(a) Purpose and scope. This part implements the rules that the Office of Management and Budget (OMB) follows under the Privacy Act of 1974, codified as amended at 5 U.S.C. 552a (Privacy Act). This part applies to all records in systems of records maintained by OMB that are retrieved by an individual's name or personal identifier. This part describes the procedures by which individuals may request access to records about themselves, request amendment or correction of those records, and request an accounting of disclosures of those records by OMB.

(b) Definitions. As used in this part:

Request for access to a record means a request made under 5 U.S.C. 552a(d)(1).

Request for amendment or correction of a record means a request made under 5 U.S.C. 552a(d)(2).

Request for an accounting means a request made under 5 U.S.C. 552a(c)(3).

Requester means an individual who makes a request for access, a request for amendment or correction, or a request for an accounting under the Privacy Act. An individual is a citizen of the United States or an alien lawfully admitted for permanent residence.

System manager means the OMB official identified in a system of records notice as the manager of a system of records; and for Government-wide systems of records, the individual designated by the agency to act on behalf of the system manager.

(c) Providing written consent to disclose records protected under the Privacy Act. OMB may disclose any record contained in a system of records by any means of communication to any person, or to another agency, pursuant to a written request by, or with the prior written consent of, the individual about whom the record pertains. An individual must verify the individual's identity in the same manner as required by § 1302.2(d) when providing written consent to disclose a record protected under the Privacy Act and pertaining to the individual.

(a) How made and addressed. You may make a Privacy Act request for access to an OMB record by mail or delivery service, to Privacy Officer, Office of Management and Budget, 725 17th Street NW, Room 9204, Washington, DC 20503 or by electronic means as described on OMB's privacy program web page: www.whitehouse.gov/omb/privacy.

(b) Description of the records sought. In making a request for access, you must describe the records that you want in enough detail to enable OMB to locate the system of records containing them with a reasonable amount of effort. Your access request should name the system of records or contain a concise description of such system of records. OMB publishes notices of OMB systems of records subject to the Privacy Act in the Federal Register.

(c) Information about yourself. Your access request should also contain sufficient information to identify yourself in order to allow OMB to determine if there is a record pertaining to you in a particular system of records.

(d) Verification of identity. To ensure that information about you is disclosed only to you or your authorized representative, you are required to verify your identity when making a Privacy Act request for access, as detailed in paragraphs (d)(1) through (3) of this section. If OMB cannot verify your identity, disclosure will be limited to information that would be required to be made available if requested under 5 U.S.C. 552 by any person.

(1) You must state your name, current address, and date and place of birth and provide either a notarized statement of identity or a signed submission under 28 U.S.C. 1746; or

(2) When available, verify your identity through remote identity-proofing and authentication using digital processes.

(3) OMB may require you to supply additional information as necessary in order to verify your identity.

(e) Verification of guardianship. When making a request for access as the parent or guardian of a minor or as the guardian of someone determined by a court of competent jurisdiction to be incompetent, for access to records about that individual, you must establish the criteria listed in paragraphs (e)(1) through (4) of this section. If OMB cannot verify your identity, disclosure will be limited to information that would be required to be made available if requested under 5 U.S.C. 552 by any person.

(1) The identity of the individual who is the subject of the record, by stating the name, current address, and date and place of birth;

(2) Your own identity, as required in this paragraph (e);

(3) That you are the parent or guardian of that individual, which you may prove by providing a copy of the individual's birth certificate showing your parentage or by providing a court order establishing your guardianship; and

(4) That you are acting on behalf of that individual in making the request.

(f) Submit identifying information only using approved OMB processes. In order to safeguard information you submit in making a request for access for purposes of verifying your identity or verifying guardianship, or any information about yourself that may assist in the rapid identification of the record to which you are requesting access (e.g., prior names, dates of employment, etc.) as well as any other identifying information contained in an OMB system of records, you must use one of OMB's approved processes as described on OMB's privacy program web page. Failure to submit identifying information through an OMB approved process may result in the failure to expunge your information in accordance with approved OMB records schedules after your access request has been processed.

(g) Subsequent requests for access. If your request for access follows a prior request under this section, and you already provided appropriate verifications with that prior request, you do not need to include the same verification or identifying information in the subsequent request for access if you reference that prior request or attach a copy of the OMB response to that request.

(a) Acknowledgment of requests. OMB will acknowledge your request for access in writing and provide an individualized tracking number. Upon request, OMB will make information available to you about the status of your request using the assigned tracking number.

(b) Timing of responses to a Privacy Act request for access. OMB will respond to Privacy Act requests for access to records according to the order in which OMB receives the requests. Consistent with OMB's FOIA procedures at 5 CFR 1303.40(b), OMB may designate multiple processing tracks that distinguish between simple and more complex Privacy Act requests for access, based on the estimated amount of work or time needed to process the request.

(c) Additional information. If, after receiving a request, OMB determines that your request does not reasonably describe the records sought, OMB will inform you what additional information is needed and why the request is otherwise insufficient. If a request does not reasonably describe the records sought, OMB's response to the request may be delayed.

(d) Grant of request for access. Once OMB makes a determination to grant a request for access, OMB will provide you a written response, which may include the following:

(1) A statement as to whether OMB will grant access by providing a copy of the record through electronic means or the mail; and

(2) The amount of fees charged, if any (see § 1302.7). (Fees are applicable only to requests for duplicates.)

(e) Adverse determination of request for access. OMB will notify you of an adverse determination denying a request for access in writing. Adverse determinations, or denials of requests, consist of: A determination to withhold any requested record in whole or in part; a determination that a requested record does not exist or cannot be located; a determination that what has been requested is not a record subject to the Privacy Act; a determination on any disputed fee matter; or a denial of a request for expedited treatment. OMB's notification letter to you will include:

(1) The decision of OMB whether to grant in whole, or deny any part of the request;

(2) The reasons for the determination for any portion of the request that is denied; and

(3) A description of the procedure by which the OMB decision to deny your request may be appealed, including the name and address of the official with whom you may lodge such an appeal.

You may request an accounting of disclosures by the same rules governing requests for access, outlined in § 1302.2.

(a) Requirement for written requests. If you want to amend a record that pertains to you in a system of records maintained by OMB, you must submit your request in writing following the procedures established in this section unless the system manager waives the requirements in this section. OMB is not required to amend records that are not subject to the Privacy Act of 1974. However, individuals who believe that such records are inaccurate may bring this to the attention of OMB.

(b) Procedures. (1) You should address your request to amend a record in a system of records to the system manager. You should include the name of the system and a brief description of the record proposed for amendment. If the request to amend the record is the result of you gaining access to the record in accordance with the provisions concerning access to records as set forth in § 1302.2, you may attach a copy of previous correspondence between you and OMB instead of providing a separate description of the record.

(2) If a requester cannot determine where within OMB to send the Privacy Act request to amend a record, the requester may send by mail or delivery to Privacy Officer, Office of Management and Budget, 725 17th Street NW, Room 9204, Washington, DC 20503 or by electronic means as described on OMB's privacy program web page: www.whitehouse.gov/omb/privacy. OMB will forward the request to the component(s) it believes most likely to have the relevant records. For the quickest possible handling, the requester should specify “Privacy Act Record Amendment Request” on the letter.

(3) You must validate your identity as described in § 1302.2(e). If OMB has previously verified your identity pursuant to § 1302.2(e), further verification of identity is not required as long as the communication does not suggest that a need for verification is present.

(4) You should clearly indicate the exact portion of the record you seek to have amended. If possible, you should also propose alternative language, or at a minimum, identify the facts that you believe are not accurate, relevant, timely, or complete, with such particularity as to permit OMB not only to understand the basis for your request, but also to make an appropriate amendment to the record.

(5) Your request must also state why you believe your record is not accurate, relevant, timely, or complete. The burden of persuading OMB to amend a record will be upon you. You must furnish sufficient facts to persuade the official in charge of the system of the inaccuracy, irrelevancy, timeliness, or incompleteness of the record.

(6) OMB will not categorically reject incomplete or inaccurate requests. OMB will ask you to clarify the request as needed.

(c) OMB action on the request. (1) OMB will acknowledge, in writing, receipt of a request to amend a record within 10 business days (i.e., excluding Saturdays, Sundays, and legal Federal holidays) of OMB's receipt.

(2) OMB will promptly respond to a Privacy Act request for amendment or correction. OMB ordinarily will respond to Privacy Act requests for amendment or correction according to their order of receipt. Consistent with OMB's FOIA procedures at 5 CFR 1303.40(b), OMB may designate multiple processing tracks that distinguish between simple and more complex Privacy Act requests for amendment or correction, based on the estimated amount of work or time needed to process the request. The response reflecting the decision upon a request for amendment will include the following:

(i) The decision of OMB whether to grant in whole, or deny any part of, the request to amend the record;

(ii) The reasons for the determination for any portion of the request which is denied; and

(iii) A description of the procedure by which the OMB decision to deny your request may be appealed, including the name and address of the official with whom you may lodge such an appeal.

(a) If you wish to appeal a decision by OMB with regard to your request to access or amend a record in accordance with the provisions of §§ 1302.2 and 1302.5, you should submit the appeal in writing and, to the extent possible, include the information specified in paragraph (b) of this section.

(b) Your appeal should contain a brief description of the record involved or copies of the correspondence from OMB in which the request to access or to amend was denied and also the reasons why you believe that access should be granted or the information amended, as relevant. Your appeal should refer to the information you furnished in support of your claim and the reasons set forth by OMB in its decision denying access or amendment, as required by §§ 1302.2 and 1302.5. In order to make the appeal process as meaningful as possible, you should set forth your disagreement in an understandable manner. In order to avoid the unnecessary retention of personal information, OMB reserves the right to dispose of the material concerning the request to access or amend a record if OMB receives no appeal in accordance with this section within 180 days of the sending by OMB of its decision upon an initial request. OMB may treat an appeal received after the 180-day period as an initial request to access or amend a record.

(c) You may send your appeal by mail or delivery to the Senior Agency Official for Privacy, Office of Management and Budget, 725 17th Street NW, Room 9204, Washington, DC 20503 or by electronic means as described on OMB's privacy program web page: www.whitehouse.gov/omb/privacy. For the quickest possible handling, the requester should specify “Privacy Act Record Appeal” on the letter.

(d) The Senior Agency Official for Privacy will review a refusal to amend a record within 30 business days (excluding Saturdays, Sundays, and legal Federal holidays) from the date on which the individual requests such review, unless the OMB Director extends the 30-day period for good cause. If the Senior Agency Official for Privacy's decision does not grant in full the request, the notice of the decision will describe the steps you may take to obtain judicial review of such a decision.

(a) Prohibitions against charging fees for Privacy Act requests. OMB will not charge you for:

(1) The search and review of requests for records subject to this part;

(2) Any copies of the record produced as a necessary part of the process of making the record available for access; or

(3) Any copies of the requested record when OMB determines that the only way you can access the record is by providing a copy to you through the mail.

(b) Waiver. OMB may at no charge provide copies of a record if it is determined the production of the copies is in the interest of the Government.

(c) Fee schedule and method of payment. OMB will charge fees as provided in paragraphs (c)(1) through (5) of this section except as provided in paragraphs (a) and (b) of this section.

(1) OMB will duplicate records at a rate of $.10 per page for all copying of 4 pages or more. There is no charge for duplication 3 or fewer pages.

(2) Where OMB anticipates that the fees chargeable under this section will amount to more than $25.00, OMB shall promptly notify you of the amount of the anticipated fee or such portion thereof as can readily be estimated. If the estimated fees will greatly exceed $25.00, OMB may require an advance deposit. OMB's request for an advance deposit shall extend an offer to the requester to consult with OMB personnel in order to reformulate the request in a manner which will reduce the fees, yet still meet the needs of the requester.

(3) You should pay fees in full before the requested copies are issued. If the requester is in arrears for previous requests, OMB will not provide copies for any subsequent request until the arrears have been paid in full.

(4) Remittances shall be in the form either of a personal check or bank draft drawn on a bank in the United States, or a postal money order. Remittances shall be made payable to the order of the Treasury of the United States and mailed or delivered to the Assistant Director for Management and Operations, Office of Management and Budget, Washington, DC 20503.

(5) OMB will provide a receipt for fees paid upon request.