This part implements the basic policies and procedures outlined in the Privacy Act of 1974, as amended (5 U.S.C. 552a), and 32 CFR part 310; and establishes the National Reconnaissance Office Privacy Program (NRO) by setting policies and procedures for the collection and disclosure of information maintained in records on individuals, the handling of requests for amendment or correction of such records, appeal and review of NRO decisions on these matters, and the application of exemptions.

Obligations under this part apply to all employees detailed, attached, or assigned to or authorized to act as agents of the National Reconnaissance Office. The provisions of this part shall be made applicable by contract or other legally binding action to government contractors whenever a contract is let for the operation of a system of records or a portion of a system of records.

Access. The review or copying of a record or its parts contained in a system of records by a requester.

Agency. Any executive or military department, other establishment, or entity included in the definition of agency in 5 U.S.C. 522(f).

Control. Ownership or authority of the NRO pursuant to federal statute or privilege to regulate official or public access to records.

Disclosure. The authorized transfer of any personal information from a system of records by any means of communication (such as oral, written, electronic, mechanical, or actual review) to any person, private entity, or government agency other than the subject of the record, the subject's designated agent, or the subject's legal guardian.

He, him, and himself. Generically used in this part to refer to both males and females.

Individual or requester. A living citizen of the U.S. or an alien lawfully admitted to the U.S. for permanent residence and to whom a record might pertain. The legal guardian or legally authorized agent of an individual has the same rights as the individual and may act on his behalf. No rights are vested in the representative of a dead person or in persons acting in an entrepreneurial (for example, sole proprietorship or partnership) capacity under this part.

Interested party. Any official in the executive (including military), legislative, or judicial branches of government, U.S. or foreign, or U.S. Government contractor who, in the sole discretion of the NRO, has a subject matter or physical interest in the documents or information at issue.

Maintain. To collect, use, store, disclose, retain, or disseminate when used in connection with records.

Originator. The NRO employee or contractor who created the document at issue or his successor in office or any official who has been delegated release or declassification authority pursuant to law.

Personal information. Information about any individual that is intimate or private to the individual, as distinguished from ‘corporate information’ which is in the public domain and related solely to the individual's official functions or public life (i.e., employee's name, job title, work phone, grade/rank, job location).

Privacy Act Coordinator. The NRO Information and Access Release Center Chief who serves as the NRO manager ofthe information review and release program instituted under the Privacy Act.

Record. Any item, collection, or grouping of information about an individual that is maintained by the NRO, including, but not limited to, the individual's education, financial transactions, medical history, and criminal or employment history, and that contains the individual's name or identifying number (such as Social Security or employee number), symbol, or other identifying particular assigned to the individual, such as fingerprint, voice print, or photograph. Records include data about individuals which is stored in computers.

Responsive record. Documents or records that the NRO has determined to be within the scope of a Privacy Act request.

Routine use. The disclosure of a record outside the Department of Defense (DoD) for a use that is compatible with the purpose for which the information was collected and maintained by NRO. Routine use encompasses not only common or ordinary use, but also all the proper and necessary uses of the record even if such uses occur infrequently. All routine uses must be published in the Federal Register.

System managers. Officials who have overall responsibility for a Privacy Act system of records.

System notice. The official public notice published in the Federal Register of the existence and general content of the system of records.

System of records. A group of any records under the control of the NRO from which information is retrieved by the name of an individual or by some identifying number, symbol, or other identifying particular assigned to that individual.

Working days. Days when the NRO is operating and specifically excludes Saturdays, Sundays, and legal public holidays.

(a) Records about individuals—

(1) Collection. The NRO will safeguard the privacy of individuals identified in its records. Information about an individual will, to the greatest extent practicable, be collected directly from the individual, and personal information will be protected from unintentional or unauthorized disclosure by treating it as marked ‘For Official Use Only.’ Access to personal information will be restricted to those employees whose official duties require it during the regular course of business.

(i) Privacy Act Statement. When an individual is requested to furnish personal information about himself for inclusion in a system of records, a Privacy Act Statement is required to enable him to make an informed decision whether to provide the information requested. A Privacy Act Statement may appear, in order of preference, at the top or bottom of a form, on the reverse side of a form, or attached to the form as a tear-off sheet.

(ii) Social Security Numbers (SSNs). It is unlawful for any governmental agency to deny an individual any right, benefit, or privilege provided by law because the individual refuses to provide his SSN. However, if a federal statute requires that the SSN be furnished or if the SSN is required to verify the identity of an individual in a system of records that was established and in use before January 1, 1975, this restriction does not apply. When collecting the SSN, a ‘qualified’ Privacy Act Statement must be provided even if the SSN will not be maintained in a system of records. The 'qualified' Privacy Act Statement shall inform the individual whether the disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.

(2) Maintenance. The NRO will maintain in its records only such information about an individual which is accurate, relevant, timely, and necessary to accomplish a purpose which is required by statute or Executive Order. All records used by the NRO to make determinations about individuals will be maintained with such accuracy and completeness as is reasonably necessary to assure fairness to the individual.

(3) Existence. The applicability of the Privacy Act depends on the existence of an identifiable record. The procedures described in NRO regulations do not require that a record be created or that an individual be given access to records that are not retrieved by name or other individual identifier. Nor do these procedures entitle an individual to have access to any information compiled in reasonable anticipation of a civil action or proceeding. NRO will maintain only those systems of records that have been described through notices published in the Federal Register. A system of records from which records may be retrieved by a name or some other personal identifier must be under NRO control for consideration under this part.

(4) Disposal. The NRO will archive, dispose of, or destroy records containing personal data in a manner to prevent specific records from being readily identified or inadvertently compromised.

(b) Evaluation of records. Statutory authority to establish and maintain a system of records does not grant unlimited authority to collect and maintain all information which may be useful or convenient. Directorates and offices maintaining records will evaluate each category of information in records systems for necessity and relevance prior to republication of all system notices in the Federal Register and during the design phase or change of a system of records. The following will be considered in the evaluation:

(1) Relationship of each item of information to the statutory purpose for which the system is maintained;

(2) Specific adverse consequences of not collecting each category of information; and

(3) Techniques for purging parts of the records.

(c) Disclosure of records. The NRO will provide the fullest access practicable by individuals to NRO records concerning them. Release of personal information to such individuals is not considered public release of information. Upon receipt of a written request, the NRO will release to individuals those records that are releasable and applicable to the individual making the request. Generally, information, other than that exempted by law and this part, will be provided to the individual. NRO personnel will comply with the Privacy Act of 1974, as amended, the DoD Privacy Act Program (32 CFR part 310), and the NRO Privacy Act Program. No NRO records shall be disclosed by any means of communication to any person or to any agency except pursuant to a written request by or the prior written consent of the individual to whom it pertains, unless disclosure of the record will be:

(1) To those employees of the NRO who have an official need for the record in the performance of their duties.

(2) Required to be disclosed to a member of the public under the Freedom of Information Act, as amended.

(3) For a routine use as defined in the Privacy Act.

(4) To the Census Bureau for the purpose of conducting a census or survey or related activity authorized by law.

(5) To a recipient who has provided the NRO with advance, adequate written assurance that the record will be used solely as statistical research and that the record is to be transferred in a form in which the individual is not identifiable.

(6) To the National Archives of the United States as a record which has sufficient historical or other value to warrant its continued preservation by the U. S. Government.

(7) To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the U.S. for a civil or criminal law enforcement activity if such activity is authorized by law and if the head of the agency or governmental entity has made a written request to the NRO specifying the particular portion of the record and the law enforcement activity for which the record is sought (blanket requests will not be accepted); a record may also be disclosed to a law enforcement agency at the initiative of the NRO pursuant to the blanket routine use for law enforcement when criminal conduct is indicated in the record.

(8) To a person showing compelling circumstances affecting the health or safety of an individual if, upon such disclosure, notification is sent to the last known address of the individual to whom the record pertains (emergency medical information may be released by telephone).

(9) To Congress or any committee, joint committee, or subcommittee of Congress with respect to a matter under its jurisdiction. This provision does not authorize the disclosure of a record to members of Congress acting in their individual capacities or on behalf of their constituents making third party requests. However, such releases may be made pursuant to the blanket routine use for Congressional inquiries when a constituent has sought the assistance of his Congressman forthe constituent's individual record(s).

(10) To the Comptroller General or any of his authorized representatives in the course of the performance of the duties of the General Accounting Office.

(11) Pursuant to an order of a court of competent jurisdiction. When the record is disclosed under compulsory legal process and when the issuance of that order or subpoena is made public by the court which issued it, the NRO will make reasonable efforts to notify the individual to whom the record pertains by mail at the most recent address contained in NRO records.

(12) To a consumer reporting agency in accordance with 31 U.S.C. 3711(f).

(d) Allocation of resources. NRO components shall exercise due diligence in their responsibilities under the Privacy Act and must devote a reasonable level of personnel to respond to requests on a ‘first-in, first-out’ basis. In allocating Privacy Act resources, the component shall consider its imposed business demands, the totality of resources available to it, the information review and release demands imposed by Congress and other governmental authorities, and the rights of the public under various disclosure laws. The PA Coordinator will establish priorities for cases consistent with established law to ensure that smaller as well as larger ‘project’ cases receive equitable attention.

(e) Written permission for disclosure. Disclosures made under circumstances not delineated in this part shall be made only if the written permission of the individual involved has been obtained. Written permission shall be recorded on or appended to the document transmitting the personal information to the other agency, in which case no separate accounting of the disclosure need be made. Written permission is required in each case; that is, once obtained, written permission for one case does not constitute blanket permission for other disclosures.

(f) Coordination with other government agencies. Records systems of the NRO may contain records originated by other agencies that may have claimed exemptions for them under the Privacy Act. Where appropriate, coordination will be effected with the originating agency. The NRO will comply with the instructions issued by another agency responsible for a system of records (e.g., Office of Personnel Management) in granting access to such records. Records containing information or interests of another government agency will not be released until coordination with the other agency involved. A request for information pertaining to the individual in an NRO record system received from another federal agency will be coordinated with the originating agency.

(g) Accounting for disclosure. Except for disclosures made under paragraphs (c)(1) and (c)(2) of this section, an accurate account of the disclosures shall be kept by the record holder in consultation with the Privacy Act Coordinator (PA Coordinator). There need not be a notation on a single document of every disclosure of a particular record. The record holder should be able to construct from its system of records the accounting information:

(1) When required by the individual to whom the record pertains, or

(2) When necessary to inform previous recipients of any amended records. The accounting shall be retained for at least five years or for the life of the record, whichever is longer, to be available for review by the subject of the record at his request except for disclosures made under paragraph (c)(7) of this section.

(h) Application of rules. Any request for access, amendment, correction, etc., of personal record information in a system of records by an individual to whom such information pertains will be governed by the Privacy Act of 1974, as amended, DoD regulatory authority, and this part, exclusively. Any denial or exemption of all or part of a record from access, disclosure, amendment, correction, etc., will be processed under DoD regulatory authority and this part, unless court order or other competent authority directs otherwise.

(i) First Amendment rights. No NRO official or component may maintain any information pertaining to the exercise by an individual of his rights under the First Amendment without the permission of that individual unless such collection is specifically authorized by statute or pertains to an authorized law enforcement activity.

(j) Non-system information on individuals. The following information is not considered part of personal records systems reportable under this part and may be maintained by NRO for ready identification, contact, and property control purposes only, provided it is not maintained in a system of records. If at any time the information described in this paragraph is being maintained in a system of records, the information is subject to the Privacy Act.

(1) Identification information at doorways, building directories, desks, lockers, name tags, etc.

(2) Geographical or agency contact cards.

(3) Property receipts and control logs for building passes, credentials, vehicles, etc.

(4) Personal working notes of employees that are merely an extension of the author's memory, if maintained properly, do not come under the Privacy Act. Personal notes are not considered official NRO records if they meet the following requirements:

(i) Keeping or discarding notes must be at the sole discretion of the author. Any requirement by supervising authority, whether by oral or written directive, regulation, policy, or memo to maintain such notes, likely would cause the notes to become official agency records.

(ii) Such notes must be restricted to the author's personal use as memory aids, and only the author may have access to them. Passing them to a successor or showing them to other personnel (including supporting staff such as secretaries) would likely cause them to become agency records.

(5) Rosters. The NRO has no restriction against rosters that contain only corporate information such as name, work telephone number, and position. Good recordkeeping practices dictate that only rosters that are relevant and necessary to the NRO's operations may be maintained, and therefore convenience rosters, which by definition do not satisfy the test, may not be maintained.

(a) The Director, NRO (DNRO):

(1) Supervises the execution of the Privacy Act and this part within the NRO.

(2) Appoints:

(i) The Chief, Information Access and Release Center as the NRO Privacy Act Coordinator.

(ii) The Director of Security, the Director of Policy, and the NRO General Counsel as the NRO Appeals Panel; and

(iii) The Chief of Staff as the Senior Official for Privacy Policy and the Privacy Act Appeal Authority.

(b) The Privacy Act Coordinator, NRO:

(1) Establishes, issues, and updates policy for the NRO Privacy Act Program, monitors compliance, and serves as the principal NRO point of contact on all Privacy Act matters.

(2) Receives, processes, and responds to all PrivacyAct requests received by the NRO, including:

(i) Granting, granting in part, or denying an initial Privacy Act request for access or amendment to a record, and notifying a requester of such actions taken in regard to that request.

(ii) Granting a requester access to all or part ofa record under dispute when, after a review, a decision is made in favor of a requester.

(iii) Directing the appropriate NRO component to amend a record and advising other record holders to amend a record when a decision is made in favor of a requester.

(iv) Notifying a requester, if a request is denied, of the reasons for denial and the procedures for appeal to the Privacy Act Appeal Authority.

(v) Notifying a requester of his right to file a concise statement of his reasons for disagreement with the NRO's refusal to amend a record.

(vi) Directing that a requester's statement of reasons for the request to amend, his concise statement of disagreement with the NRO's refusal to amend a record, and the NRO's letter of denial be included in the file containing the disputed record.

(vii) Referring all appeals to the Privacy Act Appeals Panel and Appeal Authority.

(viii) Notifying a requester of any required fees and delivering such collected fees to the Comptroller.

(ix) Obtaining supplemental information from the requester when required.

(3) Serves as the NRO point of contact with the Defense Privacy Office.

(4) Reviews NRO use of records, and at least 40 calendar days prior to establishing a new agency system of records, ensures that new or amended notices are prepared and published in the Federal Register consistent with the requirements of 32 CFR part 310;

(5) Coordinates with forms managers to ensure that a Privacy Act Statement is on all forms or in all other methods used to collect personal information for inclusion in any NRO records system;

(6) Prepares the NRO Privacy Act report for submission to the DoD Privacy Office and to other authorities, as required by 32 CFR part 310.

(7) Reviews all procedures, including forms, which require an individual to furnish information for conformity with the Privacy Act.

(8) Retains the accounting of disclosures for at least five years or for the life of the record, whichever is longer, to be available for review by the subject of the record at his request except for disclosures made under paragraph (c)(7) of § 326.4; and

(9) Develops and oversees Privacy Act Program training for NRO personnel.

(c) The Privacy Act Appeals Panel, NRO:

(1) Meets and reviews all denials appealed by means of the NRO internal appeals process; and

(2) Recommends a finding to the Privacy Act Appeal Authority by a majority vote of those present at the meeting and based on the written record and the panel's deliberations.

(d) The Privacy Act Appeal Authority, NRO:

(1) Determines all NRO Privacy Act appeals.

(2) Reports the determination to the PA Coordinator.

(3) Signs the final appeal letter to the requester.

(e) General Counsel, NRO:

(1) Ensures uniformity in NRO legal positions concerning the Privacy Act and reviews proposed responses to Privacy Act requests to ensure legal sufficiency, as appropriate.

(2) Consults with DoD General Counsel on final denials that may be inconsistent with other final decisions within DoD; raises new legal issues of potential significance to other government agencies.

(3) Provides advice and assistance to the DNRO, the PA Coordinator, and component Directors, as required, in the discharge of their responsibilities pertaining to the Privacy Act.

(4) Advises on all legal matters concerning the Privacy Act, including legal decisions, rulings by the Department of Justice, and actions by DoD and other commissions on the Privacy Act.

(5) Approves all Privacy Act Statements prior to their reproduction and distribution.

(6) Acts as the NRO focal point for Privacy Act litigation with the Department of Justice.

(7) Provides a status report to the Defense Privacy Office, consistent with the requirements of 32 CFR part 310, whenever an individual brings suit under subsection (g) of the Privacy Act against NRO.

(f) Chief Information Officer (CIO), NRO:

(1) Ensures that NRO systems of records databases have procedures to protect the confidentiality of personal records maintained or processed by means of automatic data processing (ADP) systems and ensures that ADP systems contain appropriate safeguards for the privacy of personnel.

(2) Coordinates with the PA Coordinator before developing or modifying CIO-sponsored ADP supported files subject to the provisions of this part.

(g) Directorate and Office Managers, NRO:

(1) Ensure that records contained in their directorate or office systems of records are disclosed only to those NRO officials or employees who require the records for official purposes.

(2) Review their own directorate and office systems of records to ensure and certify that no systems of records other than those listed in the Federal Register System Notices are maintained; notify the CIO and the PA Coordinator promptly whenever there are changes to processing equipment, hardware, software, or database that may require an amended system notice.

(3) Maintain only such information about an individual as is relevant and necessary to accomplish a purpose which is required by statute or Executive Order and identify the specific provision of law or Executive Order which provides authority for the maintenance of information in each system of records.

(h) System Managers, NRO:

(1) Ensure that adequate safeguards have been established and are enforced to prevent the misuse, unauthorized disclosure, alteration, or destruction of personal information contained in system records.

(2) Ensure that all personnel who have access tothe system of records, or are engaged in developing or supervising procedures for handling records, are aware of their responsibilities established by the NRO Privacy Act Program.

(3) Evaluate each system of records during the planning stage and at regular intervals. The following factors should be considered:

(i) Relationship of data to be collected and retained to the purposes for which the system is maintained (all information must be relevant and necessary to the purpose for which it is collected).

(ii) The specific impact on the purpose or mission if categories of information are not collected (all data fields must be necessary to accomplish a lawful purpose or mission).

(iii) Whether informational needs can be met without using personal identifiers.

(iv) The cost of maintaining and disposing of records within the systems of records and the length of time each item of information must be retained according to the NRO Records Control Schedule as approved by the National Archives and Records Administration.

(4) Review system alterations or amendments to evaluate for relevancy and necessity.

(i) Forms and Information Managers. All NRO individualsresponsible for forms or methods used to collect personal information from individuals will:

(1) Ensure that Privacy Act Statements are on appropriate forms and that new forms have the required Privacy Act Statement.

(2) Determine, with General Counsel's concurrence, which forms require Privacy Act Statements and will prepare such statements.

(3) Assist the initiators in determining whether a form, format, questionnaire, or report requires a Privacy Act Statement. Privacy Act Statements must be complete, specific, written in plain English, and approved by the Office of General Counsel.

(j) Employees, NRO:

(1) Will be familiar with the provisions of this part regarding the maintenance of systems of records, authorized access, and authorized disclosure;

(2) Will collect, maintain, use, and/or disseminate records containing identifiable personal information only for lawful purposes; will keep the information current, complete, relevant, and accurate for its intended use; and will safeguard the records in a system and keep them the minimum time required;

(3) Will not disclose any personal information contained in any system of records, except as authorized by the Privacy Act and this part;

(4) Will maintain no system of records concerning individuals except those authorized, and will maintain no other information concerning individuals except as necessary for the conduct of business at the NRO;

(5) Will provide individuals a Privacy Act Statement when asking them to provide information about themselves. The Privacy Act Statement will include the authority under which the information is being requested, whether disclosure of the information is mandatory or voluntary, the purposes for which it is being requested, the uses to which it will be put, and the consequences of not providing the information;

(6) May not deny an individual any right or privilege provided by law because of that individual's failure to disclose his SSN unless such information is required by federal statute or disclosure was required by statute or regulations adopted prior to January 1, 1975. If disclosure of the SSN is not required, NRO directorates and offices are not precluded from requesting it from individuals; however, the Privacy Act Statement must make clear that the disclosure of the SSN is voluntary and, if the individual refuses to disclose it, must be prepared to identify him by alternate means.

(7) Will collect personal information directly from the subject whenever possible; employees may collect information from third parties when that information must be verified, opinions or evaluations are required, the subject cannot be contacted, or the subject requests it.

(8) Will keep paper and electronic records which contain personal information and are retrieved by name or personal identifier only in approved systems published in the Federal Register.

(9) Will amend and correct records when directed by the PA Coordinator.

(10) Will report to the PA Coordinator any disclosures of personal information from a system of records, or the maintenance of any system of records, not authorized by this part.

(a) An individual's written request for access to records about himself which does not specify the Act under which the request is made will be processed under both the Freedom of Information Act (FOIA) and the Privacy Act and the applicable regulations. Such requests will be processed under both Acts regardless of whether the requester cites one Act, both, or neither in the request in order to ensure the maximum possible disclosure to the requester. Individuals may not be denied access to a record pertaining to themselves merely because those records are exempt from disclosure under the FOIA.

(b) A Privacy Act request that neither specifies the system(s) of records to be searched nor identifies the substantive nature of the information sought will be processed by searching the systems of records categorized as Environmental Health, Safety and Fitness, FOIA/Privacy, General, and Security.

(c) A Privacy Act request that does not designate the system(s) of records to be searched but does identify the substantive nature of the information sought will be processed by searching those systems of records likely to have information similar to that sought by the requester.

(d) The NRO will not disclose any record to any person or government agency except by written request or prior written consent of the subject of the record unless the disclosure is required by law or is within the exceptions of the Privacy Act. If a requester authorizes another individual to obtain the requested records on his behalf, the requester shall provide a written, signed, notarized statement appointing that individual as his representative and certifying that the individual appointed may have access to the requester's records and that such access shall not constitute an invasion of his privacy nor a violation of his rights under the Privacy Act. In lieu of a notarized statement, the NRO will accept a declaration in accordance with 28 U.S.C. 1746.

(e) Upon receipt of a written request, the Privacy Act Coordinator (PA Coordinator) will release to the requester those records which are releasable and applicable to the individual making the request. Records about individuals include data stored electronically or in electronic media. Documentary material qualifies as a record if the record is maintained in a system of records.

(f) Initial availability, potential for release, and cost determination will usually be made within ten working days of the date on which a written request for any identifiable record is received by the NRO (and acknowledgement is sent to the individual). If additional time is needed due to unusual circumstances, a written notification of the delay will be forwarded to the requester within the ten working day period. This notification will briefly explain the circumstances for the delay and indicate the anticipated date for a substantive response.

(g) All requests will be handled in the order received on a ‘first-in, first-out’ basis. Requests will be considered for expedited processing only if the NRO determines that there is a genuine health, humanitarian, or due process reason involving possible deprivation of life or liberty which creates an exceptional and urgent need, that there is no alternative forum for the records sought, and that substantive records relevantto the stated needs may exist and be releasable.

(h) Records provided or originated by another agency or containing other agency information will not be released prior to coordination with the other agency involved.

(i) Requesting or obtaining access to records under false pretenses is a violation of the Privacy Act and is subject to criminal penalties.

(a) To the maximum extent practical, personal information about an individual will be obtained directly from that individual.

(b) Whenever an individual is asked to provide personal information, including Social Security Number (SSN) or a personal identifier, about himself, a Privacy Act Statement will be furnished that will advise him of the authority (whether by statute or by Executive Order) under which the information is requested, whether disclosure of the information is voluntaryor mandatory, the purposes for which it is requested, the uses to which it will be put, and the consequences of not providing the information.

(c) When asking third parties to provide information about other individuals, NRO employees will advise them:

(1) Of the purpose of the request, and

(2) That their identities and the information they are furnishing may be released to the individual unless they expressly request confidentiality. All persons interviewed must be informed of their rights and offered confidentiality.

(a) Request in writing. An individual seeking notification of whether a system of records contains a record pertaining to him, or an individual seeking access to records pertaining to him which are available under the Privacy Act, shall address the request in writing to the Privacy Act Coordinator, National Reconnaissance Office, 14675 Lee Road, Chantilly, VA 20151-1715. The request should contain at least the following information:

(1) Identification. Reasonable identification, including first name, middle name or initial, surname, any aliases or nicknames, Social Security Number, and return address of the individual concerned, accompanied by a signed notarized statement that such information is true under penalty of perjury and swearing to or affirming his identity. An unsworn declaration, under 28 U.S.C. 1746, also is acceptable. In the case of a request for records of a sensitive nature if the PA Coordinator determines that this information does not sufficiently identify the individual, the PA Coordinator may requests additional identification or clarification of information submitted by the individual.

(i) In addition, an alien lawfully admitted for permanent residence shall provide his Alien Registration Number and the date that status was acquired.

(ii) The parent or guardian of a minor or of a person judicially determined to be incompetent, or an attorney retained to represent an individual, in addition to establishing the identity of the minor or person represented as required in this part, shall provide evidence of his own identity as required in this part and evidence of such parentage, guardianship, or representation by submitting a certified copyof the minor's birth certificate, the court order establishing such guardianship, or the representation agreement which establishes the relationship.

(2) Cost. A statement of willingness to pay reproduction costs. Processing of requests and administrative appeals from individuals who owe outstanding fees will be held in abeyance until such fees are paid.

(3) Record sought. A description, to the best of his ability, of the nature of the record sought and the system in which it is thought to be included. In lieu of this, a requester may simply describe why and under what circumstances he believes that the NRO maintains responsive records; the NRO will undertake the appropriate searches.

(b) Access on behalf of the individual. If the requester wishes another person to obtain the records on his behalf, the requester will furnish a notarized statement or unsworn declaration appointing that person as his representative, authorizing him access to the record, and affirming that access will not constitute an invasion of the requester's privacy or a violation of his rights under the Privacy Act. The NRO requires a written statement to authorize discussion of the individual's record in the presence of a third person.

(a) The PA Coordinator shall acknowledge receipt of the request in writing within ten working days.

(b) Upon receipt of a request, the PA Coordinator shall refer the request to those components most likely to possess responsive records. The components shall search all relevant record systems within their cognizance and shall:

(1) Determine whether a responsive record exists in a system of records.

(2) Determine whether access must be denied and on what legal basis. An individual may be denied access to his records under the Privacy Act only if an exemption has been properly claimed for all or part of the records or information requested; or if the information was compiled in reasonable anticipation of a civil action or proceeding.

(3) Approve the disclosure of records for which they are the originator.

(4) Forward to the PA Coordinator all records approved for release or necessary for coordination with or referral to another originator or interested party as well as notification of the specific determination for any denial.

(c) When all records have been collected, the PA Coordinator shall notify the individual of the determination and shall provide an exact copy of records deemed to be accessible if a copy has been requested.

(d) When an original record is illegible, incomplete, or partially exempt from release, the PA Coordinator shall explain in terms understood by the requester the portions of a record that are unclear.

(e) If access to requested records, or any portion thereof, is denied, the PA Coordinator shall inform the requester in writing of the specific reason(s) for denial, including the specific citation to appropriate sections of the Privacy Act or other statutes, this and other NRO regulations, or the Code of Federal Regulations authorizing denial, and the right to appeal this determination through the NRO appeal procedure within 60 calendar days. The denial shall include the date of denial, the name and title/position of the denial authority, and the address of the NRO Appeal Authority. Access may be refused when the records are exempt by the Privacy Act. Usually an individual will not be denied access to the entire record, but only to those portions to which the denial of access furthers the purpose for which an exemption was claimed.

(a) Any individual whose request for access is denied may request a review of the initial decision within 60 calendar days of the date of the notification of denial of access by appealing within the NRO internal appeals process. If a requester elects to request NRO review, the request shall be sent in writing to the Privacy Act Coordinator, National Reconnaissance Office, 14675 Lee Road, Chantilly, VA 20151-1715, briefly identifying the particular record which is the subject of the request and setting forth the reasons for the appeal. The request should enclose a copy of the denial correspondence. The following procedures apply to appeals within the NRO:

(1) The PA Coordinator, after acknowledging receipt of the appeal, shall promptly refer the appeal to the record-holding components, informing them of the date of receipt of the appeal and requesting that the component head or his designee review the appeal.

(2) The record-holding components shall review the initial denial of access to the requested records and shall inform the PA Coordinator of their review determination.

(3) The PA Coordinator shall consolidate the component responses, review the record, direct such additional inquiry or investigation as is deemed necessary to make a fair and equitable determination, and make a recommendation to the NRO Appeals Panel, which makes a recommendation to the Appeal Authority.

(4) The Appeal Authority shall notify the PA Coordinator of the result of the determination on the appeal, who shall notify the individual of the determination in writing.

(5) If the determination reverses the initial denial, the PA Coordinator shall provide a copy of the records requested. If the determination upholds the initial denial, the PA Coordinator shall inform the requester of his right to judicial review in U.S. District Court and shall include the exact reasons for denial with specific citations to the provisions of the Privacy Act, other statutes, NRO regulations, or the Code of Federal Regulations upon which the determination is based.

(b) The Appeal Authority shall act on the appeal or provide a notice of extension within 30 working days.

When requested medical and psychological records are not exempt from disclosure, the PA Coordinator may determine which non-exempt medical or psychological records should not be sent directly to the requester because of possible harm or adverse impact to the requester or another person. In that event, the information may be disclosed to a physician named by the requester. The appointment of the physician will be in the same notarized form or declaration as described in § 326.8 and will certify that the physician is licensed to practice in the appropriate specialty (medicine, psychology, or psychiatry). Upon designation, verification of the physician's identity, and agreement by the physician to review the documents with the requester to explain the meaning of the documents and to offer counseling designed to mitigate any adverse reaction, the NRO will forward such records to the designated physician. If the requester refuses or fails to designate a physician, the record shall not be provided. Under such circumstances refusal of access is not considered a denial for Privacy Act reporting purposes. However, if the designated physician declines to furnish the records to the individual, the PA Coordinator will take action to ensure that the records are provided to the individual.

(a) An individual may request amendment or correction of a record pertaining to him/her by addressing such request in writing, to the Privacy Act Coordinator, National Reconnaissance Office, 14675 Lee Road, Chantilly, VA 20151-1715. Incomplete or inaccurate requests will not be rejected categorically; instead, the requester will be asked to clarify the request as needed. A request will not be rejected or require resubmission unless additional information is essential to process the request. Usually, amendments under this part are limited to correcting factual errors and not matters of official judgment, such as promotion ratings and job performance appraisals. The requester must adequately support his claim and must identify:

(1) The particular record he wishes to amend or correct, specifying the number of pages and documents, the titles of the documents, form numbers if any, dates on documents, and individuals who signed them. Any reasonable description of the documents is acceptable. A clear and specific description of passages, pages, or documents to be amended will expedite processing the request.

(2) The desired amending language. The requester should specify the type of amendment, including complete removal of data, passages, or documents from record or correction of information to make it accurate, more timely, complete, or relevant.

(3) A justification for such amendment or correctionto include any documentary evidence supporting the request.

(b) Individuals will be required to provide verification of identity as in § 326.8. to ensure that the requester is seeking to amend records pertaining to himself and not, inadvertently or intentionally, the records of another individual.

(c) Minor factual errors in an individual's personal record may be corrected routinely upon request without resort to the Privacy Act or the provisions of this part, if the requester and the record holder agree to that procedure and the requester receives a copy of the corrected record whenever possible. A written request is not required when individuals indicate amendments during routine annual review and updating of records programs conducted by the NRO for civilian personnel and the Services for military personnel. Requests for deletion, removal of records, and amendment of substantive factual information will be processed according to the Privacy Act and the provisions of this part.

(d) The PA Coordinator shall acknowledge receipt of the request in writing within ten working days. No separate acknowledgement of receipt is necessary if the request can be either approved or denied and the requester advised within the ten-day period. For written requests presented in person, written acknowledgement may be provided at the time the request is presented.

(e) The PA Coordinator shall refer such request to the record-holder components, shall advise those components of the date of receipt, and shall request that those components make a prompt determination on such request.

(f) The record-holder components shall promptly:

(1) Make any amendment or correction to any portion of the record which the individual believes is not accurate, relevant, timely, or complete and notify the PA Coordinator and all holders and recipients of such records and their amendments that the correction was made; or

(2) Set forth the reasons for the refusal, if they determine that the requested amendment or correction will not be made or if they decline to make the requested amendment but instead augment the official record, and so inform the PA Coordinator.

(g) The Privacy Act Coordinator shall:

(1) Inform the requester of the agency's determination to make the amendment or correction as requested and notify all prior recipients of the change to the disputed records for which an accounting had been required; or

(2) Inform the requester of the specific reasons and legal authorities for the agency's refusal and the procedures established for him to request a review of that refusal.

(h) The amendment procedure is not intended to replace other existing procedures such as those for registering grievances or appealing performance appraisal reports. In such cases the requester will be apprised of the appropriate procedures for such actions.

(i) This part does not permit the alteration of evidence presented to courts, boards, or other official proceedings.

(a) Any individual whose request for amendment or correction is denied may request a review of the initial decision within 60 calendar days of the date of the notification of denial by appealing within the NRO internal appeals process. If a requester elects to request NRO review, the request shall be sent in writing to the Privacy Act Coordinator, National Reconnaissance Office, 14675 Lee Road, Chantilly, VA 20151-1715, briefly identifying the particular record which is the subject of the request and setting forth the reasons for the appeal. The request should enclose a copy of the denial correspondence. The following procedures apply to appeals within the NRO:

(1) The PA Coordinator, after acknowledging receipt of the appeal, shall promptly refer the appeal to the record-holding components, informing them of the date of receipt of the appeal and requesting that the component head or his designee review the appeal.

(2) The record-holding components shall review the initial denial of access to the requested records and shall inform the PA Coordinator of their review determination.

(3) The PA Coordinator shall act as secretary of the Appeals Panel. He shall:

(i) Consolidate the component responses and reasons for the initial denial.

(ii) Provide all supporting materials both furnished to and by the requester and the record-holding component.

(iii) Review the record.

(iv) Direct such additional inquiry or investigation as is deemed necessary to make a fair and equitable determination.

(v) Prepare the record and schedule the appeal for the next meeting of the Appeals Panel. The Appeals Panel shall recommend a finding to the Appeal Authority by a majority vote of those present at the meeting based on the written record and the Panel's deliberations. No personal appearances shall be permitted without the express permission of the Panel.

(4) The Appeal Authority shall notify the PA Coordinator of the result of the determination on the appeal who shall notify the individual of the determination in writing.

(5) The Appeal Authority will notify the PA Coordinator if the determination is that the record should be amended. The PA Coordinator will promptly advise the requester and the office holding the record to amend the record and to notify all prior recipients of the records for which an accounting was required of the change.

(6) If the determination upholds the initial denial, in whole or in part, the PA Coordinator shall inform the requester:

(i) Of the denial and the reason.

(ii) Of his right to file in NRO records within 60 calendar days a concise statement of the reasons for disputing the information contained in the record. If the requester elects to file a statement of disagreement, the PA Coordinator will be responsible for clearly noting any portion of the record that is disputed and for appending into the file the requester's statement as well as a copy of the NRO's letter to the requester denying the disputed information, if appropriate. The requester's statement and the NRO denial letter will be made available to anyone to whom the record is subsequently disclosed, and prior recipients of the disputed record will be provided a copy of both to the extent that an accounting of disclosures is maintained.

(iii) Of his right to judicial review in U.S. District Court.

(7) The Appeal Authority shall act on the appeal or provide a notice of extension within 30 working days.

(a) Personal records contained in a Privacy Act system of records maintained by NRO shall not be disclosed by any means to any person or agency outside the NRO except with the written consent of the individual subject of the record, unless as provided in this part.

(b) Except for disclosure made to members of the NRO in connection with their official duties and disclosures required by the Freedom of Information Act, an accounting will be kept of all disclosures of records maintained in NRO systems of records and of all disclosures of investigative information. Accounting entries will record the date, kind of information, purpose of each disclosure, and the name and address of the person or agency to whom the disclosure is made. Accounting records will be maintained for at least five years after the last disclosure or for the life of the record, whichever is longer. Subjects of NRO records will be given access to associated accounting records upon request except for disclosures made pursuant to § 326.4, or where an exemption has been properly claimed for the system of records.

Individuals requesting copies of their official personnel records are entitled to one free copy; a charge will be assessed for additional copies. There is a cost of $.15 per page. Fees will not be assessed if the cost is less than $30.00. Fees should be paid by check or postal money order payable to the Treasurer of the United States and forwarded to the Privacy Act Coordinator, NRO, at the time the copy of the record is delivered. In some instances, fees will be due in advance.

Each request shall be treated as a certification by the requester that he is the individual named in the request. The Privacy Act provides criminal penalties for any person who knowingly and willfully requests or obtains any information concerning an individual under false pretenses.

(a) All systems of records maintained by the NRO shall be exempt from the requirements of 5 U.S.C. 552a(d) pursuant to 5 U.S.C. 552a(k)(1) to the extent that the system contains any information properly classified under Executive Order 12958 and which is required by the Executive Order to be withheld in the interest of national defense of foreign policy. This exemption, which may be applicable to parts of all systems of records, is necessary because certain record systems not otherwise specifically designated for exemptions herein may contain items of information that have been properly classified.

(b) No system of records within the NRO shall be considered exempt under subsection (j) or (k) of the Privacy Act until the exemption and the exemption rule for the system of records has been published as a final rule in the Federal Register.

(c) An individual is not entitled to have access to any information compiled in reasonable anticipation of a civil action or proceeding (5 U.S.C. 552a(d)(5)).

(d) Proposals to exempt a system of records will be forwarded to the Defense Privacy Office, consistent with the requirements of 32 CFR part 310, for review and action.

This part implements the basic policies and procedures for the implementation of the Privacy Act of 1974, as amended (5 U.S.C. 552a); OMB Circular A-130; 1 and 32 CFR part 310; and to promote uniformity in the DeCA Privacy Act Program.

This part applies to Headquarters, Field Operating Activities (FOA), Regions, Zones, Central Distribution Centers (CDC), Commissaries of DeCA, and contractors during the performance of a contract with DeCA. All personnel are expected to comply with the procedures established herein.

Access. The review of a record of a copy of a record or parts thereof in a system of records by any individual.

Agency. For the purposes of disclosing records subject to the Privacy Act among DoD Components, the Department of Defense is considered a single agency. For all other purposes to include applications for access and amendment, denial of access or amendment, appeals from denials, and record keeping as regards release to non-DoD agencies; each DoD Component is considered an agency within the meaning of the Privacy Act.

Computer room. Any combination of electronic hardware and software integrated in a variety of forms (firmware, programmable software, hard wiring, or similar equipment) that permits the processing of textual data. The equipment contains device to receive information and other processors with various capabilities to manipulate the information, store and provide input.

Confidential source. A person or organization who has furnished information to the federal government under an express promise that the person's or the organization's identity will be held in confidence or under an implied promise of such confidentiality if this implied promise was made before September 27, 1975.

Disclosure. The transfer of any personal information from a system of records by any means of communication (such as oral, written, electronic, mechanical, or actual review) to any person, private entity, or government agency, other than the subject of the record, the subject's designated agent or the subject's legal guardian.

Federal Register system. Established by Congress to inform the public of interim, proposed, and final regulations or rulemaking documents having substantial impact on the public. In this case, DeCA directives have the same meaning as regulations or rulemaking documents. The secondary role of the Federal Register system is to publish notice documents of public interest.

Individual. A living person who is a citizen of the United States or an alien lawfully admitted for permanent residence. The parent of a minor or the legal guardian of any individual also may act on behalf of an individual. Corporations, partnerships, sole proprietorships, professional groups, businesses, whether incorporated or unincorporated, and other commercial entities are not “individuals.”

Individual access. Access to information pertaining to the individual by the individual or his or her designated agent or legal guardian.

Law enforcement activity. Any activity engaged in the enforcement of criminal laws, including efforts to prevent, control, or reduce crime or to apprehend criminals, and the activities of prosecutors, courts, correctional, probation, pardon, or parole authorities.

Maintain. Includes maintain, collect, use or disseminate.

Official use. Within the context of this part, this term is used when officials and employees of a DoD Component have a demonstrated need for the use of any record or the information contained therein in the performance of their official duties, subject to DoD 5200.1-R,2 “DoD Information Security Program Regulation.”

Personal information. Information about an individual that identifies, relates or is unique to, or describes him or her; e.g., a social security number, age, military rank, civilian grade, marital status, race, salary, home/office phone numbers, etc.

Privacy Act. The Privacy Act of 1974, as amended, (5 U.S.C. 552a).

Privacy Act request. A request from an individual for notification as to the existence of, access to, or amendment of records pertaining to that individual. These records must be maintained in a system of records.

Member of the public. Any individual or party acting in a private capacity to include federal employees or military personnel.

Record. Any item, collection, or grouping of information, whatever the storage media (e.g., paper, electronic, etc.), about an individual that is maintained by a DoD Component, including but not limited to, his or her education, financial transactions, medical history, criminal or employment history and that contains his or her name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph.

Risk assessment. An analysis considering information sensitivity, vulnerabilities, and the cost to a computer facility or word processing activity in safeguarding personal information processed or stored in the facility or activity.

Routine use. The disclosure of a record outside the Department of Defense for a use that is compatible with the purpose for which the information was collected and maintained by the Department of Defense. The routine use must be included in the published system notice for the system of records involved.

Statistical record. A record maintained only for statistical research or reporting purposes and not used in whole or in part in making determinations about specific individuals.

System manager. The DoD Component official who is responsible for the operation and management of a system of records.

System of records. A group of records under the control of a DoD Component from which personal information is retrieved by the individual's name or by some identifying number, symbol, or other identifying particular assigned to an individual.

Word processing system. A combination of equipment employing automated technology, systematic procedures, and trained personnel for the primary purpose of manipulating human thoughts and verbal or written or graphic presentations intended to communicate verbally or visually with another individual.

Word processing equipment. Any combination of electronic hardware and computer software integrated in a variety of forms (firmware, programmable software, hard wiring, or similar equipment) that permits the processing of textual data. Generally, the equipment contains a device to recieve information, a computer-like processor with various capabilities to manipulate the information, a storage medium, and an output device.

(a) System of records. To be subject to the provisions of this part, a “system of records” must:

(1) Consist of “records” that are retrieved by the name of an individual or some other personal identifier, and

(2) Be under the control of DeCA.

(b) Retrieval practices. Records in a group of records that may be retrieved by a name or personal identifier are not covered by this part even if the records contain personal data and are under the control of DeCA. The records MUST BE, in fact, retrieved by name or other personal identifier to become a system of records for DeCA.

(c) Relevance and necessity. Only those records that contain personal information which is relevant and necessary to accomplish a purpose required by Federal statute or an Executive Order will be maintained by DeCA.

(d) Authority to establish systems of records. Director, DeCA has the authority to establish systems of records; however, each time a system of records is established, the Executive Order or Federal statute that authorizes maintaining the personal information must be identified.

(1) DeCA will not maintain any records describing how an individual exercises his or her rights guaranteed by the First Amendment of the U.S. Constitution.

(2) These rights include, but are not limited to, freedom of religion, freedom of political beliefs, freedom of speech, freedom of the press, the right to assemble, and the right to petition.

(e) System manager's evaluation. Systems managers, along with the DeCA Privacy Officer, shall evaluate the information to be included in each new system before establishing the system and evaluate periodically the information contained in each existing system of records for relevancy and necessity. Such a review will also occur when a system notice amendment or alteration is prepared. Consider the following:

(1) The relationship of each item of information retained and collected to the purpose for which the system is maintained.

(2) The specific impact on the purpose or mission of not collecting each category of information contained in the system.

(3) The possibility of meeting the informational requirements through use of information not individually identifiable or through other techniques, such as sampling.

(4) The length of time each item of personal information must be retained.

(5) The cost of maintaining the information.

(6) The necessity and relevancy of the information to the purpose for which it was collected.

(f) Discontinued information requirements. (1) When notification is received to stop collecting any category or item of personal information, the DeCA PA Officer will issue instructions to stop immediately and also excise this information from existing records, when feasible, and amend existing notice.

(2) Disposition of these records will be provided by the DeCA PA Officer in accordance with the DeCA Filing System.3

(g) Government contractors. (1) When DeCA contracts for the operation or maintenance of a system of records or a portion of a system of records by a contractor, the record system or the portion affected are considered to be maintained by DeCA and are subject to this part. DeCA is responsible for applying the requirements of this part to the contractor. The contractor and its employees are to be considered employees of DeCA for the purposes of the approved provisions of the Privacy Act during the performance of the contract. Consistent with the Defense Acquisition Regulation, contracts requiring the maintenance of a system of records or the portion of a system of records shall identify specifically the record system and the work to be performed and shall include in the solicitation and resulting contract such terms as are prescribed in the Defense Acquisition Regulation (DAR).4

(2) If the contractor must use or have access to individually identifiable information subject to this part to perform any part of a contract, and the information would have been collected and maintained by DeCA but for the award of the contract, these contractor activities are subject to this part.

(3) The restrictions in paragraphs (g)(1) and (g)(2) of this section do not apply to records:

(i) Established and maintained to assist in making internal contractor management decisions such as those maintained for use in managing the contract.

(ii) Those maintained as internal contractor employee records even when used in conjunction with providing goods and services to DeCA.

(4) Disclosure of records to contractors. Disclosure of personal records to a contractor for the use in the performance of any DeCA contract is considered a disclosure within the Department of Defense (DoD). The contractor is considered the agent of DeCA and is to be maintaining and receiving the records for DeCA.

(h) Safeguarding personal information. DeCA personnel will protect records in every system of records for confidentiality against alteration, unauthorized disclosure, embarrassment, or unfairness to any individual about when information is kept.

(1) Supervisor/Manager paper records maintained by DeCA personnel will be treated as ‘For Official Use Only’ (FOUO) documents and secured in locked file cabinets, desks or bookcases during non-duty hours. During normal working hours, these records will be out-of-sight if the working area is accessible to non-government personnel.

(2) Personnel records maintained by DeCA computer room or stand alone systems, will be safeguarded at all times. Printed computer reports containing personal data must carry the markings FOUO. Other media storing personal data such as tapes, reels, disk packs, etc., must be marked with labels which bear FOUO and properly safeguarded.

(3) Adherence to paragraphs (h)(1) and (h)(2) of this section, fulfills the requirements of 32 CFR part 285.

(i) Records disposal. (1) DeCA records containing personal data will be shredded or torn to render the record unrecognizable or beyond reconstruction.

(2) The transfer of large quantities of DeCA records containing personal data to disposal activities is not considered a release of personal information under this part. The volume of such transfers makes it difficult or impossible to identify easily specific individual records. Care must be exercised to ensure that the bulk is maintained so as to prevent specific records from becoming readily identifiable. If the bulk is amintained, no special procedures are required. if the bulk cannot be maintained, dispose of the records by shredding or tearing to render the record unrecognizable or beyond reconstruction.

(a) Collect directly from the individual. To the greatest extent practicable, collect personal information directly from the individual to whom it pertains if the information may be used in making any determination about the rights, privileges, or benefits of the individual under any Federal program.

(b) Collecting personal information from third parties. It may not be practical to collect personal information directly from an individual in all cases. Some examples of this are:

(1) Verification of information through third party sources for security or employment suitability determinations;

(2) Seeking third party opinions such as supervisory comments as to job knowledge, duty performance, or other opinion-type evaluations;

(3) When obtaining the needed information directly from the individual is exceptionally difficult or may result in unreasonable costs; or

(4) Contacting a third party at the request of the individual to furnish certain information such as exact periods of employment, termination dates, copies of records, or similar information.

(c) Collecting social security numbers (SSNs). (1) It is unlawful for DeCA to deny an individual any right, benefit, or privilege provided by law because an individual refuses to provide his or her SSN. Executive Order 9397 authorizes solicitation and use of SSNs as numerical identifiers for individuals in most Federal record systems, however, it does not provide mandatory authority for soliciting.

(2) When an individual is requested to provide their SSN, they must be told:

(i) the uses that will be made of the SSN;

(ii) The statute, regulation or rule authorizing the solicitation of the SSN; and

(iii) Whether providingthe SSN is voluntary or mandatory.

(3) Once the SSN has been furnished for the purpose of establishing a record, the notification in paragraph (c)(2) of this section is not required if the individual is only requested to furnish or verify the SSNs for identification purposes in connection with the normal use of his or her records.

(d) Privacy act statements. When a DeCA individual is requested to furnish personal information about himself or herself for inclusion in a system of records, a Privacy Act Statement is required regardless of the medium used to collect the information, e.g. forms, personal interviews, telephonic interviews. The statement allows the individual to make a decision whether to provide the information requested. The statement will be concise, curent, and easily understood and must state whether providing the information is voluntary or mandatory. if furnishing the data is mandatory, a Federal statute, Executive Order, regulation or other lawful order must be cited. If the personal information solicited is not to be incorporated into a DeCA system of records, a PA statement is not required. This information obtained without the PA statement will not be incorporated into any DeCA systems of records.

(1) The DeCA Privacy Act Statement will include:

(i) The specific Federal statute or Executive Order that authorized collection of the requested information;

(ii) The principal purpose or purposes for which the information is to be used;

(iii) The routine uses that will be made of the information;

(iv) Whether providing the information is voluntary or mandatory; and

(v) The effects on the individual if he or she chooses not to provide the requested information.

(2) Forms. When DeCA uses forms to collect personal information, placement of the Privacy Act advisory statement should be in the following order of preference:

(i) Below the title of the form and positioned so the individual will be advised of the requested information,

(ii) Within the body of the form with a notation of its location below the title of the form,

(iii) On the reverse of the form with a notation of its location below the title of the form,

(iv) Attached to the form as a tear-off sheet, or

(v) Issued as a separate supplement to the form.

(3) Forms issued by non-DoD Activities. Ensure that the statement prepared by the originating agency on their forms is adequate for the purpose for which DeCA will use the form. If the statement is inadequate, DeCA will prepare a new statement before using the form. Forms issued by other agencies not subject to the Privacy Act but its use requires DeCA to collect personal data, a Privacy Act Statement will be added.

(a) Individual access to personal information. Release of personal information to individuals whose records are maintained in a systems of records under this part is not considered public release of information. DeCA will release to the individuals all of the personal information, except to the extent the information is contained in an exempt system of records.

(1) Requests for access. (i) Individuals in DeCA Headquarters and FOAs will address requests for access to their personal information to the DeCA Privacy Act Officers. Individuals in Regions, CDCs, and commissaries, will address requests to their respective Region Privacy Act Coordinator. The individual is not required to explain or justify why access is being sought.

(ii) If an individual wishes to be accompanied by a third party when seeking access to his or her records or to have the records released directly to the third party, a signed access authorization granting the third party access is required.

(iii) A DeCA individual will not be denied access to his or her records because he or she refuses to provide his or her SSN unless the SSN is the only way retrieval can be made.

(2) Granting access. (i) If the record is not part of an exempt system, DeCA personnel will be granted access to the original record or an exact copy of the original record without any changes or deletions. Medical records will be disclosed to the individual to whom they pertain unless an individual fails to comply with the established requirements. This includes refusing to name a physician to receive medical records when required, refusing to pay fees, or when a judgment is made that access to such records may have an adverse effect on the mental or physical health of the individual. Where an adverse effect may result, a release will be made in consultation with a physician.

(ii) DeCA personnel may be denied access to information compiled in reasonable anticipation of a civil action or proceeding. The term “civil proceeding” is intended to include quasi-judicial and pretrial judicial proceedings. Information prepared in conjunction with the quasi-judicial, pretrial and trial proceedings to include those prepared by DeCA legal and non-legal officials of the possible consequences of a given course of action are protected from access.

(iii) Requests by DeCA personnel for access to investigatory records pertaining to themselves, compiled for law enforcement purposes, are processed under this part and that of 32 CFR part 310. Those requests by DeCA personnel for investigatory records pertaining to themselves that are in records systems exempt from access provisions shall be processed under this part or 32 CFR part 285, depending upon which provides the greatest degree of access.

(3) Non agency records. (i) Uncirculated personal notes and records that are not given or circulated to any person or organization (example, personal telephone list) that are kept or discarded at the author's discretion and over which DeCA exercises no direct control, are not considered DeCA records. However, if personnel are officially directed or encouraged, either in writing or orally, to maintain such records, they may become “agency records” and may be subject to this part.

(ii) Personal uncirculate handwritten notes of team leaders, office supervisors, or military supervisory personnel concerning subordinates are not a system of records within the meaning of this part. Such notes are an extension of the individual's memory. These notes, however, must be maintained and discarded at the discretion of the individual supervisor and not circulated to others. Any established requirement to maintain such notes (written or oral directives, regulation or command policy) make these notes “AGENCY RECORDS.” If the notes are circulated, they must be made a part of the system of records. Any action that gives personal notes the appearance of official agency records is prohibited unless they have been incorporated into a DeCA system of records.

(b) Relationship between the Privacy Act and the Freedom of Information Act (FOIA). (1) Requests from DeCA individuals for access to a record pertaining to themselves made under the FOIA are processed under the provisions of this part, 32 CFR part 310 and DeCA Directive 30-12, Freedom of Information Act (FOIA) Program.5

(2) Request from DeCA individuals or access to a record pertaining to themselves are processed under this part and 32 CFR part 310.

(3) Requests from DeCA individuals for access to records about themselves that cite both Acts or the DeCA implementing directives for both Acts are processed under this part except:

(i) When the access provisions of the FOIA provide a greater degree of access process under the FOIA, or

(ii) When access to the information sought is controlled by another Federal statute process access procedures under the controlling statute.

(4) Requests from DeCA individuals for access to information about themselves in a system of records that do not cite either Act or DeCA implementing directive are processed under the procedures established by this part.

(5) DeCA requesters will not be denied access to personal information concerning themselves that would be releasable to them under either Act because they fail to cite either Act or the wrong Act. The Act or procedures used in granting or denying access will be explained to requesters.,

(6) DeCA requesters should receive access to their records within 30 days.

(7) Records in all DeCA systems maintained in accordance with the Government-wide systems notices are in temporary custody of DeCA, and all requests or amend these records will be processed in accordance with this part.

(c) Denial of individual access. (1) A DeCA individual may be denied formal access to a record pertaining to him/her only if the record:

(i) Was compiled in reasonable anticipation of civil action.

(ii) Is in a system of records that has been exempt from access provisions of this part.

(iii) All systems of records maintained by the Defense Commissary Agency shall be exempt from the requirements of 5 U.S.C. 552a(d) pursuant to 5 U.S.C. 552a(k)(1) to the extent that the system contains any information properly classified under Executive Order 12958 and which is required by the Executive Order to be withheld in the interest of national defense or foreign policy. This exemption, which may be applicable to parts of all systems of records, is necessary because certain record systems not otherwise specifically designated for exemptions herein may contain items of information that have been properly classified.

(iv) Is contained in a system of records for which access may be denied under some other Federal statute.

(v) All systems of records maintained by the DeCA shall be exempt from the requirements of 5 U.S.C. 552a(d) pursuant to 5 U.S.C. 552a(k)(1) to the extent that the system contains any information properly classified under Executive Order 12958 and which is required by the Executive Order to be withheld in the interest of national defense of foreign policy. This exemption, which may be applicable to parts of all systems of records, is necessary because certain record systems not otherwise specifically designated for exemptions herein may contain items of information that have been properly classified.

(2) DeCA individuals will only be denied access to those portions of the records from which the denial of access serves some legitimate governmental purpose.

(3) Other reasons to refuse DeCA individuals are:

(i) The request is not described well enough to locate it within a reasonable amount of effort by the PA Officer or PA Coordinator; or

(ii) An individual fails to comply with the established requirements including refusing to name a physician to receive medical records when required or to pay fees.

(4) Only the DeCA IDA can deny access. This denial must be in writing and contain:

(i) The date of the denial, name, title of position, and signature of the DeCA Initial Denial Authority.

(ii) The specific reasons for the denial, including specific reference to the appropriate sections of the PA, other statutes, this part or the Code of Federal Regulations (CFR);

(iii) Information providing the right to appeal the denial through the DeCa appeal procedure within 60 days, and the title, position and address of the DeCA PA Appellate Authority.

(5) DeCA Appeal Procedures. The Director of DeCA, or the designee, will review any appeal by an individual from a denial of access to DeCA records. Formal written notification will be provided to the individual explaining whether the denial is sustained totally or in part. The DeCA PA Officer will:

(i) Assign a control number and process the appeal to the Director, DeCA or the designee appointed by the Director.

(ii) Provide formal written notification to the individual by the appeal authority explaining whether the denial is sustained totally or in part and the exact reasons for the denial to include provisions of the Act, other statute, this part or the CFR whichever the determination is based, or

(iii) Provide the individual access to the material if the appeal is granted.

(iv) Process all appeals within 30 days of receipt unless the appeal authority determines the review cannot be made within that period and provide notification to the individual the reasons for the delay and when an answer may be expected.

(d) Amendment of records. (1) DeCA employees are encouraged to review the personal information being maintained abut them periodically. An individual may request amendment of any record contained in a system of records unless the system of records has been exempt specifically from the amendment procedures by the Director, DeCa. A request for amendment must include:

(i) A description of the item or items to be amended.

(ii) The specific reason for the amendment.

(iii) The type of amendment action such as deletion, correction or addition.

(iv) Copies of evidence supporting the request.

(v) DeCA employees may be required to provide identification to make sure that they are indeed seeking to amend a record pertaining to themselves.

(2) The amendment process is not intended to permit the alteration of evidence presented in the course of judicial or quasi-judicial proceedings. Amendments to these records are made through specific procedures established for the amendment of these records.

(i) Written notification will be provided to the requester within 10 working days of its receipt by the DeCA PA Officer. No notification will be provided to the requester if the action completed within the 10 days. Only under exceptional circumstances will more than 30 days be required to reach the decision to amend a request. If the decision is to grant all or in part of the request for amendment, the record will be amended and the requester informed and all other offices/personnel known to be keeping the information.

(ii) If the request for amendment is denied in whole or in part, The PA Officer will notify the individual in writing and provide the specific reasons and the procedures for appealing the decision.

(iii) All appeals are to be processed within 30 days. If additional time is required, the requester will be informed and provided when a final decision may be expected.

(e) Fee assessments. (1) DeCA personnel will only be charged the direct cost of copying and reproduction, computed using the appropriate portions of the fee schedule in DeCA Directive 30-12.6 Normally, fees are waived automatically if the direct costs of a given request are less than $30. This fee waiver provision does not apply when a waiver has been granted to the individual before, and later requests appear to be an extension or duplication of that original request. Decisions to waive or reduce fees that exceed the automatic waiver threshold will be made on a case-by-case basis. Fees may not be charged when:

(i) Copying is performed for the convenience of the Government or is the only means to make the record available for the individual.

(ii) No reading room is available for the individual to review the record or a copy is made to keep the original in DeCA files.

(iii) The information may be obtained without charge under any other regulation, directive, or statute.

(2) No fees will be collected for search, retrieval, and review of records to determine releasability, copying of records when the individual has not requested a copy, transportation of records and personnel, or normal postage.

(a) Disclosures and nonconsensual disclosures. (1) All requests made by DeCA individuals for personal information about other individuals (third parties) will be processed under DeCA Directive 30-12 7 except when the third party personal information is contained in the Privacy record of the individual making the request.

(2) For the purposes of disclosure and disclosure accounting, the Department of Defense is considered a single agency.

(3) Personal information from DeCA systems of records will not be disclosed outside the DoD unless:

(i) The record has been requested by the individual to whom it pertains,

(ii) Written consent has been given by the individual to whom the record pertains for release to the requesting agency, activity, or individual, or

(iii) The release is pursuant to one of the specific nonconsensual purposes set forth in the Act.

(4) Records may be disclosed without the consent of a DeCA individual to any DoD official who has need for the record in the performance of their assigned duties. Rank, position, or title alone does not authorize this access. An official need for this information must exist.

(5) DeCA records must be disclosed if their release is required by 32 CFR part 285, which is implemented by DeCA Directive 30-12.8 32 CFR part 285 requires that records be made available to the public unless exempt from disclosure under the FOIA.

(b) Normally releasable information. Personal information that is normally releasable without the consent of a DeCA individual that does not imply a clearly unwarranted invasion of personal privacy:

(1) Civilian employees:

(i) Name,

(ii) Present and past position titles,

(iii) Present and past grades,

(iv) Present and past salaries,

(v) Present and past duty stations,

(vi) Office or duty telephone numbers,

(2) Military members:

(i) Full name,

(ii) Rank,

(iii) Date of rank,

(iv) Gross salary,

(v) Past duty assignments,

(vi) Present duty assignments,

(vii) Future assignments that are officially established,

(viii) Office or duty telephone numbers,

(ix) Source of commission,

(x) Promotion sequence number,

(xi) Awards and decorations,

(xii) Attendance at professional military schools,

(xiii) Duty status at any given time.

(3) All disclosures of personal information on civilian employees shall be made in accordance with the Office of Personnel Management (OPM) and all disclosures of personal information on military members shall be made in accordance with the standards established by 32 CFR part 285.

(4) The release of DeCA employees' home addresses and home telephone numbers is considered a clearly unwarranted invasion of personal privacy and is prohibited; however, these may be released without prior consent of the employee if:

(i) The employee has indicated previously that he or she consents to their release,

(ii) The releasing official was requested to release the information under the provisions of 32 CFR part 285.

(5) Before listing home addresses and home telephone numbers in any DeCA telephone directory, give the individuals the opportunity to refuse such a listing.

(c) Disclosures for established routine uses. (1) Records may be disclosed outside of DeCA without consent of the individual to whom they pertain for an established routine use.

(2) A routine use shall:

(i) Be compatible with the purpose for which the record was collected;

(ii) Indicate to whom the record may be released;

(iii) Indicate the uses to which the information may be put by the receiving agency; and

(iv) Have been published previously in the Federal Register.

(3) A routine use will be established for each user of the information outside DeCA who need official access to the records. This use may be discontinued or amended without the consent of the individual/s involved. Any routine use that is new or changed is published in the Federal Register 30 days before actually disclosing the record. In addition to routine uses established by DeCA individual system notices, blanket routine uses have been established. See Appendix C to this part.

(d) Disclosure without consent. DeCA records may be disclosed without the consent of the individual to whom they pertain to another agency within or under the control of the U.S. for a civil or criminal law enforcement activity if:

(1) The civil or criminal law enforcement activity is authorized by law (Federal, State, or local); and

(2) The head of the agency or instrumentality (or designee) has made a written request to the Component specifying the particular record or portion desired and the law enforcement activity for which it is sought.

(3) Blanket requests for any and all records pertaining to an individual shall not be honored. The requesting agency or instrumentality must specify each record or portion desired and how each relates to the authorized law enforcement activity.

(4) This disclosure provision applies when the law enforcement agency or instrumentality request the record, If the DoD Component discloses a record outside the DoD for law enforcement purposes without the individual's consent and without an adequate written request, the disclosure must be pursuant to an established routine use, such as the blanket routine use for law enforcement.

(e) Disclosures to the public from health care records. (1) The following general information may be released to the news media or public concerning a DeCA employee treated or hospitalized in DoD medical facilities and non-Federal facilities for whom the cost of the care is paid by DoD:

(i) Personal information concerning the patient that is provided in § 327.8 and under provisions of 32 CFR part 285.

(ii) The medical condition such as the date of admission or disposition and the present medical assessment of the individual's condition in the following terms if the medical doctor has volunteered the information:

(A) The individual's condition is presently (stable) (good) (fair) (serious) or (critical), and

(B) Whether the patient is conscious, semi-conscious or unconscious.

(2) Detailed medical and other personal information may be released on a DeCA employee only if the employee has given consent to the release. If the employee is not conscious or competent, no personal information, except that required by 32 CFR part 285, will be released until there has been enough improvement in the patient's condition for them to give informed consent.

(3) Any item of personal information may be released on a DeCA patient if the patient has given consent to its release.

(4) This part does not limit the disclosure of personal medical information for other government agencies' use in determining eligibility for special assistance or other benefits provided disclosure in pursuant to a routine use.

This part:

(a) Establishes a policy and procedure by which the Department of Defense will invite the comments of the public on those of its proposed regulations and other types of rulemaking as described hereafter which originate within the Department of Defense as a requirement of general applicability and future effect designed to implement, interpret, or prescribe law or policy, or practice or procedure requirements of a component. This requirement applies to those regulations which constitute the authority for actions having a substantial and direct impact on the public when consistent with other responsibilities of the Department for the efficient and responsible conduct of public business.

(b) Implements the provisions of 5 U.S.C. 552 relating to the kinds of regulations that must be published in the Federal Register after they are adopted.

(a) The provisions of this part apply to the Office of the Secretary of Defense, the Military Departments, the Organization of the Joint Chiefs of Staff, and the Defense Agencies (hereinafter referred to singularly as a “DoD component” or collectively as “DoD components”).

(b) These provisions are applicable to those directives, instructions, regulations, policy memoranda, manuals, and other forms of rulemaking (hereinafter referred to as “regulations”) that have a substantial and direct impact on the public. Only a regulation which must be published in the Federal Register after its adoption in accordance with 5 U.S.C. 552 (as implemented in § 336.5) comes within the requirement that it be evaluated to determine whether it will have the substantial and direct impact on the public that warrants an invitation for public comment prior to its adoption. An implementation by a subordinate component of a regulation adopted by a component at a higher level within the Department of Defense is not deemed to “originate” a requirement of general applicability and future effect, and therefore, does not fall within the scope of the obligation to invite public comment on its provisions.

(c) The determination by the component originating a regulation shall be final and conclusive in determining whether a regulation or a proposed regulation comes within the purview of this part. Consideration shall be given, however, to the definition of “rulemaking” found in 5 U.S.C. 551 as it relates to the requirements of 5 U.S.C. 553 in making this determination.

(d) The requirement for inviting public comment on a proposed regulation shall not be deemed applicable to any proposed regulation coming within one or more of the following exemptions or exceptions to the rulemaking procedures set forth in 5 U.S.C. 553.

(1) Any matter pertaining to a military or foreign affairs function of the United States which has been determined under the criteria of an Executive Order or statute to require a security classification in the interests of national defense or foreign policy.

(2) Any matter relating to (i) agency management, (ii) agency personnel, or (iii) public contracts (e.g., the Armed Services Procurement Regulation), including nonappropriated fund contracts.

(3) Any matter involving (i) interpretative rules, (ii) general statements of policy, or (iii) rules of agency organization, procedure, or practice.

(4) Any situation in which the DoD Component for good cause finds that inviting public comment on a proposed regulation is (i) impracticable, (ii) unnecessary, or (iii) contrary to the public interest, and incorporates in the adopted regulation that determination and its basis.

(e) Exceptions to the requirement in 5 U.S.C. 552 for publication in the Federal Register of adopted regulations for the guidance of the public shall be made in accordance with guidance provided in 32 CFR 286.8.

(a) It is the policy of the Department of Defense to encourage the maximum practicable participation of the public in the formulation of regulations having a substantial and direct impact on the public, and to inform the public fully through publication in the Federal Register of all adopted regulations intended for public guidance.

(b) A proposed regulation which would originate a Department of Defense policy having a substantial and direct impact on the public should be published, along with a notice of purpose and authority, in the Federal Register in order to invite public comment within a designated time at least 30 days prior to its intended adoption. This policy should be followed even though the proposed regulation may come within one or more of the exceptions or exemptions to the requirement for prepublication of proposed rules described in § 336.2(d) (2) (i) and (ii), (3) and (4), unless it is determined by the DoD Component as a matter within its sole and exclusive prerogative that the employment of the exception or exemption is appropriate to satisfy a significant and legitimate interest of the DoD Component or the public.

(c) After their adoption, all regulations for the guidance of the public shall be published in the Federal Register in accordance with 5 U.S.C. 552, even though they may come within one or more of the exemptions described in 32 CFR 286.6. If no significant and legitimate interest of the DoD Component or public precludes such publication. This policy extends to some adopted regulations for the guidance of the public which were not the subject of notice and public comment.

(a) The general notice of a proposed regulation shall be published in the Federal Register in accordance with the guidance contained in the “Federal Register Handbook on Document Drafting” (GSA), whenever that regulation would have a substantial and direct impact on the public or any significant portion of the public, unless it comes within one or more of the exceptions or exemptions previously set forth in § 336.2(d).

(b) The notice shall include:

(1) A statement of the purpose and objective of the proposed regulation;

(2) Reference to the legal authority under which the regulation is proposed; and

(3) The terms or substance of the proposed regulation.

(c) Whenever the originating DoD Component finds that notice and prepublication of a proposed regulation for public comment are impracticable, unnecessary, or contrary to the public interest, it shall incorporate that finding and a brief statement of its reasons in the adopted regulation, or it may adopt and publish in the Federal Register a separate regulation excepting or exempting categories of regulations for any of these reasons, with an explanation of the basis for excepting or exempting each particular category. Separate regulations for this purpose shall be promulgated by the procedures for proposed rules whenever this falls within the requirements of paragraph (a) of this section.

(d) Following the publication of notice and the proposed regulation in the Federal Register, the DoD Component shall give all interested persons an opportunity to participate in the rulemaking through the submission of written data, views, or arguments. An opportunity for oral presentation will normally not be provided, but may as a matter within the sole and exclusive prerogative of the component be extended where it is found to be in the interest of the DoD Component or the public. After careful consideration of all relevant matter presented, the component shall incorporate in the adopted regulation a concise general statement of its basis and purpose. A preamble to the adopted regulation may be published in the Federal Register to explain the relationship of the adopted rule to the proposed rule, including the nature and effect of public comments.

Subject to the exemptions set forth in 32 CFR 286.6:

(a) Each DoD Component shall publish in the Federal Register an informative, current description for the guidance of the public, of where, how, and by what authority it performs any of its functions. In deciding which information to publish in the Federal Register a DoD Component shall consider the fundamental objective of informing all interested persons of how to deal effectively with the component.

(b) Information to be published in the Federal Register shall include:

(1) Descriptions of the central and field organization of the component concerned, and the established places at which, the employees or members of the armed forces from whom, and the methods whereby the public may secure information, make submittals or requests, or obtain decisions.

(2) The procedures by which a DoD Component conducts its business with the public, both formally and informally.

(3) The rules of procedure which must be followed, the description of forms which must be completed, or the source from which forms may be obtained, and instructions on the scope and content of papers, reports, examinations required to be submitted pursuant to such rules of procedures, as adopted by the component.

(4) Directives, instructions, regulations, manuals, policy memorandums, statements of general policy, or interpretation of general applicability adopted by the agency, and other substantive rules of general applicability affecting the public.

(c) With the approval of the Director of the Federal Register, the requirement for publication in the Federal Register (1 CFR part 51, 37 FR 23614, Nov. 4, 1972) may be satisfied by reference in the Federal Register to other publications reasonably available to the class of persons affected and containing the information which must otherwise be published in the Federal Register.

(1) In order to be eligible for incorporation by reference, the matter must be in the nature of published data, criteria, standards, specifications, techniques, illustrations, or other published information reasonably available to members of class affected thereby.

(2) Incorporation by reference is not acceptable as a complete substitute for promulgating in full text material required to be published by 5 U.S.C. 552.

(3) Incorporation by reference is acceptable as a means of avoiding unnecessary repetition within the promulgated document of published information already reasonably available to the class affected. Examples include:

(i) Construction standards promulgated by a professional association or architects, engineers, or builders.

(ii) Code of ethics promulgated by professional organizations.

(iii) Forms and formats publicly or privately published and readily available to the persons required to use them.

(d) It is incumbent upon each component to review all information of the type described in paragraph (b) of this section, to insure that it is published on an up-to-date basis in the Federal Register, including every amendment revision, or repeal. No member of the general public can be required to resort to, or be adversely affected by, any material not published as required by the foregoing provisions of § 336.5 unless he has actual and timely notice of the content of that material.

Each component shall accord any interested person the right to petition for the issuance, amendment, or repeal of a regulation that originates or would originate, for the Department of Defense or that component, a policy, requirement, or procedure coming within the scope of § 336.4. Any such petition shall be given full and prompt consideration by the component charged with the responsibility for issuing such a regulation. The petitioner shall be advised in writing of the disposition, and the reason for the disposition, of any written petition for the issuance, amendment, or repeal of a regulation. The official responsibility for disposition of the petition may at his absolute discretion, grant the petitioner a right to appear for the purpose of supporting his petition if this is compatible with the orderly conduct of public business.

This part becomes effective on February 1, 1975, but is applicable only to the regulations promulgated under the authority of a component after April 1, 1975. Two copies of implementing regulations shall be forwarded to the General Counsel of the Department of Defense on or before April 1, 1975.

DoD Directives, DoD Instructions, and changes published in Chapter 2—Number Index section of DoD 5025.1-I, “DoD Directives System Annual Index” (except those issuances identified as classified) are available to the public and Government Agencies, at cost, from the National Technical Information Service, 5285 Port Royal Road, Springfield, VA 22161, telephone 703-487-4650.

(a) The DNA issuances published in the DNA indexes are published under the following subject groups:

(b) Copies of DNA indexes and instructions may be ordered by telephone or letter. The commercial telephone number is (703) 325-7095. Include personal or company name, street address or post office box, city, state, country (if applicable) and zip code when submitting requests. Submit written requests to: Defense Nuclear Agency, Public Affairs Office, Washington, DC 20305-1000.

(c) This service is provided to the public and to federal agencies other than the Department of Defense. DNA does not charge for requests for an index and one instruction; however, fees for larger orders are determined on a case-by-case basis.