(a) Purpose and scope. This part contains the regulations of the U.S. Department of Labor implementing the Privacy Act of 1974, 5 U.S.C. 552a. The regulations apply to all records which are contained in systems of records maintained by, or under the control of, the Department of Labor and which are retrieved by an individual's name or personal identifier. These regulations set forth the procedures by which an individual may seek access under the Privacy Act to records pertaining to him, may request correction or amendment of such records, or may seek an accounting of disclosures of such records by the Department. These regulations are applicable to each component of the Department.

(b) Government-wide systems of records. (1) DOL/GOVT-1 (Office of Workers' Compensation Programs, Federal Employees' Compensation Act File):

(i) All records, including claim forms, medical, investigative and other reports, statements of witnesses, and other papers relating to claims for compensation filed under the Federal Employees' Compensation Act (as amended and extended), are covered by the government-wide system of records entitled DOL/GOVT-1. This system is maintained by and under the control of the Employment Standards Administration's Office of Workers' Compensation Programs (OWCP), and, as such, all records contained in the OWCP claims file, as well as all copies of such documents retained and/or maintained by the injured worker's employing agency, are official records of the OWCP.

(ii) The protection, release, inspection and copying of records covered by DOL/GOVT-1 shall be accomplished in accordance with the rules, guidelines and provisions of this part, as well as with part 70 of this subtitle, and with the notice of the systems of records and routine uses published in the Federal Register. All questions relating to access/disclosure, and/or the amendment of FECA records maintained by the OWCP or an employing agency, are to be resolved in accordance with this part.

(iii)(A) While an employing agency may establish procedures that an injured employee or beneficiary should follow in requesting access to documents it maintains, any decision issued in response to such a request must comply with the rules and regulations of the Department of Labor.

(B) Any administrative appeal taken from a denial issued by the employing agency shall be filed with the Solicitor of Labor in accordance with §§ 71.7 and 71.9 of this part.

(iv) No agency other than the OWCP has authority to issue determinations in response to requests for the correction or amendment of records contained in or covered by DOL/GOVT-1. Any request for correction or amendment received by an employing agency must be referred to the OWCP for review and decision.

(2) For the government-wide system of records entitled DOL/GOVT-2 (Job Corps Student Records), a system maintained by and under the control of the Employment and Training Administration, the regulations of this Department shall govern, including the procedure for requesting access to, or amendment of the records, as well as appeals therefrom, shall govern.

(c) Definitions. As used in this subpart, the following terms shall have the following meanings:

(1) Agency has the meaning set forth in 5 U.S.C. 552(f).

(2) Component means each separate agency, bureau, office, board, division, commission, service, or administration of the Department of Labor, as well as each agency which possesses records covered by a DOL government-wide system of records.

(3) Individual Data Subject means the individual by whose name or identifier the subject record is retrieved.

(4) Record means any item, collection, or grouping of information about an individual which is maintained by any component within a system of records and which contains the individual's name, identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint, voiceprint, or photograph.

(5) Requester means an individual who makes either a request for access, a request for correction or amendment, or a request for an accounting.

(6) Routine use has the meaning set forth in 5 U.S.C. 552a(7).

(7) Statistical record has the meaning set forth in 5 U.S.C. 552a(6).

(8) System of records means a group of any records under the control of the Department or any component from which information is retrieved by the name of an individual or by some identifying number, symbol, or other identifying particular assigned to that individual.

(9) Under the control of means those official records for which the agency is officially responsible and either has in its possession or exercises dominion over. This excludes those records which, although in the physical possession of agency employees and used by them in performing official functions, are not, in fact, agency records. Uncirculated personal notes, papers and records which are retained or discarded at the author's discretion and over which the agency exercises no dominion or control (e.g., personal telephone list) are not agency records for purposes of this part.

(10) He, his, and him include “she”, “hers” and “her”.

(a) Procedure for making requests for access to records. An individual, or legal representative acting on his behalf, may request access to a record about himself by appearing in person or by writing to the component that maintains the record. (See appendix A to this part which lists the components of the Department of Labor and their addresses.) A requester in need of guidance in defining his request may write to the Assistant Secretary for Administration and Management, U.S. Department of Labor, 200 Constitution Avenue, NW, Washington, DC 20210-0002. A request should be addressed to the component that maintains the requested record. Both the envelope and the request itself should be marked: “Privacy Act Request.”

(b) Description of records sought. A request for access to records must describe the records sought in sufficient detail to enable Department personnel to locate the system of records containing the record with a reasonable amount of effort. Whenever possible, a request for access should describe the nature of the record sought, the date of the record or the period in which the record was compiled, and the name or identifying number of the system of records in which the requester believes the record is kept.

(c) Agreement to pay fees. The filing of a request for access to a record under this subpart shall be deemed to constitute an agreement to pay all applicable fees charged under § 71.6 up to $25.00. The component responsible for responding to the request shall confirm this agreement in its letter of acknowledgment to the requester. When filing a request, a requester may specify a willingness to pay a greater amount, if applicable.

(d) Verification of identity. Any individual who submits a request for access to records must verify his identity in one of the following ways:

(1) Any requester making a request in writing must state in his request his full name, and current address. In addition, a requester must provide with his request an example of his signature, which shall be notarized, or signed as an unsworn declaration under penalty of perjury, pursuant to 28 U.S.C. 1746. In order to facilitate the identification of the requested records, a requester may also include in his request his Social Security number.

(2) Any requester submitting a request in person may provide to the component a form of official photographic identification, such as a passport, an identification badge or a driver's license which contains the photograph of the requester. If a requester is unable to produce a form of photographic identification, he may provide to the component two or more acceptable forms of identification bearing his name and address. In all cases, sufficient identification must be presented to confirm that the requester is the individual data subject.

(e) Verification of guardianship. The parent, guardian, or representative of a minor or the guardian or representative of a person judicially determined to be incompetent who submits a request for access to the records of the minor or incompetent must establish:

(1) His identity, as required in paragraph (d) of this section,

(2) That the requester is the parent, guardian, or representative of the subject of the record, which may be proved by providing a copy of the subject's birth certificate showing parentage or by providing a court order establishing the guardianship, and

(3) That he seeks to act on behalf of the subject of the record.

(f) The disclosure officer may waive the requirements set forth in paragraphs (d) and (e) of this section when he deems such action to be appropriate, and may substitute in lieu thereof, other reasonable means of identification.

(a) In general. Except as otherwise provided in this section, the component that:

(1) First receives a request for access to a record, and

(2) Has possession of the requested record is the component ordinarily responsible for responding to the request.

(b) Authority to grant or deny requests. The head of a component, or his designee (i.e. disclosure officer), is authorized to make an initial grant or denial of any request for access to a record in the possession of that component.

(c) Processing of requests for access not properly addressed. A request for access that is not properly addressed as specified in § 71.2 shall be forwarded to the Assistant Secretary for Administration and Management, who shall forward the request to the appropriate component or components for processing. A request not addressed to the appropriate component will be deemed not to have been received by the Department until the Assistant Secretary for Administration and Management has forwarded the request to the appropriate component which has the record and that component has received the request. When the component receives an improperly addressed request, it shall notify the requester of the date on which it received the request. Accordingly, a request for access shall be deemed received on the date that it is received in the appropriate component.

(d) Date for determining responsive records. In determining the extent to which records are responsive to a request for access, a component ordinarily will include only those records within the component's possession and control as of the date of its receipt of the request.

(e) First party requests. A request for access by the individual data subject for his or her own records shall be processed both under the Freedom of Information Act (FOIA) and the Privacy Act (PA).

(a) Form of notice granting request for access. A request by the individual data subject for access to his or her own records shall not be denied unless both a Privacy Act exemption and a Freedom of Information Act exemption apply to the requested records. A component shall make a determination within 30 days to grant or deny a request for access in whole or in part. If the request is granted in whole, the component shall so notify the requester in writing. The notice shall describe the manner in which access to the record will be granted and shall inform the requester of any fees to be charged in accordance with § 71.6.

(b) Form of notice denying request for access. A component denying a request for access in whole or in part shall so notify the requester in writing. The notice, signed by the responsible agency official, shall include:

(1) The name and title or position of the person responsible for the denial;

(2) A brief statement of the reason or reasons for the denial, including the Privacy Act and FOIA exemption or exemptions which the component has relied upon in denying the request; and

(3) A statement that the denial may be appealed under § 71.7(a), and a description of the requirements of that paragraph.

(c) Record cannot be located. If no records are found which are responsive to the request, the component shall so notify the requester in writing. Such notification by the component shall inform the requester that, if the requester considers this response to be a denial of their request, the requester has a right to appeal to the Solicitor of Labor, within ninety days, as set forth in § 71.7.

(d) Medical records. When an individual requests medical records concerning himself, which are not otherwise exempt from disclosure, the disclosure officer shall, if deemed necessary because of possible harm to the individual, advise the individual that the Department of Labor believes that the records should be provided to a physician designated in writing by the individual. In addition, the Department shall request the individual to designate such a physician. Upon receipt of the designation, the disclosure officer will permit the physician to review the records or to receive copies of the records by mail, upon proper verification of identity.

(a) Manner of access. A component that has made a determination to grant a request for access shall grant the requester access to the requested record either by providing the requester with a copy of the record, or making the record available for inspection by the requester at a reasonable time and place. The component shall charge the requester only duplication costs in accordance with the provisions of § 71.6. If a component provides access to a record by making the record available for inspection by the requester, the manner of such inspection shall not unreasonably disrupt the operations of the component.

(b) Accompanying person. A requester appearing in person to review his own records may be accompanied by another individual of his own choosing. The requester shall provide the Department with his or her written consent to disclose the record to the accompanying person.

(a) When charged. A component shall charge fees pursuant to 31 U.S.C. 9701 and 5 U.S.C. 552a(f)(5) for the copying of records unless the component, in its discretion, waives or reduces the fees for good cause shown. A component shall charge fees at the rate of $0.15 per page. In accordance with the provisions of the Freedom of Information Act, the first 100 pages of copying shall be furnished without charge. For materials other than paper copies, the component may charge the direct costs of reproduction, but only if the requester has been notified of such costs before they are incurred. Fees shall not be charged where they would amount, in the aggregate, for one request or for a series of related requests, to less than $15.00. Notwithstanding any other provision of this paragraph, the first copy of an individual's Privacy Act record shall be provided to the individual at no cost.

(b) Notice of estimated fees amounting to between $25 to $250. When a component determines or estimates that the fees to be charged under this section may amount to between $25 to $250, the component shall notify the requester as soon as practicable of the actual or estimated amount of the fee, unless the requester has indicated in advance his willingness to pay a fee as high as that anticipated.

(c) Notice of estimated fees in excess of $250. When a component determines or estimates that the fees to be charged under this section may amount to more than $250, the component shall notify the requester as soon as practicable of the actual or estimated amount of the fee, unless the requester has indicated in advance his willingness to pay a fee as high as that estimated. If the fee is estimated to be in excess of $250, then the agency may require payment in advance. (If only a portion of the fee can be estimated readily, the component shall advise the requester that the estimated fee may be only a portion of the total fee.) Where the estimated fee exceeds $250 and a component has so notified the requester, the component will be deemed not to have received the request for access to records until the requester has paid the anticipated fee, in full or in part. A notice to a requester pursuant to this paragraph shall offer him the opportunity to confer with Department personnel with the object of reformulating his request to meet his needs at a lower cost.

(d) Form of payment. Requesters must pay fees by cash, check or money order payable to either the Treasury of the United States, or the U.S. Department of Labor. However, the Department shall not require advance payment in any case where the fee is under $250, except that where a requester has previously failed to pay a fee charged under this part, the requester must pay the component or the Department the full amount owed and make an advance deposit of the full amount of any estimated fee before a component shall be required to process a new or pending request for access from that requester.

(a) Appeals to the Solicitor of Labor. When a component denies in whole or in part a request for access to records, the requester may appeal the denial to the Solicitor of Labor within 90 days of his receipt of the notice denying his request. An appeal to the Solicitor of Labor shall be made in writing, addressed to the Solicitor of Labor, U.S. Department of Labor, 200 Constitution Avenue, NW, Washington, DC. 20210-0002. Both the envelope and the letter of appeal itself must be clearly marked: “Privacy Act Appeal.” An appeal not so addressed and marked shall be forwarded to the Office of the Solicitor as soon as it is identified as an appeal under the Privacy Act. An appeal that is improperly addressed shall be deemed not to have been received by the Department until the Office of the Solicitor receives the appeal.

(b) Form of action on appeal. The disposition of an appeal shall be in writing. A written decision affirming in whole or in part the denial of a request for access shall include a brief statement of the reason or reasons for the affirmation, including each Privacy Act and FOIA exemption relied upon and its relation to each record withheld, and a statement that judicial review of the denial is available in the U.S. District Court for the judicial district in which the requester resides or has his principal place of business, the judicial district in which the requested records are located, or the District of Columbia. If the denial of a request for access is reversed on appeal, the requester shall be so notified and the request shall be processed promptly in accordance with the decision on appeal.

(c) Delegation of Authority by the Solicitor of Labor. The Solicitor of Labor is authorized to delegate his authority to decide appeals from any and all denials of access to other senior attorneys within the Office of the Solicitor.

Each component shall preserve all correspondence relating to the requests it receives under this subpart, and all records processed pursuant to such requests, until such time as the destruction of such correspondence and records is authorized pursuant to title 44 of the U.S. Code and record schedules approved by the National Archives and Records Administration, and otherwise in accordance with retention requirements as published in the agency's system of records. Under no circumstances shall records be destroyed while they are the subject of a pending request for access, appeal, or lawsuit under the Act.

(a) How made. An individual may submit a request for correction or amendment of a record pertaining to him. The request must be in writing and must be addressed to the component that maintains the record. (Appendix A of this part lists the components of the Department and their addresses.) The request must identify the particular record in question, state the correction or amendment sought, and set forth the justification for the change. Both the envelope and the request itself must be clearly marked: “Privacy Act Amendment Request.”

(b) Initial determination. Within 30 working days of receiving a request for correction or amendment, a component shall notify the requester whether his request will be granted or denied, in whole or in part. If the component grants the request in whole or in part, it shall send the requester a copy of the amended record, in releasable form, as proof of the change. If the component denies the request in whole or in part, it shall notify the requester in writing of the denial. The notice of denial shall state the reason or reasons for the denial and advise the requester of his right to appeal.

(c) Appeals. When a request for correction or amendment is denied in whole or in part, the requester may appeal the denial to the Solicitor of Labor within 90 days of his receipt of the notice denying his request. An appeal to the Solicitor of Labor shall be made in writing, shall set forth the specific item of information sought to be corrected or amended, and shall include any documentation said to justify the change. An appeal shall be addressed to the Solicitor of Labor, U.S. Department of Labor, 200 Constitution Avenue, NW, Washington, DC 20210-0002. Both the envelope and the letter of appeal itself must be clearly marked: “Privacy Act Amendment Appeal.”

(d) Determination on appeal. The Solicitor of Labor shall decide all appeals from denials of requests to correct or amend records. All such appeals shall be decided within 30 working days of receipt of the appeal, unless there is good cause shown to extend this period. The appellant shall be notified if the period for decision has been extended.

(1) If the denial of a request is affirmed on appeal, the requester shall be so notified in writing and advised of:

(i) The reason or reasons the denial has been affirmed,

(ii) The requester's right to file a Statement of Disagreement, as provided in paragraph (f) of this section, and

(iii) The requester's right to obtain judicial review of the denial in the U.S. District Court for the judicial district in which the requester resides or has its principal place of business, the judicial district in which the record is located, or the District of Columbia.

(2) If the denial is reversed on appeal, the requester shall be so notified and the request for correction or amendment shall be promptly remanded to the component that denied the request for processing in accordance with the decision on appeal.

(e) Delegation of Authority by the Solicitor of Labor. The Solicitor of Labor is authorized to delegate his or her authority to decide any and all appeals from denials of requests to correct or amend records to other senior attorneys within the Office of the Solicitor.

(f) Statements of disagreement. A requester whose request or appeal under this section has been denied shall have the right to file a Statement of Disagreement with the Solicitor of Labor, U.S. Department of Labor, 200 Constitution Avenue, NW, Washington, DC 20210-0002, within 30 days of receiving notice of denial. Statements of Disagreement may not exceed one typed page per fact disputed. Statements exceeding this limit shall be returned to the requester for condensation. Upon receipt of a Statement of Disagreement under this section, the agency shall promptly have the statement included in the record and shall have the disputed record marked so as to indicate that a Statement of Disagreement has been filed.

(g) Notices of correction or amendment or disagreement. Within 30 working days of the correction or amendment of a record, the component that maintains the record shall advise all components or agencies to which it previously disclosed the record that the record has been amended. Whenever an individual has filed a Statement of Disagreement, a component shall append a copy of the Statement to the disputed record whenever the record is disclosed. The component may also append to the disputed record a written statement giving the component's reasons for denying the request to correct or amend the record.

Certain records are not subject to correction or amendment. These include, but are not limited to:

(a) Transcripts of testimony given under oath or written statements made under oath;

(b) Transcripts or decisions of grand jury, administrative, judicial, or quasi-judicial proceedings which constitute the official record of such proceedings;

(c) Records duly exempted from correction pursuant to 5 U.S.C. 552a(j) or 552a(k) by rulemaking promulgated under the Administrative Procedure Act (5 U.S.C. 551 et seq.)

If the record of an individual has been disclosed to any person under compelling circumstances affecting the health or safety of any person, as described in 5 U.S.C. 552a(b)(8), the individual to whom the record pertains shall be notified of the disclosure at his last known address within 10 working days. The notice of such disclosure shall be in writing and shall state the nature of the information disclosed, the person or agency to whom it was disclosed, the date of disclosure, and the compelling circumstances justifying the disclosure. The officer who made or authorized the disclosure shall be responsible for providing such notification.

(a) Each component unit that requests an individual to disclose his social security account number shall provide the individual, in writing, with the following information:

(1) The statute, regulation, Executive Order or other authority under which the number is solicited;

(2) Whether the disclosure is mandatory or voluntary; and

(3) The consequences, if any, to the individual should he or she refuse or fail to disclose the number.

(b) Neither the Department nor any of its component units shall, in the absence of specific federal statutory authority, deny to an individual any right, benefit or privilege provided by law solely because of such individual's refusal to disclose his social security account number.

(c) The head of each component unit shall ensure that employees authorized to collect social security account numbers or tax identifying numbers, are aware of the statutory or other basis for collecting such information, of the uses to which such numbers may be put, and of the consequences, if any, that might follow if a person refuses to disclose the requested number.

(a) Each component shall inform its employees of the provisions of the Privacy Act, including the Act's civil liability and criminal penalty provisions. Each component also shall notify its employees that they have a duty to:

(1) Protect the security of records,

(2) Ensure the accuracy, relevance, timeliness, and completeness of records,

(3) Avoid the unauthorized disclosure, either verbal or written, of records, and

(4) Ensure that the component maintains no system of records without public notice.

(b) Except to the extent that the Privacy Act permits such activities, an employee of the Department of Labor shall:

(1) Not collect information of a personal nature from individuals unless the employee is authorized to collect such information to perform a function or discharge a responsibility of the Department;

(2) Collect from individuals only that information which is necessary to the performance of the functions or to the discharge of the responsibilities of the Department;

(3) Collect information about an individual directly from that individual, whenever practicable;

(4) Inform each individual from whom information is collected of:

(i) The legal authority that authorizes the Department to collect such information,

(ii) The principal purposes for which the Department intends to use the information,

(iii) The routine uses the Department may make of the information, and

(iv) The practical and legal effects upon the individual of not furnishing the information;

(5) Maintain all records which are used by the agency in making any determination about any individual with such accuracy, relevance, timeliness, and completeness as to ensure fairness to the individual in the determination;

(6) Maintain no record describing how any individual exercises rights guaranteed by the First Amendment to the United States Constitution, unless:

(i) The individual has volunteered such information for his own benefit,

(ii) A statute expressly authorizes the Department to collect, maintain, use, or disseminate the information, or

(iii) The individual's beliefs, activities, or membership are pertinent to and within the scope of an authorized law enforcement activity;

(7) Notify the head of the component of the existence or development of any system of records that has not been disclosed to the public;

(8) Disclose no record to anyone, for any use, unless authorized by the Act;

(9) Maintain and use records with care to prevent the inadvertent disclosure of a record to anyone; and

(10) Notify the head of the component of any record that contains information that the Act or the foregoing provisions of this paragraph do not permit the Department to maintain.

(a) Prohibition. (1) An employee shall not engage in a financial transaction using nonpublic information, nor allow the improper use of nonpublic information to further his own private interest or that of another, whether through advice or recommendations, or by knowing unauthorized disclosure. See 5 CFR 2635.703.

(2) Nonpublic information is information that an employee gains by reason of Federal employment that he knows or reasonably should know has not been made available to the general public. Nonpublic information includes information contained in a Privacy Act system of records which an individual knew or should have known:

(i) Is normally exempt from disclosure under Exemptions 6 or 7(C) of the Freedom of Information Act, or is otherwise protected from disclosure by statute, Executive Order or regulation;

(ii) Has not actually been disseminated to the general public and is not authorized to be made available to the public upon request.

(b) Sanctions. Any DOL employee who willfully discloses any information or records from any file that contains individually-identifiable information to any person or agency not entitled to receive it, and the disclosure of which is prohibited by the Privacy Act or by rules or regulations established thereunder, and who, knowing the disclosure of the specific material is so prohibited, will be subject to disciplinary action, as appropriate.

(c) Public disclosures by third parties of DOL Privacy Act records. When Labor Department records subject to the Privacy Act are disclosed to third parties, and as a condition of the disclosure of such records, the person or entity to whom the records are furnished is expressly prohibited from further disseminating the information, any further dissemination of the information so furnished to such person or entity may be subject to the penalties set forth in 18 U.S.C. 641.

All DOL systems managers, disclosure officers, and employees with responsibilities under the Privacy Act shall periodically attend training offered by the Department on the Privacy Act.