(a) This subpart is issued under the Privacy Act of 1974, Public Law 93-579, 88 Stat. 1896; 12 U.S.C. 552a, as amended.

(b) The Privacy Act of 1974 is based, in part, on the finding by Congress that “in order to protect the privacy of individuals identified in information systems maintained by Federal agencies, it is necessary and proper for the Congress to regulate the collection, maintenance, use, and dissemination of information by such agencies.” To achieve this objective, the Act generally provides that Federal agencies must advise an individual upon request whether records maintained by the agency in a system of records pertain to the individual and must grant the individual access to such records. The Act further provides that individuals may request amendments to records pertaining to them that are maintained by the agency, and that the agency shall either grant the requested amendments or set forth fully its reasons for refusing to do so.

(c) The Appraisal Subcommittee of the Federal Financial Institutions Examination Council (ASC), pursuant to subsection (f) of the Privacy Act, adopts the following rules and procedures to implement the provisions of the Act summarized above and other provisions of the Act. These rules and procedures are applicable to all requests for information and access or amendment to records pertaining to an individual that are contained in any system of records that is maintained by the ASC.

The following definitions shall apply for purposes of this subpart:

(a) The terms individual, maintain, record, system of records, and routine use are defined for purposes of these rules as they are defined in 5 U.S.C. 552a(a)(2), (a)(3), (a)(4), (a)(5) and (a)(7).

(b) ASC or Subcommittee means the Appraisal Subcommittee of the Federal Financial Institutions Examination Council.

(c) Privacy Act Officer means the ASC's Associate Director for Administration or such other ASC staff officer, other than the Executive Director, duly designated by the ASC's Executive Director.

(a) Place to make request. Any request by an individual to be advised whether any system of records maintained by the ASC and named by the individual contains a record pertaining to him or her, or any request by an individual for access to a record pertaining to him or her that is contained in a system of records maintained by the ASC, shall be submitted in person at the ASC between 9 a.m. and 4:30 p.m., Monday through Friday, which is located at 1325 G Street NW, Suite 500, Washington, DC 20005, or by mail addressed to: Privacy Act Officer, ASC, 1325 G Street NW, Suite 500, Washington, DC 20005. All requests will be required to be put in writing and signed by the individual making the request. In the case of requests for access that are made by mail, the envelope should be clearly marked “Privacy Act Request.”

(1) Information to be included in requests. Each request by an individual concerning whether the ASC maintains in a system of records a record that pertains to the individual, or for access to any record pertaining to the individual that is maintained by the ASC in a system of records, shall include such information as will assist the ASC in identifying those records as to which the individual is seeking information or access. Where practicable, the individual should identify the system of records that is the subject of his or her request by reference to the ASC's notices of systems of records, which are published in the Federal Register, as required by section (e)(4) of the Privacy Act, 5 U.S.C. 552a(e)(4). Where a system of records is compiled on the basis of a specific identification scheme, the individual should include in his or her request the identification number or other identifier assigned to the individual. In the event the individual does not know that number or identifier, the individual shall provide other information, including his or her full name, address, date of birth and subject matter of the record, to aid in processing his or her request. If additional information is required before a request can be processed, the individual shall be so advised.

(2) Verification of identity. When the fact of the existence of a record is not required to be disclosed under the Freedom of Information Act, 5 U.S.C. 552, as amended, or when a record as to which access has been requested is not required to be disclosed under that Act, the individual seeking the information or requesting access to the record shall be required to verify his or her identity before access will be granted or information given. For this purpose, individuals shall appear at the ASC located at 1325 G Street NW, Suite 500, Washington, DC 20005, between 9 a.m. to 4:30 p.m., Monday through Friday. The ASC's Office is not open on Saturdays, Sundays or Federal holidays.

(3) Methods for verifying identity—appearance in person. For the purpose of verifying identity, an individual seeking information regarding pertinent records or access to those records shall furnish documentation that may reasonably be relied on to establish the individual's identity. Such documentation might include a valid birth certificate, driver's license, employee or military identification card, and medicare card.

(4) Method for verifying identity—by mail. Where an individual cannot appear at the ASC's Office for the purpose of verifying identity, the individual shall submit, along with the request for information or access, a signed and notarized statement attesting to his or her identity. Where access is being sought, the sworn statement shall include a representation that the records being sought pertain to the individual and a stipulation that the individual is aware that knowingly and willfully requesting or obtaining records pertaining to an individual from the ASC under false pretenses is a criminal offense.

(5) Additional procedures for verifying identity. When it appears appropriate to the Privacy Act Officer, other arrangements may be made for the verification of identity as are reasonable under the circumstances and appear to be effective to prevent unauthorized disclosure of, or access to, individual records.

(b) Acknowledgement of requests for information pertaining to individual records in a record system or for access to individual records. (1) Except where an immediate acknowledgement is given for requests made in person, the receipt of a request for information pertaining to individual records in a record system will be acknowledged within 10 days, excluding Saturdays, Sundays and Federal holidays. Requests will be processed as promptly as possible and a response to such requests will be given within 30 days (excluding Saturdays, Sundays, and Federal holidays) unless, within the 30 day period and for cause shown, the individual making the request is notified in writing that a longer period is necessary.

(a) Initial review. Requests by individuals for access to records pertaining to them will be referred to the ASC's Privacy Act Officer, who initially will determine whether access will be granted.

(b) Grant of request for access. (1) If it is determined that a request for access to records pertaining to an individual will be granted, the individual will be advised by mail that access will be given at the ASC or a copy of the requested record will be provided by mail if the individual shall so indicate. Where the individual requests that copies of the record be mailed to or her or requests copies of a record upon reviewing it at the ASC, the individual shall pay the cost of making requested copies, as set forth in § 1102.109 of this subpart.

(2) In granting access to an individual to a record pertaining to him or her, the ASC staff shall take steps to prevent the unauthorized disclosure of information pertaining to other individuals.

(c) Denial of request for access. If it is determined that access will not be granted, the individual making the request will be notified of that fact and given the reasons why access is being denied. The individual also will be advised of his or her right to seek review by the Executive Director of the initial decision to deny access, in accordance with the procedures set forth in § 1102.107 of this subpart.

(d) Time for acting on requests for access. Access to a record pertaining to an individual normally will be granted or denied within 30 days (excluding Saturdays, Sundays, and Federal holidays) after the receipt of the request for access, unless the individual making the request is notified in writing within the 30 day period that, for good cause shown, a longer time is required. In such cases, the individual making the request shall be informed in writing of the difficulties encountered and an indication shall be given as to when it is anticipated that access may be granted or denied.

(e) Authorization to allow designated person to review and discuss records pertaining to another individual. An individual, who is granted access to records pertaining to him or her and who appears at the ASC Office to review the records, may be accompanied by another person of his or her choosing. Where the records as to which access has been granted are not required to be disclosed under provisions of the Freedom of Information Act, 5 U.S.C. 552, as amended, the individual requesting the records, before being granted access, shall execute a written statement, signed by him or her, specifically authorizing the latter individual to review and discuss the records. If such authorization has not been given as described, the person who has accompanied the individual making the request will be excluded from any review or discussion of the records.

(f) Exclusion for certain records. Nothing contained in these rules shall allow an individual access to any information compiled in reasonable anticipation of an administrative judicial or civil action or proceeding.

(a) Statement of physician or mental health professional. When an individual requests access to records pertaining to the individual that include medical and/or psychological information, the ASC, if it deems it necessary under the particular circumstances, may require the individual to submit with the request a signed statement by the individual's physician or a mental health professional indicating that, in his or her opinion, disclosure of the requested records or information directly to the individual will not have an adverse effect on the individual.

(b) Designation of physician or mental health professional to receive records. If the ASC believes, in good faith, that disclosure of medical and/or psychological information, directly to an individual could have an adverse effect on that individual, the individual may be asked to designate in writing a physician or mental health professional to whom the individual would like the records to be disclosed, and disclosure that otherwise would be made to the individual will instead be made to the designated physician or mental health professional.

(a) Place to make requests. A request by an individual to amend records pertaining to him or her may be made in person during normal business hours at the ASC located at 1325 G Street NW, Suite 500, Washington, DC 20005, or by mail addressed to the Privacy Act Officer, ASC, 1325 G Street NW, Suite 500, Washington, DC 20005.

(1) Information to be included in requests. Each request to amend an ASC record shall reasonably describe the record sought to be amended. Such description should include, for example, relevant names, dates and subject matter to permit the record to be located among the records maintained by the ASC. An individual who has requested that a record pertaining to the individual be amended will be advised promptly if the record cannot be located on the basis of the description given and that further identifying information is necessary before the request can be processed. An initial evaluation of a request presented in person will be made immediately to ensure that the request is complete and to indicate what, if any, additional information will be required. Verification of the individual's identity as set forth in § 1102.102(a) (2), (3), (4) and (5) may also be required.

(2) Basis for amendment. An individual requesting an amendment to a record pertaining to the individual shall specify the substance of the amendment and set forth facts and provide such materials that would support his or her contention that the record as maintained by the ASC is not accurate, timely or complete, or that the record is not necessary and relevant to accomplish a statutory purpose of the ASC as authorized by law or by Executive Order of the President.

(b) Acknowledgement of requests for amendment. Receipt of a request to amend a record pertaining to an individual normally will be acknowledged in writing within 10 days after such request has been received, excluding Saturdays, Sundays and Federal holidays. When a request to amend is made in person, the individual making the request will be given a written acknowledgement when the request is presented. The acknowledgement will describe the request received and indicate when it is anticipated that action will be taken on the request. No acknowledgement will be sent when the request for amendment will be reviewed, and an initial decision made, within the 10 day period after such request has been received.

(a) Initial review. As in the case of requests for access, requests by individuals for amendment to records pertaining to them will be referred to the ASC's Privacy Act Officer for an initial determination.

(b) Standards to be applied in reviewing requests. In reviewing requests to amend records, the Privacy Act Officer will be guided by the criteria set forth in 5 U.S.C. 552(e) (1) and (5), i.e., that records maintained by the ASC shall contain only such information as is necessary and relevant to accomplish a statutory purpose of the ASC as required by statute or Executive Order of the President and that such information also be accurate, timely, relevant and complete. These criteria will be applied whether the request is to add material to a record or to delete information from a record.

(c) Time for acting on requests. Initial review of a request by an individual to amend a record shall be completed as promptly as is reasonably possible and normally within 30 days (excluding Saturdays, Sundays, and Federal holidays) from the date the request was received, unless unusual circumstances preclude completion of review within that time. If the anticipated completion date indicated in the acknowledgement cannot be met, the individual requesting the amendment will be advised in writing of the delay and the reasons therefor, and also advised when action is expected to be completed.

(d) Grant of requests to amend records. If a request to amend a record is granted in whole or in part, the Privacy Act Officer will:

(1) Advise the individual making the request in writing of the extent to which it has been granted;

(2) Amend the record accordingly; and

(3) Where an accounting of disclosures of the record has been kept pursuant to 5 U.S.C. 552a(c), advise all previous recipients of the record of the fact that the record has been amended and the substance of the amendment.

(e) Denial of requests to amend records. If an individual's request to amend a record pertaining to him is denied in whole or in part, the Privacy Act Officer will:

(1) Promptly advise the individual making the request in writing of the extent to which the request has been denied;

(2) State the reasons for the denial of the request;

(3) Describe the procedures established by the ASC to obtain further review within the ASC of the request to amend, including the name and address of the person to whom the appeal is to be addressed; and

(4) Inform the individual that the Privacy Act Officer will provide information and assistance to the individual in perfecting an appeal of the initial decision.

(a) Administrative review. Any person who has been notified pursuant to § 1102.103(c) that a request for access to records pertaining to him or her has been denied in whole or in part, or pursuant to § 1102.106(e) of this subpart that a request for amendment has been denied in whole or in part, or who has received no response to a request for access or to amend within 30 days (excluding Saturdays, Sundays and Federal holidays) after the request was received by the ASC's staff (or within such extended period as may be permitted in accordance with §§ 1102.103(d) and 1102.106(c) of this subpart), may appeal the adverse determination or failure to respond by applying for an order of the Executive Director determining and directing that access to the record be granted or that the record be amended in accordance with his or her request.

(1) The application shall be in writing and shall describe the record in issue and set forth the proposed amendment and the reasons therefor.

(2) The application shall be delivered to the ASC, 1325 G Street NW, Suite 500, Washington, DC 20005, or by mail addressed to the Privacy Act Officer, ASC, 1325 G Street NW, Suite 500, Washington, DC 20005.

(3) The applicant may state such facts and cite such legal or other authorities in support of the application.

(4) The Executive Director will make a determination with respect to any appeal within 30 days after the receipt of such appeal (excluding Saturdays, Sundays, and Federal holidays), unless for good cause shown, the Executive Director shall extend that period. If such an extension is made, the individual who is appealing shall be advised in writing of the extension, the reasons therefor, and the anticipated date when the appeal will be decided.

(5) In considering an appeal from a denial of a request to amend a record, the Executive Director shall apply the same standards as set forth in § 1102.106(b).

(6) If the Executive Director concludes that access should be granted, the Executive Director shall issue an order granting access and instructing the Privacy Act Officer to comply with § 1102.103(b).

(7) If the Executive Director concludes that the request to amend the record should be granted in whole or in part, the Executive Director shall issue an order granting the requested amendment in whole or in part and instructing the Privacy Act Officer to comply with the requirements of § 1102.106(d) of this subpart, to the extent applicable.

(8) If the Executive Director affirms the initial decision denying access, the Executive Director shall issue an order denying access and advising the individual seeking access of:

(i) The order;

(ii) The reasons for denying access; and

(iii) The individual's right to obtain judicial review of the decision pursuant to 5 U.S.C. 552a(g)(1)(B).

(9) If the Executive Director determines that the decision of the Privacy Act Officer denying a request to amend a record should be upheld, the Executive Director shall issue an order denying the request and the individual shall be advised of:

(i) The order refusing to amend the record and the reasons therefor;

(ii) The individual's right to file a concise statement setting forth his or her disagreement with the Executive Director's decision not to amend the record;

(iii) The procedures for filing such a statement of disagreement with the Executive Director;

(iv) The fact that any such statement of disagreement will be made available to anyone to whom the record is disclosed, together with, if the Executive Director deems it appropriate, a brief statement setting forth the Executive Director's reasons for refusing to amend;

(v) The fact that prior recipients of the record in issue will be provided with the statement of disagreement and the Executive Director's statement, if any, to the extent that an accounting of such disclosures has been maintained pursuant to 5 U.S.C. 552a(c); and

(vi) The individual's right to seek judicial review of the Executive Director's refusal to amend, pursuant to 5 U.S.C. 552a(g)(1)(A).

(b) Statement of disagreement. As noted in paragraph (a)(9)(ii) of this section, an individual may file with the Executive Director a statement setting forth his or her disagreement with the Executive Director's denial of his or her request to amend a record.

(1) Such statement of disagreement shall be delivered to the ASC, 1325 G Street NW, Suite 500, Washington, DC 20005, within 30 days after receipt by the individual of the Executive Director's order denying the amendment, excluding Saturdays, Sundays and Federal holidays. For good cause shown, this period can be extended for a reasonable time.

(2) Such statement of disagreement shall concisely state the basis for the individual's disagreement. Unduly lengthy or irrelevant materials will be returned to the individual by the Executive Director for appropriate revisions before they become a permanent part of the individual's record.

(3) The record about which a statement of disagreement has been filed will clearly note which part of the record is disputed and the Executive Director will provide copies of the statement of disagreement and, if the Executive Director deems it appropriate, provide a concise statement of his or her reasons for refusing to amend the record, to persons or other agencies to whom the record has been or will be disclosed.

(a) Extensions of time. Pursuant to §§ 1102.103(b), 1102.104(d), 1102.109(c) and 1102.109(a)(4) of this subpart, the time within which a request for information, access or amendment by an individual with respect to records maintained by the ASC that pertain to him or her normally would be processed may be extended for good cause shown or because of unusual circumstances. As used in these rules, good cause and unusual circumstances shall include, but only to the extent reasonably necessary to the proper processing of a particular request:

(1) The need to search for and collect the requested records from establishments that are separate from the ASC. Some records of the ASC may be stored in Federal Records Centers in accordance with law—including many of the documents that have been on file with the ASC for more than 2 years—and cannot be made available promptly. Any person who has requested for personal examination a record stored at the Federal Records Center will be notified when the record will be made available.

(2) The need to search for, collect, and appropriately examine a voluminous amount of separate and distinct records which may be demanded in a single request. While every reasonable effort will be made to comply fully with each request as promptly as possible on a first-come, first-served basis, work done to search for, collect and appropriately examine records in response to a request for a large number of records will be contingent upon the availability of processing personnel in accordance with an equitable allocation of time to all members of the public who have requested or wish to request records.

(3) The need for consultation, which shall be conducted with all practicable speed, with another agency having a substantial interest in the determination of the request, or among two or more components within the ASC having substantial subject-matter interest herein.

(b) Effective date of action. Whenever it is provided in this subpart that an acknowledgement or response to a request will be given by specific times, deposit in the mails of such acknowledgement or response by that time, addressed to the person making the request, will be deemed full compliance.

(c) Records in use by a member of the ASC or its staff. Although every effort will be made to make a record in use by a member of the ASC or its staff available when requested, it may occasionally be necessary to delay making such a record available when doing so at the time the request is made would seriously interfere with the work of the ASC or its staff.

(d) Missing or lost records. Any person who has requested a record or a copy of a record pertaining to him or her will be notified if the record sought cannot be found. If the person so requests, he or she will be notified if the record subsequently is found.

(e) Oral requests; misdirected written requests—(1) Telephone and other oral requests. Before responding to any request by an individual for information concerning whether records maintained by the ASC in a system of records pertain to the individual or to any request for access to records by an individual, such request must be in writing and signed by the individual making the request. The Executive Director will not entertain any appeal from an alleged denial of failure to comply with an oral request. Any person who has made an oral request for information or access to records who believes that the request has been improperly denied should resubmit the request in appropriate written form to obtain proper consideration and, if need be, administrative review.

(2) Misdirected written requests. The ASC cannot assure that a timely or satisfactory response will be given to written requests for information, access or amendment by an individual with respect to records pertaining to him or her that are directed to the ASC other than in a manner prescribed in §§ 1102.103(a), 1102.106(a), 1102.108(a)(2), and 1102.110 of this subpart. Any staff member who receives a written request for information, access or amendment should promptly forward the request to the Privacy Act Officer. Misdirected requests for records will be considered to have been received by the ASC only when they have been actually received by the Privacy Act Officer in cases under § 1102.108(a)(2). The Executive Director will not entertain any appeal from an alleged denial or failure to comply with a misdirected request, unless it is clearly shown that the request was in fact received by the Privacy Act Officer.

(a) There will be no charge assessed to the individual for the ASC's expense involved in searching for or reviewing the record. Copies of the ASC's records will be provided by a commercial copier at rates established by a contract between the copier and the ASC or by the ASC at the rates in § 1101.4(b)(5)(ii) of 12 CFR part 1101.

(b) Waiver or reduction of fees. Whenever the Executive Director of the ASC determines that good cause exists to grant a request for reduction or waiver of fees for copying documents, he or she may reduce or waive any such fees.

Title 18 U.S.C. 1001 makes it a criminal offense, subject to a maximum fine of $10,000, or imprisonment for not more than 5 years or both, to knowingly and willingly make or cause to be made any false or fraudulent statements or representations in any matter within the jurisdiction of any agency of the United States. 5 U.S.C. 552a(i) makes it a misdemeanor punishable by a fine of not more than $5,000 for any person knowingly and willfully to request or obtain any record concerning an individual from the ASC under false pretenses. 5 U.S.C. 552a(i) (1) and (2) provide criminal penalties for certain violations of the Privacy Act by officers and employees of the ASC.