FDIC 1212/03 (6-99)

TYPE AND NUMBER

Circular 1031.1

CONTACT TELEPHONE NUMBER

Hugo A. Zia (703) 562-2671

DATE

June 22, 2006

DATE OF CANCELLATION (Bulletins Only)

TO: All Divisions and Offices

FROM: Lawrence Gross Jr.

Chief Information Officer and Chief Privacy Officer

Chief Information Officer Organization

Charles Yi

General Counsel and Chief FOIA Officer

Legal Division 

SUBJECT: Administration of the Privacy Act

1. Purpose To update procedures and provide guidance for the appropriate 

collection, maintenance, use and/or dissemination of records 

subject to the Privacy Act of 1974 (Pub. L. No. 93-579, 88 Stat. 

1896, codified as amended at 5 U.S.C. § 552a).

2. Revision FDIC Circular 1031.1, The Privacy Act of 1974: Employee Rights 

and Responsibilities, dated March 29, 1989, is hereby revised 

and superseded.

3. Scope The provisions of this circular apply to all FDIC personnel and 

contractors with access to records subject to the Privacy Act. 

4. Background The Privacy Act was passed by Congress to address concerns 

about the collection and use of information about individuals by 

the Federal Government. The Privacy Act seeks to balance the 

need of Federal agencies to collect and maintain information with 

the right of individuals to be protected against unwarranted 

invasions of their privacy. In general, the Privacy Act allows 

individuals to learn how Federal agencies collect, maintain, use, 

and disseminate agency records containing their personal 

information, and it helps to protect confidentiality by restricting 

agency disclosure of the records. The Privacy Act also allows 

individuals to gain access to their personal nonexempt records, to 

request an accounting of disclosures made to others, and to seek 

FEDERAL DEPOSIT INSURANCE CORPORATION

DIRECTIVE SYSTEM

*Pedestrian changes have been made to the directive and appear in blue. 5/23/2014 and 

4/25/2016.
Circular 1031.1 June 22, 2006

correction or amendment of records that are inaccurate or 

incomplete.
Circular 1031.1 2 June 22, 2006

5. Policy It is the policy of the FDIC that all FDIC personnel and 

contractors comply with the Privacy Act, FDIC Privacy Act 

Regulations at 12 C.F.R § 310, and FDIC Privacy Program 

Policies found at www.fdic.gov/about/privacy. 

6. Definitions a. Individual. A person who is either a U.S. citizen or an alien 

lawfully admitted for permanent residence.

b. Record. Any item, collection, or grouping of information about 

an Individual that is maintained by the FDIC in a System of 

Records, including, but not limited to, his/her education, financial 

transactions, medical history, and criminal or employment history 

and that contains his/her name, or the identifying number (such 

as a social security number), symbol, or other identifying 

particular assigned to the Individual, such as a finger or voice 

print, or a photograph.

c. System of Records. A group of any Records under the 

control of the FDIC from which information is retrieved by the 

name or by some identifying number, symbol, or other identifying 

particular assigned to an Individual.

d. System of Records Notice (SORN). A notice published in 

the Federal Register that describes an FDIC System of Records. 

e. System Manager. The FDIC official identified in the SORN 

who is responsible for the operation and management of the 

System of Records. 

f. Routine Use. The use of a Record for a purpose compatible 

with the purpose for which the Record was collected.

7. Administration of

Records

The following guidelines shall be used for the Administration of 

Records:

a. Records shall be collected, used, disseminated, and/or 

maintained in a manner so as to ensure information integrity,

security, and confidentiality.

b. Records shall contain only such information about an 

Individual as is relevant and necessary to accomplish a purpose 

of the FDIC.

c. No Records shall be maintained describing how an Individual 

exercises rights guaranteed by the First Amendment.

d. Information which may be used in making determinations 

about an Individual’s rights, benefits, and privileges under 
Circular 1031.1 3 June 22, 2006

Administration of

Records (cont’d)

Federal programs will, to the extent practicable, be collected 

directly from that Individual.

e. Each Individual who is asked to supply personal information 

which will be added to a System of Records will be provided a 

Privacy Act Statement stating the authority for the solicitation, the 

principal purposes for which the information will be used, whether 

supplying the information is mandatory or voluntary, and the 

Routine Uses which may be made of the information.

f. A SORN shall be published in the Federal Register prior to the 

establishment of a new or changed System of Records.

g. An accurate accounting of the name, address, date, nature, 

and purpose of all Record disclosures will be kept for the greater 

of five years or the life of the Record, except for disclosures made 

under subparagraphs 8.b.(1) and (2), below. The accounting 

shall be provided to the Individual named in the Record at his/her 

request, except for disclosures made under subparagraph 8.b.(7), 

below.

h. Individuals may have access to review and copy Records 

pertaining to them and to request that such Records be amended 

as appropriate.

i. Contracts that affect the maintenance or operation of a System 

of Records will comply with the Privacy Act. 

8. Nondisclosure of 

Records

a. No Record may be disclosed to any person (including FDIC 

personnel) or to another Federal agency without either a request 

from or the written consent of the Individual to whom the Record 

pertains.

b. Exceptions. A Record may be disclosed without either a 

request from or the written consent of the Individual to whom the 

Record pertains pursuant to one or more of the following 

exceptions:

(1) Need to Know. To FDIC personnel who have a need to 

know the information in the performance of their duties;

(2) FOIA. When required under the Freedom of Information 

Act;

(3) Routine Use. Pursuant to a published Routine Use for 

the particular System of Records at issue;
Circular 1031.1 4 June 22, 2006

Nondisclosure of 

Records (cont’d)

 (4) Bureau of the Census. To the Bureau of the Census for 

 purposes of planning or carrying out a census, survey, or

related activity;

(5) Statistical Research. To a recipient who has provided 

adequate, advance written assurance that the Record will be 

used solely for statistical research, provided that the Record is 

to be transferred in a form that is not individually identifiable;

(6) National Archives. To the National Archives and 

Records Administration as a Record which has sufficient 

historical or other value to warrant its continued preservation 

by the United States Government, or for evaluation by the 

Archivist of the United States or the designee of the Archivist 

to determine whether the Record has such value;

(7) Law Enforcement. To another agency or to an 

instrumentality of any governmental jurisdiction within or under 

the control of the United States for a civil or criminal law 

enforcement activity if the activity is authorized by law, and if 

the head of the agency or instrumentality has made a written 

request to the FDIC specifying the particular portion desired 

and the law enforcement activity for which the Record is 

sought;

(8) Emergency Circumstances. In an emergency when the 

Individual's health or safety is at risk;

(9) Congress. To either House of Congress, or, to the extent 

of matters within its jurisdiction, any committee, 

subcommittee, joint committee, or joint subcommittee of 

Congress;

(10) Government Accountability Office. To the Comptroller 

General or authorized representative in the course of the 

performance of the duties of the Government Accountability 

Office;

(11) Court Order. Pursuant to the order of a court of 

competent jurisdiction; and

(12) Consumer Reporting Agencies. To a consumer 

reporting agency in accordance with section 3711(f) of Title 31 

United States Code.

9. Access to Records 

 by Individuals

a. An Individual may gain access to review and copy all or any 

portion of his/her Records contained in a System of Records 

upon written request to the FDIC Legal Division FOIA/Privacy Act
Circular 1031.1 5 June 22, 2006

 Access to Records

 by Individuals

 (cont’d)

Group together with appropriate proof of identity and payment of 

any applicable copying fees. A denial of an Individual’s request 

for access to his/her Records may be appealed in writing to the 

FDIC General Counsel within 30 business days of the denial.

b. Exemptions. An Individual may not gain access to the 

following exempt Records:

(1) Information compiled in reasonable anticipation of a civil 

action or proceeding;

(2) Investigatory material compiled for law enforcement 

purposes (exceptions apply in certain non-criminal matters 

where benefits are denied the Individual);

(3) Investigatory material compiled solely for the purpose of 

determining suitability, eligibility, or qualifications for FDIC 

employment, to the extent that such disclosure would reveal the 

identity of a source who furnished information under an express 

promise of confidentiality; and

(4) Testing or examination material used solely to determine or 

assess Individual qualifications for appointment, the disclosure 

of which would compromise the objectivity or fairness of the 

testing or examination process.

10. Amendment of 

Records by 

Individuals

An Individual may request the amendment of his/her Records 

alleged to be inaccurate, irrelevant, untimely or incomplete by 

written request to the FDIC Legal Division FOIA/Privacy Act Group 

together with appropriate proof of identity. Requests for 

amendment of Records will be referred to the System Manager of 

the System of Records in which the Record is contained for 

determination within 10 business days following receipt of such 

request. A denial of an Individual’s request for amendment of 

his/her Records may be appealed in writing to the FDIC General 

Counsel within 30 business days of the denial. If the System 

Manager’s denial of the requested amendment is upheld by the 

FDIC General Counsel, the Individual may file a statement of 

disagreement which must be included with any subsequent 

disclosure of the disputed Record. 
Circular 1031.1 6 June 22, 2006

11. Violations Failure to comply with the Privacy Act may result in a civil lawsuit 

for money damages against the FDIC. A willful violation of the 

Privacy Act may result in a criminal misdemeanor conviction and 

fines of up to $5,000 against the responsible FDIC or contractor 

personnel. Examples of activities that could subject personnel to 

criminal sanctions include the knowing maintenance of a System 

of Records without a SORN or the willful disclosure of a Record 

absent one of the twelve access exceptions set forth in 

subparagraphs 8.b. (1) through (12), above.

12. Effective Date The provisions outlined in this circular are effective immediately