PART 515—PRIVACY ACT PROCEDURES Authority: 5 U.S.C. 552a Source: 82 FR 8141, Jan. 24, 2017, unless otherwise noted. § 515.1 Purpose and scope. This part contains the regulations the National Indian Gaming Commission (Commission) follows in implementing the Privacy Act of 1974. These regulations should be read together with the Privacy Act, which provides additional information about records maintained on individuals. The regulations in this part apply to all records contained within systems of records maintained by the Commission that are retrieved by an individual's name or personal identifier. They describe the procedures by which individuals may request access to records about themselves, request amendment or correction of those records, and request an accounting of disclosures of those records by the Commission. The Commission shall also process all Privacy Act requests for access to records under the Freedom of Information Act (FOIA), 5 U.S.C. 552, and the Commission's FOIA regulations contained in 25 CFR part 517, which gives requesters maximum disclosure. § 515.2 Definitions. For the purposes of this subpart: (a) Individual (b) Maintain (c) Record (d) System of records (e) Routine use (f) Working day § 515.3 Request for access to records. (a) How made and addressed. [email protected]. (b) Description of records sought. (c) Agreement to pay fees. (d) Verification of identity. (e) Verification of guardianship. (1) The identity of the individual who is the subject of the record by stating the name, current address, date and place of birth, and, at the requester's option, the social security number of the individual; (2) The requester's own identity, as required in paragraph (d) of this section; (3) That the requester is the parent or guardian of the individual and proof of such relationship by providing a birth certificate showing parentage or a court order establishing guardianship; and (4) That the requester is acting on behalf of that individual in making the request. (f) Verification in the case of third party information requests. (g) In-person disclosures. [82 FR 8141, Jan. 24, 2017, as amended at 82 FR 34403, July 25, 2017] § 515.4 Responsibility for responding to requests. (a) In general. (b) Authority to grant or deny requests. (c) Consultations and referrals. (1) Respond to the request regarding that record, after consulting with the agency best able to determine whether to disclose it and with any other agency that has a substantial interest in it; or (2) Refer the responsibility for responding to the request regarding that record to the agency best able to determine whether to disclose it, or to another agency that originated the record. Ordinarily, the agency that originated a record will be presumed to be best able to determine whether to disclose it. (d) Notice of referral. § 515.5 Responses to requests for access to records. (a) Acknowledgement of requests. (b) Grants of requests for access. (c) Adverse determinations of requests for access. (1) The name and title of the person responsible for the denial; (2) A brief statement of the reason(s) for the denial, including any Privacy Act exemption(s) applied to the denial; (3) A statement that the denial may be appealed under § 515.7 and a description of the requirements of § 515.7. § 515.6 Request for amendment or correction of records. (a) How made and addressed. (b) Privacy Act Officer response. (1) The reason(s) for the denial; and (2) The procedure for appeal of the denial under paragraph (c) of this section. (c) Appeals. (d) Statements of Disagreement. (e) Notification of amendment, correction, or disagreement. (f) Records not subject to amendment. § 515.7 Appeals of initial adverse agency determination. (a) Adverse determination. (b) Appeals. (c) Responses to appeals. (d) When appeal is required. [82 FR 8141, Jan. 24, 2017, as amended at 82 FR 34403, July 25, 2017] § 515.8 Requests for an accounting of record disclosure. (a) How made and addressed. (b) Where accountings are not required. (1) Disclosures for which accountings are not required to be kept, such as those that are made to employees of the Commission who have a need for the record in the performance of their duties and disclosures that are made under section 552 of title 5; (2) Disclosures made to law enforcement agencies for authorized law enforcement activities in response to written requests from those law enforcement agencies specifying the law enforcement activities for which the disclosures are sought; or (3) Disclosures made from law enforcement systems of records that have been exempted from accounting requirements. (c) Appeals. (d) Preservation of accountings. § 515.9 Notice of court-ordered and emergency disclosures. (a) Court-ordered disclosures. (b) Emergency disclosures. § 515.10 Fees. The Commission shall charge fees for duplication of records under the Privacy Act in the same way in which it charges duplication fees under § 517.9 of this chapter. No search or review fee may be charged for any record. Additionally, when the Privacy Act Officer makes a copy of a record as a necessary part of reviewing the record or granting access to the record, the Commission shall not charge for the cost of making that copy. Otherwise, the Commission may charge a fee sufficient to cover the cost of duplicating a record. [82 FR 8141, Jan. 24, 2017, as amended at 82 FR 34403, July 25, 2017] § 515.11 Penalties. Any person who makes a false statement in connection with any request for access to a record, or an amendment thereto, under this part, is subject to the penalties prescribed in 18 U.S.C. 494 and 495. § 515.12 [Reserved] § 515.13 Specific exemptions. (a) The following systems of records are exempt from 5 U.S.C. 552a(c)(3), (d), (e)(1) and (f): (1) Indian Gaming Individuals Records System. (2) Management Contract Individuals Record System. (b) The exemptions under paragraph (a) of this section apply only to the extent that information in these systems is subject to exemption under 5 U.S.C. 552a(k)(2). When compliance would not appear to interfere with or adversely affect the overall responsibilities of the Commission, with respect to licensing of key employees and primary management officials for employment in an Indian gaming operation or verifying the suitability of an individual who has a financial interest in, or management responsibility for a management contract, the applicable exemption may be waived by the Commission. (c) Exemptions from the particular sections are justified for the following reasons: (1) From 5 U.S.C. 552a(c)(3), because making available the accounting of disclosures to an individual who is the subject of a record could reveal investigative interest. This would permit the individual to take measures to destroy evidence, intimidate potential witnesses, or flee the area to avoid the investigation. (2) From 5 U.S.C. 552a(d), (e)(1), and (f) concerning individual access to records, when such access could compromise classified information related to national security, interfere with a pending investigation or internal inquiry, constitute an unwarranted invasion of privacy, reveal a sensitive investigative technique, or pose a potential threat to the Commission or its employees or to law enforcement personnel. Additionally, access could reveal the identity of a source who provided information under an express promise of confidentiality. (3) From 5 U.S.C. 552a(d)(2), because to require the Commission to amend information thought to be incorrect, irrelevant, or untimely, because of the nature of the information collected and the length of time it is maintained, would create an impossible administrative and investigative burden by continually forcing the Commission to resolve questions of accuracy, relevance, timeliness, and completeness. (4) From 5 U.S.C. 552a(e)(1) because: (i) It is not always possible to determine relevance or necessity of specific information in the early stages of an investigation. (ii) Relevance and necessity are matters of judgment and timing in that what appears relevant and necessary when collected may be deemed unnecessary later. Only after information is assessed can its relevance and necessity be established. (iii) In any investigation the Commission may receive information concerning violations of law under the jurisdiction of another agency. In the interest of effective law enforcement and under 25 U.S.C. 2716(b), the information could be relevant to an investigation by the Commission. (iv) In the interviewing of individuals or obtaining evidence in other ways during an investigation, the Commission could obtain information that may or may not appear relevant at any given time; however, the information could be relevant to another investigation by the Commission.