that the substance of the requested 
record is exceptionally sensitive, the Agency will require the 
individual to furnish a signed, notarized statement that she/he is in 
fact the person named in the file before granting access to the 
records.
    (e) Original records will not be released from the custody of the 
records system manager. Copies will be furnished subject to and in 
accordance with fees established in Sec. 505.11.
    (f) Denial of access to records:
    (1) The requirements of this section do not entitle an individual 
access to any information compiled in reasonable anticipation of a 
civil action or proceeding.

[[Page 51006]]

    (2) The Agency is not required to permit access to records if the 
information is not retrievable by the individual's name or other 
personal identifier; those requests will be processed as Freedom of 
Information Act requests.
    (3) The Agency may deny an individual access to a record, or 
portion thereof, if following a review it is determined that the record 
or portion falls within the exemptions provided in 5 U.S.C. 552a(j) and 
552a(k). See Secs. 505.13 and 505.14 for a listing of general and 
specific exemptions.
    (4) The decision to deny access to a record or a portion of the 
record is made by the Agency's Privacy Act Officer. Officer of the 
General Counsel. The denial letter will advise the individual of her/
his rights to appeal the denial (See Sec. 505.9 on Access Appeal 
Committee's review).


Sec. 505.6  Medical records.

    If, in the judgment of the Agency, the release of medical 
information directly to the requester could have an adverse effect on 
the requester, the Agency will arrange an acceptable alternative to 
granting access of such records to the requester. This normally 
involves the release of the information to a doctor named by the 
requester. However, this special procedure provision does not in any 
way limit the absolute right of the individual to receive a complete 
copy of her or his medical record.


Sec. 505.7  Correction or amendment of record.

    (a) An individual has the right to request that the Agency amend a 
record pertaining to her/him which the individual believes is not 
accurate, relevant, timely, or complete. At the time the Agency grants 
access to a record, it will furnish guidelines for requesting 
amendments to the record.
    (b) Requests for amendments to records must be writing and mailed 
or delivered to the USIA Privacy Act Officer, Office of the General 
Counsel, 301 4th Street, SW, Washington, DC 20547, who will coordinate 
the review of the request to amend a record with the appropriate 
office(s). Such requests must contain, at a minimum, identifying 
information needed to locate the record, a brief description of the 
item or items of information to be amended, and the reason for the 
requested change. The requester should submit as much documentation, 
arguments or other data as seems warranted to support the request for 
amendment.
    (C) The Agency will review all requests for amendments to records 
within 10 working days of receipt of the request and either make the 
changes or inform the requester of its refusal to do so and the reasons 
therefore.


Sec. 505.8  Agency review of requests for changes.

    (a) In reviewing a record in response to a request to amend or 
correct a file, the Agency shall incorporate the criteria of accuracy, 
relevance timeliness, and completeness of the record in the review.
    (b) If the Agency agrees with an individual's request to amend a 
record, it shall:
    (1) Advise the individual in writing:
    (2) Correct the record accordingly.
    (3) And, to the extent that an accounting of disclosure was 
maintained, advise all previous recipients of the record of the 
corrections.
    (C) If the Agency disagrees with all or any portion of an 
individual's request to amend a record, it shall:
    (1) Advise the individual of the reasons for the determination;
    (2) Inform the individual of her/his right to further review (see 
Sec. 505.9).


Sec. 505.9  Review of adverse agency determination.

    (a) When the Agency determines to deny a request to amend a record, 
or portion of the record, the individual may request further review by 
the Agency's Access Appeal Committee. The written request for review 
should be mailed to the Chairperson, Access Appeal Committee, USIA, 
Office of Public Liaison, 301 4th Street, SW, Washington, DC 20547. The 
letter should include any documentation, information or statement which 
substantiates the request for review.
    (b) The Agency's Access Appeal Committee will review the Agency's 
initial denial to amend the record and the individual's documentation 
supporting amendment, within 30 working days. If additional time is 
required, the individual will be notified in writing of the reasons for 
the delay and the approximate date when the review is expected to be 
complete. Upon completion of the review, the Chairperson will notify 
the individual of the results.
    (c) If the Committee upholds the Agency's denial to amend the 
record, the Chairperson will advise the individual of:
    (1) The reasons for the Agency's refusal to amend the record;
    (2) Her/his right and the procedure to add to the file a concise 
statement supporting the individual's disagreement with the decision of 
the Agency;
    (3) Her/his right to seek judicial review of the Agency's refusal 
to amend the file.
    (d) When an individual files a statement disagreeing with the 
Agency's refusal to amend a record, the Agency will clearly annotate 
the record so that the fact that the record is disputed is apparent to 
anyone who may subsequently have access to, use of, or reason to 
disclose the file. If information is disclosed regarding the area of 
dispute, the Agency will provide a copy of the individual's statement 
in the disclosure. Any statement which may be included by the Agency 
regarding the dispute will be limited to the reasons given to the 
individual for not amending the record. Copies of the Agency's 
statement shall be treated as part of the individual's record, but will 
not be subject to amendment by the individual under these regulations.


Sec. 505.10  Disclosure to third parties.

    The Agency will not disclose any information about an individual to 
any person or another agency without the prior consent of the 
individual about whom the information is maintained, except as provided 
for in the following paragraphs.
    (a) Medical records--May be disclosed to a doctor or other medical 
practitioner, named by the individual, as prescribed in Sec. 505.6 
above.
    (b) Accompanying individual--When a requester is accompanied by any 
other person, the Agency will require that the requester sign a 
statement granting consent to the disclosure of the contents of the 
record to that person.
    (c) Designees--If a person requests another person's file, she or 
he must present a signed statement from that person of record which 
authorizes and consents to the release of the file to the designated 
individual.
    (d) Guardians--Parent(s) or legal guardian(s) of dependent minors 
or of an individual who has been declared by a court to be incompetent 
due to physical, mental or age incapacity, may act for and on behalf of 
the individual on whom the Agency maintains records.
    (e) Other disclosures--A record may be disclosed without a request 
by or written consent of the individual to whom the record pertains if 
such disclosure conditions are authorized under the provisions of 5 
U.S.C. 552a(b). These conditions are:
    (1) Disclosure within the Agency. This condition is based upon a 
``need-to-know'' concept which recognizes that Agency personnel may 
require access to discharge their duties.
    (2) Disclosure to the public. No consent by an individual is 
necessary if

[[Page 51007]]

the record is required to be released under the Freedom of Information 
Act (FOIA), 5 U.S.C. 552. The record may be exempt, however, under one 
of the nine exemptions of the FOIA.
    (3) Disclosure for a routine use. No consent by an individual is 
necessary if the condition is necessary for a ``routine use'' as 
defined in Sec. 505.2(g). Information may also be released to other 
government agencies which have statutory or other lawful authority to 
maintain such information. (See Appendix I--Prefatory Statement of 
General Routine Uses, FR 31977, Vol. 55, No. 151, Aug. 6, 1990)
    (4) Disclosure to the Bureau of the Census. For purposes of 
planning or carrying out a census or survey or related activity. Title 
13 U.S.C. section 8 limits the uses which may be made of these records 
and also makes them immune from compulsory disclosure.
    (5) Disclosure for statistical research and reporting. The Agency 
will provide the statistical information requested only after all names 
and personal identifiers have been deleted from the records.
    (6) Disclosure to the National Archives. For the preservation of 
records of historical value, pursuant to 44 U.S.C. 2103.
    (7) Disclosure for law enforcement purposes. Upon receipt of a 
written request by another Federal agency or a State or local 
government describing the law enforcement purpose for which a record is 
required, and specifying the particular record. Blanket requests for 
all records pertaining to an individual are not permitted under the 
Privacy Act.
    (8) Disclosure under emergency circumstances. For the safety or 
health of an individual (e.g., medical records on a patient undergoing 
emergency treatment).
    (9) Disclosure to the Congress. For matters within the jurisdiction 
of any House or Senate committee or subcommittee, and/or joint 
committee or subcommittee.
    (10) Disclosure to the General Accounting Office (GAO). For matters 
within the jurisdiction of the duties of the GAO's Comptroller General.
    (11) Disclosure pursuant to court order. Pursuant to the order of a 
court of competent jurisdiction. This does not include a subpoena for 
records requested by counsel and issued by a clerk of the court.


Sec. 505.11  Fees.

    (a) The first copy of any Agency record about an individual will be 
provided free of charge. A fee of $0.15 per page will be charged for 
any additional copies requested by the individual.
    (b) Checks or money orders should be made payable to the United 
States Treasurer and mailed to the Freedom of Information Act/Privacy 
Act Unit, Office of the General Counsel, 301 4th Street, SW., 
Washington, DC 20547. The Agency will not accept cash.


Sec. 505.12  Civil remedies and criminal penalties.

    (a) Grounds for court action. An individual will have a remedy in 
the Federal District Courts under the following circumstances:
    (1) Denial of access. Individuals may challenge an Agency decision 
to deny them access to records to which they consider themselves 
entitled.
    (2) Refusal to amend a record. Under conditions prescribed in 5 
U.S.C. 552a(g), an individual may seek judicial review of the Agency's 
refusal to amend a record.
    (3) Failure to maintain a record accurately. An individual may 
bring suit against the Agency for any alleged intentional and willful 
failure to maintain a record accurately, if it can be shown that the 
individual was subject to an adverse action resulting in the denial of 
a right, benefit, entitlement or employment the individual could 
reasonably have expected to be granted if the record had not been 
deficient.
    (4) Other failures to comply with the Act. An individual may bring 
an action for any alleged failure by the Agency to comply with the 
requirements of the Act or failure to comply with any rule published by 
the Agency to implement the Act provided it can be shown that:
    (i) The action was intentional or willful;
    (ii) The Agency's action adversely affected the individual; and,
    (iii) The adverse action was caused by the Agency's actions.
    (b) Jurisdiction and time limits. (1) Action may be brought in the 
district court for the jurisdiction in which the individual resides or 
has a place of residence or business, or in which the Agency records 
are situated, or in the District of Columbia.
    (2) The statute of limitations is two years from the date upon 
which the cause of action arises, except for cases in which the Agency 
has materially and willfully misrepresented any information required to 
be disclosed and when such misrepresentation is material to the 
liability of the Agency. In such cases the statute of limitations is 
two years from the date of discovery by the individual of the 
misrepresentation.
    (3) A suit may not be brought on the basis of injury which may have 
occurred as a result of the Agency's disclosure of a record prior to 
September 27, 1975.
    (C) Criminal penalties.--(1) Unauthorized disclosure. It is a 
criminal violation of the provisions of the Act for any officer or 
employee of the Agency knowingly and willfully to disclose a record in 
any manner to any person or agency not entitled to receive it, for 
failure to meet the conditions of disclosure enumerated in 5 U.S.C. 
552a(b), or without the written consent or at the request of the 
individual to whom the record pertains. Any officer or employee of the 
Agency found guilty of such misconduct shall be fined not more than 
$5,000.
    (2) Failure to publish a public notice. It is a criminal violation 
of the Act to willfully maintain a system of records and not to publish 
the prescribed public notice. Any officer or employee of the Agency 
found guilty of such misconduct shall be fined not more than $5,000.
    (3) Obtaining records under false pretenses. The Act makes it a 
criminal offense to knowingly and willfully request or gain access to a 
record about an individual under false pretenses. Any person found 
guilty of such an offense may be fined not more than $5,000.


Sec. 505.13  General exemptions (Subsection (j)).

    (a) General exemptions are available for systems of records which 
are maintained by the Central Intelligence Agency (Subsection (j)(1)), 
or maintained by an agency which performs as its principal function any 
activity pertaining to the enforcement of the criminal laws (Subsection 
(j)(2)).
    (b) The Act does not permit general exemption of records compiled 
primarily for a noncriminal purpose, even though there are some quasi-
criminal aspects to the investigation and even though the records are 
in a system of records to which the general exemption applies.


Sec. 505.14  Specific exemptions (Subsection (k)).

    The specific exemptions focus more on the nature of the records in 
the systems of records than on the agency. The following categories of 
records may be exempt from disclosure:
    (a) Subsection (k)(1). Records which are specifically authorized 
under criteria established under an Executive Order to be kept secret 
in the interest of national defense or foreign policy, and which are in 
fact properly classified pursuant to such Executive Order;
    (b) Subsection (k)(2). Investigatory records compiled for law 
enforcement purposes (other than material within the

[[Page 51008]]

scope of subsection (j)(2) as discussed in Sec. 505.13(a)). If any 
individual is denied any right, privilege, or benefit for which she/he 
would otherwise be eligible, as a result of the maintenance of such 
material, the material shall be provided to the individual, unless 
disclosure of the material would reveal the identity of a confidential 
source;
    (c) Subsection (k)(3). Records maintained in connection with 
protection of the President and other VIPs accorded special protection 
by statute;
    (d) Subsection (k)(4). Records required by statute to be maintained 
and used solely as statistical records;
    (e) Subsection (k)(5). Records compiled solely for the purpose of 
determining suitability, eligibility, or qualifications for Federal 
civilian employment, military service, Federal contracts, or access to 
classified information, but only if disclosure of the material would 
reveal the identity of a confidential source that furnished information 
to the Government;
    (f) Subsection (k)(6). Testing or examination records used solely 
to determine individual qualifications for appointment or promotion in 
the Federal service when the disclosure of such would compromise the 
objectivity or fairness of the testing or examination process;
    (g) Subsection (k)(7). Evaluation records used to determine 
potential for promotion in the armed services, but only if disclosure 
would reveal the identity of a confidential source.
    (h) Records of other agencies Any Agency record system which 
contains information originated by another agency whose record system 
is exempt from certain provisions of the Act will not be disclosed by 
USIA. (See Sec. 505.13, General Exemptions.)


Sec. 505.15  Exempt systems of records used.

    USIA is authorized to use exemptions (k)(1), (k)(2), (k)(4), 
(k)(5), and (k)(6). The following Agency components currently maintain 
exempt systems of records under one or more of these specific 
exemptions: Executive Secretariat; Educational and Cultural Exchange 
Program; Legal Files; Privacy Act and Freedom of Information Act Files; 
Employee Grievance Files; Recruitment Records; Employee Master 
Personnel Records; Foreign Service Selection Board Files; Employee 
Training Files; Personnel Security and Integrity Records; International 
Broadcasting Bureau Director's Executive Secretariat Files; and 
International Broadcasting Bureau Employee Personnel Files. (See 
Appendix I--Prefatory Statement of General Routine Uses, 55 FR 31977, 
Aug. 6, 1990.)
Les Jin,
General Counsel.
[FR Doc. 96-24783 Filed 9-27-96; 8:45 am]
BILLING CODE 8230-01-M