by Unknown
396
Appendix D: Consumer and Credit Data Privacy Laws
(vi) matches performed for foreign counterintelligence pur-
poses or to produce background checks for security
clearances of Federal personnel or Federal contractor
personnel;
(vii) matches performed incident to a levy described in sec-
tion 6103(k)(8) of the Internal Revenue Code of 1986; or
(vi i) matches performed pursuant to section 202(x)(3) or
1611(e)(1) of the Social Security Act (42 U.S.C. § 402(x)(3),
§ 1382(e)(1));
(9) the term “recipient agency” means any agency, or contractor
thereof, receiving records contained in a system of records from
a source agency for use in a matching program;
(10) the term “non-Federal agency” means any State or local govern-
ment, or agency thereof, which receives records contained in a
system of records from a source agency for use in a matching
program;
(11) the term “source agency” means any agency which discloses
records contained in a system of records to be used in a match-
ing program, or any State or local government, or agency thereof,
which discloses records to be used in a matching program;
(12) the term “Federal benefit program” means any program admin-
istered or funded by the Federal Government, or by any agent
or State on behalf of the Federal Government, providing cash or
in-kind assistance in the form of payments, grants, loans, or loan
guarantees to individuals; and
(13) the term “Federal personnel” means officers and employees of
the Government of the United States, members of the uniformed
services (including members of the Reserve Components),
individuals entitled to receive immediate or deferred retirement
benefits under any retirement program of the Government of the
United States (including survivor benefits).
(b) Conditions of disclosure. No agency shall disclose any record
which is contained in a system of records by any means of com-
munication to any person, or to another agency, except pursuant
to a written request by, or with the prior written consent of, the
individual to whom the record pertains, unless disclosure of the
record would be—
(1) to those officers and employees of the agency which maintains
the record who have a need for the record in the performance of
their duties;
(2) required under section 552 of this title;
(3) for a routine use as defined in subsection (a)(7) of this section
and described under subsection (e)(4)(D) of this section;
Appendix D: Consumer and Credit Data Privacy Laws
397
(4) to the Bureau of the Census for purposes of planning or carrying
out a census or survey or related activity pursuant to the provisions
of Title 13;
(5) to a recipient who has provided the agency with advance adequate
written assurance that the record will be used solely as a statisti-
cal research or reporting record, and the record is to be trans-
ferred in a form that is not individually identifiable;
(6) to the National Archives and Records Administration as a record
which has sufficient historical or other value to warrant its
continued preservation by the United States Government, or
for evaluation by the Archivist of the United States or the des-
ignee of the Archivist to determine whether the record has
such value;
(7) to another agency or to an instrumentality of any governmental
jurisdiction within or under the control of the United States for a
civil or criminal law enforcement activity if the activity is autho-
rized by law, and if the head of the agency or instrumentality has
made a written request to the agency which maintains the record
specifying the particular portion desired and the law enforce-
ment activity for which the record is sought;
(8) to a person pursuant to a showing of compelling circumstances
affecting the health or safety of an individual if upon such dis-
closure notification is transmitted to the last known address of
such individual;
(9) to either House of Congress, or, to the extent of matter within
its jurisdiction, any committee or subcommittee thereof, any
joint committee of Congress or subcommittee of any such joint
committee;
(10) to the Comptroller General, or any of his authorized represen-
tatives, in the course of the performance of the duties of the
General Accounting Office;
(11) pursuant to the order of a court of competent jurisdiction; or
(12) to a consumer reporting agency in accordance with section
3711(e) of Title 31.
(c) Accounting of Certain Disclosures. Each agency, with respect to
each system of records under its control, shall—
(1) except for disclosures made under subsections (b)(1) or (b)(2) of
this section, keep an accurate accounting of—
(A) the date, nature, and purpose of each disclosure of a record
to any person or to another agency made under subsection
(b) of this section; and
(B) the name and address of the person or agency to whom the
disclosure is made;
398
Appendix D: Consumer and Credit Data Privacy Laws
(2) retain the accounting made under paragraph (1) of this subsec-
tion for at least five years or the life of the record, whichever is
longer, after the disclosure for which the accounting is made;
(3) except for disclosures made under subsection (b)(7) of this sec-
tion, make the accounting made under paragraph (1) of this
subsection available to the individual named in the record at his
request; and
(4) inform any person or other agency about any correction or nota-
tion of dispute made by the agency in accordance with subsection
(d) of this section of any record that has been disclosed to the
person or agency if an accounting of the disclosure was made.
(d) Access to records. Each agency that maintains a system of records
shall—
(1) upon request by any individual to gain access to his record or
to any information pertaining to him which is contained in the
system, permit him and upon his request, a person of his own
choosing to accompany him, to review the record and have a
copy made of all or any portion thereof in a form comprehen-
sible to him, except that the agency may require the individual to
furnish a written statement authorizing discussion of that indi-
vidual’s record in the accompanying person’s presence;
(2) permit the individual to request amendment of a record pertain-
ing to him and—
(A) not later than 10 days (excluding Saturdays, Sundays, and
legal public holidays) after the date of receipt of such request,
acknowledge in writing such receipt; and
(B) promptly, either—
(i) make any correction of any portion thereof which the
individual believes is not accurate, relevant, timely, or
complete; or
(ii) inform the individual of its refusal to amend the record
in accor
dance with his request, the reason for the
refusal, the procedures established by the agency for
the individual to request a review of that refusal by the
head of the agency or an officer designated by the head
of the agency, and the name and business address of
that official;
(3) permit the individual who disagrees with the refusal of the
agency to amend his record to request a review of such refusal,
and not later than 30 days (excluding Saturdays, Sundays, and
legal public holidays) from the date on which the individual
requests such review, complete such review and make a final
determination unless, for good cause shown, the head of the
Appendix D: Consumer and Credit Data Privacy Laws
399
agency extends such 30-day period; and if, after his review,
the reviewing official also refuses to amend the record in
accordance with the request, permit the individual to file
with the agency a concise statement setting forth the rea-
sons for his disagreement with the refusal of the agency, and
notify the individual of the provisions for judicial review of
the reviewing official’s determination under subsection (g)(1)
(A) of this section;
(4) in any disclosure, containing information about which the indi-
vidual has filed a statement of disagreement, occurring after
the filing of the statement under paragraph (3) of this subsec-
tion, clearly note any portion of the record which is disputed and
provide copies of the statement and, if the agency deems it
appropriate, copies of a concise statement of the reasons of the
agency for not making the amendments requested, to persons
or other agencies to whom the disputed record has been dis-
closed; and
(5) nothing in this section shall allow an individual access to any
information compiled in reasonable anticipation of a civil action
or proceeding.
(e) Agency requirements. Each agency that maintains a system of
records shall—
(1) maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency
required to be accomplished by statute or by Executive order of
the President;
(2) collect information to the greatest extent practicable directly
from the subject individual when the information may result
in adverse determinations about an individual’s rights, benefits,
and privileges under Federal programs;
(3) inform each individual whom it asks to supply information, on
the form which it uses to collect the information or on a separate
form that can be retained by the individual—
(A) the authority (whether granted by statute, or by Executive
order of the President) which authorizes the solicitation of
the information and whether disclosure of such information
is mandatory or voluntary;
(B) the principal purpose or purposes for which the information
is intended to be used;
(C) the routine uses which may be made of the information, as
published pursuant to paragraph (4)(D) of this subsection; and
(D) the effects on him, if any, of not providing all or any part of
the requested information;
400
Appendix D: Consumer and Credit Data Privacy Laws
(4) subject to the provisions of paragraph (11) of this subsection,
publish in the Federal Register upon establishment or revision
a notice of the existence and character of the system of records,
which notice shall include—
(A) the name and location of the system;
(B) the categories of individuals on whom records are maintained
in the system;
(C) the categories of records maintained in the system;
(D) each routine use of the records contained in the sys-
tem, including the categories of users and the purpose of
such use;
(E) the policies and practices of the agency regarding storage,
retrievability, access controls, retention, and disposal of the
records;
(F) the title and business address of the agency official who is
responsible for the system of records;
(G) the agency procedures whereby an individual can be noti-
fied at his request if the system of records contains a record
pertaining to him;
(H) the agency procedures whereby an individual can be notified
at his request how he can gain access to any record pertain-
ing to him contained in the system of records, and how he
can contest its content; and
(I) the categories of sources of records in the system;
(5) maintain all records which are used by the agency in making
any determination about any individual with such accuracy, rel-
evance, timeliness, and completeness as is reasonably necessary
to assure fairness to the individual in the determination;
(6) prior to disseminating any record about an individual to any
person other than an agency, unless the dissemination is made
pursuant to subsection (b)(2) of this section, make reasonable
efforts to assure that such records are accurate, complete, timely,
and relevant for agency purposes;
(7) maintain no record describing how any individual exercises
rights guaranteed by the First Amendment unless expressly
authorized by statute or by the individual about whom the record
is maintained or unless pertinent to and within the scope of an
authorized law enforcement activity;
(8) make reasonable efforts to serve notice on an individual when
any record on such individual is made available to any person
under compulsory legal process when such process becomes a
matter of public record;
Appendix D: Consumer and Credit Data Privacy Laws
401
(9) establish rules of conduct for persons involved in the design,
development, operation, or maintenance of any system of records,
or in maintaining any record, and instruct each such person with
respect to such rules and the requirements of this section, includ-
ing any other rules and procedures adopted pursuant to this sec-
tion and the penalties for noncompliance;
(10) establish appropriate administrative, technical and physical
safeguards to insure the security and confidentiality of records
and to protect against any anticipated threats or hazards to their
security or integrity which could result in substantial harm,
embarrassment, inconvenience, or unfairness to any individual
on whom information is maintained;
(11) at least 30 days prior to publication of information under
paragraph (4)(D) of this subsection, publish in the Federal
Register notice of any new use or intended use of the informa-
tion in the system, and provide an opportunity for interested
persons to submit written data, views, or arguments to the
agency; and
(12) if such agency is a recipient agency or a source agency in a
matching program with a non-Federal agency, with respect to
any establishment or revision of a matching program, at least 30
days prior to conducting such program, publ
ish in the Federal
Register notice of such establishment or revision.
(f) Agency rules. In order to carry out the provisions of this section, each agency that maintains a system of records shall promulgate rules, in
accordance with the requirements (including general notice) of sec-
tion 553 of this title, which shall—
(1) establish procedures whereby an individual can be notified in
response to his request if any system of records named by the
individual contains a record pertaining to him;
(2) define reasonable times, places, and requirements for identifying
an individual who requests his record or information pertaining
to him before the agency shall make the record or information
available to the individual;
(3) establish procedures for the disclosure to an individual upon his
request of his record or information pertaining to him, including
special procedure, if deemed necessary, for the disclosure to an
individual of medical records, including psychological records,
pertaining to him;
(4) establish procedures for reviewing a request from an individual
concerning the amendment of any record or information per-
taining to the individual, for making a determination on the
402
Appendix D: Consumer and Credit Data Privacy Laws
request, for an appeal within the agency of an initial adverse
agency determination, and for whatever additional means may
be necessary for each individual to be able to exercise fully his
rights under this section; and
(5) establish fees to be charged, if any, to any individual for mak-
ing copies of his record, excluding the cost of any search for and
review of the record.