[Federal Register Volume 63, Number 165 (Wednesday, August 26, 1998)]
[Proposed Rules]
[Pages 45433-45440]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 98-22672]


=======================================================================
-----------------------------------------------------------------------

NATIONAL ARCHIVES AND RECORDS ADMINISTRATION

36 CFR Part 1202

RIN 3095-AA66


Privacy Act Regulations

AGENCY: National Archives and Records Administration (NARA).

ACTION: Notice of proposed rulemaking.

-----------------------------------------------------------------------

SUMMARY: This proposed rule would streamline NARA regulations 
implementing the Privacy Act of 1974 by revising and simplifying 
policies for release of medical information, clarifying whom in NARA 
individuals contact with Privacy Act requests and appeals, and removing 
detailed internal NARA operating procedures that do not belong in the 
regulation. NARA is taking this action after conducting a review of its 
existing Privacy Act regulations in accordance with Executive Order 
12866.

DATES: Comments must be received by October 26, 1998.

ADDRESSES: Comments must be sent to Regulation Comment Desk, Policy and 
Communications Staff (NPOL), National Archives and Records 
Administration, 8601 Adelphi Road, College Park, MD 20740-6001.

FOR FURTHER INFORMATION CONTACT: Nancy Allard at (301) 713-7360, 
extension 226, or Mary Ronan at (301) 713-6025, extension 226.

SUPPLEMENTARY INFORMATION: This rule is a significant regulatory action 
for the purposes of Executive Order 12866, and has been reviewed by 
OMB. As required by the Regulatory Flexibility Act, it is

[[Page 45434]]

hereby certified that this proposed rule will not have a significant 
impact on small entities.

List of Subjects in 36 CFR Part 1202

    Archives and records, Privacy.

    For the reasons set forth in the preamble, NARA proposes to revise 
part 1202 of title 36, Code of Federal Regulations, to read as follows:

PART 1202--REGULATIONS IMPLEMENTING THE PRIVACY ACT OF 1974

Subpart A--General Provisions

Sec.
1202.1  Scope of part.
1202.4  Definitions.
1202.6  Contact point for Privacy Act assistance and referrals.
1202.10  Collection and use.
1202.12  Standards of accuracy.
1202.14  Rules of conduct.
1202.16  Safeguarding systems of records.
1202.18  Inconsistent issuances of NARA superseded.
1202.20  Records of other agencies.
1202.22  Subpoena and other legal demands.

Subpart B--Disclosure of Records

1202.30  Conditions of disclosure.
1202.32  Procedures for disclosure.
1202.34  Accounting of disclosures.

Subpart C--Individual Access to Records

1202.40  Forms of request.
1202.42  Special requirements for medical records.
1202.44  Granting access.
1202.46  Denials of access.
1202.48  Appeal of denial of access within NARA.
1202.50  Records available at a fee.
1202.52  Prepayment of fees over $250.
1202.54  Form of payment.

Subpart D--Requests to Amend Records

1202.60  Submission of requests to amend records.
1202.62  Review of requests to amend records.
1202.64  Approval of requests to amend.
1202.66  Denial of requests to amend.
1202.68  Agreement to alternative amendments.
1202.70  Appeal of denial of request to amend a record.
1202.72  Statements of disagreement.
1202.74  Judicial review.

Subpart E--Exemptions

1202.90  Specific exemptions.

    Authority: 5 U.S.C. 552a; 44 U.S.C. 2104(a).

Subpart A--General Provisions


Sec. 1202.1  Scope of part.

    (a) This part governs requests for NARA organizational records and 
certain records of defunct agencies under the Privacy Act, 5 U.S.C. 
552a (hereinafter referred to as the Act). This part applies to all 
NARA records, as defined in Sec. 1202.4, which contain personal 
information about an individual and some means of identifying the 
individual, and which are contained in a system of records as defined 
in 5 U.S.C. 552a(a)(5) from which information is retrieved by use of an 
identifying particular assigned to the individual. The part prescribes 
procedures for notifying an individual of NARA systems of records which 
may contain a record pertaining to him or her; procedures for gaining 
access and contesting the contents of such records, and other 
procedures for carrying out the provisions of the Act.
    (b) Policies and procedures governing the disclosure and 
availability of NARA operational records in general are in part 1250 of 
this chapter.


Sec. 1202.4  Definitions.

    For the purposes of this part:
    Access means a transfer of a record, a copy of a record, or the 
information in a record to the subject individual, or the review of a 
record by the subject individual.
    Agency means agency as defined in 5 U.S.C. 552(f).
    Defunct agency records means the records in a Privacy Act system of 
an agency that has ceased to exist without a successor in functions 
that have not yet been transferred to the National Archives of the 
United States.
    Disclosure means a transfer by any means of a record, a copy of a 
record, or the information contained in a record to a recipient other 
than the subject individual, or the review of a record by someone other 
than the subject individual.
    Individual means a citizen of the United States or an alien 
lawfully admitted for permanent residence.
    Maintain includes maintain, collect, use, or disseminate.
    NARA Privacy Act appeal official means the Deputy Archivist of the 
United States for appeals of denials of access to or amendment of 
records maintained in a system of records, except where the system 
manager is the Inspector General. The term means the Archivist of the 
United States for appeals of denial of access to or amendment of 
records in systems of records maintained by the Inspector General.
    Record means any item, collection, or grouping of information about 
an individual that is maintained by an agency, including, but not 
limited to, his or her education, financial transactions, medical 
history and criminal or employment history, and that contains his or 
her name or an identifying number, symbol, or other identifying 
particular assigned to the individual, such as a fingerprint, 
voiceprint, or photograph. For purposes of this part, ``record'' does 
not include archival records that have been transferred to the National 
Archives of the United States.
    Routine use means, with respect to the disclosure of a record, the 
use of that record for a purpose which is compatible with the purpose 
for which it was collected.
    Solicitation means a request by a NARA officer or employee that an 
individual provide information about himself or herself.
    Statistical record means a record in a system of records maintained 
for statistical research or reporting purposes only and not used in 
whole or in part in making any determination about an identifiable 
individual, except as provided by 13 U.S.C. 8.
    Subject individual means the individual named or discussed in a 
record or the individual to whom a record otherwise pertains.
    System manager means the NARA employee who is responsible for the 
maintenance of a system of records and for the collection, use, and 
dissemination of information therein.
    System of records means a group of any records under the control of 
NARA from which information is retrieved by the name of the individual 
or by some identifying number, symbol, or other identifier assigned to 
that individual.


Sec. 1202.6  Contact point for Privacy Act assistance and referrals.

    Requests for assistance and referral to the responsible system 
manager or other NARA employee charged with implementing these 
regulations should be made to the NARA Privacy Act Officer, National 
Archives and Records Administration, Room 4400, 8601 Adelphi Rd., 
College Park, MD 20740-6001.


Sec. 1202.10  Collection and use.

    (a) General. Any information used in whole or in part in making a 
determination about an individual's rights, benefits, or privileges 
under NARA programs will be collected directly from the subject 
individual to the greatest extent practicable. The system manager also 
will ensure that information collected is used only in conformance with 
the provisions of the Act and this part.
    (b) Solicitation of information. System managers will ensure that 
at the time information is solicited the subject individual is informed 
of the authority for collecting that information, whether

[[Page 45435]]

providing the information is mandatory or voluntary, the purposes for 
which the information will be used, the routine uses of the 
information, and the effects on the individual, if any, of not 
providing the information. The director of the NARA forms management 
program will ensure that forms used to solicit information are in 
compliance with the Act and this part.
    (c) Solicitation of social security number. (1) Before a NARA 
employee or NARA contractor requires an individual to disclose his or 
her social security number, NARA will ensure that either:
    (i) The disclosure is required by Federal law; or
    (ii) The disclosure was required under a Federal law or regulation 
adopted before January 1, 1975, to verify the identity of an 
individual, and the social security number will become a part of a 
system of records in existence and operating before January 1, 1975.
    (2) If solicitation of the social security number is authorized 
under paragraph (c)(1)(i) or (ii) of this section, the NARA employee or 
NARA contractor who requests an individual to disclose his or her 
social security number must first inform that individual whether that 
disclosure is mandatory or voluntary, by what statutory or other 
authority the number is solicited, and the uses that will be made of 
it.
    (d) Soliciting information from third parties. A NARA employee or 
NARA contractor will inform third parties who are requested to provide 
information about another individual of the purposes for which the 
information will be used.


Sec. 1202.12  Standards of accuracy.

    The system manager will ensure that all records which are used by 
NARA to make a determination about any individual are maintained with 
such accuracy, relevance, timeliness, and completeness as is reasonably 
necessary to ensure fairness to the individual.


Sec. 1202.14  Rules of conduct.

    All NARA employees and/or NARA contractors involved in the design, 
development, operation, or maintenance of any system of records, or in 
maintaining any record, must review the provisions of 5 U.S.C. 552a and 
the regulations in this part, and must conduct themselves in accordance 
with the rules of conduct concerning the protection of personal 
information in the NARA Standards of Conduct.


Sec. 1202.16  Safeguarding systems of records.

    The system manager will ensure that appropriate administrative, 
technical, and physical safeguards are established to ensure the 
security and confidentiality of records and to protect against any 
anticipated threats or hazards to their security or integrity which 
could result in substantial harm, embarrassment, inconvenience, or 
unfairness to any individual on whom information is maintained. 
Personnel information contained in both manual and automated systems of 
records will be protected by implementing the following safeguards:
    (a) Official personnel folders, authorized personnel operating or 
work folders, and other records of personnel actions effected during a 
NARA employee's Federal service or affecting the employee's status and 
service, including information on experience, education, training, 
special qualifications and skills, performance appraisals, and conduct, 
will be stored in a lockable metal filing cabinet when not in use by an 
authorized person. A system manager may employ an alternative storage 
system providing that it furnishes an equivalent degree of physical 
security as storage in a lockable metal filing cabinet.
    (b) System managers, at their discretion, may designate additional 
records of unusual sensitivity which require safeguards similar to or 
greater than those described in paragraph (a) of this section.
    (c) System managers will permit access to and use of automated or 
manual personnel records only to persons whose official duties require 
such access, or to subject individuals or their representatives as 
provided by this part.


Sec. 1202.18  Inconsistent issuances of NARA superseded.

    Any policies and procedures in any NARA issuance which are 
inconsistent with the policies and procedures in this part are 
superseded to the extent of that inconsistency.


Sec. 1202.20  Records of other agencies.

    (a) Records accessioned into the National Archives of the United 
States. Archival records which were contained in systems of records of 
agencies and which have been transferred to the National Archives of 
the United States are exempt from most provisions of the Privacy Act 
(see 5 U.S.C. 552a(l)(2) and (l)(3)). Rules governing access to such 
records are contained in subchapter C of this chapter.
    (b) Current records of other agencies. If NARA receives a request 
for access to records which are the primary responsibility of another 
agency, but which are maintained by or in the temporary possession of 
NARA on behalf of that agency in a regional records service facility, 
NARA will refer the request to the agency concerned for appropriate 
action. NARA will advise the requester that the request has been 
forwarded to the responsible agency. (See 5 U.S.C. 552a(l)(1)).
    (c) Records in Government-wide Privacy Act systems. Records in the 
custody of NARA which are the primary responsibility of another agency, 
e.g., the Office of Personnel Management (OPM) or the Office of 
Government Ethics (OGE), are governed by the regulations promulgated by 
that agency pursuant to the Act.
    (d) Records of defunct agencies in the custody of NARA. Records of 
defunct agencies in the custody of NARA at a NARA records center but 
not yet accessioned into the National Archives of the United States are 
governed by the regulations in this part.


Sec. 1202.22  Subpoenas and other legal demands.

    Access to NARA systems of records by subpoena or other legal 
process will be made in accordance with the provisions of part 1250 of 
this chapter for NARA operational records and records of defunct 
agencies not yet accessioned into the National Archives of the United 
States and part 1254 of this chapter for archival records, records 
center holdings, and donated historical materials.

Subpart B--Disclosure of Records


Sec. 1202.30  Conditions of disclosure.

    No NARA employee may disclose any record in a system of records to 
any person or to another agency without the express written consent of 
the subject individual unless the disclosure is:
    (a) To NARA employees who have a need for the information in the 
official performance of their duties;
    (b) Required by the provisions of the Freedom of Information Act, 
as amended;
    (c) For a routine use as published in a notice in the Federal 
Register;
    (d) To the Bureau of the Census for purposes of planning or 
carrying out a census or survey or related activity pursuant to title 
13 U.S.C.;
    (e) To a recipient who has provided NARA with advance adequate 
written assurance that the record will be used solely as a statistical 
research or reporting record. (The record will be transferred in a form 
that is not individually identifiable. In addition to deleting personal 
identifying information from records released for statistical purposes, 
the system manager

[[Page 45436]]

will ensure that the identity of the individual cannot reasonably be 
deduced by combining various statistical records.) The written 
statement must include as a minimum:
    (1) A statement of the purpose for requesting the records; and
    (2) Certification that the records will be used only for 
statistical purposes;
    (f) To the National Archives of the United States as a record which 
has sufficient historical or other value to warrant its continued 
preservation by the United States Government; or for evaluation by the 
Archivist or the designee of the Archivist to determine whether the 
record has such value;
    (g) To another agency or instrumentality of any governmental 
jurisdiction within or under the control of the United States for a 
civil or criminal law enforcement activity, if the activity is 
authorized by law, and if the head of the agency or instrumentality or 
his or her other designated representative has made a written request 
to NARA specifying the particular portion desired and the law 
enforcement activity for which the record is sought;
    (h) To a person showing compelling circumstances affecting the 
health or safety of an individual, not necessarily the individual to 
whom the record pertains. Upon such disclosure, a notification must be 
sent to the last known address of the subject individual;
    (i) To either House of Congress or to a committee or subcommittee 
(joint or of either House, to the extent that the matter falls within 
its jurisdiction);
    (j) To the Comptroller General or any of his authorized 
representatives in the course of the performance of the duties of the 
General Accounting Office;
    (k) Pursuant to the order of a court of competent jurisdiction; or
    (l) To a consumer reporting agency in accordance with 31 U.S.C. 
3711(e).


Sec. 1202.32  Procedures for disclosure.

    (a) Address all requests for disclosure of records pertaining to a 
third party to the NARA Privacy Act Officer, National Archives and 
Records Administration, Room 4400, 8601 Adelphi Rd., College Park, MD 
20740-6001. Upon receipt of such request, NARA will verify the right of 
the requester to obtain disclosure pursuant to Sec. 1202.30. Upon 
verification, the system manager will make the requested records 
available. NARA will acknowledge requests within 10 workdays and will 
make a decision within 30 workdays, unless NARA notifies the requester 
that the time limit must be extended for good cause.
    (b) If NARA determines that the disclosure is not permitted under 
Sec. 1202.30, the system manager will deny the request in writing. The 
requester will be informed of the right to submit a request for review 
and final determination to the appropriate NARA Privacy Act Appeal 
Officer.
    (1) The Archivist of the United States is the NARA Privacy Act 
Appeal Officer for records maintained by the Office of the Inspector 
General. Requests for review involving records for which the Inspector 
General is the system manager must be addressed to the NARA Privacy Act 
Appeal Officer (N), National Archives and Records Administration, 8601 
Adelphi Rd., College Park, MD 20470-6001.
    (2) The Deputy Archivist of the United States is the appeal officer 
for all other NARA records. Requests for review involving all other 
records must be addressed to the NARA Privacy Act Appeal Officer (ND), 
National Archives and Records Administration, 8601 Adelphi Rd., College 
Park, MD 20470-6001.


Sec. 1202.34  Accounting of disclosures.

    (a) Except for disclosures made pursuant to Sec. 1202.30(a) and 
(b), an accurate accounting of each disclosure will be made and 
retained for 5 years after the disclosure or for the life of the 
record, whichever is longer. The accounting will include the date, 
nature, and purpose of each disclosure, and the name and address of the 
person or agency to whom the disclosure is made.
    (b) The system manager also will maintain in conjunction with the 
accounting of disclosures:
    (1) A full statement of the justification for the disclosures;
    (2) All documentation surrounding disclosure of a record for 
statistical or law enforcement purposes; and
    (3) Evidence of written consent by the subject individual to a 
disclosure, if applicable.
    (c) Except for the accounting of disclosures made under 1202.30(g) 
or of disclosures made from exempt systems (see subpart E of this 
part), the accounting of disclosures will be made available to the 
subject individual upon request. Procedures for requesting access to 
the accounting are in subpart C of this part.

Subpart C--Individual Access to Records


Sec. 1202.40  Forms of requests.

    (a) Individuals seeking access to their records or to any 
information pertaining to themselves which is contained in a system of 
records should notify the NARA Privacy Act Officer, National Archives 
and Records Administration, Rm. 4400, 8601 Adelphi Rd., College Park, 
MD 20740-6001.
    (b) The request must be in writing and must bear the legend 
``Privacy Act Request'' both on the request letter and on the envelope. 
The request letter must contain:
    (1) The complete name and identifying number of the NARA system as 
published in the Federal Register;
    (2) The full name and address of the subject individual;
    (3) A brief description of the nature, time, place, and 
circumstances of the subject individual's association with NARA; and
    (4) Any other information which the subject individual believes 
would help NARA to determine whether the information about the 
individual is included in the system of records.
    (c) NARA will answer or acknowledge the request within 10 workdays 
of its receipt by NARA.
    (d) NARA at its discretion, may accept oral requests for access to 
a NARA system of records, subject to verification of identity.


Sec. 1202.42  Special requirements for medical records.

    When NARA receives a request for access to medical records, if NARA 
believes, in good faith, that disclosure of medical and/or 
psychological information directly to the subject individual could have 
an adverse effect on that individual, the subject individual may be 
asked to designate in writing a physician or mental health professional 
to whom he or she would like the records to be disclosed, and 
disclosure that otherwise would be made to the subject individual will 
instead be made to the designated physician or mental health 
professional.


Sec. 1202.44  Granting access.

    (a) Upon receipt of a request for access to non-exempt records, 
NARA will make such records available to the subject individual or 
shall acknowledge the request within 10 workdays of its receipt by 
NARA. The acknowledgment will indicate when the system manager will 
make the records available.
    (b) If NARA anticipates more than a 10-day delay in making a record 
available, NARA also will include in the acknowledgment specific 
reasons for the delay.
    (c) If a subject individual's request for access does not contain 
sufficient information to permit the system manager to locate the 
records, NARA will request additional information from the individual 
and will have 10

[[Page 45437]]

workdays following receipt of the additional information in which to 
make the records available or to acknowledge receipt of the request and 
to indicate when the records will be available.
    (d) Records will be made available for authorized access during 
normal business hours at the NARA offices where the records are 
located.
    (1) Requesters must be prepared to identify themselves by producing 
at least one piece of identification bearing a name or signature and 
either a photograph or physical description, e.g., a driver's license 
or employee identification card. NARA reserves the right to ask the 
requester to produce additional pieces of identification to assure NARA 
of the requester's identity. If the individual is unable to produce 
suitable identification, he or she must sign a statement asserting that 
he or she is the subject individual and stipulating that he or she 
understands the criminal penalty for perjury and the penalty in the 
Privacy Act for requesting or obtaining access to records under false 
pretenses (5 U.S.C. 552a(i)(3)). NARA will provide a form for this 
purpose.
    (2) Requesters must sign a form indicating that they have been 
given access.
    (e) At the written request of a subject individual, NARA may 
provide access by mailing a copy of the requested records to that 
individual or to another person designated by the subject individual. 
In the request, the subject individual must provide a copy of proof of 
identity, such as an electrostatic copy of a driver's license, or a 
statement asserting he or she is the subject individual and stipulating 
that he or she understands the criminal penalty for perjury and the 
penalty in the Privacy Act for requesting or obtaining access to 
records under false pretenses (5 U.S.C. 552a(i)(3)).
    (f) Upon request, a system manager will permit a subject individual 
to examine the original of a non-exempt record, will provide the 
individual with a copy of the record, or both.
    (g) Subject individuals may either pick up a record in person or 
receive it by mail. A system manager may not make a record available to 
a third party for delivery to the subject individual, except for 
medical records as outlined in Sec. 1202.42, or at the explicit written 
direction of the subject individual in accordance with paragraph (h) of 
this section.
    (h) Subject individuals who wish to have a person of their choosing 
review, accompany them in reviewing, or obtain a copy of a record must, 
prior to the disclosure of their record, sign a statement authorizing 
the disclosure. The system manager will maintain this statement with 
the record.
    (i) The procedure for access to an accounting of disclosures is 
identical to the procedure for access to a record as set forth in this 
section.


Sec. 1202.46  Denials of access.

    (a) A system manager may deny a subject individual access to his or 
her record only on the grounds that NARA has published rules in the 
Federal Register exempting the pertinent system of records from the 
access requirement and the record is exempt from disclosure under the 
Freedom of Information Act, as amended (FOIA). Exempt systems of 
records are described in subpart E of this part.
    (b) Upon receipt of a request for access to a record which is 
contained within an exempt system of records, NARA will:
    (1) Review the record to determine whether all or part of the 
record must be released to the requester in accordance with 
Sec. 1202.44, notwithstanding the inclusion of the record within an 
exempt system of records; and
    (2) Disclose the record in accordance with Sec. 1202.44 or notify 
the requester that the request has been denied in whole or in part.
    (c) If the request is denied in whole or in part, the notice will 
include a statement specifying the applicable Privacy Act and FOIA 
exemptions and advising the requester of the right to appeal the 
decision as provided in Sec. 1202.74.


Sec. 1202.48  Appeal of denial of access within NARA.

    (a) Requesters denied access in whole or part to records pertaining 
to them may file with NARA an appeal of that denial. The appeal must be 
postmarked no later than 35 calendar days after the date of the denial 
letter from NARA.
    (1) The Archivist of the United States is the NARA Privacy Act 
Appeal Official for records maintained by the Office of the Inspector 
General. Appeals involving records for which the Inspector General is 
the system manager must be addressed to NARA Privacy Act Appeal 
Official (N), National Archives and Records Administration, Washington, 
DC 20408.
    (2) The Deputy Archivist of the United States is the NARA Privacy 
Act Appeal Official for all other NARA records. All other appeals must 
be addressed to NARA Privacy Act Appeal Official (ND), National 
Archives and Records Administration, Washington, DC 20408.
    (b) Each appeal to the NARA Privacy Act Appeal Official must be in 
writing. The appeal must bear the legend ``Privacy Act--Access 
Appeal,'' on both the face of the letter and the envelope.
    (c) Upon receipt of an appeal, the NARA Privacy Act Appeal Official 
will consult with the system manager, legal counsel, and such other 
officials as may be appropriate. If the NARA Privacy Act Appeal 
Official, in consultation with these officials, determines that the 
request for access should be granted because the subject records are 
not exempt, the NARA Privacy Act Appeal Official will immediately 
either instruct the system manager in writing to grant access to the 
record in accordance with Sec. 1202.44 or shall grant access and will 
notify the requester of that action.
    (d) If the NARA Privacy Act Appeal Official, in consultation with 
the officials specified in paragraph (c) of this section, determines 
that the appeal should be rejected, the NARA Privacy Act Appeal 
Official immediately will notify the requester in writing of that 
determination. This action will constitute NARA's final determination 
on the request for access to the record and will include:
    (1) The reason for the rejection of the appeal; and
    (2) Notice of the requester's right to seek judicial review of 
NARA's final determination, as provided in Sec. 1202.74.
    (e) The final NARA determination will be made no later than 30 
workdays from the date on which the appeal is received by the NARA 
Privacy Act Appeal Official. The NARA Privacy Act Appeal Official may 
extend this time limit by notifying the requester in writing before the 
expiration of the 30 workdays. The NARA Privacy Act Appeal Official's 
notification will include an explanation of the reasons for the 
extension of time.


Sec. 1202.50  Records available at a fee.

    NARA will waive fees for copies of records for the first 100 pages 
copied or when the cost to collect the fee will exceed the amount 
collected. When a fee is charged, the charge per copy is $0.30 per page 
if NARA makes the copy or $0.10 per page if the requester makes the 
copy on a NARA self-service copier. Fees for other reproduction 
processes are computed upon request.


Sec. 1202.52  Prepayment of fees over $250.

    If the system manager determines that the estimated total fee is 
likely to exceed $250, NARA will notify the individual that the 
estimated fee must be prepaid prior to NARA's making the records 
available. NARA will remit any excess amount paid by the individual or 
bill

[[Page 45438]]

the individual for an additional amount if there is a variation between 
the final fee charged and the amount prepaid.


Sec. 1202.54  Form of payment.

    Payment shall be by check or money order payable to the National 
Archives and Records Administration and shall be addressed to the NARA 
Privacy Act Officer.

Subpart D--Requests To Amend Records


Sec. 1202.60  Submission of requests to amend records.

    Subject individuals who desire to amend any record containing 
personal information about themselves should write to the NARA Privacy 
Act Officer, except that a current NARA employee who desires to amend 
personnel records should write to the Director, Human Resources 
Services Division. Each request must include evidence of and 
justification for the need to amend the pertinent record. Each request 
must bear the legend ``Privacy Act--Request To Amend Record'' 
prominently marked on both the face of the request letter and the 
envelope.


Sec. 1202.62  Review of requests to amend records.

    (a) NARA will acknowledge receipt of a request to amend a record 
within 10 workdays. If possible, the acknowledgment will include the 
system manager's determination either to amend the record or to deny 
the request to amend as provided in Sec. 1202.66.
    (b) When reviewing a record in response to a request to amend, the 
system manager will assess the accuracy, relevance, timeliness, and 
completeness of the existing record in light of the proposed amendment. 
The system manager will determine whether the amendment is justified. 
With respect to a request to delete information, the system manager 
also will review the request and existing record to determine whether 
the information is relevant and necessary to accomplish an agency 
purpose required to be accomplished by law or Executive order.


Sec. 1202.64  Approval of requests to amend.

    If the system manager determines that amendment of a record is 
proper in accordance with the request to amend, he or she promptly will 
make the necessary amendment to the record and will send a copy of the 
amended record to the subject individual. NARA will advise all previous 
recipients of the record, using the accounting of disclosures, of the 
fact that an amendment has been made and give the substance of the 
amendment. Where practicable, NARA will send a copy of the amended 
record to previous recipients.


Sec. 1202.66  Denial of requests to amend.

    If the system manager determines that an amendment of a record is 
improper or that the record should be amended in a manner other than 
that requested by an individual, NARA will advise the requester in 
writing of the decision. The denial letter will state the reasons for 
the denial of the request to amend; include proposed alternative 
amendments, if appropriate; state the requester's right to appeal the 
denial of the request to amend; and state the procedure for appealing.


Sec. 1202.68  Agreement to alternative amendments.

    If the denial of a request to amend a record includes proposed 
alternative amendments and if the requester agrees to accept them, the 
requester must notify the system manager who will make the necessary 
amendments in accordance with Sec. 1202.64.


Sec. 1202.70  Appeal of denial of request to amend a record.

    (a) A requester who disagrees with a denial of a request to amend a 
record may file an appeal of that denial.
    (1) If the denial was signed by a NARA system manager other than 
the Inspector General, the requester must address the appeal to the 
NARA Privacy Act Appeal Official (ND), Washington, DC 20408.
    (2) If the denial was signed by the Inspector General, the 
requester must address the appeal to the NARA Privacy Act Appeal 
Official (N), Washington, DC 20408.
    (3) If the requester is an employee of NARA and the denial to amend 
involves a record maintained in the employee's Official Personnel 
Folder, or in another Government-wide system maintained by NARA on 
behalf of another agency, NARA will provide the requester the name and 
address of the appropriate appeal official in that agency.
    (b) Each appeal to the NARA Privacy Act appeal official must be in 
writing and must be postmarked no later than 35 calendar days from the 
date of NARA denial of a request to amend a record. The appeal must 
bear the legend ``Privacy Act--Appeal,'' both on the face of the letter 
and the envelope.
    (c) Upon receipt of an appeal, the NARA Privacy Act appeal official 
will consult with the system manager, legal counsel, and such other 
officials as may be appropriate. If the NARA Privacy Act appeal 
official, in consultation with these officials, determines that the 
record should be amended as requested, he or she immediately will 
instruct the system manager to amend the record in accordance with 
Sec. 1202.64 and will notify the requester of that action.
    (d) If the NARA Privacy Act appeal official, in consultation with 
the officials specified in paragraph (c) of this section, determines 
that the appeal should be rejected, the NARA Privacy Act appeal 
official immediately will notify the requester in writing of that 
determination. This action will constitute the NARA final determination 
on the request to amend the record and will include:
    (1) The reasons for the rejection of the appeal;
    (2) Proposed alternative amendments, if appropriate, which the 
requester subsequently may accept in accordance with Sec. 1202.68;
    (3) Notice of the requester's right to file a Statement of 
Disagreement for distribution in accordance with Sec. 1202.72; and
    (4) Notice of the requester's right to seek judicial review of the 
NARA final determination, as provided in Sec. 1202.74.
    (e) The NARA final determination will be made no later than 30 
workdays from the date on which the appeal is received by the NARA 
Privacy Act appeal official. In extraordinary circumstances, the NARA 
Privacy Act appeal official may extend this time limit by notifying the 
requester in writing before the expiration of the 30 workdays. The NARA 
Privacy Act appeal official's notification must include a justification 
for the extension of time.


Sec. 1202.72  Statements of disagreement.

    Upon receipt of a NARA final determination denying a request to 
amend a record, the requester may file a Statement of Disagreement with 
the appropriate system manager. The Statement of Disagreement must 
include an explanation of why the requester believes the record to be 
inaccurate, irrelevant, untimely, or incomplete. The system manager 
will maintain the Statement of Disagreement in conjunction with the 
pertinent record and will include a copy of the Statement of 
Disagreement in any disclosure of the pertinent record. The system 
manager will provide a copy of the Statement of Disagreement to any 
person or agency to whom the record has been disclosed only if the 
disclosure was subject to the accounting requirements of Sec. 1202.34.


Sec. 1202.74  Judicial review.

    Within 2 years of receipt of a NARA final determination as provided 
in

[[Page 45439]]

Sec. 1202.48 or Sec. 1202.70, a requester may seek judicial review of 
that determination. A civil action must be filed in the Federal 
District Court in which the requester resides or has his or her 
principal place of business or in which the NARA records are situated, 
or in the District of Columbia.

Subpart E--Exemptions


Sec. 1202.90  Specific exemptions.

    (a)(1) The following systems of records are eligible for exemption 
under 5 U.S.C. 552a(k)(1) because they contain information specifically 
authorized under criteria established by an Executive Order to be kept 
secret in the interest of national defense or foreign policy and are in 
fact properly classified pursuant to such Executive Order. Accordingly, 
these systems of records are exempt from the following sections of 5 
U.S.C. 552a: (c)(3), (d), (e)(1), and (e)(4) (G) and (H):

Investigative Case Files of the Inspector General--NARA 23
Personnel Security Case Files--NARA 24

    (2) Exemptions from the particular subsections are justified for 
the following reasons:
    (i) From subsection (c)(3) because accounting for each disclosure 
could result in the release of properly classified information which 
would compromise the national defense or disrupt foreign policy.
    (ii) From the access and amendment provisions of subsection (d) 
because access to the records in these systems of records could result 
in the release of properly classified information which would 
compromise the national defense or disrupt foreign policy. Amendment of 
either of these series of records would interfere with ongoing 
investigations and law enforcement or national security activities and 
impose an impossible administrative burden by requiring investigations 
to be continuously reinvestigated.
    (iii) From subsection (e)(1) because verification of the accuracy 
of all information to the records could result in the release of 
properly classified information which would compromise the national 
defense or disrupt foreign policy.
    (iv) From subsection (e)(4) (G) and (H) because these systems are 
exempt from the access and amendment provisions of subsection (d) 
pursuant to subsection (k)(1) of the Privacy Act.
    (b)(1) The following system of records is eligible for exemption 
under 5 U.S.C. 552a(k)(2) because it contains investigatory material 
compiled for law enforcement purposes other than material within the 
scope of subsection (j)(2) of 5 U.S.C. 552a. However, if any individual 
is denied any right, privilege or benefit that he would otherwise be 
entitled by Federal law, or for which he would otherwise be eligible, 
as a result of the maintenance of such material, such material will be 
provided to such individual, except to the extent that the disclosure 
of such material would reveal the identity of a source who furnished 
information to the Government under an express promise that the 
identity of the source would be held in confidence, or prior to January 
1, 1975, under an implied promise that the identity of the source would 
be held in confidence. Accordingly, the following system of records is 
exempt from subsections (c)(3), (d), (e)(1) and (e)(4) (G) and (H), and 
(f) of 5 U.S.C. 552a:

Investigative Files of the Inspector General, NARA--23

    (2) Exemptions from the particular subsections are justified for 
the following reasons:
    (i) From subsection (c)(3) because release of disclosure accounting 
could alert the subject of an investigation of an actual or potential 
criminal, civil, or regulatory violation to the existence of the 
investigation and the fact that they are subjects of the investigation, 
and reveal investigative interest by not only the Inspector General 
(OIG), but also by the recipient agency. Since release of such 
information to the subjects of an investigation would provide them with 
significant information concerning the nature of the investigation, 
release could result in the destruction of documentary evidence, 
improper influencing of witnesses, endangerment of the physical safety 
of confidential sources, witnesses, and law enforcement personnel, the 
fabrication of testimony, flight of the subject from the area, and 
other activities that could impede or compromise the investigation. In 
addition, accounting for each disclosure could result in the release of 
properly classified information which would compromise the national 
defense or disrupt foreign policy.
    (ii) From the access and amendment provisions of subsection (d) 
because access to the records contained in this system of records could 
inform the subject of an investigation of an actual or potential 
criminal, civil, or regulatory violation, of the existence of that 
investigation; of the nature and scope of the information and evidence 
obtained as to his activities; of the identity of confidential sources, 
witnesses, and law enforcement personnel, and of information that may 
enable the subject to avoid detection or apprehension. These factors 
would present a serious impediment to effective law enforcement where 
they prevent the successful completion of the investigation, endanger 
the physical safety of confidential sources, witnesses, and law 
enforcement personnel, and/or lead to the improper influencing of 
witnesses, the destruction of evidence, or the fabrication of 
testimony. In addition, granting access to such information could 
disclose security-sensitive or confidential business information or 
information that would constitute an unwarranted invasion of the 
personal privacy of third parties. Amendment of the records would 
interfere with ongoing investigations and law enforcement activities 
and impose an impossible administrative burden by requiring 
investigations to be continuously reinvestigated.
    (iii) From subsection (e)(1) because the application of this 
provision could impair investigations and interfere with the law 
enforcement responsibilities of the OIG for the following reasons:
    (A) It is not possible to detect relevance or necessity of specific 
information in the early stages of a civil, criminal or other law 
enforcement investigation, case, or matter. Relevance and necessity are 
questions of judgment and timing, and it is only after the information 
is evaluated that the relevance and necessity of such information can 
be established.
    (B) During the course of any investigation, the OIG may obtain 
information concerning actual or potential violations of laws other 
than those within the scope of its jurisdiction. In the interest of 
effective law enforcement, the OIG should retain this information, as 
it may aid in establishing patterns of inappropriate activity, and can 
provide valuable leads for Federal and other law enforcement agencies.
    (C) In interviewing individuals or obtaining other forms of 
evidence during an investigation, information may be supplied to an 
investigator which relates to matters incidental to the primary purpose 
of the investigation but which may relate also to matters under the 
investigative jurisdiction of another agency. Such information cannot 
readily be segregated.
    (iv) From subsection (e)(4) (G) and (H) because this system is 
exempt from the access and amendment provisions of subsection (d) 
pursuant to subsection (k)(1) and (k)(2) of the Privacy Act.
    (v) From subsection (f) because this system is exempt from the 
access and amendment provisions of subsection (d) pursuant to 
subsection (k)(1) and (k)(2) of the Privacy Act.

[[Page 45440]]

    (c)(1) The following system of records is eligible for exemption 
under 5 U.S.C. 552a(k)(5) because it contains investigatory material 
compiled solely for the purpose of determining suitability, 
eligibility, or qualifications for Federal civilian employment, 
military service, Federal contracts, or access to classified 
information, but only to the extent that the disclosure of such 
material would reveal the identity of a source who furnished 
information to the Government under an express promise that the 
identity of the source would be held in confidence, or, prior to 
January 1, 1975, under an implied promise that the identity of the 
source would be held in confidence. Accordingly, this system of records 
is exempt from 5 U.S.C. 552a(d)(1).

Personnel Security Case Files, NARA--24

    (2) Exemptions from the particular subsection is justified as 
access to records in the system would reveal the identity(ies) of the 
source(s) of information collected in the course of a background 
investigation. Such knowledge might be harmful to the source who 
provided the information as well as violate the explicit or implicit 
promise of confidentiality made to the source during the investigation. 
Disclosure might violate the privacy of third parties.

    Dated: August 17, 1998.
John W. Carlin,
Archivist of the United States.
[FR Doc. 98-22672 Filed 8-25-98; 8:45 am]
BILLING CODE 7515-01-P