PART 1901—PUBLIC RIGHTS UNDER THE PRIVACY ACT OF 1974 Authority: National Security Act of 1947, as amended; Central Intelligence Agency Act of 1949, as amended; Privacy Act, as amended; and Executive Order 12958 (or successor Orders). Source: 62 FR 32488, June 16, 1997, unless otherwise noted. General § 1901.01 Authority and purpose. (a) Authority. (b) Purpose in general. (1) To request notification of whether the Central Intelligence Agency maintains a record concerning them in any non-exempt portion of a system of records or any non-exempt system of records; (2) To request a copy of all non-exempt records or portions of records; (3) To request that any such record be amended or augmented; and (4) To file an administrative appeal to any initial adverse determination to deny access to or amend a record. (c) Other purposes. § 1901.02 Definitions. For purposes of this part, the following terms have the meanings indicated: (a) Agency CIA (b) Days (c) Control (d) Coordinator (e) Federal agency (f) Interested party (g) Maintain (h) Originator (i) Privacy Act PA (j) Record (k) Requester individual (l) Responsive record (m) Routine use (n) System of records § 1901.03 Contact for general information and requests. For general information on this part, to inquire about the Privacy Act program at CIA, or to file a Privacy Act request, please direct your communication in writing to the Information and Privacy Coordinator, Central Intelligence Agency, Washington, DC. 20505. Requests with the required identification statement pursuant to 32 CFR 1901.13 must be filed in original form by mail. Subsequent communications and any inquiries will be accepted by mail or facsimile at (703) 613-3007 or by telephone at (703) 613-1287. Collect calls cannot be accepted. § 1901.04 Suggestions and complaints. The Agency welcomes suggestions or complaints with regard to its administration of the Privacy Act. Many requesters will receive pre-paid, customer satisfaction survey cards. Letters of suggestion or complaint should identify the specific purpose and the issues for consideration. The Agency will respond to all substantive communications and take such actions as determined feasible and appropriate. Filing of Privacy Act Requests § 1901.11 Preliminary information. Members of the public shall address all communications to the contact specified at § 1901.03 and clearly delineate the communication as a request under the Privacy Act and this regulation. Requests and administrative appeals on requests, referrals, and coordinations received from members of the public who owe outstanding fees for information services at this or other federal agencies will not be accepted and action on existing requests and appeals will be terminated in such circumstances. § 1901.12 Requirements as to form. (a) In general. (b) For access. Federal Register. (c) For amendment. § 1901.13 Requirements as to identification of requester. (a) In general. (b) Requirement for aliens. (c) Requirement for representatives. (d) Procedure otherwise. § 1901.14 Fees. No fees will be charged for any action under the authority of the Privacy Act, 5 U.S.C. 552a, irrespective of the fact that a request is or may be processed under the authority of both the Privacy Act and the Freedom of Information Act. Action on Privacy Act Requests § 1901.21 Processing requests for access to or amendment of records. (a) In general. (b) Receipt, recording and tasking. (c) Effect of certain exemptions. (d) Time for response. § 1901.22 Action and determination(s) by originator(s) or any interested party. (a) Initial action for access. (1) Determine whether responsive records exist; (2) Determine whether access must be denied in whole or part and on what legal basis under both Acts in each such case; (3) Approve the disclosure of records for which they are the originator; and (4) Forward to the Coordinator all records approved for release or necessary for coordination with or referral to another originator or interested party as well as the specific determinations with respect to denials (if any). (b) Initial action for amendment. (1) Make the amendment as requested; (2) Write to all other identified persons or agencies to whom the record has been disclosed (if an accounting of the disclosure was made) and inform of the amendment; and (3) Inform the Coordinator of such decisions. (c) Action otherwise on amendment request. (1) Set forth the reasons for refusal; and (2) Inform the Coordinator of such decision and the reasons therefore. (d) Referrals and coordinations. (e) Effect of certain exemptions. § 1901.23 Notification of decision and right of appeal. Within ten (10) days of receipt of responses to all initial taskings and subsequent coordinations (if any), and dispatch of referrals (if any), the Agency will provide disclosable records to the requester. If a determination has been made not to provide access to requested records (in light of specific exemptions) or that no records are found, the Agency shall so inform the requester, identify the denying official, and advise of the right to administrative appeal. Additional Administrative Matters § 1901.31 Special procedures for medical and psychological records. (a) In general. (1) Which records may be sent directly to the requester and (2) Which records should not be sent directly to the requester because of possible medical or psychological harm to the requester or another person. (b) Procedure for records to be sent to physician. (1) To review the documents with the requesting individual, (2) To explain the meaning of the documents, and (3) To offer counseling designed to temper any adverse reaction, the Agency will forward such records to the designated physician. (c) Procedure if physician option not available. § 1901.32 Requests for expedited processing. (a) All requests will be handled in the order received on a strictly “first-in, first-out” basis. Exceptions to this rule will only be made in circumstances that the Agency deems to be exceptional. In making this determination, the Agency shall consider and must decide in the affirmative on all of the following factors: (1) That there is a genuine need for the records; and (2) That the personal need is exceptional; and (3) That there are no alternative forums for the records sought; and (4) That it is reasonably believed that substantive records relevant to the stated needs may exist and be deemed releasable. (b) In sum, requests shall be considered for expedited processing only when health, humanitarian, or due process considerations involving possible deprivation of life or liberty create circumstances of exceptional urgency and extraordinary need. In accordance with established judicial precedent, requests more properly the scope of requests under the Federal Rules of Civil or Criminal Procedure (or equivalent state rules) will not be granted expedited processing under this or related (e.g., Freedom of Information Act) provisions unless expressly ordered by a federal court of competent jurisdiction. § 1901.33 Allocation of resources; agreed extensions of time. (a) In general. (1) The totality of resources available to the component, (2) The business demands imposed on the component by the Director of Central Intelligence or otherwise by law, (3) The information review and release demands imposed by the Congress or other governmental authority, and (4) The rights of all members of the public under the various information review and disclosure laws. (b) Discharge of Privacy Act responsibilities. (c) Requests for extension of time. Action on Privacy Act Administrative Appeals § 1901.41 Establishment of appeals structure. (a) In general. (b) Historical Records Policy Board (“HRPB” or “Board”). (1) Membership. (2) Authorities and activities. (c) Agency Release Panel (“ARP” or “Panel”). (1) Membership. (2) Authorities and activities. § 1901.42 Right of appeal and appeal procedures. (a) Right of Appeal. (b) Requirements as to time and form. (c) Exceptions. (d) Receipt, recording, and tasking. § 1901.43 Determination(s) by Deputy Director(s). Each Deputy Director in charge of a directorate which originated or has an interest in any of the records subject to the appeal, or designee, is a required party to any appeal; other interested parties may become involved through the request of the Coordinator when it is determined that some or all of the information is also within their official cognizance. These parties shall respond in writing to the Coordinator with a finding as to the exempt or non-exempt status of the information including citations to the applicable exemption and/or their agreement or disagreement as to the requested amendment and the reasons therefore. Each response shall be provided expeditiously on a “first-in, first-out” basis taking into account the business requirements of the parties and consistent with the information rights of members of the general public under the various information review and release laws. § 1901.44 Action by appeals authority. (a) Preparation of docket. (b) Decision by the Agency Release Panel. (c) Decision by the Historical Records Policy Board. § 1901.45 Notification of decision and right of judicial review. (a) In general. (b) For amendment requests. Prohibitions § 1901.51 Limitations on disclosure. No record which is within a system of records shall be disclosed by any means of communication to any individual or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless disclosure of the record would be: (a) To those officers and employees of this Agency which maintains the record who have a need for the record in the performance of their duties; (b) Required under the Freedom of Information Act, 5 U.S.C. 552; (c) For a routine use as defined in § 1901.02(m), as contained in the Privacy Act Issuances Compilation which is published biennially in the Federal Register, (d) To the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of U.S.C. Title 13; (e) To a recipient who has provided the Agency with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable; (f) To the National Archives and Records Administration as a record which has sufficient historical or other value to warrant its continued preservation by the United States Government, or for evaluation by the Archivist of the United States or designee to determine whether the record has such value; (g) To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of that agency or instrumentality has made a written request to the CIA specifying the particular information desired and the law enforcement activity for which the record is sought; (h) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if upon such disclosure notification is transmitted to the last known address of such individual; (i) To either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee; (j) To the Comptroller General or any of his authorized representatives in the course of the performance of the duties of the General Accounting Office; or (k) To any agency, government instrumentality, or other person or entity pursuant to the order of a court of competent jurisdiction of the United States or constituent states. § 1901.52 Criminal penalties. (a) Unauthorized disclosure. (b) Unauthorized maintenance. (c) Unauthorized requests. Exemptions § 1901.61 Purpose and authority. Purpose of exemptions. (a) The purpose of the following specified general exemption of polygraph records is to prevent access and review of records which intimately reveal CIA operational methods. The purpose of the general exemption from the provisions of sections (c)(3) and (e)(3) (A)-(D) of the Privacy Act is to avoid disclosures that may adversely affect ongoing operational relationships with other intelligence and related organizations and thus reveal or jeopardize intelligence sources and methods or risk exposure of intelligence sources and methods in the processing of covert employment applications. (b) The purpose of the general exemption from sections (d), (e)(4)(G), (f)(1), and (g) of the Privacy Act is to protect only those portions of systems of records which if revealed would risk exposure of intelligence sources and methods or hamper the ability of the CIA to effectively use information received from other agencies or foreign governments. (c) It should be noted that by subjecting information which would consist of, reveal, or pertain to intelligence sources and methods to separate determinations by the Director of Central Intelligence under the provision entitled “General exemptions,” (d) The purpose of the general exemption for records that consist of, pertain to, or would otherwise reveal the identities of employees who provide information to the Office of the Inspector General is to implement section 17 of the CIA Act of 1949, as amended, 50 U.S.C. 403q(e)(3), and to ensure that no action constituting a reprisal or threat of reprisal is taken because an employee has cooperated with the Office of Inspector General. (e) The purpose of the specific exemptions provided for under section (k) of the Privacy Act is to exempt only those portions of systems of records which would consist of, reveal, or pertain to that information which is enumerated in that section of the Act. (f) In each case, the Director of Central Intelligence currently or then in office has determined that the enumerated classes of information should be exempt in order to comply with dealing with the proper classification of national defense or foreign policy information; protect the identification of persons who provide information to the CIA Inspector General; protect the privacy of other persons who supplied information under an implied or express grant of confidentiality in the case of law enforcement or employment and security suitability investigations (or promotion material in the case of the armed services); protect information used in connection with protective services under 18 U.S.C. 3056; protect the efficacy of testing materials; and protect information which is required by statute to be maintained and used solely as statistical records. § 1901.62 General exemptions. (a) Pursuant to authority granted in section (j) of the Privacy Act, the Director of Central Intelligence has determined to exempt from all sections of the Act—except sections 552a(b); (c) (1) and (2); (e) (1), (4) (A)-(F), (5), (6), (7), (9), (10), and (11); and (i)—the following systems of records or portions of records in a system of record: (1) Polygraph records. (2) [Reserved] (b) Pursuant to authority granted in section (j) of the Privacy Act, the Director of Central Intelligence has determined to exempt from sections (c)(3) and (e)(3) (A)-(D) of the Act all systems of records maintained by this Agency. (c) Pursuant to authority granted in section (j) of the Privacy Act, the Director of Central Intelligence has determined to exempt from notification under sections (e)(4)(G) and (f)(1) those portions of each and all systems of records which have been exempted from individual access under section (j) in those cases where the Coordinator determines after advice by the responsible components that confirmation of the existence of a record may jeopardize intelligence sources and methods. In such cases the Agency must neither confirm nor deny the existence of the record and will advise a requester that there is no record which is available pursuant to the Privacy Act of 1974. (d) Pursuant to authority granted in section (j) of the Privacy Act, the Director of Central Intelligence has determined to exempt from access by individuals under section (d) of the Act those portions and only those portions of all systems of records maintained by the CIA that: (1) Consist of, pertain to, or would otherwise reveal intelligence sources and methods; (2) Consist of documents or information provided by any foreign government entity, international organization, or, any United States federal, state, or other public agency or authority; and (3) Consist of information which would reveal the identification of persons who provide information to the CIA Inspector General. (e) Pursuant to authority granted in section (j) of the Privacy Act, the Director of Central Intelligence has determined to exempt from judicial review under section (g) of the Act all determinations to deny access under section (d) of the Act and all decisions to deny notice under sections (e)(4)(G) and (f)(1) of the Act pursuant to determination made under paragraph (c) of this section when it has been determined by an appropriate official of the CIA that such access would disclose information which would: (1) Consist of, pertain to, or otherwise reveal intelligence sources and methods; (2) Consist of documents or information provided by any foreign government entity, international organization, or, any United States federal, state, or other public agency or authority; and (3) Consist of information which would reveal the identification of persons who provide information to the CIA Inspector General. § 1901.63 Specific exemptions. Pursuant to authority granted in section (k) of the Privacy Act, the Director of Central Intelligence has determined to exempt from section (d) of the Privacy Act those portions and only those portions of all systems of records maintained by the CIA that would consist of, pertain to, or otherwise reveal information that is: (a) Classified pursuant to Executive Order 12958 (or successor or prior Order) and thus subject to the provisions of 5 U.S.C. 552(b)(1) and 5 U.S.C. 552a(k)(1); (b) Investigatory in nature and compiled for law enforcement purposes, other than material within the scope of section (j)(2) of the Act; provided however, that if an individual is denied any right, privilege, or benefit to which they are otherwise eligible, as a result of the maintenance of such material, then such material shall be provided to that individual except to the extent that the disclosure would reveal the identity of a source who furnished the information to the United States Government under an express promise of confidentiality, or, prior to the effective date of this section, under an implied promise of confidentiality; (c) Maintained in connection with providing protective services to the President of the United States or other individuals pursuant to 18 U.S.C. 3056; (d) Required by statute to be maintained and used solely as statistical records; (e) Investigatory in nature and compiled solely for the purpose of determining suitability, eligibility, or qualifications for federal civilian employment, military service, federal contracts, or access to classified information, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the United States Government under an express promise of confidentiality, or, prior to the effective date of this section, under an implied promise of confidentiality; (f) Testing or examination material used solely to determine individual qualifications for appointment or promotion in the federal service the disclosure of which would compromise the objectivity or fairness of the testing or examination process; or (g) Evaluation material used to determine potential for promotion in the armed services, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the United States Government under an express promise of confidentiality, or, prior to the effective date of this section, under an implied promise of confidentiality.