[Federal Register Volume 66, Number 154 (Thursday, August 9, 2001)]
[Proposed Rules]
[Pages 41811-41814]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 01-19819]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF DEFENSE

32 CFR Part 320

[NIMA Instruction 5500.7R1]


Privacy Act; Implementation

AGENCY: National Imagery and Mapping Agency, DoD.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The National Imagery and Mapping Agency (NIMA) is proposing to 
revise its existing Privacy Act procedural and exemption rules.

DATES: Comments must be received on or before October 9, 2001 to be 
considered by this agency.

ADDRESSES: Comments should be sent to the Office of General Counsel, 
National Imagery and Mapping Agency, Mail Stop D-10, 4600 Sangamore 
Road, Bethesda, MD 20816-5003.

FOR FURTHER INFORMATION CONTACT: Mr. Tom Willess, Associate General 
Counsel, at (301) 227-2953.

SUPPLEMENTARY INFORMATION:

Executive Order 12866, ``Regulatory Planning and Review''

    The Director of Administration and Management, Office of the 
Secretary of Defense, hereby determines that Privacy Act rules for the 
Department of Defense are not significant rules. The rules do not (1) 
Have an annual effect on the economy of $100 million or more or 
adversely affect in a material way the economy; a sector of the 
economy; productivity; competition; jobs; the environment; public 
health or safety; or State, local, or tribal governments or 
communities; (2) Create a serious inconsistency or otherwise interfere 
with an action taken or planned by another Agency; (3) Materially alter 
the budgetary impact of entitlements, grants, user fees, or loan 
programs, or the rights and obligations of recipients thereof; or (4) 
Raise novel legal or policy issues arising out of legal mandates, the 
President's priorities, or the principles set forth in this Executive 
order.

Public Law 96-354, ``Regulatory Flexibility Act'' (5 U.S.C. Chapter 
6)

    The Director of Administration and Management, Office of the 
Secretary of Defense, hereby certifies that Privacy Act rules for the 
Department of Defense do not have significant economic impact on a 
substantial number of small entities because they are concerned only 
with the administration of Privacy Act systems of records within the 
Department of Defense.

Public Law 96-511. ``Paperwork Reduction Act'' (44 U.S.C. Chapter 
35)

    The Director of Administration and Management, Office of the 
Secretary of Defense, hereby certifies that Privacy Act rules for the 
Department of Defense impose no information requirements beyond the 
Department of Defense and that the information collected within the 
Department of Defense is necessary and consistent with 5 U.S.C. 552a, 
known as the Privacy Act of 1974.

Section 202, Public Law 104-4, ``Unfunded Mandates Reform Act''

    The Director of Administration and Management, Office of the 
Secretary of Defense, hereby certifies that Privacy Act rulemaking for 
the Department of Defense does not involve a Federal mandate that may 
result in the expenditure by State, local and tribal governments, in 
the aggregate, or by the private sector, of $100 million or more and 
that such rulemaking will not significantly or uniquely affect small 
governments.

Executive Order 13132, ``Federalism''

    The Director of Administration and Management, Office of the 
Secretaray of Defense, hereby certifies that the Privacy Act rules for 
the Department of Defense do not have federalism implications. The 
rules do not have substantial direct effects on the States, on the 
relationship between the National Government and the States, or on the 
distribution of power and responsibilities among the various levels of 
government.

List of Subjects in 32 CFR Part 320

    Privacy.

    Part 320 is revised to read as follows:

PART 320--NATIONAL IMAGERY AND MAPPING AGENCY PRIVACY PROGRAM

Sec.
320.1  Purposes and scope.
320.2  Definitions.
320.3  Responsibilities
320.4  Procedures for requesting information.
320.5  Disclosure of requested information.
20.6  Requests for correction or amendment to record.
320.7  Agency review of request for correction or amendment of 
record.
320.8  Appeal of initial adverse agency determination on correction 
or amendment.
320.9  Disclosure of record to person other than the individual to 
whom it pertains.
320.10  Fees.
320.11  Penalties.
320.12  Exemptions.

    Authority: Pub. L. 93-579, 88 Stat. 1986 (5 U.S.C. 552a).

Sec. 320.1  Purpose and scope.

    (a) This part is published pursuant to the Privacy Act of 1974, as 
amended (5 U.S.C. 552a), (hereinafter the ``Privacy Act''). This part:
    (1) Establishes or advises of the procedures whereby an individual 
can:
    (i) Request notification of whether the National Imagery and 
Mapping Agency (NIMA) maintains or has disclosed a record pertaining to 
him in any nonexempt system of records,
    (ii) Request a copy or other access to such a record or to an 
accounting of its disclosure,
    (iii) Request that the record be amended and
    (iv) Appeal any initial adverse determination of any such request;
    (2) Specifies those systems of records which the Director, 
Headquarters NIMA has determined to be exempt from the procedures 
established by this regulation and from certain provisions of the 
Privacy Act. NIMA policy encompasses the safeguarding of

[[Page 41812]]

individual privacy from any misuse of NIMA records and the provision of 
the fullest access practicable to individuals to NIMA records 
concerning them.


Sec. 320.2  Definitions.

    As used in this part:
    (a) Appellate authority (AA). A NIMA employee who has been granted 
authority to review the decision of the Initial Denial Authority (IDA) 
that has been appealed by the Privacy Act requester and make the appeal 
determination for NIMA on the releasability of the records in question.
    (b) Individual. A living person who is a citizen of the United 
States or an alien lawfully admitted for permanent residence. The 
parent of a minor or the legal guardian of any individual also may act 
on behalf of an individual. Corporations, partnerships, sole 
proprietorships, professional groups, businesses, whether incorporated 
or unincorporated, and other commercial entities are not 
``individuals''.
    (c) Initial denial authority (IDA). A NIMA employee, or designee, 
who has been granted authority to make an initial determination for 
NIMA that records requested in a Privacy Act request should be withheld 
from disclosure or release.
    Maintain. Includes maintain, collect, use or disseminate.
    (e) Personal information. Information about an individual that 
identifies, relates to or is unique to, or describes him or her; e.g., 
a social security number, age, military rank, civilian grade, marital 
status, race, or salary, home/office phone numbers, etc.
    (r)  Record. Any item, collection, or grouping of information, 
whatever the storage media (e.g., paper, electronic, etc.), about an 
individual that is maintained by NIMA, including, but not limited to 
education, financial transactions, medical history, criminal or 
employment history, and that contains the individual's name or the 
identifying number, symbol or other identifying particulars assigned to 
the individual such as a finger or voice print or a photograph.
    (g) Routine use. The disclosure of a record outside the Department 
of Defense for a use that is compatible with the purpose for which the 
information was collected and maintained by the Department of Defense. 
The routine use must be included in the published system notice for the 
system of records involved.
    (h) System of records. A group of records under the control of NIMA 
from which personal information is retrieved by the individual's name 
or by some identifying number, symbol, or other identifying particular 
assigned to the individual.
    (i) System manger. The NIMA official who is responsible for the 
operation and management of a system of records.


Sec. 320.3  Responsibilities.

    (a) Director of NIMA:
    (1) Implements the NIMA privacy program.
    (2) Designates the Director of the Public Affairs Office as the 
NIMA Initial Denial Authority.
    (3) Designates the Chief of Staff as the Appellate Authority.
    (4) Designates the General Counsel as the NIMA Privacy Act Officer 
and the principal point of contact for matters involving the NIMA 
privacy program.
    (b) NIMA General Counsel:
    (1) Oversees systems of records maintained throughout NIMA, 
administered by IS `WHAT IS IS'. This includes coordinating all notices 
of new systems of records and changes to existing systems for 
publication in the Federal Register.
    (2) Coordinates all denials of requests for access to or amendment 
of records.
    (3) Assesses and collects fees for costs associated with processing 
Privacy Act requests and approves or denies requests for fee waivers. 
Fees collected are forwarded through Financial Management Directorate 
to the U.S. Treasury.
    (4) Prepares the annual report to the Defense Privacy Office.
    (5) Oversees investigations of allegations of unauthorized 
maintenance, disclosure, or destruction of records.
    (6) Conducts or coordinates Privacy Act training for NIMA personnel 
as needed, including training for public affairs officers and others 
who deal with the public and news media.
    (c) NIMA System Managers:
    (1) Ensure that all personnel who either have access to a system of 
records or who are engaged in developing or supervising procedures for 
handling records in a system of records are aware of their 
responsibilities for protecting personal information.
    (2) Prepare notices of new systems of records and changes to 
existing systems for publication in the Federal Register.
    (3) Ensure that no records subject to this part are maintained for 
which a systems notice has not been published.
    (4) Respond to requests by individuals for access, correction, or 
amendment to records maintained pursuant to the NIMA privacy program.
    (5) Provide recommendations to General Counsel for responses to 
requests from individuals for access, correction, or amendment to 
records.
    (6) Safeguard records to ensure that they are protected from 
unauthorized alteration or disclosure.
    (7) Dispose of records in accordance with accepted records 
management practices to prevent inadvertent compromise. Disposal 
methods such as tearing, burning, melting, chemical decomposition, 
pulping, pulverizing, shredding, or mutilation are considered adequate 
if the personal data is rendered unrecognizable or beyond 
reconstruction.


Sec. 320.4  Procedures for requesting information.

    (a) Upon request in person or by mail, any individual, as defined 
in Sec. 320.2, shall be informed whether or not any NIMA system of 
records contains a record pertaining to him.
    (b) Any individual requesting such information in person may appear 
at NIMA General Counsel Office (refer to the NIMA address list at 
paragraph (e) of this section) or at the NIMA office thought to 
maintain the record in question and shall provide:
    (1) Information sufficient to identify the record, e.g., the 
individual's own name, date of birth, place of birth, and, if possible, 
an indication of the type of record believed to contain information 
concerning the individual, and
    (2) Acceptable identification to verify the individual's identity, 
e.g., driver's license, employee identification card or medicare card.
    (c) Any individual requesting such information by mail shall 
address the request to the Office of General Counsel (refer to 
paragraph (e) of this section) or NIMA office thought to maintain the 
record in question and shall include in such request the following:
    (1) Information sufficient to identify the record, e.g., the 
individual's own name, date of birth, place of birth, and, if possible, 
an indication of the type of record believed to contain information 
concerning the individual, and
    (2) A notarized statement or unsworn declaration in accordance with 
28 U.S.C. 1746 to verify the individual's identity, if, in the opinion 
of the NIMA system manager, the sensitivity of the material involved 
warrants.
    (d) NIMA procedures on requests for information. Upon receipt of a 
request for information made in accordance with these regulations, 
notice of the existence or nonexistence of any records described in 
such requests will be furnished to the requesting party within ten 
working days of receipt.
    (e) Written requests for access to records should be sent to NIMA 
Bethesda, ATTN: NIMA/GC, Mail Stop

[[Page 41813]]

D-10, 4600 Sangamore Road, Bethesda, MD 20816-5003.
    (f) Requests for information made under the Freedom of Information 
Act are processed in accordance with ``DoD Freedom of Information Act 
Program Regulation'' (32 CFR part 286).
    (g) Requests for personal information from the Government 
Accounting Office (GAO) are processed in accordance with DoD Directive 
7650.1 \1\ ``GAO Access to Records''.
---------------------------------------------------------------------------

    \1\ Copies may be obtained: http://web7.whs.osd.mil/corres.htm
---------------------------------------------------------------------------


Sec. 320.5  Disclosure of requested information.

    (a) Upon request by an individual made in accordance with the 
procedures set forth in this section, such individual shall be granted 
access to any pertinent record which is contained in a nonexempt NIMA 
system of records. However, nothing in this section shall allow an 
individual access to any information compiled by NIMA in reasonable 
anticipation of a civil or criminal action or proceeding.
    (b) Procedures for requests for access to records. Any individual 
may request access to a pertinent NIMA record in person or by mail.
    (1) Any individual making such request in person shall appear at 
Office of General Counsel, NIMA Bethesda, ATTN: NIMA/GC, Mail Stop D-
10, 4600 Sangamore Road, Bethesda, MD 20816-5003, and shall provide 
identification to verify the individuals' identity, e.g., driver's 
license, employee identification card, or medicare card.
    (2) Any individual making a request for access to records by mail 
shall address such request to the Office of General Counsel, NIMA 
Bethesda, ATTN: NIMA/GC, Mail Stop D-10, 4600 Sangamore Road, Bethesda, 
MD 20816-5003; and shall include therein a signed, notarized statement, 
or an unsworn statement or declaration in accordance with 28 U.S.C. 
1746, to verify identity.
    (3) Any individual requesting access to records under this section 
in person may be accompanied by a person of the individual's own 
choosing while reviewing the record requested. If an individual elects 
to be so accompanied, said individual shall give notice of such 
election in the request and shall provide a written statement 
authorizing disclosure of the record in the presence of the 
accompanying person. Failure to so notify NIMA in a request for access 
shall be deemed to be a decision by the individual not to be 
accompanied.
    (c) NIMA determination of requests for access.
    (1) Upon receipt of a request made in accordance with this section, 
the NIMA Office of General Counsel or NIMA office having responsibility 
for maintenance of the record in question shall release the record, or 
refer it to an Initial Denial Authority, who shall:
    (i) Determine whether such request shall be granted.
    (ii) Make such determination and provide notification within 30 
working days after receipt of such request.
    (iii) Notify the individual that fees for reproducing copies of 
records will be assessed and should be remitted before the copies may 
be delivered. Fee schedule and rules for assessing fees are contained 
in Sec. 320.9.
    (iv) Requests for access to personal records may be denied only by 
an agency official authorized to act as an Initial Denial Authority or 
Final Denial Authority, after coordination with the Office of General 
Counsel.
    (2) If access to a record is denied because such information has 
been copied by NIMA in reasonable anticipation of a civil or criminal 
action or proceeding, the individual will be notified of such 
determination and his right to judicial appeal under 5 U.S.C. 552a(g).
    (d) Manner of providing access.
    (1) If access is granted, the individual making the request shall 
notify NIMA whether the records requested are to be copied and mailed.
    (2) If the records are to be made available for personal inspection 
the individual shall arrange for a mutually agreeable time and place 
for inspection of the record. NIMA reserves the right to require the 
presence of a NIMA officer or employee during personal inspection of 
any record pursuant to this section and to request of the individual 
that a signed acknowledgement of the fact be provided that access to 
the record in question was granted by NIMA


Sec. 320.6  Request for correction or amendment to record.

    (a) Any individual may request amendment of a record pertaining to 
said individual.
    (b) After inspection of a pertinent record, the individual may file 
a request in writing with the NIMA Office of General Counsel for 
amendment. Such requests shall specify the particular portions of the 
record to be amended, the desired amendments and the reasons, supported 
by documentary proof, if available.


Sec. 320.7  Agency review of request for correction or amendment of 
record.

    (a) Not later than 10 working days after receipt of a request to 
amend a record, in whole or in part, the NIMA Office of General 
Counsel, or NIMA office having responsibility for maintenance of the 
record in question, shall correct any portion of the record which the 
individual demonstrates is not accurate, relevant, timely or complete, 
and thereafter either inform the individual of such correction or 
process the request for denial.
    (b) Denials of requests for amendment of a record will be made only 
by an agency official authorized to act as an Initial Denial Authority, 
after coordination with the Office of General Counsel. The denial 
letter will inform the individual of the denial to amend the record 
setting forth the reasons therefor and notifying the individual of his 
right to appeal the decision to NIMA.
    (c) Any person or other agency to whom the record has been 
previously disclosed shall be informed of any correction or notation of 
dispute with respect to such records.
    (d) These provisions for amending records are not intended to 
permit the alteration of evidence previously presented during any 
administrative or quasi-judicial proceeding, such as an employee 
grievance case. Any changes in such records should be made only through 
the established procedures for such cases. Further, these provisions 
are not designed to permit collateral attack upon what has already been 
the subject of an administrative or quasi-judicial action. For example, 
an individual may not use this procedure to challenge the final 
decision on a grievance, but the individual would be able to challenge 
the fact that such action has been incorrectly recorded in his file.


Sec. 320.8  Appeal of initial adverse agency determination on 
correction or amendment.

    (a) An individual whose request for amendment of a record 
pertaining to him may further request a review of such determination in 
accordance with this section.
    (b) Not later than 30 working days following receipt of 
notification of denial to amend, an individual may file an appeal of 
such decision with NIMA. The appeal shall be in writing, mailed or 
delivered to NIMA, ATTN: Mail Stop D-10, 4600 Sangamore Road, Bethesda, 
MD 20816-5003. The appeal must identify the records involved, indicate 
the dates of the request and adverse determination, and indicate the 
express basis for that determination. In addition, the letter of appeal 
shall state briefly and succinctly the reasons why the adverse 
determination should be reversed.
    (c) Upon appeal from a denial to amend a record the NIMA Appellate

[[Page 41814]]

Authority or designee shall make a determination whether to amend the 
record and must notify the individual of that determination by mail, 
not later than 10 working days after receipt of such appeal, unless 
extended pursuant to paragraph (d) of this section.
    (1) The Appellate Authority or designee shall also notify the 
individual of the provisions of the Privacy Act of 1974 regarding 
judicial review of the NIMA Appellate Authority's determination.
    (2) If on appeal the denial to amend the record is upheld, the 
individual shall be permitted to file a statement setting forth the 
reasons for disagreement with the Appellate Authority's determination 
and such statement shall be appended to the record in question.
    (d) The Appellate Authority or designee may extend up to 30 days 
the time period in which to make a determination on an appeal from 
denial to amend a record for the reason that a fair and equitable 
review cannot be completed within the prescribed time period.


Sec. 320.9  Disclosure of record to persons other than the individual 
to whom it pertains.

    (a) No officer or employee of NIMA will disclose any record which 
is contained in a system of records, by any means of communication to 
any person or agency within or outside the Department of Defense 
without the request or consent of the individual to whom the record 
pertains, except as described in 32 CFR 310.41; Appendix C to part 310 
of this chapter; and/or a NIMA Privacy Act system of records notice.
    (b) Any such record may be disclosed to any person or other agency 
only upon written request, of the individual to whom the record 
pertains.
    (c) In the absence of a written consent from the individual to whom 
the record pertains, such record may be disclosed only provided such 
disclosure is:
    (1) To those officers and employees of the DoD who have a need for 
the record in the performance of their duties.
    (2) Required under the Freedom of Information Act (32 CFR part 
286).
    (3) For a routine use established within the system of records 
notice.
    (4) To the Bureau of Census for purposes of planning or carrying 
out a census or survey or related activity pursuant to the provisions 
of title 13.
    (5) To a recipient who has provided the NIMA with adequate advance 
written assurance that the record will be used solely as a statistical 
research or reporting record and the record is transferred in a form 
that is not individually identifiable and will not be used to make any 
decisions about the rights, benefits or entitlements of an individual.
    (6) To the National Archives of the United States as a record which 
has sufficient historical or other value to warrant its continued 
preservation by the U.S. Government or for evaluation by the 
Administrator of the General Services Administration or his designee to 
determine whether the record has such value.
    (7) To another agency or to an instrumentality of any governmental 
jurisdiction within or under the control of the U.S. for a civil or 
criminal law enforcement activity authorized by law, provided the head 
of the agency or instrumentality has made a prior written request to 
the Director, NIMA specifying the particular record and the law 
enforcement activity for which it is sought.
    (8) To a person pursuant to a showing of compelling circumstances 
affecting the health or safety of an individual, if upon such 
disclosure notification is transmitted to the last known address of 
such individual.
    (9) To either house of Congress, and, to the extent of the matter 
within its jurisdiction, any committee or subcommittee or joint 
committee of Congress.
    (10) To the Comptroller General or any of the authorized 
representatives in the course of the performance of the duties of the 
GAO.
    (11) Under an order of a court of competent jurisdiction.
    (12) To a consumer reporting agency in accordance with section 
3711(f) of title 31.
    (d) Except for disclosures made pursuant to paragraphs (c)(1) and 
(2) of this section, an accurate accounting will be kept of the data, 
nature and purpose of each disclosure of a record to any person or 
agency, and the name and address of the person or agency to whom the 
disclosure was made. The accounting of disclosures will be made 
available for review by the subject of a record at his request except 
for disclosures made pursuant to paragraph (c)(7) of this section. If 
an accounting of disclosure has been made, any person or agency 
contained therein will be informed of any correction or notation of 
dispute made pursuant to Sec. 320.6 of this part.


Sec. 320.10  Fees.

    Individuals may request copies for retention of any documents to 
which they are granted access to NIMA records pertaining to them. 
Requesters will not be charged for the first copy of any records 
provided; however, duplicate copies will require a charge to cover 
costs of reproduction. Such charges will be computed in accordance with 
32 CFR part 310.


Sec. 320.11  Penalties.

    The Privacy Act of 1974 (5 U.S.C. 552a(i)(3)) makes it a 
misdemeanor subject to the maximum fine at $5,000, to knowingly and 
willfully request or obtain any record concerning an individual under 
false pretenses. The Act also establishes similar penalties for 
violations by NIMA employees of the Act or regulations established 
thereunder.


Sec. 320.12  Exemptions.

    (a) Exempt Systems of Record. All systems of records maintained by 
the NIMA and its components shall be exempt from the requirements of 5 
U.S.C. 552a(d) pursuant to the 5 U.S.C. 552a(k)(1) to the extent that 
the system contains any information properly classified under Executive 
Order 12958 and that is required by Executive Order to be withheld in 
the interest of national defense or foreign policy. This exemption is 
applicable to parts of all system of records, including those not 
otherwise specifically designated for exemptions herein which contain 
isolated items of properly classified information.

    Dated: August 1, 2001.
L.M. Bynum,
Alternate OSD Federal Register Liaison Officer, Department of Defense.
[FR Doc. 01-19819 Filed 8-08-01; 8:45 am]
BILLING CODE 5001-08-M