not be confused with, or limited to, the commonly recognized personnel system of records maintained by a civilian personnel office or a military assignment branch. The agency may be maintaining within a single system of records several categories of records relating to Federal personnel and other categories on non-Federal personnel, e.g., contractor personnel, applicants, dependents, etc. Some categories may be covered while others may not. Unlike "Federal personnel," the subjects of record of payroll record systems are easily discerned.

(f) Matching purpose. The purpose of a Federal personnel or payroll records match must be to take some adverse action, financial, personnel, disciplinary, or other adverse action against Federal personnel.

$317.92 Federal benefit matches.

(a) Categories of subjects covered. The Privacy Act provisions cover only the following categories of subjects of record for Federal benefit matches.

(1) Applicants for Federal benefit programs (i.e., individuals initially applying for benefits).

(2) Program beneficiaries (i.e., individuals currently receiving or formerly receiving benefits).

(3) Providers of services to support such programs (i.e., those deriving income from them such as health care providers).

(b) Types of programs covered. Only Federal benefit programs providing cash or in-kind assistance to individuals are covered by the Privacy Act. State programs are not covered. Programs using records about subjects who are not "individuals". See definitions of this part (§ 317.3).

(c) Matching purpose. A Federal benefit match must have as its purpose one or more of the following:

(1) Establishing or verifying initial or continuing eligibility for Federal benefit programs.

(2) Verifying compliance with the requirements, either statutory or regulatory, of such programs.

(3) Recouping payments or delinquent debts under such Federal benefit programs.

(d) Summary of basic requirements. Four basic elements:

(1) Computerized comparison. (2) Categories of subjects.

(3) Federal benefit program, and (4) Matching purpose, must all be present before a matching program is covered under the Privacy Act.

§317.93 Matching program exclusions.

The following are not included under the definition of a matching program. The agency is not required to comply with the computer matching provisions of the Privacy Act, although it may be required to comply with any other applicable provisions of the Act and this part.

(a) Statistical matches whose purpose is solely to produce aggregate data stripped of personal identifiers. This does not mean that the data bases used in the match must be stripped prior to the match, but only that the results of the match must not contain data identifying any individual. Implicit in this exception is that this kind of match is not done to take action against specific individuals.

(b) Statistical matches whose purpose is in support of any research or statistical project. The results of these matches need not be stripped of identifiers, but they must not be used to make decisions that affect the rights, benefits or privileges of specific individuals.

(c) Pilot matches. This exclusion covers small scale sampling matches whose purpose is to gather cost-benefit data on which to premise a decision about engaging in a full-fledged matching program. Pilot matches must be retained in a statistical information gathering channel. It is at this point that the component can decide whether to conduct a statistical data gathering match without consequences to the subjects of record or a full-fledged program where results will be used to take specific action against them. To avoid possible misuse of pilot matches and to ensure full compliance with the Privacy Act, these matches must be approved by the Defense Data Integrity Board.

(d) Law enforcement investigative matches whose purpose is to gather evidence against a named person or persons

system of records of other Federal agencies or data from state and local governments and actually performs the match by computer.

(2) The recipient agency is responsible for publishing a notice in the FEDERAL REGISTER of the matching program. Where a state or local agency is the recipient, the Federal source agency is responsible for publishing the notice.

(3) A Federal source agency discloses the data from a system of records for the match. A non-Federal agency may also be a source, but the record data will not be from a system of records. The "system of records" concept under the Privacy Act does not apply to the recordkeeping practices of state local governmental agencies.

or

(4) The recipient Federal agency, or the Federal source agency in a match performed by a non-Federal agency, is responsible for reporting the match. This agency must contact the other participants to gather the information necessary to make a unified report as required by § 317.100.

(5) In some circumstances, a source agency may be the instigator and ultimate beneficiary of the matching program, as when an agency lacking computer resources uses another agency to perform the match; or when as a practical matter, an agency may not wish to release and disclose its data base to another agency as a source because of privacy safeguard considerations.

(b) Compliance with the system of records and disclosure provisions. (1) The agency must ensure that it identifies the system(s) of records involved in the matching program and has published the necessary notice(s) in the FEDERAL REGISTER.

(2) The Privacy Act does not itself authorize disclosures from system of records for the purpose of conducting a matching program. The agency must justify any disclosures outside the Department of Defense under subsection (b) of the Act. This means obtaining the written consent of the subjects of record for the disclosure or relying on one of the 12 non-consensual disclosures exceptions to the written consent rule. To rely on the routine use exception (b)(3), the agency must have already established the routine use (pub

lished in the FEDERAL REGISTER), or in the alternative, must comply with subsections (e)(4)(d) and (e)(11) of the Act which means amending the record system notice to add an appropriate routine use for the match. An amendment requires publication in the FEDERAL REGISTER with a 30 day waiting period for public comment.

(3) The routine use permitting disclosure for the match must be compatible with and related to the purpose for which the record was initially compiled.

(4) The routine use for the match in a record system notice shall clearly indicate that it entails a computer matching program with a specific agency for an established purpose and intended objective. For purposes of matching, a routine use must state that a disclosure may be made for a matching program. The agency may not rely on an existing established routine use to meet the requirements of the Act unless it expressly permits disclosure for matching purposes.

(c) Prior notice to record subjects. Subjects of record must receive prior notice that their records may be matched. This may be done by direct and/or constructive notice.

(1) Direct notice may be given when there is some form of contact between the government and the subject. Information can be furnished to individuals on the application form when they apply for a benefit, in a notice that arrives with a benefit, or in correspondence they receive in the mail. Use of the advisory Privacy Act Statement is an acceptable manner to provide direct notice to subjects of record at the time of application. The agency shall provide direct notice for front-end eligibility verification matching programs whose purpose is to validate an applicant's initial eligibility for a benefit and later to determine continued eligibility using the Privacy Act Statement on the application form. Providers of services should be given notice (Privacy Act Statement) on the form on which they apply for reimbursement for services provided. Providing notice of matching programs using the Privacy Act Statement shall be part of the normal process of implementing a Federal benefits program. The agency

(Note: In the case of internal DoD matches, the "purpose(s)" element of the system(s) involved.) If non-Federal records are involved, a complete description to include the specific source, address, and category of records to be used, e.g., Human Resources Administration Medicaid File, City of New York, Human Resources Administration, 250 Church Street, New York, NY 10013.

(vi) A complete description of the category of records and individuals covered from the record system(s) to be used, the specific data elements to be matched, and the approximate number of records that will be matched.

(vii) The projected start and ending dates for a one-time match or the inclusive dates for a continuing match.

(viii) The address for receipt of any public comment or inquiries concerning the notice shall indicate: Director, Defense Privacy Office, 400 Army Navy Drive, Room 205, Arlington, VA 22202–2884.

(a) Independent verification and notice. Subjects of record of matching programs shall be afforded certain due process procedures when a match uncovers any disqualifying or adverse information about them. No recipient agency, non-Federal agency, or source agency shall take any adverse action against an individual until such agency has independently verified such information and the individual has received a notice from the agency containing a statement of its findings and gives the individual the opportunity to contest the findings before making a final determination. The agency shall not take any adverse action based on the raw results of a computer matching program. Adverse information developed by a match must be investigated and verified prior to any action being taken.

(b) Waiver of independent verification procedures. Program officials may request the Data Integrity Board waive the independent verification requirement after they have identified the type of matching data eligible for a waiver and conducted a thorough determination of the data's accuracy.

The only data eligible for waiver is that which identifies the individual and the amount of benefits paid under a federal benefit program. The data must not be ambiguous. After the Data Integrity Board determines that the data qualifies for the waiver procedure, the program official must present convincing evidence to the Data Integrity Board of the recipient agency to permit the Board to assert a high degree of confidence in the accuracy of the data. The following elements are examples of evidence which will assist a Board in making such a determination: A description of the databases involved including how the information is acquired and maintained; the system manager's overall assessment of the reliability of the systems and the accuracy of the data they contain; the results of any assessments or audits conducted; any material or significant weaknesses under various statutes; security controls in place; previous security assessments; any historical data relating to program error rates; and any information relating to the currency of the data. If the Board approves the waiver, it will notify the source agency and the program officials.

(c) Independent investigation. Conservation of resources dictates that the procedures for affording due process be flexible and suited to the data being verified and the consequences to the individual of making a mistake. If the source agency has established a high degree of confidence in the quality of its data and it can demonstrate that its quality control processes are rigorous, the recipient agency may choose to expend fewer resources in independently verifying the data. Absolute confirmation is not required. The agency should bring some degree of reasonableness to the process of verifying data. Some methods to consider are:

(1) The individual subject of record who is the best source where practical, and

(2) Researching source documents.

(d) Notice and opportunity to contest. The agency is required to notify matching subjects of adverse information uncovered during a matching program and give them an opportunity to contest and explain before the agency