Source: https://www.federalregister.gov/documents/2000/04/10/00-8723/defense-commissary-agency-privacy-act-program
Timestamp: 2017-09-23 20:38:49
Document Index: 447662171

Matched Legal Cases: ['art 327', 'ART 327', 'art 327', 'art 327', 'art 327', 'art 327', 'art 327', 'art 327', 'art 310', 'art, 32', 'art 310', 'art 310', 'art 285', 'art 285', 'art 285', 'art 310', '§\u2009327', '§\u2009327', '§\u2009327', '§\u2009327', '§\u2009327']

A Proposed Rule by the Defense Department on 04/10/2000
Comments must be received by June 9, 2000, to be considered by the agency.
18938-18947 (10 pages)
List of subjects in CFR 32 CFR Part 327
PART 327 - DEFENSE COMMISSARY AGENCY PRIVACY ACT PROGRAM
Appendix A to part 327-Sample DeCA response letter
Appendix B to part 327-Internal management control review checklist.
https://www.federalregister.gov/d/00-8723 https://www.federalregister.gov/d/00-8723
Defense Commissary Agency, DOD
This proposed rule establishes the Defense Commissary Agency Privacy Act Program. This rule establishes policies and procedures for implementing the DeCA Privacy Program, and delegates authorities and assigns responsibilities for the administration of the DeCA Privacy Program.
Accordingly, Title 32 of the CFR is proposed to be amended in Chapter I, subchapter O, by adding part 327 to read as follows:
327.1 Purpose.
327.2 Applicability.
327.3 Responsibilities.
327.4 Definitions.
327.5 Systems of records
327.6 Collecting personal information.
327.7 Access by individuals.
327.8 Disclosure of personal information to other agencies and third parties.
Appendix A to part 327 - Sample DeCA response letter.
Appendix B to part 327 - Internal management control review checklist.
Appendix C to part 327 - DeCA blanket routine uses.
This part implements the basic policies and procedures for the implementation of the Privacy Act of 1974, as amended (5 U.S.C. 552a); OMB Circular A-130 [1] ; and 32 CFR part 310; and to promote uniformity in the DeCA Privacy Act Program.
(a) The Director, DeCA:
(1) Supervises the execution of the Privacy Act and this part within the DeCA, and serves as the DeCA Privacy Act Appeal Authority. Start Printed Page 18939
(b) The Privacy Act Officer, DeCA:
(c) DeCA Directorates/Staff Offices:
(d) Regions:
(1) Regional Directors will appoint a Regional PA Coordinator who will maintain suspense control of PA actions, prepare documentation to the OPR for response, forward the information to the DeCA PA Officer for release determination, and notify the requester that the response will be received from the DeCA PA Officer using the format in Appendix A to this part.
(e) DeCA Field Operating Activities (FOAs):
(f) Central Distribution Centers (CDCs) and Commissaries:
Individual. A living person who is a citizen of the United States or an alien lawfully admitted for permanent residence. The parent of a minor or the legal guardian of any individual also may act on behalf of an individual. Corporations, partnerships, sole proprietorships, professional groups, businesses, whether incorporated or unincorporated, and other commercial entities are not ‘individuals.’
Official use. Within the context of this part, this term is used when officials and employees of a DoD Component have a demonstrated need for the use of any record or the information contained therein in the performance of their official duties, subject to DoD 5200.1-R [2] , ‘DoD Information Security Program Regulation’.
Privacy Act request. A request from an individual for notification as to the Start Printed Page 18940existence of, access to, or amendment of records pertaining to that individual. These records must be maintained in a system of records.
(a) System of records. To be subject to the provisions of this part, a ‘system of records’ must:
(1) Consist of ‘records’ that are retrieved by the name of an individual or some other personal identifier, and
(2) Disposition of these records will be provided by the DeCA PA Officer in accordance with the DeCA Filing System [3] .
(1) When DeCA contracts for the operation or maintenance of a system of records or a portion of a system of records by a contractor, the record system or the portion affected are considered to be maintained by DeCA and are subject to this part. DeCA is responsible for applying the requirements of this part to the contractor. The contractor and its employees are to be considered employees of DeCA for the purposes of the approved provisions of the Privacy Act during the performance of the contract. Consistent with the Defense Acquisition Regulation, contracts requiring the maintenance of a system of records or the portion of a system of records shall identify specifically the record system and the work to be performed and shall include in the solicitation and resulting contract such terms as are prescribed in the Defense Acquisition Regulation (DAR). [4]
(i) Established and maintained to assist in making internal contractor Start Printed Page 18941management decisions such as those maintained for use in managing the contract.
(h) Safeguarding personal information. DeCA personnel will protect records in every system of records for confidentiality against alteration, unauthorized disclosure, embarrassment, or unfairness to any individual about whom information is kept.
(2) The transfer of large quantities of DeCA records containing personal data to disposal activities is not considered a release of personal information under this part. The volume of such transfers makes it difficult or impossible to identify easily specific individual records. Care must be exercised to ensure that the bulk is maintained so as to prevent specific records from becoming readily identifiable. If the bulk is maintained, no special procedures are required. If the bulk cannot be maintained, dispose of the records by shredding or tearing to render the record unrecognizable or beyond reconstruction.
(c) Collecting social security numbers (SSNs).
(d) Privacy act statements. When a DeCA individual is requested to furnish personal information about himself or herself for inclusion in a system of records, a Privacy Act Statement is required regardless of the medium used to collect the information, e.g. forms, personal interviews, telephonic interviews. The statement allows the individual to make a decision whether to provide the information requested. The statement will be concise, current, and easily understood and must state whether providing the information is voluntary or mandatory. If furnishing the data is mandatory, a Federal statute, Executive Order, regulation or other lawful order must be cited. If the personal information solicited is not to be incorporated into a DeCA system of records, a PA statement is not required. This information obtained without the PA statement will not be incorporated into any DeCA systems of records.
(a) Individual access to personal information. Release of personal information to individuals whose records are maintained in a systems of records under this part is not considered public release of information. DeCA will Start Printed Page 18942release to the individual all of the personal information, except to the extent the information is contained in an exempt system of records.
(1) Requests for access.
(i) Individuals in DeCA Headquarters and FOAs will address requests for access to their personal information to the DeCA Privacy Act Officer. Individuals in Regions, CDCs, and commissaries, will address requests to their respective Region Privacy Act Coordinator. The individual is not required to explain or justify why access is being sought.
(2) Granting access.
(ii) DeCA personnel may be denied access to information compiled in reasonable anticipation of a civil action or proceeding. The term ‘civil proceeding’ is intended to include quasi-judicial and pretrial judicial proceedings. Information prepared in conjunction with the quasi-judicial, pretrial and trial proceedings to include those prepared by DeCA legal and non-legal officials of the possible consequences of a given course of action are protected from access.
(3) Non agency records.
(i) Uncirculated personal notes and records that are not given or circulated to any person or organization (example, personal telephone list) that are kept or discarded at the author's discretion and over which DeCA exercises no direct control, are not considered DeCA records. However, if personnel are officially directed or encouraged, either in writing or orally, to maintain such records, they may become ‘agency records’ and may be subject to this part.
(ii) Personal uncirculated handwritten notes of team leaders, office supervisors, or military supervisory personnel concerning subordinates are not a system of records within the meaning of this part. Such notes are an extension of the individual's memory. These notes, however, must be maintained and discarded at the discretion of the individual supervisor and not circulated to others. Any established requirement to maintain such notes (written or oral directives, regulation or command policy) make these notes ‘AGENCY RECORDS’. If the notes are circulated, they must be made a part of a system of records. Any action that gives personal notes the appearance of official agency records is prohibited unless they have been incorporated into a DeCA system of records.
(b) Relationship Between the Privacy Act and the Freedom of Information Act (FOIA).
(1) Requests from DeCA individuals for access to a record pertaining to themselves made under the FOIA are processed under the provisions of this part, 32 CFR part 310 and DeCA Directive 30-12, Freedom of Information Act (FOIA) Program [5] .
(2) Request from DeCA individuals for access to a record pertaining to themselves are processed under this part and 32 CFR part 310.
(5) DeCA requesters will not be denied access to personal information concerning themselves that would be releasable to them under either Act because they fail to cite either Act or the wrong Act. The Act or procedures used in granting or denying access will be explained to requesters.
(7) Records in all DeCA systems maintained in accordance with the Government-wide systems notices are in temporary custody of DeCA, and all requests to access or amend these records will be processed in accordance with this part.
(c) Denial of individual access.
(2) DeCA individuals will only be denied access to those portions of the records from which the denial of access Start Printed Page 18943serves some legitimate governmental purpose.
(d) Amendment of records.
(1) DeCA employees are encouraged to review the personal information being maintained about them periodically. An individual may request amendment of any record contained in a system of records unless the system of records has been exempt specifically from the amendment procedures by the Director, DeCA. A request for amendment must include:
(i) Written notification will be provided to the requester within 10 working days of its receipt by the DeCA PA Officer. No notification will be provided to the requester if the action is completed within the 10 days. Only under exceptional circumstances will more than 30 days be required to reach the decision to amend a request. If the decision is to grant all or in part of the request for amendment, the record will be amended and the requester informed and all other offices/personnel known to be keeping the information.
(e) Fee assessments.
(1) DeCA personnel will only be charged the direct cost of copying and reproduction, computed using the appropriate portions of the fee schedule in DeCA Directive 30-12 [6] . Normally, fees are waived automatically if the direct costs of a given request are less than $30. This fee waiver provision does not apply when a waiver has been granted to the individual before, and later requests appear to be an extension or duplication of that original request. Decisions to waive or reduce fees that exceed the automatic waiver threshold will be made on a case-by-case basis. Fees may not be charged when:
(1) All requests made by DeCA individuals for personal information about other individuals (third parties) will be processed under DeCA Directive 30-12 [7] except when the third party personal information is contained in the Privacy record of the individual making the request.
(2) For the purposes of disclosure and disclosure accounting, the Department of Defense (DoD) is considered a single agency.
(i) The record has been requested by the individual to whom it pertains
(5) DeCA records must be disclosed if their release is required by 32 CFR part 285, which is implemented by DeCA Directive 30-12 [8] . 32 CFR part 285 requires that records be made available to the public unless exempt from disclosure under the FOIA.
(1) Civilian employees
(ii) Present and past position titles
(iii) Present and past grades Start Printed Page 18944
(iv) Present and past salaries
(v) Present and past duty stations
(vi) Office or duty telephone numbers
(2) Military members
(iii) Date of rank
(iv) Gross salary
(v) Past duty assignments
(vi) Present duty assignments
(vii) Future assignments that are officially established
(viii) Office or duty telephone numbers
(ix) Source of commission
(x) Promotion sequence number
(xi) Awards and decorations
(xii) Attendance at professional military schools
(xiii) Duty status at any given time
(d) Disclosures without Consent. DeCA records may be disclosed without the consent of the individual to whom they pertain to another agency within or under the control of the U.S. for a civil or criminal law enforcement activity if:
(4) This disclosure provision applies when the law enforcement agency or instrumentality requests the record. If the DoD Component discloses a record outside the DoD for law enforcement purposes without the individual's consent and without an adequate written request, the disclosure must be pursuant to an established routine use, such as the blanket routine use for law enforcement.
(i) Personal information concerning the patient that is provided in section 327.8 and under the provisions of 32 CFR part 285.
(A) The individual's condition is presently (stable) (good) (fair) (serious) or (critical) and,
(4) This part does not limit the disclosure of personal medical information for other government agencies' use in determining eligibility for special assistance or other benefits provided disclosure is pursuant to a routine use.
Dear Mrs. Employee:
This responds to your Privacy Act request dated (enter date of request), in which you requested (describe requested records).
(a) Task: Personnel and/or Organization Management
(b) Subtask: Privacy Act (PA) Program
(g) Assessable unit: The assessable units are HQ, DeCA, Regions, Central Distribution Centers, Field Operating Activities, and commissaries. Each test question is annotated to indicate which organization(s) is (are) responsible for responding to the question(s). Assessable unit managers responsible for completing this checklist are shown in the DeCA MCP, DeCA Directive 70-2 [1] .
(h) Event cycle 1: Establish and implement a Privacy Act Program Start Printed Page 18945
(3) Control Techniques: 32 CFR part 310 and DeCA Directive 30-13 [2] , Privacy Act Program.
(iii) Are the current names and office telephone numbers furnished OSD, Privacy Act Office of the PA Officer and the IDA? (DeCA HQ/SA). Response: Yes / No / NA. Remarks:
(i) Event cycle 2: Processing PA Requests
(2) Control Objective: PA requests are processed correctly
(iii) Ensure DeCA records are only withheld when they fall under the general and specific exemptions of 5 U.S.C. 552a and one or more of the nine exemptions under DeCA Directive 30-12 [3] , Freedom of Information Act (FOIA) Program.
(iv) Ensure all requests are coordinated through the General Counsel
(j) Event cycle 3: Requesting PA Information
(D) The consequences of failing to provide the requested information. Response: Yes / No / NA. Remarks:
(k) Event cycle 4: Records Maintenance
(1) Risk: Unprotected records allowing individuals without a need to know access to privacy information
(2) Control Objective: PA records are properly maintained throughout their life cycle
(v) Is a Systems Manager appointed for each automated/manual PA systems of records? (DeCA HQ/SA, Region). Response: Yes / No / NA. Remarks: Start Printed Page 18946
(vi) Are PA records maintained and disposed of in accordance with DeCA Directive 30-2 [4] , The Defense Commissary Agency Filing System? (All). Response: Yes / No / NA. Remarks:
(l) I attest that the above listed internal controls provide reasonable assurance that DeCA resources are adequately safeguarded. I am satisfied that if the above controls are fully operational, the internal controls for this sub-task throughout DeCA are adequate.
Safety, Security and Administration
ASSESSABLE UNIT MANAGER (Signature)
(a) Routine Use--Law Enforcement. If a system of records maintained by a DoD Component, to carry out its functions, indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or by regulation, rule, or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the agency concerned, whether Federal, State, local, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, rule, regulation, or order issued pursuant thereto.
(b) Routine Use-Disclosure when Requesting Information. A record from a system of records maintained by a Component may be disclosed as a routine use to a Federal, State, or local agency maintaining civil, criminal, or other relevant enforcement information or other pertinent information, such as current licenses, if necessary to obtain information relevant to a Component decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant, or other benefit.
(c) Routine Use--Disclosure of Requested Information. A record from a system of records maintained by a Component may be disclosed to a Federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the information is relevant and necessary to the requesting agency's decision on the matter.
(d) Routine Use--Congressional Inquiries. Disclosure from a system of records maintained by a Component may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
(e) Routine Use--Private Relief Legislation. Relevant information contained in all systems of records of the Department of Defense published on or before August 22, 1975, will be disclosed to the OMB in connection with the review of private relief legislation as set forth in OMB Circular A-19 at any stage of the legislative coordination and clearance process as set forth in that Circular.
(f) Routine Use--Disclosures Required by International Agreements. A record from a system of records maintained by a Component may be disclosed to foreign law enforcement, security, investigatory, or administrative authorities to comply with requirements imposed by, or to claim rights conferred in, international agreements and arrangements including those regulating the stationing and status in foreign countries of DoD military and civilian personnel.
(g) Routine Use--Disclosure to State and Local Taxing Authorities. Any information normally contained in Internal Revenue Service (IRS) Form W-2 which is maintained in a record from a system of records maintained by a Component may be disclosed to State and local taxing authorities with which the Secretary of the Treasury has entered into agreements under 5 U.S.C., sections 5516, 5517, and 5520 and only to those State and local taxing authorities for which an employee or military member is or was subject to tax regardless of whether tax is or was withheld. This routine use is in accordance with Treasury Fiscal Requirements Manual Bulletin No. 76-07.
(h) Routine Use--Disclosure to the Office of Personnel Management. A record from a system of records subject to the Privacy Act and maintained by a Component may be disclosed to the Office of Personnel Management (OPM) concerning information on pay and leave, benefits, retirement deduction, and any other information necessary for the OPM to carry out its legally authorized government-wide personnel management functions and studies.
(i) Routine Use--Disclosure to the Department of Justice for Litigation. A record from a system of records maintained by this component may be disclosed as a routine use to any component of the Department of Justice for the purpose of representing the Department of Defense, or any officer, employee or member of the Department in pending or potential litigation to which the record is pertinent.
(j) Routine Use--Disclosure to Military Banking Facilities Overseas. Information as to current military addresses and assignments may be provided to military banking facilities who provide banking services overseas and who are reimbursed by the Government for certain checking and loan losses. For personnel separated, discharged, or retired from the Armed Forces, information as to last known residential or home of record address may be provided to the military banking facility upon certification by a banking facility officer that the facility has a returned or dishonored check negotiated by the individual or the individual has defaulted on a loan and that if restitution is not made by the individual, the U.S. Government will be liable for the losses the facility may incur.
(k) Routine Use--Disclosure of Information to the General Services Administration (GSA). A record from a system of records maintained by this component may be disclosed as a routine use to the General Services Administration (GSA) for the purpose of records management inspections conducted under authority of 44 U.S.C. 2904 and 2906.
(l) Routine Use--Disclosure of Information to the National Archives and Records Administration (NARA). A record from a system of records maintained by this component may be disclosed as a routine use to the National Archives and Records Administration (NARA) for the purpose of records management inspections conducted under authority of 44 U.S.C. 2904 and 2906.
(m) Routine Use--Disclosure to the Merit Systems Protection Board. A record from a system of records maintained by this component may be disclosed as a routine use to the Merit Systems Protection Board, including the Office of the Special Counsel for the purpose of litigation, including Start Printed Page 18947administrative proceedings, appeals, special studies of the civil service and other merit systems, review of OPM or component rules and regulations, investigation of alleged or possible prohibited personnel practices; including administrative proceedings involving any individual subject of a DoD investigation, and such other functions, promulgated in 5 U.S.C. 1205 and 1206, or as may be authorized by law.
(n) Routine Use--Counterintelligence Purpose. A record from a system of records maintained by this component may be disclosed as a routine use outside the DoD or the U.S. Government for the purpose of counterintelligence activities authorized by U.S. Law or Executive Order or for the purpose of enforcing laws which protect the national security of the United States.
1. Copies may be obtained: http://www.whitehouse.gov/​OMB/​circulars
2. Copies may be obtained: http://www.whs.osd.mil/​corres.htm.
3. Copies may be obtained: Defense Commissary Agency, ATTN: FOIA/Privacy Officer, 1300 E. Avenue, Fort Lee, VA 23801-1800
4. See foonote 3 to § 327.5
5. See foonote 3 to § 327.5.
6. See foonote 3 to § 327.5.
7. See foonote 3 to § 327.5.
8. See foonote 3 to § 327.5.
4. See foonote 2 to this Appendix B.
[FR Doc. 00-8723 Filed 4-7-00; 8:45 am]