(a) In general. Agency components shall devote such personnel and other resources to the responsibilities imposed by the Privacy Act as may be appropriate and reasonable considering:

(1) The totality of resources available to the component,

(2) The business demands imposed on the component by the Director of Central Intelligence or otherwise by law,

(3) The information review and release demands imposed by the Congress or other governmental authority, and

(4) The rights of all members of the public under the various information review and disclosure laws.

(b) Discharge of Privacy Act responsibilities. Components shall exercise due diligence in their responsibilities under the Privacy Act and must allocate a reasonable level of resources to requests under the Act in a strictly “first-in, first-out” basis and utilizing two or more processing queues to ensure that smaller as well as larger (i.e., project) cases receive equitable attention. The Information and Privacy Coordinator is responsible for management of the Agency-wide program defined by this part and for establishing priorities for cases consistent with established law. The Director, Information Management through the Agency Release Panel shall provide policy and resource direction as necessary and shall make determinations on administrative appeals.

(c) Requests for extension of time. While the Privacy Act does not specify time requirements, our joint treatment of requests under the FOIA means that when the Agency is unable to meet the statutory time requirements of the FOIA, the Agency may request additional time from a requester. In such instances the Agency will inform a requester of his or her right to decline our request and proceed with an administrative appeal or judicial review as appropriate.