For purposes of this subpart:

Access means making a record available to a subject individual.

Amendment means any correction, addition to or deletion of information in a record.

Individual means a natural person who either is a citizen of the United States or an alien lawfully admitted to the United States for permanent residence.

Maintain includes the term “maintain”, collect, use, or disseminate.

Privacy Act Office means the ONDCP officials who are authorized to respond to requests and to process requests for amendment of records ONDCP maintains under the Privacy Act.

Record means any item, collection or grouping of information about an individual that ONDCP maintains within a system of records and contains the individual's name or the identifying number, symbol or other identifying particular assigned to the individual, such as a finger or voice print or photograph.

System of records means a group of records ONDCP maintains or controls from which information is retrieved by the name of an individual or by some identifying number, symbol or other identifying particular assigned to the individual.

This subpart implements the Privacy Act, 5 U.S.C. 552a,a. It establishes ONDCP's rules for access to records in systems of records we maintain that are retrieved by an individual's name or another personal identifier. It describes the procedures by which individuals may request access to records, request amendment or correction of those records, and request an accounting of disclosures of those records by ONDCP. Whenever it is appropriate to do so, ONDCP automatically processes a Privacy Act request for access to records under both the Privacy Act and the FOIA, following the rules contained in this part. ONDCP processes a request under both the Privacy Act and the FOIA so you will receive the maximum amount of information available to you by law.

(a) In general. You can make a Privacy Act request for records about yourself. You also can make a request on behalf of another individual as the parent or legal guardian of a minor, or as the legal guardian of someone determined by a court to be incompetent.

(b) How do I make a request? (1) Where do I send my written request? To make a request for access to a record, you should write directly to our Office of General Counsel. Heightened security delays mail delivery. To avoid mail delivery delays, we strongly suggest that you email your request to [email protected]. Our mailing address is: SSDMD/RDS; ONDCP Office of General Counsel; Joint Base Anacostia-Bolling (JBAB); Bldg. 410/Door 123; 250 Murray Lane SW, Washington, DC 20509. To make sure that the Office of General Counsel receives your request without delay, you should include the notation “Privacy Act Request” in the subject line of your email or on the front of your envelope and also at the beginning of your request.

(2) Security concerns. To protect our computer systems, we reserve the right not to open attachments to emailed requests. We request that you include your request within the body of the email.

(c) What should my request include? You must describe the record that you seek in enough detail to enable ONDCP to locate the system of records containing the record with a reasonable amount of effort. Include specific information about each record sought, such as the time period in which you believe it was compiled, the name or identifying number of each system of records in which you believe it is kept, and the date, title or name, author, recipient, or subject matter of the record. As a general rule, the more specific you are about the record that you seek, the more likely we will be able to locate it in response to your request.

(d) How do I request amendment of a record? If you are requesting an amendment of an ONDCP record, you must identify each particular record in question and the system of records in which the record is located, describe the amendment that you seek, and state why you believe that the record is not accurate, relevant, timely or complete. You may submit any documentation that you think would be helpful, including an annotated copy of the record.

(e) How do I request an accounting of record disclosures? If you are requesting an accounting of disclosures made by ONDCP to another person, organization or Federal agency, you must identify each system of records in question. An accounting generally includes the date, nature and purpose of each disclosure, as well as the name and address of the person, organization, or Federal agency to which the disclosure was made.

(f) Verification of identity. When making a Privacy Act request, you must verify your identity in accordance with these procedures to protect your privacy or the privacy of the individual on whose behalf you are acting. If you make a Privacy Act request and you do not follow these identity verification procedures, ONDCP cannot process your request.

(1) How do I verify my own identity? You must include in your request your full name, citizenship status, current address, and date and place of birth. We may request additional information to verify your identity. To verify your own identity, you must provide an unsworn declaration under 28 U.S.C. 1746,a. To fulfill this requirement, you must include the following statement just before the signature on your request:

(2) How do I verify parentage or guardianship? If you make a request as the parent or legal guardian of a minor, or as the legal guardian of someone determined by a court to be incompetent, for access to records or information about that individual, you must establish:

(i) The identity of the individual who is the subject of the record, by stating the individual's name, citizenship status, current address, and date and place of birth;

(ii) Your own identity, as required in paragraph (f)(1) of this section;

(iii) That you are the parent or legal guardian of the individual, which you may prove by providing a copy of the individual's birth certificate showing your parentage or a court order establishing your guardianship; and

(iv) That you are acting on behalf of the individual in making the request.

(a) When will we respond to your request? We will search to determine if the requested records exist in a system of records ONDCP owns or controls. The Office of General Counsel will respond to you in writing within 20 days after we receive your request and/or within ten working days after we receive your request for an amendment, if it meets the requirements of this subpart. We may extend the response time in unusual circumstances, such as the need to consult with another agency about a record or to retrieve a record that is in storage.

(b) What will our response include? (1) Our written response will include our determination whether to grant or deny your request in whole or in part, a brief explanation of the reasons for the determination, and the amount of the fee charged, if any, under § 1401.24. If you requested access to records, we will make the records, if any, available to you. If you requested amendment of a record, the response will describe any amendments made and advise you of your right to obtain a copy of the amended record.

(2) We will also notify the individual who is subject to the record in writing, if, based on your request, any system of records contains a record pertaining to him or her.

(3) If ONDCP makes an adverse determination with respect to your request, our written response will identify the name and address of the person responsible for the adverse determination, that the adverse determination is not a final agency action, and describe the procedures by which you may appeal the adverse determination under § 1401.23.

(4) An adverse determination is a response to a Privacy Act request that:

(i) Withholds any requested record in whole or in part;

(ii) Denies a request to amend a record in whole or in part;

(iii) Declines to provide an accounting of disclosures;

(iv) Advises that a requested record does not exist or cannot be located;

(v) Finds that what you requested is not a record subject to the Privacy Act; or

(vi) Advises on any disputed fee matter.

(a) What can I appeal? You can appeal any adverse determination in writing to our Director or designee within 90 calendar days after the date of our response. We provide a list of adverse determinations in § 1401.22(b)(3).

(b) How do I make an appeal? (1) What should I include? You may appeal by submitting a written statement giving the reasons why you believe the Director or designee should overturn the adverse determination. Your written appeal may include as much or as little related information as you wish to provide, as long as it clearly identifies the determination (including the request number, if known) that you are appealing.

(2) Where do I send my appeal? You should mark both your letter and the envelope, or the subject of your email, “Privacy Act Appeal.” To avoid mail delivery delays caused by heightened security, we strongly suggest that you email any appeal to [email protected]. Our mailing address is: SSDMD/RDS; ONDCP Office of General Counsel; Joint Base Anacostia-Bolling (JBAB); Bldg. 410/Door 123; 250 Murray Lane SW, Washington, DC 20509.

(c) Who will decide your appeal? (1) The Director or designee will act on all appeals under this section.

(2) We ordinarily will not adjudicate an appeal if the request becomes a matter of litigation.

(3) On receipt of any appeal involving classified information, the Director or designee must take appropriate action to ensure compliance with applicable classification rules.

(d) When will we respond to your appeal? The Director or designee will notify you of its appeal decision in writing within 30 days from the date it receives an appeal that meets the requirements of paragraph (b) of this section. We may extend the response time in unusual circumstances, such as the need to consult with another agency about a record or to retrieve a record shipped offsite for storage.

(e) What will our response include? The written response will include the Director or designee's determination whether to grant or deny your appeal in whole or in part, a brief explanation of the reasons for the determination, and information about the Privacy Act provisions for court review of the determination.

(1) Appeals concerning access to records. If your appeal concerns a request for access to records and the appeal is granted in whole or in part, we will make the records, if any, available to you.

(2) Appeals concerning amendments. If your appeal concerns amendment of a record, the response will describe any amendment made and advise you of your right to obtain a copy of the amended record. We will notify all persons, organizations or Federal agencies to which we previously disclosed the record, if an accounting of that disclosure was made, that the record has been amended. Whenever the record is subsequently disclosed, the record will be disclosed as amended. If our response denies your request for an amendment to a record, we will advise you of your right to file a statement of disagreement under paragraph (f) of this section.

(f) Statements of disagreement—(1) What is a statement of disagreement? A statement of disagreement is a concise written statement in which you clearly identify each part of any record that you dispute and explain your reason(s) for disagreeing with our denial in whole or in part of your appeal requesting amendment.

(2) How do I file a statement of disagreement? You should mark both your letter and the envelope, or the subject of your email, “Privacy Act Statement of Disagreement.” To avoid mail delivery delays caused by heightened security, we strongly suggest that you email a statement of disagreement to [email protected]. Our mailing address is: SSDMD/RDS; ONDCP Office of General Counsel; Joint Base Anacostia-Bolling (JBAB); Bldg. 410/Door 123; 250 Murray Lane SW, Washington, DC 20509.

(3) What will we do with your statement of disagreement? We shall clearly note any portion of the record that is disputed and provide copies of the statement and, if we deem appropriate, copies of our statement that denied your request for an appeal for amendment, to persons or other agencies to whom the disputed record has been disclosed.

(g) When appeal is required. Under this section, you generally first must submit a timely administrative appeal, before seeking review of an adverse determination or denial request by a court.

(a) Agreement to pay fees. Your request is an agreement to pay fees. We consider your Privacy Act request as your agreement to pay all applicable fees unless you specify a limit on the amount of fees you agree to pay. We will not exceed the specified limit without your written agreement.

(b) How do we calculate fees? We will charge a fee for duplication of a record under the Privacy Act in the same way we charge for duplication of records under the FOIA in § 1401.11(c). There are no fees to search for or review records requested under the Privacy Act.