12 C.F.R. Subpart E—The Privacy Act
Title 12 - Banks and Banking
Source: 54 FR 18476, May 1, 1989, unless otherwise noted. Redesignated at 63 FR 14338, Mar. 25, 1998.
This subpart governs requests made of NCUA under the Privacy Act (5 U.S.C. 552a). The regulation applies to all records maintained by NCUA which contain personal information about an individual and some means of identifying the individual, and which are contained in a system of records from which information may be retrieved by use of an identifying particular; sets forth procedures whereby individuals may seek and gain access to records concerning themselves and request amendments of those records; and sets forth requirements applicable to NCUA employees' maintaining, collecting, using, or disseminating such records. For purposes of this subpart: (a) Individual means a citizen of the United States or an alien lawfully admitted for permanent residence. (b) Maintain includes maintain, collect, use, or disseminate. (c) Record means any item, collection, or grouping of information about an individual that is maintained by NCUA, and that contains the name, or an identifying number, symbol, or other identifying particular assigned to the individual. (d) System of records means a group of any records under NCUA's control from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual. (e) Routine use means, with respect to the disclosure of a record, the use of such record for a purpose which is compatible with the purpose for which it was collected. (f) Statistical record means a record in a system of records maintained for statistical research or reporting purposes only and not used in whole or in part in making any determination about an identifiable individual, except as provided by section 8 of title 13 of the United States Code. (a) An individual seeking notification of whether a system of records contains a record pertaining to that individual, or an individual seeking access to information or records pertaining to that individual which are available under the Privacy Act shall present a request to the NCUA official identified in the access procedure section of the “Notice of Systems of Records” published in the (b) In addition to meeting the identification requirements set forth in §792.55, an individual seeking notification or access, either in person or by mail, shall describe the nature of the record sought, the approximate dates covered by the record, and the system in which it is thought to be included, as described in the “Notice of Systems of Records” published in the [54 FR 18476, May 1, 1989, as amended at 59 FR 36041, July 15, 1994; 64 FR 57365, Oct. 25, 1999; 67 FR 30774, May 8, 2002] (a) The following standards are applicable to an individual submitting requests either in person or by mail under §792.54: (1) If not personally known to the NCUA official responding to the request, an individual seeking access to records about that individual in person shall establish identity by the presentation of a single document bearing a photograph (such as a passport or identification badge) or by the presentation of two items of identification which do not bear a photograph but do bear both a name and address (such as a driver's license or credit card); (2) An individual seeking access to records about that individual by mail may establish identity by a signature, address, date of birth, employee identification number if any, and one other identifier such as a photocopy of driver's license or other document. If less than all of this requisite identifying information is provided, the NCUA official responding to the request may require further identifying information prior to any notification or responsive disclosure. (3) An individual seeking access to records about himself by mail or in person, who cannot provide the required documentation or identification, may provide an unsworn declaration subscribed to as true under penalty of perjury. (b) The parent or guardian of a minor or a person judicially determined to be incompetent shall, in addition to establishing identity of the minor or other person as required in paragraph (a) of this section, furnish a copy of a birth certificate showing parentage or a court order establishing guardianship. (c) An individual may request by telephone notification of the existence of and access to records about that individual and contained in a system of records. In such a case, the NCUA official responding to the request shall require, for the purpose of comparison and verification of identity, at least two items of identifying information (such as date of birth, home address, social security number) already possessed by the NCUA. If the requisite identifying information is not provided, or otherwise at the discretion of the responsible NCUA official, an individual may be required to submit the request by mail or in person in accordance with paragraph (a) of this section. (d) An individual seeking to review records about that individual may be accompanied by another person of their own choosing. In such cases, the individual seeking access shall be required to furnish a written statement authorizing discussion of that individual's records in the accompanying person's presence. (e) In addition to the requirements set forth in paragraphs (a), (b) and (c) of this section, the published “Notice of System of Records” for individual systems may include further requirements of identification where necessary to retrieve the individual records from the system. [54 FR 18476, May 1, 1989. Redesignated at 63 FR 14338, Mar. 25, 1998, as amended at 64 FR 57365, Oct. 25, 1999; 65 FR 63790, Oct. 25, 2000] (a) The NCUA official identified in the record access procedure section of the “Notice of Systems of Records” and identified in accordance with §792.54(a), by an individual seeking notification of, or access to, a record, shall be responsible: (1) For determining whether access is available under the Privacy Act; (2) for notifying the requesting individual of that determination; and (3) for providing access to information determined to be available. In the case of an individual access request made in person, information determined to be available shall be provided by allowing a personal review of the record or portion of a record containing the information requested and determined to be available, and the individual shall be allowed to have a copy of all or any portion of available information made in a form comprehensible to him. In the case of an individual access request made by mail, information determined to be available shall be provided by mail, unless the individual has requested otherwise. (b) The following time limits shall be applicable to the required determinations, notification and provisions of access set forth in paragraph (a) of this section: (1) A request concerning a single system of records which does not require consultation with or requisition of records from another agency will be responded to within 20 working days after receipt of the request. (2) A request requiring requisition of records from or consultation with another agency will be responded to within 30 working days of receipt of the request. (3) If a request under paragraphs (b)(1) or (2) of this section presents unusual difficulties in determining whether the records involved are exempt from disclosure, the Privacy Act Officer, in the Office of General Counsel, may extend the time period established by the regulations by 10 working days. (c) Nothing in this section shall be construed to allow an individual access to any information compiled in reasonable anticipation of a civil action or proceeding, or any information exempted from the access provisions of the Privacy Act. [54 FR 18476, May 1, 1989, as amended at 59 FR 36042, July 15, 1994; 64 FR 57365, Oct. 25, 1999; 65 FR 63790, Oct. 25, 2000] (a) When a request for records or information from NCUA includes information furnished by other Federal agencies, the NCUA official responsible for action on the request shall consult with the appropriate agency prior to making a decision to disclose or refuse access to the record, but the decision whether to disclose the record shall be made in the first instance by the NCUA official. (b) When an individual requests medical records concerning himself, the NCUA official responsible for action on the request may advise the individual that the records to be released will be provided first to a physician designated in writing by the individual. The physician will provide the records to the individual. [54 FR 18476, May 1, 1989. Redesignated at 63 FR 14338, Mar. 25, 1998, as amended at 65 FR 63790, Oct. 25, 2000] (a) An individual may request amendment of a record concerning that individual by addressing a request, either in person or by mail, to the NCUA official identified in the “contesting record procedures” section of the “Notice of Systems of Records” published in the (b) Within 10 working days of receipt of the request, the appropriate NCUA official shall advise the individual that the request has been received. The appropriate NCUA official shall then promptly (under normal circumstances, not later than 30 working days after receipt of the request) advise the individual that the record is to be amended or corrected, or inform the individual of rejection of the request to amend the record, the reason for the rejection, and the procedures established by §792.27 for the individual to request a review of that rejection. [54 FR 18476, May 1, 1989, as amended at 59 FR 36041, 36042, July 15, 1994; 65 FR 63790, Oct. 25, 2000] (a) A rejection, in whole or in part, of a request to amend or correct a record may be appealed to the General Counsel within 30 working days of receipt of notice of the rejection. Appeals shall be in writing, and shall set forth the specific item of information sought to be corrected and the documentation justifying the correction. Appeals shall be addressed to the Office of General Counsel, National Credit Union Administration, 1775 Duke Street, Alexandria, VA 22314–3428. Appeals shall be decided within 30 working days of receipt unless the General Counsel, for good cause, extends such period for an additional 30 working days. (b) Within the time limits set forth in paragraph (a) of this section, the General Counsel shall either advise the individual of a decision to amend or correct the record, or advise the individual of a determination that an amendment or correction is not warranted on the facts, in which case the individual shall be advised of the right to provide for the record a “Statement of Disagreement” and of the right to further appeal pursuant to the Privacy Act. For records under the jurisdiction of the Office of Personnel Management, appeals will be made pursuant to that agency's regulations. (c) A statement of disagreement may be furnished by the individual. The statement must be sent, within 30 days of the date of receipt of the notice of General Counsel refusal to authorize correction, to the General Counsel, National Credit Union Administration, 1775 Duke Street, Alexandria, VA 22314–3428. Upon receipt of a statement of disagreement in accordance with this section, the General Counsel shall take steps to ensure that the statement is included in the system of records containing the disputed item and that the original item is so marked to indicate that there is a statement of dispute and where, within the system of records, that statement may be found. (d) When a record has been amended or corrected or a statement of disagreement has been furnished, the system manger for the system of records containing the record shall, within 30 days thereof, advise all prior recipients of information to which the amendment or statement of disagreement relates whose identity can be determined by an accounting made as required by the Privacy Act of 1974 or any other accounting previously made, of the amendment or statement of disagreement. When a statement of disagreement has been furnished, the system manager shall also provide any subsequent recipient of a disclosure containing information to which the statement relates with a copy of the statement and note the disputed portion of the information disclosed. A concise statement of the reasons for not making the requested amendment may also be provided if deemed appropriate. (e) If access is denied because of an exemption, the individual will be notified of the right to appeal that determination to the General Counsel within 30 days after receipt. Appeals will be determined within 20 working days. [54 FR 18476, May 1, 1989, as amended at 59 FR 36041, July 15, 1994; 65 FR 63790, Oct. 25, 2000] No record or item of information concerning an individual which is contained in a system of records maintained by NCUA shall be disclosed by any means of communication to any person, or to another agency, without the prior written consent of the individual to whom the record or item of information pertains, unless the disclosure would be— (a) To an employee of the NCUA who has need for the record in the performance of duty; (b) Required by the Freedom of Information Act; (c) For a routine use as described in the “Notice of Systems of Records,” published in the (d) To the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of title 13 of the United States Code; (e) To a recipient who has provided the NCUA with advance adequate written assurance that the record or item will be used soley as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable; (f) To the National Archives and Records Administration as a record or item which has sufficient historical or other value to warrant its continued preservation by the United States Government, or for evaluation by the Archivist of the United States or the designee of the Archivist to determine whether the record has such value; (g) To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to NCUA specifying the particular portion desired and the law enforcement activity for which the record or item is sought; (h) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if, upon such disclosure, notification is transmitted to the last known address of such individual; (i) To either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee; (j) To the Comptroller General, or any of his authorized representatives, in the course of the performance of the duties of the General Accounting Office; or (k) Pursuant to the order of a court of competent jurisdiction; or (l) To a consumer reporting agency in accordance with section 3711(f) of title 31 of the United States Code (31 U.S.C. 3711(f)). (a) Each system manager identified in the “Notice of Systems of Records” as published in the (b) Accounting records, at a minimum, shall include the information disclosed, the name and address of the person or agency to whom disclosure was made, and the date of disclosure. When records are transferred to the National Archives and Records Administration for storage in records centers, the accounting pertaining to those records shall be transferred with the records themselves. (c) Any accounting made under this section shall be retained for at least five years or the life of the record, whichever is longer, after the disclosure for which the accounting is made. At the time of the request for access or correction or at any other time, an individual may request an accounting of disclosures made of the individual's record outside the NCUA. Request for accounting shall be directed to the system manager. Any available accounting, whether kept in accordance with the requirements of the Privacy Act or under procedures established prior to September 27, 1975, shall be made available to the individual, except that an accounting need not be made available if it relates to: (a) A disclosure made pursuant to the Freedom of Information Act (5 U.S.C. 552); (b) A disclosure made within the NCUA; (c) A disclosure made to a law enforcement agency pursuant to 5 U.S.C. 552a(b)(7); (d) A disclosure which has been exempted from the provisions of 5 U.S.C. 552a(c)(3) pursuant to 5 U.S.C. 552a (j) or (k). (a) The system manager, as identified in the “Notice of Systems of Records” published in the (b) The purpose of the review shall be to eliminate any requirement for information that is not relevant and necessary to carry out an NCUA function and to accomplish the following objectives: (1) To ensure that no information concerning religion, political beliefs or activities, association memberships (other than those required for a professional license), or the exercise of other First Amendment rights is required to be disclosed unless such requirement of disclosure is expressly authorized by statute or is pertinent to and within the scope of any authorized law enforcement activity; (2) To ensure that the form or accompanying statement makes clear to the individual which information by law must be disclosed and the authority for that requirement, and which information is voluntary; (3) To ensure that the form or accompanying statement makes clear the principal purpose or purposes for which the information is being collected, and states concisely the routine uses that will be made of the information; (4) To ensure that the form or accompanying statement clearly indicates to the individual the existing rights, benefits or privileges not to provide all or part of the requested information; and (5) To ensure that any form requesting disclosure of a social security number, or an accompanying statement, clearly advises the individual of the statute or regulation requiring disclosure of the number, or clearly advises the individual that disclosure is voluntary and that no consequence will flow from a refusal to disclose it, and the uses that will be made of the number whether disclosed mandatorily or voluntarily. (c) Any form which does not meet the objectives specified in the Privacy Act and this section shall be revised to conform thereto. (a) No NCUA component shall contract for the operation of a system of records by or on behalf of the Agency without the express approval of the NCUA Board. (b) Any contract which is approved shall continue to ensure compliance with the requirements of the Privacy Act. The contracting component shall have the responsibility for ensuring that the contractor complies with the contract requirements relating to the Privacy Act. (a) Fees pursuant to 5 U.S.C. 552a(f)(5) shall be assessed for actual copies of records provided to individuals on the following basis, unless the NCUA official determining access waives the fee because of the inability of the individual to pay or the cost of collecting the fee exceeds the fee: (1) For copies of documents provided, copy fees as stated in NCUA's current FOIA fee schedule; and (2) For copying information, if any, maintained in nondocument form, the direct cost to NCUA may be assessed. (b) If it is determined that access fees chargeable under this section will amount to more than $25, and the individual has not indicated in advance willingness to pay fees as high as are anticipated, the individual shall be notified of the amount of the anticipated fees before copies are made, and the individual's access request shall not be considered to have been received until receipt by NCUA of written agreement to pay. [54 FR 18476, May 1, 1989. Redesignated at 63 FR 14338, Mar. 25, 1998, as amended at 65 FR 63790, Oct. 25, 2000] (a) NCUA maintains four systems of records that are exempted from some provisions of the Privacy Act. In paragraph (b) of this section, those systems of records are identified by System Name and System Number, as stated in the NCUA's “Notice of Systems of Records,” published in the (b)(1) System NCUA–1, entitled “Employee Suitability Security Investigations Containing Adverse Information,” consists of adverse information about NCUA employees that had been obtained as a result of routine U.S. Office of Personnel Management (OPM) security Investigations. To the extent that NCUA maintains records in this system pursuant to OPM guidelines that may require retrieval of information by use of individual identifiers, those records are encompassed by and included in the OPM Central system of records number Central-9 entitled, “Personnel Investigations Records,” and thus are subject to the exemptions promulgated by OPM. Additionally, in order to ensure the protection of properly confidential sources, particularly as to those records which are not maintained pursuant to such Office of Personnel Management requirements, the records in these systems of records are exempted, pursuant to section k(5) of the Privacy Act (5 U.S.C. 552a(k)(5)), from section (d) of the Act (5 U.S.C. 552a(d)). To the extent that disclosure of a record would reveal the identity of a confidential source, NCUA need not grant access to that record by its subject. Information which would reveal a confidential source shall, however, whenever possible, be extracted or summarized in a manner which protects the source and the summary or extract shall be provided to the requesting individual. (2) System NCUA–8, entitled, “Investigative Reports Involving Any Crime or Suspicious Activity Against a Credit Union, NCUA,” consists of investigatory or enforcement records about individuals suspected of involvement in violations of laws or regulations, whether criminal or administrative. These records are maintained in an overall context of general investigative information concerning crimes against credit unions. To the extent that individually identifiable information is maintained, however, for purposes of protecting the security of any investigations by appropriate law enforcement authorities and promoting the successful prosecution of all actual criminal activity, the records in this system are exempted, pursuant to section k(2) of the Privacy Act (5 U.S.C. 552a(k)(2)), from sections (c)(3), and (d)). NCUA need not make an accounting of previous disclosures of a record in this system of records available to its subject, the NCUA need not grant access to any records in this system of records by their subject. Further, whenever individuals request records about themselves and maintained in this system of records, the NCUA shall, to the extent necessary to realize the above-stated purposes, neither confirm nor deny the existence of the records but shall advise the individuals only that no records available to them pursuant to the Privacy Act of 1974 have been identified. However, should review of the record reveal that the information contained therein has been used or is being used to deny the individuals any right, privilege or benefit for which they are eligible or to which they would otherwise be entitled under Federal law, the individuals shall be advised of the existence of the information and shall be provided the information, except to the extent disclosure would identify a confidential source. Information which would identify a confidential source shall, if possible, be extracted or summarized in a manner which protects the source and the summary or extract shall be provided to the requesting individual. (3) System NCUA–20, entitled, “Office of Inspector General (OIG) Investigative Records,” consists of OIG records of closed and pending investigations of individuals alleged to have been involved in criminal violations. The records in this system are exempted pursuant to Sections (k)(2) of the Privacy Act, 5 U.S.C. 552a(k)(2), from sections (c)(3); (d); (e)(1); (e)(4)(G); (e)(4)(H); (e)(4)(I); and (f). The records in this system are also exempted pursuant to Section (j)(2) of the Privacy Act, 5 U.S.C. 552a(j)(2), from sections (c)(3); (c)(4); (d); (e)(1); (e)(2); (e)(3); and (g). (4) System NCUA–13, entitled, “Litigation Case Files,” consists of investigatory materials compiled for law enforcement purposes. Records in the Litigation Case Files system are used in connection with the execution of NCUA's legal and enforcement responsibilities. Because the system covers investigatory materials compiled for law enforcement purposes, it is eligible for exemption under subsection (k)(2) of the Privacy Act. 5 U.S.C. 552a(k)(2). The Litigation Case Files system is exempt from subsections (c)(3), (d), (e)(1), (e)(4)(G), (H), (I) and (f) of the Privacy Act. 5 U.S.C. 552a (c)(3), (d), (e)(1), (e)(4)(G), (H), (I) and (f). However, if an individual is denied any right, privilege, or benefit to which he would otherwise be entitled by federal law, or for which he otherwise would be eligible, as a result of the maintenance of such records, the records or information will be made available to him, provided the identity of a confidential source is not disclosed. (c) For purposes of this section, a “confidential source” means a source who furnished information to the Government under an express promise that the identity of the source would remain confidential, or, prior to September 27, 1976, under an implied promise that the identity of the source would be held in confidence. [54 FR 18476, May 1, 1989, as amended at 60 FR 31912, June 19, 1995; 64 FR 57365, Oct. 25, 1999; 65 FR 63790, Oct. 25, 2000] (a) Each system manager, with the approval of the head of that Office, shall establish administrative and physical controls to insure the protection of a system of records from unauthorized access or disclosure and from physical damage or destruction. The controls instituted shall be proportional to the degree of sensitivity of the records, but at a minimum must insure: that records are enclosed in a manner to protect them from public view; that the area in which the records are stored is supervised during all business hours to prevent unauthorized personnel from entering the area or obtaining access to the records; and that the records are inaccessible during nonbusiness hours. (b) Each system manager, with the approval of the head of that Office, shall adopt access restriction to insure that only those individuals within the agency who have a need to have access to the records for the performance of duty have access. Procedures shall also be adopted to prevent accidental access to or dissemination of records. The head of each NCUA Office shall take such measures as are necessary to ensure that employees authorized to collect information from individuals are advised that individuals may not be required without statutory or regulatory authorization to furnish Social Security numbers, and that individuals who are requested to provide Social Security numbers voluntarily must be advised that furnishing the number is not required and that no penalty or denial of benefits will flow from the refusal to provide it. (a) The Director of the Office of Human Resources, with advice from the General Counsel, is responsible for training NCUA employees in the obligations imposed by the Privacy Act and this subpart. (b) The head of each NCUA Office shall be responsible for assuring that employees subject to that person's supervision are advised of the provisions of the Privacy Act, including the criminal penalties and civil liabilities provided therein, and that such employees are made aware of their responsibilities to protect the security of personal information, to assure its accuracy, relevance, timeliness, and completeness, to avoid unauthorized disclosure either orally or in writing, and to insure that no information system concerning individuals, no matter how small or specialized, is maintained without public notice. (c) With respect to each system of records maintained by NCUA, Agency employees shall: (1) Collect no information of a personal nature from individuals unless authorized to collect it to achieve a function or carry out an NCUA responsibility; (2) Collect from individuals only that information which is necessary to NCUA functions or responsibilities; (3) Collect information, wherever possible, directly from the individual to whom it relates; (4) Inform individuals from whom information is collected of the authority for collection, the purposes thereof, the routine uses that will be made of the information, and the effects, both legal and practical of not furnishing the information; (5) Not collect, maintain, use, or disseminate information concerning an individual's religious or political beliefs or activities or his membership in associations or organizations, unless: (i) The individual has volunteered such information for his own benefit; (ii) The information is expressly authorized by statute to be collected, maintained, used, or disseminated; or (iii) Activities involved are pertinent to and within the scope of an authorized investigation or adjudication. (6) Advise their supervisors of the existence or contemplated development of any record system which retrieves information about individuals by individual identifier. (7) Maintain an accounting, in the prescribed form, of all dissemination of personal information outside NCUA, whether made orally or in writing; (8) Disseminate no information concerning individuals outside NCUA except when authorized by 5 U.S.C. 552a or pursuant to a routine use as set forth in the “routine use” section of the “Notice of Systems of Records” published in the (9) Maintain and process information concerning individuals with care in order to ensure that no inadvertent disclosure of the information is made either within or outside NCUA; and (10) Call to the attention of the proper NCUA authorities any information in a system maintained by NCUA which is not authorized to be maintained under the provisions of the Privacy Act, including information on First Amendment activities, information that is inaccurate, irrelevant or so incomplete as to risk unfairness to the individuals concerned. (c) Heads of offices within NCUA shall, at least annually, review the record systems subject to their supervision to ensure compliance with the provisions of the Privacy Act. [54 FR 18476, May 1, 1989, as amended at 59 FR 36042, July 15, 1994; 65 FR 63790, Oct. 25, 2000; 67 FR 30774, May 8, 2002]
Title 12: Banks and Banking
PART 792—REQUESTS FOR INFORMATION UNDER THE FREEDOM OF INFORMATION ACT AND PRIVACY ACT, AND BY SUBPOENA; SECURITY PROCEDURES FOR CLASSIFIED INFORMATION
Subpart E—The Privacy Act
§ 792.52 Scope.
§ 792.53 Definitions.
§ 792.54 Procedures for requests pertaining to individual records in a system of records.
§ 792.55 Times, places, and requirements for identification of individuals making requests and identification of records requested.
§ 792.56 Notice of existence of records, access decisions and disclosure of requested information; time limits.
§ 792.57 Special procedures: Information furnished by other agencies; medical records.
§ 792.58 Requests for correction or amendment to a record; administrative review of requests.
§ 792.59 Appeal of initial determination.
§ 792.60 Disclosure of record to person other than the individual to whom it pertains.
§ 792.61 Accounting for disclosures.
§ 792.62 Requests for accounting for disclosures.
§ 792.63 Collection of information from individuals; information forms.
§ 792.64 Contracting for the operation of a system of records.
§ 792.65 Fees.
§ 792.66 Exemptions.
§ 792.67 Security of systems of records.
§ 792.68 Use and collection of Social Security numbers.
§ 792.69 Training and employee standards of conduct with regard to privacy.
