(a) Each NASA employee is responsible for adhering to the requirements of the Privacy Act and this regulation.

(b) An employee shall not seek or obtain access to a record in a NASA system of records or to copies of any portion of such records under false pretenses. Only those employees with an official “need to know” may seek and obtain access to records pertaining to others.

(c) Employees shall refrain from discussing or disclosing personal information about others which they have obtained because of their official need to know such information in the performance of official duties.

(d) To the extent included in a contract which provides for the maintenance by or on behalf of NASA of a system of records to accomplish a function of NASA, the requirements of this section shall apply to contractor employees who work under the contract.

The Associate Administrator is responsible for:

(a) Making final Agency determinations on appeals (§ 1212.400), except on those related to records originating in the Office of the Inspector General;

(b) Authorizing exemptions from one or more provisions of the Privacy Act for NASA systems of records (See § 1212.500); and,

(c) Authorizing an extension for making a final determination on an appeal (§ 1212.400(d)), except for an appeal related to records originating in the Office of the Inspector General.

[57 FR 4928, Feb. 11, 1992, as amended at 77 FR 60621, Oct. 4, 2012; NASA-21-091; NASA-2021-0007, 88 FR 12149, Feb. 27, 2023]

The Inspector General is responsible for:

(a) Making final Agency determinations on appeals related to records originating with the Office of the Inspector General (§ 1212.400), and

(b) Authorizing an extension for making a final determination on an appeal related to records originating with the Office of the Inspector General (§ 1212.400(e)).

[77 FR 60622, Oct. 4, 2012]

(a) The NASA Chief Information Officer is responsible for the following:

(1) Providing overall supervision and coordination of NASA's policies and procedures under this regulation;

(2) Approving system notices for publication in the Federal Register;

(3) Assuring that NASA employees and officials are informed of their responsibilities and that they receive appropriate training for the implementation of these requirments; and,

(4) Preparing and submitting the biennial report on implementation of the Privacy Act to OMB and special reports required under this regulation, including establishing appropriate reporting procedures in accordance with OMB Circular No. A-130.

(b) The Chief Information Officer may establish a position of ‘NASA Privacy Act Officer,’designate someone to function as such an officer, and delegate to that officer any of the functions described in paragraph (a) of this section.

[57 FR 4928, Feb. 11, 1992. Redesignated and amended at 77 FR 60622, Oct. 4, 2012]

(a) Officials-in-Charge of Headquarters Offices, Directors of NASA Field Centers and Officials-in-Charge of Component Facilities are responsible for the following with respect to those systems of records maintained in their organization:

(1) Avoiding the establishment of new systems of records or new routine uses of a system of records without first complying with the requirements of this regulation;

(2) Ensuring that the requirements of this regulation and the Privacy Act are followed by employees;

(3) Ensuring that there is appropriate coordination within NASA before a determination is made to disclose information without the individual's consent under authority of 5 U.S.C. 552a(b) (See § 1212.203(f)); and

(4) Providing appropriate oversight for responsibilities and authorities exercised by system managers under their jurisdiction (§ 1212.705).

(5) Establish a position of Center Privacy Manager to assist in carrying out the responsibilities listed in this section.

(b) [Reserved]

[57 FR 4928, Feb. 11, 1992. Redesignated and amended at 77 FR 60622, Oct. 4, 2012; 78 FR 8964, Feb. 7, 2013]

(a) Each system manager is responsible for the following with regard to the system of records over which the system manager has cognizance:

(1) Overall compliance with this part, NASA Policy Directive (NPD) 1382.17 and NASA Procedural Requirements (NPR) 1382.1.

(2) Ensuring that each person involved in the design, development, operation, or maintenance of the system of records is instructed with respect to the requirements of this regulation and the possible penalties for noncompliance;

(3) Submitting a request to the Associate Administrator for an exemption of the system under subpart 1212.5 of this part, setting forth in proposed rulemaking form the reasons for the exemption and citing the specific provision of the Privacy Act which is believed to authorize the exemption;

(4) After consultation with the Office of the General Counsel or the Chief Counsel, making reasonable efforts to serve notice on an individual when any record on such individual is made available to any person under compulsory legal process when such process becomes a matter of public record;

(5) Making an initial determination on an individual's request to correct or amend a record, in accordance with § 1212.302;

(6) Prior to disclosure of any record about an individual, assuring that the record is first reviewed for accuracy, completeness, timeliness, and relevance;

(7) Authorizing disclosures of a record without the individual's consent under § 1212.203(f)(1) through (12);

(8) Responding within the requirements of § 1212.200 to an individual's request for information as to whether the system contains a record pertaining to the individual;

(9) Responding to an individual's request for access and copying of a record, in accordance with subpart 1212.2 of this part;

(10) Amending a record under subpart 1212.3 of this part, or filing in an individual's record a statement of dispute;

(11) Preparing an addendum to an individual's statement of dispute to be filed in the individual's records, in accordance with § 1212.401;

(12) Maintaining disclosure accountings in accordance with 5 U.S.C. 552a(c) and § 1212.203 of this part. This includes records disclosed pursuant to any computer matching programs;

(13) Notifying persons to whom a record has been disclosed and for which an accounting was made as to disputes and corrections involving the record; and

(14) Developing appropriate safeguards for the system of records in accordance with § 1212.605(a).

(b) Where a system of records has subsystems described in the system notice, the subsystem manager will have the responsibilities outlined in paragraph (a) of this section. Although the system manager has no line authority over subsystem managers, the system manager does have overall functional responsibility for the total system, and may issue guidance to subsystem managers on implementation of this part. When furnishing information for required reports, the system manager will be responsible for reporting the entire system of records, including any subsystems.

(c) Exercise of the responsibilities and authorities in paragraph (a) of this section by any system or subsystem managers at a NASA Center shall be subject to any conditions or limitations imposed in accordance with § 1212.704(a)(4) and (5).

[57 FR 4928, Feb. 11, 1992. Redesignated and amended at 77 FR 60622, Oct. 4, 2012; NASA-21-091; NASA-2021-0007, 88 FR 12149, Feb. 27, 2023]

The Assistant Administrator for Procurement is responsible for developing appropriate procurement regulations and procedures under which NASA contracts requiring the maintenance of a system of records in order to accomplish a NASA function are made subject to the requirements of this part.

[57 FR 4928, Feb. 11, 1992. Redesignated at 77 FR 60622, Oct. 4, 2012]

Authority necessary to carry out the responsibilities specified in this regulation is delegated to the officials named, subject to any conditions or limitations imposed in accordance with this subpart 1212.7.

[57 FR 4928, Feb. 11, 1992. Redesignated at 77 FR 60622, Oct. 4, 2012]