32 C.F.R. § 505.2 Individual rights of access and amendment.
Title 32 - National Defense
(a) Access under the Privacy Act. Upon a written or oral request, an individual or his/her designated agent or legal guardian will be granted access to a record pertaining to that individual, maintained in a system of records, unless the record is subject to an exemption and the system manager has invoked the exemption (see §505.5), or the record is information compiled in reasonable anticipation of a civil action or proceeding. The requester does not have to state a reason or otherwise justify the need to gain access. Nor can an individual be denied access solely because he/she refused to provide his/her Social Security Number unless the Social Security Number was required for access by statute or regulation adopted prior to January 1, 1975. The request should be submitted to the custodian of the record. (b) Notifying the individual. The custodian of the record will acknowledge requests for access within 10 work days of receipt. Records will be provided within 30 days, excluding Saturdays, Sundays, and legal public holidays. (c) Relationship between the Privacy Act and the Freedom of Information Act. A Privacy Act request for access to records should be processed also as a Freedom of Information Act request. If all or any portion of the requested material is to be denied, it must be considered under the substantive provisions of both the Privacy Act and the Freedom of Information Act. Any withholding of information must be justified by asserting a legally applicable exemption in each Act. (d) Functional requests. If an individual asks for his/her record and does not cite, or reasonably imply, either the Privacy Act or the Freedom of Information Act, and another prescribing directive authorizes release, the records should be released under that directive. Examples of functional requests are military members asking to see their Military Personnel Records Jacket, or civilian employees asking to see their Official Personnel Folder. (e) Medical records. If it is determined that releasing medical information to the data subject could have an adverse affect on the mental or physical health of that individual, the requester should be asked to name a physician to receive the record. The data subject's failure to designate a physician is not a denial under the Privacy Act and cannot be appealed. (f) Third party information. Third party information pertaining to the data subject may not be deleted from a record when the data subject requests access to the record unless there is an established exemption (see §505.5(d)). However, personal data such as SSN and home address of third parties in the data subject's record normally do not pertain to the data subject and therefore may be withheld. Information about the relationship between the data subject and the third party would normally be disclosed as pertaining to the data subject. (g) Referral of records. Requests for access to Army systems of records containing records that originated with other DOD Components or Federal agencies which claimed exemptions for them will be coordinated with or referred to the originator for release determination. The requester will be notified of the referral. (h) Fees. Requesters will be charged only for the reproduction of requested documents. Normally, there will be no charge for the first copy of a record provided to the individual whose record it is. Thereafter, fees will be computed as set forth in AR 340–17. (i) Denial of access. (1) The only officials authorized to deny a request from a data subject for records in a system of records pertaining to that individual are the appropriate Access and Amendment Refusal Authorities (see §505.1(f)), or the Secretary of the Army, acting through the General Counsel. Denial is appropriate only if the record: (i) Was compiled in reasonable anticipation of a civil action or proceeding, or (ii) Is properly exempted by the Secretary of the Army from the disclosure provisions of the Privacy Act (see §505.5), there is a legitimate governmental purpose for invoking the exemption, and it is not required to be disclosed under the Freedom of Information Act. (2) Requests for records recommended to be denied will be forwarded to the appropriate AARA within 5 work days of receipt, together with the request, disputed records, and justification for withholding. The requester will be notified of the referral. (3) Within the 30 work day period (see §505.2(b)), the AARA will give the following information to the requester in writing if the decision is to deny the request for access: (i) Official's name, position title, and business address; (ii) Date of the denial; (iii) Reasons for the denial, including citation of appropriate section(s) of the Privacy Act and this regulation; (iv) The opportunity for further review of the denial by the General Counsel, Office, Secretary of the Army, The Pentagon, Washington, DC 20310, through the AARA within 60 calendar days. (For denials made by the Army when the record is maintained in one of OPM's government-wide systems of records, notices for which are described at appendix B, AR 340–21–8, an individual's request for further review must be addressed to the Assistant Director for Agency Compliance and Evaluation, Office of Personnel Management, 1900 E Street NW., Washington, DC 20415–0001.) (j) Amendment of records. (1) Individuals may request the amendment of their records, in writing, when such records are believed to be inaccurate as a matter of fact rather than judgment, irrelevant, untimely, or incomplete. (2) The amendment procedures are not intended to permit challenge to a record that records an event that actually occurred nor are they designed to permit collateral attack upon that which has been the subject of a judicial or quasi-judicial action. Consideration of request for an amendment would be appropriate if it can be shown that circumstances leading up to the event that is recorded on the document were challenged through administrative procedures and found to be inaccurately described, that the document is not identical to the individual's copy, or that the document was not constructed in accordance with the applicable recordkeeping requirements prescribed. For example, the amendment provisions do not allow an individual to challenge the merits of an adverse action. However, if the form that documents the adverse action contains an error on the fact of the record (e.g., the individual's name is misspelled, an improper date of birth or SSN was recorded), the amendment procedures may be used to request correction of the record. (3) US Army Criminal Investigations Command reports of investigation (records in system notices AO501.08e Informant Register, AO508.11b Criminal Information Reports and Cross Index Card Files, and AO508.25a Index to Criminal Investigative Case Files) have been exempted from the amendment provisions of the Privacy Act. Requests to amend these reports will be considered under AR 195–2 by the Commander, US Army Criminal Investigations Command, action by the Commander, US Army Criminal Investigation Commander will constitute final action on behalf of the Secretary of the Army under that regulation. (4) Records accessioned into the National Archives are exempted from the Privacy Act provision allowing individuals to request amendment of records. Most provisions of the Privacy Act apply only to those systems of records which are under the legal control of the originating agency; e.g., an agency's current operating files or records stored at a Federal records center. (k) Procedures. (1) Requests to amend a record should be addressed to the custodian or system manager of that record. The request must reasonably describe the record to be amended and the changes sought (i.e., deletion, addition, amendment). The burden of proof rests with the requester; therefore, the alteration of evidence presented to courts, boards, and other official proceedings is not permitted. (An individual acting for the requester must supply a written consent signed by the requester.) (2) The custodian or system manager will acknowledge the request within 10 work days and make final response within 30 work days. (3) The record for which amendment is sought must be reviewed by the proper system manager or custodian for accuracy, relevance, timeliness, and completeness so as to assure fairness to the individual in any determination made about that individual on the basis of that record. (4) If the amendment is proper, the custodian or system manager will physically amend the record by adding or deleting information, or destroying the record or a portion of it, and notify the requester of such action. (5) If the amendment is not justified, the request and all relevant documents, including the reasons for not amending, will be forwarded to the appropriate AARA within 5 work days and the requester so notified. (6) The AARA, on the basis of the evidence, either will amend the record and notify the requester and the custodian of that decision, or will deny the request and inform the requester: (i) Of reasons for not amending; and (ii) Of his/her right to seek further review by the DA Privacy Review Board (through the AARA). (7) On receipt of an appeal from a denial to amend, the AARA will append any additional records or background information that substantiates the refusal or renders the case complete and, within 5 work days of receipt, forward the appeal to the DA Privacy Review Board. (8) The DA Privacy Review Board, on behalf of the Secretary of the Army, will complete action on a request for further review within 30 work days of its receipt by the AARA. The General Counsel may authorize an additional 30 days when unusual circumstances and good cause so warrant. The Board may seek additional information, including the appellant's official file, if deemed relevant and necessary to deciding the appeal. (i) If the Board determines that amendment is justified, it will amend the record and notify the requester, the AARA, the custodian of the record, and any prior recipients of the record. (ii) If the Board denies the request, it will obtain the General Counsel's concurrence. Response to the appellant will include reasons for denial and the appellant's right to file a statement of disagreement with the Board's action and to seek judicial review of the Army's refusal to amend. (9) Statements of disagreement will be an integral part of the record to which it pertains so the fact that the record is disputed is apparent to anyone who may have access to, use of, or need to disclose from it. The disclosing authority may include a brief summary of the Board's reasons for not amending the disputed record. The summary will be limited to the reasons stated to the individual by the Board. (l) Privacy case files. Whenever an individual submits a Privacy Act request, a case file will be established; see system notice AO240.01DAAG. In no instance will the individual's request and Army actions thereon be included in the individual's personnel file. The case file will comprise the request for access/amendment, grants, refusals, coordination action, and related papers. This file will not be used to make any determinations about the individuals.
Title 32: National Defense
PART 505—THE ARMY PRIVACY PROGRAM
§ 505.2 Individual rights of access and amendment.
