(a) Purpose. This subpart establishes policies, procedures, requirements, and responsibilities for administration of the Privacy Act of 1974, 5 U.S.C. 552a,at.

(b) Relationship to the Freedom of Information Act. The Privacy Act applies to records contained in a systems of records, as defined in § 404.15. If an individual submits a request for access to records and cites the Privacy Act, but the records sought are not contained in a Privacy Act system of records, then the request shall be processed only under subpart A of this part, Procedures for Disclosure of Records Under the Freedom of Information Act. All requests properly processed under this subpart B shall also be processed under subpart A of this part.

(c) Appellate authority. The Ex-Im Bank Assistant General Counsel for Administration is the appellate authority for all Privacy Act requests.

(d) Delegation. Any action or determination in this subpart which is the responsibility of a specific Ex-Im Bank employee may be delegated to a duly designated alternate.

(e) Ex-Im Bank address. The Export-Import Bank of the United States is located at 811 Vermont Avenue, NW, Washington, DC 20571.

For purposes of this subpart, the following definitions shall apply:

Appeal—A written request to the Ex-Im Bank Assistant General Counsel for Administration for reversal of an adverse initial determination.

Final determination—The written decision by the Assistant General Counsel for Administration on an appeal.

Individual—A citizen of the United States or an alien lawfully admitted for permanent residence.

Initial determination—The initial written determination in response to a Privacy Act request.

Record—Any item, collection or grouping of information about an individual that is maintained within a system of records and that contains the individual's name or an identifying number, symbol or other identifying particular assigned to the individual.

Redaction—The process of removing non-disclosable material from a record so that the remainder may be released.

Request for access—A request to view a record.

Request for accounting—A request for a list of all disclosures of a record.

Request for correction—A request to modify a record.

Requester—An individual who makes a request under the Privacy Act.

Review—The process of examining a record to determine whether any portion is required to be withheld.

Search—The process of identifying and collecting records pursuant to a request.

System of records—A group of any records under the control of an agency from which information is retrieved by the name of the individual or some identifying number, symbol or other identifying particular assigned to the individual.

Working days—All calendar days excluding Saturdays, Sundays, and Federal Government holidays.

(a) Form. Requests for access must be made in writing and must be signed by the requester. Requests should be addressed to the Freedom of Information and Privacy Office at the address in § 404.14(e) and should contain both the return address and telephone number of the requester.

(b) Description of records sought. A request for access must describe the records sought in sufficient detail so as to enable Ex-Im Bank personnel to locate the system of records containing the records with a reasonable amount of effort. To the extent practicable, such description should include the nature of the record sought, the date of the record or the period in which the record was compiled, and the name or identifying number of the system of records in which the requester believes the record is kept. A requester may include his or her social security number in the request in order to facilitate the identification and location of the requested records.

(c) Fee statement. The request must contain a statement expressing willingness to pay fees for processing the request or a request for a fee waiver (see § 404.18(d)).

(1) Whenever a requester submits a request for access that does not contain a fee statement or a request for a fee waiver, Ex-Im Bank shall advise the requester of the requirements of this section. If the requester fails to respond within ten working days of such notification, then the Freedom of Information and Privacy Office shall notify the requester, in writing, that Ex-Im Bank will not process the request.

(2) A general statement by the requester expressing willingness to pay all applicable fees shall be deemed an agreement to pay up to $25.00. If Ex-Im Bank estimates that the fees for a request will exceed $25.00, then Ex-Im Bank shall notify the requester. Ex-Im Bank shall offer the requester the opportunity to agree, in writing, either to pay a greater fee or to modify the request as a means of limiting the cost.

(3) Whenever the estimated fee chargeable under this section exceeds $25.00, Ex-Im Bank reserves the right to require a requester to make an advance payment prior to processing the request.

(4) Ex-Im Bank shall not process a request by a requester who has failed to pay a fee for a previous request unless and until such requester had paid the full amount owed and also has paid, in advance, the total estimated charges for the new request.

(d) Verification of identity. An individual who submits a request for access must verify his or her identity. The request must include the requesters full name, current address, and date and place of birth. In addition, such requester must provide a notarized statement attesting to his or her identity.

(e) Verification of guardianship. When a parent or guardian of a minor or the guardian of a person judicially determined to be incompetent submits a request for access to records that relate to the minor or incompetent, such parent or guardian must establish:

(1) His or her own identity and the identity of the subject of the record in accordance with paragraph (d) of this section; and

(2) Parentage or guardianship of the subject of the record, either by providing a copy of the subject's birth certificate showing parentage or by providing a court order establishing guardianship.

(f) Written notice of amendment. The requester must provide any amendment to the original request in writing to Ex-Im Bank.

(g) Requester assistance. Ex-Im Bank shall make reasonable efforts to assist a requester in complying with the requirements of this section.

(h) Date of receipt. Requests for access shall be deemed to have been received on the date that the request is received by the Freedom of Information and Privacy Office, provided that all the requirements of this section have been met. Ex-Im Bank shall notify the requester of the date on which it officially received a request.

(a) Time for processing. The Freedom of Information and Privacy Office shall respond to valid requests for access within twenty working days of the date of receipt of the request letter. The time for response may be extended an additional ten working days for good cause, provided that the Freedom of Information and Privacy Office notifies the requester in writing.

(b) Notice regarding request for access. The Freedom of Information and Privacy Office shall notify the requester in writing of its decision to grant or deny a request for access.

(1) If the request is granted, then the notice shall either include the requested records, in releasable form, or shall describe the manner in which access to the record will be granted. The notice also shall inform the requester of any processing fee.

(2) A denial is a determination to withhold any requested record in whole or in part or a determination that the requested record does not exist or cannot be located. If the request is denied, then the denial notice shall state:

(i) The name, signature, and title or position of the person responsible for the denial;

(ii) The reasons for the denial; and

(iii) The procedure for appeal of the denial under § 404.19 and a brief description of the requirements of that section.

(c) Form of record disclosure. Ex-Im Bank shall grant access to the requested records either by providing the requester with a copy of the record or, at the requester's option, by making the record available for inspection at a reasonable time and place. If Ex-Im Bank makes the record available for inspection, such inspection shall not unreasonably disrupt Ex-Im Bank operations. In addition, the requester must provide a form of official photographic identification—such as a passport, driver's license or identification badge—and any other form of identification bearing his or her name and address prior to inspection of the requested records. Records may be inspected by the requester in the presence of another individual, provided that the requester signs a form stating that Ex-Im Bank is authorized to disclose the record in the presence of both individuals.

(a) Search and review. Ex-Im Bank shall not charge for search and review.

(b) Duplication. Ex-Im Bank shall charge $.10 per page for paper copy duplication. Ex-Im Bank shall charge the actual or estimated cost of copies prepared by computer, such as tape or printouts, or for other methods of reproduction or duplication.

(c) Minimum fee. Ex-Im Bank shall waive final fees of $5.00 or less.

(d) Fee waivers. Ex-Im Bank may waive fees whenever it is determined to be in the public interest. Fees of less than $50.00 shall be waived in connection with any request by an employee, former employee or applicant for employment, related to a grievance or complaint of discrimination against Ex-Im Bank.

(e) Special services charges. Complying with requests for special services such as those listed in this paragraph is entirely at the discretion of Ex-Im Bank. Ex-Im Bank shall recover the full costs of providing such services to the extent that it elects to provide them.

(1) Certifications. Ex-Im Bank shall charge $25.00 to certify the authenticity of any Ex-Im Bank record or any copy of such record.

(2) Special shipping. Ex-Im Bank may ship by special means (e.g., express mail) if the requester so desires, provided that the requester has paid or has expressly undertaken to pay all costs of such special services. Ex-Im Bank shall not charge for ordinary packaging and mailing.

(a) Appeals to the Assistant General Counsel for Administration. Whenever Ex-Im Bank denies a request for access or for waiver or reduction of fees, the requester may appeal the denial to the Assistant General Counsel for Administration within 30 working days of the date of Ex-Im Bank's issuance of notice of such action. Appeals must be made in writing and must be signed by the appellant. Appeals should be addressed to the Assistant General Counsel for Administration at the address in § 404.14(e). Both the envelope and the appeal letter should be clearly marked in capital letters: “PRIVACY ACT APPEAL.” Failure to properly mark or address the appeal may slow its processing. An appeal shall not be deemed to have been received by Ex-Im Bank until the Assistant General Counsel for Administration receives the appeal letter. The letter should include:

(1) A copy of the denied request or a description of the records requested;

(2) The name and title of the Ex-Im Bank employee who denied the request;

(3) The date on which the request was denied; and

(4) The Ex-Im Bank identification number assigned to the request.

(b) Final determination. The disposition of an access appeal shall be made in writing within twenty working days after the date of receipt of the appeal. The Assistant General Counsel for Administration may extend the time for response an additional ten working days for good cause, provided that the requester is notified in writing. A decision affirming the denial of a request for access shall include a brief statement of the reasons for affirming the denial and shall advise the requester of the right to seek judicial review. If the initial determination is reversed, then the request shall be remanded to the Freedom of Information and Privacy Office to be processed in accordance with the decision on appeal.

(a) Form. Requests for correction must be made in writing and must be signed by the requester. Requests should be addressed to the Freedom of Information and Privacy Office at the address in § 404.14(e) and should contain both the return address and telephone number of the requester. The request must identify the particular record in question, state the correction sought, and set forth the justification for the correction. The requester also must verify his or her identity in accordance with the procedures set forth at § 404.16(d) and (e). Both the envelope and the request for correction itself should be clearly marked in capital letters: “PRIVACY ACT CORRECTION REQUEST.”

(b) Initial determination. The Freedom of Information and Privacy Office shall respond to valid correction requests within ten working days of receipt of the request letter. If Ex-Im Bank grants the request for correction, then the Freedom of Information and Privacy Office shall advise the requester of his or her right to obtain a copy, in releasable form, of the corrected record. A denial notice shall state the reasons for the denial and shall advise the requester of the right to appeal. Ex-Im Bank shall not charge for processing requests for correction.

(c) Appeal of denial of request for correction. Whenever Ex-Im Bank denies a request for correction, the requester may appeal the denial to the Assistant General Counsel for Administration within thirty working days of Ex-Im Bank's issuance of notice of such action. Appeals must be made in writing and must be signed by the appellant. Appeals should be addressed to the Assistant General Counsel for Administration at the address set forth in § 404.14(e). Both the envelope and the appeal letter should be clearly marked in capital letters: “PRIVACY ACT CORRECTION APPEAL.” Failure to properly mark or address the appeal may slow its processing. An appeal shall not be deemed to have been received by Ex-Im Bank until the Assistant General Counsel for Administration receives the appeal letter. The letter must include:

(1) A copy of the denied request or a description of the correction sought;

(2) The name and title of the Ex-Im Bank employee who denied the request;

(3) The date on which the request was denied;

(4) The Ex-Im Bank identification number assigned to the request; and

(5) Any information said to justify the correction.

(d) Final determination on correction appeal. (1) The disposition of an appeal shall be made in writing within twenty working days after the date of receipt of an appeal. The Assistant General Counsel for Administration may extend the time for response an additional ten working days for good cause, provided that the requester is notified in writing.

(2) A decision affirming the denial of a request for access shall advise the appellant of the:

(i) Reasons for affirming the denial;

(ii) Right to seek judicial review; and

(iii) Right to file a statement of disagreement, as provided in paragraph (e) of this section.

(3) If the initial determination is reversed, then the request shall be remanded to the Freedom of Information and Privacy Office to be processed in accordance with the decision on appeal.

(e) Statement of disagreement. Upon denial of a correction appeal, the appellant shall have the right to file a statement of disagreement with Ex-Im Bank, setting forth his or her reasons for disagreeing with the Agency's action. The statement should be addressed to the Freedom of Information and Privacy Office at the address in § 404.14(e) and must be received within thirty working days of Ex-Im Bank's issuance of the denial notice. A statement of disagreement must not exceed one typed page per fact disputed. Statements exceeding this limit shall be returned to the requester for editing. Upon receipt of a statement of disagreement under this section, the Freedom of Information and Privacy Office shall have the statement included in the system of records in which the disputed record is maintained and shall have the disputed record marked so as to indicate that a Statement of Disagreement has been filed. Ex-Im Bank may also append to the disputed record a written statement regarding Ex-Im Bank's reasons for denying the request to correct the record.

(f) Notices of correction or disagreement. In any disclosure of a record for which Ex-Im Bank has received a statement of disagreement, Ex-Im Bank shall clearly note any portion of the record which is disputed and shall provide a copy of the statement of disagreement. Ex-Im Bank also may provide its own statement regarding the disputed record. In addition, whenever Ex-Im Bank corrects a record or receives a statement of disagreement, Ex-Im Bank shall, as is reasonable under the circumstances, advise any person or agency to which it previously disclosed such record of the correction or statement, provided that an accounting of such disclosure exists.

(a) Required information. With respect to each system of records under Ex-Im Bank control, Ex-Im Bank shall maintain an accurate accounting of the date, nature, and purpose of each external disclosure of a record and the name and address of all persons, organizations, and agencies to which disclosure has been made. Ex-Im Bank shall retain this accounting for at least five years or the life of the record, whichever is longer.

(b) Form. An individual may obtain an accounting of all disclosures of a record, provided that such individual establishes his or her identity as the subject of such record in accordance with the procedures set forth at § 404.16(d) and (e). A request for an accounting must be made in writing and must be signed by the requester. The request should be addressed to the Freedom of Information and Privacy Office at the address in § 404.14(e) and should contain both the return address and telephone number of the requester. Both the envelope and the request itself should be clearly be marked in capital letters: “PRIVACY ACT ACCOUNTING REQUEST.” Failure to properly mark or address the request may slow its processing. The request shall not be deemed to have been received by Ex-Im Bank until the Freedom of Information and Privacy Office receives the request. The letter must clearly identify the particular record for which the accounting is requested.

(c) Initial determination. The Freedom of Information and Privacy Office shall notify the requester whether the request will be granted or denied within ten working days of receipt of a valid request for an accounting. Ex-Im Bank shall not charge for processing such a request.

(d) Exceptions. Ex-Im Bank shall not be required to provide an accounting to an individual when the accounting relates to a disclosure made:

(1) To an employee within the agency;

(2) Under the FOIA; or

(3) To a law enforcement agency for an authorized law enforcement activity in response to a written request from such agency which specified the law enforcement activity for which the disclosure was sought.

(a) Court-ordered disclosures. When a record pertaining to an individual is required to be disclosed by a court order, the Assistant General Counsel for Administration shall make reasonable efforts to provide notice to the subject individual. Notice shall be given within a reasonable time after Ex-Im Bank's receipt of the order, except that in a case in which the order is not a matter of public record, notice shall be given only after the order becomes public. Such notice shall be mailed to the individual's last known address and shall contain a copy of the order and a description of the information disclosed.

(b) Emergency disclosures. If a record has been disclosed by Ex-Im Bank under compelling circumstances affecting the health or safety of any person, then, within ten working days, the Assistant General Counsel for Administration shall notify the subject individual of the disclosure at his or her last known address. The notice of such disclosure shall be in writing and shall state the:

(1) Nature of the information disclosed;

(2) Person, organization or agency to which it was disclosed;

(3) Date of disclosure; and

(4) Compelling circumstances justifying the disclosure.

(a) Policy. Ex-Im Bank recognizes the importance of assessing, to the extent reasonably possible, the risks associated with transactions supported by Ex-Im Bank. It is often difficult to assess risks related to individuals and non-publicly trade entities. Therefore, when an individual or a non-publicly traded entity applies for participation in an Ex-Im Bank program or is proposed as a guarantor for an Ex-Im Bank transaction, Ex-Im Bank may request social security and/or U.S. passport numbers from such individual or from the principals of such entity. Ex-Im Bank shall not require submission of this information, and unwillingness or inability to provide a social security or passport number shall not affect Ex-Im Bank's decision on an application for Ex-Im Bank assistance.

(b) Use. Ex-Im Bank shall use social security and passport numbers to assess the creditworthiness of Ex-Im Bank program participants and as a mechanism for enforcing agreements with Ex-Im Bank. Such information shall not be disclosed, except as warranted by law and regulation.

(c) Notice. Whenever Ex-Im Bank requests a social security or passport number, Ex-Im Bank shall place an appropriate Privacy Act notification on the form used to collect the information.

(a) Approval by Assistant General Counsel for Administration. Ex-Im Bank shall not contract for the operation of a system of records or for an activity that requires access to a system of records without the express, written approval of the Assistant General Counsel for Administration.

(b) Contract clauses. Any contract authorized under paragraph (a) of this section shall contain the standard contract clauses required by the Federal Acquisition Regulation (48 CFR 24.104) to ensure compliance with the requirements imposed by the Privacy Act. The division within Ex-Im Bank that is responsible for technical supervision of the contract shall be responsible for ensuring that the contractor complies with the Privacy Act contract requirements.

(c) Contractor status. Any contractor that operates an Ex-Im Bank system of records or engages in an activity that requires access to an Ex-Im Bank system of records shall be considered an Ex-Im Bank employee for purposes of this subpart. Ex-Im Bank shall supply any such contractor with a copy of the regulations in this subpart upon entering into a contract with Ex-Im Bank.

Nothing in this subpart shall be construed to entitle any person to any service or to the disclosure of any record to which such person is not entitled under the Privacy Act.