(6) Nonexempted system. A listing of the nonexempted systems or segments thereof (subject to this rule) on hand in the agency or command, their location, and the estimated number of records at each location.

(7) Operational experiences. A general description of operational experiences, and for each system of records, the actual or estimated number of individuals who:

(i) Requested information on the existence of records pertaining to them.

(ii) Refused to provide information requested by the Army.

(iii) Requested access to their records.

(iv) Requested amendment of their records.

(v) Requested review of an initial refusal to amend their records.

(vi) Sought redress through the courts.

(8) Costs. The actual or estimated cost to accomplish all actions required by (or resulting from implementation of) this rule during the reporting year. In developing these data, cost associated with system redesign, programming, machine time, publication development and reproduction, and manpower will be identified or estimated and included.

(1) Rules of conduct. Army Staff agency heads and commanders at all levels will assure that all personnel, including government contractors or their employees, who are involved in the design, development, operation, maintenance, or control of any system of records defined in paragraph (e)(9) of this section, are informed of all requirements to protect the privacy of individuals who are subjects of the records. The following sanctions will be emphasized to all personnel:

(1) There are criminal penalties for knowingly and willfully maintaining a system of records without meeting the notice requirement of this rule, and for disclosing a record about an individual without the written consent or the written request of that individual, or unless disclosure is for one of the reasons listed in § 505.3(b).

(2) The Department of the Army and its responsible officials may be subject to civil suit for failure to

comply with the Privacy Act as implemented by this rule.

[40 FR 55552, Nov. 28, 1975, as amended at 44 FR 37503, June 27, 1979]

§ 505.2 Access to and amendment of an individual's records.

(a) General. (1) This chapter prescribes those procedures whereby an individual may determine whether records pertaining to him exist within a specific system of records, request access to such records (including the accounting of disclosures maintained pursuant to § 505.3) and request that any record pertaining to him be amended because it is not accurate, relevant, timely or complete. In order that an individual may properly avail himself of his rights to determine the existence of records and to gain access, Congress has required the publication in the FEDERAL REGISTER of notices describing the various systems of records maintained by the Army. See §§ 505.5, 505.6 and 505.9. It is therefore imperative that an individual seeking to exercise his rights first consult these notices, discern those which may apply to him, and then reasonably identify the systems in any correspondence with the Army. This will insure a prompt and accurate response from the Army. Individuals desiring assistance in identifying the systems which may have records pertaining to them should contact HQDA (DAAG-AMR), Washington, D.C. 20314.

(2) If a request is the proper concern of another office within the Department of Defense, it will promptly be referred to that office for action and the individual will be advised accordingly. Only where such a referral would significantly disrupt agency activities, e.g., where the request involves a multitude of systems in a variety of locations, will the individual be asked to resubmit his request to the appropriate officials. Any applicable time periods will commence upon receipt of the request by the proper office.

(3) If a request is the proper concern of another agency, it (along with copies of any records which may be involved) will promptly be referred to that agency. The individual will be ad

vised of this referral and whether the other agency desires that he resubmit his request directly to it or whether it will process the request without any further correspondence.

(4) The time periods specified by this section will be extended only for good cause shown and with the approval of the General Counsel acting on behalf of the Secretary of the Army, unless the individual voluntarily agrees to an extension. Any such agreement will be confirmed in writing by the appropriate official.

(b) Requests to determine the existence of records. Upon request, written or oral, an individual (or his authorized representative) will be informed whether a particular system of records contains any record pertaining to him. The requesting individual need only reasonably identify the system which he desires searched and provide any identifying information which may be necessary to effect a proper search. Requests will be submitted to the official identified through the system notice, who will answer such requests within ten working days of receipt and inform the individual how to request access to any record located. See paragraph (d)(1)(ii) of this section. No fee will be charged for this search.

(c) Requests for access and the Freedom of Information Act (32 CFR Part 518). (1) Where an individual (or his authorized representative) requests disclosure of records, the Privacy Act and this rule apply only if those records:

(i) Pertain to him;

(ii) Are contained in a system of records, as defined in § 505.1(e)(9);

(iii) Are retrieved by reference to his, as opposed to some third party's, identity. Requests for the above records are to be processed in accordance with this rule whether or not they are sought under the Freedom of Information Act (32 CFR Part 518) or whether the individual specifically identifies them as subject to the Privacy Act. Requests for all other records will be processed in accordance with 32 CFR Part 518.

(2) If the individual has not reasonably identified the records he desires and it is unclear into which of the above categories his request falls, the

individual will be contacted immediately to clarify his request.

(d) Procedure for requesting access. (1) An individual who desires access to any records pertaining to him within a system of records will:

(i) Determine the existence of such records, as provided in paragraph (b) of this section;

(ii) If records are determined to exist, submit a written request as indicated in the applicable system notice. See 505.6(u). (The name and address of this official will be provided in the response required by paragraph (b) of this section.) Such a request will reasonably identify the record within the system of records sought.

(iii) If access is granted, upon request pay any fee charged in accordance with paragraph (e)(2)(ii) of this section and provide any information or documentation sought in accordance with paragraph (e)(2) of this section.

(iv) If access is denied in whole or in part, appeal if he so desires to the Secretary of the Army, Attention: Office of the General Counsel. Such an appeal will be addressed to the appropriate Access and Amendment Refusal Authority for forwarding to the General Counsel.

(2) If the appeal is denied in whole or in part, the individual may seek judicial review of the denial in accordance with section 3(g) of the Privacy Act.

(e) Processing requests for access. (1) The official who receives the request specified in paragraph (d)(1)(ii) of this section will, within ten working days of receipt, acknowledge such receipt.

(2) With respect to any portion of the record to which this official determines that access must or can be granted, he will, within thirty working days of receipt, inform the individual:

(i) That access can be obtained either by mail (through copy reproduction) or in person (through personal inspection), at the individual's option. Personal inspection will normally be allowed during duty hours at a location reasonably convenient to the requester;

(ii) of the fees, if any, that are to be charged. Only the cost of reproducing those copies desired by the individual

may be charged. These charges will be at the rate specified in 32 CFR 518.19, and may be waived as provided therein or otherwise within the discretion of the releasing official.

(iii) If the records would not be available to any member of the public under 32 CFR Part 518, that he must provide reasonable verification of his identity.

(a) When access is requested in person, verification will normally be limited to information or documents which an individual is likely to have readily available e.g., driver's license, employee or military identification card. Where no suitable documentation can be provided, a signed statement from the individual asserting his identity and indicating knowledge of the penalty for obtaining or requesting records under false pretenses (a fine of up to $5000) will suffice,

(b) When access is requested through the mail, verification may involve providing certain minimum identifying data, such as name and date of birth. If the sensitivity of the information contained in the requested record warrants, a signed and notarized statement similar to that described in paragraph (a) may be required.

NOTE: An individual cannot be denied access to a record solely because he refuses to provide his social security number, unless the number was required for access by statute or regulation adopted prior to January 1, 1975. See § 505.4(d).

(iv) That the individual who desires access in person may be accompanied by another individual of his own choosing, if he so desires. The appropriate commander may require the individual to furnish a written statement authorizing any discussion of the records in the presence of the accompanying person.

(3) Promptly upon receipt of any fee, information, and documentation requested pursuant to paragraph (e) (2) of this section, the releasing official will grant access to the records as requested. Any such record will be in a form comprehensible to the individual.

(4) With respect to any portion of the record to which the official indicated in the applicable system notice determines, in accordance with paragraph (f) of this section, that access

must be denied, he will within ten working days of receipt of the request:

(i) Forward a copy of the request, together with a copy of the record involved and his reason(s) for recommending denial, to the appropriate Access and Amendment Refusal Authority (AARA) identified in § 505.1(g), and

(ii) Notify the individual of this referral.

(5) With respect to any portion of the record to which the AARA decides to grant access, he will follow the procedures specified in paragraphs (e) (2) and (3) of this section. With respect to those portions which he denies, he will, within the same thirty working day period:

(i) Inform the individual in writing of his reason(s) for doing so. This will include a statement of the exemptions relied upon under the Privacy Act and the Freedom of Information Act and the significant and legitimate governmental purposes served by non-disclosure (see paragraph (f)(2)) of this section;

(ii) Advise the individual of his right to appeal through the AARA to the Secretary of the Army, Attention: Office of the General Counsel; and

(iii) Submit copies of the request and his denial to the Office of the General Counsel.

(6) An AARA who receives a notice of appeal (paragraph (d)(1)(iv) of this section) will forward it to the General Counsel within five working days of receipt. This referral will include copies of all records requested by the individual, clearly indicating those portions to which access was denied, together with a detailed justification for the denial.

(7) The Office of the General Counsel, on behalf of the Secretary of the Army and within twenty-five working days after receipt of the appeal letter, will decide any appeal submitted to it.

(f) Denial of access. (1) Commanders and custodians possessing records are authorized to provide access to records on request of the individual concerned, unless otherwise limited by applicable regulation. However, only the appropriate AARA identified

in

§ 505.1(g) is authorized to deny access.

(2) Individuals may be denied access to a record only if it was compiled in reasonable anticipation of a civil action or proceeding, or if:

(i) It has been properly exempted from the disclosure provisions of the Privacy Act, in accordance with § 505.7; and

(ii) It would not otherwise be required to be disclosed under the Freedom of Information Act (32 CFR Part 518); and

(iii) There exists a significant and legitimate governmental purpose for doing so.

(3) An individual will not be denied access to his record solely because it is exempt from disclosure under 32 CFR Part 518 or because its physical presence is not readily available, e.g., on magnetic tape. Access will not be conditioned upon any requirement to state a reason or otherwise justify a need for access.

(4) If a record contains both releasable and exempt information, the releasable portions will be segregated and made available. For example, to protect the personal privacy of other persons who may be identified in a record, an extract or copy will be made, deleting only that information pertaining to those persons which would be denied to the requesting individual under 32 CFR Part 518.

(5) A medical record will be disclosed to the individual to whom it pertains unless, in the judgment of a physician, access to the record could have an adverse effect on the individual's physical or mental health. When it has been determined that the disclosure could have such an effect, the information may be transmitted to a physician named by the requesting individual, who will be informed of this alternative. Such transmittals are not considered to constitute a denial of access.

(6) Requests for access to records which are considered to be the property of another agency (within the meaning of the Privacy Act) or office within the Department of Defense, or which are on loan to the using office, e.g., investigative records, will be referred to the appropriate agency or office in accordance with paragraphs (a) (2) and (3) of this section. Requests for all other records contained in a

system of records must be processed in accordance with this rule and, if applicable, in coordination with the originating organization.

(g) Requests for accounting of certain disclosures. Any individual (or his authorized representative) may request the accounting of disclosures of records pertaining to him made pursuant to § 505.3(c). Such requests shall be addressed to the records custodian, and will be processed in accordance with paragraphs (d) to (f) of this section, as applicable. Requests may be denied only for those accountings made pursuant to § 503.3(b)(7), or to the extent the system within which the record is contained has been exempted from this provision in accordance with § 505.7.

(h) Procedure for requesting amendment of records. Upon request an individual (or his authorized representative) may have a record pertaining to him amended by correction, addition, deletion or otherwise, regardless of whether it is part of a system of records, if such record is not accurate, relevant, timely, or complete. Such requests will be processed in accordance with this rule, irrespective of whether the Privacy Act is cited, except for those records specified in paragraphs (h) (3) and (4) of this section.

(1) An individual desiring amendment will:

(i) Submit a request in writing to the custodian of the records; however, individuals who make oral requests for amendments that can be accepted will not be requested to submit the request in writing. Such requests will contain sufficient information to permit identification and location of the records, a description of the item or portion for which amendment is requested, the reason(s) why amendment is being requested and, if appropriate, documentary evidence supporting the requested amendment. The burden of proof is on the individual to demonstrate the propriety of amendment. The individual will also provide verification of his identity, as described in paragraph (e)(2)(iii) of this section, to ensure that he is seeking amendment of his records and none other.

(ii) Provide any additional information which may be required pursuant to paragraph (i)(1)(ii), (2), or (4).

(iii) If amendment is refused in whole or in part, appeal if he so desires to the Department of the Army Privacy Review Board (see § 505.1(h)). The appeal will be addressed to the appropriate Access and Amendment Refusal Authority for forwarding to the Board.

(2) If the appeal is denied in whole or in part, the individual may:

(i) Submit, if he so desires, to the custodian of the record a concise statement setting forth the reasons for his disagreement with the refusal of the Board to amend. See paragraphs (i)(4) and (j) of this section.

(ii) Seek, if he so desires, judicial review of the denial in accordance with section 3(g) of the Privacy Act.

(3) Requests for amendment in accordance with this rule may be sought only where the record is alleged to be inaccurate, irrelevant, untimely, or incomplete. Also, the rule does not permit the alteration of evidence presented in the course of judicial, quasijudicial, or quasi-legislative proceedings. Requests for amendment of judgmental matters should be processed under applicable existing procedures (e.g., Army Regulation 623-105 for officer evaluation report appeals).

(4) US Army Criminal Investigation Command (USACIDC) reports of investigation are exempt from amendment provisions of the Privacy Act. Requests for amendment of criminal investigation reports that fall within the scope of 32 CFR Part 633 will not be considered under the provisions of 32 CFR Part 505. The action of the Commander, USACIDC will constitute final action on behalf of the Secretary of the Army with respect to 32 CFR Part 633.

(i) Processing of requests for amendment of records.

(1) The custodian of a record who initially receives a request for amendment pursuant to paragraph (h) of this section will:

(i) Within ten working days after receipt, acknowledge in writing such receipt. The acknowledgment will clearly identify the request and advise the individual when he may expect to be

informed of action taken on the request. If the request is delivered in person, a written acknowledgment should be provided when the request is presented.

(ii) If further information is essential for proper processing of the request, contact the individual immediately and explain the necessity of such information. The time periods specified by this section will be deferred pending receipt of such information.

(iii) If he determines that amendment is proper because the record is inaccurate, irrelevant, untimely, or incomplete, make the necessary correction and so advise the individual within 30 working days after receipt of the request. If a disclosure accounting has been made (see § 503.3(c)), he will advise all previous recipients of the record of the substance of the correction and that they should notify those to whom they have disclosed the record of this correction. Amendments of records will be physically accomplished, as circumstances warrant, through the addition of supplementary information, or by means of annotations, alteration, obliteration, deletion, or destructure of the record or a portion of it. Files maintenance and disposition instructions in the 340series of Army Regulations (AR) do not apply to destruction of records accomplished in order to amend records pursuant to this rule.

(iv) If he believes that amendment is not proper, because the system containing the record has been exempted pursuant to § 505.7 or otherwise, within five working days after receipt forward the request, along with the records involved and his recommendation, to the appropriate AARA identified in § 505.1, paragraph (f). He will also inform the individual of this referral when he acknowledges receipt pursuant to paragraph (i)(1)(i) of this section.

(2) If an AARA properly receives a request for amendment directly from an individual, the AARA will acknowledge the request within 10 working days as required by paragraph (i)(1)(i) of this section.

(3) The AARA may request further information pursuant to paragraph (i)(1)(ii) of this section. The days thus