PART 2606—PRIVACY ACT RULES Authority: 5 U.S.C. 552a, 5 U.S.C. App. (Ethics in Government Act of 1978). Source: 68 FR 27891, May 22, 2003, unless otherwise noted. Subpart A—General Provisions § 2606.101 Purpose. This part sets forth the regulations of the Office of Government Ethics (OGE) implementing the Privacy Act of 1974, as amended (5 U.S.C. 552a). It governs access, maintenance, disclosure, and amendment of records contained in OGE's executive branch Governmentwide and internal systems of records, and establishes rules of conduct for OGE employees who have responsibilities under the Act. § 2606.102 Definitions. For the purpose of this part, the terms listed below are defined as follows: Access Act Amendment Data subject He, his, him Office OGE System manager System of records Working day § 2606.103 Systems of records. (a) Governmentwide systems of records. (b) OGE Internal systems of records. § 2606.104 OGE and agency responsibilities. (a) The procedures in this part apply to: (1) All initial Privacy Act access and amendment requests regarding records contained in an OGE system of records. (2) Administrative appeals from an Office or agency denial of an initial request for access to, or to amend, records contained in an OGE system of records. (b) For records contained in an OGE Governmentwide system of records, each agency is responsible (unless specifically excepted by the Office) for responding to initial requests for access or amendment of records in its custody and administrative appeals of denials thereof. (c) For records and material of another agency that are in the custody of OGE, but not under its control or ownership, OGE may refer a request for the records to that other agency, consult with the other agency prior to responding, or notify the requester that the other agency is the proper agency to contact. § 2606.105 Rules for individuals seeking to ascertain if they are the subject of a record. An individual seeking to ascertain if any OGE system of records contains a record pertaining to him must follow the access procedures set forth at § 2606.201(a) and (b). § 2606.106 OGE employee Privacy Act rules of conduct and responsibilities. Each OGE employee involved in the design, development, operation, or maintenance of any system of records, or in maintaining any record covered by the Privacy Act, shall comply with the pertinent provisions of the Act relating to the treatment of such information. Particular attention is directed to the following provisions of the Privacy Act: (a) 5 U.S.C. 552a(e)(7). (b) 5 U.S.C. 552a(b). (c) 5 U.S.C. 552a(e)(1). (d) 5 U.S.C. 552a(e)(2). (e) 5 U.S.C. 552a(e)(3). (f) 5 U.S.C. 552a(b) and (e)(10). (g) 5 U.S.C. 552a(c)(1), (c)(2) and (c)(3). (h) 5 U.S.C. 552a(e)(5) and (e)(6). (i) 5 U.S.C. 552a(d)(1), (d)(2) and (d)(3). (j) 5 U.S.C. 552a(c)(4) and (d)(4). (k) 5 U.S.C. 552a(n). (l) 5 U.S.C. 552a(i). Subpart B—Access to Records and Accounting of Disclosures § 2606.201 Requests for access. (a) Records in an OGE Governmentwide system of records. (1) Records filed directly with OGE by non-OGE employees: (2) Records filed with a Designated Agency Ethics Official (DAEO) or the head of a department or agency: (3) Records filed with the Federal Election Commission by candidates for President or Vice President: (b) Records in an OGE Internal System of Records. (c) Content of request. Federal Register, http://www.usoge.gov, http://www.access.gpo.gov/su_docs/aces/PrivacyAct.shtml (2) If the written inquiry does not refer to a specific system of records, it should include other information that will assist in the identification of the records for which access is being requested. Such information may include, for example, the individual's full name (including her maiden name, if pertinent), dates of employment, social security number (if any records in the system include this identifier), current or last place and date of Federal employment. If the request for access follows a prior request to determine if an individual is the subject of a record, the same identifying information need not be included in the request for access if a reference is made to that prior correspondence, or a copy of the response to that request is attached. (3) The request should state whether the requester wants a copy of the record, or wants to examine the record in person. § 2606.202 OGE or other agency action on requests. A response to a request for access should include the following: (a) A statement that there is a record or records as requested or a statement that there is not a record in the system of records; (b) The method of access (if a copy of all the records requested is not provided with the response); (c) The amount of any fees to be charged for copies of records under § 2606.206 of this part or other agencies' Privacy Act regulations as referenced in that section; (d) The name, title, and telephone number of the official having operational control over the record; and (e) If the request is denied in whole or in part, or no record is found in the system, a statement of the reasons for the denial, or a statement that no record has been found, and notice of the procedures for appealing the denial or no record finding. § 2606.203 Granting access. (a) The methods for allowing access to records, when such access has been granted by OGE or the other agency concerned are: (1) Examination in person in a designated office during the hours specified by OGE or the other agency; (2) Providing photocopies of the records; or (3) Transfer of records at the option of OGE or the other agency to another more convenient Federal facility. (b) When a requester has not indicated whether he wants a copy of the record, or wants to examine the record in person, the appropriate system manager may choose the means of granting access. However, the means chosen should not unduly impede the data subject's right of access. A data subject may elect to receive a copy of the records after having examined them. (c) Generally, OGE or the other agency concerned will not furnish certified copies of records. When copies are to be furnished, they may be provided as determined by OGE or the other agency concerned. (d) When the data subject seeks to obtain original documentation, the Office and the other agencies concerned reserve the right to limit the request to copies of the original records. Original records should be made available for review only in the presence of the appropriate system manager or his designee. Note to paragraph ( d Section 2071(a) of title 18 of the United States Code makes it a crime to conceal, remove, mutilate, obliterate, or destroy any record filed in a public office, or to attempt to do so. (e) Identification requirements Access granted in person Current or former employees. (ii) Other than current or former employees. (2) Access granted by mail. (3) Unavailability of identification documentation. (4) Inadequate identification. (f) Access by the parent of a minor, or legal guardian. (g) Accompanying individual. (h) Access to medical records. (i) Exclusion. see (j) Maximum access. § 2606.204 Request for review of an initial denial of access. (a)(1) A data subject may submit a written appeal of the decision by OGE or the other agency to deny an initial request for access to records or a no record response. (i) For records filed directly with OGE, the appeal must be submitted to the Director, Office of Government Ethics, Suite 500, 1201 New York Avenue, NW., Washington, DC 20005-3917. (ii) For records in OGE's executive branch Governmentwide systems of records that are filed directly with an agency (including the Federal Election Commission) other than OGE, the appeal must be submitted to the Privacy Act access appeals official as specified in the agency's own Privacy Act regulations or the respective head of the agency concerned if it does not have any Privacy Act regulations. (2) The words “Privacy Act Appeal” should be included on the envelope and at the top of the letter of appeal. (b) The appeal should contain a brief description of the records involved or copies of the correspondence from OGE or the agency in which the initial request for access was denied. The appeal should attempt to refute the reasons given by OGE or the other agency concerned in its decision to deny the initial request for access or the no record finding. § 2606.205 Response to a request for review of an initial denial of access. (a) If the OGE Director or agency reviewing official determines that access to the records should be granted, the response will state how access will be provided if the records are not included with the response. (b) Any decision that either partially or fully affirms the initial decision to deny access shall inform the requester of the right to seek judicial review of the decision in accordance with 5 U.S.C. 552a(g) of the Privacy Act. § 2606.206 Fees. (a) Fees for records filed with OGE Services for which fees will not be charged: (i) The search and review time expended by OGE to produce a record; (ii) The first copy of the records provided; or (iii) The Office of Government Ethics making the records available to be personally reviewed by the data subject. (2) Additional copies of records. (i) Notice of anticipated fees in excess of $25.00. (ii) Advance payments. (A) The Office estimates or determines that the total fee to be assessed under this section is likely to exceed $250.00. When a determination is made that the allowable charges are likely to exceed $250.00, the requester will be notified of the likely cost and will be required to provide satisfactory assurance of full payment where the requester has a history of prompt payment of Privacy Act fees, or will be required to submit an advance payment of an amount up to the full estimated charges in the case of requesters with no history of payment; or (B) The requester has previously failed to pay a Privacy Act fee charged in a timely fashion ( i.e., (iii) Interest charges. et seq. et seq. (iv) Remittance. (b) Fees for records filed with agencies other than OGE. § 2606.207 Accounting of disclosures. (a) The Office of Government Ethics or the other agency concerned will maintain an accounting of disclosures in cases where records about the data subject are disclosed from OGE's system of records except— (1) When the disclosure is made pursuant to the Freedom of Information Act, as amended (5 U.S.C. 552); or (2) When the disclosure is made to those officers and employees of OGE or the other agency which maintains the records who have a need for the records in the performance of their duties. (b) This accounting of disclosures will be retained for at least five years or for the life of the record, whichever is longer, and will contain the following information: (1) A brief description of the record disclosed; (2) The date, nature, and purpose for the disclosure; and (3) The name and address of the individual, agency, or other entity to whom the disclosure is made. (c) Under sections 102 and 105 of the Ethics in Government Act, 18 U.S.C. 208(d) and 5 CFR parts 2634 and 2640 of OGE's executive branch regulations, a requester other than the data subject must submit a signed, written application on the OGE Form 201 or agency equivalent form to inspect or receive copies of certain records, such as SF 278 Public Financial Disclosure Reports, Certificates of Divestiture, 18 U.S.C. 208(b)(1) and (b)(3) waivers, and OGE certified qualified blind and diversified trust instruments and other publicly available qualified trust materials. The written application requests the name, occupation and address of the requester as well as lists the prohibitions on obtaining or using the records. These applications are used as the accounting of disclosures for these records. (d) Except for the accounting of a disclosure made under subsection (b)(7) of the Privacy Act for a civil or criminal law enforcement activity that is authorized by law, the accounting of disclosures will be made available to the data subject upon request in accordance with the access procedures of this part. Subpart C—Amendment of Records § 2606.301 Requests to amend records. (a) Amendment request. (b) Addresses Records in an OGE Governmentwide system of records. (i) Records filed directly with OGE by non-OGE employees: (ii) Records filed with a Designated Agency Ethics Official (DAEO) or the head of a department or agency: (iii) Records filed with the Federal Election Commission by candidates for President or Vice President: (2) Records in an OGE internal system of records. (c) Contents of request. (2) The name of the system of records and a brief description of the record(s) proposed for amendment must be included in any request for amendment. In the event the request to amend the record(s) is the result of the data subject's having gained access to the record(s) in accordance with the provisions concerning access to records as set in subpart B of this part, copies of previous correspondence between the requester and OGE or the agency will serve in lieu of a separate description of the record. (3) The exact portion of the record(s) the data subject seeks to have amended should be indicated clearly. If possible, proposed alternative language should be set forth, or, at a minimum, the reasons why the data subject believes his record is not accurate, relevant, timely, or complete should be set forth with enough particularity to permit OGE or the other agency concerned not only to understand the data subject's basis for the request, but also to make an appropriate amendment to the record. (d) Burden of proof. (e) Identification requirement. § 2606.302 OGE or other agency action on requests. (a) Time limit for acknowledging a request for amendment. (b) Initial determination on an amendment request. (1) If OGE or the other agency concerned grants the request, the appropriate system manager will amend the record(s) and provide a copy of the amended record(s) to the data subject. Where an accounting of disclosure has been maintained, the system manager shall advise all previous recipients of the record that an amendment has been made and give the substance of the amendment. Where practicable, the system manager shall send a copy of the amended record to previous recipients. (2) If OGE or the other agency concerned denies the request in whole or in part, the reasons for the denial will be stated in the response letter. In addition, the response letter will state: (i) The name and address of the official with whom an appeal of the denial may be lodged; and (ii) A description of any other procedures which may be required of the data subject in order to process the appeal. § 2606.303 Request for review of an initial refusal to amend a record. (a)(1) A data subject may submit a written appeal of the initial decision by OGE or an agency denying a request to amend a record in an OGE system of records. (i) For records which are filed directly with OGE, the appeal must be submitted to the Director, Office of Government Ethics, Suite 500, 1201 New York Avenue, NW., Washington, DC 20005-3917. (ii) For records which are filed directly with an agency (including the Federal Election Commission) other than OGE, the appeal must be submitted to the Privacy Act amendments appeals official as specified in the agency's own Privacy Act regulations, or to the respective head of the agency concerned if it does not have Privacy Act regulations. (2) The words “Privacy Act Appeal” should be included on the envelope and at the top of the letter of the appeal. (b) The request for review should contain a brief description of the record(s) involved or copies of the correspondence from OGE or the agency in which the request to amend was denied, and the reasons why the data subject believes that the disputed information should be amended. § 2606.304 Response to a request for review of an initial refusal to amend; disagreement statements. (a) The OGE Director or agency reviewing official should make a final determination in writing not later than 30 days from the date the appeal was received. The 30-day period may be extended for good cause. Notice of the extension and the reasons therefor will be sent to the data subject within the 30-day period. (b) If the OGE Director or agency reviewing official determines that the record(s) should be amended in accordance with the data subject's request, the OGE Director or agency reviewing official will take the necessary steps to advise the data subject, and to direct the appropriate system manager: (1) To amend the record(s), and (2) To notify previous recipients of the record(s) for which there is an accounting of disclosure that the record(s) have been amended. (c) If the appeal decision does not grant in full the request for amendment, the decision letter will notify the data subject that he may: (1) Obtain judicial review of the decision in accordance with the terms of the Privacy Act at 5 U.S.C. 552a(g); and (2) File a statement setting forth his reasons for disagreeing with the decision. (d)(1) A data subject's disagreement statement must be concise. The appropriate system manager has the authority to determine the “conciseness” of the statement, taking into account the scope of the disagreement and the complexity of the issues. (2) In any disclosure of information about which an individual has filed a statement of disagreement, the appropriate system manager will clearly note any disputed portion(s) of the record(s) and will provide a copy of the statement to persons or other agencies to whom the disputed record or records has been disclosed and for whom an accounting of disclosure has been maintained. A concise statement of the reasons for not making the amendments requested may also be provided.