Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17367 

(b) The volume regulation percentages 

apply to acquisitions of the varietal type 

of raisins for the applicable crop year 

until the reserve raisins for that crop are 

disposed of under the marketing order. 

Dated: April 3, 2007. 

Lloyd C. Day, 

Administrator, Agricultural Marketing 

Service. 

[FR Doc. E7–6530 Filed 4–6–07; 8:45 am] 

BILLING CODE 3410–02–P 

SMALL BUSINESS ADMINISTRATION 

13 CFR Part 102 

RIN 3245–AF20 

Record Disclosure and Privacy 

AGENCY: U.S. Small Business 

Administration (SBA). 

ACTION: Direct Final Rule. 

SUMMARY: This rule updates the U.S. 

Small Business Administration’s (SBA) 

regulations implementing the Privacy 

Act of 1974. This rule ensures the 

security and confidentiality of 

personally identifiable records and 

protects against hazards to their 

integrity. Specifically, Subpart B of the 

Privacy Act regulations is revised to 

include SBA’s procedures for 

maintaining appropriate administrative, 

technical and physical safeguards to 

ensure the security of the records. Also 

included are Privacy Act standards of 

conduct for Agency employees; training 

and reporting requirements pursuant to 

Privacy Act guidelines and the Office of 

Management and Budget (OMB) 

guidance; and the Privacy Act 

responsibilities of the Chief, Freedom of 

Information/Privacy Acts (FOI/PA) 

Office. 

DATES: This rule is effective June 8, 2007 

without further action, unless 

significant adverse comment is received 

by May 9, 2007. If significant adverse 

comment is received, the SBA will 

publish a timely withdrawal of the rule 

in the Federal Register. 

ADDRESSES: You may submit comments, 

identified by RIN 3245–AF20, by any of 

the following methods: (1) Federal 

rulemaking portal at http:// 

www.regulations.gov; (2) e-mail: 

lisa.babcock@sba.gov, include RIN 

number 3245–AF20 in the subject line 

of the message; (3) mail to: Delorice P. 

Ford, Agency Chief FOIA Officer, 409 

3rd Street, SW., Mail Code: 2441, 

Washington, DC 20416; and (4) Hand 

Delivery/Courier: 409 3rd Street, SW., 

Washington, DC 20416. 

FOR FURTHER INFORMATION CONTACT: 

Delorice P. Ford, Agency Chief FOIA 

Officer, (202) 401–8203. 

SUPPLEMENTARY INFORMATION: SBA is 

revising Subpart B of Part 102 to include 

more in-depth information about 

Privacy Act (PA) responsibilities, and to 

further ensure the security and 

confidentiality of the Agency’s 

personally identifiable records, 

including the standards for disclosure of 

information under computer matching 

programs. This rule will further assist 

the SBA in focusing on the four basic 

policy objectives of the Privacy Act. 

Those objectives are: the restriction of 

disclosure of personally identifiable 

information; individuals’ increased right 

of access to records maintained on 

them; individuals’ right to seek 

amendment of records maintained on 

them; and the establishment of fair 

information practices. SBA is 

substantially revising this rule to 

present it in a statement and narrative 

format rather than question and answer, 

which conforms to the current writing 

style of Subpart A. As a result, the 

headings and section numbers are 

different than current SBA rule 13 CFR 

part 102, Subpart B. 

SBA is publishing this rule as a direct 

final rule because it believes the rule is 

non-controversial since it merely 

enforces the basic policy objectives of 

the Privacy Act and does not present 

novel or unusual policies or practices. 

Because the rule follows routine, 

standard government-wide Privacy Act 

practices, SBA believes that this direct 

final rule will not elicit any significant 

adverse comments. However, if such 

comments are received, SBA will 

publish a timely notice of withdrawal in 

the Federal Register. 

Section-by Section Analysis 

General provisions, § 102.20, provides 

an overview of the scope of regulations 

contained in Subpart B as well as 

definitions for terms that are not 

previously defined in Part 102. 

New § 102.21 Agency officials 

responsible for the Privacy Act, 

describes the various Agency personnel 

responsible for the PA and a listing of 

their duties. Some of this information is 

currently included in SBA PA rules at 

13 CFR 102.29 and 102.32. 

Section 102.22 Requirements relating 

to systems of records, this section 

expands current SBA PA rules at 

§§ 102.24 and 102.25 and establishes 

parameters for the type of information 

that SBA may collect from an 

individual, including the prohibition on 

maintaining records concerning First 

Amendment rights in certain 

circumstances. Section 102.22 also 

addresses how to ensure the accurate 

and secure maintenance of records on 

individuals, and how to report new 

systems of records. 

Section 102.23—Publication in the 

Federal Register Notices of systems of 

records explains that SBA will publish 

notice of new or modified systems of 

records and routine uses in the Federal 

Register. This section is not currently 

included in SBA rules. 

Section 102.24—Requests for access 

to records describes procedures for 

individuals on how and where to make 

requests for access to records under the 

PA. This section is similar to current 

SBA rule at 13 CFR 102.34. 

Section 102.25—Responsibility for 

responding to requests for access to 

records provides a description of 

responsibilities for Agency respondents 

to requests for access to records, while 

§ 102.26—Responses to requests for 

access to record describes what to 

include in those responses. Current SBA 

rule at 13 CFR 102.36 provides similar 

information. 

New § 102.27—Appeals from denials 

of requests for access to records 

provides procedures for individuals on 

how and where to make appeals from 

denials of requests for access to records. 

Section 102.28—Requests for 

amendment or correction of records, 

provides a description of how and 

where to make requests and appeals for 

amendment or correction of records, 

including how to file Statements of 

Disagreement if appeals under this 

section are denied in whole or part. 

Section 102.29—Requests for an 

accounting of record disclosures 

describes procedures for individuals to 

make requests and appeals for an 

accounting of records disclosures. 

Section 102.30—Preservation of 

records this section describes how SBA 

will implement the record retention 

requirements of Title 44 of the United 

States Code or the National Archives 

and Records Administration’s General 

Records Schedule 14. 

Section 102.31—Fees this section 

states that for PA matters, SBA charges 

only for duplication of records and all 

fees under $25 are waived. 

Section 102.32—Notice of courtordered and emergency disclosures this 

section explains SBA’s compliance with 

court-ordered and emergency 

disclosures. SBA will notify individuals 

by mailing a notice to their last known 

address. 

Section 102.33—Security of systems 

of records this section requires SBA 

offices that maintain PA records to 

establish controls to protect records on 

individuals and ensure that record 

access is limited to only those 


rwilkins on PROD1PC63 with RULES
17368 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

individuals who must have access to the 

records to perform their duties. 

Section 102.34—Contracts for the 

operation of record systems this section 

establishes that SBA contractors are 

subject to the PA and this rule. The 

contractor and its employees are 

considered SBA employees during the 

contract and can be subject to the 

sanctions of the PA. 

Section 102.35—Use and collection of 

Social Security Numbers under this 

section, individuals may not be 

negatively affected if they refuse to 

provide their social security numbers, 

unless such numbers are required under 

a statute or regulation adopted prior to 

1975, or the collection in general is 

authorized by statute. Individuals must 

be informed whether submitting the 

social security number is mandatory or 

voluntary; the authority for collecting it; 

and the purpose for which it will be 

used. 

Section 102.36—Privacy Act 

standards of conduct this section 

requires SBA to inform its employees 

how the Agency enforces PA provisions, 

including civil liability and criminal 

penalty provisions. The section sets 

forth standards for collecting, 

maintaining, accessing, or disclosing 

information in a system of records, in 

order to comply with those standards. 

Section 102.37—Training 

requirements according to this section 

all SBA employees with PA duties must 

periodically attend Agency PA training. 

Section 102. 38—Other rights and 

services this section limits the rights of 

persons to access any record they are 

not entitled to under the PA. 

Section 102.39—SBA’s Exempt 

Privacy Act Systems of Records this 

section identifies the systems of records 

that are exempt from disclosure and the 

basis for their exemption. In general 

such systems contain Office of Inspector 

General (OIG) investigatory materials, 

Equal Employment Opportunity 

records, personnel records, and 

litigation records that contain 

personally identifiable criminal, 

investigative, and financial information. 

The exemption of these systems will 

help protect the investigative process, 

information sources, and classified 

information. 

Section 102.40—Computer matching 

agreements this section establishes that 

SBA may not disclose information on an 

individual for use in a computer 

matching program unless the Agency 

has entered into a written agreement 

governing the use of the information 

with the recipient of such information. 

Among other things, matching 

agreements must specify the purpose, 

legal authority, description and 

approximate number of records, 

estimate of savings, procedures for 

individualized notice, information 

verification, record retention and 

security, prohibitions on duplication 

and re-disclosure, assessments on 

record accuracy, and record access by 

the Comptroller General. Copies of all 

matching agreements must be provided 

to appropriate Congressional 

committees. 

This section also establishes a Data 

Integrity Board to oversee and 

coordinate the matching programs, 

approve and maintain all written 

agreements, and if OMB requests, 

compile a report on SBA’s matching 

activities that will be available to the 

public. Finally, this section sets forth 

the process for filing an appeal with 

OMB of any matching agreement the 

Data Integrity Board disapproves. OMB 

may approve such a matching 

agreement, if it finds that the program 

will be consistent with all applicable 

legal, regulatory and policy 

requirements, is cost-effective and is in 

the public interest. If the Board and 

OMB disapprove a matching program 

proposed by OIG, the IG may report 

such disapproval to the Administrator 

and to Congress. 

Section 102.41—Other provisions this 

section explains that SBA personnel 

records are maintained in accordance 

with Office of Personnel Management 

regulations, describes the conditions for 

disclosing an individual’s medical 

records, and notifies individuals that 

SBA will not profit from the sale of an 

individual’s name or address. 

Compliance With Executive Orders 

12866, 12988, and 13132, the 

Regulatory Flexibility Act (5 U.S.C. 

601–612), and the Paperwork 

Reduction Act (44 U.S.C. Ch. 35) 

Executive Order 12866 

The Office of Management and Budget 

has determined that this rule does not 

constitute a significant regulatory action 

within the meaning of Executive Order 

12866. This rule merely makes SBA’s 

Privacy Act program more compliant 

with current law and facilitates greater 

public understanding of why personal 

information is collected, how that 

information will be used and shared, 

how it may be accessed, and securely 

stored. 

Executive Order 12988 

This rule meets the applicable 

standards set forth in §§ 3(a) and 

(3)(b)(2) of Executive Order 12988, to 

minimize litigation, eliminate 

ambiguity, and reduce burden. This rule 

would not have retroactive or 

preemptive effect. 

Executive Order 13132 

This rule would not have substantial 

direct effects on the States, on the 

relationship between the national 

government and the States, or on the 

distribution of power and 

responsibilities among the various 

levels of government. Therefore, for 

purposes of Executive Order 13132, 

SBA has determined that this rule does 

not have sufficient federalism 

implications to warrant the preparation 

of a Federalism Assessment. 

Paperwork Reduction Act 

For the purpose of the Paperwork 

Reduction Act, 44 U.S.C. Ch. 35, SBA 

has determined that this rule will not 

impose any new reporting or record 

keeping requirements. 

Regulatory Flexibility Act 

The Regulatory Flexibility Act (RFA) 

requires administrative agencies to 

consider the effect of their actions on 

small entities, small non-profit 

enterprises, and small local 

governments. The RFA requires 

agencies to prepare an analysis which 

describes the impact of each rule on 

such entities. However, in lieu of 

preparing an analysis, section 605 of the 

RFA allows an agency to certify that the 

rulemaking is not expected to have a 

significant economic impact on a 

substantial number of small entities. 

This rule concerns the rights of 

individuals under the Privacy Act and 

outlines the responsibilities of the 

Agency to ensure that information it 

collects on those individuals is used 

and maintained in a manner that 

ensures its confidentiality. An 

individual is not a small entity as 

defined in the RFA. Furthermore, the 

Privacy Act does not concern small 

entities. Accordingly, SBA certifies that 

this rule will not have a significant 

economic impact on a substantial 

number of small entities. 

List of Subjects in 13 CFR Part 102 

Freedom of information, Privacy. 

■ For the reasons stated in the preamble, 

the Small Business Administration 

amends 13 CFR Chapter I, part 102, as 

follows: 

PART 102—RECORD DISCLOSURE 

AND PRIVACY 

■ 1. The authority citation for part 102 

is revised to read as follows: 

Authority: 5 U.S.C. 301, 552, 552a; 31 

U.S.C. 9701; 44 U.S.C. 3501, et seq., E.O. 

12600, 52 FR 23781, 3 CFR, 187 Comp., p. 

235. 


rwilkins on PROD1PC63 with RULES
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17369 

■ 2. Revise subpart B of part 102 to read 

as follows: 

Subpart B—Protection of Privacy and 

Access to Individual Records Under 

the Privacy Act of 1974 

Sec. 

102.20 General provisions. 

102.21 Agency officials responsible for the 

Privacy Act of 1974. 

102.22 Requirements relating to systems of 

records. 

102.23 Publication in the Federal 

Register—Notices of systems of records. 

102.24 Requests for access to records. 

102.25 Responsibility for responding to 

requests for access to records. 

102.26 Responses to requests for access to 

records. 

102.27 Appeals from denials of requests for 

access to records. 

102.28 Requests for amendment or 

correction of records. 

102.29 Requests for an accounting of record 

disclosures. 

102.30 Preservation of records. 

102.31 Fees. 

102.32 Notice of court-ordered and 

emergency disclosures. 

102.33 Security of systems of records. 

102.34 Contracts for the operation of record 

systems. 

102.35 Use and collection of Social Security 

Numbers. 

102.36 Privacy Act standards of conduct. 

102.37 Training requirements. 

102.38 Other rights and services. 

102.39 SBA’s exempt Privacy Act systems 

of records. 

102.40 Computer matching. 

102.41 Other provisions. 

Subpart B—Protection of Privacy and 

Access to Individual Records Under 

the Privacy Act of 1974 

§ 102.20 General provisions. 

(a) Purpose and scope. This subpart 

implements the provisions of the 

Privacy Act of 1974, 5 U.S.C. 552a. 

These regulations apply to all records 

which are contained in systems of 

records maintained by the U.S. Small 

Business Administration (SBA) and that 

are retrieved by an individual’s name or 

personal identifier. These regulations 

set forth the procedures by which 

individuals may request access to 

records about themselves, request 

amendment or correction of those 

records, and request an accounting of 

disclosures of those records by the SBA. 

These regulations also set forth the 

requirements applicable to SBA 

employees maintaining, collecting, 

using or disseminating records 

pertaining to individuals. This subpart 

applies to SBA and all of its offices and 

is mandatory for use by all SBA 

employees. 

(b) Definitions. As used in this 

subpart: 

(1) Agency means the U.S. Small 

Business Administration (SBA) and 

includes all of its offices wherever 

located; 

(2) Employee means any employee of 

the SBA, regardless of grade, status, 

category or place of employment; 

(3) Individual means a citizen of the 

United States or an alien lawfully 

admitted for permanent residence. This 

term shall not encompass 

entrepreneurial enterprises (e.g. sole 

proprietors, partnerships, corporations, 

or other forms of business entities); 

(4) Maintain includes maintain, 

collect, use, or disseminate; 

(5) Record means any item, collection, 

or grouping of information about an 

individual that is maintained by the 

SBA, including, but not limited to 

education, financial transactions, 

medical history, and criminal or 

employment history and that contains 

the individual’s name, or an identifying 

number, symbol, or other identifying 

particular assigned to the individual 

such as a finger or voice print or 

photograph; 

(6) System of records means a group 

of any records under the control of SBA 

from which information is retrieved by 

the name of the individual or by an 

identifying number, symbol, or other 

identifying particular assigned to the 

individual; 

(7) Statistical record means a record 

in a system of records maintained for 

statistical research or reporting purposes 

only and not used in whole or in part 

in making any determination about an 

identifiable individual; 

(8) Routine use means, with respect to 

the disclosure of a record, the use of 

such record for a purpose which is 

compatible with the purpose for which 

it was collected; 

(9) Request for access to a record 

means a request made under Privacy 

Act subsection (d)(1) allowing an 

individual to gain access to his or her 

record or to any information pertaining 

to him or her which is contained in a 

system of records; 

(10) Request for amendment or 

correction of a record means a request 

made under Privacy Act subsection 

(d)(2), permitting an individual to 

request amendment or correction of a 

record that he or she believes is not 

accurate, relevant, timely, or complete; 

(11) Request for an accounting means 

a request made under Privacy Act 

subsection (c)(3) allowing an individual 

to request an accounting of any 

disclosure to any SBA officers and 

employees who have a need for the 

record in the performance of their 

duties; 

(12) Requester is an individual who 

makes a request for access, a request for 

amendment or correction, or a request 

for an accounting under the Privacy Act; 

and 

(13) Authority to request records for a 

law enforcement purpose means that the 

head of an Agency or a United States 

Attorney, or either’s designee, is 

authorized to make written requests 

under subsection (b)(7) of the Privacy 

Act for records maintained by other 

agencies that are necessary to carry out 

an authorized law enforcement activity. 

§ 102.21 Agency employees responsible 

for the Privacy Act of 1974. 

(a) Program/Support Office Head is 

the SBA employee in each field office 

and major program and support area 

responsible for implementing and 

overseeing this regulation in that office. 

(b) Privacy Act Systems Manager 

(PASM) is the designated SBA employee 

in each office responsible for the 

development and management of any 

Privacy Act systems of records in that 

office. 

(c) Senior Agency Official for Privacy 

is SBA’s Chief Information Officer (CIO) 

who has overall responsibility and 

accountability for ensuring the SBA’s 

implementation of information privacy 

protections, including the SBA’s full 

compliance with Federal laws, 

regulations, and policies relating to 

information privacy such as the Privacy 

Act and the E-Government Act of 2002. 

(d) Chief, Freedom of Information/ 

Privacy Acts (FOI/PA) Office oversees 

and implements the record access, 

amendment, and correction provisions 

of the Privacy Act. 

§ 102.22 Requirements relating to systems 

of records. 

(a) In general. Each SBA office shall, 

in accordance with the Privacy Act: 

(1) Maintain in its records only such 

information about an individual as is 

relevant and necessary to accomplish a 

purpose of the Agency required to be 

accomplished by a statute or by 

Executive Order of the President; 

(2) Collect information to the greatest 

extent practicable directly from the 

subject individual when the information 

may affect an individual’s rights, 

benefits, and privileges under Federal 

programs; 

(b) Requests for information from 

individuals. If a form is being used to 

collect information from individuals, 

either the form used to collect the 

information, or a separate form that can 

be retained by the individual, must state 

the following: 

(1) The authority (whether granted by 

statute, or by Executive Order of the 


rwilkins on PROD1PC63 with RULES
17370 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

President) which authorizes the 

solicitation of the information and 

whether disclosure of such information 

is mandatory or voluntary; 

(2) The principal purpose or purposes 

for which the information is intended to 

be used; 

(3) The routine uses which may be 

made of the information; and 

(4) The effects on such individual, if 

any, of not providing all or any part of 

the requested information. 

(c) Report on new systems. Each SBA 

office shall provide adequate advance 

notice to Congress and OMB through the 

FOI/PA Office of any proposal to 

establish or alter any system of records 

in order to permit an evaluation of the 

probable or potential effect of such 

proposal on the privacy and other 

personal or property rights of 

individuals or the disclosure of 

information relating to such individuals. 

(d) Accurate and secure maintenance 

of records. Each SBA office shall: 

(1) Maintain all records which are 

used in making any determination about 

any individual with such accuracy, 

relevance, timeliness, and completeness 

as is reasonably necessary to assure 

fairness to the individual in the 

determination; 

(2) Prior to disseminating any record 

from a system of records about an 

individual to any requestor, including 

an agency, make reasonable efforts to 

assure that such records are accurate, 

complete, timely, and relevant for SBA 

purposes; and 

(3) Establish appropriate 

administrative, technical, and physical 

safeguards to insure the security and 

confidentiality of records and to protect 

against any anticipated threats or 

hazards to their security or integrity 

which could result in substantial harm, 

embarrassment, inconvenience, or 

unfairness to any individual on whom 

information is maintained. 

(i) PASMs, with the approval of the 

head of their offices, shall establish 

administrative and physical controls, 

consistent with SBA regulations, to 

insure the protection of records systems 

from unauthorized access or disclosure 

and from physical damage or 

destruction. The controls instituted 

shall be proportional to the degree of 

sensitivity of the records but at a 

minimum must ensure that records 

other than those available to the general 

public under the FOIA, are protected 

from public view, that the area in which 

the records are stored is supervised 

during all business hours and physically 

secured during non-business hours to 

prevent unauthorized personnel from 

obtaining access to the records. 

(ii) PASMs, with the approval of the 

head of their offices, shall adopt access 

restrictions to insure that only those 

individuals within the agency who have 

a need to have access to the records for 

the performance of their duties have 

access to them. Procedures shall also be 

adopted to prevent accidental access to, 

or dissemination of, records. 

(e) Prohibition against maintenance of 

records concerning First Amendment 

rights. No SBA office shall maintain a 

record describing how any individual 

exercises rights guaranteed by the First 

Amendment (e.g. speech), unless the 

maintenance of such record is: 

(1) Expressly authorized by statute, or 

(2) Expressly authorized by the 

individual about whom the record is 

maintained, or 

(3) Pertinent to and within the scope 

of an authorized law enforcement 

activity. 

§ 102.23 Publication in the Federal 

Register—Notices of systems of records. 

(a) Notices of systems of records to be 

published in the Federal Register. (1) 

The SBA shall publish in the Federal 

Register upon establishment or revision 

a notice of the existence and character 

of any new or revised systems of 

records. Unless otherwise instructed, 

each notice shall include: 

(i) The name and location of the 

system; 

(ii) The categories of individuals on 

who records are maintained in the 

system; 

(iii) The categories of records 

maintained in the system; 

(iv) Each routine use of the records 

contained in the system, including the 

categories of users and the purpose of 

such use; 

(v) The policies and practices of the 

office regarding storage, retrievability, 

access controls, retention, and disposal 

of the records; 

(vi) The title and business address of 

the SBA official who is responsible for 

the system of records; 

(vii) A statement that SBA procedures 

allow an individual, at his or her 

request, to determine whether a system 

of records contains a record pertaining 

to him or her, to review such records 

and to contest or amend such records, 

located in sections 102.25 through 

102.29 of these regulations. 

(viii) A statement that such requests 

may be directed to the SBA’s FOI/PA 

Office, 409 3rd St., SW., Washington, 

DC 20416 or faxed to 202–205–7059; 

and 

(ix) The categories of sources of 

records in the system. 

(2) Minor changes to systems of 

records shall be published annually. 

(b) Notice of new or modified routine 

uses to be published in the Federal 

Register. At least 30 days prior to 

disclosing records pursuant to a new 

use or modification of a routine use, as 

published under paragraph (a)(1)(iv) of 

this section, each SBA office shall 

publish in the Federal Register notice of 

such new or modified use of the 

information in the system and provide 

an opportunity for any individual or 

persons to submit written comments. 

§ 102.24 Requests for access to records. 

(a) How made and addressed. An 

individual, or his or her legal guardian, 

may make a request for access to an SBA 

record about himself or herself by 

appearing in person or by writing 

directly to the SBA office that maintains 

the record or to the FOI/PA Office by 

mail to 409 3rd St., SW., Washington, 

DC 20416 or fax to 202–205–7059. A 

request received by the FOI/PA Office 

will be forwarded to the appropriate 

SBA Office where the records are 

located. 

(b) Description of records sought. A 

request for access to records must 

describe the records sought in sufficient 

detail to enable SBA personnel to locate 

the system of records containing them 

with a reasonable amount of effort. A 

request should also state the date of the 

record or time period in which the 

record was compiled, and the name or 

identifying number of each system of 

records in which the requester believes 

the record is kept. The SBA publishes 

notices in the Federal Register that 

describe its systems of records. A 

description of the SBA’s systems of 

records also may be found at http:// 

www.sba.gov/foia/systemrecords.doc. 

(c) Verification of identity. Any 

individual who submits a request for 

access to records must verify his or her 

identity. No specific form is required; 

however, the requester must state his or 

her full name, current address, and date 

and place of birth. The request must be 

signed and the requester’s signature 

must either be notarized or submitted 

under 28 U.S.C. 1746. This law permits 

statements to be made under penalty of 

perjury as a substitute for notarization, 

the language states: 

(1) If executed outside the United 

States: ‘‘I declare (or certify, verify, or 

state) under penalty of perjury under the 

laws of the United States of America 

that the foregoing is true and correct. 

Executed on (date). Signature’’; or 

(2) If executed within the Untied 

States, its territories, possessions or 

commonwealths: ‘‘I declare (or certify, 

verify, or state) under penalty of perjury 

that the foregoing is true and correct. 

Executed on (date). Signature’’. 


rwilkins on PROD1PC63 with RULES
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17371 

(d) Verification of guardianship. 

When making a request as a legal agent 

or the parent or guardian of a minor or 

as the guardian of someone determined 

by a court to be incompetent, for access 

to records about that individual, the 

requester must establish: 

(1) The identity of the individual who 

is the subject of the record, by stating 

the name, current address, date and 

place of birth, and, at the requester’s 

option, the social security number of the 

individual; 

(2) The requester’s own identity, as 

required in paragraph (c) of this section; 

(3) That the requester is the legal 

agent or parent or guardian of that 

individual, which may be proven by 

providing a copy of the individual’s 

birth certificate showing his parentage 

or by providing a court order 

establishing guardianship; and 

(4) That the requester is acting on 

behalf of that individual in making the 

request. 

§ 102.25 Responsibility for responding to 

requests for access to records. 

(a) In general. Except as stated in 

paragraphs (c), (d), and (e) of this 

section and in § 102.24(a), the office that 

first receives a request for access to a 

record, and has possession of that 

record, is the office responsible for 

responding to the request. That office 

shall acknowledge receipt of the request 

not later than 10 days (excluding 

Saturdays, Sundays, and legal public 

holidays) after the date of receipt of the 

request in writing. In determining 

which records are responsive to a 

request, an office ordinarily shall 

include only those records in its 

possession as of the date the office 

begins its search for them. If any other 

date is used, the office shall inform the 

requester of that date. 

(b) Authority to grant or deny 

requests. The Program/Support Office 

Head, or designee, is authorized to grant 

or deny any request for access to a 

record of that office. 

(c) Consultations and referrals. When 

an office receives a request for access to 

a record in its possession, it shall 

determine whether another office, or 

another agency of the Federal 

Government, is better able to determine 

whether the record is exempt from 

access under the Privacy Act. If the 

receiving office determines that it is best 

able to process the record in response to 

the request, then it shall do so. If the 

receiving office determines that it is not 

best able to process the record, then it 

shall either: 

(1) Respond to the request regarding 

that record, after consulting with the 

office or agency best able to determine 

whether the record is exempt from 

access and with any other office or 

agency that has a substantial interest in 

it; or 

(2) Refer the responsibility for 

responding to the request to the office 

best able to determine whether the 

record is exempt from access or to 

another agency that originated the 

record (but only if that agency is subject 

to the Privacy Act). Ordinarily the office 

or agency that originated a record will 

be presumed to be best able to 

determine whether it is exempt from 

access. 

(d) Law enforcement information. 

Whenever a request is made for access 

to a record containing information that 

relates to an investigation of a possible 

violation of law and that was originated 

by SBA’s Office of the Inspector General 

(OIG) or another agency, the receiving 

office shall refer the responsibility for 

responding to the request regarding that 

information to either SBA’s OIG or the 

other agency ‘‘depending on where the 

investigation originated.’’

(e) Classified information. Whenever a 

request is made for access to a record 

containing information that has been 

classified by or may be appropriate for 

classification by another office or 

agency under Executive Order 12958 or 

any other executive order concerning 

the classification of records, the 

receiving office shall refer the 

responsibility for responding to the 

request regarding that information to the 

office or agency that classified the 

information, should consider the 

information for classification, or has the 

primary interest in it, as appropriate. 

Whenever a record contains information 

that has been derivatively classified by 

an office because it contains information 

classified by another office or agency, 

the office shall refer the responsibility 

for responding to the request regarding 

that information to the office or agency 

that classified the underlying 

information. Information determined to 

no longer require classification shall not 

be withheld from a requester on the 

basis of Exemption (k)(1) of the Privacy 

Act. 

(f) Notice of referral. Whenever an 

office refers all or any part of the 

responsibility for responding to a 

request to another office or agency, it 

shall notify the requester of the referral 

and inform the requester of the name of 

each office or agency to which the 

request has been referred and of the part 

of the request that has been referred. 

(g) Responses to consultations and 

referrals. All consultations and referrals 

shall be processed according to the date 

the access request was initially received 

by the first office or agency, not any 

later date. 

(h) Agreements regarding 

consultations and referrals. Offices may 

make agreements with other offices or 

agencies to eliminate the need for 

consultations or referrals for particular 

types of records. 

§ 102.26 Responses to requests for access 

to records. 

(a) Acknowledgements of requests. On 

receipt of a request, an office shall send 

an acknowledgement letter to the 

requester. 

(b) Grants of requests for access. Once 

an office makes a determination to grant 

a request for access in whole or in part, 

it shall notify the requester in writing. 

The Program/Support Office Head or 

designee shall inform the requester in 

the notice of any fee charged under 

§ 102.31 and shall disclose records to 

the requester promptly on payment of 

any applicable fee. If a request is made 

in person, the office may disclose 

records to the requester directly, in a 

manner not unreasonably disruptive of 

its operations, on payment of any 

applicable fee and with a written record 

made of the grant of the request. If a 

requester is accompanied by another 

person, he or she shall be required to 

authorize in writing any discussion of 

the records in the presence of the other 

person. 

(c) Adverse determinations of requests 

for access. A Program/Support Office 

Head or designee making an adverse 

determination denying a request for 

access in any respect shall notify the 

requester of that determination in 

writing. Adverse determinations, or 

denials of requests, consist of: a 

determination to withhold any 

requested record in whole or in part; a 

determination that a requested record 

does not exist or cannot be located; a 

determination that the requested 

information is not a record subject to the 

Privacy Act; a determination on any 

disputed fee matter; and a denial of a 

request for expedited treatment. The 

notification letter shall be signed by the 

Program/Support Office Head or 

designee, and shall include: 

(1) The name and title or position of 

the person responsible for the denial; 

(2) A brief statement of the reason(s) 

for the denial, including any FOIA or 

Privacy Act exemption(s) applied in 

denying the request; and 

(3) A statement that the denial may be 

appealed under § 102.27(a) and a 

description of the requirements of 

§ 102.27(a). 


rwilkins on PROD1PC63 with RULES
17372 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

§ 102.27 Appeals from denials of requests 

for access to records. 

(a) Appeals. If the requester is 

dissatisfied with an office’s response to 

his or her request for access to records, 

the requester may make a written appeal 

of the adverse determination denying 

the request in any respect to the SBA’s 

FOI/PA Office, 409 3rd St., SW., 

Washington, DC 20416. The appeal 

must be received by the FOI/PA Office 

within 60 days of the date of the letter 

denying the request. The requester’s 

appeal letter should include as much 

information as possible, including the 

identity of the office whose adverse 

determination is being appealed. Unless 

otherwise directed, the Chief, FOI/PA 

will decide all appeals under this 

subpart. 

(b) Responses to appeals. The 

decision on a requester’s appeal will be 

made in writing not later than 30 days 

(excluding Saturdays, Sundays, and 

legal public holidays) after the date of 

receipt of such appeal. A decision 

affirming an adverse determination in 

whole or in part will include a brief 

statement of the reason(s) for the 

affirmation, including any Privacy Act 

exemption applied, and will inform the 

requester of the Privacy Act provisions 

for court review of the decision. If the 

adverse determination is reversed or 

modified on appeal in whole or in part, 

the requester will be notified in a 

written decision and his request will be 

reprocessed in accordance with that 

appeal decision. 

(c) Judicial review. In order to seek 

judicial review by a court of any adverse 

determination or denial of a request, a 

requester must first appeal it to the FOI/ 

PA Office under this section. 

§ 102.28 Requests for amendment or 

correction of records. 

(a) How made and addressed. Unless 

the record is not subject to amendment 

or correction as stated in paragraph (f) 

of this section, an individual may make 

a request for amendment or correction 

of an SBA record about himself or 

herself by writing directly to the office 

that maintains the record, following the 

procedures in § 102.24. The request 

should identify each particular record in 

question, state the amendment or 

correction sought, and state why the 

record is not accurate, relevant, timely, 

or complete. The requester may submit 

any documentation that he or she thinks 

would be helpful. If the requester 

believes that the same record is in more 

than one system of records, that should 

be stated and the request should be sent 

to each office that maintains a system of 

records containing the record. 

(b) Office responses. Within ten (10) 

days (excluding Saturdays, Sundays, 

and legal public holidays) of receiving 

a request for amendment or correction 

of records, an office shall send the 

requester a written acknowledgment of 

receipt, and the office shall notify the 

requester within 30 days (excluding 

Saturdays, Sundays, and legal public 

holidays) of receipt of the request 

whether it is granted or denied. If the 

Program/Support Office Head or 

designee grants the request in whole or 

in part, the amendment or correction 

must be made, and the requester 

advised of his or her right to obtain a 

copy of the corrected or amended 

record. If the office denies a request in 

whole or in part, it shall send the 

requester a letter signed by the Program/ 

Support Office Head or designee that 

shall state: 

(1) The reason(s) for the denial; and 

(2) The procedure for appeal of the 

denial under paragraph (c) of this 

section, including the name and 

business address of the official who will 

act on your appeal. 

(c) Appeals. An individual may 

appeal a denial of a request for 

amendment or correction to the FOI/PA 

Office in the same manner as a denial 

of a request for access to records (see 

§ 102.27), and the same procedures shall 

be followed. If the appeal is denied, the 

requester shall be advised of his or her 

right to file a Statement of Disagreement 

as described in paragraph (d) of this 

section and of his or her right under the 

Privacy Act for court review of the 

decision. 

(d) Statement of Disagreement. If an 

appeal under this section is denied in 

whole or in part, the requester has the 

right to file a Statement of Disagreement 

that states the reason(s) for disagreeing 

with the SBA’s denial of his or her 

request for amendment or correction. A 

Statement of Disagreement must be 

concise, must clearly identify each part 

of any record that is disputed, and 

should be no longer than one typed page 

for each fact disputed. An individual’s 

Statement of Disagreement must be sent 

to the office that maintains the record 

involved, which shall place it in the 

system of records in which the disputed 

record is maintained and shall mark the 

disputed record to indicate that a 

Statement of Disagreement has been 

filed and where in the system of records 

it may be found. 

(e) Notification of amendment/ 

correction or disagreement. Within 30 

days (excluding Saturdays, Sundays, 

and legal public holidays) of the 

amendment or correction of a record, 

the office that maintains the record shall 

notify all persons, organizations, or 

agencies to which it previously 

disclosed the record, if an accounting of 

that disclosure was made, that the 

record has been amended or corrected. 

If an individual has filed a Statement of 

Disagreement, the office shall append a 

copy of it to the disputed record 

whenever the record is disclosed and 

may also append a concise statement of 

its reason(s) for denying the request to 

amend or correct the record. 

(f) Records not subject to amendment 

or correction. The following records are 

not subject to amendment or correction: 

(1) Transcripts of testimony given 

under oath or written statements made 

under oath; 

(2) Transcripts of grand jury 

proceedings, judicial proceedings, or 

quasi-judicial proceedings, which are 

the official record of those proceedings; 

(3) Pre-sentence records that 

originated with the courts; and 

(4) Records in systems of records that 

have been exempted from amendment 

and correction under Privacy Act, 5 

U.S.C. 552a (j) or (k) by notice published 

in the Federal Register. 

§ 102.29 Requests for an accounting of 

record disclosures. 

(a) How made and addressed. Except 

where accountings of disclosures are not 

required to be kept (as stated in 

paragraph (b) of this section), an 

individual may make a request for an 

accounting of any disclosure that has 

been made by the SBA to another 

person, organization, or agency of any 

record in a system of records about him 

or her. This accounting contains the 

date, nature, and purpose of each 

disclosure, as well as the name and 

address of the person, organization, or 

agency to which the disclosure was 

made. The request for an accounting 

should identify each particular record in 

question and should be made by writing 

directly to the SBA office that maintains 

the record, following the procedures in 

§ 102.24. 

(b) Where accountings are not 

required. Offices are not required to 

provide accountings where they relate 

to: 

(1) Disclosures for which accountings 

are not required to be kept; disclosures 

that are made to employees within the 

SBA and disclosures that are made 

under the FOIA; 

(2) Disclosures made to law 

enforcement agencies for authorized law 

enforcement activities in response to 

written requests from those law 

enforcement agencies specifying the 

civil or criminal law enforcement 

activities for which the disclosures are 

sought; or 


rwilkins on PROD1PC63 with RULES
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17373 

(3) Disclosures made from law 

enforcement systems of records that 

have been exempted from accounting 

requirements under Privacy Act, 5 

U.S.C. 552a(j) or (k) by notice published 

in the Federal Register. 

(c) Appeals. An individual may 

appeal a denial of a request for an 

accounting to the FOI/PA Office in the 

same manner as a denial of a request for 

access to records (see § 102.27), and the 

same procedures will be followed. 

§ 102.30 Preservation of records. 

Each office will preserve all 

correspondence pertaining to the 

requests that it receives under this 

subpart, as well as copies of all 

requested records, until disposition or 

destruction is authorized by title 44 of 

the United States Code or the National 

Archives and Records Administration’s 

General Records Schedule 14. Records 

will not be disposed of while they are 

the subject of a pending request, appeal, 

or lawsuit under the Privacy Act. 

§ 102.31 Fees. 

SBA offices shall charge fees for 

duplication of records under the Privacy 

Act in the same way in which they 

charge duplication fees under 

§ 102.6(b)(3). No search or review fee 

may be charged for any record unless 

the record has been exempted from 

access under Exemptions (j)(2) or (k)(2) 

of the Privacy Act. SBA will waive fees 

under $25.00. 

§ 102.32 Notice of court-ordered and 

emergency disclosures. 

(a) Court-ordered disclosures. When a 

record pertaining to an individual is 

required to be disclosed by order of a 

court of competent jurisdiction, the 

office that maintains the record shall 

make reasonable efforts to provide 

notice of this to the individual. Notice 

shall be given within a reasonable time 

after the office’s receipt of the order, 

except that in a case in which the order 

is not a matter of public record, the 

notice shall be given only after the order 

becomes public. This notice shall be 

mailed to the individual’s last known 

address and shall contain a copy of the 

order and a description of the 

information disclosed. Notice shall not 

be given if disclosure is made from a 

criminal law enforcement system of 

records that has been exempted from the 

notice requirement. 

(b) Emergency disclosures. Upon 

disclosing a record pertaining to an 

individual made under compelling 

circumstances affecting health or safety, 

the office shall notify that individual of 

the disclosure. This notice shall be 

mailed to the individual’s last known 

address and shall state the nature of the 

information disclosed; the person, 

organization, or agency to which it was 

disclosed; the date of disclosure; and 

the compelling circumstances justifying 

the disclosure. 

§ 102.33 Security of systems of records. 

(a) Each Program/Support Office Head 

or designee shall establish 

administrative and physical controls to 

prevent unauthorized access to its 

systems of records, to prevent 

unauthorized disclosure of records, and 

to prevent physical damage to or 

destruction of records. The stringency of 

these controls shall correspond to the 

sensitivity of the records that the 

controls protect. At a minimum, each 

office’s administrative and physical 

controls shall ensure that: 

(1) Records are protected from public 

view; 

(2) The area in which records are kept 

is supervised during business hours to 

prevent unauthorized persons from 

having access to them; 

(3) Records are inaccessible to 

unauthorized persons outside of 

business hours; and 

(4) Records are not disclosed to 

unauthorized persons or under 

unauthorized circumstances in either 

oral or written form. 

(b) Each Program/Support Office Head 

or designee shall establish procedures 

that restrict access to records to only 

those individuals within the SBA who 

must have access to those records in 

order to perform their duties and that 

prevent inadvertent disclosure of 

records. 

(c) The OCIO shall provide SBA 

offices with guidance and assistance for 

privacy and security of electronic 

systems and compliance with pertinent 

laws and requirements. 

§ 102.34 Contracts for the operation of 

record systems. 

When SBA contracts for the operation 

or maintenance of a system of records or 

a portion of a system of records by a 

contractor, the record system or the 

portion of the record affected, are 

considered to be maintained by the 

SBA, and subject to this subpart. The 

SBA is responsible for applying the 

requirements of this subpart to the 

contractor. The contractor and its 

employees are to be considered 

employees of the SBA for purposes of 

the sanction provisions of the Privacy 

Act during performance of the contract. 

§ 102.35 Use and collection of Social 

Security Numbers. 

Each Program/Support Office Head or 

designee shall ensure that collection 

and use of SSN is performed only when 

the functionality of the system is 

dependant on use of the SSN as an 

identifier. Employees authorized to 

collect information must be aware: 

(a) That individuals may not be 

denied any right, benefit, or privilege as 

a result of refusing to provide their 

social security numbers, unless: 

(1) The collection is authorized either 

by a statute; or 

(2) The social security numbers are 

required under statute or regulation 

adopted prior to 1975 to verify the 

identity of an individual; and 

(b) That individuals requested to 

provide their social security numbers 

must be informed of: 

(1) Whether providing social security 

numbers is mandatory or voluntary; 

(2) Any statutory or regulatory 

authority that authorizes the collection 

of social security numbers; and 

(3) The uses that will be made of the 

numbers. 

§ 102.36 Privacy Act standards of conduct. 

Each Program/Support Office Head or 

designee shall inform its employees of 

the provisions of the Privacy Act, 

including its civil liability and criminal 

penalty provisions. Unless otherwise 

permitted by law, an employee of the 

SBA shall: 

(a) Collect from individuals only the 

information that is relevant and 

necessary to discharge the 

responsibilities of the SBA; 

(b) Collect information about an 

individual directly from that individual 

whenever practicable; 

(c) Inform each individual from whom 

information is collected of: 

(1) The legal authority to collect the 

information and whether providing it is 

mandatory or voluntary; 

(2) The principal purpose for which 

the SBA intends to use the information; 

(3) The routine uses the SBA may 

make of the information; and 

(4) The effects on the individual, if 

any, of not providing the information; 

(d) Ensure that the office maintains no 

system of records without public notice 

and that it notifies appropriate SBA 

officials of the existence or development 

of any system of records that is not the 

subject of a current or planned public 

notice; 

(e) Maintain all records that are used 

by the SBA in making any 

determination about an individual with 

such accuracy, relevance, timeliness, 

and completeness as is reasonably 

necessary to ensure fairness to the 

individual in the determination; 

(f) Except as to disclosures made to an 

agency or made under the FOIA, make 

reasonable efforts, prior to 


rwilkins on PROD1PC63 with RULES
17374 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

disseminating any record about an 

individual, to ensure that the record is 

accurate, relevant, timely, and complete; 

(g) Maintain no record describing how 

an individual exercises his or her First 

Amendment rights, unless it is 

expressly authorized by statute or by the 

individual about whom the record is 

maintained, or is pertinent to and 

within the scope of an authorized law 

enforcement activity; 

(h) When required by the Privacy Act, 

maintain an accounting in the specified 

form of all disclosures of records by the 

SBA to persons, organizations, or 

agencies; 

(i) Maintain and use records with care 

to prevent the unauthorized or 

inadvertent disclosure of a record to 

anyone; and 

(j) Notify the appropriate SBA official 

of any record that contains information 

that the Privacy Act does not permit the 

SBA to maintain. 

§ 102.37 Training requirements. 

All employees should attend privacy 

training within one year of employment 

with SBA. All employees with Privacy 

Act responsibilities must attend Privacy 

Act training, whenever needed, that is 

offered by the SBA. 

§ 102.38 Other rights and services. 

Nothing in this subpart shall be 

construed to entitle any person, as a 

right, to any service or to the disclosure 

of any record to which such person is 

not entitled under the Privacy Act. 

§ 102.39 SBA’s exempt Privacy Act 

systems of records. 

(a) Systems of records subject to 

investigatory material exemption under 

5 U.S.C. 552a(k)(2), or 5 U.S.C. 

552a(k)(5) or both: 

(1) Office of Inspector General 

Records Other Than Investigation 

Records—SBA 4, contains records 

pertaining to audits, evaluations, and 

other non-audit services performed by 

the OIG; 

(2) Equal Employment Opportunity 

Complaint Cases—SBA 13, contains 

complaint files, Equal Employment 

Opportunity counselor’s reports, 

investigation materials, notes, reports, 

and recommendations; 

(3) Investigative Files—SBA 16, 

contains records gathered by the OIG in 

the investigation of allegations that are 

within the jurisdiction of the OIG; 

(4) Investigations Division 

Management Information System—SBA 

17, contains records gathered or created 

during preparation for, conduct of, and 

follow-up on investigations conducted 

by the OIG, the Federal Bureau of 

Investigation (FBI), and other Federal, 

State, local, or foreign regulatory or law 

enforcement agency; 

(5) Litigation and Claims Files—SBA 

19, contains records relating to 

recipients classified as ‘‘in litigation’’

and all individuals involved in claims 

by or against the Agency; 

(6) Personnel Security Files—SBA 24, 

contains records on active and inactive 

personnel security files, employee or 

former employee’s name, background 

information, personnel actions, OPM, 

and/or authorized contracting firm 

background investigations; 

(7) Security and Investigations Files—

SBA 27, contains records gathered or 

created during preparation for, conduct 

of, and follow-up on investigations 

conducted by OIG, the FBI, and other 

Federal, State, local, or foreign 

regulatory or law enforcement agencies 

as well as other material submitted to or 

gathered by OIG in furtherance of its 

investigative function; and 

(8) Standards of Conduct Files—SBA 

29, contains records on confidential 

employment and financial statements of 

employees Grade 13 and above. 

(b) These systems of records are 

exempt from the following provisions of 

the Privacy Act and all regulations in 

this part promulgated under these 

provisions: 

(1) 552a(c)(3) (Accounting of Certain 

Disclosures); 

(2) 552a(d) (Access to Records); 

(3) 552a(e)(1), 4G, H, and I (Agency 

Requirements); and 

(4) 552a(f) (Agency Rules). 

(c) The systems of records described 

in paragraph (a) of this section are 

exempt from the provisions of the 

Privacy Act described in paragraph (b) 

of this section in order to: 

(1) Prevent the subject of 

investigations from frustrating the 

investigatory process; 

(2) Protect investigatory material 

compiled for law enforcement purposes; 

(3) Fulfill commitments made to 

protect the confidentiality of sources 

and to maintain access to necessary 

sources of information; or 

(4) Prevent interference with law 

enforcement proceedings. 

(d) In addition to the foregoing 

exemptions in paragraphs (a) through (c) 

of this section, the systems of records 

described in paragraph (a) of this 

section numbered SBA 4, 16, 17, 24, and 

27 are exempt from the Privacy Act 

except for subsections (b), (c)(1) and (2), 

(e)(4)(A) through F, (e)(6), (7), (9), (10) 

and (11) and (i) to the extent that they 

contain: 

(1) Information compiled to identify 

individual criminal offenders and 

alleged offenders and consisting only of 

identifying data and notations of arrests, 

confinement, release, and parole and 

probation status; 

(2) Information, including reports of 

informants and investigators, associated 

with an identifiable individual 

compiled to investigate criminal 

activity; or 

(3) Reports compiled at any stage of 

the process of enforcement of the 

criminal laws from arrest or indictment 

through release from supervision 

associated with an identifiable 

individual. 

(e) The systems of records described 

in paragraph (d) of this section are 

exempt from the Privacy Act to the 

extent described in that paragraph 

because they are records maintained by 

the Investigations Division of the OIG, 

which is a component of SBA which 

performs as its principal function 

activities pertaining to the enforcement 

of criminal laws within the meaning of 

5 U.S.C. 552a(j)(2). They are exempt in 

order to: 

(1) Prevent the subjects of OIG 

investigations from using the Privacy 

Act to frustrate the investigative 

process; 

(2) Protect the identity of Federal 

employees who furnish a complaint or 

information to the OIG, consistent with 

section 7(b) of the Inspector General Act 

of 1978, 5 U.S.C. app. 3; 

(3) Protect the confidentiality of other 

sources of information; 

(4) Avoid endangering confidential 

sources and law enforcement personnel; 

(5) Prevent interference with law 

enforcement proceedings; 

(6) Assure access to sources of 

confidential information, including that 

contained in Federal, State, and local 

criminal law enforcement information 

systems; 

(7) Prevent the disclosure of 

investigative techniques; or 

(8) Prevent the disclosure of classified 

information. 

§ 102.40 Computer matching. 

The OCIO will enforce the computer 

matching provisions of the Privacy Act. 

The FOI/PA Office will review and 

concur on all computer matching 

agreements prior to their activation and/ 

or renewal. 

(a) Matching agreements. SBA will 

comply with the Computer Matching 

and Privacy Protection Act of 1988 (5 

U.S.C. 552a(o), 552a notes) . The Privacy 

Protection Act establishes procedures 

Federal agencies must use if they want 

to match their computer lists. SBA shall 

not disclose any record which is 

contained in a system of records to a 

recipient agency or non-Federal agency 

for use in a computer matching program 

except pursuant to a written agreement 


rwilkins on PROD1PC63 with RULES
Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 17375 

between SBA and the recipient agency 

or non-Federal agency specifying: 

(1) The purpose and legal authority 

for conducting the program; 

(2) The justification for the purpose 

and the anticipated results, including a 

specific estimate of any savings; 

(3) A description of the records that 

will be matched, including each data 

element that will be used, the 

approximate number of records that will 

be matched, and the projected starting 

and completion dates of the matching 

program; 

(4) Procedures for providing 

individualized notice at the time of 

application, and periodically thereafter 

as directed by the Data Integrity Board, 

that any information provided by any of 

the above may be subject to verification 

through matching programs to: 

(i) Applicants for and recipients of 

financial assistance or payments under 

Federal benefit programs, and 

(ii) Applicants for and holders of 

positions as Federal personnel. 

(5) Procedures for verifying 

information produced in such matching 

program as required by paragraph (c) of 

this section. 

(6) Procedures for the retention and 

timely destruction of identifiable 

records created by a recipient agency or 

non-Federal agency in such matching 

program; 

(7) Procedures for ensuring the 

administrative, technical, and physical 

security of the records matched and the 

results of such programs; 

(8) Prohibitions on duplication and 

redisclosure of records provided by SBA 

within or outside the recipient agency 

or non-Federal agency, except where 

required by law or essential to the 

conduct of the matching program; 

(9) Procedures governing the use by a 

recipient agency or non-Federal agency 

of records provided in a matching 

program by SBA, including procedures 

governing return of the records to SBA 

or destruction of records used in such 

programs; 

(10) Information on assessments that 

have been made on the accuracy of the 

records that will be used in such 

matching programs; and 

(11) That the Comptroller General 

may have access to all records of a 

recipient agency or non-Federal agency 

that the Comptroller General deems 

necessary in order to monitor or verify 

compliance with the agreement. 

(b) Agreement specifications. A copy 

of each agreement entered into pursuant 

to paragraph (a) of this section shall be 

transmitted to OMB, the Committee on 

Governmental Affairs of the Senate and 

the Committee on Governmental 

Operations of the House of 

Representatives and be available upon 

request to the public. 

(1) No such agreement shall be 

effective until 30 days after the date on 

which a copy is transmitted. 

(2) Such an agreement shall remain in 

effect only for such period, not to 

exceed 18 months, as the Data Integrity 

Board determines is appropriate in light 

of the purposes, and length of time 

necessary for the conduct, of the 

matching program. 

(3) Within three (3) months prior to 

the expiration of such an agreement, the 

Data Integrity Board may without 

additional review, renew the matching 

agreement for a current, ongoing 

matching program for not more than one 

additional year if: 

(i) Such program will be conducted 

without any change; and 

(ii) Each party to the agreement 

certifies to the Board in writing that the 

program has been conducted in 

compliance with the agreement. 

(c) Verification. In order to protect 

any individual whose records are used 

in matching programs, SBA and any 

recipient agency or non-Federal agency 

may not suspend, terminate, reduce, or 

make a final denial of any financial 

assistance or payment under the Federal 

benefit program to such individual, or 

take other adverse action against such 

individual as a result of information 

produced by such matching programs 

until such information has been 

independently verified. 

(1) Independent verification requires 

independent investigation and 

confirmation of any information used as 

a basis for an adverse action against an 

individual including, where applicable: 

(i) The amount of the asset or income 

involved, 

(ii) Whether such individual actually 

has or had access to such asset or 

income or such individual’s own use, 

and 

(iii) The period or periods when the 

individual actually had such asset or 

income. 

(2) SBA and any recipient agency or 

non-Federal agency may not suspend, 

terminate, reduce, or make a final denial 

of any financial assistance or payment 

under a Federal benefit program, or take 

other adverse action as a result of 

information produced by a matching 

program, 

(i) Unless such individual has 

received notice from such agency 

containing a statement of its findings 

and information of the opportunity to 

contest such findings, and 

(ii) Until the subsequent expiration of 

any notice period provided by the 

program’s governing statute or 

regulations, or 30 days. Such 

opportunity to contest may be satisfied 

by notice, hearing, and appeal rights 

governing such Federal benefit program. 

The exercise of any such rights shall not 

affect rights available under the Privacy 

Act. 

(3) SBA may take any appropriate 

action otherwise prohibited by the 

above if SBA determines that the public 

health or safety may be adversely 

affected or significantly threatened 

during the notice period required by 

paragraph (c)(2)(ii) of this section. 

(d) Sanctions. Notwithstanding any 

other provision of law, SBA may not 

disclose any record which is contained 

in a system of records to a recipient 

agency or non-Federal agency for a 

matching program if SBA has reason to 

believe that the requirements of 

paragraph (c) of this section, or any 

matching agreement entered into 

pursuant to paragraph (b) of this section 

or both, are not being met by such 

recipient agency. 

(1) SBA shall not renew a matching 

agreement unless, 

(i) The recipient agency or nonFederal agency has certified that it has 

complied with the provisions of that 

agreement; and 

(ii) SBA has no reason to believe that 

the certification is inaccurate. 

(e) Review annually each ongoing 

matching program in which the Agency 

has participated during the year, either 

as a source or as a matching agency in 

order to assure that the requirements of 

the Privacy Act, OMB guidance, and any 

Agency regulations and standard 

operating procedures, operating 

instructions, or guidelines have been 

met. 

(f) Data Integrity Board. SBA shall 

establish a Data Integrity Board (Board) 

to oversee and coordinate the 

implementation of the matching 

program. The Board shall consist of the 

senior officials designated by the 

Administrator, to include the Inspector 

General (who shall not serve as 

chairman), and the Senior Agency 

Official for Privacy. The Board shall: 

(1) Review, approve and maintain all 

written agreements for receipt or 

disclosure of Agency records for 

matching programs to ensure 

compliance with paragraph (a) of this 

section and with all relevant statutes, 

regulations, and guidance; 

(2) Review all matching programs in 

which SBA has participated during the 

year, determine compliance with 

applicable laws, regulations, guidelines, 

and Agency agreements, and assess the 

costs and benefits of such programs; 

(3) Review all recurring matching 

programs in which SBA has participated 


rwilkins on PROD1PC63 with RULES
17376 Federal Register / Vol. 72, No. 67 / Monday, April 9, 2007 / Rules and Regulations 

during the year, for continued 

justification for such disclosures; 

(4) At the instruction of OMB, 

compile a report to be submitted to the 

Administrator and OMB, and made 

available to the public on request, 

describing the matching activities of 

SBA, including, 

(i) Matching programs in which SBA 

has participated; 

(ii) Matching agreements proposed 

that were disapproved by the Board; 

(iii) Any changes in membership or 

structure of the Board in the preceding 

year; 

(iv) The reasons for any waiver of the 

requirement described below for 

completion and submission of a costbenefit analysis prior to the approval of 

a matching program; 

(v) Any violations of matching 

agreements that have been alleged or 

identified and any corrective action 

taken; and 

(vi) Any other information required 

by OMB to be included in such report; 

(5) Serve as clearinghouse for 

receiving and providing information on 

the accuracy, completeness, and 

reliability of records used in matching 

programs; 

(6) Provide interpretation and 

guidance to SBA offices and personnel 

on the requirements for matching 

programs; 

(7) Review Agency recordkeeping and 

disposal policies and practices for 

matching programs to assure 

compliance with the Privacy Act; and 

(8) May review and report on any SBA 

matching activities that are not 

matching programs. 

(g) Cost-benefit analysis. Except as 

provided in paragraphs (e)(2) and (3) of 

this section, the Data Integrity Board 

shall not approve any written agreement 

for a matching program unless SBA has 

completed and submitted to such Board 

a cost-benefit analysis of the proposed 

program and such analysis demonstrates 

that the program is likely to be cost 

effective. The Board may waive these 

requirements if it determines, in 

writing, and in accordance with OMB 

guidelines, that a cost-benefit analysis is 

not required. Such an analysis also shall 

not be required prior to the initial 

approval of a written agreement for a 

matching program that is specifically 

required by statute. 

(h) Disapproval of matching 

agreements. If a matching agreement is 

disapproved by the Data Integrity Board, 

any party to such agreement may appeal 

to OMB. Timely notice of the filing of 

such an appeal shall be provided by 

OMB to the Committee on 

Governmental Affairs of the Senate and 

the Committee on Government 

Operations of the House of 

Representatives. 

(1) OMB may approve a matching 

agreement despite the disapproval of the 

Data Integrity Board if OMB determines 

that: 

(i) The matching program will be 

consistent with all applicable legal, 

regulatory, and policy requirements; 

(ii) There is adequate evidence that 

the matching agreement will be costeffective; and 

(iii) The matching program is in the 

public interest. 

(2) The decision of OMB to approve 

a matching agreement shall not take 

effect until 30 days after it is reported 

to the committees described in 

paragraph (h) of this section. 

(3) If the Data Integrity Board and the 

OMB disapprove a matching program 

proposed by the Inspector General, the 

Inspector General may report the 

disapproval to the Administrator and to 

the Congress. 

§ 102.41 Other provisions. 

(a) Personnel Records. All SBA 

personnel records and files, as 

prescribed by OPM, shall be maintained 

in such a way that the privacy of all 

individuals concerned is protected in 

accordance with regulations of OPM (5 

CFR parts 293 and 297). 

(b) Mailing Lists. The SBA will not 

sell or rent an individual’s name or 

address. This provision shall not be 

construed to require the withholding of 

names or addresses otherwise permitted 

to be made public. 

(c) Changes in Systems. The SBA 

shall provide adequate advance notice 

to Congress and OMB of any proposal to 

establish or alter any system of records 

in order to permit an evaluation of the 

probable or potential effect of such 

proposal on the privacy and other 

personal or property rights of 

individuals or the disclosure of 

information relating to such individuals, 

and its effect on the preservation of the 

constitutional principles of federalism 

and separation of powers. 

(d) Medical Records. Medical records 

shall be disclosed to the individual to 

whom they pertain. SBA may, however, 

transmit such information to a medical 

doctor named by the requesting 

individual. In regard to medical records 

in personnel files, see also 5 CFR 

297.205. 

Steven C. Preston, 

Administrator. 

[FR Doc. 07–1651 Filed 4–6–07; 8:45 am] 

BILLING CODE 8025–01–P 

DEPARTMENT OF TRANSPORTATION 

Federal Aviation Administration 

14 CFR Part 39 

[Docket No. FAA–2007–27012; Directorate 

Identifier 2006–NM–188–AD; Amendment 

39–15017; AD 2007–07–15] 

RIN 2120–AA64 

Airworthiness Directives; Airbus Model 

A300 B4–601, A300 B4–603, A300 B4–

605R, A300 C4–605R Variant F, A310–

204, and A310–304 Airplanes Equipped 

With General Electric CF6–80C2 

Engines 

AGENCY: Federal Aviation 

Administration (FAA), Department of 

Transportation (DOT). 

ACTION: Final rule. 

SUMMARY: The FAA is superseding an 

existing airworthiness directive (AD), 

which applies to certain Airbus Model 

A300 B4–600, B4–600R, C4–605R 

Variant F, and F4–600R (collectively 

called A300–600) series airplanes; and 

Model A310 series airplanes. That AD 

currently requires a one-time inspection 

for damage of the integrated drive 

generator (IDG) electrical harness and 

pyramid arm, and repair if necessary. 

This new AD adds new repetitive 

inspections, which, when initiated, 

terminate the inspection required by the 

existing AD. This new AD also requires 

repairing damage and protecting the 

harness. This new AD also provides for 

optional terminating action for the 

repetitive inspections. This new AD also 

removes certain airplanes from the 

applicability of the existing AD. This 

AD results from a report of structural 

damage on the forward pyramid arm of 

an engine pylon due to chafing of the 

IDG electrical harness against the 

structure of the pyramid arm. We are 

issuing this AD to prevent electrical 

arcing in the engine pylon, which could 

result in loss of the relevant alternating 

current (AC) bus bar, reduced structural 

integrity of the engine pylon, and 

possible loss of control of the airplane. 

DATES: This AD becomes effective May 

14, 2007. 

The Director of the Federal Register 

approved the incorporation by reference 

of certain publications listed in the AD 

as of May 14, 2007. 

On May 13, 2004 (69 FR 23090, April 

28, 2004), the Director of the Federal 

Register approved the incorporation by 

reference of Airbus All Operators Telex 

A310–54A2038, dated February 19, 

2004; and Airbus All Operators Telex 

A300–54A6037, dated February 19, 

2004. 


rwilkins on PROD1PC63 with RULES