The procedures outlined in this subpart 1212.2 apply to the following types of requests made by individuals under the Privacy Act concerning records about themselves:

(a) To determine if information on the requester is included in a system of records;

(b) For access to a record under 5 U.S.C. 552a(d)(1); and

(c) For an accounting of disclosures of the individual's Privacy Act records under 5 U.S.C. 552a(c)(3).

[57 FR 4928, Feb. 11, 1992, as amended at 77 FR 60621, Oct. 4, 2012]

(a) Individuals may request access to their Privacy Act records, either in person, in writing, or electronically.

(b) Individuals may also authorize a third party to have access to their Privacy Act records. This authorization shall be in writing, signed by the individual, or submitted electronically. Requests must contain the individual's address or email address, as well as the name, address or email address of the representative being authorized access. The identities of both the subject individual and the representative must be verified in accordance with the procedures set forth in § 1212.202.

(c)(1) In-person or written requests must be directed to the appropriate system manager, or, if unknown, to the Center Privacy Manager or Freedom of Information Act (FOIA) Office at NASA Headquarters or Field Center. The request should be identified clearly on the envelope and on the letter as a “Request Under the Privacy Act.”

(2) Electronic requests may be initiated online at https://www.nasa.gov/about/highlights/HP_Privacy.html.

(3) Where possible, requests should contain the following information to ensure timely processing:

(i) Name and address of subject.

(ii) Email address of subject, for electronic requests only.

(iii) Identity of the system of records.

(iv) Nature of the request.

(v) Identifying information specified in the applicable system notice to assist in identifying the request, such as location of the record, if known, full name, birth date, time periods in which the records are believed to have been compiled, etc.

(d) NASA has no obligation to comply with a nonspecific request for access to information concerning an individual, e.g., a request to provide copies of “all information contained in your files concerning me,” although a good faith effort will be made to locate records if there is reason to believe NASA has records on the individual. If the request is so incomplete or incomprehensible that the requested record cannot be identified, additional information or clarification will be requested in the acknowledgement, and assistance to the individual will be offered as appropriate.

(e) If the Center Privacy Manager receives a request for access, the Privacy Manager will record the date of receipt and immediately forward the request to the responsible system manager for handling.

(f) If the Center FOIA Office receives a first party request for records or access, the FOIA Office will process the request under the Privacy Act pursuant to this part.

(g) Normally, the system manager shall respond to a request for access within 10 business days of receipt of the request and the access shall be provided within 30 business days of receipt.

(1) In response to a request for access, the system manager or Privacy Act Officer shall:

(i) Notify the requester that there is no record on the individual in the system of records and inform the requester of the procedures to follow for appeal (see § 1212.4);

(ii) Notify the requester that the record is exempt from disclosure, cite the appropriate exemption, and inform the requester of the procedures to follow for appeal (see § 1212.4);

(iii) Upon request, promptly provide copies of the record, subject to the fee requirements (see § 1212.204); or

(iv) Make the individual's record available for personal inspection in the presence of a NASA representative.

(2) Unless the system manager agrees to another location, personal inspection of the record shall be at the location of the record as identified in the system notice.

(3) When an individual requests records in a system of records maintained on a third party, the request shall be processed as a FOIA request under 14 CFR part 1206. If the records requested are subject to release under FOIA (5 U.S.C. 552(b)), then a Privacy Act exemption may not be invoked to deny access.

(4) When an individual requests records in a system of records maintained on the individual, the request shall be processed under this part. NASA will not rely on exemptions contained in FOIA to withhold any record which is otherwise accessible to the individual under this part.

[NASA-21-091, 57 FR 4928, Feb. 11, 1992, as amended by NASA-2021-0007, 88 FR 12148, Feb. 27, 2023]

(a) The system manager will release records to the requester or representative in person only upon production of satisfactory identification which includes the individual's name, signature, and photograph or physical description.

(b) The system manager will release records to the requester or representative electronically via a NASA provided temporary secure storage space, after the identities of both are validated by the Agency's identity authorization process.

(c) The system manager will release copies of records by mail only when the circumstances indicate that the requester and the subject of the record are the same. The system manager may require that the requester's signature be notarized or witnessed by two individuals unrelated to the requester.

(d) Identity procedures more stringent than those required in this section may be prescribed in the system notice when the records are medical or otherwise sensitive.

[NASA-21-091; NASA-2021-0007,88 FR 12148, Feb. 27, 2023]

(a) The system manager shall keep a disclosure accounting for each disclosure to a third party of a record from a system of records. This includes records disclosed pursuant to computer matching programs.

(b) Disclosure accountings are not required but are recommended for disclosures made:

(1) With the subject individual's consent; or

(2) In accordance with § 1212.203(f) (1) and (2), below.

(c) The disclosure accounting required by paragraph (a) of this section shall include:

(1) The date, nature, and purpose of the disclosure; and

(2) The name and address of the recipient person or Agency.

(d) The disclosure accounting shall be retained for at least 5 years after the disclosure or for the life of the record, whichever is longer.

(e) The disclosure accounting maintained under the requirements of this section is not itself a system of records.

(f) Records in a NASA system of records may not be disclosed to third parties without the consent of the subject individual. However, in consonance with 5 U.S.C. 552a(b), disclosure may be authorized without consent, if disclosure would be:

(1) To an officer or employee of NASA who has a need for the record in the performance of official duties;

(2) Required under the Freedom of Information Act (5 U.S.C. 552) and part 1206 of this chapter;

(3) For a routine use described in the system notice for the system of records;

(4) To the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of Title 13, U.S. Code;

(5) To a recipient who has provided NASA with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable;

(6) To the National Archives and Records Administration as a record which has sufficient historical or other value to warrant its continued preservation by the United States Government or for evaluation by the Archivist of the United States or the Archivist's designee to determine whether the record has such value;

(7) To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity, if the activity is authorized by law and if the head of the agency or instrumentality has made a written request to NASA specifying the particular portion desired and the law enforcement activity for which the record is sought;

(8) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if upon such disclosure notification is transmitted to the last known address of such individual;

(9) To either House of Congress or, to the extent the matter is within its jurisdiction, any committee or subcommittee, or any joint committee of Congress or subcommittee of any such joint committee;

(10) To the Comptroller General, or any of the Comptroller's authorized representative(s), in the course of the performance of the duties of the General Accounting Office;

(11) Pursuant to the order of a court of competent jurisdiction; or

(12) To a consumer reporting agency in accordance with section 3711(f) of Title 31.

[NASA-21-091, 57 FR 4928, Feb. 11, 1992, as amended by 77 FR 60621, Oct. 4, 2012]

(a) Fees will not be charged for:

(1) Search for a retrieval of the requesting individual's records;

(2) Review of the records;

(3) Making a copy of a record when it is a necessary part of the process of making the record available for review;

(4) Transportation of the record(s);

(5) Making a copy of an amended record to provide evidence of the amendment; or

(6) Copies of records if this is determined to be in the best interest of the Government.

(b) Fees for the hard-copy duplication of records will be assessed in accordance with § 1206.700(a) of this chapter.

(c) Where it appears that duplication fees chargeable under this section will exceed $25, the requester shall be provided an estimate of the fees before copies are made. Where possible, the requester will be afforded the opportunity to confer with Agency personnel in a manner which will reduce the fees, yet still meet the needs of the requester.

(d) Where the anticipated fee chargeable under this section exceeds $25, an advance deposit of part or all of the anticipated fee may be required.

[NASA-21-091, 57 FR 4928, Feb. 11, 1992, as amended by NASA-2021-0007, 88 FR 12149, Feb. 27, 2023]

(a) The NASA Administrator has determined that the systems of records set forth in § 1212.501 are exempt from disclosure to the extent provided therein.

(b) Medical records. Normally, an individual's medical record shall be disclosed to the individual, unless the system manager, in consultation with a medical doctor, determines that access to the record could have an adverse effect upon the individual. In this case, NASA shall allow access to the record by a medical doctor designated in writing by the requesting individual.

(c) Test and qualification materials. Testing or examination material used solely to determine individual qualifications for appointment or promotion in the Federal service the disclosure of which would compromise the objectivity or fairness of the testing or examination process and copies of certificates of eligibles and other lists of eligibles, the disclosure of which is proscribed by 5 CFR 300.201, shall be removed from an individual's record containing such information before granting access.

(d) Information compiled for civil actions or proceedings. Nothing in this part shall allow an individual access to any information compiled in reasonable anticipation of a civil action or proceeding.

[57 FR 4928, Feb. 11, 1992, as amended by NASA-21-091; NASA-2021-0007, 88 FR 12149, Feb. 27, 2023]