(a) Authorized officials. Only the PCII Program Manager is authorized to validate and mark information submitted for protection outside of a categorical inclusion as PCII. The PCII Program Manager or a Program Manager's Designee may mark information qualifying for protection under categorical inclusions pursuant to paragraph (f) of this section as PCII.

(b) Presumption of protection. All information submitted in accordance with the procedures set forth in § 29.5 of this part will be presumed to be and will be treated as PCII, enjoying the protections of the CII Act, from the time the information is received by the PCII Program Office or a PCII Program Manager's Designee. The information must remain protected unless and until the PCII Program Office renders a final decision that the information is not PCII. The PCII Program Office will, with respect to information that is not properly submitted, inform the submitting person or entity within thirty calendar days of receipt, by a means of communication to be prescribed by the PCII Program Manager, that the submittal was procedurally defective. The submitter will then have an additional thirty calendar days to remedy the deficiency from the date of receipt of such notification by the PCII Program Office. If the submitting person or entity does not cure the deficiency within thirty calendar days after the date of receipt of the notification provided by the PCII Program Office in this paragraph, the PCII Program Office may determine that the presumption of protection is terminated. Under such circumstances, the PCII Program Office may cure the deficiency by labeling the submission with the information required in § 29.5 or may notify the applicant that the submission does not qualify as PCII. No CII submission will lose its presumptive status as PCII except as provided in paragraph (g) of this section.

(c) Marking of information. All PCII must be clearly identified through markings made by the PCII Program Office. The PCII Program Office will mark PCII materials as follows: “This document contains PCII. In accordance with the provisions of 6 CFR part 29, this document is exempt from release under the Freedom of Information Act (5 U.S.C. 552(b)(3)) and similar laws requiring public disclosure. Unauthorized release may result in criminal and administrative penalties. This document is to be safeguarded and disseminated in accordance with the CII Act and PCII Program requirements.” When distributing PCII, the distributing person must ensure that the distributed information contains this marking.

(d) Acknowledgement of receipt of information. The PCII Program Office or a PCII Program Manager's Designee will acknowledge receipt of information submitted as CII and accompanied by an express statement, and in so doing will:

(1) Contact the submitting person or entity, within thirty calendar days of receipt of the submission of CII, by the means of delivery prescribed in procedures developed by the PCII Program Manager. In the case of oral submissions, receipt will be acknowledged in writing within thirty calendar days after receipt by the PCII Program Office or a PCII Program Manager's Designee of a written statement, certification, and documents that memorialize the oral submission, as referenced in § 29.5(a)(3)(ii);

(2) Enter the appropriate data into the PCIIMS as required in § 29.4(e); and

(3) Provide the submitting person or entity with a unique tracking number that will accompany the information from the time it is received by the PCII Program Office or a PCII Program Manager's Designee.

(e) Validation of information. (1) The PCII Program Manager is responsible for reviewing all submissions that request protection under the CII Act. The PCII Program Manager will review the submitted information as soon as practicable. If a final determination is made that the submitted information meets the requirements for protection, the PCII Program Manager must ensure that the information has been marked as required in paragraph (c) of this section, notify the submitting person or entity of the determination, and disclose it only pursuant to § 29.8.

(2) If the PCII Program Office makes an initial determination that the information submitted does not meet the requirements for protection under the CII Act, the PCII Program Office will:

(i) Notify the submitting person or entity of the initial determination that the information is not considered to be PCII. This notification also will, as necessary:

(A) Request that the submitting person or entity complete the requirements of § 29.5(a) or further explain the nature of the information and the submitting person or entity's basis for believing the information qualifies for protection under the CII Act;

(B) Advise the submitting person or entity that the PCII Program Office will review any further information provided before rendering a final determination;

(C) Advise the submitting person or entity that the submission can be withdrawn at any time before a final determination is made;

(D) Notify the submitting person or entity that until a final determination is made the submission will be treated as PCII;

(E) Notify the submitting person or entity that any response to the notification must be received by the PCII Program Office no later than thirty calendar days after the date of the notification; and

(F) Request the submitting person or entity to state whether, in the event the PCII Program Office makes a final determination that any such information is not PCII, the submitting person or entity prefers that the information be maintained without the protections of the CII Act, returned to the submitting person or entity, or destroyed. If a request for return is made, all such information will be returned to the submitting person or entity.

(ii) If the information submitted has not been withdrawn by the submitting person or entity, the PCII Program Office will return the information to the submitter in accordance with the submitting person or entity's written preference and the procedures set forth in paragraph (e)(2)(i) of this section within thirty calendar days of making a final determination that the information submitted is not eligible for protections under the CII Act. If the submitting person or entity cannot be notified or the submitting person or entity's response is not received within thirty calendar days of the date of the notification as provided in paragraph (e)(2)(i) of this section, the PCII Program Office will make the initial determination final and return the information to the submitter. If return to the submitter is impractical, the PCII Program Office will destroy the information within thirty calendar days. This process is consistent with the appropriate National Archives and Records Administration-approved records disposition schedule.

(f) Categorical Inclusions of Certain Types of CII as PCII. The PCII Program Manager has discretion to declare certain subject matter or types of information categorically protected as PCII and to set procedures for receipt and processing of such information. Information within a categorical inclusion will be considered validated upon receipt by the PCII Program Manager or any of the PCII Program Manager's Designees without further review, provided that the submitter provides the express statement required by § 29.5(a)(3). The PCII Program Manager's designees will provide to the PCII Program Office information submitted under a categorical inclusion.

(g) Changing the status of PCII to non-PCII. Once information is validated, only the PCII Program Manager may change the status of PCII to that of non-PCII and remove its PCII markings. Status changes may only take place when the submitting person or entity requests in writing that the information no longer be protected under the CII Act; or when the PCII Program Office determines that the information was, at the time of the submission, customarily in the public domain. Upon making an initial determination that a change in status may be warranted, but prior to a final determination, the PCII Program Office, using the procedures in paragraph (e)(2) of this section, will inform the submitting person or entity of the initial determination of a change in status. Notice of the final change in status of PCII will be provided to all recipients of PCII received under § 29.8.