This subpart contains the regulations of the Department of the Interior implementing section 3 of the Privacy Act. Sections 2.47 through 2.57 describe the procedures and policies of the Department concerning maintenance of records which are subject to the Act. Sections 2.60 through 2.66 describe the procedure under which individuals may determine whether systems of records subject to the Act contain records relating to them and the procedure under which they may seek access to existing records. Sections 2.70 through 2.77 describe the procedure under which individuals may petition for amendment of records subject to the Act relating to them. Section 2.79 lists records systems that have been exempted from certain requirements of the Act.

(a) Act. As used in this subpart, “Act” means section 3 of the Privacy Act, 5 U.S.C. 552a.

(b) Bureau. For purposes of this subpart, a “bureau” is any constituent bureau or office of the Department, including the Office of the Secretary and any other Departmental office.

(c) Individual. As used in this subpart, “individual” means a citizen of the United States or an alien lawfully admitted for permanent residence.

(d) Maintain. As used in this subpart, the term “maintain” includes maintain, collect, use or disseminate.

(e) Record. As used in this subpart, “record” means any item, collection, or grouping of information about an individual that is maintained by the Department or a bureau thereof, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the individual's name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print, or a photograph.

(f) System of records. As used in this subpart, “System of records” means a group of any records under the control of the Department or a bureau thereof from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

(g) Medical records. As used in this subpart, “medical records” means records which relate to the identification, prevention, cure or alleviation of any disease, illness or injury including psychological disorders, alcoholism and drug addiction.

(h) Office of Personnel Management personnel records. As used in the subpart, “Office of Personnel Management personnel records” means records maintained for the Office of Personnel Management by the Department and used for personnel management programs or processes such as staffing, employee development, retirement, and grievances and appeals.

(i) Statistical records. As used in this subpart, “statistical records” means records in a system of records maintained for statistical research or reporting purposes only and not used in whole or in part in making any determination about an identifiable individual.

(j) Routine use. As used in this subpart, “routine use” means a use of a record for a purpose which is compatible with the purpose for which it was collected.

(k) System notice. As used in this subpart, “system notice” means the notice describing a system of records required by 5 U.S.C. 552a(e)(4) to be published in the Federal Register upon establishment or revision of the system of records.

(l) System manager. As used in this subpart, “system manager” means the official designated in a system notice as having administrative responsibility for a system of records.

(m) Departmental Privacy Act Officer. As used in this subpart, “Departmental Privacy Act Officer” means the official in the Office of the Assistant Secretary—Policy, Budget and Administration charged with responsibility for assisting the Assistant Secretary—Policy, Budget and Administration in carrying out the functions assigned in this subpart and for coordinating the activities of the bureaus of the Department in carrying out the functions which they are assigned in this subpart.

(n) Bureau Privacy Act Officer. As used in this subpart, “Bureau Privacy Act Officer” means the official within each bureau assigned responsibility for bureau implementation of the Act and the regulations of this subpart.

(o) Working day. As used in this subpart, “working day” means a regular Federal work day. It does not include Saturdays, Sundays or public legal holidays.

The Privacy Act applies to all “records,” as that term is defined in § 2.46(e), which the Department maintains in a “system of records,” as that term is defined in § 2.46(f).

(a) Content of records. Records subject to the Act shall contain only such information about an individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or Executive Order of the President.

(b) Standards of accuracy. Records subject to the Act which are used in making any determination about any individual shall be maintained with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual in making the determination.

(c) Collection of information. (1) Information which may be used in making determinations about an individual's rights, benefits, and privileges under Federal programs shall, to the greatest extent practicable, be collected directly from that individual.

(2) In deciding whether collection of information from an individual, as opposed to a third party source, is practicable, the following factors, among others, may be considered:

(i) Whether the nature of the information sought is such that it can only be obtained from a third party;

(ii) Whether the cost of collecting the information from the individual is unreasonable when compared with the cost of collecting it from a third party;

(iii) Whether there is a risk that information collected from third parties, if inaccurate, could result in an adverse determination to the individual concerned;

(iv) Whether the information, if supplied by the individual, would have to be verified by a third party; or

(v) Whether provisions can be made for verification, by the individual, of information collected from third parties.

(d) Advice to individuals concerning uses of information. (1) Each individual who is asked to supply information about him or herself which will be added to a system of records shall be informed of the basis for requesting the information, how it may be used, and what the consequences, if any, are of not supplying the information.

(2) At a minimum, the notice to the individual must state:

(i) The authority (whether granted by statute or Executive Order of the President) which authorizes the solicitation of the information and whether disclosure of such information is mandatory or voluntary;

(ii) The principal purpose or purposes for which the information is intended to be used;

(iii) The routine uses which may be made of the information; and

(iv) The effects on the individual, if any, of not providing all or any part of the requested information.

(3)(i) When information is collected on a standard form, the notice to the individual shall be provided on the form, on a tear-off sheet attached to the form, or on a separate sheet, whichever is most practical.

(ii) When information is collected by an interviewer, the interviewer shall provide the individual with a written notice which the individual may retain. If the interview is conducted by telephone, however, the interviewer may summarize the notice for the individual and need not provide a copy to the individual unless the individual requests a copy.

(iii) An individual may be asked to acknowledge, in writing, that the notice required by this section has been provided.

(e) Records concerning activity protected by the First Amendment. No record may be maintained describing how any individual exercises rights guaranteed by the First Amendment to the Constitution unless the maintenance of the record is (1) expressly authorized by statute or by the individual about whom the record is maintained or (2) pertinent to and within the scope of an authorized law enforcement activity.

(a) The Privacy Act requires publication of a notice in the Federal Register describing each system of records subject to the Act. Such notice will be published prior to the establishment or a revision of the system of records. 5 U.S.C. 552a(e)(4).

(b) Each bureau shall notify the Departmental Privacy Act Officer promptly of any modifications or amendments which are required in the then-current notice describing a system of records for which it is responsible.

(c) A bureau desiring to establish a new system of records or a new use for an existing system of records shall notify the Departmental Privacy Act Officer, no fewer than ninety (90) calendar days in advance.

(a) Statutory requirement. The Privacy Act requires that records subject to the Act be maintained with appropriate administrative, technical and physical safeguards to insure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity which could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained, 5 U.S.C. 552a(e)(10).

(b) Records maintained in manual form. When maintained in manual form, records subject to the Privacy Act shall be maintained in a manner commensurate with the sensitivity of the information contained in the system of records. The following minimum safeguards, or safeguards affording comparable protection, are applicable to Privacy Act systems of records containing sensitive information:

(1) Areas in which the records are maintained or regularly used shall be posted with an appropriate warning stating that access to the records is limited to authorized persons. The warning also shall summarize the requirements of § 2.52 and state that the Privacy Act contains a criminal penalty for the unauthorized disclosure of records to which it applies.

(2) During working hours, (i) the area in which the records are maintained or regularly used shall be occupied by authorized personnel or (ii) access to the records shall be restricted by their storage in locked metal file cabinets or a locked room.

(3) During non-working hours, access to the records shall be restricted by their storage in locked metal file cabinets or a locked room.

(4) Where a locked room is the method of security provided for a system, the bureau responsible for the system shall supplement that security by (i) providing lockable file cabinets or containers for the records or (ii) changing the lock or locks for the room so that they may not be opened with a master key. For the purposes of this paragraph, a master key is a key which may be used to open rooms other than the room containing records subject to the Privacy Act, unless those rooms are utilized by officials or employees authorized to have access to the records subject to the Privacy Act.

(c) Records maintained in computerized form. When maintained in computerized form, records subject to the Privacy Act shall be maintained, at a minimum, subject to safeguards based on those recommended in the National Bureau of Standard's booklet “Computer Security Guidelines for Implementing the Privacy Act of 1974” (May 30, 1975), and any supplements thereto, which are adequate and appropriate to assuring the integrity of records in the system.

(d) Office of Personnel Management personnel records. A system of records made up of Office of Personnel Management personnel records shall be maintained under the security requirements set out in 5 CFR 293.106 and 293.107.

(e) Bureau responsibility. (1) The bureau responsible for a system of records shall be responsible for assuring that specific procedures are developed to assure that the records in the system are maintained with security meeting the requirements of the Act and this section.

(2) These procedures shall be in writing and shall be posted or otherwise periodically brought to the attention of employees working with the records contained in the system.

(a) Handling of records subject to the Act. Employees whose duties require handling of records subject to the Privacy Act shall, at all times, take care to protect the integrity, security and confidentiality of these records.

(b) Disclosure of records. No employee of the Department may disclose records subject to the Privacy Act unless disclosure is permitted under § 2.56 or is to the individual to whom the record pertains.

(c) Alteration of records. No employee of the Department may alter or destroy a record subject to the Privacy Act unless (1) such alteration or destruction is properly undertaken in the course of the employee's regular duties or (2) such alteration or destruction is required by a decision under §§ 2.70 through 2.75 or the decision of a court of competent jurisdiction.

(d) Bureau responsibility. The bureau responsible for a system of records shall be responsible for assuring that employees with access to the system are made aware of the requirements of this section and of 5 U.S.C. 552a(i)(1), which imposes criminal penalties for knowingly and willfully disclosing a record about an individual without the written request or consent of that individual unless disclosure is permitted under one of the exceptions listed in § 2.56 (b) and (c).

(a) Required contract provisions. When a contract provides for the operation by or on behalf of the Department of a system of records to accomplish a Department function, the contract shall, consistent with the Department's authority, cause the requirements of 5 U.S.C. 552a and the regulations contained in this subpart to be applied to such system.

(b) System manager. The head of the bureau responsible for the contract shall designate a regular employee of the bureau to be the manager for a system of records operated by a contractor.

(a) Prohibition of disclosure. No record contained in a system of records may be disclosed by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains.

(b) General exceptions. The prohibition contained in paragraph (a) does not apply where disclosure of the record would be:

(1) To those officers or employees of the Department who have a need for the record in the performance of their duties; or

(2) Required by the Freedom of Information Act, 5 U.S.C. 552.

(c) Specific exceptions. The prohibition contained in paragraph (a) of this section does not apply where disclosure of the record would be:

(1) For a routine use as defined in § 2.46(j) which has been described in a system notice published in the Federal Register;

(2) To the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of Title 13, U.S. Code.

(3) To a recipient who has provided the system manager responsible for the system in which the record is maintained with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable;

(4) To the National Archives and Records Administration as a record which has sufficient historical or other value to warrant its continued preservation by the U.S. Government, or for evaluation by the Archivist of the United States or the designee of the Archivist to determine whether the record has such value;

(5) To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the Department specifying the particular portion desired and the law enforcement activity for which the record is sought;

(6) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if upon such disclosure notification is transmitted to the last known address of such individual;

(7) To either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee;

(8) To the Comptroller General, or any of his authorized representatives, in the course of the performance of the duties of the General Accounting Office;

(9) Pursuant to the order of a court of competent jurisdiction; or

(10) To a consumer reporting agency in accordance with section 3(d) of the Federal Claims Collection Act of 1966, as amended (31 U.S.C. 3711(f)).

(d) Reviewing records prior to disclosure. (1) Prior to any disclosure of a record about an individual, unless disclosure is required by the Freedom of Information Act, reasonable efforts shall be made to assure that the records are accurate, complete, timely and relevant for agency purposes.

(2) When a record is disclosed in connection with a Freedom of Information request made under subpart B of this part and it is appropriate and administratively feasible to do so, the requester shall be informed of any information known to the Department indicating that the record may not be fully accurate, complete, or timely.

(a) Maintenance of an accounting. (1) Where a record is disclosed to any person, or to another agency, under any of the specific exceptions provided by § 2.56 (c), an accounting shall be made.

(2) The accounting shall record (i) the date, nature, and purpose of each disclosure of a record to any person or to another agency and (ii) the name and address of the person or agency to whom the disclosure was made.

(3) Accountings prepared under this section shall be maintained for at least five years or the life of the record, whichever is longer, after the disclosure for which the accounting is made.

(b) Access to accountings. (1) Except for accountings of disclosures made under § 2.56(c)(5), accountings of all disclosures of a record shall be made available to the individual to whom the record relates at the individual's request.

(2) An individual desiring access to an accounting of disclosures of a record pertaining to the individual shall submit a request by following the procedures of § 2.63.

(c) Notification of disclosure. When a record is disclosed pursuant to § 2.56(c)(9) as the result of the order of a court of competent jurisdiction, reasonable efforts shall be made to notify the individual to whom the record pertains as soon as the order becomes a matter of public record.

(a) Submission of requests. (1)(i) Individuals desiring to determine under the Privacy Act whether a system of records contains records pertaining to them shall address inquiries to the system manager having responsibility for the system unless the system notice describing the system prescribes or permits submission to some other official or officials.

(ii) If a system notice describing a system requires individuals to contact more than two officials concerning the existence of records in the system, individuals desiring to determine whether the system contains records pertaining to them may contact the system manager for assistance in determining which official is most likely to be in possession of records pertaining to those individuals.

(2) Individuals desiring to determine whether records pertaining to them are maintained in two or more systems shall make a separate inquiry concerning each system.

(b) Form of request. (1) An inquiry to determine whether a system of records contains records pertaining to an individual shall be in writing.

(2) To insure expeditious handling, the request shall be prominently marked, both on the envelope and on the face of the request, with the legend “PRIVACY ACT INQUIRY.”

(3) The request shall state that the individual is seeking information concerning records pertaining to him or herself and shall supply such additional identifying information, if any, as is called for in the system notice describing the system.

(4) Individuals who have reason to believe that information pertaining to them may be filed under a name other than the name they are currently using (e.g., maiden name), shall include such information in the request.

(a) Decisions on request. (1) Individuals inquiring to determine whether a system of records contains records pertaining to them shall be promptly advised whether the system contains records pertaining to them unless (i) the records were compiled in reasonable anticipation of a civil action or proceeding or (ii) the system of records is one which has been excepted from the notification provisions of the Privacy Act by rulemaking (§ 2.79).

(2) If the records were compiled in reasonable anticipation of a civil action or proceeding or the system of records is one which has been excepted from the notification provisions of the Privacy Act by rulemaking, the individuals will be promptly notified that they are not entitled to notification of whether the system contains records pertaining to them.

(b) Authority to deny requests. A decision to deny a request for notification of the existence of records shall be made by the system manager responsible for the system of records concerning which inquiry has been made and shall be concurred in by the bureau Privacy Act officer for the bureau which maintains the system, provided, however that the head of a bureau may, in writing, require (1) that the decision be made by the bureau Privacy Act officer and/or (2) that the bureau head's own concurrence in the decision be obtained.

(c) Form of decision. (1) No particular form is required for a decision informing individuals whether a system of records contains records pertaining to them.

(2) A decision declining to inform an individual whether or not a system of records contains records pertaining to him or her shall be in writing and shall:

(i) State the basis for denial of the request.

(ii) Advise the individual that an appeal of the declination may be made to the Assistant Secretary—Policy, Budget and Administration pursuant to § 2.65 by writing to the Privacy Act Officer, Office of the Assistant Secretary—Policy, Budget and Administration, U.S. Department of the Interior, Washington, DC 20240.

(iii) State that the appeal must be received by the foregoing official within twenty (20) working days of the date of the decision.

(3) If the decision declining a request for notification of the existence of records involves Department employee records which fall under the jurisdiction of the Office of Personnel Management, the individual shall be informed in a written response which shall:

(i) State the reasons for the denial.

(ii) Include the name, position title, and address of the official responsible for the denial.

(iii) Advise the individual that an appeal of the declination may be made only to the Assistant Director for Workforce Information, Personnel Systems Oversight Group, Office of Personnel Management, 1900 E Street NW., Washington, DC 20415.

(4) Copies of decisions declining a request for notification of the existence of records made pursuant to paragraphs (c)(2) and (c)(3) of this section shall be provided to the Departmental and Bureau Privacy Act Officers.

The Privacy Act permits individuals, upon request, to gain access to their records or to any information pertaining to them which is contained in a system and to review the records and have a copy made of all or any portion thereof in a form comprehensive to them. 5 U.S.C. 552a(d)(1). A request for access shall be submitted in accordance with the procedures in this subpart.

(a) Submission of requests. (1)(i) Requests for access to records shall be submitted to the system manager having responsibility for the system in which the records are maintained unless the system notice describing the system prescribes or permits submission to some other official or officials.

(ii) If a system notice describing a system requires individuals to contact more than two officials concerning access to records in the system, individuals desiring to request access to records pertaining to them may contact the system manager for assistance in determining which official is most likely to be in custody of records pertaining to that individual.

(2) Individuals desiring access to records maintained in two or more separate systems shall submit a separate request for access to the records in each system.

(b) Form of request. (1) A request for access to records subject to the Privacy Act shall be in writing.

(2) To insure expeditious handling, the request shall be prominently marked, both on the envelope and on the face of the request, with the legend “PRIVACY ACT REQUEST FOR ACCESS.”

(3) Requesters shall specify whether they seek all of the records contained in the system which relate to them or only some portion thereof. If only a portion of the records which relate to the individual are sought, the request shall reasonably describe the specific record or records sought.

(4) If the requester seeks to have copies of the requested records made, the request shall state the maximum amount of copying fees which the requester is willing to pay. A request which does not state the amount of fees the requester is willing to pay will be treated as a request to inspect the requested records. Requesters are further notified that under § 2.64(d) the failure to state willingness to pay fees as high as are anticipated by the Department will delay processing of a request.

(5) The request shall supply such identifying information, if any, as is called for in the system notice describing the system.

(6) Requests failing to meet the requirements of this paragraph shall be returned to the requester with a written notice advising the requester of the deficiency in the request.

(a) Decisions on requests. A request made under this subpart for access to a record shall be granted promptly unless (1) the record was compiled in reasonable anticipation of a civil action or proceeding or (2) the record is contained in a system of records which has been excepted from the access provisions of the Privacy Act by rulemaking (§ 2.79).

(b) Authority to deny requests. A decision to deny a request for access under this subpart shall be made by the system manager responsible for the system of records in which the requested record is located and shall be concurred in by the bureau Privacy Act officer for the bureau which maintains the system, provided, however, that the head of a bureau may, in writing, require (1) that the decision be made by the bureau Privacy Act officer and/or (2) that the bureau head's own concurrence in the decision be obtained.

(c) Form of decision. (1) No particular form is required for a decision granting access to a record. The decision shall, however, advise the individual requesting the record as to where and when the record is available for inspection or, as the case may be, where and when copies will be available. If fees are due under § 2.64(d), the individual requesting the record shall also be notified of the amount of fees due or, if the exact amount has not been determined, the approximate amount of fees due.

(2) A decision denying a request for access, in whole or part, shall be in writing and shall:

(i) State the basis for denial of the request.

(ii) Contain a statement that the denial may be appealed to the Assistant Secretary—Policy, Budget and Administration pursuant to § 2.65 by writing to the Privacy Act Officer, Office of the Assistant Secretary—Policy, Budget and Administration, U.S. Department of the Interior, Washington, DC 20240.

(iii) State that the appeal must be received by the foregoing official within twenty (20) working days of the date of the decision.

(3) If the decision denying a request for access involves Department employee records which fall under the jurisdiction of the Office of Personnel Management, the individual shall be informed in a written response which shall:

(i) State the reasons for the denial.

(ii) Include the name, position title, and address of the official responsible for the denial.

(iii) Advise the individual that an appeal of the denial may be made only to the Assistant Director for Workforce Information, Personnel Systems and Oversight Group, Office of Personnel Management, 1900 E Street NW., Washington, DC 20415.

(4) Copies of decisions denying requests for access made pursuant to paragraphs (c)(2) and (c)(3) of this section will be provided to the Departmental and Bureau Privacy Act Officers.

(d) Fees. (1) No fees may be charged for the cost of searching for or reviewing a record in response to a request made under § 2.63.

(2) Fees for copying a record in response to a request made under § 2.63 shall be charged in accordance with the schedule of charges contained in Appendix A to this part, unless the official responsible for processing the request determines that reduction or waiver of fees is appropriate.

(3) Where it is anticipated that fees chargeable in connection with a request will exceed the amount the person submitting the request has indicated a willingness to pay, the official processing the request shall notify the requester and shall not complete processing of the request until the requester has agreed, in writing, to pay fees as high as are anticipated.

(a) Right of appeal. Except for appeals pertaining to Office of Personnel Management records, individuals who have been notified that they are not entitled to notification of whether a system of records contains records pertaining to them or have been denied access, in whole or part, to a requested record may appeal to the Assistant Secretary—Policy, Budget and Administration.

(b) Time for appeal. (1) An appeal must be received by the Privacy Act Officer no later than twenty (20) working days after the date of the initial decision on a request.

(2) The Assistant Secretary—Policy, Budget and Administration may, for good cause shown, extend the time for submission of an appeal if a written request for additional time is received within twenty (20) working days of the date of the initial decision on the request.

(c) Form of appeal. (1) An appeal shall be in writing and shall attach copies of the initial request and the decision on the request.

(2) The appeal shall contain a brief statement of the reasons why the appellant believes the decision on the initial request to have been in error.

(3) The appeal shall be addressed to Privacy Act Officer, Office of the Assistant Secretary—Policy, Budget and Administration, U.S. Department of the Interior, Washington, DC 20240.

(d) Action on appeals. (1) Appeals from decisions on initial requests made pursuant to §§ 2.61 and 2.63 shall be decided for the Department by the Assistant Secretary—Policy, Budget and Administration or an official designated by the Assistant Secretary after consultation with the Solicitor.

(2) The decision on an appeal shall be in writing and shall state the basis for the decision.

(a) Medical records. (1) Medical records shall be disclosed to the individual to whom they pertain unless it is determined, in consultation with a medical doctor, that disclosure should be made to a medical doctor of the individual's choosing.

(2) If it is determined that disclosure of medical records directly to the individual to whom they pertain could have an adverse effect on that individual, the individual may designate a medical doctor to receive the records and the records will be disclosed to that doctor.

(b) Inspection in presence of third party. (1) Individuals wishing to inspect records pertaining to them which have been opened for their inspection may, during the inspection, be accompanied by a person of their own choosing.

(2) When such a procedure is deemed appropriate, individuals to whom the records pertain may be required to furnish a written statement authorizing discussion of their records in the accompanying person's presence.

The Privacy Act permits individuals to request amendment of records pertaining to them if they believe the records are not accurate, relevant, timely or complete. 5 U.S.C. 552a(d)(2). A request for amendment of a record shall be submitted in accordance with the procedures in this subpart.

(a) Submission of petitions for amendment. (1) A request for amendment of a record shall be submitted to the system manager for the system of records containing the record unless the system notice describing the system prescribes or permits submission to a different official or officials. If an individual wishes to request amendment of records located in more than one system, a separate petition must be submitted to each system manager.

(2) A petition for amendment of a record may be submitted only if the individual submitting the petition has previously requested and been granted access to the record and has inspected or been given a copy of the record.

(b) Form of petition. (1) A petition for amendment shall be in writing and shall specifically identify the record for which amendment is sought.

(2) The petition shall state, in detail, the reasons why the petitioner believes the record, or the objectionable portion thereof, is not accurate, relevant, timely or complete. Copies of documents or evidence relied upon in support of these reasons shall be submitted with the petition.

(3) The petition shall state, specifically and in detail, the changes sought in the record. If the changes involve rewriting the record or portions thereof or involve adding new language to the record, the petition shall propose specific language to implement the changes.

(a) Decisions on petitions. In reviewing a record in response to a petition for amendment, the accuracy, relevance, timeliness and completeness of the record shall be assessed against the criteria set out in § 2.48. In addition, personnel records shall be assessed against the criteria for determining record quality published in the Federal Personnel Manual and the Departmental Manual addition thereto.

(b) Authority to decide. An initial decision on a petition for amendment may be made only by the system manager responsible for the system of records containing the challenged record. If the system manager declines to amend the record as requested, the bureau Privacy Act officer for the bureau which maintains the system must concur in the decision, provided, however, that the head of a bureau may, in writing, require (1) that the decision be made by the bureau Privacy Act officer and/or (2) that the bureau head's own concurrence in the decision be obtained.

(c) Acknowledgement of receipt. Unless processing of a petition is completed within ten (10) working days, the receipt of the petition for amendment shall be acknowledged in writing by the system manager to whom it is directed.

(d) Inadequate petitions. (1) If a petition does not meet the requirements of § 2.71, the petitioner shall be so advised and shall be told what additional information must be submitted to meet the requirements of § 2.71.

(2) If the petitioner fails to submit the additional information within a reasonable time, the petition may be rejected. The rejection shall be in writing and shall meet the requirements of paragraph (e) of this section.

(e) Form of decision. (1) A decision on a petition for amendment shall be in writing and shall state concisely the basis for the decision.

(2) If the petition for amendment is rejected, in whole or part, the petitioner shall be informed in a written response which shall:

(i) State concisely the basis for the decision.

(ii) Advise the petitioner that the rejection may be appealed to the Assistant Secretary—Policy, Budget and Administration by writing to the Privacy Act Officer, Office of the Assistant Secretary—Policy, Budget and Administration, U.S. Department of the Interior, Washington, DC 20240.

(iii) State that the appeal must be received by the foregoing official within twenty (20) working days of the decision.

(3) If the petition for amendment involves Department employee records which fall under the jurisdiction of the Office of Personnel Management and is rejected, in whole or part, the petitioner shall be informed in a written response which shall:

(i) State concisely the basis for the decision.

(ii) Advise the petitioner that an appeal of the rejection may be made pursuant to 5 CFR 297.306 only to the Assistant Director for Workforce Information, Personnel Systems and Oversight Group, Office of Personnel Management, 1900 E Street NW., Washington, DC 20415.

(4) Copies of rejections of petitions for amendment made pursuant to paragraphs (e)(2) and (e)(3) of this section will be provided to the Departmental and Bureau Privacy Act Officers.

(f) Implementation of initial decision. If a petition for amendment is accepted, in whole or part, the bureau maintaining the record shall:

(1) Correct the record accordingly and,

(2) Where an accounting of disclosures has been made pursuant to § 2.57, advise all previous recipients of the record that the correction was made and the substance of the correction.

(a) Acknowledgement of receipt. The acknowledgement of receipt of a petition required by § 2.72(c) shall be dispatched not later than ten (10) working days after receipt of the petition by the system manager responsible for the system containing the challenged record, unless a decision on the petition has been previously dispatched.

(b) Decision on petition. A petition for amendment shall be processed promptly. A determination whether to accept or reject the petition for amendment shall be made within thirty (30) working days after receipt of the petition by the system manager responsible for the system containing the challenged record.

(c) Suspension of time limit. The thirty (30) day time limit for a decision on a petition shall be suspended if it is necessary to notify the petitioner, pursuant to § 2.72(d), that additional information in support of the petition is required. Running of the thirty (30) day time limit shall resume on receipt of the additional information by the system manager responsible for the system containing the challenged record.

(d) Extensions of time. (1) The thirty (30) day time limit for a decision on a petition may be extended if the official responsible for making a decision on the petition determines that an extension is necessary for one of the following reasons:

(i) A decision on the petition requires analysis of voluminous record or records;

(ii) Some or all of the challenged records must be collected from facilities other than the facility at which the official responsible for making the decision is located.

(iii) Some or all of the challenged records are of concern to another bureau of the Department or another agency of the Federal Government whose assistance and views are being sought in processing the request.

(2) If the official responsible for making a decision on the petition determines that an extension is necessary, the official shall promptly inform the petitioner of the extension and the date on which a decision is expected to be dispatched.

(a) Right of appeal. Except for appeals pertaining to Office of Personnel Management records, where a petition for amendment has been rejected in whole or in part, the individual submitting the petition may appeal the denial to the Assistant Secretary—Policy, Budget and Administration.

(b) Time for appeal. (1) An appeal must be received no later than twenty (20) working days after the date of the decision on a petition.

(2) The Assistant Secretary—Policy, Budget and Administration may, for good cause shown, extend the time for submission of an appeal if a written request for additional time is received within twenty (20) working days of the date of the decision on a petition.

(c) Form of appeal. (1) An appeal shall be in writing and shall attach copies of the initial petition and the decision on that petition.

(2) The appeal shall contain a brief statement of the reasons why the appellant believes the decision on the petition to have been in error.

(3) The appeal shall be addressed to Privacy Act Officer, Office of the Assistant Secretary—Policy, Budget and Administration, U.S. Department of the Interior, Washington, DC 20240.

(a) Authority. Appeals from decisions on initial petitions for amendment shall be decided for the Department by the Assistant Secretary—Policy, Budget and Administration or an official designated by the Assistant Secretary, after consultation with the Solicitor.

(b) Time limit. (1) A final determination on any appeal shall be made within thirty (30) working days after receipt of the appeal.

(2) The thirty (30) day period for decision on an appeal may be extended, for good cause shown, by the Secretary of the Interior. If the thirty (30) day period is extended, the individual submitting the appeal shall be notified of the extension and of the date on which a determination on the appeal is expected to be dispatched.

(c) Form of decision. (1) The final determination on an appeal shall be in writing and shall state the basis for the determination.

(2) If the determination upholds, in whole or part, the initial decision rejecting the petition for amendment, the determination shall also advise the individual submitting the appeal:

(i) Of his or her right to file a concise statement of the reasons for disagreeing with the decision of the agency;

(ii) Of the procedure established by § 2.77 for the filing of the statement of disagreement;

(iii) That the statement which is filed will be made available to anyone to whom the record is subsequently disclosed together with, at the discretion of the Department, a brief statement by the Department summarizing its reasons for refusing to amend the record;

(iv) That prior recipients of the challenged record will be provided a copy of any statement of dispute to the extent that an accounting of disclosure was maintained; and

(v) Of his or her right to seek judicial review of the Department's refusal to amend the record.

(3) If the determination reverses, in whole or in part, the initial decision rejecting the petition for amendment, the system manager responsible for the system containing the challenged record shall be directed to:

(i) Amend the challenged record accordingly; and

(ii) If an accounting of disclosures has been made, advise all previous recipients of the record of the amendment and its substance.

(a) Filing of statement. If the determination of the Assistant Secretary—Policy, Budget and Administration under § 2.75 rejects in whole or part, a petition for amendment, the individual submitting the petition may file with the system manager for the system containing the challenged record a concise written statement setting forth the reasons for disagreement with the determination of the Department.

(b) Disclosure of statements. In any disclosure of a record containing information about which an individual has filed a statement of disagreement under this section which occurs after the filing of the statement, the disputed portion of the record will be clearly noted and the recipient shall be provided copies of the statement of disagreement. If appropriate, a concise statement of the reasons of the Department for not making the requested amendments may also be provided to the recipient.

(c) Maintenance of statements. System managers shall develop procedures to assure that statements of disagreement filed with them shall be maintained in such a way as to assure dissemination of the statements to recipients of the records to which the statements pertain.

(a) Criminal law enforcement records exempt under 5 U.S.C. 552a(j)(2). Pursuant to 5 U.S.C. 552a(j)(2) the following systems of records are exempted from all of the provisions of 5 U.S.C. 552a and the regulations in this subpart except paragraphs (b), (c)(1) and (2), (e)(4)(A) through (F), (e)(6), (7), (9), (10), (11), and (12), and (i) of 5 U.S.C. 552a and the portions of the regulations in this subpart implementing these paragraphs:

(1) INTERIOR/FWS-20, Investigative Case File System.

(2) INTERIOR/BIA-18, Law Enforcement Services System.

(3) INTERIOR/NPS-19, Law Enforcement Statistical Reporting System.

(4) INTERIOR/OIG-02, Investigative Records.

(5) INTERIOR/DOI-10, Incident Management, Analysis and Reporting System.

(6) INTERIOR/DOI-50, Insider Threat Program.

(b) Classified records exempt under 5 U.S.C. 552a(k)(1). Pursuant to 5 U.S.C. 552a(k)(1), the following systems of records have been exempted from paragraphs (c)(3), (d), (e)(1), (e)(4)(G), (H), and (I), and (f) of 5 U.S.C. 552a and the provisions of the regulations in this subpart implementing these paragraphs:

(1) INTERIOR/DOI-50, Insider Threat Program.

(2) INTERIOR/DOI-45, Personnel Security Program Files.

(3) INTERIOR/OIG-02, Investigative Records.

(c) Law enforcement records exempt under 5 U.S.C. 552a(k)(2). Pursuant to 5 U.S.C. 552a(k)(2), the following systems of records are exempted from paragraphs (c)(3), (d), (e)(1), (e)(4)(G), (H), and (I), and (f) of 5 U.S.C. 552a and the provisions of the regulations in this subpart implementing these paragraphs:

(1) INTERIOR/OIG-2, Investigative Records.

(2) INTERIOR/FWS-21, Permits System.

(3) INTERIOR/BLM-18, Criminal Case Investigation System.

(4) INTERIOR/BLM-19, Civil Trespass Case Investigations.

(5) INTERIOR/BLM-20, Employee Conduct Investigations.

(6)-(7) [Reserved]

(8) INTERIOR/NPS-17, Employee Financial Irregularities.

(9) INTERIOR/Reclamation-37, Trespass Cases.

(10) INTERIOR/SOL-1, Litigation, Appeal and Case Files System, to the extent that it consists of investigatory material compiled for law enforcement purposes.

(11) INTERIOR/FWS-19, Endangered Species Licenses System.

(12) INTERIOR/FWS-20, Investigative Case File System.

(13) INTERIOR/BIA-24, Timber Cutting and Trespass Claims Files.

(14) INTERIOR/DOI-11, Debarment and Suspension Program.

(15) INTERIOR/DOI-10, Incident Management, Analysis and Reporting System.

(16) INTERIOR/DOI-50, Insider Threat Program.

(17) INTERIOR/DOI-24, Indian Arts and Crafts Board.

(18) INTERIOR/BSEE-01, Investigations Case Management System (CMS).

(19) INTERIOR/DOI-46, Physical Security Access Files.

(20) INTERIOR/DOI-45, Personnel Security Program Files.

(d) Records maintained in connection with providing protective services exempt under 5 U.S.C. 552a(k)(3). Pursuant to 5 U.S.C. 552a(k)(3), the following systems of records have been exempted from paragraphs (c)(3), (d), (e)(1), (e)(4)(G), (H), and (I) and (f) of 5 U.S.C. 552a and the provisions of the regulations in this subpart implementing these paragraphs:

(1) INTERIOR/DOI-46, Physical Security Access Files.

(2) INTERIOR/DOI-45, Personnel Security Program Files.

(3) INTERIOR/OIG-02, Investigative Records.

(e) Investigatory records exempt under 5 U.S.C. 552a(k)(5). Pursuant to 5 U.S.C. 552a(k)(5), the following systems of records have been exempted from paragraphs (c)(3), (d), (e)(1), (e)(4)(G), (H), and (I), and (f) of 5 U.S.C. 552a and the provisions of the regulations in this subpart implementing these paragraphs:

(1) [Reserved]

(2) INTERIOR/GS-9, National Research Council Grants Program.

(3) INTERIOR/OS-68, Committee Management Files.

(4) INTERIOR/DOI-11, Debarment and Suspension Program.

(5) INTERIOR/DOI-46, Physical Security Access Files.

(6) INTERIOR/DOI-50, Insider Threat Program.

(7) INTERIOR/DOI-45, Personnel Security Program Files.

(8) INTERIOR/OIG-02, Investigative Records.

(f) Records maintained on testing and examination material exempt under 5 U.S.C. 552a(k)(6). Pursuant to U.S.C. 552a(k)(6), the following systems of records have been exempted from 5 U.S.C. 552a(c)(3), (d), (e)(1), (e)(4)(G), (H) and (I), and (f) and the provisions of the regulations in this subpart implementing these paragraphs.

(1) INTERIOR/DOI-45, Personnel Security Program Files.

(2) [Reserved]