Sec.

Subpart C-Official Personnel Folder

293.301

Applicability of regulations. 293.302 Establishment of Official Personnel Folder.

293.303 Ownership of folder.

293.304 Maintenance and content of folder. 293.305 Type of folder to be used.

293.306 Use of existing folders upon trans

fer or reemployment. 293.307 Disposition of folders of former

Federal employees. 293.308 Removal of temporary records from folders.

AUTHORITY: 5 U.S.C. 552a; Executive Order 12107, (December 28, 1978), 5 U.S.C. 1302. 3 CFR 1954-1958 Compilation; 5 CFR 7.2; Executive Order 9830, 3 CFR 1943-1948 Compilation.

SOURCE: 44 FR 65033, Nov. 9, 1979, unless otherwise noted.

Subpart A-Basic Policies on Maintenance of Personnel Records

§ 293.101 Purpose and scope.

(a) This subpart sets forth basic policies governing the creation, development, maintenance, processing, use, dissemination, and safeguarding of personnel records which the Office of Personnel Management requires agencies to maintain in the personnel management or personnel policy setting process.

(b) Agencies in the Executive Branch of the Federal Government are subject to specific Office of Personnel Management recordkeeping requirements to varying degrees, pursuant to statute, Office regulation, or formal agreements between the Office and agencies. This subpart applies to any department or independent establishment in the Executive Branch of the Federal Government, including a government corporation or Government controlled corporation, except those specifically excluded from Office recordkeeping requirements by statute, Office regulation, or formal agreement between the Office and that agency.

ernment corporation, Government controlled corporation, or other establishment in the Executive Branch of the Government (including the Executive Office of the President), or any independent regulatory agency;

"Data subject" means the individual about whom the Office or agency is maintaining information in a system of records;

"Individual" means a citizen of the United States or an alien lawfully admitted for permanent residence;

"Information" means papers, records, photographs, magnetic storage media, micro storage media, and other documentary materials regardless of physical form or characteristics, containing data about an individual and required by the Office in pursuance of law or in connection with the discharge of official business, as defined by statute, regulation, or administrative procedure;

"Maintain" includes collect, use, or disseminate;

"Office" means the Office of Personnel Management;

"Personnel record" means any record concerning an individual which is maintained an used in the personnel management or personnel policysetting process. (For purposes of this part, this term is not limited just to those personnel records in a system of records and subject to the Privacy Act);

"Record" means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his or her education, financial transactions, medical history, criminal history, or employment history;

"System of records" means a group of records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

§ 293.103 Recordkeeping standards.

(a) The head of each agency shall ensure that persons having access to or involved in the creation, development, processing, use, or maintenance

of personnel records are informed of pertinent recordkeeping regulations and requirements of the Office of Personnel Management and the agency. Authority to maintain personnel records does not constitute authority to maintain information in the record merely because it may be useful; both Government-wide and internal agency personnel records shall contain only information concerning an individual that is relevant and necessary to accomplish the Federal personnel management purposes required by statute, Executive order, or Office regulation.

(b) The Office is responsible for establishing minimum standards of accuracy, relevancy, necessity, timeliness, and completeness for personnel records it requires agencies to maintain. These standards are discussed in appropriate chapters of the Federal Personnel Manual. Before approval of any agency requests for changes in recordkeeping practices governed by the Federal Personnel Manual, the Office will examine the proposal or request in the context of such standards set forth by the agency in support of the proposal and in light of the personnel program area that requires these records.

§ 293.104 Collection of information.

(a) Any information in personnel records whether or not those records are in a system of records, used in whole or in part in making a determination about an individual's rights, benefits, or privileges under Federal personnel programs should, to the greatest extent practicable, be collected directly from the individual concerned. Factors to be considered in determining whether to collect, the data from the individual concerned or a third party are when:

(1) The nature of the information is such that it can only be obtained from another party;

(2) The cost of collecting the information directly from the individual is unreasonable when compared with the cost of collecting it from another party;

(3) There is virtually no risk that information collected from other parties, if inaccurate, could result in a de

termination adverse to the individual concerned;

(4) The information supplied by an individual must be verified by another party; or

(5) There are provisions made, to the greatest extent practicable, to vertify information collected from another party with the individual concerned.

§ 293.105 Restrictions on collection and use of information.

(a) First Amendment. Personnel records describing how individuals exercise rights guaranteed by the First Amendment are prohibited unless expressly authorized by statute, or by the individual concerned, or unless pertinent to and within the scope of an authorized law enforcement activity. These rights include, but are not limited to, free exercise of religious and political beliefs, freedom of speech and the press, and freedom to assemble and to petition the government.

(b) Social Security Number.

(1) Agencies may not require individuals to disclose their Social Security Number unless disclosure would be required;

(i) Under Federal statute; or

(ii) Under any statute, Executive order, or regulation that authorizes any Federal, State, or local agency maintaining a system of records that was in existence and operating prior to January 1, 1975, to request the Social Security Number as a necessary means of verifying the identity of an individual.

(2) Individuals asked to voluntarily (circumstances not covered by paragraph (b)(1) of this section) provide their Social Security Number shall suffer no penalty or denial of benefits for refusing to provide it.

§ 293.106 Safeguarding information about

individuals.

(a) To ensure the security and confidentiality of personnel records, in whatever form, each agency shall establish administrative, technical, and physical controls to protect information in personnel records from unauthorized access, use, modification, destruction, or disclosure. As a minimum, these controls shall require that

all persons whose official duties require access to and use of personnel records be responsible and accountable for safeguarding those records and for ensuring that the records are secured whenever they are not in use or under the direct control of authorized persons. Generally, personnel records should be held, processed, or stored only where facilities and conditions are adequate to prevent unauthorized

access.

(b) Personnel records must be stored in metal filing cabinets which are locked when the records are not in use, or in a secured room. Alternative storage facilities may be employed provided they furnish an equivalent or greater degree of security than these methods. Except for access by the data subject, only employees whose official duties require access shall be allowed to handle and use personnel records, in whatever form or media the records might appear. To the extent feasible, entry into personnel record storage areas shall be similarly limited. Documentation of the removal of records from storage areas must be kept so that adequate control procedures can be established to assure that removed records are returned on a timely basis.

(c) Disposal and destruction of personnel records shall be in accordance with the General Record Schedule issued by the General Services Administration for the records or, alternatively, with Office or agency records control schedules approved by the National Archives and Records Service of the General Services Administration. § 293.107 Special safeguards for automated records.

(a) In addition to following the security requirements of § 293.106 of this part, managers of automated personnel records shall establish administrative, technical, physical, and security safeguards for data about individuals in automated records, including input and output documents, reports, punched cards, magnetic tapes, disks, and on-line computer storage. The safeguards must be in writing to comply with the standards on automated data processing physical security issued by the National Bureau of

Standards, U.S. Department of Commerce, and, as a minimum, must be sufficient to:

(1) Prevent careless, accidental, or unintentional disclosure, modification, or destruction of identifiable personal data;

(2) Minimize the risk that skilled technicians or knowledgeable persons could improperly obtain access to, modify, or destroy identifiable personnel data;

(3) Prevent casual entry by unskilled persons who have no official reason for access to such data;

(4) Minimize the risk of an unauthorized disclosure where use is made of identifiable personal data in testing of computer programs;

(5) Control the flow of data into, through, and from agency computer operations;

(6) Adequately protect identifiable data from environmental hazards and unneccessary exposure; and

(7) Assure adequate internal audit procedures to comply with these procedures.

(b) The disposal of identifiable personal data in automated files is to be accomplished in such a manner as to make the data unobtainable to unauthorized personnel. Unneeded personal data stored on reusable media such as magnetic tapes and disks must be erased prior to release of the media for reuse.

§ 293.108 Rules of conduct.

(a) Scope. These rules of conduct apply to all Office and agency employees responsible for creation, development, maintenance, processing, use, dissemination, and safeguarding of personnel records. The Office and agencies shall require that such employees are familiar with these and appropriate supplemental agency internal regulations.

(b) Standards of Conduct. Office and agency employees whose official duties involve personnel records shall be sensitive to individual rights to personal privacy and shall not disclose information from any personnel record unless disclosure is part of their official duties or required by executive order, regulation, or statute (e.g., required by

the Freedom of Information Act, 5 U.S.C. 552).

(c) Improper uses of personnel information. Any Office or agency employee who makes a disclosure of personnel records knowing that such disclosure is unauthorized, or otherwise knowingly violates these regulation, shall be subject to disciplinary action and may also be subject to criminal penalties where the records are subject to the Privacy Act (5 U.S.C. 552a). Employees are prohibited from using personnel information not available to the public, gained through official duties, for commercial solicitation or sale, or for personal gain.

Subpart B-Personnel Records Subject to the Privacy Act

§ 293.201 Purpose.

The purpose of this subpart is to set forth the criteria to be used to determine when personnel records on individuals are subject both to the regulations contained in this part and to Office or agency regulations implementing the Privacy Act of 1974, 5 U.S.C. 552a. When personnel records are maintained within a system of records, the records are deemed to be within the scope of both the regulations in this part and Office or agency regulations implementing the Privacy Act.

§ 293.202 Records subject to Office or agency Privacy Act regulations.

When the Office of Personnel Management publishes in the FEDERAL REGISTER a notice of system of records for personnel records which are maintained by the agencies or by the Office, that system of records will be subject to the regulations in this part and also to the regulations in Part 297 of this chapter. When agencies publish a notice of system of records for personnel records required by the Office that are not included in the Office's notices, those agency systems of records will be subject both to the regulations contained in this part and to agency promulgated regulations that implement the Privacy Act.

§ 293.203 Review of Office or agency practices.

Reviews of agency personnel management policies and practices will be conducted to insure compliance with Office regulations. The Office may direct agencies to take whatever corrective action is necessary. Office or agency officials who have knowledge of violations of these regulations shall take whatever corrective action is necessary. Agencies shall list officials of the Office of Personnel Management as a routine user for personnel records to assist the Office in its oversight responsibilities.

Subpart C-Official Personnel Folder

§ 293.301 Applicability of regulations.

This subpart applies to, and within this subpart "agency" means, except those specifically excluded from Office recordkeeping requirements by statute, Office regulation or formal agreement between the Office and the agency, each executive department and independent establishment of the Federal Government, each corporation wholly owned or controlled by the United States, and with respect to positions subject to civil service rules and regulations, the legislative and judicial branches of the Federal Government and the District of Columbia Government.

§ 293.302 Establishment of Official Personnel Folder.

Each agency shall establish an Official Personnel Folder for each employee occupying a position subject to this part, except as provided in § 293.306. Except as provided for in Federal Personnel Manual Supplement 293-31, there will be only one Official Personnel Folder maintained for each employee.

§ 293.303 Ownership of folder.

The Official Personnel Folder of each employee in a position subject to civil service rules and regulations is under the jurisdiction and control of, and is part of the records of, the Office of Personnel Management.

§ 293.304 Maintenance and content of folder.

The head of each agency shall maintain in the Official Personnel Folder the reports of selection and other personnel actions named in section 2951 of title 5, United States Code. The folder shall also contain permanent records affecting the employee's status and service as required by the Office's instructions and as designated in FPM Supplement 293-31.

§ 293.305 Type of folder to be used.

Each agency shall use only Official Personnel Folders from Federal Supply Service contracts or stock for the folders required by this part.

§ 293.306 Use of existing folders upon transfer or reemployment.

When an agency hires a person who has served on or after April 1, 1947, in a position subject to this part, it shall request the transfer of the Official Personnel Folder pertaining to the person's employment. The folder so obtained shall be used in lieu of establishing a new Official Personnel Folder.

(a) When a person for whom an Official Personnel Folder has been established transfers from one agency to another, the last employing (losing) agency shall, on request, transfer the folder to the new employing agency.

(b) Before transferring the Official Personnel Folder, the losing agency shall:

(1) Remove those records of a temporary nature filed on the left side of the folder; and

(2) Ensure that all permanent documents of the folder are complete, correct, and present in the folder in accordance with FPM Supplement 29331.

§ 293.307 Disposition of folders of former Federal employees.

(a) Folders of persons separated from employment must be retained by the losing agency for thirty days after separation, and may be retained for an additional sixty days. Thereafter, the folder should be transferred to the General Services Administration, National Personnel Records Center (Ci

294.101 Purpose.

294.102 Definitions.

294.103 General policy.

294.104 Information available-Indexes; of certain records.

294.105 Places where information may be obtained.

294.106 Procedures for obtaining information.

294.107 Service charges for information. 294.108 Appeal of a denial of information. 294.109 Custody of information; subpenas. 294.110 Deceased employees.

Subpart B-The Public Information Function 294.201 Public information policy.

Subpart C-Office Operations 294.301 Policy and interpretations. Subpart D-Medical Information 294.401 Medical information. Subpart E-Examinations and Related Subjects 294.501 Examinations.

Subpart F-Investigations 294.601 Investigative reports.

Subpart G-Official Personnel Folder

294.701 Coverage.

294.702 Availability of information. 294.703 Access to folder.