(a) Purpose and scope. The subpart contains the regulations of the Office of Independent Counsel implementing the Privacy Act of 1974, 5 U.S.C. 552a. The regulations apply to all records that are contained in systems of records maintained by the Office of Independent Counsel and that are retrieved by an individual's name or personal identifier. These regulations set forth the procedures by which an individual may seek access under the Privacy Act to records pertaining to him, may request correction of such records, or may seek an accounting of disclosures of such records by the office.

(b) Transfer of law-enforcement records. The head of the Office, or his designee, is authorized to make written requests under 5 U.S.C. 552a(b)(7) for transfer of records maintained by other agencies that are necessary to carry out an authorized law-enforcement activity of the Office.

(c) Definitions. As used in this subpart, the following terms shall have the following meanings:

(1) Agency has the meaning given in 5 U.S.C. 551(1) and 5 U.S.C. 552a(a)(1).

(2) Record has the same meaning given in 5 U.S.C. 552(a)(4).

(3) Request for access means a request made pursuant to 5 U.S.C. 552a(d)(1).

(4) Request for correction means a request made pursuant to 5 U.S.C. 552a(d)(2).

(5) Request for an accounting means a request made pursuant to 5 U.S.C. 552a(c)(3).

(6) Requester means an individual who makes either a request for access, a request for correction, or a request for an accounting.

(7) System of records means a group of any group of any records under the control of the Office from which information is retrieved by the name of an individual or by some identifying number, symbol, or other identifying particular assigned to that individual.

(a) Procedure for making requests for access to records. An individual may request access to a record about him by appearing in person or by writing the Office. A requester in need of guidance in defining his request may write to the FOIA/PA Officer, Office of Independent Counsel, suite 701 West, 555 Thirteenth Street, NW., Washington, DC 20004. Both the envelope and the request itself should be marked: “Privacy Act Request.”

(b) Description of records sought. A request for access to records must describe the records sought in sufficient detail to enable Office personnel to locate the system of records containing the record with a reasonable amount of effort. Whenever possible, a request for access should describe the nature of the records sought, the date of the record or the period in which the record was compiled, and the name or identifying number of the system of records in which the requester believes the record is kept.

(c) Agreement to pay fees. The filing of a request for access to a record under this subpart shall be deemed to constitute an agreement to pay all applicable fees charged under § 700.17 up to $25.00. The Office shall confirm this agreement in its letter of acknowledgment to the requesters. When filing a request, a requester may specify a willingness to pay a greater amount, if applicable.

(d) Verification of identity. Any individual who submits a request for access to records must verify his identity in one of the following ways, unless the notice published in the Federal Register describing the relevant system of records provides otherwise.

(1) Any requester making a request in writing must state in his request his full name, current address, and date and place of birth. In addition, a requester must provide with his request an example of his signature, which shall be notarized. In order to facilitate the identification and location of the requested records, a requester may also, at his option, include in his request his Social Security number.

(2) Any requester submitting a request in person may provide to the Office a form of Official photographic identification, such as a passport or an identification badge. If a requester is unable to produce a form of photographic identification, he may provide to the Office two or more acceptable forms of identification (such as a driver's license or credit card) bearing his name and address.

(e) Verification of guardianship. The parent or guardian of a minor (or the guardian of a person judicially determined to be incompetent) who submits a request for access to the records of the minor or incompetent must establish:

(1) His own identity and the identity of the subject of the record, as required in paragraph (d) of this section,

(2) That he is the parent or guardian of the subject of the record, which may be proved by providing a copy of the subject's birth certificate showing parentage or by providing a court order establishing the guardianship, and

(3) That he seeks to act on behalf of the subject of the record.

(a) Authority to grant or deny requests. The head of the Office, or his designee, is authorized to grant or deny any request for access to a record.

(b) Initial action by the Office. When the Office receives a request for access to a record in its possession, the Office shall promptly determine whether another Government agency is better able to determine whether the record is exempt, to any extent, from access. If the Office determines that it is the agency best able to determine whether the record is exempt, to any extent, from access, then the Office shall respond to the request. If the Office determines that it is not the agency best able to determine whether the record is exempt from access, the Office shall respond to the request, after consulting with the agency best able to determine whether the record is exempt from access. Under ordinary circumstances, the agency that generated or originated a requested record shall be presumed to be the agency best able to determine whether the record is exempt from access. However, nothing in this section shall prohibit the agency that generated or originated a requested record from consulting with the Office, if the agency that generated or originated the requested record determines that the Office has an interest in the requested record or the information contained therein.

(c) Law-enforcement information. Whenever a request for access is made for a record containing information that relates to an investigation of a possible violation of criminal law or to a criminal law-enforcement proceeding and that was generated or originated by another agency, the Office shall consult with that other agency, as appropriate.

(d) Classified information. Whenever a request for access is made for a record containing information that has been classified, or that may be eligible for classification, by another agency under the provision of Executive Order 12356 or any other Executive order concerning the classification of records, the Office shall refer the responsibilities for responding to the request to the agency that classified the information or should consider the information for classification. Whenever a record contains information that has been derivatively classified by the Office because it contains information classified by another agency, the Office shall refer the responsibility for responding to the request to the agency that classified the underlying information; however, such referral shall extend only to the information classified by the other agency.

(e) Agreements regarding consultations. No provision of this section shall preclude formal or informal agreements between the Office and another agency, to eliminate the need for consultations concerning requests or classes of requests.

(f) Date for determining responsive records. In determining records responsive to a request for access, the Office ordinarily will include only those records within the Office's possession and control as of the date of its receipt of the request.

(a) Form of notice granting request for access. After the Office has made a determination to grant a request for access in whole or in part, the Office shall so notify the requester in writing. The notice shall describe the manner in which access to the record will be granted and shall inform the requester of any fees to be charged in accordance with § 700.17.

(b) Form of notice denying request for access. When the Office denies a request for access in whole or in part it shall so notify the requester in writing. The notice shall be signed by the head of the Office, or his designee, and shall include:

(1) The name and title or position of the person responsible for the denial;

(2) A brief statement of the reason or reasons for the denial, including the Privacy Act exemption or exemptions that the Office has relied upon in denying the request and a brief explanation of the manner in which the exemption or exemptions apply to each record withheld; and

(3) A statement that the denial may be appealed under § 700.18(a) and a description of the requirements of that subsection.

(c) Record cannot be located or has been destroyed. If a requested record cannot be located from the information supplied, or is known or believed to have been destroyed or otherwise disposed of, the Office shall so notify the requester in writing.

(d) Medical records. When an individual requests medical records pertaining to himself that are not otherwise exempt from individual access, the Office may advise the individual that the records will be provided only to a physician, designated by the individual, who requests the records and establishes his identity in writing. The designated physician shall determine which records should be provided to the individual and which records should not be disclosed to the individual because of possible harm to the individual or another person.

In processing a request for access to a record containing information that is classified or classifiable under Executive Order 12356 or any other Executive order concerning the classification of records, the Office shall review the information to determine whether it warrants classification. Information that does not warrant classification shall not be withheld from a requester on the basis of 5 U.S.C. 552a(k)(1). The Office shall, upon receipt of any appeal involving classified or classifiable information, take appropriate action to ensure compliance with the provisions of Executive Order 12356.

(a) Law-enforcement records exempted under subsections (j)(2) and (k)(2). Before denying a request by an individual for access to a law-enforcement record that has been exempted from access pursuant to 5 U.S.C. 552a(k)(2), the Office must review the requested record to determine whether information in the record has been used or is being used to deny the individual any right, privilege, or benefit for which he would otherwise be eligible or to which he would otherwise be entitled under federal law. If so, the Office shall notify the requester of the existence of the record and disclose such information to the requester, except to the extent that the information would identify a confidential source. In cases when disclosure of information in a law-enforcement record could reasonably be expected to identify a confidential source, the record shall not be disclosed to the requester unless the Office is able to delete from such information all material that would identify the confidential source.

(b) Employee background investigations. When a requester requests access to a record pertaining to a background investigation and the record has been exempted from access pursuant to 5 U.S.C. 552a(k)(5), the record shall not be disclosed to the requester unless the Office is able to delete from such record all information that would identify a confidential source.

(a) Manner of access. The Office, once it has made a determination to grant a request for access, shall grant the requester access to the requested record by—

(1) Providing the requester with a copy of the record or

(2) Making the record available for inspection by the requester at a reasonable time and place.

(b) Accompanying person. A requester appearing in person to review his records may be accompanied by another individual of his own choosing. Both the requester and the accompanying person shall be required to sign a form stating that the Office of Independent Counsel is authorized to disclose the record in the presence of both individuals.

(a) When charged. The Office shall charge fees pursuant to 5 U.S.C. 552a(f)(5) for the copying of records to afford access to individuals unless the Office, in its discretion, waives or reduces the fees for good cause shown. The Office shall charge fees only at the rate of $0.10 per page. For materials other than paper copies, the Office may charge the direct costs of reproduction, but only if the requester has been notified of such costs before they are incurred. Fees shall not be charged when they would amount, in the aggregate, for one request or for a series of related requests, to less than $3.00. However, the Office may, in its discretion, increase the amount of this minimum fee.

(b) Notice of estimated fees in excess of $25. When the Office determines or estimates that the fees to be charged under this section may amount to more than $25, the Office shall notify the requester as soon as practicable of the actual or estimated amount of the fee, unless the requester has indicated in advance his willingness to pay a fee as high as that anticipated. (If only a portion of the fee can be estimated readily, the Office shall advise the requester that the estimated fee may be only a portion of the total fee.) When the estimated fee exceeds $25 and the Office has so notified the requester, the Office will be deemed not to have received the request for access to records until the requester has agreed to pay the anticipated fee. A notice to a requester pursuant to this paragraph shall offer him the opportunity to confer with Office personnel with the object of reformulating his request to meet his needs at a lower cost.

(c) Form of payment. Requesters must pay fees by check or money order made payable to the Treasury of the United States.

(d) Advance deposits. (1) When the estimated fee chargeable under this section exceeds $25, the Office may require a requester to make an advance deposit of 25 percent of the estimated fee or an advance payment of $25, whichever is greater.

(2) When a requester has previously failed to pay a fee charged under this part, the requester must pay the Office the full amount owed and make an advance deposit of the full amount of any estimated fee before the Office shall be required to process a new or pending request for access from that requester.

(a) Appeals to Independent Counsel. When the Office denies in whole or part a request for access to records, the requester may appeal the denial to Independent Counsel within 30 days of his receipt of the notice denying his request. An appeal to Independent Counsel shall be made in writing, addressed to the Office of Independent Counsel, suite 701 West, 555 Thirteenth Street, NW., Washington, DC 20004. Both the envelope and the letter of appeal itself must be clearly marked: “Privacy Act Appeal.”

(b) Action on appeals. Unless Independent Counsel otherwise directs, he or his designee shall act on all appeals under this section, except that: A denial of a request for access by Independent Counsel, or his designee, shall constitute the final action of the Office on that request.

(c) Form of action on appeal. The disposition of an appeal shall be in writing. A decision affirming in whole or in part the denial of a request for access shall include a brief statement of the reason or reasons for the affirmance, including each Privacy Act exemption relied upon and its relation to each record withheld, and a statement that judicial review of the denial is available in the United States District Court for the judicial district in which the requester resides or has his principal place of business, the judicial district in which the requested records are located, or the District of Columbia. If the denial of a request for access is reversed on appeal, the requester shall be so notified and the request shall be processed promptly in accordance with the decision on appeal.

The Office shall preserve all correspondence relating to the requests it receives under this subpart, and all records processed pursuant to such requests, until such time as the destruction of such correspondence and records is authorized pursuant to title 44 of the U.S. Code. Under no circumstances shall records be destroyed while they are the subject of a pending request for access, appeal, or lawsuit under the Act.

(a) How made. Unless a record is exempted from correction and amendment, an individual may submit a request for correction of a record pertaining to him. A request for correction must be made in writing. The request must identify the particular record in question, state the correction sought, and set forth the justification for the correction. Both the envelope and the request for correction itself must be clearly marked: “Privacy Act Correction Request.”

(b) Initial determination. Within 10 working days of receiving a request for correction, the Office shall notify the requester whether his request will be granted or denied, in whole or in part. If the Office grants the request for correction in whole or in part, it shall advise the requester of his right to obtain a copy of the corrected record, in releasable form, upon request. If the Office denies the request for correction in whole or in part, it shall notify the requester in writing of the denial. The notice of denial shall state the reason or reasons for the denial and advise the requester of his right to appeal.

(c) Appeals. When a request for correction is denied in whole or in part, the requester may appeal the denial to Independent Counsel within 30 days of his receipt of the notice denying his request. An appeal to Independent Counsel shall be made in writing, shall set forth the specific item of information sought to be corrected, and shall include any documentation said to justify the correction. An appeal shall be addressed to the Office of Independent Counsel, suite 701 West, 555 Thirteenth Street, NW., Washington, DC 20004. Both the envelope and the letter of appeal itself must be clearly marked: “Privacy Act Correction Appeal.”

(d) Determination on appeal. Independent Counsel, or his designee, shall decide all appeals from denials or requests to correct records. All such appeals shall be decided within 30 working days of receipt of the appeal, unless there is good cause to extend this period. If the denial of a request is affirmed on appeal, the requester shall be so notified in writing and advised of—

(1) The reason or reasons the denial has been affirmed,

(2) The requester's right to file a Statement of Disagreement, as provided in paragraph (e) of this section, and

(3) The requester's right to obtain judicial review of the denial in the United States District Court for the judicial district in which the requester resides or has his principal place of business, the judicial district in which the record is located, or the District of Columbia.

(e) Statements of disagreement. A requester whose appeal under this section is denied shall have the right to file a Statement of Disagreement with the Office of Independent Counsel, Suite 701 West, 555 Thirteenth Street, NW., Washington, DC 20004, within 30 days of receiving notice of denial of his appeal. Statements of disagreement may not exceed one typed page per fact disputed. Statements exceeding this limit shall be returned to the requester for condensation. Upon receipt of a statement of disagreement under this section, Independent Counsel, or his designee, shall have the statement included in the system of records in which the disputed record is maintained and shall have the disputed record marked so as to indicate—

(1) That a statement of disagreement has been filed, and

(2) Where in the system of records the statement of disagreement may be found.

(f) Notices of correction or disagreement. Within 30 working days of the correction of a record, the Office shall advise all agencies to which it previously disclosed the record that the record has been corrected. Whenever an individual has filed a statement of disagreement, the Office shall append a copy of the statement to the disputed record whenever the record is disclosed. The Office may also append to the disputed record any written statement it has made giving the Office's reasons for denying the request to correct the record.

The following records are not subject to correction or amendment as provided in § 700.20:

(a) Transcripts of testimony given under oath or written statements made under oath;

(b) Transcripts of grand jury proceedings, judicial proceedings, or quasi-judicial proceedings that constitute the official record of such proceedings;

(c) Presentence records that are the property of the courts, but may be maintained by the Office in a system of records; and

(d) Records duly exempted from correction pursuant to 5 U.S.C. 552a(j) or 552a(k) by notice published in the Federal Register.

(a) An individual may request the Office to provide him with an accounting of those other agencies to which the Office has disclosed the record, and the date, nature, and purpose of each disclosure. A request for an accounting must be made in writing and must identify the particular record for which the accounting is requested. The request also must be addressed to the Office and both the envelope and the request itself must clearly be marked: “Privacy Act Accounting Request.”

(b) The Office shall not be required to provide an accounting to an individual to the extent that the accounting relates to—

(1) Records for which no accounting must be kept pursuant to 5 U.S.C. 552a(c)(1),

(2) Disclosures of records to law-enforcement agencies for lawful law-enforcement activities, pursuant to written requests from such law-enforcement agencies specifying records sought and the law-enforcement activities for which the records are sought, under 5 U.S.C. 552a (c)(3) and (b)(7), or

(3) Records for which an accounting need not be disclosed pursuant to 5 U.S.C. 552a (j) or (k).

(c) A denial of a request for an accounting may be appealed to Independent Counsel in the same manner as a denial of a request for access, with both the envelope and the letter of appeal itself clearly marked: “Privacy Act Accounting Appeal.”

(a) Subpoenas. When records pertaining to an individual are subpoenaed by a grand jury, court, or quasi-judicial authority, the official served with the subpoena shall be responsible for ensuring that written notice of its service is forwarded to the individual. Notice shall be provided within 10 working days of the service of the subpoena or, in the case of a grand jury subpoena, within 10 working days of its becoming a matter of public record. Notice shall be mailed to the last known address of the individual and shall contain the following information: The date the subpoena is returnable, the court or quasi-judicial authority to which it is returnable, the name and number of the case of proceeding, and the nature of the records sought. Notice of the service of a subpoena is not required if the system of records has been exempted from the notice requirement of 5 U.S.C. 552a(e)(8), pursuant to 5 U.S.C. 552a(j), by a Notice of Exemption published in the Federal Register.

(b) Emergency disclosures. If the record of an individual has been disclosed to any person under compelling circumstances affecting the health or safety of any person, as described in 5 U.S.C. 552a(b)(8), the individual to whom the record pertains shall be notified of the disclosure at his last known address within 10 working days. The notice of such disclosure shall be in writing and shall state the nature of the information disclosed, the person or agency to whom it was disclosed, the date of disclosure, and the compelling circumstances justifying the disclosure. The officer who made or authorized the disclosure shall be responsible for providing such notification.

(a) The Office Administrator or Security Officer shall be responsible for issuing regulations governing the security of systems of records. To the extent that such regulations govern the security of automated systems of records, the regulations shall be consistent with the guidelines developed by the National Bureau of Standards.

(b) The Office shall establish administrative and physical controls to prevent unauthorized access to its systems of records, to prevent the unauthorized disclosure of records, and to prevent the unauthorized disclosure of records, and to prevent the physical damage or destruction of records. The stringency of such controls shall reflect the sensitivity of the records the controls protect. At a minimum, however, the Office's administrative and physical controls shall ensure that—

(1) Records are protected from public view,

(2) The area in which records are kept is supervised during business hours to prevent unauthorized persons from having access to the records, and

(3) Records are inaccessible to unauthorized persons outside of business hours.

(c) The Office shall establish rules restricting access to records to only those individuals within the Office who must have access to such records in order to perform their duties. The Office also shall adopt procedures to prevent the accidental disclosure of records or the accidental granting of access to records.

(a) Each system manager of a system of records that utilizes Social Security numbers as a method of identification without statutory authorization, or authorization by regulation adopted prior to January 1, 1975, shall take steps to revise the system to avoid future collection and use of the Social Security numbers.

(b) The Office shall take such measures as are necessary to ensure that employees authorized to collect information from individuals are advised that individuals may not be required to furnish Social Security numbers without statutory or regulatory authorization and that individuals who are requested to provide Social Security numbers voluntarily must be advised that furnishing the number is not required and that no penalty or denial of benefits will flow from the refusal to provide it.

(a) The Office shall inform its employees of the provisions of the Privacy Act, including the Act's civil liability and criminal penalty provisions. The Office also shall notify its employees that they have a duty to—

(1) Protect the security of records,

(2) Assure the accuracy, relevance, timeliness, and completeness of records,

(3) Avoid the unauthorized disclosure, either verbal or written, of records, and

(4) Ensure that the Office maintains no system of records without public notice.

(b) Except to the extent that the Privacy Act permits such activities, an employee of the Office of Independent Counsel shall:

(1) Not collect information of a personal nature from individuals unless the employee is authorized to collect such information to perform a function or discharge a responsibility of the Office;

(2) Collect from individuals only that information that is necessary to the performance of the functions or to the discharge of the responsibilities of the Office;

(3) Collect information about an individual directly from that individual, whenever practicable;

(4) Inform each individual from whom information is collected of—

(i) The legal authority that authorizes the Office to collect such information,

(ii) The principal purposes for which the Office intends to use the information,

(iii) The routine uses the Office may make of the information, and

(iv) The effects upon the individual of not furnishing the information;

(5) Maintain all records that are used by the agency in making any determination about any individual with such accuracy, relevance, timeliness, and completeness as to assure fairness to the individual in the determination;

(6) Except as to disclosures to an agency or pursuant to 5 U.S.C. 552a(b)(2), make reasonable efforts, prior to disseminating any record about an individual, to assure that such records are accurate, relevant, timely, and complete;

(7) Maintain no record concerning an individual's religious or political beliefs or activities, or his membership in associations or organizations, unless—

(i) The individual has volunteered such information for his own benefit,

(ii) A statute expressly authorizes the Office to collect, maintain, use or disseminate the information, or

(iii) The individual's beliefs, activities, or membership are pertinent to and within the scope of an authorized law-enforcement or correctional activity;

(8) Notify the head of the Office of the existence or development of any system of records that has not been disclosed to the public;

(9) When required by the Act, maintain an accounting in the prescribed form of all disclosures of records by the Office to agencies or individuals whether verbally or in writing;

(10) Disclose no record to anyone, except within the Office, for any use, unless authorized by the Act;

(11) Maintain and use records with care to prevent the inadvertent disclosure of a record to anyone; and

(12) Notify the head of the Office of any record that contains information that the Act or the foregoing provisions of this paragraph do not permit the Office to maintain.

(c) Not less than once a year, the head of each Office shall review the systems of records maintained by that Office to ensure that the Office is in compliance with the provisions of the Privacy Act.

Nothing in this subpart shall be construed to entitle any person, as of right, to any service or to the disclosure of any record to which such person is not entitled under 5 U.S.C. 552a.