(a) Individuals may request access to records in a system of records or request to be notified if a system of records contains records pertaining to them by writing to or appearing in person before the DoD Component that maintains the record. Written requests should be sent to the address listed in the record access procedures of the system of records notice (SORN) containing the record requested. If the name of the system of records or the address for the DoD Component that has the record is unknown, the individual may look up the SORN or the contact information for the DoD Component Privacy Office at http://www.defense.gov/privacy.

(b) For access to the Official Personnel Files of federal civilian employees, which are maintained in the custody of the Department under the authority of the Office of Personnel Management (OPM) SORN OPM/GOVT-1, individuals must contact their DoD Component FOIA Requester Service Center. Contact information for DoD Component FOIA Requester Service Centers can be found at https://www.foia.gov/report-makerequest.html.

(c) Requesters should provide their full name, current address and email address, and when requested in the access procedures of the applicable SORN, date of birth, place of birth, and telephone number, to assist the DoD Component in responding to the request and providing released records to the requester. The requester must sign the request and have it notarized or submit the request under 28 U.S.C. 1746, a law that permits unsworn statements to be made under penalty of perjury as a substitute for notarization. To assist with the identification and location of requested records, when requested in the access procedures of the applicable SORN, the requester may also, at his or her option, include his or her DoD Identification Number (DoD ID Number) or Social Security Number (SSN). Providing a DoD ID Number or SSN should be appropriate for the type of record being sought.

(d) When making a request for access to records as the parent or guardian for an individual who is a minor or for an individual who is determined by a court to be incompetent, the parent/guardian must establish:

(1) The identity of the individual who is the subject of the record;

(2) The parent/guardian's own identity;

(3) That the requester is the parent or guardian of that individual, which may be proven by providing a copy of the individual's birth certificate showing parentage or a court order establishing the guardianship; and

(4) That the parent or guardian is acting on behalf of the individual in making the request.

(e) Members of the Military Services and married persons are not considered minors, regardless of age.

DoD may deny an individual access to certain information about the individual that resides in a DoD Component's system of records when an exemption from the Privacy Act is claimed for the system of records and codified in the Code of Federal Regulations as described in § 310.12. When an exemption pursuant to subsection (j) or (k) of the Privacy Act exists, it will be listed in the SORN for the particular system in which the individual's information is located. Records compiled in reasonable anticipation of a civil action or proceeding may be withheld pursuant to subsection (d)(5) of the Privacy Act.

(a) Upon receipt of a request, a component will send an acknowledgment letter to the requester within 10 days (excluding Saturdays, Sundays, and legal public holidays) which shall confirm the requester's agreement to pay duplication fees, if any, and provide an assigned case file number for reference purposes.

(b) In some cases, the DoD Component initially receiving the request may refer the request to another DoD Component or agency. The DoD Component that initially received the request will send the requester a notice of referral that will identify each DoD Component or agency to which the request has been referred, as well as which part of the request has been referred.

(c) Access to protected health information, including medical records, is governed by the Privacy Act and DoD 6025.18-R, “DoD Health Information Privacy Regulation” (available at http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/602518r.pdf).

(d) When a DoD Component makes a determination to grant a request for access in whole or in part, the DoD Component shall notify the requester in writing or simply provide the requested record. The response to the request may be made in lieu of the acknowledgment of receipt provided the response will be made within 10 days (excluding Saturdays, Sundays, and legal public holidays). The DoD Component shall inform the requester of any fee charged for duplication of the record(s). If the request is made in person, the individual may receive the records directly in a manner not unreasonably disruptive of the DoD Component's operations, upon payment of any applicable fee. If the individual is accompanied by another person, the individual may be required to authorize in writing any discussion of the records in the presence of the other person.

(e) A DoD Component denying a request for access in any respect shall notify the requester of that determination in writing.

(1) The notice of denial consists of:

(i) A determination to withhold any requested record in whole or in part;

(ii) A determination that a requested record does not exist or cannot be located; or

(iii) A determination that what has been requested is not a record subject to the Privacy Act.

(2) The denial notification letter shall be signed by the head of the DoD Component, or the DoD Component head's designee, and shall include:

(i) The date of the denial;

(ii) A brief statement of the reason(s) for the denial, including any Privacy Act exemption(s) applied by the DoD Component in denying the request; and

(iii) A statement that the denial can be appealed within 60 calendar days in accordance with § 310.6. The statement will include the position title and the address of the appellate authority.

(a) If the requester is dissatisfied with a DoD Component's response, the requester can appeal an adverse determination denying the request to the appellate authority listed in the notification of denial letter. The appeal must be made in writing, and it must be postmarked within 60 calendar days of the date of the letter denying the initial request for records. The letter of appeal should include a copy of the DoD Component's determination (including the assigned request number, if known). For the quickest possible handling, the appeal letter and the envelope should be marked: “Privacy Act Appeal.”

(b) The appellant will be notified of the decision on his or her appeal in writing. If the decision affirms the adverse determination in whole or in part, the notification will include a brief statement of the reason(s) for the affirmation, including any exemptions applied, and will inform the appellant of the Privacy Act provisions for judicial review of the appellate authority's decision. If the adverse determination is reversed or modified, in whole or in part, the appellant will be notified in writing of this decision and the request will be reprocessed in accordance with that appeal decision.

(c) In order to seek a judicial review of a denial of a request for access to records, a requester must first file an appeal under this section.

(d) An appeal ordinarily will not be acted on if the request becomes a matter of litigation.

(a) If the record is not subject to amendment and correction as stated in paragraph (b) of this section, an individual may make a request for amendment or correction of a DoD Component's record about that individual by writing directly to the DoD Component that maintains the record as identified in the published SORN applicable to the record. The request should identify each particular record in question, state the amendment or correction that is sought, and state why the record is not accurate, relevant, timely, or complete without the correction. The individual will also need to verify identity in the same manner as described in §§ 310.3(c) through (d). Factual documentation that is helpful to the DoD Component privacy officials should be submitted with the request. If it is believed that the same record exists in more than one system of records, this should be stated in the request, and the request should be addressed to each DoD Component that maintains a system of records containing the record as noted in this paragraph.

(b) Certain records are not subject to amendment or correction under the Privacy Act:

(1) Proceedings and determinations of courts-martial, military tribunal, or Military Boards of Correction are not generally subject to amendment or correction under the Privacy Act.

(2) Records in systems of records that have been exempted from amendment and correction under the Privacy Act, 5 U.S.C. 552a(j) or (k) are not subject to amendment or correction.

(3) The amendment process is not intended to permit the alteration of records presented in the course of judicial or quasi-judicial proceedings such as the adjudication process for personnel security clearances or contesting grades in academic records. Any amendments or changes to these records normally are made through the specific procedures established for the amendment of such records.

(4) Nothing in the amendment process is intended or designed to permit a collateral attack upon what has already been the subject of a judicial or quasi-judicial determination. However, while the individual may not attack the accuracy of the judicial or quasi-judicial determination under this part, he or she may challenge the accuracy of the recording of that action.

(c) An individual requesting amendment or correction of records will receive a written acknowledgment of receipt of the request within 10 days (excluding Saturdays, Sundays, and legal public holidays), as required by the Privacy Act. The response to the request may be made in lieu of the acknowledgment of receipt provided the response is made within 10 days (excluding Saturdays, Sundays, and legal public holidays). The response to the request must be made promptly and indicate whether the request is granted or denied.

(d) If the request for amendment or correction is granted in whole or in part, the response to the individual will receive a description or copy of the amendment or correction made and, if a copy of the amended or corrected record is not included in the response, notification of the right to obtain a copy of the corrected or amended record in disclosable form.

(e) If the request for amendment or correction is denied in whole or in part, the response to the individual will include a signed letter stating:

(1) The reason(s) for the denial; and

(2) The procedure for appeal of the denial under paragraph (f) of this section, including the name, position title and business address of the official who will act on the appeal.

(f) An individual may appeal the denial of a request for amendment or correction to the individual's record to the appellate authority at the address listed in the notification of denial letter, in the same manner as for a denial of a request for access to records (see § 310.6). The appeal determination shall be made within 30 working days (excluding Saturdays, Sundays, and legal public holidays) from the date of the appeal, unless the period is extended for good cause. If the appeal is denied in whole or in part, the individual will be advised of the right to file a Statement of Disagreement as described in paragraph (g) of this section, and of the right under the Privacy Act for judicial review of the decision.

(g) If an appeal under this section is denied in whole or in part, the individual has the right to file a Statement of Disagreement that states the reason(s) for disagreeing with the DoD Component's denial of the request for amendment or correction. Statements of Disagreement must be concise, must clearly identify each part of any record that is disputed, and should generally be no longer than one typed page. The Statement of Disagreement must be sent to the DoD Component holding the respective record. The Statement of Disagreement will be filed or notated in the system of records, and an annotation to the record itself will indicate the existence and location of the Statement of Disagreement.

(h) Notifications of amendment/correction or statements of disagreement will be made to all persons, organizations, and agencies to which the record was previously disclosed if an accounting of that disclosure was made in accordance with subsection (c) of the Privacy Act and § 310.9. If an individual has filed a Statement of Disagreement, a copy of the statement will be appended to the disputed record whenever the record is disclosed, and a concise statement of the reason(s) for denying the request to amend or correct the record may also be appended.

In addition to the right to judicial review after a denied appeal for access to or amendment of a record, the requester has the right to bring a civil action against the Department if the Department:

(a) Fails to maintain a record concerning the individual with such accuracy, relevance, timeliness and completeness as is necessary to assure fairness in any determination relating to the qualifications, character, rights, opportunities of, or benefits to the individual that may be made on the basis of such record, and consequently a determination is made which is adverse to the individual; or

(b) Fails to comply with any other provision of the Privacy Act or this rule, in such a way as to have an adverse effect on the individual.

(a) An individual may make a request for an accounting of any disclosure that has been made by the Department to another person, organization, or agency of any record about the individual maintained in a system of records.

(b) This accounting contains the date, nature, and purpose of each disclosure, as well as the name and address of the person, organization, or agency to which the disclosure was made. Records of disclosure accountings are maintained for five years after the disclosure or for the life of the record, whichever is longer.

(c) The request for an accounting should identify each particular record in question and should be made by writing directly to the DoD Component that maintains the record, following the procedures in § 310.3.

(d) DoD Components are not required to provide disclosure accountings when related to:

(1) Disclosures for which accountings are not required to be kept—in other words, disclosures that are made to employees within the Department who have a need for the record in the performance of their duties and disclosures that are made under the Freedom of Information Act;

(2) Disclosures made to law enforcement agencies for authorized law enforcement activities in response to written request from the head of the agency or instrumentality of those law enforcement agencies specifying the law enforcement activities for which the disclosures are sought; or

(3) Disclosures made from systems of records that have been exempted from accounting requirements.

(e) An individual may appeal a denial of a request for a disclosure accounting to the address listed in the notification of denial letter, in the same manner as a denial of a request for access to records, following the procedures in § 310.6.

(a) When an individual makes a Privacy Act request for a copy of a record in a system of records, the request shall be considered an agreement to pay all applicable fees.

(b) There is no minimum fee for duplication, and there is no automatic charge for processing a request. Fees for duplication of records will be charged in the same manner as requests for records under the Freedom of Information Act.

(c) Normally, fees are waived automatically if the direct costs of a given request are less than the cost of processing the fee. Decisions to waive or reduce fees that exceed the waiver threshold are made on a case-by-case basis.

Nothing in this part shall be construed to entitle any person, as of right, to any service or to the disclosure of any record to which such person is not entitled under the Privacy Act.