Subpart 1212.6-Instructions for NASA Employees

§ 1212.600 General policy.

In compliance with the Privacy Act and in accordance with the requirements and procedures of this regulation, NASA has an obligation to:

(a) Advise individuals, when requested, as to whether any specific system of records maintained by NASA contains records pertaining to them;

(b) Prevent records being maintained by NASA in a system of records for a specific purpose from being used or made available for another purpose without the individual's consent; and,

(c) Permit individuals to have access to information about themselves in a NASA system of records, to have a copy made, and, if appropriate under Subpart 1212.3 of this part, to amend the records.

§ 1212.601 Maintenance and publication requirements for systems of records.

(a) In maintaining systems of records, NASA shall:

(1) Maintain any record in a system of records for necessary and lawful purposes only, assure that the information is current and accurate for its intended use, and provide adequate safeguards to prevent misuse of the information.

(2) Maintain only information about an individual relevant and necessary to accomplish a purpose or to carry out a function of NASA authorized by law or by Executive order of the President.

(3) Maintain records used by NASA officials in making any determination about any individual with such accuracy, relevance, timeliness, and completeness reasonably necessary to assure fairness to the individual in making the determination.

(4) Maintain no record describing how an individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute, by the individual about whom the record is maintained or unless pertinent to and within the scope of an authorized law enforcement activity.

(5) Maintain and provide access to records of other agencies under NASA's control consistent with the regulations of this part.

(b) Any system of records maintained by NASA which is in addition to or substantially different from a Governmentwide systems of records described in a systems notice published by another agency shall be regarded as a NASA system of records subject to the requirements of this part, and the NASA system notice shall include a reference to the system notice of the other agency.

(c) NASA shall provide adequate advance notice to Congress and OMB of any proposal to establish a new system of records or alter any existing system of records as prescribed by OMB Circular No. A-130, Appendix I.

§ 1212.602 Requirements for collecting

information.

In collecting information for systems of records, the following requirements shall be met:

(a) Information shall be collected to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual's rights, benefits, and privileges under Federal programs. Exceptions to this policy may be made under certain circumstances, such as one of the following:

(1) There is a need to verify the accuracy of the information supplied by an individual.

(2) The information can only be obtained from a third party.

(3) There is no risk that information collected from third parties, if inaccurate, could result in an adverse determination to the individual concerned.

(4) Provisions are made to verify with the individual information collected from a third party.

(b) Each individual who is asked to supply information shall be informed of the following:

(1) The authority (whether granted by statute, or by Executive order of the President) for requesting the information;

(2) Whether disclosure is mandatory or voluntary;

(3) The intended official use of the information;

§ 1212.605 Safeguarding information in systems of records.

(a) Safeguards appropriate for a NASA system of records shall be developed by the system manager in a written plan approved by the Installation Security Officer.

(b) When records or copies of records are distributed within NASA they shall be prominently identified as records protected under the Privacy Act and shall be subject to the same safeguard, retention, and disposition requirements applicable to the system of records.

(c) When records or copies of records are distributed to other Federal agencies, other than those having custody of the systems of records, they shall be prominently identified as records protected under the Privacy Act.

(d) Records that are otherwise required by law to be released to the pub

lic need not be safeguarded or identified as Privacy Act records.

§ 1212.606 Duplicate copies of records or portions of records.

(a) NASA officials may maintain and use, for official purposes, duplicate copies of records or portions of records from a system of records maintained by their own organizational unit. This practice should occur only where there are justifiable organizational needs for it, e.g., where geographic distances make use of the system of records time consuming or inconvenient. These duplicate copies shall not be considered a separate NASA system of records. For example, an office head or designee may keep duplicate copies of personnel, training, or similar records on employees within the organization for administrative convenience purposes.

(b) No disclosure shall be made from duplicate copies outside of the organizational unit. Any outside request for disclosure shall be referred to the appropriate system manager for response. (c) Duplicate copies are subject to the same safeguard requirements applicable to the system of records.

Subpart 1212.7-NASA Authority and Responsibilities

§ 1212.700 NASA employees.

(a) Each NASA employee is responsible for adhering to the requirements of the Privacy Act and this regulation.

(b) An employee shall not seek or obtain access to a record in a NASA system of records or to copies of any portion of such records under false pretenses. Only those employees with an official "need to know" may seek and obtain access to records pertaining to others.

(c) Employees shall refrain from discussing or disclosing personal information about others which they have obtained because of their official need to know such information in the performance of official duties.

(d) To the extent included in a contract which provides for the maintenance by or on behalf of NASA of a system of records to accomplish a function of NASA, the requirements of this section shall apply to contractor employees who work under the contract.

(a) The Associate Administrator for Management Systems and Facilities is responsible for the following:

(1) Providing overall supervision and coordination of NASA's policies and procedures under this regulation;

(2) Approving system notices for publication in the FEDERAL REGISTER;

(3) Assuring that NASA employees and officials are informed of their responsibilities and that they receive appropriate training for the implementation of these requirments; and,

(4) Preparing and submitting the biennial report on implementation of the Privacy Act to OMB and special reports required under this regulation, including establishing appropriate reporting procedures in accordance with OMB Circular No. A-130.

(b) The Associate Administrator for Management Systems and Facilities may establish a position of ‘NASA Privacy Officer,' or designate someone to function as such an officer, reporting directly to the Associate Administrator for Management Systems and Facilities, and delegate to that officer any of the functions described in paragraph (a) of this section.

§ 1212.703 Headquarters and Field or Component Installations.

(a) Officials-in-Charge of Headquarters Offices, Directors of NASA Field Installations and Officials-inCharge of Component Installations are responsible for the following with respect to those systems of records maintained in their organization:

(1) Avoiding the establishment of new systems of records or new routine uses

of a system of records without first complying with the requirements of this regulation;

(2) Ensuring that the requirements of this regulation and the Privacy Act are followed by employees;

(3) Ensuring that there is appropriate coordination within NASA before a determination is made to disclose information without the individual's consent under authority of 5 U.S.C. 552a(b) (See § 1212.203(g)); and

(4) Providing appropriate oversight for responsibilities and authorities exercised by system managers under their jurisdiction (§ 1212.704).

(b) Directors of NASA Field Installations and Officials-in-Charge of Component Installations or designees may establish a position of installation Privacy Officer to assist in carrying out the responsibilities listed in paragraph (a) of this section.

§ 1212.704 System manager.

(a) Each system manager is responsible for the following with regard to the system of records over which the system manager has cognizance:

(1) Overall compliance with the "Privacy Act-NASA Regulations" (NASA Management Instruction (NMI) 1382.17) and the Computer Matching Program (NMI 1382.18);

(2) Ensuring that each person involved in the design, development, operation, or maintenance of the system of records is instructed with respect to the requirements of this regulation and the possible penalties for noncompliance;

(3) Submitting a request to the Assistant Deputy Administrator for an exemption of the system under subpart 1212.5 of this part, setting forth in proposed rulemaking form the reasons for the exemption and citing the specific provision of the Privacy Act which is believed to authorize the exemption;

(4) After consultation with the Office of the General Counsel or the Chief Counsel, making reasonable efforts to serve notice on an individual when any record on such individual is made available to any person under compulsory legal process when such process becomes a matter of public record;

(5) Making an initial determination on an individual's request to correct or

of a

(7) Authorizing disclosures record without the individual's consent under § 1212.203(g)(1) through (12);

(8) Responding within the requirements of § 1212.200 to an individual's request for information as to whether the system contains a record pertaining to the individual;

(9) Responding to an individual's request for access and copying of a record, in accordance with subpart 1212.2 of this part;

(10) Amending a record under subpart 1212.3 of this part, or filing in an individual's record a statement of dispute;

(11) Preparing an addendum to an individual's statement of dispute to be filed in the individual's records, in accordance with § 1212.401;

(12) Maintaining disclosure accountings in accordance with 5 U.S.C. 552a(c) and 14 CFR 1212.203. This includes records disclosed pursuant to any computer matching programs;

(13) Notifying persons to whom a record has been disclosed and for which an accounting was made as to disputes and corrections involving the record; and

(14) Developing appropriate safeguards for the system of records in accordance with §1212.605(a).

(b) Where a system of records has subsystems described in the system notice, the subsystem manager will have the responsibilities outlined in paragraph (a) of this section. Although the system manager has no line authority over subsystem managers, the system manager does have overall functional responsibility for the total system, and may issue guidance to subsystem managers on implementation of this part. When furnishing information for required reports, the system manager will be responsible for reporting the entire system of records, including any subsystems.

(c) Exercise of the responsibilities and authorities in paragraph (a) of this section by any system or subsystem managers at a NASA Installation shall

be subject to any conditions or limitations imposed in accordance with § 1212.703 (a)(4) and (b).

81212.705 Assistant Administrator for

Procurement.

The Assistant Administrator for Procurement is responsible for developing appropriate procurement regulations and procedures under which NASA contracts requiring the maintenance of a system of records in order to accomplish a NASA function are made subject to the requirements of this part.

§ 1212.706 Delegation of authority.

Authority necessary to carry out the responsibilities specified in this regulation is delegated to the officials named, subject to any conditions or limitations imposed in accordance with this subpart 1212.7.

Subpart 1212.8-Failure To Comply With Requirements of This Part

§ 1212.800 Civil remedies.

Failure to comply with the requirements of the Privacy Act and this part could subject NASA to civil suit under the provisions of 5 U.S.C. 552a(g).

§ 1212.801 Criminal penalties.

(a) A NASA officer or employee may be subject to criminal penalties under the provisions of 5 U.S.C. 552a(i)(1) and (2).

(1) Section 552a(i)(1). Any officer or employee of an agency, who by virtue of employment or official position, has possession of, or access to, agency records which contain individually identifiable information the disclosure of which is prohibited by this section or by rules or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

(2) Section 552a(i)(2). Any officer or employee of any agency who willfully maintains a system of records without meeting the notice requirements of subsection (e)(4) of this section shall be

(a) Consistent with NASA statutory responsibility, NASA will “* * * provide for the widest practicable and appropriate dissemination of information concerning its activities and the results thereof, * * *”

(b) Release of information concerning NASA activities and the results will be made promptly, factually and completely. Exceptions include that information whch may be exempt from disclosure under the "Freedom of Information Act" (5 U.S.C. 552, as amended) (14 CFR Part 1212). For classified DoD

missions on the National Space Transportation System (NSTS), release of information concerning NASA activities will be restricted by the STS Security Classification Guide. In addition, information concerning the survivability/vulnerability of the NSTS may be classified for all NSTS operations.

(c) NASA will respond promptly to queries from the information media and industry, and cooperate with contractors in their release of NASA related informational material including

advertising.

(d) NASA officials may participate in interviews and speak for the Agency in areas of their assigned responsibility. § 1213.102 Responsibility.

(a) The Associate Administrator for Public Affairs is responsible for the development and overall administration of an integrated Agencywide communications program and determines whether the specific information is to be released. The Associate Administrator for Public Affairs will:

(1) Direct and coordinate all Headquarters and agencywide public information activities.

(2) Direct and coordinate all agencywide news-oriented audiovisual activities.

(b) In accordance with §1213.104, the Public Affairs Officers assigned to Headquarters Program and Staff Of

fices

are responsible for developing plans and coordinating all public information activities covering their respective programs at Headquarters and in the field.

(c) In accordance with §1213.104, Directors of Field Installations, through their Public Affairs Officers, are responsible for initiating and obtaining concurrences for information programs and public releases issued by their respective installation and component installations.

(d) The requirements of this section do not apply to the Office of Inspector General (IG) regarding IG activities.

[52 FR 45936, Dec. 3, 1987, as amended at 56 FR 66787, Dec. 26, 1991]