32 C.F.R. Subpart D—Access by Individuals
Title 32 - National Defense
(a) Individual access. (1) The access provisions of this part are intended for use by individuals about whom records are maintained in systems of records. Release of personal information to individuals under this part is not considered public release of information. (2) Make available to the individual to whom the record pertains all of the personal information that can be released consistent with DoD responsibilities. (b) Individual requests for access. Individuals shall address requests for access to personal information in a system of records to the system manager or to the office designated in the DoD Component rules or the system notice. (c) Verification of identity. (1) Before granting access to personal data, an individual may be required to provide reasonable verification of his or her identity. (2) Identity verification procedures shall not: (i) Be so complicated as to discourage unnecessarily individuals from seeking access to information about themselves; or (ii) Be required of an individual seeking access to records which normally would be available under the “DoD Freedom of Information Act Program” (32 CFR part 286). (3) Normally, when individuals seek personal access to records pertaining to themselves, identification is made from documents that normally are readily available, such as employee and military identification cards, driver's license, other licenses, permits or passes used for routine identification purposes. (4) When access is requested by mail, identity verification may consist of the individual providing certain minimum identifying data, such as full name, date and place of birth, or such other personal information necessary to locate the record sought. If the information sought is of a sensitive nature, additional identifying data may be required. If notarization of requests is required, procedures shall be established for an alternate method of verification for individuals who do not have access to notary services, such as military members overseas. (5) If an individual wishes to be accompanied by a third party when seeking access to his or her records or to have the records released directly to a third party, the individual may be required to furnish a signed access authorization granting the third party access. (6) An individual shall not be refused access to his or her record solely because he or she refuses to divulge his or her SSN unless the SSN is the only method by which retrieval can be made. (See §310.20(b)). (7) The individual is not required to explain or justify his or her need for access to any record under this part. (8) Only a denial authority may deny access and the denial must be in writing and contain the information required by paragraph (b) of §310.31. (d) Granting individual access to records. (1) Grant the individual access to the original record or an exact copy of the original record without any changes or deletions, except when changes or deletions have been made in accordance with paragraph (e) of this section. For the purpose of granting access, a record that has been amended under §310.31(b) is considered to be the original. See pargraph (e) of this section for the policy regarding the use of summaries and extracts. (2) Provide exact copies of the record when furnishing the individual copies of records under this part. (3) Explain in terms understood by the requestor any record or portion of a record that is not clear. (e) Illegible, incomplete, or partially exempt records. (1) Do not deny an individual access to a record or a copy of a record solely because the physical condition or format of the record does not make it readily available (for example, deteriorated state or on magnetic tape). Either prepare an extract or recopy the document exactly. (2) If a portion of the record contains information that is exempt from access, an extract or summary containing all of the information in the record that is releasable shall be prepared. (3) When the physical condition of the record or its state makes it necessary to prepare an extract for release, ensure that the extract can be understood by the requester. (4) Explain to the requester all deletions or changes to the records. (f) Access to medical records. (1) Disclose medical records to the individual to whom they pertain, even if a minor, unless a judgment is made that access to such records could have an adverse effect on the mental or physical health of the individual. Normally, this determination shall be made in consultation with a medical doctor. (2) If it is determined that the release of the medical information may be harmful to the mental or physical health of the individual: (i) Send the record to a physician named by the individual; and (ii) In the transmittal letter to the physician explain why access by the individual without proper professional supervision could be harmful (unless it is obvious from the record). (3) Do not require the physician to request the records for the individual. (4) If the individual refuses or fails to designate a physician, the record shall not be provided. Such refusal of access is not considered a denial for Privacy Act reporting purposes. (See paragraph (a) of §310.31). (5) Access to a minor's medical records may be granted to his or her parents or legal guardians. However, observe the following procedures: (i) In the United States, the laws of the particular state in which the records are located may afford special protection to certain types of medical records (for example, records dealing with treatment for drug or alcohol abuse and certain psychiatric records). Even if the records are maintained by a military medical facilities these statutes may apply. (ii) For the purposes of parental access to the medical records and medical determinations regarding minors at overseas installation the age of majority is 18 years except when: (A) A minor at the time he or she sought or consented to the treatment was between 15 and 17 years of age; (B) The treatment was sought in a program which was authorized by regulation or statute to offer confidentiality of treatment records as a part of the program; (C) The minor specifically requested or indicated that he or she wished the treatment record to be handled with confidence and not released to a parent or guardian; and (D) The parent or guardian seeking access does not have the written authorization of the minor or a valid court order granting access. (iii) If all four of the above conditions are met, the parent or guardian shall be denied access to the medical records of the minor. Do not use these procedures to deny the minor access to his or her own records under this part or any other statutes. (6) All members of the Military Services and all married persons are not considered minors regardless of age, and the parents of these individuals do not have access to their medical records without written consent of the individual. (g) Access to information compiled in anticipation of civil action. (1) An individual is not entitled under this part to gain access to information compiled in reasonable anticipation of a civil action or proceeding. (2) The term “civil proceeding” is intended to include quasi-judicial and pretrial judicial proceedings that are the necessary preliminary steps to formal litigation. (3) Attorney work products prepared in conjunction with quasi-judicial pretrial, and trial proceedings, to include those prepared to advise DoD Component officials of the possible legal consequences of a given course of action, are protected. (h) Access to investigatory records. (1) Requests by individuals for access to investigatory records pertaining to themselves and compiled for law enforcement purposes are processed under this part of the DoD Freedom of Information Program (32 CFR part 286) depending on which part gives them the greatest degree of access. (2) Process requests by individuals for access to investigatory record pertaining to themselves compiled for law enforcement purposes and in the custody of law enforcement activities that have been incorporated into systems of records exempted from the access provisions of this part in accordance with section B of chapter 5 under reference (f). Do not deny an individual access to the record solely because it is in the exempt system, but give him or her automatically the same access he or she would receive under the Freedom of Information Act (5 U.S.C. 552). (See also paragraph (h) of this section.) (3) Process requests by individuals for access to investigatory records pertaining to themselves that are in records systems exempted from access provisions under paragraph (a) of §310.52, subpart F, under this part, or the DoD Freedom of Information Act Program (32 CFR part 286) depending upon which regulation gives the greatest degree of access (see also paragraph (j) of this section). (4) Refer individual requests for access to investigatory records exempted from access under a general exemption temporarily in the hands of a noninvestigatory element for adjudicative or personnel actions to the originating investigating agency. Inform the requester in writing of these referrals. (i) Nonagency records. (1) Certain documents under the physical control of DoD personnel and used to assist them in performing official functions, are not considered “agency records” within the meaning of this Regulation. Uncirculated personal notes and records that are not disseminated or circulated to any person or organization (for example, personal telephone lists or memory aids) that are retained or discarded at the author's discretion and over which the Component exercises no direct control, are not considered agency records. However, if personnel are officially directed or encouraged, either in writing or orally, to maintain such records, they may become “agency records,” and may be subject to this part. (2) The personal uncirculated handwritten notes of unit leaders, office supervisors, or military supervisory personnel concerning subordinates are not systems of records within the meaning of this part. Such notes are an extension of the individual's memory. These notes, however, must be maintained and discarded at the discretion of the individual supervisor and not circulated to others. Any established requirement to maintain such notes (such as, written or oral directives, regulations, or command policy) make these notes “agency records” and they then must be made a part of a system of records. If the notes are circulated, they must be made a part of a system of records. Any action that gives personal notes the appearance of official agency records is prohibited, unless the notes have been incorporated into a system of records. (j) Relationship between the Privacy Act and the Freedom of Information Act. (1) Process requests for individual access as follows: (i) Requests by individuals for access to records pertaining to themselves made under the Freedom of Information Act (5 U.S.C. 552) or the DoD Freedom of Information Act Program (32 CFR part 286) or DoD Component instuctions implementing the DoD Freedom of Information Act Program are processed under the provisions of that reference. (ii) Requests by individuals for access to records pertaining to themselves made under the Privacy Act of 1971 (5 U.S.C. 552a), this part, or the DoD Component instructions implementing this part are processed under this part. (iii) Requests by individuals for access to records about themselves that cite both Acts or the implementing regulations and instructions for both Acts are processed under this part except: (A) When the access provisions of the DoD Freedom of Information Act Program (32 CFR part 286) provide a greater degree of access; or (B) When access to the information sought is controlled by another federal statute. (C) If the former applies, follow the provisions of 32 CFR part 286; and if the later applies, follow the access procedures established under the controlling statute. (iv) Requests by individuals for access to information about themselves in systems of records that do not cite either Act or the implementing regulations or instructions for either Act are processed under the procedures established by this part. However, there is no requirement to cite the specific provisions of this part or the Privacy Act (5 U.S.C. 552a) when responding to such requests. Do not count these requests as Privacy Act request for reporting purposes (see subpart I). (2) Do not deny individuals access to personal information concerning themselves that would otherwise be releasable to them under either Act solely because they fail to cite either Act or cite the wrong Act, regulation, or instruction. (3) Explain to the requester which Act or procedures have been used when granting or denying access under either Act (see also paragraph (j)(1)(iv) of this section). (k) Time limits. Normally acknowledge requests for access within 10 working days after receipt and provide access within 30 working days. (l) Privacy case file. Establish a Privacy Act case file when required (see paragraph (p) of §310.32 of this subpart). [51 FR 2364, Jan. 16, 1986. Redesignated at 56 FR 55631, Oct. 29, 1991, as amended at 56 FR 57800, Nov. 14, 1991] (a) Denying individual access. (1) An individual may be denied formally access to a record pertaining to him or her only if the record: (i) Was compiled in reasonable anticipation of civil action (see paragraph (g) of §310.30) (ii) Is in a system of records that has been exempted from the access provisions of this regulation under one of the permitted exemptions (see subpart F). (iii) Contains classified information that has been exempted from the access provision of this part under blanket exemption for such material claimed for all DoD records system (see §310.50(c) of subpart F). (iv) Is contained in a system of records for which access may be denied under some other federal statute. (2) Only deny the individual access to those portions of the records from which the denial of access serves some legitimate governmental purpose. (b) Other reasons to refuse access. (1) An individual may be refused access if: (i) The record is not described well enough to enable it to be located with a reasonable amount of effort on the part of an employee familiar with the file; or (ii) Access is sought by an individual who fails or refuses to comply with the established procedural requirements, including refusing to name a physician to receive medical records when required (see paragraph (f) of §310.30) or to pay fees (see §310.33 of this subpart). (2) Always explain to the individual the specific reason access has been refused and how he or she may obtain access. (c) Notifying the individual. Formal denials of access must be in writing and include as a minimum: (1) The name, title or position, and signature of a designated Component denial authority; (2) The date of the denial; (3) The specific reason for the denial, including specific citation to the appropriate sections of the Privacy Act (5 U.S.C. 552a) or other statutes, this part, DoD Component instructions or Code of Federal Regulations (CFR) authorizing the denial; (4) Notice to the individual of his or her right to appeal the denial through the Component appeal procedure within 60 calendar days; and (5) The title or position and address of the Privacy Act appeals official for the Component. (d) DoD Component appeal procedures. Establish internal appeal procedures that, as a minimum, provide for: (1) Review by the head of the Component or his or her designee of any appeal by an individual from a denial of access to Component records. (2) Formal written notification to the individual by the appeal authority that shall: (i) If the denial is sustained totally or in part, include as a minimum: (A) The exact reason for denying the appeal to include specific citation to the provisions of the Act or other statute, this part, Component instructions or the CFR upon which the determination is based; (B) The date of the appeal determination; (C) The name, title, and signature of the appeal authority; (D) A statement informing the applicant of his or her right to seek judicial relief. (ii) If the appeal is granted, notify the individual and provide access to the material to which access has been granted. (3) The written appeal notification granting or denying access is the final Component action as regards access. (4) The individual shall file any appeals from denial of access within no less than 60 calendar days of receipt of the denial notification. (5) Process all appeals within 30 days of receipt unless the appeal authority determines that a fair and equitable review cannot be made within that period. Notify the applicant in writing if additional time is required for the appellate review. The notification must include the reasons for the delay and state when the individual may expect an answer to the appeal. (e) Denial of appeals by failure to act. A requester may consider his or her appeal formally denied if the authority fails: (1) To act on the appeal within 30 days; (2) To provide the requester with a notice of extension within 30 days; or (3) To act within the time limits established in the Component's notice of extension (see paragraph (d)(5) of this section). (f) Denying access to OPM records held by DoD Components. (1) The records in all systems of records maintained in accordance with the OPM government-wide system notices are technically only in the temporary custody of the Department of Defense. (2) All requests for access to these records must be processed in accordance with the Federal Personnel Manual (5 CFR parts 293, 294, 297 and 735) as well as the applicable Component procedures. (3) When a DoD Component refuses to grant access to a record in an OPM system, the Component shall instruct the individual to direct his or her appeal to the appropriate Component appeal authority, not the Office of Personnel Management. (4) The Component is responsible for the administrative review of its denial of access to such records. [51 FR 2364, Jan. 16, 1986. Redesignated at 56 FR 55631, Oct. 29, 1991, as amended at 56 FR 57800, Nov. 14, 1991] (a) Individual review and correction. Individuals are encouraged to review the personnel information being maintained about them by DoD Components periodically and to avail themselves of the procedures established by this part and any other Component regulations to update their records. (b) Amending records. (1) An individual may request the amendment of any record contained in a system of records pertaining to him or her unless the system of record has been exempted specifically from the amendment procedures of this part under paragraph (b) of §310.50, subpart F. Normally, amendments under this part are limited to correcting factual matters and not matters of official judgment, such as performance ratings, promotion potential, and job performance appraisals. (2) While a Component may require that the request for amendment be in writing, this requirement shall not be used to discourage individuals from requesting valid amendments or to burden needlessly the amendment process. (3) A request for amendment must include: (i) A description of the item or items to be amended; (ii) The specific reason for the amendment; (iii) The type of amendment action sought (deletion, correction, or addition); and (iv) Copies of available documentary evidence supporting the request. (c) Burden of proof. The applicant must support adequately his or her claim. (d) Identification of requesters. (1) Individuals may be required to provide identification to ensure that they are indeed seeking to amend a record pertaining to themselves and not, inadvertently or intentionally, the record of others. (2) The indentification procedures shall not be used to discourage legitimate requests or to burden needlessly or delay the amendment process. (See paragraph (c) of §310.30). (e) Limits on attacking evidence previously submitted. (1) The amendment process is not intended to permit the alteration of evidence presented in the course of judicial or quasi-judicial proceedings. Any amendments or changes to these records normally are made through the specific procedures established for the amendment of such records. (2) Nothing in the amendment process is intended or designed to permit a collateral attack upon what has already been the subject of a judicial or quasi-judicial determination. However, while the individual may not attack the accuracy of the judicial or quasi-judicial determination under this part, he or she may challenge the accuracy of the recording of that action. (f) Sufficiency of a request to amend. Consider the following factors when evaluating the sufficiency of a request to amend: (1) The accuracy of the information itself; and (2) The relevancy, timeliness, completeness, and necessity of the recorded information for accomplishing an assigned mission or purpose. (g) Time limits. (1) Provide written acknowledgement of a request to amend within 10 working days of its receipt by the appropriate systems manager. There is no need to acknowledge a request if the action is completed within 10 working days and the individual is so informed. (2) The letter of acknowledgement shall clearly identify the request and advise the individual when he or she may expect to be notified of the completed action. (3) Only under the most exceptional circumstances shall more than 30 days be required to reach a decision on a request to amend. Document fully and explain in the Privacy Act case file (see paragraph (p) of this section) any such decision that takes more than 30 days to resolve. (h) Agreement to amend. If the decision is made to grant all or part of the request for amendment, amend the record accordingly and notify the requester. (i) Notification of previous recipients. (1) Notify all previous recipients of the information, as reflected in the disclosure accounting records, that an amendment has been made and the substance of the amendment. Recipients who are known to be no longer retaining the information need not be advised of the amendment. All DoD Components and federal agencies known to be retaining the record or information, even if not reflected in a disclosure record, shall be notified of the amendment. Advise the requester of these notifications. (2) Honor all requests by the requester to notify specific federal agencies of the amendment action. (j) Denying amendment. If the request for amendment is denied in whole or in part, promptly advise the individual in writing of the decision to include: (1) The specific reason and authority for not amending; (2) Notification that he or she may seek further independent review of the decision by the head of the Component or his or her designee; (3) The procedures for appealing the decision citing the position and address of the official to whom the appeal shall be addressed; and (4) Where he or she can receive assistance in filing the appeal. (k) DoD Component appeal procedures. Establish procedures to ensure the prompt, complete, and independent review of each amendment denial upon appeal by the individual. These procedures must ensure that: (1) The appeal with all supporting materials both that furnished the individual and that contained in Component records is provided to the reviewing official, and (2) If the appeal is denied completely or in part, the individual is notified in writing by the reviewing official that: (i) The appeal has been denied and the specific reason and authority for the denial; (ii) The individual may file a statement of disagreement with the appropriate authority and the procedures for filing this statement; (iii) If filed properly, the statement of disagreement shall be included in the records, furnished to all future recipients of the records, and provided to all prior recipients of the disputed records who are known to hold the record; and (iv) The individual may seek a judicial review of the decision not to amend. (3) If the record is amended, ensure that: (i) The requester is notified promptly of the decision; (ii) All prior known recipients of the records who are known to be retaining the record are notified of the decision and the specific nature of the amendment (see paragraph (i) of this section); and (iii) The requester is notified as to which DoD Components and federal agencies have been told of the amendment. (4) Process all appeals within 30 days unless the appeal authority determines that a fair review cannot be made within this time limit. If additional time is required for the appeal, notify the requester, in writing, of the delay, the reason for the delay, and when he or she may expect a final decision on the appeal. Document fully all requirements for additional time in the Privacy Case File. (See paragraph (p) of this section) (l) Denying amendment of OPM records held by DoD Components. (1) The records in all systems of records controlled by the Office of Personnel Management (OPM) government-wide system notices are technically only temporarily in the custody of the Department of Defense. (2) All requests for amendment of these records must be processed in accordance with the OPM Federal Personnel Manual (5 CFR parts 293, 294, 297 and 735). The Component denial authority may deny a request. However, the appeal process for all such denials must include a review by the Assistant Director for Agency Compliance and Evaluation, Office of Personnel Management, 1900 E Street NW, Washington, DC 20415. (3) When an appeal is received from a Component's denial of amendment of the OPM controlled record, process the appeal in accordance with the OPM Federal Personnel Manual (5 CFR parts 293, 294, 297 and 735) and notify the OPM appeal authority listed above. (4) The individual may appeal any Component decision not to amend the OPM records directly to OPM. (5) OPM is the final review authority for any appeals from a denial to amend the OPM records. (m) Statements of disagreement submitted by individuals. (1) If the reviewing authority refuses to amend the record as requested, the individual may submit a concise statement of disagreement setting forth his or her reasons for disagreeing with the decision not to amend. (2) If an individual chooses to file a statement of disagreement, annotate the record to indicate that the statement has been filed (see paragraph (n) of this section). (3) Furnish copies of the statement of disagreement to all DoD Components and federal agencies that have been provided copies of the disputed information and who may be maintaining the information. (n) Maintaining statements of disagreement. (1) When possible, incorporate the statement of disagreement into the record. (2) If the statement cannot be made a part of the record, establish procedures to ensure that it is apparent from the records that a statement of disagreement has been filed and maintain the statement so that it can be obtained readily when the disputed information is used or disclosed. (3) Automated record systems that are not programed to accept statements of disagreement shall be annotated or coded so that they clearly indicate that a statement of disagreement is on file, and clearly identify the statement with the disputed information in the system. (4) Provide a copy of the statement of disagreement whenever the disputed information is disclosed for any purpose. (o) DoD Component summaries of reasons for refusing to amend. (1) A summary of reasons for refusing to amend may be included with any record for which a statement of disagreement is filed. (2) Include in this summary only the reasons furnished to the individual for not amending the record. Do not include comments on the statement of disagreement. Normally, the summary and statement of disagreement are filed together. (3) When disclosing information for which a summary has been filed, a copy of the summary may be included in the release, if the Component desires. (p) Privacy Case Files. (1) Establish a separate Privacy Case File to retain the documentation received and generated during the amendment or access process. (2) The Privacy Case File shall contain as a minimum: (i) The request for amendment or access; (ii) Copies of the DoD Component's reply granting or denying the request; (iii) Any appeals from the individual; (iv) Copies of the action regarding the appeal with supporting documentation which is not in the basic file; and (v) Any other correspondence generated in processing the appeal, to include coordination documentation. (3) Only the items listed in paragraphs (p)(4) and (s) of this section may be included in the system of records challenged for amendment or for which access is sought. Do not retain copies of unamended records in the basic record system if the request for amendment is granted. (4) The following items relating to an amendment request may be included in the disputed record system: (i) Copies of the amended record. (ii) Copies of the individual's statement of disagreement (see paragraph (m) of this section). (iii) Copies of Component summaries (see paragraph (o) of this section). (iv) Supporting documentation submitted by the individual. (5) The following items relating to an access request may be included in the basic records system: (i) Copies of the request; (ii) Copies of the Component's action granting total access. Note. A separate Privacy case file need not be created in such cases. (iii) Copies of the Component's action denying access; (iv) Copies of any appeals filed; (v) Copies of the reply to the appeal. (6) There is no need to establish a Privacy case file if the individual has not cited the Privacy Act (reference (b)), this part, or the Component implementing instruction for this part. (7) Privacy case files shall not be furnished or disclosed to anyone for use in making any determination about the individual other than determinations made under this part. [51 FR 2364, Jan. 16, 1986. Redesignated at 56 FR 55631, Oct. 29, 1991, as amended at 56 FR 57800, Nov. 14, 1991] (a) Assessing fees. (1) Charge the individual only the direct cost of reproduction. (2) Do not charge reproduction fees if copying is: (i) The only means to make the record available to the individual (for example, a copy of the record must be made to delete classified information); or (ii) For the convenience of the DoD Component (for example, the Component has no reading room where an individual may review the record, or reproduction is done to keep the original in the Component's file). (3) No fees shall be charged when the record may be obtained without charge under any other regulation, directive, or statute. (4) Do not use fees to discourage requests. (b) No minimum fees authorized. Use fees only to recoup direct reproduction costs associated with granting access. Minimum fees for duplication are not authorized and there is no automatic charge for processing a request. (c) Prohibited fees. Do not charge or collect fees for: (1) Search and retrieval of records; (2) Review of records to determine releasability; (3) Copying records for DoD Component convenience or when the individual has not specifically requested a copy; (4) Transportation of records and personnel; or (5) Normal postage. (d) Waiver of fees. (1) Normally, fees are waived automatically if the direct costs of a given request is less than $30. This fee waiver provision does not apply when a waiver has been granted to the individual before, and later requests appear to be an extension or duplication of that original request. A DoD Component may, however, set aside this automatic fee waiver provision when on the basis of good evidence it determines that the waiver of fees is not in the public interest. (2) Decisions to waiver or reduce fees that exceed the automatic waiver threshold shall be made on a case-by-case basis. (e) Fees for members of Congress. Do not charge members of Congress for copying records furnished even when the records are requested under the Privacy Act on behalf of a constituent (see §310.41(k) of subpart E). When replying to a constituent inquiry and the fees involved are substantial, consider suggesting to the Congressman that the constituent can obtain the information directly by writing to the appropriate offices and paying the costs. When practical, suggest to the Congressman that the record can be examined at no cost if the constituent wishes to visit the custodian of the record. (f) Reproduction fees computation. Compute fees using the appropriate portions of the fee schedule in subpart G of the DoD Freedom of Information Program (32 CFR part 286). [51 FR 2364, Jan. 16, 1986. Redesignated at 56 FR 55631, Oct. 29, 1991, as amended at 56 FR 57800, Nov. 14, 1991]
Title 32: National Defense
PART 310—DoD PRIVACY PROGRAM
Subpart D—Access by Individuals
§ 310.30 Individual access to personal information.
§ 310.31 Denial of individual access.
§ 310.32 Amendment of records.
§ 310.33 Reproduction fees.
