[Code of Federal Regulations] [Title 12, Volume 6] [Revised as of January 1, 2001] From the U.S. Government Printing Office via GPO Access [CITE: 12CFR1702] [Page 903-908] TITLE 12--BANKS AND BANKING CHAPTER XVII--OFFICE OF FEDERAL HOUSING ENTERPRISE OVERSIGHT, DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT PART 1702--IMPLEMENTATION OF THE PRIVACY ACT OF 1974--Table of Contents Sec. 1702.1 Scope. 1702.2 Definitions. 1702.3 Requests for access to individual records. 1702.4 Decision to grant or deny requests for access to individual records. 1702.5 Special procedures for medical records. [[Page 904]] 1702.6 Requirements for verification of identity. 1702.7 Requests for amendment of individual records. 1702.8 Decision to grant or deny requests for amendment of individual records. 1702.9 Appeals of the initial decision to deny access to or amendment of individual records. 1702.10 Decision to grant or deny appeals. 1702.11 Disclosure of individual records to other persons or agencies. 1702.12 Accounting of disclosures. 1702.13 Requests for accounting of disclosures. 1702.14 Fees. 1702.15 Preservation of records. 1702.16 Rights of parents and legal guardians. 1702.17 Penalties. Authority: 5 U.S.C. 552a, 12 U.S.C. 4513(b). Source: 63 FR 8844, Feb. 23, 1998, unless otherwise noted. Redesignated at 65 FR 81327, Dec. 26, 2000. Sec. 1702.1 Scope. (a) This part 1702 sets forth the procedures by which an individual may request access to records about him/her that are maintained by the Office of Federal Housing Enterprise Oversight (OFHEO) in a designated system of records, amendment of such records, or an accounting of disclosures of such records. This part 1702 implements the provisions of the Privacy Act of 1974, as amended (Privacy Act) (5 U.S.C. 552a). (b) A request from an individual for a record about that individual that is not contained in an OFHEO designated system of records will be considered to be a Freedom of Information Act (FOIA) (5 U.S.C. 552) request and will be processed under the FOIA. [63 FR 8844, Feb. 23, 1998. Redesignated and amended at 65 FR 81327, Dec. 26, 2000] Sec. 1702.2 Definitions. For the purposes of this part 1702-- Amendment means any correction of, addition to, or deletion from a record. Designated system of records means a system of records that OFHEO has listed and summarized in the Federal Register pursuant to the requirements of 5 U.S.C. 552a(e). Individual means a natural person who is either a citizen of the United States of America or an alien lawfully admitted for permanent residence. Maintain includes collect, use, disseminate, or control. Privacy Act Appeals Officer means the OFHEO employee who has been delegated the authority to determine Privacy Act appeals. Privacy Act Officer means the OFHEO employee who has been delegated the authority to determine Privacy Act requests. Record means any item, collection, or grouping of information about an individual that is maintained by OFHEO and that contains his/her name, or the identifying number, symbol, or other identifying particular assigned to the individual. Routine use, with respect to disclosure of a record, means the use of such record for a purpose that is compatible with the purpose for which it was created. Statistical Record means a record in a system of records maintained only for statistical research or reporting purposes and not used, in whole or in part, in making any determination about an identifiable individual, except as provided by 13 U.S.C. 8. System of records means a group of records under the control of OFHEO from which information is retrieved by the name of the individual or some identifying number, symbol, or other identifying particular assigned to the individual. [63 FR 8844, Feb. 23, 1998. Redesignated and amended at 65 FR 81327, Dec. 26, 2000] Sec. 1702.3 Requests for access to individual records. (a) Any individual may request records about him/her that are maintained by OFHEO. (b) The procedures for submitting requests are as follows: (1) If the records are contained in a governmentwide system of records of the U.S. Office of Personnel Management (OPM), the request must be submitted as prescribed by the regulations of OPM (5 CFR part 297). (2) If the records are contained in a record in a system of records of another Federal agency, the request must be submitted as prescribed in the Federal Register Privacy Act notice for the specific governmentwide system. [[Page 905]] (3) If the records are contained in a system of records of OFHEO, the request must be submitted in writing to the Privacy Act Officer, Office of Federal Housing Enterprise Oversight, 1700 G Street, NW., Fourth Floor, Washington, DC 20552. The written request should describe the records sought and identify the designated systems of records in which such records may be contained. (A copy of the designated systems of records published by OFHEO in the Federal Register is available upon request from the Privacy Act Officer.) No individual shall be required to state a reason or otherwise justify a request for access to records about him/her. Sec. 1702.4 Decision to grant or deny requests for access to individual records. (a) Basis for the decision. The Privacy Act Officer shall grant access to records upon receipt of a request submitted under Sec. 1702.3(b)(3), unless the records-- (1) Were compiled in reasonable anticipation of a civil action or proceeding; or (2) Require special procedures for medical records provided for in Sec. 1702.5. (b) Notification procedures. (1) Within 20 business days of receipt of a request submitted under Sec. 1702.3(b)(3), the Privacy Act Officer shall send a written acknowledgment of receipt to the requesting individual. (2) As soon as reasonably possible, normally within 20 business days following receipt of the request, the Privacy Act Officer shall send a written notification that informs the individual whether the requested records exist and, if the requested records exist, whether access is granted or denied, in whole or in part. (c) Access procedures. If access is granted, in whole or in part, the Privacy Act Officer shall provide the individual with a reasonable period of time to inspect the records at OFHEO during normal business hours or shall mail a copy of the requested records to the individual. (d) Denial procedures. If access is denied, in whole or in part, the Privacy Act Officer shall inform the individual of the reasons for the denial and of the right to appeal the denial, as set forth in Sec. 1702.9. [63 FR 8844, Feb. 23, 1998. Redesignated and amended at 65 FR 81327, Dec. 26, 2000] Sec. 1702.5 Special procedures for medical records. The Privacy Act Officer shall grant access to medical records to the requesting individual to whom the medical records pertain. However, if, in the judgment of OFHEO, such direct access may have an adverse effect on that individual, the Privacy Act Officer shall transmit the medical records to a licensed medical doctor named by the individual. Sec. 1702.6 Requirements for verification of identity. (a) Written requests submitted in person. Any individual who submits in person a written request under this part, may be required to present two forms of identification, such as an employment identification card, driver's license, passport, or other document typically used for identification purposes. One of the two forms of identification must contain the individual's photograph and signature. (b) Other written requests. Any individual who submits, other than in person, a written request under this part may be required to provide either one or both of the following: (1) Minimal identifying information, such as full name, date and place of birth, or other personal information. (2) At the election of the individual, either a certification of a duly commissioned notary public of any State or territory or the District of Columbia attesting to the requesting individual's identity or an unsworn declaration subscribed to as true under penalty of perjury under the laws of the United States of America. Sec. 1702.7 Requests for amendment of individual records. (a) Procedures for requesting amendment of a record. Any individual may request amendment of any record about him/her that the individual believes is not accurate, relevant, timely, or complete. To request amendment, the individual must submit a written request to the Privacy Act Officer, Office of [[Page 906]] Federal Housing Enterprise Oversight, 1700 G Street, NW., Fourth Floor, Washington, DC 20552. The request should include-- (1) The reason for requesting the amendment; (2) A description of the record, or portion thereof, including the name of the appropriate designated system of records, sufficient to enable the Privacy Act Officer to identify the particular record or portion thereof; and (3) If available, a copy of the record, or portion thereof, on which the specific portion requested to be amended is notated. (b) Requirement for identifying information. The Privacy Act Officer may require the individual making the request for amendment to provide the identifying information specified in Sec. 1702.6. [63 FR 8844, Feb. 23, 1998. Redesignated and amended at 65 FR 81327, Dec. 26, 2000] Sec. 1702.8 Decision to grant or deny requests for amendment of individual records. (a) Notification procedures. Within 10 business days following receipt of a request for amendment of records, the Privacy Act Officer shall send a written acknowledgment of receipt to the requesting individual. As soon as reasonably possible, normally within 30 business days from the receipt of the request for amendment, the Privacy Act Officer shall send a written notification to the individual that informs him/her of the decision to grant or deny, in whole or in part, the request for amendment. (b) Amendment procedures. If the request is granted, in whole or in part, the requested amendment shall be made to the subject record. A copy of the amended record shall be provided to all prior recipients of the subject record in accordance with Sec. 1702.12(b). (c) Denial procedures. If the request is denied, in whole or in part, the Privacy Act Officer shall include in the written notification the reasons for the denial and an explanation of the right to appeal the denial, as set forth in Sec. 1702.9. [63 FR 8844, Feb. 23, 1998. Redesignated and amended at 65 FR 81327, Dec. 26, 2000] Sec. 1702.9 Appeals of the initial decision to deny access to or amendment of individual records. Any individual may appeal the initial denial, in whole or in part, of a request for access to or amendment of his/her record. To appeal, the individual must submit a written appeal, within 30 business days following receipt of written notification of denial, to the Privacy Act Appeals Officer, Office of Federal Housing Enterprise Oversight, 1700 G Street, NW., Fourth Floor, Washington, DC 20552. Both the envelope and the appeal request should be marked ``Privacy Act Appeal.'' The appeal should include-- (a) The information specified for requests for access in Sec. 1702.3(b)(3) or for requests for amendment in Sec. 1702.7, as appropriate; (b) A copy of the initial denial notice; and (c) Any other relevant information for consideration by the Privacy Act Appeals Officer. [63 FR 8844, Feb. 23, 1998. Redesignated and amended at 65 FR 81327, Dec. 26, 2000] Sec. 1702.10 Decision to grant or deny appeals. (a) Notification of decision. Within 30 business days following receipt of the appeal, the Privacy Act Appeals Officer shall send a written notification of the decision to grant or deny to the individual making the appeal. The Privacy Act Appeals Officer may extend the 30-day notification period for good cause. If the time period is extended, the Privacy Act Appeals Officer shall inform in writing the individual making the appeal of the reason for the extension and the expected date of the final decision. (b) Appeal granted. If the appeal for access is granted, in whole or in part, the Privacy Act Appeals Officer shall provide the individual with reasonable time to inspect the requested records at OFHEO during normal business hours or mail a copy of the requested records to the individual. If the appeal for amendment is granted, in whole or in part, the requested amendment shall be made. A copy of the amended record shall be provided to all prior recipients of the subject record in accordance with Sec. 1702.12(b). [[Page 907]] (c) Appeal denied. If the Privacy Act Appeals Officer denies, in whole or in part, the appeal for access or amendment, he/she shall include in the written notification of the reasons for the denial an explanation of the right to seek judicial review of the final decision, and, with respect to an appeal for amendment, the right to submit a statement of disagreement under paragraph (d) of this section. (d) Statements of disagreement and explanation. (1) Upon receipt of a decision to deny, in whole or in part, the appeal for amendment of records, the individual may file a statement with the Privacy Act Appeals Officer that sets forth his/her reasons for disagreeing with the decision. The Privacy Act Appeals Officer shall attach the statement of disagreement to the record that is the subject of the request for amendment. In response to the statement of disagreement, the Privacy Act Appeals Officer has the discretion to prepare a statement that explains why the requested amendment was not made. If prepared, the statement of explanation shall be attached to the subject record and a copy of the statement provided to the individual who filed the statement of disagreement. (2) The Privacy Act Appeals Officer shall provide a copy of any statement of disagreement, and may provide any statement of explanation, to prior recipients of the subject record in accordance with Sec. 1702.12(b). (e) Right to judicial review. If OFHEO does not comply with the notification procedures under paragraph (a) of this Sec. 1720.10 with respect to an appeal for amendment of records, the appealing individual may bring a civil action against OFHEO in the appropriate district court of the United States, as provided for under 5 U.S.C. 552a(g)(1)(A) and 552a(g)(5) before receiving the written notification of the decision. [63 FR 8844, Feb. 23, 1998. Redesignated and amended at 65 FR 81327, Dec. 26, 2000] Sec. 1702.11 Disclosure of individual records to other persons or agencies. (a) OFHEO may disclose a record to a person or agency other than the individual about whom the record pertains only under one or more of the following circumstances: (1) If requested and authorized in writing by the individual. (2) With the prior written consent of the individual. (3) If such disclosure is required under the Freedom of Information Act. (4) For a routine use, as defined in Sec. 1702.2, with respect to a designated system of records as described by OFHEO in its notice of systems of records published in the Federal Register. (5) Pursuant to the order of a court of competent jurisdiction. (6) To the following persons or agencies-- (i) Officers and employees of OFHEO who have a need for the record in the performance of their duties; (ii) The Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of title 13 of the United States Code; (iii) A recipient who has provided OFHEO with advance, adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable; (iv) The National Archives and Records Administration as a record which has sufficient historical or other value to warrant its continued preservation by the U.S. Government, or for evaluation by the Archivist of the United States to determine whether the record has such value; (v) An agency or an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to OFHEO specifying the particular portion of the record desired and the law enforcement activity for which the record is sought; (vi) A person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if, concurrently with such disclosure, notification is transmitted to the last known address of the individual to whom the record pertains; [[Page 908]] (vii) Either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress, or subcommittee of any such joint committee; (viii) The Comptroller General, or any of his/her authorized representatives, in the course of the performance of the duties of the General Accounting Office; or (ix) A consumer reporting agency in accordance with 31 U.S.C. 3711(e). (b) Before a record is disclosed to other persons or agencies under paragraph (a) (1) or (2) of this section, the identifying information specified in Sec. 1702.6 may be required. [63 FR 8844, Feb. 23, 1998. Redesignated and amended at 65 FR 81327, Dec. 26, 2000] Sec. 1702.12 Accounting of disclosures. (a) OFHEO shall keep an accurate accounting of the date, nature, and purpose of each disclosure of a record, and the name and address of each person or agency to whom a disclosure was made under Sec. 1702.11, except for disclosures made under Sec. 1702.11(a)(3) or (a)(6)(i). OFHEO shall retain such accounting for at least 5 years or the life of the record, whichever is longer, after the disclosure for which the accounting was made. (b) When a record has been amended, in whole or in part, or when a statement of disagreement has been filed, a copy of the amended record and any statement of disagreement must be provided, and any statement of explanation may be provided, to all prior and subsequent recipients of the affected record whose identities can be determined pursuant to the disclosure accountings required under paragraph (a) of this section. [63 FR 8844, Feb. 23, 1998. Redesignated and amended at 65 FR 81327, Dec. 26, 2000] Sec. 1702.13 Requests for accounting of disclosures. (a) Any individual may request an accounting of disclosures of records about him/her for which an accounting is required to be maintained under Sec. 1702.12(a) by submitting a written request to the Privacy Act Officer, Office of Federal Housing Enterprise Oversight, 1700 G Street, NW., Fourth Floor, Washington, DC 20552. Before processing the request, the Privacy Act Officer may require that the individual provide the identifying information specified under Sec. 1702.6. (b) The Privacy Act Officer shall make available the accounting of disclosures required to be maintained under Sec. 1702.12, except for an accounting made under Sec. 1702.11(a)(6)(v). [63 FR 8844, Feb. 23, 1998. Redesignated and amended at 65 FR 81327, Dec. 26, 2000] Sec. 1702.14 Fees. OFHEO shall not charge any fees for providing a copy of any records, pursuant to a request for access under this part. Sec. 1702.15 Preservation of records. OFHEO shall preserve all correspondence relating to the written requests it receives and all records processed pursuant to such requests under this part, in accordance with the records retention provisions of General Records Schedule 14, Informational Services Records. OFHEO shall not destroy records that are subject to a pending request for access, amendment, appeal, or lawsuit pursuant to the Privacy Act. Sec. 1702.16 Rights of parents and legal guardians. For purposes of this part, a parent of any minor or the legal guardian of any individual who has been declared to be incompetent due to physical or mental incapacity or age by a court of competent jurisdiction may act on behalf of the individual. Sec. 1702.17 Penalties. The Privacy Act (5 U.S.C. 552a(i)(3)) makes it a misdemeanor, subject to a maximum fine of $5,000, to knowingly and willfully request or obtain any record concerning an individual from OFHEO under false pretenses.