PART 9801—PRIVACY ACT REGULATIONS Authority: Section 11 of the Inspector General Act of 1978, as amended, 5 U.S.C. app.; 5 U.S.C. 301, 552a; 31 U.S.C. 9701; Sec. 15010, Pub. L. 116-136, 134 Stat. 281. Source: 81 FR 86563, Dec. 1, 2016, unless otherwise noted. Subpart A—General Provisions § 9801.101 Purpose and scope. This part contains the regulations of the Council of the Inspectors General on Integrity and Efficiency (CIGIE) implementing the Privacy Act of 1974, 5 U.S.C. 552a. This part sets forth the basic responsibilities of CIGIE with regard to CIGIE's compliance with the requirements of the Privacy Act and offers guidance to members of the public who wish to exercise any of the rights established by the Privacy Act with regard to records maintained by CIGIE. These regulations should be read in conjunction with the Privacy Act, which explains in more detail individuals' rights. § 9801.102 CIGIE organization. (a) Centralized program. (b) Acceptance of requests and appeals. [82 FR 51333, Nov. 6, 2017] § 9801.103 Definitions. (a) For purposes of this part the terms individual, maintain, record, routine use, system of records, (b) CIGIE (c) Days, (d) IC (e) Request for access (f) Request for amendment (g) Request for an accounting (h) Requester (i) PRAC [81 FR 86563, Dec. 1, 2016, as amended at 86 FR 26649, May 17, 2021] § 9801.104 Rules for determining if an individual is the subject of a record. An individual seeking to determine if a specific CIGIE system of records contains a record pertaining to the individual must follow the procedures set forth for access to records in § 9801.201(a), (b)(1) and (2), (c), and (d). A request to determine if an individual is the subject of a record will ordinarily be responded to within 10 days, except when CIGIE determines otherwise, in which case the request will be acknowledged within 10 days and the individual will be informed of the reasons for the delay and an estimated date by which a response will be issued. § 9801.105 Employee standards of conduct. CIGIE will inform its employees involved in the design, development, operation, or maintenance of any system of records, or in maintaining any record, of the provisions of the Privacy Act, including the Act's civil liability and criminal penalty provisions. Unless otherwise permitted by law, an employee of CIGIE shall: (a) Collect from individuals only the information that is relevant and necessary to discharge the responsibilities of CIGIE; (b) Collect information about an individual directly from that individual whenever practicable when the information may result in adverse determinations about an individual's rights, benefits, and privileges under Federal programs; (c) Inform each individual from whom information is collected of: (1) The legal authority to collect the information and whether providing it is mandatory or voluntary; (2) The principal purpose for which CIGIE intends to use the information; (3) The routine uses CIGIE may make of the information; and (4) The effects on the individual, if any, of not providing the information; (d) Maintain no system of records without public notice and notify appropriate CIGIE officials of the existence or development of any system of records that is not the subject of a current or planned public notice; (e) Maintain all records that are used by CIGIE in making any determination about an individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to ensure fairness to the individual in the determination; (f) Except as to disclosures made to an agency or made under the Freedom of Information Act, 5 U.S.C. 552 (FOIA), make reasonable efforts, prior to disseminating any record about an individual, to ensure that the record is accurate, relevant, timely, and complete; (g) Maintain no record describing how an individual exercises his or her First Amendment rights, unless it is expressly authorized by statute or by the individual about whom the record is maintained, or is pertinent to and within the scope of an authorized law enforcement activity; (h) When required by the Privacy Act, maintain an accounting in the specified form of all disclosures of records by CIGIE to persons, organizations, or agencies; (i) Maintain and use records with care to prevent the unauthorized or inadvertent disclosure of a record to anyone. No record contained in a CIGIE system of records shall be disclosed to another person, or to another agency outside CIGIE, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless the disclosure is otherwise authorized by the Privacy Act; and (j) Notify the appropriate CIGIE official of any record that contains information that the Privacy Act does not permit CIGIE to maintain. [81 FR 86563, Dec. 1, 2016, as amended at 82 FR 51333, Nov. 6, 2017] § 9801.106 Use and collection of social security numbers. (a) No denial of right, benefit, or privilege. (b) Notification to individual. (1) Whether providing social security numbers is mandatory or voluntary; (2) The statutory or regulatory authority that authorizes the collection of social security numbers; and (3) The uses that will be made of the numbers. § 9801.107 Other rights and services. Nothing in this part shall be construed to entitle any person, as of right, to any service or to the disclosure of any record to which such person is not entitled under the Privacy Act. Subpart B—Access to Records and Accounting of Disclosures § 9801.201 Requests for access. (a) How addressed. (b) Description of records sought. Federal Register, www.ignet.gov, (2) If the written inquiry does not refer to a specific system of records, it must describe the records that are sought in enough detail to enable CIGIE personnel to locate the system of records containing them with a reasonable amount of effort. (3) The request should state whether the requester wants a copy of the record or wants to examine the record in person. (c) Verification of identity. (d) Verification of guardianship. (1) The identity of the individual who is the subject of the record, by stating the name, current address, date and place of birth, and, at the requester's option, the social security number of the individual; (2) The requester's identity, as required in paragraph (c) of this section; (3) That the requester is the parent or guardian of that individual, which may be established by providing a copy of the individual's birth certificate showing the requester's parentage or by providing a court order establishing the requester's guardianship; and (4) That the requester is acting on behalf of that individual in making the request. § 9801.202 Response to requests. A request for access will ordinarily be responded to within 10 days, except when CIGIE determines otherwise, in which case the request will be acknowledged within 10 days and the requester will be informed of the reasons for the delay and an estimated date by which a response will be issued. A response to a request for access should include the following: (a) A statement that there is a record or records as requested or a statement that there is not a record in the system of records; (b) The method of access (if a copy of all the records requested is not provided with the response); (c) The amount of any fees to be charged for copies of records under § 9801.207, if applicable; (d) The name and title of the official responsible for the response; and (e) If the request is denied in whole or in part, or no record is found in the system, a statement of the reasons for the denial, or a statement that no record has been found, and notice of the procedures for appealing the denial or no record finding. § 9801.203 Granting access. (a) Means of access. (i) Examination in person in a designated office during the hours specified by CIGIE; or (ii) Providing copies of the records. (2) When a requester has not indicated whether he wants a copy of the record or wants to examine the record in person, CIGIE may choose the means of granting access. However, the means chosen should not unduly impede the requester's right of access. A requester may elect to receive a copy of the records after having examined them. (b) Accompanying individual. (c) Certified copies. (d) Original records. § 9801.204 Special procedures: Medical records. In the event CIGIE receives a request pursuant to § 9801.201 for access to medical records (including psychological records) whose disclosure CIGIE determines would be harmful to the individual to whom they relate, it may refuse to disclose the records directly to the requester but shall transmit them to a physician designated by the requester. § 9801.205 Appeals from denials of requests for access to records. (a) How addressed. (b) Deadline and content. § 9801.206 Response to appeal of a denial of access. (a) Access granted. (b) Denial affirmed. (c) When appeal is required. § 9801.207 Fees. (a) No fees for most services. (1) The search and review time expended by CIGIE to produce a record; (2) The first copy of the records provided; and (3) CIGIE making the records available to be personally reviewed by the requester. (b) Fees for additional copies. (1) If the total fee for additional copies amounts to more than $25.00, the requester will be notified of the fee amount. Except as specified in paragraph (b)(2) of this section, upon requester's written agreement to pay the assessed fees, CIGIE will provide the additional copies without prepayment of such fees ( i.e., (2) An advance payment before additional copies of the records are made will be required if: (i) CIGIE determines that the total fee to be assessed under this section exceeds $250.00. When such a determination is made, the requester will be notified of the determination and will be required to submit an advance payment of an amount up to the total fee. The amount of the advanced payment will be at the sole discretion of CIGIE and will be based, in part, on whether requester has a history of prompt payment of Privacy Act fees. If the required advanced payment is an amount less than the total fee, requester will be required to submit a written agreement to pay any fees not paid in advance; or (ii) The requester has previously failed to pay a previously assessed Privacy Act fee in a timely fashion ( i.e., (c) Interest charges. (d) Payment address. § 9801.208 Requests for accounting of record disclosures. (a) How made and addressed. (b) Where accountings are not required. (1) Disclosures for which accountings are not required to be kept, including disclosures that are made to officers and employees of CIGIE and disclosures that are made under the FOIA. For purposes of this part, officers and employees of CIGIE includes, in part, CIGIE's membership, as addressed in section 11 of the Inspector General Act, when such members are acting in their capacity as CIGIE members; (2) Disclosures made to law enforcement agencies for authorized law enforcement activities in response to written requests from those law enforcement agencies specifying the law enforcement activities for which the disclosures are sought; or (3) Disclosures made from law enforcement systems of records that have been exempted from accounting requirements. Subpart C—Amendment of Records § 9801.301 Requests for amendment of record. (a) How addressed. (b) Contents of request. (1) The name of the system of records and a brief description of the record proposed for amendment. In the event the request to amend the record is the result of the requester having gained access to the record in accordance with the provisions concerning access to records as set forth in subpart B of this part, copies of previous correspondence between the requester and CIGIE will serve in lieu of a separate description of the record. (2) The exact portion of the record the requester seeks to have amended should be indicated clearly. If possible, proposed alternative language should be set forth, or, at a minimum, the reasons why the requester believes the record is not accurate, relevant, timely, or complete should be set forth with enough particularity to permit CIGIE to not only understand the requester's basis for the request, but also to make an appropriate amendment to the record. (c) Burden of proof. (d) Identification requirement. [81 FR 86563, Dec. 1, 2016, as amended at 82 FR 51334, Nov. 6, 2017] § 9801.302 Response to requests. (a) Time limit for acknowledging a request for amendment. (b) Determination on an amendment request. (1) If CIGIE grants the request, the appropriate system manager will amend the record(s) and provide a copy of the amended record(s) to the requester. To the extent an accounting of disclosure has been maintained, the system manager shall advise all previous recipients of the record that an amendment has been made and give the substance of the amendment. Where practicable, the system manager shall send a copy of the amended record to previous recipients. (2) If CIGIE denies the request in whole or in part, the reasons for the denial will be stated in the response letter. In addition, the response letter will state: (i) The name and address of the official with whom an appeal of the denial may be lodged; and (ii) A description of any other procedures which may be required of the requester in order to process the appeal. § 9801.303 Appeal from adverse determination on amendment. (a) How addressed. (b) Deadline and content. § 9801.304 Response to appeal of adverse determination on amendment; disagreement statements. (a) Response timing. (b) Amendment granted. (1) To amend the record(s); and (2) To notify previous recipients of the record(s) for which there is an accounting of disclosure that the record(s) have been amended. (c) Denial affirmed. (1) Obtain judicial review of the decision in accordance with the terms of the Privacy Act at 5 U.S.C. 552a(g); and (2) File a statement setting forth their reasons for disagreeing with the decision. (d) Requester's disagreement statement. (e) Provision of requester's disagreement statement. § 9801.305 Assistance in preparing request to amend a record or to appeal an initial adverse determination. Requesters may seek assistance in preparing a request to amend a record or an appeal of an initial adverse determination, or to learn further of the provisions for judicial review, by contacting CIGIE's Privacy Officer by email at [email protected] Subpart D—Exemptions Source: 82 FR 51334, Nov. 6, 2017, unless otherwise noted. § 9801.401 Exemptions. (a) General policy. (b) Specific system of records exempted under (j)(2), (k)(1), and (k)(2). (1) Pursuant to the provisions of 5 U.S.C. 552a(j)(2), CIGIE-04 is exempt from the following provisions of the Privacy Act: 5 U.S.C. 552a(c)(3) and (c)(4); (d); (e)(1), (e)(2), (e)(3), (e)(4)(G)-(H), (e)(5), and (e)(8); (f); and (g). (2) Pursuant to the provisions of 5 U.S.C. 552a(k)(1) and (2), CIGIE-04 is exempt from the following provisions of the Privacy Act: 5 U.S.C. 552a(c)(3); (d); (e)(1) and (e)(4)(G)-(H); and (f). (3) Exemptions from the particular subsections are justified for the following reasons: (i) From subsection (c)(3) because release of disclosure accounting could alert the subjects of an investigation of an actual or potential criminal, civil, or regulatory violation to the existence of the investigation and the fact that they are subjects of the investigation, and reveal investigative interest by not only CIGIE, through the IC, but also by external agencies such as the Public Integrity Section of the Department of Justice. Because release of such information to the subjects of an investigation would provide them with significant information concerning the nature of the investigation, release could result in the destruction of documentary evidence, improper influencing of witnesses, and other activities that could impede or compromise the investigation. In addition, accounting for each disclosure could result in the release of properly classified information which would compromise the national defense or disrupt foreign policy. (ii) From subsection (c)(4) because this system is exempt from the access provisions of subsection (d) pursuant to subsections (j) and (k) of the Privacy Act. (iii) From the access and amendment provisions of subsection (d) because access to the records contained in this system of records could inform the subjects of an investigation of an actual or potential criminal, civil, or regulatory violation of the existence of that investigation and of the nature and scope of the information and evidence obtained as to their activities. Such awareness by the subjects could prevent the successful completion of an investigation and/or lead to the improper influencing of witnesses, the destruction of evidence, or fabricated testimony. In addition, granting access to such information could disclose security-sensitive or confidential business information or information that would constitute an unwarranted invasion of the personal privacy of third parties. Finally, access to the records could result in the release of classified information which would compromise the national defense or disrupt foreign policy. Amendment of the records would interfere with ongoing investigations and law enforcement activities and impose an impossible administrative burden by requiring investigations to be continuously reinvestigated. (iv) From subsection (e)(1) because the application of this provision could impair investigations and interfere with the law enforcement responsibilities of CIGIE through the IC for the following reasons: (A) It is not possible to detect relevance or necessity of specific information in the early stages of a civil, criminal, or other law enforcement investigation, case, or matter, including investigations in which use is made of classified information. Relevance and necessity are questions of judgment and timing, and it is only after the information is evaluated that the relevance and necessity of such information can be established. (B) During the course of any investigation, CIGIE, through the IC, may obtain information concerning actual or potential violations of laws other than those within the scope of its jurisdiction. In the interest of effective law enforcement, CIGIE should retain this information, as it may aid in establishing patterns of criminal activity and can provide valuable leads for Federal and other law enforcement agencies. (C) In interviewing individuals or obtaining other forms of evidence during an investigation, information may be supplied to an investigator that relates to matters incidental to the primary purpose of the investigation but which may relate also to matters under the investigative jurisdiction of another agency. Such information cannot readily be segregated. (v) From subsection (e)(2) because, in some instances, the application of this provision would present a serious impediment to law enforcement for the following reasons: (A) The subjects of an investigation would be placed on notice as to the existence of an investigation and would therefore be able to avoid detection or apprehension, to improperly influence witnesses, to destroy evidence, or to fabricate testimony. (B) In certain circumstances the subjects of an investigation cannot be required to provide information to investigators, and information relating to their illegal acts, violations of rules of conduct, or any other misconduct must be obtained from other sources. (C) In any investigation it is necessary to obtain evidence from a variety of sources other than the subjects of the investigation. (vi) From subsection (e)(3) because the application of this provision would provide the subjects of an investigation with substantial information which could impede or compromise the investigation. (vii) From subsection (e)(4)(G)-(I) because this system of records is exempt from the access provisions of subsection (d). (viii) From subsection (e)(5) because the application of this provision may prevent the collection of any data not shown to be accurate, relevant, timely, and complete at the moment it is collected. In the collection of information for law enforcement purposes, it is impossible to determine in advance what information is accurate, relevant, timely, and complete. Material which may seem unrelated, irrelevant, or incomplete when collected may take on added meaning or significance as an investigation progresses. The restrictions of this provision could interfere with the preparation of a complete investigative report, and thereby impede effective law enforcement. (ix) From subsection (e)(8) because the application of this provision could prematurely reveal an ongoing criminal investigation to the subjects of an investigation and could reveal investigative techniques, procedures, or evidence. (x) From subsection (f) because CIGIE's rules are inapplicable to those portions of the system that are exempt and would place the burden on CIGIE of either confirming or denying the existence of a record pertaining to a requesting individual, which might in itself provide an answer to that individual relating to an ongoing investigation. The conduct of a successful investigation leading to the indictment of a criminal offender precludes the applicability of established agency rules relating to verification of record, disclosure of the record to that individual, and record amendment procedures for this record system. (xi) From subsection (g) to the extent that this system is exempt from the access and amendment provisions of subsection (d) pursuant to subsections (j)(2), (k)(1), and (k)(2) of the Privacy Act. (c) Specific system of records exempted under (j)(2), (k)(1), and (k)(2). (1) Pursuant to the provisions of 5 U.S.C. 552a(j)(2), CIGIE-6 is exempt from the following provisions of the Privacy Act: 5 U.S.C. 552a(c)(3) and (c)(4); (d); (e)(1), (e)(2), (e)(3), (e)(4)(G)-(H), (e)(5), and (e)(8); (f); and (g). (2) Pursuant to the provisions of 5 U.S.C. 552a(k)(1) and (2), CIGIE-6 is exempt from the following provisions of the Privacy Act: 5 U.S.C. 552a(c)(3); (d); (e)(1) and (e)(4)(G)-(H); and (f). (3) Exemptions from the particular subsections are justified for the following reasons: (i) From subsection (c)(3) because release of disclosure accounting could alert the subjects of an investigation of an actual or potential criminal, civil, or regulatory violation to the existence of the investigation and the fact that they are subjects of the investigation, and reveal investigative interest by not only CIGIE, through the PRAC, but also by external agencies such as Federal Offices of Inspector General. Because release of such information to the subjects of an investigation would provide them with significant information concerning the nature of the investigation, release could result in the destruction of documentary evidence, improper influencing of witnesses, and other activities that could impede or compromise the investigation. In addition, accounting for each disclosure could result in the release of properly classified information which would compromise the national defense or disrupt foreign policy. (ii) From subsection (c)(4) because this system is exempt from the access provisions of subsection (d) pursuant to subsections (j) and (k) of the Privacy Act. (iii) From the access and amendment provisions of subsection (d) because access to the records contained in this system of records could inform the subjects of an investigation of an actual or potential criminal, civil, or regulatory violation of the existence of that investigation and of the nature and scope of the information and evidence obtained as to their activities. Such awareness by the subjects could prevent the successful completion of an investigation and/or lead to the improper influencing of witnesses, the destruction of evidence, or fabricated testimony. In addition, granting access to such information could disclose security-sensitive or confidential business information or information that would constitute an unwarranted invasion of the personal privacy of third parties. Finally, access to the records could result in the release of classified information which would compromise the national defense or disrupt foreign policy. Amendment of the records would interfere with ongoing investigations and law enforcement activities and impose an impossible administrative burden by requiring investigations to be continuously reinvestigated. (iv) From subsection (e)(1) because the application of this provision could impair investigations and interfere with the law enforcement responsibilities of CIGIE through the PRAC for the following reasons: (A) It is not possible to detect relevance or necessity of specific information in the early stages of a civil, criminal, or other law enforcement investigation, case, or matter, including investigations in which use is made of classified information. Relevance and necessity are questions of judgment and timing, and it is only after the information is evaluated that the relevance and necessity of such information can be established. (B) During the course of any investigation, CIGIE, through the PRAC may obtain information concerning actual or potential violations of laws other than those within the scope of its jurisdiction. In the interest of effective law enforcement, the PRAC should retain this information, as it may aid in establishing patterns of criminal activity and can provide valuable leads for Federal and other law enforcement agencies. (C) In interviewing individuals or obtaining other forms of evidence during an investigation, information may be supplied to an investigator that relates to matters incidental to the primary purpose of the investigation but which may relate also to matters under the investigative jurisdiction of another agency. Such information cannot readily be segregated. (v) From subsection (e)(2) because, in some instances, the application of this provision would present a serious impediment to law enforcement for the following reasons: (A) The subjects of an investigation would be placed on notice as to the existence of an investigation and would therefore be able to avoid detection or apprehension, to improperly influence witnesses, to destroy evidence, or to fabricate testimony. (B) In certain circumstances the subjects of an investigation cannot be required to provide information to investigators, and information relating to their illegal acts, violations of rules of conduct, or any other misconduct must be obtained from other sources. (C) In any investigation it is necessary to obtain evidence from a variety of sources other than the subjects of the investigation. (vi) From subsection (e)(3) because the application of this provision would provide the subjects of an investigation with substantial information which could impede or compromise the investigation. (vii) From subsection (e)(4)(G)-(I) because this system of records is exempt from the access provisions of subsection (d). (viii) From subsection (e)(5) because the application of this provision may prevent the collection of any data not shown to be accurate, relevant, timely, and complete at the moment it is collected. In the collection of information for law enforcement purposes, it is impossible to determine in advance what information is accurate, relevant, timely, and complete. Material which may seem unrelated, irrelevant, or incomplete when collected may take on added meaning or significance as an investigation progresses. The restrictions of this provision could interfere with the preparation of a complete investigative report, and thereby impede effective law enforcement. (ix) From subsection (e)(8) because the application of this provision could prematurely reveal an ongoing criminal investigation to the subjects of an investigation and could reveal investigative techniques, procedures, or evidence. (x) From subsection (f) because CIGIE's rules are inapplicable to those portions of the system that are exempt and would place the burden on CIGIE of either confirming or denying the existence of a record pertaining to a requesting individual, which might in itself provide an answer to that individual relating to an ongoing investigation. The conduct of a successful investigation leading to the indictment of a criminal offender precludes the applicability of established agency rules relating to verification of record, disclosure of the record to that individual, and record amendment procedures for this record system. (xi) From subsection (g) to the extent that this system is exempt from the access and amendment provisions of subsection (d) pursuant to subsections (j)(2), (k)(1), and (k)(2) of the Privacy Act. [81 FR 86563, Dec. 1, 2016, as amended at 86 FR 26649, May 17, 2021]