(a) In general. NACIC components shall devote such personnel and other resources to the responsibilities imposed by the Privacy Act as may be appropriate and reasonable considering:

(1) The totality of resources available to the component,

(2) The business demands imposed on the component by the Director, NACIC or otherwise by law,

(3) The information review and release demands imposed by the Congress or other governmental authority, and

(4) The rights of all members of the public under the various information review and disclosure laws.

(b) Discharge of Privacy Act responsibilities. Offices shall exercise due diligence in their responsibilities under the Privacy Act and must allocate a reasonable level of resources to requests under the Act in a strictly “first-in, first-out” basis and utilizing two or more processing queues to ensure that smaller as well as larger (i.e., project) cases receive equitable attention. The Information and Privacy Coordinator is responsible for management of the NACIC-wide program defined by this part and for establishing priorities for cases consistent with established law. The Director, NACIC shall provide policy and resource direction as necessary and shall render decisions on administrative appeals.

(c) Requests for extension of time. While the Privacy Act does not specify time requirements, our joint treatment of requests under the FOIA means that when NACIC is unable to meet the statutory time requirements of the FOIA, NACIC may request additional time from a requester. In such instances NACIC will inform a requester of his or her right to decline our request and proceed with an administrative appeal or judicial review as appropriate.