U.S. NUCLEAR REGULATORY COMMISSION

PRIVACY ACT REQUEST GUIDE

02/2004

Contents

This reference guide comprises the following sections to familiarize you with the procedures

for submitting a Privacy Act request to the U.S. Nuclear Regulatory Commission (NRC):

I. Introduction

II. Access to Records Under the Privacy Act

III. Where to Send Your Privacy Act Request

IV. How to Make a Privacy Act Request

V. Processing Your Privacy Act Request

VI. Response Times

VII. Fees

VIII. Initial Request Determinations

IX. Appeals

X. Statement of Disagreement

XI. Judicial Review

I. Introduction

The Privacy Act (PA) of 1974 is a Federal law that is set forth in Title 5, Section 552a, of the

United States Code (5 U.S.C. 552a), as amended. The purpose of the PA is to balance the

Government’s need to maintain information about individuals with the rights of individuals to be

protected against unwarranted invasions of their privacy resulting from the collection,

maintenance, use, and disclosure of personal information. In general, the PA allows individuals

to learn how the Federal Government collects, maintains, uses, and disseminates records

containing personal information. It also safeguards confidentiality by limiting or restricting

disclosure of personally identifiable records maintained by Federal agencies. The PA allows

individuals to gain access to their own personal records (unless the requested records are

exempted from disclosure), and to seek correction or amendment of Federally maintained

records that are inaccurate, incomplete, untimely, or irrelevant. As such, the PA establishes a

“code of fair information practices,” which requires Federal agencies to comply with statutory

norms for collecting, maintaining, and disseminating records containing information about

individuals.

The PA applies only to U.S. citizens and aliens who are lawfully admitted for permanent

residence in the United States. It applies only to personal information maintained by agencies in

the Executive Branch of the Federal Government. 

The PA also pertains only to information that is maintained in a “system of records,” which the Act

defines as a group of agency-controlled records from which information is retrieved by a unique

identifier, such as an individual’s name and/or birth date, social security number, or employee

identification number. The PA further defines a “record” as any individually identifiable set of

information that an agency might maintain about a person. Such records may include a wide

variety of personal information including, but not limited to, information about education,
financial transactions, medical history, criminal history, or employment history. However, the

PA explicitly states that agencies may not maintain information about how individuals exercise

their First Amendment rights, unless maintenance of that information is specifically authorized

by statute or relates to a law enforcement activity.

II. Access to Records Under the Privacy Act

The formal regulations for making PA requests to the NRC are set forth in Title 10, Part 9,

Subpart B, of the Code of Federal Regulations (10 CFR 9.50), which is available on the NRC’s

public Web site at http://www.nrc.gov/reading-rm/doc-collections/cfr/part009/. 

As previously indicated, you may submit a PA request for information only if you are a U.S. citizen

or an alien who has been lawfully admitted for permanent residence in the United States. 

In addition, you may only request information that is maintained in any of the NRC’s 41 PA Systems

of Records. These systems contain information regarding various categories of individuals

including, but not limited to, current and former NRC employees, contractors, consultants, applicants,

and licensees. You may also request access to records concerning a minor child, as long as you

are that child’s parent or legal guardian and demonstrate that you are acting in the child’s best

interests. In addition, you may request access to records concerning another eligible individual,

as long as you can provide verifiable written authorization from that person designating you as a

representative acting on his or her behalf. You should note, however, that any individual who

willfully requests or obtains any information under false pretenses is guilty of a misdemeanor and

may be fined up to $5,000, pursuant to 5 U.S.C. 552a(i)(3).

You should also note that the Privacy Act is a companion to the Freedom of Information Act (FOIA),

which establishes a presumption that any person has the right to request access to records in

the possession of the Executive Branch of the Federal Government. The PA and the FOIA

have different procedures and exemptions. Consequently, information that is exempt from

disclosure under one Act may be disclosable under the other. In order to take maximum

advantage of both Acts, you may cite both laws when submitting a request for access to NRC

records that contain information only about yourself. However, when requesting NRC records

that contain information about other individuals or entities, cite only the FOIA.

The NRC will automatically handle requests in a manner that maximizes the amount of

information that is disclosable. If you have any doubt about which Act to use in requesting

information from the NRC, always cite both the PA and the FOIA. While neither Act grants an

absolute right to examine Government documents, both Acts give you the right to request records

and to receive a response to your request. You also have the right to appeal the denial and, if

necessary, to challenge it in court (as discussed later in this guide).

III. Where to Send Your Privacy Act Request

You may submit a PA request to the NRC in person or by mail, email, or facsimile (fax),

addressed to the NRC Freedom of Information Act and Privacy Act (FOIA/PA) Officer, as follows:
Mail: U.S. Nuclear Regulatory Commission

Mail Stop T6-D8

Washington, DC 20555-0001

Fax: (301) 415-5130

Email: FOIA@nrc.gov

Electronic

Information

Exchange

(EIE):

The NRC offers the following means to obtain detailed guidance

on making electronic submissions:

• access the agency’s public Web site at http://www.nrc.gov/site-help/eie.html

• call (301) 415-6030

• email EIE@nrc.gov

• write to the Applications Development Division

Office of the Chief Information Officer

U.S. Nuclear Regulatory Commission

Washington, DC 20555-0001

Among other topics, the available EIE guidance discusses the

formats that the NRC can accept, the use of electronic signatures,

and the treatment of non-public information.

For further information, contact the NRC’s FOIA/PA Officer at (301) 415-7169 between the

hours of 7:00 a.m. and 4:00 p.m., Monday through Friday, excluding Government holidays.

IV. How to Make a Privacy Request

Under the Privacy Act, you may request (1) access to records pertaining to you and contained

in a PA system of records, (2) an accounting of NRC disclosures of your personal information to

others, and/or (3) correction or amendment of records about you that are maintained

in a PA system of records. You may also make such requests on behalf of a minor child,

as long as you are that child’s parent or legal guardian and demonstrate that you are acting

in the child’s best interests.

To avoid delays in processing, you should ensure that your request includes three basic

elements:

(1) State that you are seeking access to (or requesting correction/amendment of) records

under the Privacy Act (or under the Privacy Act and the Freedom of Information Act,

as described above).

(2) Include your name, address, date of birth, employee identification number (if any),

signature, and proof of identity (as discussed below).

(3) Describe the requested records (or information) as specifically as possible. 

Whenever possible, you should identify which of the NRC’s 41 PA systems of records

you want the agency to search. You may also want to identify your contacts with the NRC.

Every person who makes a request for records pertaining to himself or herself must meet the

NRC’s requirements for proof of identity:

• If you make a written request, you may establish your identity by providing your name,

address, date of birth, social security number, employee identification number (if any),
signature, and one other identifying item (such as a copy of your driver license, Federal

agency badge, or passport).

• If you request your records in person, you may establish your identity by presenting either

(1) a single document bearing your photograph (such as a driver license, Federal agency

badge, or passport), or (2) two identifying items that do not bear a photograph but do bear

your name, address and signature.

• If you cannot provide the necessary proof of identity, you may provide a notarized statement,

affirming or swearing to your identity and the fact that you understand that the NRC may impose

penalties for obtaining records under false pretenses, pursuant to 5 U.S.C. 552a(i)(3). 

You may obtain forms for such notarized statements by contacting the NRC’s FOIA/PA Officer,

whose address and phone number are noted above.

In addition, when you visit an NRC office to inspect your PA record(s), you may bring along

another individual of your choosing to review the record(s) with you. In such instances, the

agency will ask you to sign a written statement authorizing discussion of the record(s) in the

presence of that person.

V. Processing Your Privacy Act Request

When the NRC’s FOIA/PA Officer receives your PA request, that officer will record the request

and assign a tracking number. In addition, the NRC will send you a written letter acknowledging

receipt of your request and indicating the name and telephone number of the NRC FOIA/PA

Specialist whom you should contact if you have questions regarding the processing and/or status

of your request. After that, processing depends on whether you are seeking access to, or

requesting correction/amendment of your records, as follows.

A. Access to Records

The system manager for the PA system(s) of records identified in the request or who is likely

to have the responsive records will be asked to search for records that are responsive to your

request and provide a copy of any such records. The system manager, or the FOIA/PA Officer

with the advice of the system manager, will determine whether access can be granted. 

The FOIA/PA Staff will review the system manager’s response, coordinate any additional NRC

reviews or referral to other agencies, and prepare the agency determination that is sent to you.

B. Corrections or Amendments

The system manager, or the FOIA/PA Officer, with the advice of the system manager who has

control of the record(s) you want corrected or amended, shall determine whether to authorize or

deny your request. The FOIA/PA staff will then review the system manager’s response,

coordinate any additional NRC reviews or consultations with other agencies, and prepare the

agency determination that is sent to you.
VI. Response Times

A. Access

The Privacy Act does not impose any response times for agency responses to requests. 

However, the NRC has established in its regulations that you will be notified of the agency

determination on your Privacy Act request within 30 working days of receipt of the request

unless the request presents unusual difficulties or involves an extensive number of records.

B. Corrections or Amendments

The NRC has a statutory responsibility to respond to your correction or amendment request

within 10 days of receiving it. 

VII. Fees

The NRC does not charge fees for search or review of records disclosed from a Privacy Act

system of records requested by the individual to whom the record pertains, and provides a

single copy free for the requester’s review. However, for copies of records disclosed from

Privacy Act Systems of Records under the Freedom of Information Act, fees applicable to

processing FOIA requests are charged as described in NRC regulations at 10 CFR 9.35. 

VIII. Initial Request Determinations

Once the NRC has processed your request, the agency will send you a written initial

determination letter. This letter will advise you whether the NRC is withholding any information

pursuant to one or more of the exemptions to the Privacy Act (as discussed below). When the

NRC is withholding one or more page(s) in entirety, the initial determination letter will either

specify the number of pages being withheld or will provide a reasonable estimate of the volume

of information withheld.

There are two general and seven specific exemptions in the PA. The two general exemptions

cover:

(1) all records maintained by the Central Intelligence Agency (not applicable to the NRC)

(2) selected records maintained by an agency or component thereof which performs as its

principal functions any activity pertaining to the enforcement of criminal laws (only used by

the NRC Office of the Inspector General)

In addition, the Privacy Act provides seven specific exemptions:

(1) information that is properly classified in the interest of national defense or foreign policy;

(2) investigatory material compiled for law enforcement purposes not covered by the general

exemptions. The specific law enforcement exemption is limited when -- as a result of the

maintenance of the records -- an individual is denied any right, privilege, or benefit to which

he or she would be entitled by Federal law or for which he or she would otherwise be

entitled. In such cases, disclosure is required except where it would reveal the identity of a

confidential source who furnished information to the Government under an express promise

that the identity of the source would be held in confidence. 
(3) information maintained in connection with providing protective services to the President of

the United States or other individuals who receive protection from the Secret Service;

(4) information required by statute to be maintained and used solely as statistical records;

(5) investigatory material compiled solely for the purpose of determining suitability, eligibility,

or qualifications for Federal civilian employment, military service, Federal contracts,

or access to classified information, but only to the extent that the disclosure of such material

would reveal the identity of a source who furnished information to the Government under

an express promise that the identity of the source would be held in confidence;

(6) testing or examination material used solely to determine individual qualifications for

appointment or promotion in the Federal Service, but only to the extent that the disclosure

of such material would compromise the objectivity or fairness of the testing or examination

process;

(7) evaluation material used to determine potential for promotion in the armed services,

but only to the extent that the disclosure of such material would reveal the identity of a source

who furnished information to the Government under an express promise that the identity

of the source would be held in confidence.

IX. Appeals

Upon receiving the NRC’s initial determination letter, you will have 60 calendar days to submit

an appeal if the letter indicates that the NRC has decided to deny a PA request for

(1) access to records or (2) amendment or correction of records. All appeals must be made in

writing, directed to the appellate official identified in the NRC’s initial determination letter, and

addressed as follows: 

Freedom of Information and Privacy Act Officer

U.S. Nuclear Regulatory Commission

Mail Stop T6-D8

Washington, DC 20555-0001

When appealing the NRC’s decision to deny access to the requested records, you should

clearly identify your appeal (on the envelope and in the letter) as “Privacy Act Appeal—Denial

of Access.” Similarly, when appealing the NRC’s decision to deny your request for correction

or amendment of the record(s), you should clearly identify your appeal (on the envelope and in

the letter) as “Privacy Act—Correction Appeal.”

The NRC will make a determination within 30 working days of receiving your appeal unless

the agency extends the time for good cause, such as the need to obtain additional information,

the volume of records involved, or the complexity of the issue. The NRC may extend the appeal

response time up to 30 additional working days.

X. Statement of Disagreement

If you still disagree with the agency’s decision regarding your appeal of a denial related to

correction or amendment of the specified record(s), you may submit a written statement of

disagreement within 30 working days of receiving the agency’s final adverse appeal determination. 

Address your statement of disagreement as follows:

Freedom of Information and Privacy Act Officer
U.S. Nuclear Regulatory Commission 

Mail Stop T6-D8

Washington, DC 20555-0001

Clearly identify your statement of disagreement (on the envelope and in the statement) as

“Privacy Act—Statement of Disagreement.” The NRC will enter your statement of disagreement

in the PA system(s) of records in which the disputed item of information is maintained. 

In addition, the NRC will mark the original record to indicate (1) that the information is disputed,

(2) that a statement of disagreement exists, and (3) where the statement of disagreement is

located within the system of records.

XI. Judicial Review

If you have filed an appeal and/or a statement of disagreement, but you still believe that the NRC

has not handled your request in accordance with the Privacy Act, you have the right to challenge

the agency’s decision in a lawsuit. The NRC’s response to your appeal will inform you that you

may file your suit in a District Court of the United States in the district in which you reside or

have a principal place of business, the district in which the relevant agency records are

maintained, or the District of Columbia.

The Privacy Act also provides a civil remedy whenever an agency fails to maintain records in a

manner that is accurate, complete, timely, and/or relevant, as is necessary to ensure fairness in

any agency determination, in the event that the agency makes a determination that is adverse

to your interests. You may also sue an agency for failing to comply with any other provision of

the Privacy Act in a manner that adversely affects you.

.