by Unknown
Federal agency of records provided in a matching program
by a source agency, including procedures governing return
of the records to the source agency or destruction of records
used in such program;
(J) information on assessments that have been made on the
accuracy of the records that will be used in such matching
program; and
(K) that the Comptroller General may have access to all records
of a recipient agency or a non-Federal agency that the
Comptroller General deems necessary in order to monitor
or verify compliance with the agreement.
(2)
(A) A copy of each agreement entered into pursuant to para-
graph (1) shall—
(i) be transmitted to the Committee on Governmental
Affairs of the Senate and the Committee on Government
Operations of the House of Representatives; and
(ii) be available upon request to the public.
(B) No such agreement shall be effective until 30 days after the
date on which such a copy is transmitted pursuant to sub-
paragraph (A)(i).
(C) Such an agreement shall remain in effect only for such
period, not to exceed 18 months, as the Data Integrity Board
of the agency determines is appropriate in light of the pur-
poses, and length of time necessary for the conduct, of the
matching program.
Appendix D: Consumer and Credit Data Privacy Laws
409
(D) Within 3 months prior to the expiration of such an agree-
ment pursuant to subparagraph (C), the Data Integrity
Board of the agency may, without additional review,
renew the matching agreement for a current, ongoing
matching program for not more than one additional
year if—
(i) such program will be conducted without any change; and
(i ) each party to the agreement certifies to the Board in writ-
ing that the program has been conducted in compliance
with the agreement.
(p) Verification and Opportunity to Contest Findings
(1) In order to protect any individual whose records are used in a
matching program, no recipient agency, non-Federal agency, or
source agency may suspend, terminate, reduce, or make a final
denial of any financial assistance or payment under a Federal
benefit program to such individual, or take other adverse action
against such individual, as a result of information produced by
such matching program, until—
(A) (i) the agency has independently verified the informa-
tion; or
(ii) the Data Integrity Board of the agency, or in the case of
a non-Federal agency the Data Integrity Board of the
source agency, determines in accordance with guid-
ance issued by the Director of the Office of Management
and Budget that—
(I) the information is limited to identification and
amount of benefits paid by the source agency under
a Federal benefit program; and
(II) there is a high degree of confidence that the informa-
tion provided to the recipient agency is accurate;
(B) the individual receives a notice from the agency containing
a statement of its findings and informing the individual of
the opportunity to contest such findings; and
(C) (i) the expiration of any time period established for the
program by statute or regulation for the individual to
respond to that notice; or
(ii) in the case of a program for which no such period is
established, the end of the 30-day period beginning
on the date on which notice under subparagraph (B) is
mailed or otherwise provided to the individual.
(2) Independent verification referred to in paragraph (1) requires
investigation and confirmation of specific information relat-
ing to an individual that is used as a basis for an adverse action
410
Appendix D: Consumer and Credit Data Privacy Laws
against the individual, including where applicable investigation
and confirmation of—
(A) the amount of any asset or income involved;
(B) whether such individual actually has or had access to such
asset or income for such individual’s own use; and
(C) the period or periods when the individual actually had such
asset or income.
(3) Notwithstanding paragraph (1), an agency may take any appro-
priate action otherwise prohibited by such paragraph if the
agency determines that the public health or public safety may be
adversely affected or significantly threatened during any notice
period required by such paragraph.
(q) Sanctions
(1) Notwithstanding any other provision of law, no source agency
may disclose any record which is contained in a system of records
to a recipient agency or non-Federal agency for a matching pro-
gram if such source agency has reason to believe that the require-
ments of subsection (p), or any matching agreement entered into
pursuant to subsection (o), or both, are not being met by such
recipient agency.
(2) No source agency may renew a matching agreement unless—
(A) the recipient agency or non-Federal agency has certified that
it has complied with the provisions of that agreement; and
(B) the source agency has no reason to believe that the certifica-
tion is inaccurate.
(r) Report on new systems and matching programs. Each agency that
proposes to establish or make a significant change in a system of
records or a matching program shall provide adequate advance
notice of any such proposal (in duplicate) to the Committee on
Government Operations of the House of Representatives, the
Committee on Governmental Affairs of the Senate, and the Office
of Management and Budget in order to permit an evaluation of the
probable or potential effect of such proposal on the privacy or other
rights of individuals.
(s) [Biennial report] Repealed by the Federal Reports Elimination and
Sunset Act of 1995, Pub. L. No. 104-66, § 3003, 109 Stat. 707, 734-36
(1995), amended by Pub. L. No. 106–113, § 236, 113 Stat. 1501, 1501A-302 (1999) (changing effective date to May 15, 2000).
(t) Effect of other laws
(1) No agency shall rely on any exemption contained in section 552
of this title to withhold from an individual any record which is
otherwise accessible to such individual under the provisions of
this section.
Appendix D: Consumer and Credit Data Privacy Laws
411
(2) No agency shall rely on any exemption in this section to with-
hold from an individual any record which is otherwise acces-
sible to such individual under the provisions of section 552 of
this title.
(u) Data Integrity Boards
(1) Every agency conducting or participating in a matching program
shall establish a Data Integrity Board to oversee and coordinate
among the various components of such agency the agency’s
implementation of this section.
(2) Each Data Integrity Board shall consist of senior officials des-
ignated by the head of the agency, and shall include any senior
> official designated by the head of the agency as responsible for
implementation of this section, and the inspector general of the
agency, if any. The inspector general shall not serve as chairman
of the Data Integrity Board.
(3) Each Data Integrity Board—
(A) shall review, approve, and maintain all written agreements
for receipt or disclosure of agency records for matching pro-
grams to ensure compliance with subsection (o), and all rel-
evant statutes, regulations, and guidelines;
(B) shall review all matching programs in which the agency
has participated during the year, either as a source agency
or recipient agency, determine compliance with applicable
laws, regulations, guidelines, and agency agreements, and
assess the costs and benefits of such programs;
(C) shall review all recurring matching programs in which the
agency has participated during the year, either as a source
agency or recipient agency, for continued justification for
such disclosures;
(D) shall compile an annual report, which shall be submitted to
the head of the agency and the Office of Management and
Budget and made available to the public on request, describ-
ing the matching activities of the agency, including—
(i) matching programs in which the agency has participated
as a source agency or recipient agency;
(i ) matching agreements proposed under subsection (o) that
were disapproved by the Board;
(i i) any changes in membership or structure of the Board in
the preceding year;
(iv) the reasons for any waiver of the requirement in para-
graph (4) of this section for completion and submission of
a cost-benefit analysis prior to the approval of a matching
program;
412
Appendix D: Consumer and Credit Data Privacy Laws
(v) any violations of matching agreements that have been
alleged or identified and any corrective action taken;
and
(vi) any other information required by the Director of the
Office of Management and Budget to be included in
such report;
(E) shall serve as a clearinghouse for receiving and providing
information on the accuracy, completeness, and reliability
of records used in matching programs;
(F) shall provide interpretation and guidance to agency compo-
nents and personnel on the requirements of this section for
matching programs;
(G) shall review agency recordkeeping and disposal policies and
practices for matching programs to assure compliance with
this section; and
(H) may review and report on any agency matching activities
that are not matching programs.
(4)
(A) Except as provided in subparagraphs (B) and (C), a Data
Integrity Board shall not approve any written agreement
for a matching program unless the agency has completed
and submitted to such Board a cost-benefit analysis of the
proposed program and such analysis demonstrates that the
program is likely to be cost effective.
(B) The Board may waive the requirements of subparagraph (A)
of this paragraph if it determines in writing, in accordance
with guidelines prescribed by the Director of the Office of
Management and Budget, that a cost-benefit analysis is not
required.
(C) A cost-benefit analysis shall not be required under subpara-
graph (A) prior to the initial approval of a written agreement
for a matching program that is specifical y required by statute.
Any subsequent written agreement for such a program shal
not be approved by the Data Integrity Board unless the agency
has submitted a cost-benefit analysis of the program as con-
ducted under the preceding approval of such agreement.
(5)
(A) If a matching agreement is disapproved by a Data Integrity
Board, any party to such agreement may appeal the disap-
proval to the Director of the Office of Management and
Budget. Timely notice of the filing of such an appeal shall be
provided by the Director of the Office of Management and
Appendix D: Consumer and Credit Data Privacy Laws
413
Budget to the Committee on Governmental Affairs of the
Senate and the Committee on Government Operations of
the House of Representatives.
(B) The Director of the Office of Management and Budget
may approve a matching agreement notwithstanding
the disapproval of a Data Integrity Board if the Director
determines that—
(i) the matching program will be consistent with all appli-
cable legal, regulatory, and policy requirements;
(i ) there is adequate evidence that the matching agreement
will be cost-effective; and
(iii) the matching program is in the public interest.
(C) The decision of the Director to approve a matching agree-
ment shall not take effect until 30 days after it is reported to
committees described in subparagraph (A).
(D) If the Data Integrity Board and the Director of the Office of
Management and Budget disapprove a matching program
proposed by the inspector general of an agency, the inspec-
tor general may report the disapproval to the head of the
agency and to the Congress.
(6) The Director of the Office of Management and Budget shall,
annually during the first 3 years after the date of enactment of
this subsection and biennially thereafter, consolidate in a report
to the Congress the information contained in the reports from
the various Data Integrity Boards under paragraph (3)(D). Such
report shall include detailed information about costs and ben-
efits of matching programs that are conducted during the period
covered by such consolidated report, and shall identify each
waiver granted by a Data Integrity Board of the requirement for
completion and submission of a cost-benefit analysis and the rea-
sons for granting the waiver.
(7) In the reports required by paragraphs (3)(D) and (6), agency match-
ing activities that are not matching programs may be reported on
an aggregate basis, if and to the extent necessary to protect ongo-
ing law enforcement or counterintelligence investigations.
(v) Office of Management and Budget Responsibilities
The Director of the Office of Management and Budget shall—
(1) develop and, after notice and opportunity for public comment,
prescribe guidelines and regulations for the use of agencies in
implementing the provisions of this section; and
(2) provide continuing assistance to and oversight of the implemen-
tation of this section by agencies.
414
Appendix D: Consumer and Credit Data Privacy Laws
The following section originally was part of the Privacy Act but was not codified; it may be found at § 552a (note).
§. 7(a)
(1) It shall be unlawful for any Federal, State or local government agency to deny to any individual any right, benefit, or privilege provided by
law because of such individual’s refusal to disclose his social secu-
rity ac
count number.
(2) The provisions of paragraph (1) of this subsection shall not apply
with respect to—
(A) any disclosure which is required by Federal statute, or
(B) any disclosure of a social security number to any Federal,
State, or local agency maintaining a system of records in
existence and operating before January 1, 1975, if such dis-
closure was required under statute or regulation adopted
prior to such date to verify the identity of an individual.
(b) Any Federal, State or local government agency which requests an
individual to disclose his social security account number shall
inform that individual whether that disclosure is mandatory or
voluntary, by what statutory or other authority such number is
solicited, and what uses will be made of it.
The following sections originally were part of P.L. 100-503, the Computer Matching and Privacy Protection Act of 1988; they may be found at § 552a (note).
§. 6 Functions of the Director of the Office
of Management and Budget
(b) Implementation Guidance for Amendments—The Director
shall, pursuant to section 552a(v) of Title 5, United States Code,
develop guidelines and regulations for the use of agencies in
implementing the amendments made by this Act not later than 8
months after the date of enactment of this Act.
§. 9 Rules of Construction
Nothing in the amendments made by this Act shall be construed to
authorize—
(1) the establishment or maintenance by any agency of a national data
bank that combines, merges, or links information on individuals
maintained in systems of records by other Federal agencies;