PART 1008—REQUESTS UNDER THE PRIVACY ACT Authority: Pub. L. 104-333, 110 Stat. 4097 (16 U.S.C. 460bb note); 5 U.S.C. 552a. Source: 63 FR 71779, Dec. 30, 1998, unless otherwise noted. § 1008.1 Purpose and scope. This part contains the regulations of the Presidio Trust implementing section 3 of the Privacy Act. Sections 1008.3 through 1008.10 describe the procedures and policies of the Presidio Trust concerning maintenance of records which are subject to the Privacy Act. Sections 1008.11 through 1008.17 describe the procedure under which individuals may determine whether systems of records subject to the Privacy Act contain records relating to them and the procedure under which they may seek access to existing records. Sections 1008.18 through 1008.24 describe the procedure under which individuals may petition for amendment of records subject to the Privacy Act relating to them. § 1008.2 Definitions. The following terms have the following meanings as used in this part: Individual Maintain Privacy Act Privacy Act Officer Record (1) System of records (2) Medical records (3) Personnel records (4) Statistical records Routine use System manager System notice Federal Register [63 FR 71779, Dec. 30, 1998, as amended at 83 FR 50834, Oct. 10, 2018] § 1008.3 Records subject to the Privacy Act. The Privacy Act applies to all records which the Presidio Trust maintains in a system of records. § 1008.4 Standards for maintenance of records subject to the Privacy Act. (a) Content of records. (b) Standards of accuracy. (c) Collection of information. (2) In deciding whether collection of information from an individual, as opposed to a third party source, is practicable, the following factors, among others, may be considered: (i) Whether the nature of the information sought is such that it can only be obtained from a third party; (ii) Whether the cost of collecting the information from the individual is unreasonable when compared with the cost of collecting it from a third party; (iii) Whether there is a risk that information collected from third parties, if inaccurate, could result in an adverse determination to the individual concerned; (iv) Whether the information, if supplied by the individual, would have to be verified by a third party; or (v) Whether provisions can be made for verification, by the individual, of information collected from third parties. (d) Advice to individuals concerning uses of information. (2) At a minimum, the notice to the individual must state: (i) The authority (whether granted by statute or Executive Order of the President) which authorizes the solicitation of the information and whether disclosure of such information is mandatory or voluntary; (ii) The principal purpose or purposes for which the information is intended to be used; (iii) The routine uses which may be made of the information; and (iv) The effects on the individual, if any, of not providing all or any part of the requested information. (3)(i) When information is collected on a standard form, the notice to the individual shall be provided on the form, on a tear-off sheet attached to the form, or on a separate sheet, whichever is most practical. (ii) When information is collected by an interviewer, the interviewer shall provide the individual with a written notice which the individual may retain. If the interview is conducted by telephone, however, the interviewer may summarize the notice for the individual and need not provide a copy to the individual unless the individual requests a copy. (iii) An individual may be asked to acknowledge, in writing, that the notice required by this section has been provided. (e) Records concerning activity protected by the First Amendment. (1) Expressly authorized by statute or by the individual about whom the record is maintained; or (2) Pertinent to and within the scope of an authorized law enforcement activity. § 1008.5 Federal Register notices describing systems of records. The Privacy Act requires publication of a notice in the Federal Register § 1008.6 Assuring integrity of records. (a) Statutory requirement. (b) Records security. § 1008.7 Conduct of employees. (a) Handling of records subject to the Privacy Act. (b) Disclosure of records. (c) Alteration of records. (1) Properly undertaken in the course of the employee's regular duties; or (2) Required by a decision under §§ 1008.18 through 1008.23 or the decision of a court of competent jurisdiction. § 1008.8 Government contracts. (a) Required contract provisions. (b) System manager. § 1008.9 Disclosure of records. (a) Prohibition of disclosure. (b) General exceptions. (1) To those officers or employees of the Presidio Trust who have a need for the record in the performance of their duties; or (2) Required by the Freedom of Information Act, 5 U.S.C. 552. (c) Specific exceptions. (1) For a routine use which has been described in a system notice published in the Federal Register (2) To the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of Title 13, U.S. Code; (3) To a recipient who has provided the system manager responsible for the system in which the record is maintained with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable; (4) To the National Archives and Records Administration as a record which has sufficient historical or other value to warrant its continued preservation by the U.S. Government, or for evaluation by the Archivist of the United States or the designee of the Archivist to determine whether the record has such value; (5) To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the Presidio Trust specifying the particular portion desired and the law enforcement activity for which the record is sought; (6) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if upon such disclosure notification is transmitted to the last known address of such individual; (7) To either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee; (8) To the Comptroller General, or any of his authorized representatives, in the course of the performance of the duties of the General Accounting Office; (9) Pursuant to the order of a court of competent jurisdiction; or (10) To a consumer reporting agency in accordance with section 3(d) of the Federal Claims Collection Act of 1966, as amended (31 U.S.C. 3711(e)). (d) Reviewing records prior to disclosure. (2) When a record is disclosed in connection with a Freedom of Information Act request made under this part and it is appropriate and administratively feasible to do so, the requester shall be informed of any information known to the Presidio Trust indicating that the record may not be fully accurate, complete, or timely. (e) Notice of court-ordered and emergency disclosures. Court-ordered disclosures. (2) Emergency disclosures. [83 FR 50835, Oct. 10, 2018] § 1008.10 Accounting for disclosures. (a) Maintenance of an accounting. (2) The accounting shall record: (i) The date, nature, and purpose of each disclosure of a record to any person or to another agency; and (ii) The name and address of the person or agency to whom the disclosure was made. (3) Accountings prepared under this section shall be maintained for at least five years or the life of the record, whichever is longer, after the disclosure for which the accounting is made. (b) Access to accountings. (2) An individual desiring access to an accounting of disclosures of a record pertaining to the individual shall submit a request by following the procedures of § 1008.13. (c) Notification of disclosure. [83 FR 50835, Oct. 10, 2018] § 1008.11 Request for notification of existence of records: Submission. (a) Submission of requests. (2) Individuals desiring to determine whether records pertaining to them are maintained in two or more systems shall make a separate inquiry concerning each system. (b) Form of request. (2) To expedite processing, both the envelope containing a request and the face of the request should bear the legend “PRIVACY ACT INQUIRY.” (3) The request shall state that the individual is seeking information concerning records pertaining to him or herself and shall supply such additional identifying information, if any, as is called for in the system notice describing the system. (4) The request must include verification of the requester's identity, including the requester's full name, current address, and date and place of birth. The request must be signed by the requester, and the signature must be notarized or submitted under 28 U.S.C. 1746, which permits statements to be made under penalty of perjury as a substitute for notarization. (5) If the request is made on behalf of a minor or someone determined by a court to be incompetent, for access to records about that individual, the requester must establish: (i) The identity of the individual who is the subject of the record, by stating the name, current address, date and place of birth, and, at the requester's option, the Social Security number of the individual; (ii) The requester's identity, as required in paragraph 4 above of this section; (iii) That the requester is the parent or guardian of that individual, which the requester may prove by providing a copy of the individual's birth certificate showing the requester's parentage or by providing a court order establishing the requester's guardianship; and (iv) That the requester is acting on behalf of that individual in making the request. (6) Individuals who have reason to believe that information pertaining to them may be filed under a name other than the name they are currently using ( e.g., [83 FR 50835, Oct. 10, 2018] § 1008.12 Requests for notification of existence of records: Action on. (a) Decisions on request. (i) The records were compiled in reasonable anticipation of a civil action or proceeding; or (ii) The system of records is one which has been excepted from the notification provisions of the Privacy Act by rulemaking. (2) If the records were compiled in reasonable anticipation of a civil action or proceeding or the system of records is one which has been excepted from the notification provisions of the Privacy Act by rulemaking, the individuals will be promptly notified that they are not entitled to notification of whether the system contains records pertaining to them. (b) Authority to deny requests. (c) Form of decision. (2) A decision declining to inform an individual whether or not a system of records contains records pertaining to him or her shall be in writing and shall: (i) State the basis for denial of the request; (ii) Advise the individual that an appeal of the declination may be made to the Executive Director pursuant to § 1008.16 by writing to the Executive Director, The Presidio Trust, P.O. Box 29052, San Francisco, CA 94129-0052; and (iii) State that the appeal must be received by the foregoing official within 20 working days of the date of the decision. (3) If the decision declining a request for notification of the existence of records involves records which fall under the jurisdiction of another agency, the individual shall be informed in a written response which shall: (i) State the reasons for the denial; (ii) Include the name, position title, and address of the official responsible for the denial; and (iii) Advise the individual that an appeal of the declination may be made only to the appropriate official of the relevant agency, and include that official's name, position title, and address. (4) Copies of decisions declining a request for notification of the existence of records made pursuant to paragraphs (c)(2) and (c)(3) of this section shall be provided to the Privacy Act Officer. § 1008.13 Requests for access to records. The Privacy Act permits individuals, upon request, to gain access to their records or to any information pertaining to them which is contained in a system and to review the records and have a copy made of all or any portion thereof in a form comprehensive to them. 5 U.S.C. 552a(d)(1). A request for access shall be submitted in accordance with the procedures in this part. § 1008.14 Requests for access to records: Submission. (a) Submission of requests. (2) Individuals desiring access to records maintained in two or more separate systems shall submit a separate request for access to the records in each system. (b) Form of request. (2) To expedite processing, both the envelope containing a request and the face of the request should bear the legend “PRIVACY ACT REQUEST FOR ACCESS.” (3) Requesters shall specify whether they seek all of the records contained in the system which relate to them or only some portion thereof. If only a portion of the records which relate to the individual are sought, the request shall reasonably describe the specific record or records sought. (4) If the requester seeks to have copies of the requested records made, the request shall state the maximum amount of copying fees which the requester is willing to pay. A request which does not state the amount of fees the requester is willing to pay will be treated as a request to inspect the requested records. Requesters are further notified that under § 1008.15(d) the failure to state willingness to pay fees as high as are anticipated by the Presidio Trust will delay processing of a request. (5) The request shall supply such identifying information, if any, as is called for in the system notice describing the system. (6) The request must include verification of the requester's identity, including the requester's full name, current address, and date and place of birth. The request must be signed by the requester, and the signature must be notarized or submitted under 28 U.S.C. 1746, which permits statements to be made under penalty of perjury as a substitute for notarization. (7) If the request is made on behalf of a minor or someone determined by a court to be incompetent, for access to records about that individual, the requester must establish: (i) The identity of the individual who is the subject of the record, by stating the name, current address, date and place of birth, and, at the requester's option, the Social Security number of the individual; (ii) The requester's identity, as required in paragraph 6 above of this section; (iii) That the requester is the parent or guardian of that individual, which the requester may prove by providing a copy of the individual's birth certificate showing the requester's parentage or by providing a court order establishing the requester's guardianship; and (iv) That the requester is acting on behalf of that individual in making the request. (8) Requests failing to meet the requirements of this paragraph shall be returned to the requester with a written notice advising the requester of the deficiency in the request. [83 FR 50836, Oct. 10, 2018] § 1008.15 Requests for access to records: Initial decision. (a) Acknowledgements of requests. (b) Decisions on requests. (1) Was compiled in reasonable anticipation of a civil action or proceeding; or (2) Is contained in a system of records which has been excepted from the access provisions of the Privacy Act by rulemaking. (c) Authority to deny requests. (d) Form of decision. (2) A decision denying a request for access, in whole or part, shall be in writing and shall: (i) State the basis for denial of the request; (ii) Contain a statement that the denial may be appealed to the Executive Director pursuant to § 1008.16 by writing to the Executive Director, The Presidio Trust, P.O. Box 29052, San Francisco, CA 94129-0052; and (iii) State that the appeal must be received by the foregoing official within 20 working days of the date of the decision. (3) If the decision denying a request for access involves records which fall under the jurisdiction of another agency, the individual shall be informed in a written response which shall: (i) State the reasons for the denial; (ii) Include the name, position title, and address of the official responsible for the denial; and (iii) Advise the individual that an appeal of the declination may be made only to the appropriate official of the relevant agency, and include that official's name, position title, and address. (4) Copies of decisions denying requests for access made pursuant to paragraphs (d)(2) and (d)(3) of this section will be provided to the Privacy Act Officer. (e) Fees. (2) Unless the Privacy Act Officer determines that reduction or waiver of fees is appropriate, fees for copying a record in response to a request made under § 1008.14 shall be charged in accordance with the provisions of this section and the current schedule of charges determined by the Executive Director and published on the Trust's website. Such charges shall be set at the level necessary to recoup the full allowable direct costs to the Trust. (3) Where it is anticipated that fees chargeable in connection with a request will exceed the amount the person submitting the request has indicated a willingness to pay, the Privacy Act Officer shall notify the requester and shall not complete processing of the request until the requester has agreed, in writing, to pay fees as high as are anticipated. [83 FR 50836, Oct. 10, 2018] § 1008.16 Requests for notification of existence of records and for access to records: Appeals. (a) Right of appeal. (b) Time for appeal. (2) The Executive Director may, for good cause shown, extend the time for submission of an appeal if a written request for additional time is received within 20 working days of the date of the initial decision on the request. (c) Form of appeal. (2) The appeal shall contain a brief statement of the reasons why the appellant believes the decision on the initial request to have been in error. (3) The appeal shall be addressed to the Executive Director, The Presidio Trust, P.O. Box 29052, San Francisco, CA 94129-0052. (d) Action on appeals. (2) The decision on an appeal shall be in writing and shall state the basis for the decision. § 1008.17 Requests for access to records: Special situations. (a) Medical records. (2) If it is determined that disclosure of medical records directly to the individual to whom they pertain could have an adverse effect on that individual, the individual may designate a medical doctor to receive the records and the records will be disclosed to that doctor. (b) Inspection in presence of third party. (2) When such a procedure is deemed appropriate, individuals to whom the records pertain may be required to furnish a written statement authorizing discussion of their records in the accompanying person's presence. § 1008.18 Amendment of records. The Privacy Act permits individuals to request amendment of records pertaining to them contained in a system of records if they believe the records are not accurate, relevant, timely or complete. 5 U.S.C. 552a(d)(2). A request for amendment of a record shall be submitted in accordance with the procedures in this part. [83 FR 50837, Oct. 10, 2018] § 1008.19 Petitions for amendment: Submission and form. (a) Submission of petitions for amendment. (2) A petition for amendment of a record may be submitted only if the individual submitting the petition has previously requested and been granted access to the record and has inspected or been given a copy of the record. (b) Form of petition. (2) To expedite processing, both the envelope containing a petition and the face of the petition should bear the legend “PRIVACY ACT PETITION FOR AMENDMENT.” (3) The petition shall state, in detail, the reasons why the petitioner believes the record, or the objectionable portion thereof, is not accurate, relevant, timely or complete. Copies of documents or evidence relied upon in support of these reasons shall be submitted with the petition. (4) The petition shall state, specifically and in detail, the changes sought in the record. If the changes involve rewriting the record or portions thereof or involve adding new language to the record, the petition shall propose specific language to implement the changes. (5) The petition must include verification of the petitioner's identity, including the petitioner's full name, current address, and date and place of birth. The petition must be signed by the petitioner, and the signature must be notarized or submitted under 28 U.S.C. 1746, which permits statements to be made under penalty of perjury as a substitute for notarization. (6) If the petition is made on behalf of a minor or someone determined by a court to be incompetent, for access to records about that individual, the petitioner must establish: (i) The identity of the individual who is the subject of the record, by stating the name, current address, date and place of birth, and, at the petitioner's option, the Social Security number of the individual; (ii) The petitioner's identity, as required in paragraph 5 above of this section; (iii) That the petitioner is the parent or guardian of that individual, which the petitioner may prove by providing a copy of the individual's birth certificate showing the petitioner's parentage or by providing a court order establishing the petitioner's guardianship; and (iv) That the petitioner is acting on behalf of that individual in making the request. (7) Petitions failing to meet the requirements of this paragraph shall be returned to the petitioner with a written notice advising the petitioner of the deficiency in the petition. [83 FR 50837, Oct. 10, 2018] § 1008.20 Petitions for amendment: Processing and initial decision. (a) Decisions on petitions. (b) Authority to decide. (c) Acknowledgment of receipt. (d) Inadequate petitions. (2) If the petitioner fails to submit the additional information within a reasonable time, the petition may be rejected. The rejection shall be in writing and shall meet the requirements of paragraph (e) of this section. (e) Form of decision. (2) If the petition for amendment is rejected, in whole or part, the petitioner shall be informed in a written response which shall: (i) State concisely the basis for the decision; (ii) Advise the petitioner that the rejection may be appealed to the Executive Director, The Presidio Trust, P.O. Box 29052, San Francisco, CA 94129-0052; and (iii) State that the appeal must be received by the foregoing official within 20 working days of the decision. (3) If the petition for amendment involves records which fall under the jurisdiction of another agency and is rejected, in whole or part, the petitioner shall be informed in a written response which shall: (i) State concisely the basis for the decision; (ii) Include the name, position title, and address of the official responsible for the denial; and (iii) Advise the individual that an appeal of the rejection may be made only to the appropriate official of the relevant agency, and include that official's name, position title, and address. (4) Copies of rejections of petitions for amendment made pursuant to paragraphs (e)(2) and (e)(3) of this section will be provided to the Privacy Act Officer. (f) Implementation of initial decision. (1) Correct the record accordingly and, (2) Where an accounting of disclosures has been made pursuant to § 1008.10, advise all previous recipients of the record that the correction was made and the substance of the correction. § 1008.21 Petitions for amendment: Time limits for processing. (a) Acknowledgment of receipt. (b) Decision on petition. (c) Suspension of time limit. (d) Extensions of time. (i) A decision on the petition requires analysis of voluminous record or records; (ii) Some or all of the challenged records must be collected from facilities other than the facility at which the Privacy Act Officer is located; or (iii) Some or all of the challenged records are of concern to another agency of the Federal Government whose assistance and views are being sought in processing the request. (2) If the official responsible for making a decision on the petition determines that an extension is necessary, the official shall promptly inform the petitioner of the extension and the date on which a decision is expected to be dispatched. § 1008.22 Petitions for amendment: Appeals. (a) Right of appeal. (b) Time for appeal. (2) The Executive Director may, for good cause shown, extend the time for submission of an appeal if a written request for additional time is received within 20 working days of the date of the decision on a petition. (c) Form of appeal. (2) The appeal shall contain a brief statement of the reasons why the appellant believes the decision on the petition to have been in error. (3) The appeal shall be addressed to the Executive Director, The Presidio Trust, P.O. Box 29052, San Francisco, CA 94129-0052. § 1008.23 Petitions for amendment: Action on appeals. (a) Authority. (b) Time limit. (2) The 30 working day period for decision on an appeal may be extended, for good cause shown, by the Executive Director. If the 30 working day period is extended, the individual submitting the appeal shall be notified of the extension and of the date on which a determination on the appeal is expected to be dispatched. (c) Form of decision. (2) If the determination upholds, in whole or part, the initial decision rejecting the petition for amendment, the determination shall also advise the individual submitting the appeal: (i) Of his or her right to file a concise statement of the reasons for disagreeing with the decision of the Presidio Trust; (ii) Of the procedure established by § 1008.24 for the filing of the statement of disagreement; (iii) That the statement which is filed will be made available to anyone to whom the record is subsequently disclosed together with, at the discretion of the Presidio Trust, a brief statement by the Presidio Trust summarizing its reasons for refusing to amend the record; (iv) That prior recipients of the challenged record will be provided a copy of any statement of dispute to the extent that an accounting of disclosure was maintained; and (v) Of his or her right to seek judicial review of the Presidio Trust's refusal to amend the record. (3) If the determination reverses, in whole or in part, the initial decision rejecting the petition for amendment, the system manager responsible for the system containing the challenged record shall be directed to: (i) Amend the challenged record accordingly; and (ii) If an accounting of disclosures has been made, advise all previous recipients of the record of the amendment and its substance. § 1008.24 Statements of disagreement. (a) Filing of statement. (b) Disclosure of statements. (c) Maintenance of statements.