PART 102—RECORD DISCLOSURE AND PRIVACY Authority: 5 U.S.C. 301, 552, 552a; 31 U.S.C. 3717, 9701; 44 U.S.C. 3501. Source: 61 FR 2673, Jan. 29, 1996, unless otherwise noted. Subpart A—Disclosure of Information Source: 82 FR 46371, Oct. 5, 2017, unless otherwise noted. § 102.1 General provisions. (a) This subpart contains the rules that SBA follows in processing requests for records under the Freedom of Information Act (“FOIA”), 5 U.S.C. 552. The rules in this subpart should be read in conjunction with the text of the FOIA and the Uniform Freedom of Information Fee Schedule and Guidelines published by the Office of Management and Budget (“OMB Guidelines”). Requests made by individuals for records about themselves under the Privacy Act of 1974, 5 U.S.C. 552a, are processed under subpart B of this part as well as under this subpart. (b) As referenced in this subpart, “component” means each separate bureau, office, division, district office, regional office, area office, service center, loan processing center or central office duty location within the SBA that is responsible for processing FOIA requests. See appendix A to this subpart for a list of information generally exempt from disclosure. For contact information for each office visit https://www.sba.gov/foia https://www.sba.gov/about-sba. (c) The SBA has a decentralized system for processing requests, with each component handling requests for its records. (d) The term record means: (1) Any information that would be an agency record subject to the requirements of this section when maintained by SBA in any format, including written or electronic format; and (2) Any information described under paragraph (d)(1) of this section that is maintained for SBA by an entity under Government contract, for purposes of records management. § 102.2 Proactive disclosure of records. Records that are required by the FOIA to be made available for public inspection in an electronic format may be accessed through the SBA's Web site at https://www.sba.gov/foia. https://www.sba.gov/foia. § 102.3 Requirements pertaining to the submission of requests. (a) General information. [email protected]. https://foiaonline.regulations.gov/foia/action/public/home. https://www.sba.gov/foia. (2) A requester who is making a request for records about himself or herself must comply with the verification of identity provision set forth in subpart B of this part. The Certification of Identity form, available at http://www.justice.gov/oip/forms/cert_ind.pdf, (3) Where a request for records pertains to another individual, a requester may receive greater access by submitting either a notarized authorization signed by that individual or a declaration made in compliance with the requirements set forth in 28 U.S.C. 1746 by that individual authorizing disclosure of the records to the requester, or by submitting proof that the individual is deceased (e.g., a copy of a death certificate or an obituary). As an exercise of administrative discretion, each component can require a requester to supply additional information if necessary in order to verify that a particular individual has consented to disclosure. (b) Description of records sought. (c) Form or format. (d) Contact information. § 102.4 Responsibility for responding to requests. (a) In general. (b) Authority to grant or deny requests. (c) Re-routing of misdirected requests. (d) Consultation, referral, and coordination. (1) Consultation. (2) Referral. (ii) Whenever a component refers any part of the responsibility for responding to a request to another component or agency, it shall document the referral, maintain a copy of the record that it refers, and notify the requester of the referral and inform the requester of the name(s) of the component or agency to which the record was referred, including that component's or agency's FOIA Contact information. (3) Coordination. (e) Classified information. (f) Agreements regarding consultations and referrals. (g) Timing of responses to consultations and referrals. § 102.5 Timing of responses to requests. (a) In general. (b) Multitrack processing. (c) Unusual circumstances. (d) Aggregating requests. (e) Expedited processing. (i) Circumstances in which the lack of expedited processing could reasonably be expected to pose an imminent threat to the life or physical safety of an individual; (ii) An urgency to inform the public about an actual or alleged Federal Government activity, if made by a person who is primarily engaged in disseminating information. (iii) The loss of substantial due process rights; or (iv) A matter of widespread and exceptional media interest in which there exist possible questions about the government's integrity that affect public confidence. (2) A request for expedited processing may be made at any time. Requests based on paragraphs (e)(1)(i) through (iii) of this section must be submitted to the component that maintains the records requested. When making a request for expedited processing of an administrative appeal, the request should be submitted to the FOI/PA Office. Requests for expedited processing that are based on paragraph (e)(1)(iv) of this section must be submitted to the component processing the request. A component that receives a misdirected request for expedited processing under the standard set forth in paragraph (e)(1)(iv) of this section shall forward it immediately to the FOI/PA Office for its determination. The time period for making the determination on the request for expedited processing under paragraph (e)(1)(iv) of this section shall commence on the date that the FOI/PA Office receives the request, provided that it is routed within 10 working days. (3) A requester who seeks expedited processing must submit a notarized statement, such as an affidavit or declaration, certified to be true and correct, explaining in detail the basis for making the request for expedited processing. For example, under paragraph (e)(1)(ii) of this section, a requester who is not a full-time member of the news media must establish that the requester is a person whose primary professional activity or occupation is information dissemination, though it need not be the requester's sole occupation. Such a requester also must establish a particular urgency to inform the public about the government activity involved in the request—one that extends beyond the public's right to know about government activity generally. The existence of numerous articles published on a given subject can be helpful in establishing the requirement that there be an “urgency to inform” the public on the topic. As a matter of administrative discretion, the SBA may waive the formal certification requirement. (4) A component shall notify the requester within 10 working days of the receipt of a request for expedited processing of its decision whether to grant or deny expedited processing. If expedited processing is granted, the request must be given priority, placed in the processing track for expedited requests, and must be processed as soon as practicable. If a request for expedited processing is denied, any appeal of that decision shall be acted on expeditiously. § 102.6 Responses to requests. (a) In general. (b) Acknowledgments of requests. (c) Estimated dates of completion and interim responses. (d) Grants of requests. (e) Adverse determinations of requests. (1) The requested record is exempt, in whole or in part; (2) The request does not reasonably describe the records sought; (3) The information requested is not a record subject to the FOIA; (4) The requested record does not exist, cannot be located, or has been destroyed; or (5) The requested record is not readily reproducible in the form or format sought by the requester. (f) Content of denial. (1) The name and title or position of the person responsible for the denial; (2) A brief statement of the reasons for the denial, including any FOIA exemption applied by the component in denying the request; (3) An estimate of the volume of any records or information withheld, such as the number of pages or some other reasonable form of estimation, although such an estimate is not required if the volume is otherwise indicated by deletions marked on records that are disclosed in part or if providing an estimate would harm an interest protected by an applicable exemption; (4) A statement that the denial may be appealed under § 102.9, and a description of the appeal requirements; and (5) A statement notifying the requester of the assistance available from the component's FOIA Public Liaison or designee, and the dispute resolution services offered by OGIS. (g) Markings on released documents. § 102.7 Confidential commercial information. (a) Definitions. Confidential commercial information Submitter (b) Designation of confidential commercial information. (c) When notice to submitters is required. (i) The requested information has been designated in good faith by the submitter as information considered protected from disclosure under Exemption 4; or (ii) The component has a reason to believe that the requested information may be protected from disclosure under Exemption 4, but has not yet determined whether the information is protected from disclosure under that exemption or any other applicable exemption. (2) The notice shall either describe the commercial information requested or include a copy of the requested records or portions of records containing the information. In cases involving a voluminous number of submitters, notice may be made by posting or publishing the notice in a place or manner reasonably likely to accomplish it. (d) Exceptions to submitter notice requirements. (1) The component determines that the information is exempt under the FOIA; (2) The information has been lawfully published or has been officially made available to the public; (3) Disclosure of the information is required by a statute other than the FOIA or by a regulation issued in accordance with the requirements of Executive Order 12600 of June 23, 1987; or (4) The designation made by the submitter under paragraph (b) of this section appears obviously frivolous, except that, in such a case, the component shall give the submitter written notice of any final decision to disclose the information and must provide that notice within a reasonable number of days prior to a specified disclosure date. (e) Opportunity to object to disclosure. (2) A submitter who fails to respond within the time period specified in the notice shall be considered to have no objection to disclosure of the information. Information received by the component after the date of any disclosure decision shall not be considered by the component. Any information provided by a submitter under this subpart may itself be subject to disclosure under the FOIA. (f) Analysis of objections. (g) Notice of intent to disclose. (1) A statement of the reasons why each of the submitter's disclosure objections was not sustained; (2) A description of the information to be disclosed; and (3) A specified disclosure date, which shall be a reasonable time subsequent to the notice. § 102.8 Fees. (a) In general. (b) Categories of requesters. (1) Commercial use requesters; (2) Non-commercial scientific/educational institutions requesters; (3) News media requesters, and; (4) All other requesters. (c) Definitions. (1) Commercial use request (2) Direct costs i.e., (3) Duplication (4) Educational institution Example 1 to paragraph (c)(4). A request from a professor of geology at a university for records relating to soil erosion, written on letterhead of the Department of Geology, would be presumed to be from an educational institution. Example 2 to paragraph (c)(4). A request from the same professor of geology seeking drug information from the Food and Drug Administration in furtherance of a murder mystery he is writing would not be presumed to be an institutional request, regardless of whether it was written on institutional stationery. Example 3 to paragraph (c)(4). A student, who makes a request in furtherance of their coursework or other school-sponsored activities and provides a copy of a course syllabus or other reasonable documentation to indicate the research purpose for the request, would qualify as part of this fee category. (5) Noncommercial scientific institution (6) Representative of the news media (7) Review (8) Search (d) Charging fees. (1) Search. (ii) For each hour spent by personnel searching for requested records, including electronic searches that do not require new programming, the fees will be charged as follows: Professional (GS 9-14)—$46; and managerial (GS 15 and above)—$83. (iii) Requesters shall be charged the direct costs associated with conducting any search that requires the creation of a new computer program to locate the requested records. Requesters shall be notified of the costs associated with creating such a program and must agree to pay the associated costs before the costs may be incurred. (iv) For requests that require the retrieval of records stored by SBA at a Federal Records Center operated by the National Archives and Records Administration (NARA), additional costs shall be charged in accordance with the Transactional Billing Rate Schedule established by NARA. (2) Duplication. (3) Review. i.e., (ii) The following table summarizes the fees for each type of requester. Table 1 to § 102.8—Summary of Fees Requester category Search Review Duplication fees Direct costs Commercial Use Yes Yes Yes Yes. Educational/Noncommercial Scientific Institutions No No Yes (first 100 pages, or equivalent volume free) No. News Media No No Yes (first 100 pages, or equivalent volume free) No. All Others Yes (first 2 hours free) No Yes (first 100 pages, or equivalent volume free) Yes. (e) Restrictions on charging fees. (i) If a component fails to comply with the time limits in which to respond to a request, it may not charge search fees, or, in the instances of requests from requesters described in paragraph (c)(1) of this section, may not charge duplication fees, except as described in paragraphs (d)(1)(ii) through (iv) of this section. (ii) If a component has determined that unusual circumstances as defined by the FOIA apply and SBA provided timely written notice to the requester in accordance with the FOIA, a failure to comply with the time limit shall be excused for an additional 10 working days. (iii) If a component has determined that unusual circumstances, as defined by the FOIA, apply and more than 5,000 pages are necessary to respond to the request, the component may charge search fees, or, in the case of requesters described in paragraph (c)(1) of this section, may charge duplication fees, if the following steps are taken. The component shall provide a timely written notice of unusual circumstances to the requester in accordance with the FOIA and SBA must have discussed with the requester via written mail, email, or telephone (or made not less than three good-faith attempts to do so) how the requester could effectively limit the scope of the request in accordance with 5 U.S.C. 552(a)(6)(B)(ii). If this exception is satisfied, the component may charge all applicable fees incurred in the processing of the request. (iv) If a court has determined that exceptional circumstances exist, as defined by the FOIA, a failure to comply with the time limits shall be excused for the length of time provided by the court order. (2) No search or review fees will be charged for a quarter-hour period unless more than half of that period is required for search or review. (3) Except for requesters seeking records for a commercial use, components shall provide without charge: (i) The first 100 pages of duplication (or the cost equivalent for other media); and (ii) The first two hours of search. (4) No fee will be charged when the total fee, after deducting the 100 free pages (or its cost equivalent) and the first two hours of search, is equal to or less than $46.00. (f) Notice of anticipated fees in excess of $46.00. (2) In cases in which a requester has been notified that the actual or estimated fees are in excess of $46.00, the request shall not be considered received and further work will not be completed until the requester commits in writing to pay the actual or estimated total fee, or designates some amount of fees the requester is willing to pay, or in the case of a noncommercial use requester who has not yet been provided with the requester's statutory entitlements, designates that the requester seeks only that which can be provided by the statutory entitlements. The requester must provide the commitment or designation in writing, and must, when applicable, designate an exact dollar amount the requester is willing to pay. Components are not required to accept payments in installments. (3) If the requester has indicated a willingness to pay some designated amount of fees, but the component estimates that the total fee will exceed that amount, the component will toll the processing of the request when it notifies the requester of the estimated fees in excess of the amount the requester has indicated a willingness to pay. The component shall inquire whether the requester wishes to revise the amount of fees the requester is willing to pay or modify the request. Once the requester responds, the time to respond will resume from where it was at the date of the notification. (4) Components shall make available their FOIA Public Liaison or other designee to assist any requester in reformulating a request to meet the requester's needs at a lower cost. (g) Charges for other services. (h) Charging interest. (i) Aggregating requests. (j) Advance payments. i.e., (2) When a component determines or estimates that a total fee to be charged under this section will exceed $250.00, it may require that the requester make an advance payment up to the amount of the entire anticipated fee before beginning to process the request. Components may elect to process the request prior to collecting fees when it receives a satisfactory assurance of full payment from a requester with a history of prompt payment. (3) Where a requester has previously failed to pay a properly charged FOIA fee to any component or SBA within 30 working days of the billing date, a component may require that the requester pay the full amount due, plus any applicable interest on that prior request, and the component may require that the requester make an advance payment of the full amount of any anticipated fee before SBA begins to process a new request or continues to process a pending request or any pending appeal. When a component has a reasonable basis to believe that a requester has misrepresented the requester's identity in order to avoid paying outstanding fees, it may require that the requester provide proof of identity. (4) In cases in which advanced payment is required, the request will not be considered received and further work will not be completed until the required payment is received. If the requester does not pay the advance payment within 30 working days after the date of the fee determination, the request will be closed. (k) Other statutes specifically providing for fees. (l) Requirements for waiver or reduction of fees. (i) Disclosure of the requested information is in the public interest because it is likely to contribute significantly to public understanding of the operations or activities of the government, and (ii) Disclosure of the information is not primarily in the commercial interest of the requester. (2) Components shall furnish records responsive to a request without charge or at a reduced rate when it determines, based on all available information, that the factors described in paragraphs (l)(2)(i) through (iii) of this section are satisfied: (i) Disclosure of the requested information would shed light on the operations or activities of the government. The subject of the request must concern identifiable operations or activities of the Federal Government with a connection that is direct and clear, not remote or attenuated. (ii) Disclosure of the requested information is likely to contribute significantly to public understanding of those operations or activities. This factor is satisfied when the following criteria are met: (A) Disclosure of the requested records must be meaningfully informative about government operations or activities. The disclosure of information that already is in the public domain, in either the same or a substantially identical form, would not be meaningfully informative if nothing new would be added to the public's understanding. (B) The disclosure must contribute to the understanding of a reasonably broad audience of persons interested in the subject, as opposed to the individual understanding of the requester. A requester's expertise in the subject area as well as the requester's ability and intention to effectively convey information to the public must be considered. Components shall presume that a representative of the news media will satisfy this consideration. (iii) The disclosure must not be primarily in the commercial interest of the requester. To determine whether disclosure of the requested information is primarily in the commercial interest of the requester, the following criteria will be considered: (A) Identify whether the requester has any commercial interest that would be furthered by the requested disclosure. A commercial interest includes any commercial, trade, or profit interest. Requesters must be given an opportunity to provide explanatory information regarding this consideration. (B) If there is an identified commercial interest, a determination will be made whether the primary interest is furthered by the request. A waiver or reduction of fees is justified when the requirements of paragraphs (l)(2)(i) and (ii) of this section are satisfied and any commercial interest is not the primary interest furthered by the request. Ordinarily there will be a presumption, that when a news media requester has satisfied factors (l)(2)(i) and (ii) of this section, the request is not primarily in the commercial interest of the requester. Disclosure to data brokers or others who merely compile and market government information for direct economic return will not be presumed to primarily serve the public interest. (3) Where only some of the records to be released satisfy the requirements for a waiver of fees, a waiver must be granted for those records. (4) Requests for a waiver or reduction of fees should be made when the request is first submitted and should address the criteria referenced above. A requester may submit a fee waiver request at a later time so long as the underlying record request is pending or on administrative appeal. When a requester who has committed to pay fees subsequently asks for a waiver of those fees and that waiver is denied, the requester must pay any costs incurred up to the date the fee waiver request was received. § 102.9 Administrative appeals. (a) Requirements for making an appeal. (b) Adjudication of appeals. (2) An appeal ordinarily will not be adjudicated if the request becomes a matter of FOIA litigation. (3) On receipt of any appeal involving classified information, the FOI/PA Office shall take appropriate action to ensure compliance with Executive Orders 13467 and 13526. (c) Decisions on appeals. (d) Time limit for issuing appeal decision. The statutory time limit for responding to appeals is generally 20 working days after receipt. However, the Appeals Officer may extend the time limit for responding to an appeal provided the circumstances set forth in 5 U.S.C. 552(a)(6)(B)(i) are met. (e) Engaging in dispute resolution services provided by OGIS. (f) When an appeal is required. § 102.10 Preservation of records. Each component shall preserve all correspondence pertaining to the requests that it receives under this subpart, as well as copies of all requested records, until disposition or destruction is authorized pursuant to title 44 of the United States Code or the General Records Schedule 14 of the National Archives and Records Administration. Records shall not be disposed of or destroyed while they are the subject of a pending request, appeal, or lawsuit under the FOIA. § 102.11 Subpoenas. (a) The person to whom the subpoena is directed must consult with SBA counsel in the relevant SBA office, who will seek approval for compliance from the Associate General Counsel for Litigation. Except where the subpoena requires the testimony of an employee of the Inspector General's office, or records within the possession of the Inspector General, the Associate General Counsel may delegate the authorization for appropriate production of documents or testimony to local SBA counsel. (b) If SBA counsel approves compliance with the subpoena, SBA will comply. (c) If SBA counsel disapproves compliance with the subpoena, SBA will not comply, and will base such noncompliance on an appropriate legal basis such as privilege or a statute. (d) SBA counsel must provide a copy of any subpoena relating to a criminal matter to SBA's Inspector General prior to its return date. Appendix A to Subpart A of Part 102—Records Maintained by SBA I. Information Generally Exempt From Disclosure a. Non-statistical information on pending, declined, withdrawn, or canceled applications. b. Non-statistical information on defaults, delinquencies, losses etc. c. Loan status, other than charged-off or paid-in-full. d. Home disaster loan status and interest rate. e. Financial statements, credit reports, business plans, plant lay-outs, marketing strategy, advertising plans, fiscal projections, pricing information, payroll information, private sector experience and contracts, IRS forms, purchase information, banking information, corporate structure, research plans and client list of applicant/recipient. f. Portions of: Certificate of Competency records, Requests for Size Determinations, 8(a) Business Development Plans, loan applications, SBIC applications, loan officer's reports. g. Internal documents not incorporated into final Agency action, pending internal recommendations on applications for assistance, SBA/attorney-client communications, pending litigation documents and investigatory documents. Discretionary disclosure policy must be utilized. h. Personal history and financial statements, tax forms, resumes, all non-government career experience, communications regarding applicant's character, home addresses and telephone numbers, social security numbers, birth dates and medical records. Portions of Inspector General (IG) reports, audit reports, program investigation records and any other records which, if released, would interfere with the Government's law enforcement proceedings and/or would reveal the identity of a confidential source and documents relating to pending litigation and investigations. Requests for IG documents must be referred to the Office of the Inspector General, Counsel Division. i. Financial information on portfolio companies. j. Information originating from other agencies should be referred to those agencies for disclosure determinations. II. Information Generally Disclosed a. Names and business addresses of recipients of approved loans, SBIC licenses, Certificates of Competency, lease guarantees, surety bond guarantees and requests for counseling. b. Names of officers, directors, stockholders or partners of recipient firms. c. Kinds and amounts of loans, loan terms, interest rates (except on home disaster loans), maturity dates, general purpose, etc. d. Statistical data on assistance, loans, defaults, contracts, counseling, etc. e. Decisions, rulings and records showing final Agency actions in specific factual situations if identifying details exempt from disclosure are first deleted. f. Awarded contracts: names, amounts, dates, contracting agencies. g. Identity of participating banks. h. List of 8(a) participants, date of entry, FPPT dates and NAICS codes. i. OHA opinions and decisions. j. Names of SBA employees, grades, titles, and duty stations. Subpart B—Protection of Privacy and Access to Individual Records Under the Privacy Act of 1974 Source: 72 FR 17369, Apr. 9, 2007, unless otherwise noted. § 102.20 General provisions. (a) Purpose and scope. (b) Definitions. (1) Agency (2) Employee (3) Individual (4) Maintain (5) Record (6) System of records (7) Statistical record (8) Routine use (9) Request for access (10) Request for amendment or correction (11) Request for an accounting (12) Requester (13) Authority to request records for a law enforcement purpose § 102.21 Agency employees responsible for the Privacy Act of 1974. (a) Program/Support Office Head (b) Privacy Act Systems Manager (c) Senior Agency Official for Privacy (d) Chief, Freedom of Information/Privacy Acts (FOI/PA) Office § 102.22 Requirements relating to systems of records. (a) In general. (1) Maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the Agency required to be accomplished by a statute or by Executive Order of the President; (2) Collect information to the greatest extent practicable directly from the subject individual when the information may affect an individual's rights, benefits, and privileges under Federal programs; (b) Requests for information from individuals. (1) The authority (whether granted by statute, or by Executive Order of the President) which authorizes the solicitation of the information and whether disclosure of such information is mandatory or voluntary; (2) The principal purpose or purposes for which the information is intended to be used; (3) The routine uses which may be made of the information; and (4) The effects on such individual, if any, of not providing all or any part of the requested information. (c) Report on new systems. (d) Accurate and secure maintenance of records. (1) Maintain all records which are used in making any determination about any individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the determination; (2) Prior to disseminating any record from a system of records about an individual to any requestor, including an agency, make reasonable efforts to assure that such records are accurate, complete, timely, and relevant for SBA purposes; and (3) Establish appropriate administrative, technical, and physical safeguards to insure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity which could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained. (i) PASMs, with the approval of the head of their offices, shall establish administrative and physical controls, consistent with SBA regulations, to insure the protection of records systems from unauthorized access or disclosure and from physical damage or destruction. The controls instituted shall be proportional to the degree of sensitivity of the records but at a minimum must ensure that records other than those available to the general public under the FOIA, are protected from public view, that the area in which the records are stored is supervised during all business hours and physically secured during non-business hours to prevent unauthorized personnel from obtaining access to the records. (ii) PASMs, with the approval of the head of their offices, shall adopt access restrictions to insure that only those individuals within the agency who have a need to have access to the records for the performance of their duties have access to them. Procedures shall also be adopted to prevent accidental access to, or dissemination of, records. (e) Prohibition against maintenance of records concerning First Amendment rights. (1) Expressly authorized by statute, or (2) Expressly authorized by the individual about whom the record is maintained, or (3) Pertinent to and within the scope of an authorized law enforcement activity. § 102.23 Publication in the Federal Register—Notices of systems of records. (a) Notices of systems of records to be published in the Federal Register. Federal Register (i) The name and location of the system; (ii) The categories of individuals on who records are maintained in the system; (iii) The categories of records maintained in the system; (iv) Each routine use of the records contained in the system, including the categories of users and the purpose of such use; (v) The policies and practices of the office regarding storage, retrievability, access controls, retention, and disposal of the records; (vi) The title and business address of the SBA official who is responsible for the system of records; (vii) A statement that SBA procedures allow an individual, at his or her request, to determine whether a system of records contains a record pertaining to him or her, to review such records and to contest or amend such records, located in sections 102.25 through 102.29 of these regulations. (viii) A statement that such requests may be directed to the SBA's FOI/PA Office, 409 3rd St., SW., Washington, DC 20416 or faxed to 202-205-7059; and (ix) The categories of sources of records in the system. (2) Minor changes to systems of records shall be published annually. (b) Notice of new or modified routine uses to be published in the Federal Register. Federal Register § 102.24 Requests for access to records. (a) How made and addressed. (b) Description of records sought. Federal Register http://www.sba.gov/foia/systemrecords.doc. (c) Verification of identity. (1) If executed outside the United States: “I declare (or certify, verify, or state) under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on (date). Signature”; or (2) If executed within the Untied States, its territories, possessions or commonwealths: “I declare (or certify, verify, or state) under penalty of perjury that the foregoing is true and correct. Executed on (date). Signature”. (d) Verification of guardianship. (1) The identity of the individual who is the subject of the record, by stating the name, current address, date and place of birth, and, at the requester's option, the social security number of the individual; (2) The requester's own identity, as required in paragraph (c) of this section; (3) That the requester is the legal agent or parent or guardian of that individual, which may be proven by providing a copy of the individual's birth certificate showing his parentage or by providing a court order establishing guardianship; and (4) That the requester is acting on behalf of that individual in making the request. § 102.25 Responsibility for responding to requests for access to records. (a) In general. (b) Authority to grant or deny requests. (c) Consultations and referrals. (1) Respond to the request regarding that record, after consulting with the office or agency best able to determine whether the record is exempt from access and with any other office or agency that has a substantial interest in it; or (2) Refer the responsibility for responding to the request to the office best able to determine whether the record is exempt from access or to another agency that originated the record (but only if that agency is subject to the Privacy Act). Ordinarily the office or agency that originated a record will be presumed to be best able to determine whether it is exempt from access. (d) Law enforcement information. (e) Classified information. (f) Notice of referral. (g) Responses to consultations and referrals. (h) Agreements regarding consultations and referrals. § 102.26 Responses to requests for access to records. (a) Acknowledgements of requests. (b) Grants of requests for access. (c) Adverse determinations of requests for access. (1) The name and title or position of the person responsible for the denial; (2) A brief statement of the reason(s) for the denial, including any FOIA or Privacy Act exemption(s) applied in denying the request; and (3) A statement that the denial may be appealed under § 102.27(a) and a description of the requirements of § 102.27(a). § 102.27 Appeals from denials of requests for access to records. (a) Appeals. (b) Responses to appeals. (c) Judicial review. § 102.28 Requests for amendment or correction of records. (a) How made and addressed. (b) Office responses. (1) The reason(s) for the denial; and (2) The procedure for appeal of the denial under paragraph (c) of this section, including the name and business address of the official who will act on your appeal. (c) Appeals. (d) Statement of Disagreement. (e) Notification of amendment/correction or disagreement. (f) Records not subject to amendment or correction. (1) Transcripts of testimony given under oath or written statements made under oath; (2) Transcripts of grand jury proceedings, judicial proceedings, or quasi-judicial proceedings, which are the official record of those proceedings; (3) Pre-sentence records that originated with the courts; and (4) Records in systems of records that have been exempted from amendment and correction under Privacy Act, 5 U.S.C. 552a (j) or ( k Federal Register. § 102.29 Requests for an accounting of record disclosures. (a) How made and addressed. (b) Where accountings are not required. (1) Disclosures for which accountings are not required to be kept; disclosures that are made to employees within the SBA and disclosures that are made under the FOIA; (2) Disclosures made to law enforcement agencies for authorized law enforcement activities in response to written requests from those law enforcement agencies specifying the civil or criminal law enforcement activities for which the disclosures are sought; or (3) Disclosures made from law enforcement systems of records that have been exempted from accounting requirements under Privacy Act, 5 U.S.C. 552a(j) or (k) by notice published in the Federal Register. (c) Appeals. § 102.30 Preservation of records. Each office will preserve all correspondence pertaining to the requests that it receives under this subpart, as well as copies of all requested records, until disposition or destruction is authorized by title 44 of the United States Code or the National Archives and Records Administration's General Records Schedule 14. Records will not be disposed of while they are the subject of a pending request, appeal, or lawsuit under the Privacy Act. § 102.31 Fees. SBA offices shall charge fees for duplication of records under the Privacy Act in the same way in which they charge duplication fees under § 102.6(b)(3). No search or review fee may be charged for any record unless the record has been exempted from access under Exemptions (j)(2) or (k)(2) of the Privacy Act. SBA will waive fees under $25.00. § 102.32 Notice of court-ordered and emergency disclosures. (a) Court-ordered disclosures. (b) Emergency disclosures. § 102.33 Security of systems of records. (a) Each Program/Support Office Head or designee shall establish administrative and physical controls to prevent unauthorized access to its systems of records, to prevent unauthorized disclosure of records, and to prevent physical damage to or destruction of records. The stringency of these controls shall correspond to the sensitivity of the records that the controls protect. At a minimum, each office's administrative and physical controls shall ensure that: (1) Records are protected from public view; (2) The area in which records are kept is supervised during business hours to prevent unauthorized persons from having access to them; (3) Records are inaccessible to unauthorized persons outside of business hours; and (4) Records are not disclosed to unauthorized persons or under unauthorized circumstances in either oral or written form. (b) Each Program/Support Office Head or designee shall establish procedures that restrict access to records to only those individuals within the SBA who must have access to those records in order to perform their duties and that prevent inadvertent disclosure of records. (c) The OCIO shall provide SBA offices with guidance and assistance for privacy and security of electronic systems and compliance with pertinent laws and requirements. § 102.34 Contracts for the operation of record systems. When SBA contracts for the operation or maintenance of a system of records or a portion of a system of records by a contractor, the record system or the portion of the record affected, are considered to be maintained by the SBA, and subject to this subpart. The SBA is responsible for applying the requirements of this subpart to the contractor. The contractor and its employees are to be considered employees of the SBA for purposes of the sanction provisions of the Privacy Act during performance of the contract. § 102.35 Use and collection of Social Security Numbers. Each Program/Support Office Head or designee shall ensure that collection and use of SSN is performed only when the functionality of the system is dependant on use of the SSN as an identifier. Employees authorized to collect information must be aware: (a) That individuals may not be denied any right, benefit, or privilege as a result of refusing to provide their social security numbers, unless: (1) The collection is authorized either by a statute; or (2) The social security numbers are required under statute or regulation adopted prior to 1975 to verify the identity of an individual; and (b) That individuals requested to provide their social security numbers must be informed of: (1) Whether providing social security numbers is mandatory or voluntary; (2) Any statutory or regulatory authority that authorizes the collection of social security numbers; and (3) The uses that will be made of the numbers. § 102.36 Privacy Act standards of conduct. Each Program/Support Office Head or designee shall inform its employees of the provisions of the Privacy Act, including its civil liability and criminal penalty provisions. Unless otherwise permitted by law, an employee of the SBA shall: (a) Collect from individuals only the information that is relevant and necessary to discharge the responsibilities of the SBA; (b) Collect information about an individual directly from that individual whenever practicable; (c) Inform each individual from whom information is collected of: (1) The legal authority to collect the information and whether providing it is mandatory or voluntary; (2) The principal purpose for which the SBA intends to use the information; (3) The routine uses the SBA may make of the information; and (4) The effects on the individual, if any, of not providing the information; (d) Ensure that the office maintains no system of records without public notice and that it notifies appropriate SBA officials of the existence or development of any system of records that is not the subject of a current or planned public notice; (e) Maintain all records that are used by the SBA in making any determination about an individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to ensure fairness to the individual in the determination; (f) Except as to disclosures made to an agency or made under the FOIA, make reasonable efforts, prior to disseminating any record about an individual, to ensure that the record is accurate, relevant, timely, and complete; (g) Maintain no record describing how an individual exercises his or her First Amendment rights, unless it is expressly authorized by statute or by the individual about whom the record is maintained, or is pertinent to and within the scope of an authorized law enforcement activity; (h) When required by the Privacy Act, maintain an accounting in the specified form of all disclosures of records by the SBA to persons, organizations, or agencies; (i) Maintain and use records with care to prevent the unauthorized or inadvertent disclosure of a record to anyone; and (j) Notify the appropriate SBA official of any record that contains information that the Privacy Act does not permit the SBA to maintain. § 102.37 Training requirements. All employees should attend privacy training within one year of employment with SBA. All employees with Privacy Act responsibilities must attend Privacy Act training, whenever needed, that is offered by the SBA. § 102.38 Other rights and services. Nothing in this subpart shall be construed to entitle any person, as a right, to any service or to the disclosure of any record to which such person is not entitled under the Privacy Act. § 102.39 SBA's exempt Privacy Act systems of records. (a) Systems of records subject to investigatory material exemption under 5 U.S.C. 552a(k)(2), or 5 U.S.C. 552a(k)(5) or both: (1) Office of Inspector General Records Other Than Investigation Records—SBA 4, contains records pertaining to audits, evaluations, and other non-audit services performed by the OIG; (2) Equal Employment Opportunity Complaint Cases—SBA 13, contains complaint files, Equal Employment Opportunity counselor's reports, investigation materials, notes, reports, and recommendations; (3) Investigative Files—SBA 16, contains records gathered by the OIG in the investigation of allegations that are within the jurisdiction of the OIG; (4) Investigations Division Management Information System—SBA 17, contains records gathered or created during preparation for, conduct of, and follow-up on investigations conducted by the OIG, the Federal Bureau of Investigation (FBI), and other Federal, State, local, or foreign regulatory or law enforcement agency; (5) Litigation and Claims Files—SBA 19, contains records relating to recipients classified as “in litigation” and all individuals involved in claims by or against the Agency; (6) Personnel Security Files—SBA 24, contains records on active and inactive personnel security files, employee or former employee's name, background information, personnel actions, OPM, and/or authorized contracting firm background investigations; (7) Security and Investigations Files—SBA 27, contains records gathered or created during preparation for, conduct of, and follow-up on investigations conducted by OIG, the FBI, and other Federal, State, local, or foreign regulatory or law enforcement agencies as well as other material submitted to or gathered by OIG in furtherance of its investigative function; and (8) Standards of Conduct Files—SBA 29, contains records on confidential employment and financial statements of employees Grade 13 and above. (b) These systems of records are exempt from the following provisions of the Privacy Act and all regulations in this part promulgated under these provisions: (1) 552a(c)(3) (Accounting of Certain Disclosures); (2) 552a(d) (Access to Records); (3) 552a(e)(1), 4G, H, and I (Agency Requirements); and (4) 552a(f) (Agency Rules). (c) The systems of records described in paragraph (a) of this section are exempt from the provisions of the Privacy Act described in paragraph (b) of this section in order to: (1) Prevent the subject of investigations from frustrating the investigatory process; (2) Protect investigatory material compiled for law enforcement purposes; (3) Fulfill commitments made to protect the confidentiality of sources and to maintain access to necessary sources of information; or (4) Prevent interference with law enforcement proceedings. (d) In addition to the foregoing exemptions in paragraphs (a) through (c) of this section, the systems of records described in paragraph (a) of this section numbered SBA 4, 16, 17, 24, and 27 are exempt from the Privacy Act except for subsections (b), (c)(1) and (2), (e)(4)(A) through F, (e)(6), (7), (9), (10) and (11) and (i) to the extent that they contain: (1) Information compiled to identify individual criminal offenders and alleged offenders and consisting only of identifying data and notations of arrests, confinement, release, and parole and probation status; (2) Information, including reports of informants and investigators, associated with an identifiable individual compiled to investigate criminal activity; or (3) Reports compiled at any stage of the process of enforcement of the criminal laws from arrest or indictment through release from supervision associated with an identifiable individual. (e) The systems of records described in paragraph (d) of this section are exempt from the Privacy Act to the extent described in that paragraph because they are records maintained by the Investigations Division of the OIG, which is a component of SBA which performs as its principal function activities pertaining to the enforcement of criminal laws within the meaning of 5 U.S.C. 552a(j)(2). They are exempt in order to: (1) Prevent the subjects of OIG investigations from using the Privacy Act to frustrate the investigative process; (2) Protect the identity of Federal employees who furnish a complaint or information to the OIG, consistent with section 7(b) of the Inspector General Act of 1978, 5 U.S.C. app. 3; (3) Protect the confidentiality of other sources of information; (4) Avoid endangering confidential sources and law enforcement personnel; (5) Prevent interference with law enforcement proceedings; (6) Assure access to sources of confidential information, including that contained in Federal, State, and local criminal law enforcement information systems; (7) Prevent the disclosure of investigative techniques; or (8) Prevent the disclosure of classified information. § 102.40 Computer matching. The OCIO will enforce the computer matching provisions of the Privacy Act. The FOI/PA Office will review and concur on all computer matching agreements prior to their activation and/or renewal. (a) Matching agreements. (1) The purpose and legal authority for conducting the program; (2) The justification for the purpose and the anticipated results, including a specific estimate of any savings; (3) A description of the records that will be matched, including each data element that will be used, the approximate number of records that will be matched, and the projected starting and completion dates of the matching program; (4) Procedures for providing individualized notice at the time of application, and periodically thereafter as directed by the Data Integrity Board, that any information provided by any of the above may be subject to verification through matching programs to: (i) Applicants for and recipients of financial assistance or payments under Federal benefit programs, and (ii) Applicants for and holders of positions as Federal personnel. (5) Procedures for verifying information produced in such matching program as required by paragraph (c) of this section. (6) Procedures for the retention and timely destruction of identifiable records created by a recipient agency or non-Federal agency in such matching program; (7) Procedures for ensuring the administrative, technical, and physical security of the records matched and the results of such programs; (8) Prohibitions on duplication and redisclosure of records provided by SBA within or outside the recipient agency or non-Federal agency, except where required by law or essential to the conduct of the matching program; (9) Procedures governing the use by a recipient agency or non-Federal agency of records provided in a matching program by SBA, including procedures governing return of the records to SBA or destruction of records used in such programs; (10) Information on assessments that have been made on the accuracy of the records that will be used in such matching programs; and (11) That the Comptroller General may have access to all records of a recipient agency or non-Federal agency that the Comptroller General deems necessary in order to monitor or verify compliance with the agreement. (b) Agreement specifications. (1) No such agreement shall be effective until 30 days after the date on which a copy is transmitted. (2) Such an agreement shall remain in effect only for such period, not to exceed 18 months, as the Data Integrity Board determines is appropriate in light of the purposes, and length of time necessary for the conduct, of the matching program. (3) Within three (3) months prior to the expiration of such an agreement, the Data Integrity Board may without additional review, renew the matching agreement for a current, ongoing matching program for not more than one additional year if: (i) Such program will be conducted without any change; and (ii) Each party to the agreement certifies to the Board in writing that the program has been conducted in compliance with the agreement. (c) Verification. (1) Independent verification requires independent investigation and confirmation of any information used as a basis for an adverse action against an individual including, where applicable: (i) The amount of the asset or income involved, (ii) Whether such individual actually has or had access to such asset or income or such individual's own use, and (iii) The period or periods when the individual actually had such asset or income. (2) SBA and any recipient agency or non-Federal agency may not suspend, terminate, reduce, or make a final denial of any financial assistance or payment under a Federal benefit program, or take other adverse action as a result of information produced by a matching program, (i) Unless such individual has received notice from such agency containing a statement of its findings and information of the opportunity to contest such findings, and (ii) Until the subsequent expiration of any notice period provided by the program's governing statute or regulations, or 30 days. Such opportunity to contest may be satisfied by notice, hearing, and appeal rights governing such Federal benefit program. The exercise of any such rights shall not affect rights available under the Privacy Act. (3) SBA may take any appropriate action otherwise prohibited by the above if SBA determines that the public health or safety may be adversely affected or significantly threatened during the notice period required by paragraph (c)(2)(ii) of this section. (d) Sanctions. (1) SBA shall not renew a matching agreement unless, (i) The recipient agency or non-Federal agency has certified that it has complied with the provisions of that agreement; and (ii) SBA has no reason to believe that the certification is inaccurate. (e) Review annually each ongoing matching program in which the Agency has participated during the year, either as a source or as a matching agency in order to assure that the requirements of the Privacy Act, OMB guidance, and any Agency regulations and standard operating procedures, operating instructions, or guidelines have been met. (f) Data Integrity Board. (1) Review, approve and maintain all written agreements for receipt or disclosure of Agency records for matching programs to ensure compliance with paragraph (a) of this section and with all relevant statutes, regulations, and guidance; (2) Review all matching programs in which SBA has participated during the year, determine compliance with applicable laws, regulations, guidelines, and Agency agreements, and assess the costs and benefits of such programs; (3) Review all recurring matching programs in which SBA has participated during the year, for continued justification for such disclosures; (4) At the instruction of OMB, compile a report to be submitted to the Administrator and OMB, and made available to the public on request, describing the matching activities of SBA, including, (i) Matching programs in which SBA has participated; (ii) Matching agreements proposed that were disapproved by the Board; (iii) Any changes in membership or structure of the Board in the preceding year; (iv) The reasons for any waiver of the requirement described below for completion and submission of a cost-benefit analysis prior to the approval of a matching program; (v) Any violations of matching agreements that have been alleged or identified and any corrective action taken; and (vi) Any other information required by OMB to be included in such report; (5) Serve as clearinghouse for receiving and providing information on the accuracy, completeness, and reliability of records used in matching programs; (6) Provide interpretation and guidance to SBA offices and personnel on the requirements for matching programs; (7) Review Agency recordkeeping and disposal policies and practices for matching programs to assure compliance with the Privacy Act; and (8) May review and report on any SBA matching activities that are not matching programs. (g) Cost-benefit analysis. (h) Disapproval of matching agreements. (1) OMB may approve a matching agreement despite the disapproval of the Data Integrity Board if OMB determines that: (i) The matching program will be consistent with all applicable legal, regulatory, and policy requirements; (ii) There is adequate evidence that the matching agreement will be cost-effective; and (iii) The matching program is in the public interest. (2) The decision of OMB to approve a matching agreement shall not take effect until 30 days after it is reported to the committees described in paragraph (h) of this section. (3) If the Data Integrity Board and the OMB disapprove a matching program proposed by the Inspector General, the Inspector General may report the disapproval to the Administrator and to the Congress. § 102.41 Other provisions. (a) Personnel records. (b) Mailing lists. (c) Changes in systems. (d) Medical records.