Privacy Act; implementation: National Imagery and Mapping Agency,

[Federal Register: October 17, 2001 (Volume 66, Number 201)]

[Rules and Regulations]

[Page 52680-52684]

From the Federal Register Online via GPO Access [wais.access.gpo.gov]

[DOCID:fr17oc01-6]

DEPARTMENT OF DEFENSE

National Imagery and Mapping Agency

32 CFR Part 320

[NIMA Instruction 5500.7R1]

Privacy Act; Implementation

AGENCY: National Imagery and Mapping Agency, DoD.

ACTION: Final rule.

SUMMARY: The National Imagery and Mapping Agency (NIMA) is revising its existing Privacy Act procedural and exemption rule. This rule is being adopted as final.

EFFECTIVE DATE: October 9, 2001.

FOR FURTHER INFORMATION CONTACT: Mr. Tom Willess, Associate General Counsel, at (301) 227-2953.

SUPPLEMENTARY INFORMATION: The proposed rule was previously published on August 9, 2001 at 66 FR 41811. No comments were received.

Executive Order 12866, ``Regulatory Planning and Review''.The Director of Administration and Management, Office of the Secretary of Defense, hereby determines that Privacy Act rules for the Department of Defense are not significant rules. The rules do not (1) Have an annual effect on the economy of $100 million or more or adversely affect in a material way the economy; a sector of the economy; productivity; competition; jobs; the environment;

[[Page 52681]]

public health or safety; or State, local, or tribal governments or communities; (2) Create a serious inconsistency or otherwise interfere with an action taken or planned by another Agency; (3) Materially alter the budgetary impact of entitlements, grants, user fees, or loan programs, or the rights and obligations of recipients thereof; or (4) Raise novel legal or policy issues arising out of legal mandates, the President's priorities, or the principles set forth in this Executive order.

Public Law 96-354, ``Regulatory Flexibility Act'' (5 U.S.C. Chapter 6).

The Director of Administration and Management, Office of the Secretary of Defense, hereby certifies that Privacy Act rules for the Department of Defense do not have significant economic impact on a substantial number of small entities because they are concerned only with the administration of Privacy Act systems of records within the Department of Defense.Public Law 96-511, ``Paperwork Reduction Act'' (44 U.S.C. Chapter 35).

The Director of Administration and Management, Office of the Secretary of Defense, hereby certifies that Privacy Act rules for the Department of Defense impose no information requirements beyond the Department of Defense and that the information collected within the Department of Defense is necessary and consistent with 5 U.S.C. 552a, known as the Privacy Act of 1974.Section 202, Public Law 104-4, ``Unfunded Mandates Reform Act'.

The Director of Administration and Management, Office of the Secretary of Defense, hereby certifies that the Privacy Act rulemaking for the Department of Defense does not involve a Federal mandate that may result in the expenditure by State, local and tribal governments, in the aggregate, or by the private sector, of $100 million or more and that such rulemaking will not significantly or uniquely affect small governments.Executive Order 13132, ``Federalism'.

The Director of Administration and Management, Office of the Secretary of Defense, hereby certifies that the Privacy Act rules for the Department of Defense do not have federalism implications. The rules do not have substantial direct effects on the States, on the relationship between the National Government and the States, or on the distribution of power and responsibilities among the various levels of government.

List of Subjects in 32 CFR Part 320

Privacy.

Accordingly, 32 CFR part 320 is revised as follows:

PART 320--NATIONAL IMAGERY AND MAPPING AGENCY PRIVACY PROGRAM

Sec. 320.1 Purpose and scope. 320.2 Definitions. 320.3 Responsibilities 320.4 Procedures for requesting information. 320.5 Disclosure of requested information. 320.6 Requests for correction or amendment to record. 320.7 Agency review of request for correction or amendment of record. 320.8 Appeal of initial adverse agency determination on correction or amendment. 320.9 Disclosure of record to person other than the individual to whom it pertains. 320.10 Fees. 320.11 Penalties. 320.12 Exemptions.

Authority: Pub. L. 93-579, 88 Stat. 1986 (5 U.S.C. 552a).

Sec. 320.1 Purpose and scope.

(a) This part is published pursuant to the Privacy Act of 1974, as amended (5 U.S.C. 552a), (hereinafter the ``Privacy Act''). This part:

(1) Establishes or advises of the procedures whereby an individual can:

(i) Request notification of whether the National Imagery and Mapping Agency (NIMA) maintains or has disclosed a record pertaining to him in any nonexempt system of records,

(ii) Request a copy or other access to such a record or to an accounting of its disclosure,

(iii) Request that the record be amended and

(iv) Appeal any initial adverse determination of any such request;

(2) Specifies those systems of records which the Director, Headquarters NIMA has determined to be exempt from the procedures established by this regulation and from certain provisions of the Privacy Act. NIMA policy encompasses the safeguarding of individual privacy from any misuse of NIMA records and the provision of the fullest access practicable to individuals to NIMA records concerning them.

Sec. 320.2 Definitions.

As used in this part:

(a) Appellate authority (AA). A NIMA employee who has been granted authority to review the decision of the Initial Denial Authority (IDA) that has been appealed by the Privacy Act requester and make the appeal determination for NIMA on the release ability of the records in question.

(b) Individual. A living person who is a citizen of the United States or an alien lawfully admitted for permanent residence. The parent of a minor or the legal guardian of any individual also may act on behalf of an individual. Corporations, partnerships, sole proprietorships, professional groups, businesses, whether incorporated or unincorporated, and other commercial entities are not ``individuals''.

(c) Initial denial authority (IDA). A NIMA employee, or designee, who has been granted authority to make an initial determination for NIMA that records requested in a Privacy Act request should be withheld from disclosure or release.

(d) Maintain. Includes maintain, collect, use or disseminate.

(e) Personal information. Information about an individual that identifies, relates to or is unique to, or describes him or her; e.g., a social security number, age, military rank, civilian grade, marital status, race, or salary, home/office phone numbers, etc.

(f) Record. Any item, collection, or grouping of information, whatever the storage media (e.g., paper, electronic, etc.), about an individual that is maintained by NIMA, including, but not limited to education, financial transactions, medical history, criminal or employment history, and that contains the individual's name or the identifying number, symbol or other identifying particulars assigned to the individual such as a finger or voice print or a photograph.

(g) Routine use. The disclosure of a record outside the Department of Defense for a use that is compatible with the purpose for which the information was collected and maintained by the Department of Defense. The routine use must be included in the published system notice for the system of records involved.

(h) System of records. A group of records under the control of NIMA from which personal information is retrieved by the individual's name or by some identifying number, symbol, or other identifying particular assigned to the individual.

(i) System manger. The NIMA official who is responsible for the operation and management of a system of records.

Sec. 320.3 Responsibilities.

(a) Director of NIMA:

(1) Implements the NIMA privacy program.

(2) Designates the Director of the Public Affairs Office as the NIMA Initial Denial Authority;

(3) Designates the Chief of Staff as the Appellate Authority.

(4) Designates the General Counsel as the NIMA Privacy Act Officer and the principal point of contact for matters involving the NIMA privacy program.

[[Page 52682]]

(b) NIMA General Counsel:

(1) Oversees systems of records maintained throughout NIMA, administered by Information Services. This includes coordinating all notices of new systems of records and changes to existing systems for publication in the Federal Register.

(2) Coordinates all denials of requests for access to or amendment of records.

(3) Assesses and collects fees for costs associated with processing Privacy Act requests and approves or denies requests for fee waivers. Fees collected are forwarded through Financial Management Directorate to the U.S. Treasury.

(4) Prepares the annual report to the Defense Privacy Office.

(5) Oversees investigations of allegations of unauthorized maintenance, disclosure, or destruction of records.

(6) Conducts or coordinates Privacy Act training for NIMA personnel as needed, including training for public affairs officers and others who deal with the public and news media.

(c) NIMA System Managers:

(1) Ensure that all personnel who either have access to a system of records or who are engaged in developing or supervising procedures for handling records in a system of records are aware of their responsibilities for protecting personal information.

(2) Prepare notices of new systems of records and changes to existing systems for publication in the Federal Register.

(3) Ensure that no records subject to this part are maintained for which a systems notice has not been published.

(4) Respond to requests by individuals for access, correction, or amendment to records maintained pursuant to the NIMA privacy program.

(5) Provide recommendations to General Counsel for responses to requests from individuals for access, correction, or amendment to records.

(6) Safeguard records to ensure that they are protected from unauthorized alteration or disclosure.

(7) Dispose of records in accordance with accepted records management practices to prevent inadvertent compromise. Disposal methods such as tearing, burning, melting, chemical decomposition, pulping, pulverizing, shredding, or mutilation are considered adequate if the personal data is rendered unrecognizable or beyond reconstruction.

Sec. 320.4 Procedures for requesting information.

(a) Upon request in person or by mail, any individual, as defined in Sec. 320.2, shall be informed whether or not any NIMA system of records contains a record pertaining to him.

(b) Any individual requesting such information in person may appear at NIMA General Counsel Office (refer to the NIMA address list at paragraph (e) of this section) or at the NIMA office thought to maintain the record in question and shall provide:

(1) Information sufficient to identify the record, e.g., the individual's own name, date of birth, place of birth, and, if possible, an indication of the type of record believed to contain information concerning the individual, and

(2) Acceptable identification to verify the individual's identity, e.g., driver's license, employee identification card or Medicare card.

(c) Any individual requesting such information by mail shall address the request to the Office of General Counsel (refer to paragraph (e) of this section) or NIMA office thought to maintain the record in question and shall include in such request the following:

(1) Information sufficient to identify the record, e.g., the individual's own name, date of birth, place of birth, and, if possible, an indication of the type of record believed to contain information concerning the individual, and

(2) A notarized statement or unsworn declaration in accordance with 28 U.S.C. 1746 to verify the individual's identity, if, in the opinion of the NIMA system manager, the sensitivity of the material involved warrants.

(d) NIMA procedures on requests for information. Upon receipt of a request for information made in accordance with these regulations, notice of the existence or nonexistence of any records described in such requests will be furnished to the requesting party within ten working days of receipt.

(e) Written requests for access to records should be sent to NIMA Bethesda, ATTN: NIMA/GC, Mail Stop D-10, 4600 Sangamore Road, Bethesda, MD 20816-5003.

(f) Requests for information made under the Freedom of Information Act are processed in accordance with ``DoD Freedom of Information Act Program Regulation'' (32 CFR part 286).

(g) Requests for personal information from the Government Accounting Office (GAO) are processed in accordance with DoD Directive 7650.1 \1\ ``GAO Access to Records''.

\1\ Copies may be obtained via Internet at http://www.dtic.mil/ whs/directives

Sec. 320.5 Disclosure of requested information.

(a) Upon request by an individual made in accordance with the procedures set forth in this section, such individual shall be granted access to any pertinent record which is contained in a nonexempt NIMA system of records. However, nothing in this section shall allow an individual access to any information compiled by NIMA in reasonable anticipation of a civil or criminal action or proceeding.

(b) Procedures for requests for access to records. Any individual may request access to a pertinent NIMA record in person or by mail.

\1\ Copies may be obtained via Internet at http://www.dtic.mil/ whs/directives

(1) Any individual making such request in person shall appear at Office of General Counsel, NIMA Bethesda, ATTN: NIMA/GC, Mail Stop D- 10, 4600 Sangamore Road, Bethesda, MD 20816-5003, and shall provide identification to verify the individuals' identity, e.g., driver's license, employee identification card, or Medicare card.

(2) Any individual making a request for access to records by mail shall address such request to the Office of General Counsel, NIMA Bethesda, ATTN: NIMA/GC, Mail Stop D-10, 4600 Sangamore Road, Bethesda, MD 20816-5003; and shall include therein a signed, notarized statement, or an unsworn statement or declaration in accordance with 28 U.S.C. 1746, to verify identity.

(3) Any individual requesting access to records under this section in person may be accompanied by a person of the individual's own choosing while reviewing the record requested. If an individual elects to be so accompanied, said individual shall give notice of such election in the request and shall provide a written statement authorizing disclosure of the record in the presence of the accompanying person. Failure to so notify NIMA in a request for access shall be deemed to be a decision by the individual not to be accompanied.

(c) NIMA determination of requests for access.

(1) Upon receipt of a request made in accordance with this section, the NIMA Office of General Counsel or NIMA office having responsibility for maintenance of the record in question shall release the record, or refer it to an Initial Denial Authority, who shall:

(i) Determine whether such request shall be granted.

(ii) Make such determination and provide notification within 30 working days after receipt of such request.

(iii) Notify the individual that fees for reproducing copies of records will be assessed and should be remitted before the copies may be delivered. Fee schedule and rules for assessing fees are contained in Sec. 320.9.

(iv) Requests for access to personal records may be denied only by an agency official authorized to act as an

[[Page 52683]]

Initial Denial Authority or Final Denial Authority, after coordination with the Office of General Counsel.

(2) If access to a record is denied because such information has been compiled by NIMA in reasonable anticipation of a civil or criminal action or proceeding, the individual will be notified of such determination and his right to judicial appeal under 5 U.S.C. 552a(g).

(d) Manner of providing access.

(1) If access is granted, the individual making the request shall notify NIMA whether the records requested are to be copied and mailed.

(2) If the records are to be made available for personal inspection the individual shall arrange for a mutually agreeable time and place for inspection of the record. NIMA reserves the right to require the presence of a NIMA officer or employee during personal inspection of any record pursuant to this section and to request of the individual that a signed acknowledgment of the fact be provided that access to the record in question was granted by NIMA.

Sec. 320.6 Request for correction or amendment to record.

(a) Any individual may request amendment of a record pertaining to said individual.

(b) After inspection of a pertinent record, the individual may file a request in writing with the NIMA Office of General Counsel for amendment. Such requests shall specify the particular portions of the record to be amended, the desired amendments and the reasons, supported by documentary proof, if available.

Sec. 320.7 Agency review of request for correction or amendment of record.

(a) Not later than 10 working days after receipt of a request to amend a record, in whole or in part, the NIMA Office of General Counsel, or NIMA office having responsibility for maintenance of the record in question, shall correct any portion of the record which the individual demonstrates is not accurate, relevant, timely or complete, and thereafter either inform the individual of such correction or process the request for denial.

(b) Denials of requests for amendment of a record will be made only by an agency official authorized to act as an Initial Denial Authority, after coordination with the Office of General Counsel. The denial letter will inform the individual of the denial to amend the record setting forth the reasons therefor and notifying the individual of his right to appeal the decision to NIMA.

(c) Any person or other agency to whom the record has been previously disclosed shall be informed of any correction or notation of dispute with respect to such records.

(d) These provisions for amending records are not intended to permit the alteration of evidence previously presented during any administrative or quasi-judicial proceeding, such as an employee grievance case. Any changes in such records should be made only through the established procedures for such cases. Further, these provisions are not designed to permit collateral attack upon what has already been the subject of an administrative or quasi-judicial action. For example, an individual may not use this procedure to challenge the final decision on a grievance, but the individual would be able to challenge the fact that such action has been incorrectly recorded in his file.

Sec. 320.8 Appeal of initial adverse agency determination on correction or amendment.

(a) An individual whose request for amendment of a record pertaining to him may further request a review of such determination in accordance with this section.

(b) Not later than 30 working days following receipt of notification of denial to amend, an individual may file an appeal of such decision with NIMA. The appeal shall be in writing, mailed or delivered to NIMA, ATTN: Mail Stop D-10, 4600 Sangamore Road, Bethesda, MD 20816-5003. The appeal must identify the records involved, indicate the dates of the request and adverse determination, and indicate the express basis for that determination. In addition, the letter of appeal shall state briefly and succinctly the reasons why the adverse determination should be reversed.

(c) Upon appeal from a denial to amend a record the NIMA Appellate Authority or designee shall make a determination whether to amend the record and must notify the individual of that determination by mail, not later than 10 working days after receipt of such appeal, unless extended pursuant to paragraph (d) of this section.

(1) The Appellate Authority or designee shall also notify the individual of the provisions of the Privacy Act of 1974 regarding judicial review of the NIMA Appellate Authority's determination.

(2) If on appeal the denial to amend the record is upheld, the individual shall be permitted to file a statement setting forth the reasons for disagreement with the Appellate Authority's determination and such statement shall be appended to the record in question.

(d) The Appellate Authority or designee may extend up to 30 days the time period in which to make a determination on an appeal from denial to amend a record for the reason that a fair and equitable review cannot be completed within the prescribed time period.

Sec. 320.9 Disclosure of record to person other than the individual to whom it pertains.

(a) No officer or employee of NIMA will disclose any record which is contained in a system of records, by any means of communication to any person or agency within or outside the Department of Defense without the request or consent of the individual to whom the record pertains, except as described in to 32 CFR 310.41; Appendix C to part 310 of this chapter; and/or a NIMA Privacy Act system of records notice.

(b) Any such record may be disclosed to any person or other agency only upon written request, of the individual to whom the record pertains.

(c) In the absence of a written consent from the individual to whom the record pertains, such record may be disclosed only provided such disclosure is:

(1) To those officers and employees of the DoD who have a need for the record in the performance of their duties.

(2) Required under the Freedom of Information Act (32 CFR part 286).

(3) For a routine use established within the system of records notice.

(4) To the Bureau of Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of title 13.

(5) To a recipient who has provided the NIMA with adequate advance written assurance that the record will be used solely as a statistical research or reporting record and the record is transferred in a form that is not individually identifiable and will not be used to make any decisions about the rights, benefits or entitlements of an individual.

(6) To the National Archives of the United States as a record which has sufficient historical or other value to warrant its continued preservation by the U.S. Government or for evaluation by the Administrator of the General Services Administration or his designee to determine whether the record has such value.

(7) To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the U.S. for a civil or criminal law enforcement activity authorized by law,

[[Page 52684]]

provided the head of the agency or instrumentality has made a prior written request to the Director, NIMA specifying the particular record and the law enforcement activity for which it is sought.

(8) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual, if upon such disclosure notification is transmitted to the last known address of such individual.

(9) To either house of Congress, and, to the extent of the matter within its jurisdiction, any committee or subcommittee or joint committee of Congress.

(10) To the Comptroller General or any of his authorized representatives in the course of the performance of the duties of the GAO.

(11) Under an order of a court of competent jurisdiction.

(12) To a consumer reporting agency in accordance with section 3711(f) of title 31.

(d) Except for disclosures made pursuant to paragraphs (c)(1) and (2) of this section, an accurate accounting will be kept of the data, nature and purpose of each disclosure of a record to any person or agency, and the name and address of the person or agency to whom the disclosure was made. The accounting of disclosures will be made available for review by the subject of a record at his request except for disclosures made pursuant to paragraph (c)(7) of this section. If an accounting of disclosure has been made, any person or agency contained therein will be informed of any correction or notation of dispute made pursuant to section 320.6 of this part.

Sec. 320.10 Fees.

Individuals may request copies for retention of any documents to which they are granted access to NIMA records pertaining to them. Requesters will not be charged for the first copy of any records provided; however, duplicate copies will require a charge to cover costs of reproduction. Such charges will be computed in accordance with 32 CFR part 310.

Sec. 320.11 Penalties.

The Privacy Act of 1974 (5 U.S.C. 552a(i)(3)) makes it a misdemeanor subject to a maximum fine of $5,000, to knowingly and willfully request or obtain any record concerning an individual under false pretenses. The Act also establishes similar penalties for violations by NIMA employees of the Act or regulations established thereunder.

Sec. 320.12 Exemptions.

(a) Exempt systems of record. All systems of records maintained by the NIMA and its components shall be exempt from the requirements of 5 U.S.C. 552a(d) pursuant to 5 U.S.C. 552a(k)(1) to the extent that the system contains any information properly classified under Executive Order 12958 and that is required by Executive Order to be withheld in the interest of national defense or foreign policy. This exemption is applicable to parts of all systems of records, including those not otherwise specifically designated for exemptions herein, which contain isolated items of properly classified information.

(b) [Reserved].

Dated: October 11, 2001. L.M. Bynum, Alternate OSD Federal Register Liaison Officer, Department of Defense.

[FR Doc. 01-26072Filed10-16-01; 8:45 am]

BILLING CODE 5001-08-P