1325.01 REV-1

CHAPTER 3. PROCEDURES FOR PROCESSING AND MONITORING REQUESTS

FOR RECORDS SUBJECT TO THE PRIVACY ACT

3-1 Introduction. This chapter sets forth procedures for processing

requests for access to or amendment of records under the Privacy

Act. It also includes procedures for disclosing records, and

accounting for such disclosures.

3-2 Personnel involved in Privacy Act activities fall into two

categories: those who process\" and disclose information and those

who make decisions concerning the disclosure of the information.

The first category includes mailroom personnel and persons

responsible for transmitting information and accounting for the

disclosures. Mailroom employee responsibilities are discussed in

paragraph 1-3. Procedures for processing requirements relating to

making decisions concerning the disclosure of the information is

discussed in this chapter. However, any questions concerning the

handling of information and/or disclosures should be resolved

directly with the Privacy Act Officer.

3-3 Relationship between the Privacy Act and the Freedom of Information

Act (FOIA) In some instances individuals requesting access to

records pertaining to themselves may not know which Act to cite as

the appropriate statutory authority. The following guidelines are

to ensure that the individuals receive the greatest degree of

access under both Acts:

A. Any person may use the FOIA to request access to agency

records. This includes U.S. citizens, permanent resident

aliens, foreign nationals, corporations, unincorporated

associations, universities, and state and local governments.

The FOIA enables a person to obtain access to agency records.

Only those records that are not maintained by the requester\'s

identifier and hence not \"records\" within \"systems of records\"

are available under FOIA.

B. Only individuals may use the Privacy Act. \"Individual\" is

limited to U.S. citizens and aliens lawfully admitted for

permanent residence. The Privacy Act in addition to access,

establishes a right to correct, amend, or expunge records

about an individual that are not accurate, relevant, timely

and complete. Only records that are retrieved by the

3-1 10/95

1325.01 REV-1

individual\'s personal identifier and not exempt from access

as described in paragraph 3-11 are releasable.

3-4 Choosing the Appropriate Act. When making a decision regarding

which Act to process requests for information the following factors

should be considered.

A. If the request is from an individual seeking information

pertaining to him, cites only the Privacy Act, and the

responsive documents are contained in a systems of records

pertaining to the requester, the request should be processed,

under the Privacy Act, taking into account any exemptions

available under the statute.

B. If the request cites only the FOIA, requests information about

a project, a program, an organization, etc., it should be

processed under the FOIA, taking into account only those

exemptions under the FOIA. See the FOIA handbook 1327.1, REV-

1, for more specific details relating to FOIA procedures and

processes. Additional guidance on FOIA exemptions which

allows the Department to withhold certain information can be

obtained from the Freedom of Information Officer in the Office

of Executive Secretariat.

C. If the requester cites both the Privacy Act and the FOIA,

process it under the Act that provides the greater degree of

access.

D. Do not penalize the individual access to his records otherwise

releasable, solely because he failed to cite the appropriate

statute or instruction.

3-5 Exemptions from the Privacy Act. The Privacy Act permits certain

types of systems of records to be exempt from access and other

provisions of the Act. There are ten exemptions which are

described at 5 U.S.C. 552a (d) (5), 5 U.S.C. 552a(j) and 5 U.S.C.

552a (k) See Appendix C, The Privacy Act of 1974, as amended, for

a detailed description of all of the exemptions. Whether a system

of records may be exempted is based on the purpose of the system of

records, not the identity of the organizational component

maintaining the records. When it is determined that a system of

records should be exempted from certain provisions of the Act, a

proposed rule must be published in the Federal Register naming

10/95 3-2

1325.01 REV-1

the system and stating the specific provisions of the Act from

which the system is to be exempted and the reasons. After a 30

day period for public comment, a final rule must be published in

the Federal Register. Agencies may not withhold records under an

exemption until these requirements have been met. The Privacy Act

Officer should be contacted for further guidance on whether or not

a system of records should be exempted and for assistance in

preparing the appropriate documents required for the Federal

Register Notices.

3-6 Conditions of Disclosure. The Privacy Act prohibits the Department

from disclosing any record contained in a system of records in any

way to anyone without a written request from or prior written

consent from the individual concerned in the record, unless

disclosure is for one of the following purposes:

A. Performance of duties by the officers and employees of the

Department.

B. Required in response to a request under the Freedom of

Information Act, Title 5, Section 552 of the United States

Code.

C. Routine use, as defined in 1-5, R., where the routine use and

the purpose of such use have been published in the Federal

Register.

D. To the Bureau of the Census for purposes of planning or

carrying out a census or survey or related activity pursuant

to the provisions of Title 13.

E. To a recipient who has provided HUD with advance adequate

written assurance that the record will be used solely as a

statistical research or reporting record, and the record is

disclosed in a form that is not individually identifiable.

This exception is limited to records which, even in

combination, cannot be used to identify individuals.

F. To the National Archives of the United States as a record

which has sufficient historical or other value to warrant its

continued preservation by the United States Government, or for

evaluation by the Archivist of the United States or his

designee to determine whether the record has such value.

3-3 10/95

1325.01 REV-1

G. To another agency or instrumentality of any governmental

jurisdiction within or under the control of the United States

for a criminal or civil law enforcement activity if the

activity is authorized by law and if the head of the agency or

instrumentality has made a written request to the agency

maintaining the record specifying the particular portion

desired and the law enforcement activity for which the record

is sought. The head of an agency, for purposes of this

condition of disclosure, means an official of the requesting

law enforcement agency at or above the rank of section chief

or equivalent.

H. The health or safety of an individual, and then only if the

person making the request, has shown a \"compelling

circumstance\" and notification of the disclosure is sent to

the individual\'s last known address.

I. To either house of Congress, or, to the extent of matters

within its jurisdiction, any committee or subcommittee

thereof, any joint committee of Congress or subcommittee or

any such joint committee. This does not authorize the

disclosure of a Privacy Act record to an individual member of

Congress acting in his own behalf or on the behalf of a

constituent.

J. To the Comptroller General or any of his authorized

representatives in the course of the performance of the duties

of the General Accounting Office.

K. Required by the order of a court of competent jurisdiction.

Keep in mind, however, that a subpoena routinely issued by a

court clerk is not acceptable, as it must be signed by a

judge.

L. To a consumer reporting agency in accordance with section

3711(f) of title 31. A consumer reporting agency is a person

or business which assembles and evaluates information for

third parties or makes/markets credit reports. A routine use

must be established prior to disclosing information to a

consumer reporting agency. Prior to disclosure, the agency

head must determine that a valid claim exists and inform the

individual: that the debt is overdue; that the agency intends

to notify a consumer reporting agency; what information will

be released; and that the individual may seek a full

explanation of the claim, dispute the claim and appeal the

initial agency decision with respect to the claim.

10/95 3-4

1325.01 REV-1

3-7 Accounting for Certain Disclosures. The Privacy Act requires

agencies to keep an accounting of disclosures made from its systems

of records so that it is simpler to trace data to be corrected, and

to inform individuals about disclosures made and to monitor

compliance. Accounting for disclosures means to record in some way

what was disclosed and to whom. Thus, any employee who discloses

such information must maintain a record of account. It is not

necessary to account for disclosures that transfer records to

another individual within HUD who uses the information in the

performance of his official duties or the FOIA. In the event that

a request for access is received from an agency that is not listed

under \"routine use\" or an individual who is not the subject of the

requested record, prior consent must be obtained from the subject

individual each and every time before that disclosure can be made.

See Exhibit 3-1 for a sample letter that may be used to inform the

subject individual of the request and Exhibit 3-2 for a sample form

that may be used to obtain consent.

A. Content of Accounting Records. The accounting record must

include the date, nature, and purpose of the disclosure, and

the name and address of the recipient. It must be kept for 5

years after the disclosure is made or the life of the record,

whichever is longer. Also, the individual must be given access

to the disclosure accountings about him. See Exhibit 3-3 for

a sample form that may be used for recording accounting

disclosures.

B. Maintaining Disclosure Accounting Records. Disclosure

accounting records are official office records and must be

kept available for reference and review. They are to be

maintained by the Office, Division or Branch that maintains

the disclosed information. Specific details of the disclosed

records should be recorded.

3-8 Inquiries Concerning Systems of Records. Anyone may inquire into

the existence of a record of information pertaining to one\'s self

or to a dependent child or legal ward in a system of records

maintained by the Department. Privacy Act Officers should attempt

to honor oral requests whenever possible, but in the event of

questions on the validity of the request, the Privacy Act Officer

should have a request submitted in writing.

A. Inquiries should contain the following information:

3-5 10/95

1325.01 REV-1

Name, address and telephone number of the requester; name,

address and telephone number of the individual to whom the

record pertains, if the individual is a minor or legal ward of

the requester; a certified or authenticated copy of documents

establishing parentage or guardianship, if such is necessary,

whether the individual to whom the record pertains is a

citizen or an alien lawfully admitted for residence into the

United States; name and location of the system of records as

published in the Federal Register; any additional information

that might assist the Department in responding to the inquiry;

date of the inquiry; the requester\'s signature. Exhibit 3-4

contains a sample Privacy Act request letter.

1\. If an inquiry is misdirected, the Departmental official

receiving it should promptly refer it to the appropriate

Privacy Act Officer; the time of receipt for processing

purposes is the time that the Privacy Act Officer

receives the inquiry. The requester should be informed

of the transfer. See Exhibit 3-5 for a sample letter

informing the requester of the transfer of a Privacy Act

Request to the appropriate HUD office.

2\. An historical log should be maintained by each Privacy

Act Officer for each case handled in his office.

Appendix A presents a Privacy Act Case Log for this

purpose, which should be started at the beginning of each

calendar year and retained for an additional calendar

year.

3\. If a requester does not know the name of the system of

records he is concerned about, the Privacy Act Officer

will provide assistance either in person or by mail.

4\. If an inquiry fails to contain all necessary information,

the Privacy Act Officer will inform the requester that

the time of receipt for processing purposes will be the

time when the additional necessary information is

received. See Exhibit 3-6 for a form letter that may be

used to obtain the additional information.

5\. Once there is sufficient information to process the

request, a record search procedure must be initiated.

This involves contacting the HUD staff(s) that

maintain(s) the system(s) of records. Exhibit 3-7

10/95 3-6

1325.01 REV-1

contains a Record Search Procedure Log that may be

used to retain a history of this activity.

6\. The Privacy Act Officer should make every effort to

respond to an inquiry within 10 working days of receipt

of the inquiry. If a response cannot be made within 10

working days, the Privacy Act Officer will notify the

requester of this fact and provide him with an estimate

of when the request would be satisfied, as well as the

reason for the delay. See Exhibit 3-8 for a sample

letter that may be used for this purpose.

7\. Paragraphs 3-8 through 3-16 relate to the processing of

the various types of Privacy Act requests and the

Departmental responsibilities with respect to them.

Exhibit 3-9 contains a sample letter by which the

requester can be informed of the Departmental action

taken with respect to his request and the actions he must

take to obtain the information that was requested, if

such are necessary.

3-9 Individual Requests for Access to Information Maintained in Systems

of Records.

A. Individual Rights. Any individual may request access to

records maintained about him by the Department. The

Department must, upon request:

1\. Inform an individual whether a system of records contains

a record or records pertaining to him;

2\. Permit an individual to review any record pertaining to

him which is contained in a system of records;

3\. Permit the individual to be accompanied by a person of

his choosing; and

4\. Permit the individual to obtain a copy of any such record

in a form comprehensible to him at a reasonable cost.

This may include braille, tape, large print, readers,

personal computer with voice, etc. No additional fee may

be requested from an employee with a disability who

requests material in an accessible format.

3-7 10/95

1325.01 REV-1

B. Agency Responsibilities. Privacy Officers should attempt to

honor oral requests whenever possible, but may ask that the

request be submitted in writing. In the event that a request

is misdirected to a HUD office, the Privacy Act Officer should

transfer the request to the appropriate office and notify the

requester of the transfer. See Exhibit 3-5 for a sample

letter that may be-used to inform the requester of a transfer

to the appropriate HUD Office.

3-10 Verification of Identity. The Privacy Act requires agencies to

develop procedures to verify the identity of a person requesting to

see or copy his record, but such requirements should not be unduly

burdensome. The purpose is to reasonably ensure that a person\" is

not improperly granted access to the records of another. The

following procedures should be followed before granting oral and

written requests for access to records.

A. An oral request for access must be accompanied by the

following identification:

1\. A document bearing the requester\'s photograph (building

pass, license, etc.).

2\. A document bearing the requester\'s signature.

3\. In the event of no such document, a signed statement

asserting the requester\'s identity and stipulating that

the requester understands the penalty provisions of the

Act. See Exhibit 3-10 for an example of such a

statement.

4\. If the requester is a parent or legal guardian of the

individual to whom the record pertains, the Privacy Act

Officer must also obtain proof of identification through

a certified or authenticated copy of the court\'s order in

the case of a ward. In no event can a parent or guardian

act for a decedent. However, access to Office of Human

Resources records maintained by the Department may be

granted to a survivor of a deceased employee, or

annuitant or someone acting in his behalf.

5\. In order to facilitate processing, the Privacy Act

Officer should also determine if the request for access

is a result of an earlier inquiry.

10/95 3-8

1325.01 REV-1

B. Written request for access should contain the same identifying

information as required for an oral inquiry. Proof of

identity should be established by a certificate of a notary

public or equivalent officer empowered to administer oaths.

C. Whether the request for access is oral or in writing, the

following will apply;

1\. If the request is misdirected the Department official

receiving it will promptly refer it to the appropriate

Privacy Act Officer; the time of receipt of the request

for processing purposes is the time the Privacy Act

Officer receives it.

2\. If the request fails to contain all the necessary

information and documents, the Privacy Act Officer will

inform the requester that the time of receipt for

processing purposes will be the time when he provides the

additional information. See Exhibit 3-6 for a sample

letter that may be used for this purpose.

3\. Once, in the opinion of the Privacy Act Officer, there is

sufficient information to process the request, a record

search procedure must be initiated. This involves

contacting HUD staff(s) that maintain(s) the system(s) of

records. Exhibit 3-7 contains a Record Search Information

Log that may be used to retain a history of this

activity.

4\. The Privacy Act Officer will respond to a request within

10 working days of receipt of the request. If a response

cannot be made within 10 working days, the Privacy Act

Officer will notify the requester of the estimated date

that a response can be made and the reason for the delay.

See Exhibit 3-8 for a sample letter that may be used for

this purpose.

5\. The requester shall not be required to state a reason or

otherwise justify his request for access to a record.

D. If the record is contained in a personnel file under control

of the Office of Human Resources, the request can be made

directly to the appropriate Personnel Officer who will act for

the Privacy Act Officer in this case.

3-9 10/95

1325.01 REV-1

3-11 Disclosure of Requested Information to Individuals. Under the

Privacy Act, an individual has access to records only if those

records are within a system of records; i.e., the records are

retrieved by the individual\'s name or other identifier.

A. Upon granting access to a record in response to a request for

access the Privacy Act Officer will notify the requester in

writing, providing the following information:

1\. The time and place where the records will be available

for personal inspection, and the period of time that the

records will be available for inspection;

2\. A copy of the information requested if no fees are

involved;

3\. An indication of whether the copy will be held pending

receipt of fees to cover the cost of copying documents,

and the estimate of the fee for copying the record;

4\. An indication that the requester may be accompanied by

another individual during the period of access and the

procedures required to allow that individual access to

the record. See paragraph 3-11; B., 4.;

5\. And, any additional requirements needed to grant access

to a specific record.

B. The Privacy Act Officer will also ensure that:

1\. Manual record files are the source for disclosing the

information and for copying purposes unless a computer

printout of the record is both easily available and

readable (clear English).

2\. Any information or assistance that is needed to make the

record intelligible will be provided at the time of

access.

10/95 3-10

1325.01 REV-1

3\. Original records will only be available under the

immediate supervision of the Privacy Act Officer or his

designee and that copies or abstracts may be available to

guarantee the security of the original record.

4\. When the requester is accompanied by another person(s),

the individual to whom the record pertains will authorize

the presence of that other person, in writing, including

the name of the individual and the record to which access

is sought, sign the authorization and have the

accompanying individual sign the authorization in the

presence of the Privacy Act Officer (see\* Exhibit 3-11

for an example of such an authorizing document).

3-12 Initial Denial of Access to Records. The Privacy Act Officer may

not deny an individual access to any record pertaining to the

individual except under highly selective conditions.

A. Grounds for denial of access to an individual\'s record(s)

follows:

1\. The record is in a system of records which the Department

has exempted from access or in a system of records

exempted by another agency responsible for filing a

notice on the system. The exemption status of a system

of records is found in the individually published system

of, records notice.

2\. The record was compiled in reasonable anticipation of a

civil action or proceeding.

3\. The individual has unreasonably failed to comply with

procedural requirements for requesting access.

B. Notification of denial of a request for access must be in

writing and should include the following information:

1\. The Privacy Act Officer\'s name and title or position.

2\. The date of the denial.

3-11 10/95

1325.01 REV-1

3\. The reason(s) for the denial, including citation to the

appropriate section(s) of the Act and the Departmental

regulations.

4\. The individual\'s opportunity for an administrative review

of the denial through a Departmental appeal procedure,

which includes a written request for review within 30

calendar days that contains copies of the original

request for access, and a statement of why the denial is

believed to be in error.

5\. The name and address of the Departmental Privacy Appeals

Officer.

6\. If the denial is administratively final (that is, no

opportunity for an appeal), then state the individuals

right to judicial review, including citation of the

appropriate section(s) of the Act and the Departmental

regulations. This can occur when the request for access

is to another agency\'s record in your possession which

has been exempted by them under the provisions for a

\"General Exemption.\"

3-13 Appeal of Initial Denial of Access to Records. The Privacy Appeals

Officer will review any initial denial of access to records only if

a written request for the review is filed within 30 calendar days

from the date of the notification of denial of access to the

record.

A. The appeal package must contain:

1\. A copy of the request for access.

2\. A copy of the written denial of the request for access.

3\. A statement of the reasons why the initial denial is

believed to be in error.

4\. The individual\'s signature.

B. The procedures and processing relating to appeal requirements

are contained in Appendix D.

3-14 Request for Correction or Amendment to a Record. Any individual

may submit a request to the Department for correction or amendment

of a record pertaining to that individual, or to a dependent child

or legal ward. Privacy Act Officers should attempt to honor oral

10/95 3-12

1325.01 REV-1

requests whenever possible, but they may require that the request

be submitted in writing.

A. The request for correction or amendment should include the

following information:

1\. A specific identification of the record sought to be

corrected or amended.

2\. The specific wording to be deleted, if any.

3\. The specific wording to be added, if any, and the exact

place at which it is to be inserted or added.

4\. A statement of the basis for the requested correction or

amendment, including all available supporting documents

or materials which substantiate the statement.

5\. Since the request, in all cases, will follow a previous

request for access, the individual\'s identity will be

established by his signature on or accompanying the

request.

B. Upon receipt of the request for correction or amendment to a

record, the Privacy Act Officer will make a determination

within 10 working days, to do one of the following:

1\. Make the requested correction or amendment and notify the

individual of the action taken;

2\. Acknowledge receipt of the request and provide an

estimate of time within which action will be taken,

explaining to the requester any unusual circumstances

(such as, records are in inactive storage, field

facilities or other establishments; voluminous data are

involved, information on other individuals must be

separated or deleted; consultation with other agencies

having a substantial interest in the determination are

necessary). The Privacy Act Officer may also ask for

such further information as may be necessary to process

the request; or,

3-13 10/95

3\. Inform the individual in writing that the request is

denied.

C. Upon receipt of further information that may have been

requested, the Privacy Act Officer will acknowledge within 10

working days and promptly determine to do one of the

following:

1\. Make the requested correction or amendment and notify the

individual of the action taken, providing, when feasible,

a copy of the corrected or amended record.

\(a\) If the uncorrected record has been disclosed to a

person or an agency and an accounting was made of

the disclosure, the Privacy Officer will notify all

such persons and agencies of the correction or

amendment.

\(b\) A recipient agency maintaining the record must

acknowledge receipt of the notification, correct or

amend the record, and notify any other person or

agency to whom it has disclosed the record,

providing an accounting was made of the disclosure,

of the substance of the correction or amendment.

2\. Inform the individual in writing that the request is

denied.

3-15 Criteria for Considering a Request for Correction or Amendment.

The Privacy Act Officer will consider the following criteria in

making a determination on a request to correct or amend an

individual\'s record:

A. The sufficiency of the evidence submitted by the individual.

B. The factual accuracy of the information.

C. The relevance and necessity of the information in terms of

purpose for which it was collected.

D. The timeliness and currency of the information in terms of the

purpose for which it was collected.

E. The completeness of the information in terms of the purpose

for which it was collected.

10/95 3-14

1325.01 REV-1

F. The possibility that denial of the request could unfairly

result in determinations adverse to the individual.

G. The character of the record sought to be corrected or amended.

H. The propriety and feasibility of complying with the specific

means of correction or amendment requested by the individual.

3-16 Initial Denial to Correct or Amend a Record. The Privacy Act

Officer may not deny an individual the right to correct or amend

the contents of a record pertaining to the individual except under

highly\*selected conditions.

A. Grounds for denial of a request to correct or amend an

individual\'s record(s) follow:

1\. The evidence presented has failed to establish the

propriety of the correction or amendment when weighed

against the applicable criteria set forth in paragraph 3-

11\. The Privacy Act Officer will not undertake to gather

evidence for the individual, but does have the right to

verify the evidence submitted.

2\. The record sought to be corrected or amended was compiled

in a terminated judicial, quasi-judicial, legislative or

quasi-legislative proceeding to which the individual was

a party or participant.

3\. The information in the record sought to be corrected or

amended or the record sought to be corrected or amended,

is the subject of a pending judicial, quasi-judicial or

quasi-legislative proceeding to which the individual is

a party or participant.

4\. The correction or amendment would violate a duly enacted

statute or promulgated regulation.

5\. The individual has unreasonably failed to comply with the

procedural requirements for requesting a correction or

amendment to a record.

B. Notification of denial of a request to correct or amend a

record must be in writing and will include the following

information:

3-15 10/95

1325.01 REV-1

1\. The Privacy Act Officer\'s name and title or position.

2\. The date of the denial.

3\. The reason(s) for the denial, including citation of the

appropriate section(s) of the Act and the Departmental

Regulations.

4\. The procedures for a Departmental appeal.

5\. The name and address of the Departmental Privacy Appeals

Officer.

3-17 Appeal from Initial Denial to Correct or Amend a Record. The

Privacy Appeals Officer will review any initial denial to correct

or amend a record only if a written request for review is filed

within 30 calendar days from the date of the notification of denial

to correct or amend the record. The procedures and processing

requirements relating to appeals are contained in Appendix D.

3-18 Reproduction Fees. Generally only one copy of any record or

document will be provided. Checks or money orders for fees should

be made payable to the \"Treasurer of the United States\". Fees

should only include the direct cost of reproduction.

A. No fees should be charged for the following:

1\. Time or effort devoted to searching for or reviewing the

record by HUD personnel;

2\. Fees not associated with the actual cost of reproduction;

3\. Producing a copy when it must be provided to the

individual without cost under another regulation,

directive, or law;

4\. Normal postage;

5\. Transportation of records or personnel; or

6\. Producing a copy when the individual has requested only

to review the record and has not requested a copy to

keep, and the only means of allowing review is to make a

copy (e.g., the record is stored in a computer and a copy

must be printed to provide individual access or the HUD

10/95 3-16

1325.01 REV-1

official does not wish to surrender temporarily the original

record for the individual to review).

B. Copying fees will be charged as prescribed below:

1\. Each copy of each page, up to 8 1/2 X 14 made by

photocopy or similar process - \$0.15.

2\. Each page of computer printout, without regard to the

number of carbon copies concurrently printed - \$0.20.

3\. Micrographic copy:

a\. duplicating - per fiche: \$1.00

b\. duplicating 16 mm roll \$2.00 per roll/cartridge

c\. paper print out - from microfilm/microfiche: \$0.15

per image/page.

C. Fee Waiver. A copy fee of \$1.00 or less shall be waived by

the Privacy Act Officer, but the copying fees of several

simultaneous requests by the same individual will be

aggregated to determine the total fee. The Privacy Act

Officer may elect to reduce a fee or to eliminate it

completely if he deems it to be in the public interest; such

as, when the cost to the Government to process the fee

disproportionally exceeds the amount of the fee.

3-17 10/95

1325.01 REV-1

EXHIBIT 3-1 SAMPLE LETTER TO INFORM

INDIVIDUAL OF A REQUEST FOR ACCESS TO

HIS PERSONAL INFORMATION

(Name)

(Address)

SUBJECT: Letter to Inform Individual of a Request for Access to his

personal information

Dear \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_,

On (date), the U.S. Department of Housing and Urban Development

received a request from (Name and address of requesting official or

agency) to disclose a record(s) about you, as described below. Since

this record comes under the Privacy Act of 1974, we may not disclose the

record to this individual or agency without your knowledge. Your

consent is necessary before such disclosure can be made.

Please complete the attached consent form and return it notifying

us of your decision on this matter.

Sincerely,

Privacy Act Officer

DESCRIPTION OF REQUEST: (State type of record/information and reason/use

for request)

10/95 3-18

1325.01 REV-1

EXHIBIT 3-2 SAMPLE FORM TO OBTAIN CONSENT TO

DISCLOSE PERSONAL INFORMATION

I, \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_, hereby () grant / ()
refuse (check one)

permission to the U.S. Department of Housing and Urban Development to

disclose my record, as described in the attached, to (name of

individual or agency), in response to a request dated

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ from this person or agency for
disclosure of such

record. No subsequent disclosure of such record to the individual or to

any other individual or agency is to be made without my additional

explicit consent, except as may be authorized by law.

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

signature

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

date

3-19 10/95

1325.01 REV-1

EXHIBIT 3-3 SAMPLE FORM FOR RECORDING ACCOUNTING DISCLOSURES

DISCLOSURE ACCOUNTING FORM

RECORD OF DISCLOSURE

UNAUTHORIZED DISCLOSURE OF PERSONAL INFORMATION FROM

THIS RECORD COULD SUBJECT THE DISCLOSURE TO CRIMINAL PENALTIES

1\. This is to remain a permanent part of the record described below

2\. An entry must be made each time the record or any information from

the record is viewed by, or furnished to any person or agency except:

A. A disclosure to HUD personnel having a need to know in the

performance of official duties; or,

B. When required under the Freedom of Information Act.

Title and Description of Record:

Date of Method of Purpose or Name & Address of Person or

Disclosure Disclosure Authority or Agency to whom disclosed

information, with signature

if made in person.

10/95 3-20

1325.01 REV-1

EXHIBIT 3-4 SAMPLE PRIVACY ACT REQUEST LETTER

Privacy Act Officer

Department of Housing and Urban Development

451 7th Street SW

Washington, DC 20410

Dear Sir:

Under the provisions of the Privacy Act of 1974, I am requesting a

copy of all records the Department is presently maintaining on me. I

was employed by the HUD Regional Office in San Francisco as a contractor

during the period of 1979 through 1985. The company that I was working

with was the X Company of San Francisco. I am interested in any records

relating to my performance as a contractor, the awarding of the

contract, the termination of the contract, and the subsequent loss of my

job. Information verifying my identity is resented below.

Mr. John Doe

777 Block Avenue

San Francisco, CA 22222

Telephone No.: (415) 555-8888

I am enclosing a notarized copy of some documents of

identification. Please send the information to the above address. You

may call me if you have further questions.

I look forward to an expeditious response to my inquiry. Thank you

for your assistance.

Sincerely,

John Doe

Enclosures

3-21 10/95

EXHIBIT 3-5 SAMPLE LETTER INFORMING REQUESTER OF TRANSFER

OF PRIVACY ACT REQUEST TO APPROPRIATE HUD OFFICE

(Name)

(Address)

Dear \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_,

The information that you recently inquired about has been found in

a Privacy Act System of records that is maintained at another HUD

office. Your request is being transferred to that office for further

handling. Your contact at that office is:

(Name)

(Privacy Act Officer)

(Business address)

You may expect to hear from him shortly.

Sincerely,

(Departmental) Privacy Act Officer

10/95 3-22

1325.01 REV-1

EXHIBIT 3-6 SAMPLE LETTER USED TO OBTAIN ADDITIONAL INFORMATION

Case No.:

(Name)

(Address)

Dear \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_,

We have received your request under the Privacy Act of 1974, and

need additional information before we can comply with your request.

Please complete the items below and return to the undersigned Acting

Privacy Act Officer.

What was your relationship with HUD at the time the record was

created (such as, employee or prospective employee, mortgage

insurance applicant, mortgagor, builder or developer, contractor or

prospective contractor, etc.):

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Approximate date when the record was created:

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Address when record was created:

Street No: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

City, State, ZIP: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Additional Information that may assist HUD in complying with your

request (such as, date of birth, names of parents, place of work,

dates of employment, position, title, etc.) :

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Please note that the time of receipt for processing purposes will

be the time that this additional information is received in our office.

Thank you.

Very sincerely yours,

(Departmental) Privacy Act

Officer

3-23 10/95

1325.01 REV-1

EXHIBIT 3-7 SAMPLE RECORD SEARCH INFORMATION LOG

U.S. Department of Housing and Urban Development

RECORD SEARCH INFORMATION

Case No: \_\_\_\_\_\_\_\_\_\_\_\_\_\_

Date of Name of Location of Type of Action

Action Person Contacted Person Contacted and remarks

10/95 3-24

1325.01 REV-1

EXHIBIT 3-8 SAMPLE LETTER FOR PRIVACY ACT PROCESSING

OVER 10 DAYS

Case Number\_\_\_\_\_\_\_\_\_\_\_\_\_\_

(Name)

(Address)

Dear \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_,

Your request under the Privacy Act of 1974 has been received and is

being processed. You will receive a response within

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_.

Your response is delayed because

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_.

If you need to contact us further on this request, please use the

Case Number referred to on the upper right side of this letter.

3-25 10/95

EXHIBIT 3-9 SAMPLE LETTER TO INFORM REQUESTER OF

DEPARTMENTAL ACTION

Case No.:\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

(Name)

(Address)

Dear \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_,

We have received and processed your request under the Privacy Act

of 1974. (Type the one of the following that applies:)

We do not have a record pertaining to you in the following Privacy

Act System of Records: (Name of SOR)

We do not have a record pertaining to you in a Privacy Act System

of Records.

Your request for access to a record is granted,

A copy of the record is enclosed.

Please contact the undersigned Privacy Act Officer to

arrange a suitable time to inspect the record.

Your request for access to a record is denied because it is exempt

from disclosure. The procedure to exercise your right of appeal of

this denial is attached.

Your request to correct or amend a record is granted:

A copy of the corrected/amended record is enclosed.

Please contact the undersigned Privacy Act Officer to arrange

a suitable time to inspect the corrected/amended record.

Your request to correct or amend a record is denied because (state

reason). The procedure to exercise your right of appeal of this

denial is attached.

Enclosed is a copy of the accounting of disclosures of your record,

as you requested.

A fee of (state amount) will be charged to make a copy of your

record as you requested. Please make a check or money order

payable to \"Treasurer

10/95 3-26

1325.01 REV-1

of the United States\" and present it to the undersigned Privacy Act

Officer or his designee.

Sincerely,

(Departmental) Privacy Act

Officer

3-27 10/95

EXHIBIT 3-10 SAMPLE STATEMENT OF IDENTITY

City:

County:

Social Security Number:

(Name of individual) who fixed his signature below in my presence, came

before me, a (title), in and for the aforesaid County and State, this

(date) day of (month, year), and established his identity to my

satisfaction. My Commission expires (date).

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Signature

10/95 3-28

1325.01 REV-1

EXHIBIT 3-11 SAMPLE REQUESTER\'S AUTHORIZATION FOR AN

ACCOMPANYING INDIVIDUAL

I (name) grant permission for the following named individual(s)

\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ to
accompany me while I

have access to personal information about me, contained in the following

system(s) of

records:

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_.

Signed: (requester)

Signed: (accompanying individual(s)

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Witnessed: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Privacy Act Officer Date

3-29 10/95