disclosure under the provisions of the Freedom of Information Act.

(3) Access to a record or a copy thereof will not be denied solely because the record's physical presence is not readily available, i.e., on magnetic tape, or because the context of the record may disclose sensitive information about another individual. To protect the personal privacy of other individuals who may be identified in a record, an extract shall be prepared deleting only that information which would not be released to the requesting individual under the Freedom of Information Act.

(4) A medical record shall be disclosed to the individual to whom it pertains unless, in the judgment of a physician, access to such record could have an adverse effect upon the individual's physical or mental health. When it has been determined that the disclosure of medical information could have an adverse effect upon the individual to whom it pertains, the information may be transmitted to a physician named by the requesting individual.

(5) This part does not entitle an individual to have access to any information compiled in reasonable anticipation of a civil action or proceeding.

(6) An element may require an individual who wishes to be accompanied by another person when receiving access to his records to furnish a written statement authorizing discussion of the records in the presence of the accompanying person.

(7) Any requests from individuals for access to or copies of their own records shall be processed in accordance with this part and not the Freedom of Information Act. Normally, requests for access to records should be acknowledged within 10 working days of receipt and access provided within 20 working days.

(8) Copies of investigatory records compiled by an investigative organization, but in the temporary custody of an element requesting the record for purposes of adjudication or other personnel action, are the records of the originating investigative agency. Individuals seeking access to such records shall be directed to the originating investigative organization and should be instructed to direct all requests submitted under the Privacy Act of 1974 to that organization. Records concerning the adjudication, or other personnel actions based on the investigative records, are originated by

DCAA and are the records of DCAA. All requests for these records shall be referred to the Security Officer, DCAA who shall respond under this part concerning them.

(b) Amendment of personal information.

(1) Individuals shall be given the opportunity to request either in person or through the mail that their records be amended; however, all requests for such amendment must be made in writing. Instructions for the preparation of a request and any forms employed should be as brief and as simple as possible. Requests should contain as a minimum, identifying information to locate the record, a description of the items to be amended and the reason amendment is being requested. A request shall not be rejected or required to be resubmitted unless additional information is essential to process the request. Incomplete or inaccurate requests shall not be rejected categorically; the individual shall be asked to clarify the request as needed. Individuals shall be required to provide identification of identity as in § 290a.6 (a) (2) to assure that the requester is seeking to amend records pertaining to him and not inadvertently or intentionally, the records of another individual.

(2) A written acknowledgment of the receipt of a request for amendment of a record must be provided to the individual within 10 working days (excluding Saturdays, Sundays, and legal public holidays) after receipt by the proper office. The acknowledgment shall clearly identify the request and advise the individual when he may expect to be advised of action taken on the request. Whenever practicable the decision shall be made within 30 working days. No separate acknowledgment of receipt is necessary if the request can be either approved or denied, and the individual advised within the 10-day period. For requests presented in person, written acknowledgment may be provided at the time the request is presented.

(3) If the element agrees with any portion or all of the individual's request to amend a record, it shall promptly advise the individual and amend the record accordingly. If a disclosure accounting has been made, the element shall advise all previous recipients of the record that the amendment has been made and the substance of the correction.

(4) If the element disagrees with all or any portion of a request to amend a record, it shall promptly:

(i) Advise the individual of its refusal and the reasons therefor;

(ii) Inform the individual that he may request a further review by the Assistant Director, Resources; and

(iii) Describe the procedures for requesting such a review, including the name and address of the Assistant Director, Resources.

(5) A review of the initial refusal to amend a record shall be made if requested by the individual.

(i) The Assistant Director, Resources, shall make a review of the initial determination.

(ii) If, after conducting the review, the Assistant Director, Resources, also refuses to amend the record in accordance with the individual's request, the individual shall be notified:

(A) Of the refusal and the reasons therefor;

(B) of the right to file a concise statement of reasons for disagreeing with the decision of the agency;

(C) of the procedures for filing a statement of disagreement; and that such statement will be made available to anyone to whom the record is subsequently disclosed.

(D) That prior recipients of the disputed record will be provided a copy of the statement of disagreement to the extent that an accounting of disclosures is maintained;

(E) Of his right to seek judicial review of the agency's refusal to amend a record.

(iii) If the Assistant Director, Resources determines that the record should be amended in accordance with the request, the element shall amend the record, advise the individual and inform previous recipients where an accounting of disclosures has been maintained.

(iv) A final determination on the individual's request for a review of an initial refusal to amend a record must be completed within 30 working days after receipt by the proper office unless the Director, DCAA determines that a fair and equitable review cannot be completed in that time. If additional time is required, the individual shall be informed in writing of the reasons for the delay and of the approximate date on which the review is expected to be completed.

(6) When an individual files a statement of dispute, the element shall clear

ly annotate the record so that the dispute is apparent to anyone who may subsequently grant access to, use, or disclose the record. The notation itself shall be integral to the record. Where an accounting of disclosure has been made, the element shall advise previous recipients that the record has been disputed and shall provide a copy of the individual's statement.

(i) The individual's statement of dispute need not be filed as an integral part of the record to which it pertains. It shall, however, be maintained in such a manner as to permit ready retrieval whenever the disputed portion of the record is to be disclosed. When information which is the subject of a statement of dispute is subsequently disclosed, the element shall note which information is disputed and provide a copy of the individual's statement.

(ii) An element may include a brief summary of its reasons for not making an amendment when disclosing disputed information. Summaries normally will be limited to the reasons stated to the individual. The element's summary will be treated as part of the individual's record; however, it will not be subject to the amendment procedures.

§ 290a.7 Disclosure to others.

(a) Except as prescribed in § 2908.6, this part does not require disclosure of records to anyone other than the individual to whom the records pertain.

(b) No record contained in a system of records maintained within DCAA shall be disclosed by any means of communication to any person, or to any agency outside DCAA, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless disclosure of the record will be:

(1) To those officials and employees of DCAA who have a need for the record in the performance of their duties and the use is compatible with the purpose for which the record is maintained. This includes, for example, transfer of information between DoD components when personnel assigned to DCAA are processed by an activity of another component such as the Defense Investigative Service, the Defense Supply Agency, or one of the Military Departments.

(2) Required to be disclosed to a member of the public by the Freedom of Information Act. Some examples of personal information pertaining to civilian

employees which are normally released without an unwarranted invasion of privacy are: name, present and past positions, office phone number, and grade. However, disclosure of personal information pertaining to civilian employees shall be made in accordance with the Federal Personnel Manual and, therefore, all requests for such information should be referred to the appropriate Personnel Office.

(3) For a routine use as defined in $290a.5 and described in DCAA record system notices.

(4) To the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity authorized by law.

(5) To a recipient who has provided DCAA with advance adequate written assurance that: The record will be used solely as a statistical research or reporting record; the record is to be transferred in a form that is not individually identifiable, i.e., the identity of the individual cannot be determined by combining various statistical records; and will not be used to make any decisions about the rights, benefits, or entitlements of an individual.

(6) To the National Archives of the United States as a record which has sufficient historical or other value to warrant its continued preservation by the United States Government, or for evaluation by the Administrator of General Services or his designee to determine whether the record has such value. A record transferred to a Federal records center for safekeeping or storage does not fall within this category since Federal records center personnel act on behalf of DCAA in this instance and the records remain under the control of DCAA. No disclosure accounting record of the transfer of records to Federal records centers need be maintained.

(7) To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the element which maintains the record specifying the particular portion desired and the law enforcement activity for which the record is sought. Blanket requests for all records pertaining to an individual will not be accepted. A record may also be disclosed to a law enforcement agency at the ini

tiative of the Counsel, DCAA when criminal conduct is suspected, provided that such disclosure has been established in advance as a routine use.

(8) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if upon such disclosure notification is transmitted to the last known address of the individual to whom the record pertains.

(9) To either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, or any joint committee. This does not authorize the disclosure of any record subject to this part to members of Congress acting in their individual capacities or on behalf of their constituents, unless the individual consents.

(10) To the Comptroller General, or any of his authorized representatives, in the course of the performance of the duties of the General Accounting Office.

(11) Pursuant to the order of a court of competent jurisdiction.

(i) When a record is disclosed under compulsory legal process and when the issuance of that order or subpoena is made public by the court which issued it, make reasonable efforts to notify the individual to whom the record pertains. This may be accomplished by notifying the individual by mail at his most recent address as contained in the element's records.

(ii) Upon being served with an order to disclose a record, the element shall endeavor to determine whether the issuance of the order is a matter of public record and, if it is not, seek to be advised when it becomes public. An accounting of the disclosure shall be made at the time the element complies with the order or subpoena.

(c) Each DCAA element, with respect to each system of records under its control shall:

(1) Except for disclosures made under paragraphs (b) (1) and (b) (2) of this section, keep an accurate accounting of the date, nature, and purpose of each disclosure of a record to any person or to another agency; and the name and address of the person or agency to whom the disclosure is made. A DCAA element need not make a notation on a single document of every disclosure of a particular record, provided it can construct from its system the required accounting information when required by the individual; when

necessary to inform previous recipients of any amended record; or when providing a cross reference to the justification or basis upon which the disclosure was made, including any written documentation as required in the case of the release of records for statistical or law enforcement purposes.

(2) Retain the accounting made under paragraph (c) (1) of this section, for at least 5 years after the last disclosure or the life of the record, whichever is longer. No record of the disclosure of this accounting need be maintained.

(3) Upon request of the individual to whom the record pertains, make available to that individual all information in its accounting of disclosures except that pertaining to disclosures for law enforcement purposes pursuant to § 290a.7(b) (7).

(d) (1) An individual's name and address may not be sold or rented by an element unless such action is specifically authorized by law. This provision shall not be construed to require the withholding of names and addresses otherwise permitted to be made public.

(2) Lists or compilations of names and home addresses, or single home addresses will not be disclosed, without the consent of the individual involved, to the public including, but not limited to, individual congressmen, creditors, and commercial and financial institutions. Requests for home addresses may be referred to the last known address of the individual for reply at his discretion and the requester will be notified accordingly. This prohibition may be waived when circumstances of a case indicate compelling and overriding interests. § 290a.8

Collection of personal information from individuals.

(a) Personal information shall be collected to the greatest extent practicable directly from the individual when the information may result in adverse determinations about an individual's rights, benefits, and privileges under Federal programs. The collection of information from third parties shall be minimized. Exceptions to this policy may be made under certain circumstances, such as the following:

(1) There is a need to ensure accuracy of information supplied by an individual by verifying with a third party, such as in the case of verifying information for a security clearance.

(2) The nature of the information is such that it can only be obtained from a third party, such as an employee's performance in a previous job or assignment.

(3) Obtaining the information from the individual would present exceptional practical difficulties or would result in unreasonable cost.

(b) Each individual who is asked to supply personal information must be told of the authority (statute or Executive Order) which authorizes its solicitation; the principal purpose or purposes for which it is to be used; the routine uses to be made of it; whether furnishing such information is mandatory or voluntary; and the effects on him, if any, of not providing it. This notice to the individual may be made on the form used to collect the information or on a separate form which can be retained by the individual. This advice must be given regardless of the media used in requesting information, whether it is a “form” in the usual sense, i.e., a preprinted document with a control number and an edition date, or a format, questionnaire, survey sheet, or report rendered on a blank sheet.

(1) Forms in use before September 27, 1975, which are to be used on and after that date must meet the notice requirements by use of a separate statement to accompany each form subject to the provisions of the Privacy Act of 1974. The statement will be assigned the identifying number used in collecting the information and the suffix "Privacy Act Statement," as follows:

(i) For forms in regularly issued, numbered series, the Privacy Act Statement shall bear the same number as the form to which it pertains.

(ii) For unnumbered formats, questionnaires, survey forms, and reports, the Privacy Act Statement will bear the report control symbol or OMB Approval Number under the authority of which the information is collected if applicable.

(2) As forms are revised or new ones issued, the Privacy Act Statement shall be incorporated, if practical, in the body of each form, format, questionnaire, survey sheet, or report initiated or revised on or after September 27, 1975. Where feasible, the Privacy Act Statement when incorporated on a form, format, etc. should be positioned in such a manner that the individual will be informed of the information required by

the act before he begins to furnish any of the information requested.

(3)(i) The proponent, i.e., the initiator, has the final responsibility for determining whether a form, format, questionnaire, survey, or report requires a Privacy Act Statement. Statements should be sufficiently complete and specific, but, at the same time, be concise and couched in easily understood language.

(ii) Forms and information management officers at all echelons of DCAA must assure that Privacy Act Statements are available and that new forms contain the Statement, if required.

(iii) No element may deny any individual any right, benefit, or privilege provided by law because of such individual's refusal to disclose his SSN, unless such disclosure is required by Federal statute or to any element maintaining a system of records in existence and operating before January 1, 1975, if such disclosure was required under statute or regulation adopted prior to such date to verify the identity of an individual. Executive Order No. 9397, November 22, 1943, authorizes elements to use the SSN as a system of numerical identification of individuals.

(iv) Any DCAA element which requests an individual to disclose the SSN must inform that individual whether disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.

(c) If disclosure of the SSN is not required by Federal statute or is not for a system of records in existence and operating prior to January 1, 1975, DCAA elements are not precluded from requesting it from the individuals concerned. However, the separate Privacy Act Statement for the SSN alone, or a merged Privacy Act Statement, covering not only the SSN but also other items of personal information, must make clear that the disclosure of the SSN is voluntary. If, in such instances, the individual refuses to disclose it, the element concerned must be prepared to identify him by alternate means. § 290a.9

Exemptions.

(a) The Director, DCAA reserves the right to designate the systems of records maintained by this agency which are to be exempted from certain provisions of the Privacy Act of 1974, and shall pub

lish in the FEDERAL REGISTER information specifying the name of each designated system, the specific provisions of the act from which each system is to be exempted, and the reasons for each exemption of the record system.

(b) To qualify for a general exemption, as defined in the Privacy Act of 1974, the system of records must be maintained by an agency or component thereof which performs as its principal function any activity pertaining to the enforcement of criminal laws, including police efforts to prevent, control, or reduce crime or to apprehend criminals, and the activities of prosecutors, courts, correctional, probation, pardon, or parole authorities. Such system of records must consist of:

(1) Information compiled for the purpose of identifying individual criminal offenders and alleged offenders and containing only identifying data and notations of arrests, the nature and disposition of criminal charges, sentencing, confinement, release, and parole and probation status;

(2) Information compiled for the purpose of a criminal investigation, including reports of informants and investigators, and associated with an identifiable individual; or

(3) Reports identifiable to an individual compiled at any state of the process of enforcement of the criminal laws from arrest or indictment through release from supervision.

(c) To qualify for a specific exemption, as defined by the Privacy Act of 1974, the system of records must be:

(1) Specifically authorized under criteria established under an Executive Order to be kept classified in the interest of national defense or foreign policy and are in fact properly classified pursuant to such Executive Order;

(2) Investigatory material compiled for law enforcement purposes, other than material covered under a general exemption; however, an individual shall not be denied access to information which has been used to deny him a right or privilege unless disclosure would reveal a confidential source. The Security Officer, DCAA, shall establish procedures governing the granting of confidentiality;

(3) Maintained in connection with providing protective service to the PresiIdent of the United States or other individuals protected pursuant to 18 U.S.C. 3056.