PART 1204—PRIVACY ACT IMPLEMENTATION Authority: 5 U.S.C. 552a. Source: 76 FR 51871, Aug. 19, 2011, unless otherwise noted. Editorial Note: Nomenclature changes to part 1204 appear at 77 FR 4646, Jan. 31, 2012. § 1204.1 Why did FHFA issue this part? The Federal Housing Finance Agency (FHFA) issued this part to— (a) Implement the Privacy Act, a Federal law that helps protect private information about individuals that Federal agencies collect or maintain. You should read this part together with the Privacy Act, which provides additional information about records maintained on individuals; (b) Establish rules that apply to all FHFA and FHFA Office of Inspector General (FHFA-OIG) maintained systems of records retrievable by an individual's name or other personal identifier; (c) Describe procedures through which you may request access to records, request amendment or correction of those records, or request an accounting of disclosures of those records by FHFA or FHFA-OIG; (d) Inform you, that when it is appropriate to do so, FHFA or FHFA-OIG automatically processes a Privacy Act request for access to records under both the Privacy Act and FOIA, following the rules contained in this part and in FHFA's Freedom of Information Act regulation at part 1202 of this title so that you will receive the maximum amount of information available to you by law; (e) Notify you that this part does not entitle you to any service or to the disclosure of any record to which you are not entitled under the Privacy Act. It also does not, and may not be relied upon, to create any substantive or procedural right or benefit enforceable against FHFA or FHFA-OIG; and (f) Notify you that this part applies to both FHFA and FHFA-OIG. § 1204.2 What do the terms in this part mean? The following definitions apply to the terms used in this part— Access Amendment Court Days, FHFA FHFA-OIG FOIA Individual Maintain Privacy Act Privacy Act Appeals Officer Privacy Act Appeals Officer Privacy Act Officer Privacy Act Officer Record Routine use Senior Agency Official for Privacy System of Records System of Records Notice Federal Register § 1204.3 How do I make a Privacy Act request? (a) What is a valid request? (b) How and where do I make a request? [email protected]. http://www.fhfa.gov, (c) What must the request include? (d) How do I request amendment or correction of a record? (e) How do I request for an accounting of disclosures? (f) Must I verify my identity? (1) How do I verify my identity? i.e. i.e. (2) How do I verify parentage or guardianship? (i) The identity of the individual who is the subject of the record, by stating the individual's name, current address, date and place of birth, and, at your option, the Social Security number of the individual; (ii) Your own identity, as required in paragraph (f)(1) of this section; (iii) That you are the parent or guardian of the individual, which you may prove by providing a properly authenticated copy of the individual's birth certificate showing your parentage or a properly authenticated court order establishing your guardianship; and (iv) That you are acting on behalf of the individual in making the request. [76 FR 51871, Aug. 19, 2011, as amended at 77 FR 4646, Jan. 31, 2012; 80 FR 80233, Dec. 24, 2015] § 1204.4 How will FHFA or FHFA-OIG respond to my Privacy Act request? (a) How will FHFA or FHFA-OIG locate the requested records? http://www.fhfa.gov. http://www.gpoaccess.gov/privacyact/index.html. (b) How long does FHFA or FHFA-OIG have to respond? (c) What will the FHFA or FHFA-OIG response include? (d) What is an adverse determination? (1) Withholds any requested record in whole or in part; (2) Denies a request for an amendment or correction of a record in whole or in part; (3) Declines to provide a requested accounting of disclosures; (4) Advises that a requested record does not exist or cannot be located; or (5) Finds what has been requested is not a record subject to the Privacy Act. (e) What will be stated in a response that includes an adverse determination? § 1204.5 What if I am dissatisfied with the response to my Privacy Act request? (a) May I appeal the response? (b) How do I appeal the response? (2) If FHFA or FHFA-OIG denied your request in whole or in part, you may appeal the denial by writing directly to the FHFA Privacy Act Appeals Officer through electronic mail, mail, delivery service, or facsimile. The electronic mail address is: [email protected]. http://www.fhfa.gov, (3) If you need more time to file your appeal, you may request an extension of time of no more than ten (10) calendar days in which to file your appeal, but only if your request is made within the original 30-calendar day time period for filing the appeal. Granting an extension is in the sole discretion of either the FHFA or FHFA-OIG Privacy Act Appeals Officer. (c) Who has the authority to grant or deny appeals? (d) When will FHFA or FHFA-OIG respond to my appeal? (e) What will the FHFA or FHFA-OIG response include? (1) If your appeal concerns a request for access to records or information and the appeal determination grants your access, the records or information, if any, will be made available to you. (2)(i) If your appeal concerns an amendment or correction of a record and the appeal determination grants your request for an amendment or correction, the response will describe any amendment or correction made to the record and advise you of your right to obtain a copy of the amended or corrected record under this part. FHFA or FHFA-OIG will notify all persons, organizations, or Federal agencies to which it previously disclosed the record, if an accounting of that disclosure was made, that the record has been amended or corrected. Whenever the record is subsequently disclosed, the record will be disclosed as amended or corrected. (ii) If the response to your appeal denies your request for an amendment or correction to a record, the response will advise you of your right to file a Statement of Disagreement under paragraph (f) of this section. (f) What is a Statement of Disagreement? (2) FHFA and FHFA-OIG will notify all persons, organizations, and Federal agencies to which it previously disclosed the disputed record, if an accounting of that disclosure was made, that the record is disputed and provide your Statement of Disagreement and the FHFA or FHFA-OIG concise statement, if any. Whenever the disputed record is subsequently disclosed, a copy of your Statement of Disagreement and the FHFA or FHFA-OIG concise statement, if any, will also be disclosed. [76 FR 51871, Aug. 19, 2011, as amended at 77 FR 4646, Jan. 31, 2012; 80 FR 80233, Dec. 24, 2015] § 1204.6 What does it cost to get records under the Privacy Act? (a) Must I agree to pay fees? (b) How does FHFA or FHFA-OIG calculate fees? § 1204.7 Are there any exemptions from the Privacy Act? (a) What is a Privacy Act exemption? (b) How do I know if the records or information I want are exempt? (2) Until superseded by FHFA or FHFA-OIG systems of records, the following OFHEO and FHFB systems of records are, under 5 U.S.C. 552a(k)(2) or (k)(5), exempt from the Privacy Act requirements of 5 U.S.C. 552a(c)(3), (d), (e)(1), (e)(4)(G), (e)(4)(H), (e)(4)(I), and (f)— (i) OFHEO-11 Litigation and Enforcement Information System; and (ii) FHFB-5 Agency Personnel Investigative Records. (c) What exemptions potentially apply to FHFA-OIG records? (1) To the extent that the systems of records entitled “FHFA-OIG Audit Files Database,” “FHFA-OIG Investigative & Evaluative Files Database,” “FHFA-OIG Investigative & Evaluative MIS Database,” “FHFA-OIG Hotline Database,” and “FHFA-OIG Correspondence Database” contain any information compiled by FHFA-OIG for the purpose of criminal law enforcement investigations, such information falls within the scope of exemption (j)(2) of the Privacy Act, 5 U.S.C. 552a(j)(2), and therefore these systems of records are exempt from the requirements of the following subsections of the Privacy Act to that extent, for the reasons stated in paragraphs (1)(i) through (vi) of this section. (i) From 5 U.S.C. 552a(c)(3), because release of an accounting of disclosures to an individual who is the subject of an investigation or evaluation could reveal the nature and scope of the investigation or evaluation and could result in the altering or destruction of evidence, improper influencing of witnesses, and other evasive actions that could impede or compromise the investigation or evaluation. (ii) From 5 U.S.C. 552a(d)(1), because release of investigative or evaluative records to an individual who is the subject of an investigation or evaluation could interfere with pending or prospective law enforcement proceedings, constitute an unwarranted invasion of the personal privacy of third parties, reveal the identity of confidential sources, or reveal sensitive investigative or evaluative techniques and procedures. (iii) From 5 U.S.C. 552a(d)(2), because amendment or correction of investigative or evaluative records could interfere with pending or prospective law enforcement proceedings, or could impose an impossible administrative and investigative or evaluative burden by requiring FHFA-OIG to continuously retrograde its investigations or evaluations attempting to resolve questions of accuracy, relevance, timeliness, and completeness. (iv) From 5 U.S.C. 552a(e)(1), because it is often impossible to determine relevance or necessity of information in the early stages of an investigation or evaluation. The value of such information is a question of judgment and timing; what appears relevant and necessary when collected may ultimately be evaluated and viewed as irrelevant and unnecessary to an investigation or evaluation. In addition, FHFA-OIG may obtain information concerning the violation of laws other than those within the scope of its jurisdiction. In the interest of effective law enforcement, FHFA-OIG should retain this information because it may aid in establishing patterns of unlawful activity and provide leads for other law enforcement agencies. Further, in obtaining evidence during an investigation or evaluation, information may be provided to FHFA-OIG that relates to matters incidental to the main purpose of the investigation or evaluation, but which may be pertinent to the investigative or evaluative jurisdiction of another agency. Such information cannot readily be identified. (v) From 5 U.S.C. 552a(e)(2), because in a law enforcement investigation or an evaluation it is usually counterproductive to collect information to the greatest extent practicable directly from the subject thereof. It is not always feasible to rely upon the subject of an investigation or evaluation as a source for information which may implicate him or her in illegal activities. In addition, collecting information directly from the subject could seriously compromise an investigation or evaluation by prematurely revealing its nature and scope, or could provide the subject with an opportunity to conceal criminal activities, or intimidate potential sources, in order to avoid apprehension. (vi) From 5 U.S.C. 552a(e)(3), because providing such notice to the subject of an investigation or evaluation, or to other individual sources, could seriously compromise the investigation or evaluation by prematurely revealing its nature and scope, or could inhibit cooperation, permit the subject to evade apprehension, or cause interference with undercover activities. (2) To the extent that the systems of records entitled “FHFA-OIG Audit Files Database,” “FHFA-OIG Investigative & Evaluative Files Database,” “FHFA-OIG Investigative & Evaluative MIS Database,” “FHFA-OIG Hotline Database,” and “FHFA-OIG Correspondence Database,” contain information compiled by FHFA-OIG for the purpose of criminal law enforcement investigations, such information falls within the scope of exemption (k)(2) of the Privacy Act, 5 U.S.C. 552a(k)(2), and therefore these systems of records are exempt from the requirements of the following subsections of the Privacy Act to that extent, for the reasons stated in paragraphs (c)(2)(i) through (iv) of this section. (i) From 5 U.S.C. 552a(c)(3), because release of an accounting of disclosures to an individual who is the subject of an investigation or evaluation could reveal the nature and scope of the investigation or evaluation and could result in the altering or destruction of evidence, improper influencing of witnesses, and other evasive actions that could impede or compromise the investigation or evaluation. (ii) From 5 U.S.C. 552a(d)(1), because release of investigative or evaluative records to an individual who is the subject of an investigation or evaluation could interfere with pending or prospective law enforcement proceedings, constitute an unwarranted invasion of the personal privacy of third parties, reveal the identity of confidential sources, or reveal sensitive investigative or evaluative techniques and procedures. (iii) From 5 U.S.C. 552a(d)(2), because amendment or correction of investigative or evaluative records could interfere with pending or prospective law enforcement proceedings, or could impose an impossible administrative and investigative or evaluative burden by requiring FHFA-OIG to continuously retrograde its investigations or evaluations attempting to resolve questions of accuracy, relevance, timeliness, and completeness. (iv) From 5 U.S.C. 552a(e)(1), because it is often impossible to determine relevance or necessity of information in the early stages of an investigation or evaluation. The value of such information is a question of judgment and timing; what appears relevant and necessary when collected may ultimately be evaluated and viewed as irrelevant and unnecessary to an investigation or evaluation. In addition, FHFA-OIG may obtain information concerning the violation of laws other than those within the scope of its jurisdiction. In the interest of effective law enforcement, FHFA-OIG should retain this information because it may aid in establishing patterns of unlawful activity and provide leads for other law enforcement agencies. Further, in obtaining evidence during an investigation or evaluation, information may be provided to FHFA-OIG that relates to matters incidental to the main purpose of the investigation or evaluation but which may be pertinent to the investigative or evaluative jurisdiction of another agency. Such information cannot readily be identified. (3) To the extent that the systems of records entitled “FHFA-OIG Audit Files Database,” “FHFA-OIG Investigative & Evaluative Files Database,” “FHFA-OIG Investigative & Evaluative MIS Database,” “FHFA-OIG Hotline Database,” and “FHFA-OIG Correspondence Database” contain any investigatory material compiled by FHFA-OIG for the purpose of determining suitability, eligibility, or qualifications for Federal civilian employment or Federal contracts, the release of which would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence, such information falls within the scope of exemption (k)(5) of the Privacy Act, 5 U.S.C. 552a(k)(5), and therefore these systems of records are exempt from the requirements of subsection (d)(1) of the Privacy Act to that extent, because release would reveal the identity of a source who furnished information to the Government under an express promise of confidentiality. Revealing the identity of a confidential source could impede future cooperation by sources, and could result in harassment or harm to such sources. § 1204.8 How are records secured? (a) What controls must FHFA and FHFA-OIG have in place? (1) Records are protected from public view; (2) The area in which records are kept is supervised during business hours to prevent unauthorized persons from having access to them; (3) Records are inaccessible to unauthorized persons outside of business hours; and (4) Records are not disclosed to unauthorized persons or under unauthorized circumstances in either oral or written form. (b) Is access to records restricted? § 1204.9 Does FHFA or FHFA-OIG collect and use Social Security numbers? FHFA and FHFA-OIG collect Social Security numbers only when it is necessary and authorized. At least annually, the FHFA Privacy Act Officer or the Senior Agency Official for Privacy will inform employees who are authorized to collect information that— (a) Individuals may not be denied any right, benefit, or privilege as a result of refusing to provide their Social Security numbers, unless the collection is authorized either by a statute or by a regulation issued prior to 1975; and (b) They must inform individuals who are asked to provide their Social Security numbers— (1) If providing a Social Security number is mandatory or voluntary; (2) If any statutory or regulatory authority authorizes collection of a Social Security number; and (3) The uses that will be made of the Social Security number. § 1204.10 What are FHFA and FHFA-OIG employee responsibilities under the Privacy Act? At least annually, the FHFA Privacy Act Officer or the Senior Agency Official for Privacy will inform employees about the provisions of the Privacy Act, including the Privacy Act's civil liability and criminal penalty provisions. Unless otherwise permitted by law, an authorized FHFA or FHFA-OIG employee shall— (a) Collect from individuals only information that is relevant and necessary to discharge FHFA or FHFA-OIG responsibilities; (b) Collect information about an individual directly from that individual whenever practicable; (c) Inform each individual from whom information is collected of— (1) The legal authority to collect the information and whether providing it is mandatory or voluntary; (2) The principal purpose for which FHFA or FHFA-OIG intends to use the information; (3) The routine uses FHFA or FHFA-OIG may make of the information; and (4) The effects on the individual, if any, of not providing the information. (d) Ensure that the employee's office does not maintain a system of records without public notice and notify appropriate officials of the existence or development of any system of records that is not the subject of a current or planned public notice; (e) Maintain all records that are used in making any determination about an individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to ensure fairness to the individual in the determination; (f) Except for disclosures made under FOIA, make reasonable efforts, prior to disseminating any record about an individual, to ensure that the record is accurate, relevant, timely, and complete; (g) When required by the Privacy Act, maintain an accounting in the specified form of all disclosures of records by FHFA or FHFA-OIG to persons, organizations, or Federal agencies; (h) Maintain and use records with care to prevent the unauthorized or inadvertent disclosure of a record to anyone; and (i) Notify the appropriate official of any record that contains information that the Privacy Act does not permit FHFA or FHFA-OIG to maintain. § 1204.11 May FHFA-OIG obtain Privacy Act records from other Federal agencies for law enforcement purposes? (a) The FHFA Inspector General is authorized under the Inspector General Act of 1978, as amended, to make written requests under 5 U.S.C. 552a(b)(7) for transfer of records maintained by other Federal agencies which are necessary to carry out an authorized law enforcement activity under the Inspector General Act of 1978, as amended. (b) The FHFA Inspector General delegates the authority under paragraph (a) of this section to the following FHFA-OIG officials— (1) Principal Deputy Inspector General; (2) Deputy Inspector General for Audits; (3) Deputy Inspector General for Investigations; (4) Deputy Inspector General for Evaluations; and (5) Deputy Inspector General for Administration. (c) The officials listed in paragraph (b) of this section may not further delegate or re-delegate the authority described in paragraph (a) of this section.