Source: https://ecfr.io/Title-32/pt32.6.1901
Timestamp: 2019-11-12 18:13:03
Document Index: 462292779

Matched Legal Cases: ['art 1901', 'art 1901', 'ART 1901', '§1901', '§1901', '§1901', '§1901']

[32 CFR 1901] Title 32 Part 1901 : Code of Federal Regulations ';
Title 32 Part 1901
PART 1901—PUBLIC RIGHTS UNDER THE PRIVACY ACT OF 1974
Authority: National Security Act of 1947, as amended; Central Intelligence Agency Act of 1949, as amended; Privacy Act, as amended; and Executive Order 12958 (or successor Orders).
Source: 62 FR 32488, June 16, 1997, unless otherwise noted.
(a) Authority. This part is issued under the authority of and in order to implement the Privacy Act of 1974 (5 U.S.C. 552a); sec. 102 of the National Security Act of 1947, as amended (50 U.S.C. 403); and sec. 6 of the Central Intelligence Agency Act of 1949, as amended (50 U.S.C. 403g).
(b) Purpose in general. This part prescribes procedures for a requester, as defined herein:
(1) To request notification of whether the Central Intelligence Agency maintains a record concerning them in any non-exempt portion of a system of records or any non-exempt system of records;
(2) To request a copy of all non-exempt records or portions of records;
(3) To request that any such record be amended or augmented; and
(4) To file an administrative appeal to any initial adverse determination to deny access to or amend a record.
(c) Other purposes. This part also sets forth detailed limitations on how and to whom the Agency may disclose personal information and gives notice that certain actions by officers or employees of the United States Government or members of the public could constitute criminal offenses.
(b) Days means calendar days when the Agency is operating and specifically excludes Saturdays, Sundays, and legal public holidays. Three (3) days may be added to any time limit imposed on a requester by this part if responding by U.S. domestic mail; ten (10) days may be added if responding by international mail;
(c) Control means ownership or the authority of the CIA pursuant to federal statute or privilege to regulate official or public access to records;
(e) Federal agency means any executive department, military department, or other establishment or entity included in the definition of agency in 5 U.S.C. 552(f);
(f) Interested party means any official in the executive, military, congressional, or judicial branches of government, United States or foreign, or U.S. Government contractor who, in the sole discretion of the CIA, has a subject matter or physical interest in the documents or information at issue;
(g) Maintain means maintain, collect, use, or disseminate;
(h) Originator means the U.S. Government official who originated the document at issue or successor in office or such official who has been delegated release or declassification authority pursuant to law;
(i) Privacy Act or PA means the statute as codified at 5 U.S.C. 552a;
(j) Record means an item, collection, or grouping of information about an individual that is maintained by the Central Intelligence Agency in a system of records;
(k) Requester or individual means a citizen of the United States or an alien lawfully admitted for permanent residence who is a living being and to whom a record might pertain;
(l) Responsive record means those documents (records) which the Agency has determined to be within the scope of a Privacy Act request;
(m) Routine use means, with respect to the disclosure of a record, the use of such record for a purpose which is compatible with the purpose for which the record is maintained;
(n) System of records means a group of any records under the control of the Central Intelligence Agency from which records are retrieved by the name of an individual or by some identifying number, symbol, or other identifying particular assigned to that individual.
For general information on this part, to inquire about the Privacy Act program at CIA, or to file a Privacy Act request, please direct your communication in writing to the Information and Privacy Coordinator, Central Intelligence Agency, Washington, DC. 20505. Requests with the required identification statement pursuant to 32 CFR 1901.13 must be filed in original form by mail. Subsequent communications and any inquiries will be accepted by mail or facsimile at (703) 613-3007 or by telephone at (703) 613-1287. Collect calls cannot be accepted.
The Agency welcomes suggestions or complaints with regard to its administration of the Privacy Act. Many requesters will receive pre-paid, customer satisfaction survey cards. Letters of suggestion or complaint should identify the specific purpose and the issues for consideration. The Agency will respond to all substantive communications and take such actions as determined feasible and appropriate.
Members of the public shall address all communications to the contact specified at §1901.03 and clearly delineate the communication as a request under the Privacy Act and this regulation. Requests and administrative appeals on requests, referrals, and coordinations received from members of the public who owe outstanding fees for information services at this or other federal agencies will not be accepted and action on existing requests and appeals will be terminated in such circumstances.
(a) In general. No particular form is required. All requests must contain the identification information required at §1901.13.
(b) For access. For requests seeking access, a requester should, to the extent possible, describe the nature of the record sought and the record system(s) in which it is thought to be included. Requesters may find assistance from information described in the Privacy Act Issuances Compilation which is published biannually by the Federal Register. In lieu of this, a requester may simply describe why and under what circumstances it is believed that this Agency maintains responsive records; the Agency will undertake the appropriate searches.
(c) For amendment. For requests seeking amendment, a requester should identify the particular record or portion subject to the request, state a justification for such amendment, and provide the desired amending language.
(a) In general. Individuals seeking access to or amendment of records concerning themselves shall provide their full (legal) name, address, date and place of birth, and current citizenship status together with a statement that such information is true under penalty of perjury or a notarized statement swearing to or affirming identity. If the Agency determines that this information is not sufficient, the Agency may request additional or clarifying information.
(b) Requirement for aliens. Only aliens lawfully admitted for permanent residence (PRAs) may file a request pursuant to the Privacy Act and this part. Such individuals shall provide, in addition to the information required under paragraph (a) of this section, their Alien Registration Number and the date that status was acquired.
(c) Requirement for representatives. The parent or guardian of a minor individual, the guardian of an individual under judicial disability, or an attorney retained to represent an individual shall provide, in addition to establishing the identity of the minor or individual represented as required in paragraph (a) or (b) of this section, evidence of such representation by submission of a certified copy of the minor's birth certificate, court order, or representational agreement which establishes the relationship and the requester's identity.
(d) Procedure otherwise. If a requester or representative fails to provide the information in paragraph (a), (b), or (c) of this section within forty-five (45) days of the date of our request, the Agency will deem the request closed. This action, of course, would not prevent an individual from refiling his or her Privacy Act request at a subsequent date with the required information.
No fees will be charged for any action under the authority of the Privacy Act, 5 U.S.C. 552a, irrespective of the fact that a request is or may be processed under the authority of both the Privacy Act and the Freedom of Information Act.
(a) In general. Requests meeting the requirements of 32 CFR 1901.11 through 1901.13 shall be processed under both the Freedom of Information Act, 5 U.S.C. 552, and the Privacy Act, 5 U.S.C. 552a, and the applicable regulations, unless the requester demands otherwise in writing. Such requests will be processed under both Acts regardless of whether the requester cites one Act in the request, both, or neither. This action is taken in order to ensure the maximum possible disclosure to the requester.
(b) Receipt, recording and tasking. Upon receipt of a request meeting the requirements of §§1901.11 through 1901.13, the Agency shall within ten (10) days record each request, acknowledge receipt to the requester, and thereafter effect the necessary taskings to the components reasonably believed to hold responsive records.
(c) Effect of certain exemptions. In processing a request, the Agency shall decline to confirm or deny the existence or nonexistence of any responsive records whenever the fact of their existence or nonexistence is itself classified under Executive Order 12958 or revealing of intelligence sources and methods protected pursuant to section 103(c)(5) of the National Security Act of 1947. In such circumstances, the Agency, in the form of a final written response, shall so inform the requester and advise of his or her right to an administrative appeal.
(d) Time for response. Although the Privacy Act does not mandate a time for response, our joint treatment of requests under both the Privacy Act and the FOIA means that the Agency should provide a response within the FOIA statutory guideline of ten (10) days on initial requests and twenty (20) days on administrative appeals. However, the current volume of requests require that the Agency often seek additional time from a requester pursuant to 32 CFR 1901.33. In such event, the Agency will inform the requester in writing and further advise of his or her right to file an administrative appeal.
(a) Initial action for access. CIA components tasked pursuant to a Privacy Act access request shall search all relevant record systems within their cognizance. They shall:
(b) Initial action for amendment. CIA components tasked pursuant to a Privacy Act amendment request shall review the official records alleged to be inaccurate and the proposed amendment submitted by the requester. If they determine that the Agency's records are not accurate, relevant, timely or complete, they shall promptly:
(c) Action otherwise on amendment request. If the CIA component records manager declines to make the requested amendment or declines to make the requested amendment but agrees to augment the official records, that manager shall promptly:
(d) Referrals and coordinations. As applicable and within ten (10) days of receipt by the Coordinator, any CIA records containing information originated by other CIA components shall be forwarded to those entities for action in accordance with paragraphs (a), (b), or (c) of this section and return. Records originated by other federal agencies or CIA records containing other federal agency information shall be forwarded to such agencies within ten (10) days of our completion of initial action in the case for action under their regulations and direct response to the requester (for other agency records) or return to the CIA (for CIA records).
(e) Effect of certain exemptions. This section shall not be construed to allow access to systems of records exempted by the Director of Central Intelligence pursuant to subsections (j) and (k) of the Privacy Act or where those exemptions require that the CIA can neither confirm nor deny the existence or nonexistence of responsive records.
Within ten (10) days of receipt of responses to all initial taskings and subsequent coordinations (if any), and dispatch of referrals (if any), the Agency will provide disclosable records to the requester. If a determination has been made not to provide access to requested records (in light of specific exemptions) or that no records are found, the Agency shall so inform the requester, identify the denying official, and advise of the right to administrative appeal.
(a) In general. When a request for access or amendment involves medical or psychological records and when the originator determines that such records are not exempt from disclosure, the Agency will, after consultation with the Director of Medical Services, determine:
(1) Which records may be sent directly to the requester and
(2) Which records should not be sent directly to the requester because of possible medical or psychological harm to the requester or another person.
(b) Procedure for records to be sent to physician. In the event that the Agency determines, in accordance with paragraph (a)(2) of this section, that records should not be sent directly to the requester, the Agency will notify the requester in writing and advise that the records at issue can be made available only to a physician of the requester's designation. Upon receipt of such designation, verification of the identity of the physician, and agreement by the physician:
(1) To review the documents with the requesting individual,
(2) To explain the meaning of the documents, and
(3) To offer counseling designed to temper any adverse reaction, the Agency will forward such records to the designated physician.
(c) Procedure if physician option not available. If within sixty (60) days of the paragraph (a)(2) of this section, the requester has failed to respond or designate a physician, or the physician fails to agree to the release conditions, the Agency will hold the documents in abeyance and advise the requester that this action may be construed as a technical denial. The Agency will also advise the requester of the responsible official and of his or her rights to administrative appeal and thereafter judicial review.
(a) All requests will be handled in the order received on a strictly “first-in, first-out” basis. Exceptions to this rule will only be made in circumstances that the Agency deems to be exceptional. In making this determination, the Agency shall consider and must decide in the affirmative on all of the following factors:
(1) That there is a genuine need for the records; and
(2) That the personal need is exceptional; and
(3) That there are no alternative forums for the records sought; and
(4) That it is reasonably believed that substantive records relevant to the stated needs may exist and be deemed releasable.
(b) In sum, requests shall be considered for expedited processing only when health, humanitarian, or due process considerations involving possible deprivation of life or liberty create circumstances of exceptional urgency and extraordinary need. In accordance with established judicial precedent, requests more properly the scope of requests under the Federal Rules of Civil or Criminal Procedure (or equivalent state rules) will not be granted expedited processing under this or related (e.g., Freedom of Information Act) provisions unless expressly ordered by a federal court of competent jurisdiction.
(a) In general. Agency components shall devote such personnel and other resources to the responsibilities imposed by the Privacy Act as may be appropriate and reasonable considering:
(b) Discharge of Privacy Act responsibilities. Components shall exercise due diligence in their responsibilities under the Privacy Act and must allocate a reasonable level of resources to requests under the Act in a strictly “first-in, first-out” basis and utilizing two or more processing queues to ensure that smaller as well as larger (i.e., project) cases receive equitable attention. The Information and Privacy Coordinator is responsible for management of the Agency-wide program defined by this part and for establishing priorities for cases consistent with established law. The Director, Information Management through the Agency Release Panel shall provide policy and resource direction as necessary and shall make determinations on administrative appeals.
(c) Requests for extension of time. While the Privacy Act does not specify time requirements, our joint treatment of requests under the FOIA means that when the Agency is unable to meet the statutory time requirements of the FOIA, the Agency may request additional time from a requester. In such instances the Agency will inform a requester of his or her right to decline our request and proceed with an administrative appeal or judicial review as appropriate.
(a) Right of Appeal. A right of administrative appeal exists whenever access to any requested record or any portion thereof is denied, no records are located in response to a request, or a request for amendment is denied. The Agency will apprise all requesters in writing of their right to appeal such decisions to the CIA Agency Release Panel through the Coordinator.
(b) Requirements as to time and form. Appeals of decisions must be received by the Coordinator within forty-five (45) days of the date of the Agency's initial decision. The Agency may, for good cause and as a matter of administrative discretion, permit an additional thirty (30) days for the submission of an appeal. All appeals to the Panel shall be in writing and addressed as specified in 32 CFR 1901.03. All appeals must identify the documents or portions of documents at issue with specificity, provide the desired amending language (if applicable), and may present such information, data, and argument in support as the requester may desire.
(c) Exceptions. No appeal shall be accepted if the requester has outstanding fees for information services at this or another federal agency. In addition, no appeal shall be accepted if the information in question has been the subject of an administrative review within the previous two (2) years or is the subject of pending litigation in the federal courts.
(d) Receipt, recording, and tasking. The Agency shall promptly record each administrative appeal, acknowledge receipt to the requester in writing, and thereafter effect the necessary taskings to the Deputy Director(s) in charge of the directorate(s) which originated or has an interest in the record(s) subject to the appeal. As used herein, the term Deputy Director includes an equivalent senior official within the DCI-area as well as a designee known as the Information Review Officer for a directorate or area.
Each Deputy Director in charge of a directorate which originated or has an interest in any of the records subject to the appeal, or designee, is a required party to any appeal; other interested parties may become involved through the request of the Coordinator when it is determined that some or all of the information is also within their official cognizance. These parties shall respond in writing to the Coordinator with a finding as to the exempt or non-exempt status of the information including citations to the applicable exemption and/or their agreement or disagreement as to the requested amendment and the reasons therefore. Each response shall be provided expeditiously on a “first-in, first-out” basis taking into account the business requirements of the parties and consistent with the information rights of members of the general public under the various information review and release laws.
(a) Preparation of docket. The Coordinator, acting as the Executive Secretary of the Agency Release Panel, shall place administrative appeals of Privacy Act requests ready for adjudication on the agenda at the next occurring meeting of that Panel. The Executive Secretary shall provide a summation memorandum for consideration of the members; the complete record of the request consisting of the request, the document(s) (sanitized and full text) at issue, and the findings of the concerned Deputy Director(s) or designee(s).
(b) Decision by the Agency Release Panel. The Agency Release Panel shall meet and decide requests sitting as a committee of the whole. Decisions are by majority vote of those present at a meeting and shall be based on the written record and their deliberations; no personal appearances shall be permitted without the express permission of the Panel.
(c) Decision by the Historical Records Policy Board. In any cases of divided vote by the ARP, any member of that body is authorized to refer the request to the CIA Historical Records Policy Board which acts as the senior corporate board for the Agency. The record compiled (the request, the memoranda filed by the originator and interested parties, and the previous decision(s)) as well as any memorandum of law or policy the referent desires to be considered, shall be certified by the Executive Secretary of the Agency Release Panel and shall constitute the official record of the proceedings and must be included in any subsequent filings.
(a) In general. The Executive Secretary of the Agency Release Panel shall promptly prepare and communicate the decision of the Panel or Board to the requester. With respect to any decision to deny information or deny amendment, that correspondence shall state the reasons for the decision, identify the officer responsible, and include a notice of the right to judicial review.
(b) For amendment requests. With further respect to any decision to deny an amendment, that correspondence shall also inform the requester of the right to submit within forty-five (45) days a statement of his or her choice which shall be included in the official records of the CIA. In such cases, the applicable record system manager shall clearly note any portion of the official record which is disputed, append the requester's statement, and provide copies of the statement to previous recipients (if any are known) and to any future recipients when and if the disputed information is disseminated in accordance with a routine use.
(a) To those officers and employees of this Agency which maintains the record who have a need for the record in the performance of their duties;
(c) For a routine use as defined in §1901.02(m), as contained in the Privacy Act Issuances Compilation which is published biennially in the Federal Register, and as described in §§(a)(7) and (e)(4)(D) of the Act;
(e) To a recipient who has provided the Agency with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable;
(g) To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of that agency or instrumentality has made a written request to the CIA specifying the particular information desired and the law enforcement activity for which the record is sought;
(a) Unauthorized disclosure. Criminal penalties may be imposed against any officer or employee of the CIA who, by virtue of employment, has possession of or access to Agency records which contain information identifiable with an individual, the disclosure of which is prohibited by the Privacy Act or by these rules, and who, knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive same.
(b) Unauthorized maintenance. Criminal penalties may be imposed against any officer or employee of the CIA who willfully maintains a system of records without meeting the requirements of section (e)(4) of the Privacy Act, 5 U.S.C.552a. The Coordinator and the Inspector General are authorized independently to conduct such surveys and inspect such records as necessary from time to time to ensure that these requirements are met.
(c) Unauthorized requests. Criminal penalties may be imposed upon any person who knowingly and willfully requests or obtains any record concerning an individual from the CIA under false pretenses.
(a) The purpose of the following specified general exemption of polygraph records is to prevent access and review of records which intimately reveal CIA operational methods. The purpose of the general exemption from the provisions of sections (c)(3) and (e)(3) (A)-(D) of the Privacy Act is to avoid disclosures that may adversely affect ongoing operational relationships with other intelligence and related organizations and thus reveal or jeopardize intelligence sources and methods or risk exposure of intelligence sources and methods in the processing of covert employment applications.
(b) The purpose of the general exemption from sections (d), (e)(4)(G), (f)(1), and (g) of the Privacy Act is to protect only those portions of systems of records which if revealed would risk exposure of intelligence sources and methods or hamper the ability of the CIA to effectively use information received from other agencies or foreign governments.
(c) It should be noted that by subjecting information which would consist of, reveal, or pertain to intelligence sources and methods to separate determinations by the Director of Central Intelligence under the provision entitled “General exemptions,” 32 CFR 1901.62 regarding access and notice, an intent is established to apply the exemption from access and notice only in those cases where notice in itself would constitute a revelation of intelligence sources and methods; in all cases where only access to information would reveal such source or method, notice will be given upon request.
(d) The purpose of the general exemption for records that consist of, pertain to, or would otherwise reveal the identities of employees who provide information to the Office of the Inspector General is to implement section 17 of the CIA Act of 1949, as amended, 50 U.S.C. 403q(e)(3), and to ensure that no action constituting a reprisal or threat of reprisal is taken because an employee has cooperated with the Office of Inspector General.
(e) The purpose of the specific exemptions provided for under section (k) of the Privacy Act is to exempt only those portions of systems of records which would consist of, reveal, or pertain to that information which is enumerated in that section of the Act.
(f) In each case, the Director of Central Intelligence currently or then in office has determined that the enumerated classes of information should be exempt in order to comply with dealing with the proper classification of national defense or foreign policy information; protect the identification of persons who provide information to the CIA Inspector General; protect the privacy of other persons who supplied information under an implied or express grant of confidentiality in the case of law enforcement or employment and security suitability investigations (or promotion material in the case of the armed services); protect information used in connection with protective services under 18 U.S.C. 3056; protect the efficacy of testing materials; and protect information which is required by statute to be maintained and used solely as statistical records.
(a) Pursuant to authority granted in section (j) of the Privacy Act, the Director of Central Intelligence has determined to exempt from all sections of the Act—except sections 552a(b); (c) (1) and (2); (e) (1), (4) (A)-(F), (5), (6), (7), (9), (10), and (11); and (i)—the following systems of records or portions of records in a system of record:
(b) Pursuant to authority granted in section (j) of the Privacy Act, the Director of Central Intelligence has determined to exempt from sections (c)(3) and (e)(3) (A)-(D) of the Act all systems of records maintained by this Agency.
(c) Pursuant to authority granted in section (j) of the Privacy Act, the Director of Central Intelligence has determined to exempt from notification under sections (e)(4)(G) and (f)(1) those portions of each and all systems of records which have been exempted from individual access under section (j) in those cases where the Coordinator determines after advice by the responsible components that confirmation of the existence of a record may jeopardize intelligence sources and methods. In such cases the Agency must neither confirm nor deny the existence of the record and will advise a requester that there is no record which is available pursuant to the Privacy Act of 1974.
(d) Pursuant to authority granted in section (j) of the Privacy Act, the Director of Central Intelligence has determined to exempt from access by individuals under section (d) of the Act those portions and only those portions of all systems of records maintained by the CIA that:
(1) Consist of, pertain to, or would otherwise reveal intelligence sources and methods;
(2) Consist of documents or information provided by any foreign government entity, international organization, or, any United States federal, state, or other public agency or authority; and
(3) Consist of information which would reveal the identification of persons who provide information to the CIA Inspector General.
(e) Pursuant to authority granted in section (j) of the Privacy Act, the Director of Central Intelligence has determined to exempt from judicial review under section (g) of the Act all determinations to deny access under section (d) of the Act and all decisions to deny notice under sections (e)(4)(G) and (f)(1) of the Act pursuant to determination made under paragraph (c) of this section when it has been determined by an appropriate official of the CIA that such access would disclose information which would:
(1) Consist of, pertain to, or otherwise reveal intelligence sources and methods;