13 C.F.R. Subpart B—The Privacy Act
Title 13 - Business Credit and Assistance
This subpart establishes SBA's policy and procedures safeguarding an individual against an invasion of personal privacy. (a) Except as otherwise provided by law or regulation, SBA will permit you to do the following: (1) Determine what records pertaining to you are collected, maintained, used, or disseminated by SBA; (2) Object when records pertaining to you are obtained by SBA for a particular purpose and are proposed to be used or made available for another purpose without your consent; and (3) Gain access to information pertaining to you in records, have a copy made of all or any portion of those records, and correct or amend such records as appropriate. (b) SBA will collect, maintain, use, or disseminate any record of identifiable personal information in a manner that assures that such action is for a necessary and lawful purpose, that the information is current and accurate for its intended use, and that adequate safeguards are provided to prevent misuse of such information. (c) SBA will permit exemptions from the requirements of 5 U.S.C. 552a (Privacy Act of 1974) (“PA”) only where an important public policy need for such exemption has been determined pursuant to or under specific statutory authority. SBA records will: (a) Contain only such information about an individual as is relevant and necessary to accomplish a purpose required of SBA by statute, regulation, or by Executive Order of the President. (b) Be comprised, to the maximum practical extent, of an individual's own statements when the information may result in an adverse determination about an individual's rights, benefits, or privileges under a Federal program. SBA will not disclose to anyone any record which is contained in a system of records, except that it will disclose a record: (a) To the person about whom the record is maintained, or to that person's agent, within the limits discussed in this subpart; (b) To those SBA employees who have a need for the record to perform their duties; (c) When required under 5 U.S.C. 552 (FOIA); (d) For a routine use of the record compatible with the purpose for which it was collected; (e) To the Bureau of the Census for purposes of planning or carrying out a census, survey, or related activity pursuant to Title 13, United States Code; (f) To a recipient who has provided the Agency with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, where the record is transferred in a form that is not individually identifiable; (g) To the National Archives of the United States as a record which has sufficient historical or other value to warrant its continued preservation by the U.S. Government, or for evaluation by the Administrator of General Services or his or her designee to determine whether the record has such value; (h) To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if: (1) The activity is authorized by law; and (2) The head of the agency or instrumentality has made a written request to the PA Officer specifying the particular portion desired and the law enforcement activity for which the record is sought; (i) To a person showing compelling circumstances affecting the health or safety of an individual. Upon disclosure, SBA will notify such individual at his or her last known address; (j) To either House of Congress, or, to the extent of matters within its jurisdiction, any committee or subcommittee thereof, or any joint committee of Congress or subcommittee of any such joint committee; (k) To the Comptroller General, or any of his or her authorized representatives, in the course of the performance of the duties of the General Accounting Office; (l) Pursuant to the order of a court of competent jurisdiction; or (m) To a consumer reporting agency in accordance with 31 U.S.C. 3711(f). (a) The provisions of parts 293 and 297 of title 5 of the Code of Federal Regulations govern all SBA files which the Office of Personnel Management determines are personnel files. (b) The provisions of part 1611 of title 29 of the Code of Federal Regulations govern all Equal Employment Opportunity complaint files. A record is information which SBA maintains on an individual and which includes either his name or an identifying symbol (such as a fingerprint, a social security number (“SSN”), or a photograph). A system of records is one or more records which SBA routinely keeps for official purposes, and from which SBA can retrieve records by using a name or personal identifier. When this subpart refers to the “person to whom a record pertains” or uses the pronoun “you”, it refers to a United States citizen or a lawfully admitted alien. It does not refer to a corporation, partnership, or sole proprietorship. (a) The following systems of records are exempt from certain provisions of the PA: Audit Reports (system of records #SBA 015), Litigation and Claims Files (#SBA 070), Personnel Security Files (#SBA 100), Security and Investigations Files (#SBA 120), Office of Inspector General Referrals (#SBA 125), Investigations Division Management Information System (#SBA 130), and Standards of Conduct Files (#SBA 140). (b) The provisions of the PA from which these systems of records are exempt are subsections (c)(3) (Accounting of Certain Disclosures), (d) (Access to Records), (e)(1), 4G, H, and I (Agency Requirements), and (f) (Agency Rules). (c) The systems of records described in paragraph (a) of this section are exempt from the provisions of the Privacy Act described in paragraph (b) of this section in order to: (1) Prevent the subject of investigations from frustrating the investigatory process; (2) Protect investigatory material compiled for law enforcement purposes; (3) Fulfill commitments made to protect the confidentiality of sources and to maintain access to necessary sources of information; or (4) Prevent interference with law enforcement proceedings. (d) In addition to the foregoing exemptions in paragraphs (a) through (c) of this section, the systems of records described in paragraph (a) of this section numbered SBA 015, 100, 120, 125 and 130 are fully exempt from the Privacy Act to the extent that they contain: (1) Information compiled to identify individual criminal offenders and alleged offenders and consisting only of identifying data and notations of arrests, confinement, release, and parole and probation status; (2) Information, including reports of informants and investigators, associated with an identifiable individual compiled to investigate criminal activity; or (3) Reports compiled at any stage of the process of enforcement of the criminal laws from arrest or indictment through release from supervision associated with an identifiable individual. (e) The systems of records described in paragraph (d) of this section are fully exempt from the PA to the extent described in that paragraph because they are records maintained by the Investigations Division of the Inspector General, which is a component of SBA which performs as its principal function activities pertaining to the enforcement of criminal laws within the meaning of 5 U.S.C. 552a(j)(2). They are exempt in order to: (1) Prevent the subjects of Office of Inspector General (OIG) investigations from using the PA to frustrate the investigative process; (2) Protect the identity of Federal employees who furnish a complaint or information to the OIG, consistent with section 7(b) of the Inspector General Act of 1978, 5 U.S.C. App. I; (3) Protect the confidentiality of other sources of information; (4) Avoid endangering confidential sources and law enforcement personnel; (5) Prevent interference with law enforcement proceedings; (6) Assure access to sources of confidential information, including that contained in Federal, State, and local criminal law enforcement information systems; (7) Prevent the disclosure of investigative techniques; or (8) Prevent the disclosure of classified information. No individual shall have access to any information compiled by SBA in reasonable anticipation of a civil action or proceeding. In the event of a question as to disclosure, the Systems Manager for the system of records involved will rely on the opinion of the General Counsel or designee, and will also consult with the PA Officer. The PA Officer has overall responsibility for administering the PA for SBA. A Systems Manager is responsible for administering the PA as to systems of records within an SBA Office. You can write to the PA Officer at 409 3rd Street, SW., Washington, DC 20416. [68 FR 59092, Oct. 14, 2003, as amended at 70 FR 29937, May 25, 2005] The senior official in each field office and each Headquarters program area designates himself or herself or appoints another as the Systems Manager for that office. Systems Managers have the following responsibilities, among others, for the offices for which they are appointed: (a) Acting as the initial contact person for individuals seeking access to or amendment of their records. (b) Responding to requests for information. (c) Discussing the availability of records with individuals. (d) Amending records in cases where amended information is not controversial and does not involve policy decisionmaking. (e) Informing individuals of any reproduction fees to be charged. (f) Assuring that their systems of records contain no record describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual about whom the record is maintained, or unless pertinent to and within the scope of an authorized law enforcement activity. You can write to a Systems Manager by writing to the SBA Office which maintains the record you are seeking. If you do not know which office that is, or you do not know the address of that office, you can write to the PA Officer at 409 3rd Street SW., Suite 5900, Washington, DC 20416, who will forward your request to the proper Systems Manager. (a) You may look at any information pertaining to yourself contained in any SBA system of records unless some law or regulation prohibits it. (b) In order to see this information, you must ask for it in writing, identifying what records you want. The writing should be addressed to the Systems Manager overseeing the system of records containing the record you wish to see. (c) The Systems Manager (or, when appropriate, the PA Officer) may ask for more specific information about the system of records in which the document you are seeking is kept, and may ask you for identification. The Systems Manager may ask you for your social security number but you are not obliged to present it and your request will not be denied simply because you do not provide it. The Systems Manager may, however, deny your request if he or she cannot determine that you are the person to whom the information pertains. The Systems Manager will respond within 10 working days. The Systems Manager will inform you that: (a) Your request is denied, in which case he or she will set forth the reasons for denial and your rights to appeal; or (b) Your request is granted and you may view your record, in which case he or she will set forth the time and date for you to review your record in the presence of an SBA employee; or (c) Your request is granted and, unless you object, SBA will mail you a copy of your record. SBA will mail you your record only if it determines that there are no other reasonable means for you to obtain access to your record. Your appeal should be in writing and should set forth any information you think would show that you should have access to your records. (a) Denial of a personnel file. Address an appeal of a denial of a request for a personnel file to the Office of Personnel Management, 1900 E Street NW., Washington, DC 20006. (b) Denial of an Equal Employment Opportunity Complaint File. Address an appeal of a denial of a request for an Equal Employment Opportunity Complaint File to the Equal Employment Opportunity Commission, 1801 L Street NW., Washington, DC 20036. (c) All other appeals. Appeal the denial of any other record to the PA Officer. See §102.30. Your appeal must reach the PA Officer on or before 30 calendar days after the date the denial was issued. If your appeal is based on the failure of the Systems Manager to answer your request, your appeal must reach the PA Officer on or before 90 calendar days after the date by which the Systems Manager should have responded under §102.35. The PA Officer will respond to you within 30 working days of the date when your appeal was received. The PA Officer will inform you that: (a) Your request is denied, in which case the reasons for denial will be set forth along with your rights to judicial review of SBA's decision; or (b) Your request is granted and you may view your record, in which case the time and date for you to review your records in the presence of an SBA employee will be set forth; or (c) Your request is granted and, unless you object, SBA will mail you a copy of your record. SBA will mail you your record only if it determines that there are no other reasonable means for you to obtain access to your record. You can petition to have records kept on you amended by writing to the Systems Manager who oversees the system of records in which the record you wish amended is kept. If you are unable to determine who that Systems Manager is, you may send your petition to the PA Officer, who will forward it to the right Systems Manager. See §102.30. Your petition should include the following: (a) In what system of records the record you want amended is kept. (b) What record you want amended. (c) What specific information in that record you want amended. (d) Why you want the record amended. (e) Any information you have, including copies of evidence, which you think will persuade the Systems Manager to amend the record. (f) What the record should say. SBA seeks to maintain only accurate, complete, and up-to-date records which are relevant to accomplish some purpose required by law, regulation, or Executive Order of the President. There are four grounds for amending a record. They are: (a) The record is not accurate. (b) The record is not relevant to any legitimate SBA concern. (c) The record is out-of-date. For example, there may have been events since the date of the record which have affected some of the information contained in the record. (d) The record is incomplete. There may be additional information relevant to the material contained in the record. Perhaps, in which case the procedures of §102.34(c) shall apply. The Systems Manager will acknowledge receipt of your request within 10 working days and issue a written response within 30 working days. The Systems Manager will: (a) Make the amendment you request, and send all individuals who had previously received a copy of that record a copy of the amended record; or (b) Amend the record, in a different manner, sending all individuals who had previously received a copy of that record a copy of the amended record and, in addition, telling you why your request was not granted in full and what appeal rights you have; or (c) Decline to amend the record, explaining why your request was not granted and telling you of your appeal rights. Your appeal should be in writing and include the following: (a) All of the information contained in your original request to amend the record; (b) Any response of the Systems Manager, including any reasons for denying your request; and (c) Any information you wish to submit in response to the Systems Manager's findings. (a) Personnel file. Address your appeal to the Office of Personnel Management, 1900 E Street NW., Washington, DC 20006. (b) Equal Employment Opportunity Complaint File. Address your appeal to the Equal Employment Opportunity Commission, 1801 L Street NW., Washington, DC 20036. (c) All other appeals. Address your appeal to the PA Officer. See §102.30. Your appeal must be received by the PA Officer within 30 calendar days of the date the Systems Manager declined to amend your records, or within 90 calendar days of the date the Systems Manager should have responded under §102.46 if the Systems Manager did not so respond. The PA Officer will decide your appeal using the criteria of accuracy, relevance, timeliness, and completeness described in §102.44. The PA Officer will review all relevant information and may seek the views of other SBA personnel. The PA Officer may review information not available to or not used by the Systems Manager. The PA Officer will respond to your appeal within 30 working days of its receipt, unless the Administrator determines that unusual circumstances exist, in which case the PA Officer will notify you of the presence of these unusual circumstances within 30 working days of the date upon which he or she received your appeal, and will respond to your appeal within 60 working days of the date of receipt. The PA Officer will: (a) Make the amendment you request, sending all individuals who had previously received a copy of that record a copy of the amended record; or (b) Amend the record in a different manner; or decline to amend it at all: (1) Sending all individuals who had previously received a copy of that record a copy of the amended record; (2) Telling you why your request was not granted in full and that you can seek judicial review; and (3) Marking the areas of dispute, including your statement of disagreement in the file, and, if appropriate, a concise statement of why SBA refused to amend the record as you requested, sending this material to all individuals who had previously received a copy of that record. You may bring a civil action against SBA in a United States district court if the SBA: (a) Makes a final determination not to provide you with access to or to amend your record in accordance with your request; (b) Fails to maintain your records with such accuracy, relevance, timeliness and completeness as is necessary to assure fairness in any determination relating to the qualifications, character, rights, opportunities of, or benefits to you that may be made on the basis of such records, and consequently a determination is made which harms you; or (c) Fails to comply with any other provisions of the PA (5 U.S.C. 552a) or the implementing regulations in this subpart, in such a way as to cause harm to you. When SBA collects information from an individual, it must, either on the form which collects the information or on a separate form which the individual may keep, state: (a) Whether disclosure of the information is voluntary or mandatory; (b) By what authority SBA is collecting the information; (c) For what principal purpose or purposes SBA is collecting the information; (d) What routine uses might be made of that information; and (e) What will happen if the information isn't supplied. No, unless compelled to by law. (a) No. You need not give SBA your SSN, even if SBA asks for it. (b) If SBA asks you for your SSN, it must tell you under what authority it seeks your SSN, and for what purpose. (c) SBA cannot withhold a benefit solely because you refuse to tell it your SSN. (a) If you go to where the records are kept, SBA will permit one person of your choosing to inspect the records with you. (b) If you want your representative to inspect the records without you, you must give SBA a written authorization. (c) SBA will mail a copy of the record to your representative if you direct SBA to do so in writing. (d) You may inspect the records of a minor if you present evidence that you are the custodial parent (including joint custodial parent) or legal guardian of that minor. An affidavit or declaration, signed by you under penalty of perjury, is normally sufficient evidence unless SBA has information to the contrary. (e) You may inspect the records of an adult incompetent if you present evidence that you are the legal guardian of that person. A guardianship order is sufficient evidence of your guardianship. Other evidence may be considered. SBA will charge you only for photocopying at the rate of 10 cents per page. SBA will not charge you for finding or reviewing your records. Fees less than $25 will be waived. SBA will tell you what disclosures it made of your records if you ask, except that SBA will not tell you about disclosures it made to another federal agency or government entity for law enforcement purposes. (a) SBA will comply with the Computer Matching and Privacy Protection Act of 1988 (5 U.S.C. 552a, 552a notes). This Act establishes procedures federal agencies must use if they want to match their computer lists. (b) If SBA adopts any procedures to supplement its compliance with the Computer Matching and Privacy Protection Act of 1988 which are not mandated in that Act, SBA will publish those procedures in Standard Operating Procedure (SOP) 40 04. You can get a copy of SOP 40 04 at any SBA Office. (c) If SBA enters into an agreement with any federal agency, contractor of any federal agency, state or local government, or agency of any state or local government to disclose records for purposes of a computer matching program, SBA will make a copy of that agreement available to the general public. You can get a copy of any such agreement by writing to the Privacy Act Officer.
Title 13: Business Credit and Assistance
PART 102—RECORD DISCLOSURE AND PRIVACY
Subpart B—The Privacy Act
§ 102.20 What privacy rights does this subpart regulate?
§ 102.21 How will SBA maintain records?
§ 102.22 When will SBA disclose records?
§ 102.23 Are there special rules about personnel and equal employment opportunity files?
§ 102.24 What is a record?
§ 102.25 What is a system of records?
§ 102.26 What does this subpart mean by “person to whom a record pertains” or “you”?
§ 102.27 What records are partially exempt from the provisions of the Privacy Act?
§ 102.28 What about information compiled for a civil action?
§ 102.29 Who administers SBA's responsibilities under the Privacy Act?
§ 102.30 How can I write to the Privacy Act Officer?
§ 102.31 Who appoints Systems Managers?
§ 102.32 What do Systems Managers do?
§ 102.33 How can I write to a Systems Manager?
§ 102.34 How can I see records kept on me?
§ 102.35 How long will it take SBA to respond to my request?
§ 102.36 How will SBA respond to my request?
§ 102.37 How may I appeal a decision to deny me access to my records?
§ 102.38 To whom should my appeal be addressed?
§ 102.39 By when must I appeal to the Privacy Act Officer?
§ 102.40 When will SBA respond to my appeal?
§ 102.41 How will SBA respond to my appeal?
§ 102.42 How can I get SBA to amend a record kept on me?
§ 102.43 What should my petition say?
§ 102.44 For what reasons will SBA amend my record?
§ 102.45 Will SBA ask me for more information after I make my request?
§ 102.46 When will SBA respond to my request?
§ 102.47 How will SBA respond to my request?
§ 102.48 How do I appeal a refusal to amend a record kept on me?
§ 102.49 To whom should I address my appeal?
§ 102.50 By when must I submit my appeal?
§ 102.51 By what standards will the Privacy Act Officer review my appeal?
§ 102.52 When will SBA respond to my appeal?
§ 102.53 How will SBA respond to my appeal?
§ 102.54 How can I obtain judicial review of an SBA Privacy Act decision?
§ 102.55 What must SBA tell the individuals from whom it collects information?
§ 102.56 Will SBA release my name or address?
§ 102.57 Do I have to give SBA my SSN?
§ 102.58 When will SBA show personnel records to a representative?
§ 102.59 What fees will SBA charge me for my records?
§ 102.60 May I be informed of disclosures made of my records?
§ 102.61 Are there Matching Program procedures?
