Comptroller General in the course of the performance of the duties of the General Accounting Office; or (k) Pursuant to the order of a court of competent jurisdiction. (1) To consumer reporting agencies as defined in the Fair Credit Reporting Act (35 U.S.C. 1681a(f) or the Debt Collection Act of 1982 (31 U.S.C. 3711(d)(4)). [44 FR 50293, Aug. 27, 1979, as amended at 48 FR 44543, Sept. 29, 1983; 50 FR 40006, Oct. 1, 1985] §6.21 Procedures for disclosure. (a) Upon receipt of a request for disclosure, the system manager shall verify the right of the requestor to obtain disclosure pursuant to §6.20. Upon that verification and subject to other requirements of this part, the system manager shall make the requested records available. (b) If the system manager determines that the disclosure is not permitted under the provisions of §6.20 or other provisions of this part, the system manager shall deny the request in writing and shall inform the requestor of the right to submit a request for review and final determination to the Director or designee. §6.22 Accounting of disclosures. (a) Except for disclosures made pursuant to §6.20 (a) and (b), an accurate accounting of each disclosure shall be made and retained for 5 years after the disclosure or for the life of the record, whichever is longer. The accounting shall include the date, nature, and purpose of each disclosure, and the name and address of the person or agency to whom the disclosure is made; (b) The system manager also shall maintain in conjunction with the accounting of disclosures; (1) A full statement of the justification for the disclosure. (2) All documentation surrounding disclosure of a record for statistical or law enforcement purposes; and (3) Evidence of written consent to a disclosure given by the subject individual. (c) Except for the accounting of disclosures made to agencies or instrumentalities in law enforcement activities in accordance with §6.20 (g) or of disclosures made from exempt systems the accounting of disclosures shall be made available to the individual upon request. Procedures for requesting access to the accounting are in subpart C of this part. Subpart C-Individual Access to Records $6.30 Form of requests. (a) An individual who seeks access to his or her record or to any information pertaining to the individual which is contained in a system of records should notify the system manager at the address indicated in the FEDERAL REGISTER notice describing the pertinent system. The notice should bear the legend "Privacy Act Request” both on the request letter and on the envelope. It will help in the processing of a request if the request letter contains the complete name and identifying number of the system as published in the FEDERAL REGISTER; the full name and address of the subject individual; a brief description of the nature, time, place, and circumstances of the individual's association with FEMA; and any other information which the individual believes would help the system manager to determine whether the information about the individual is included in the system of records. The system manager shall answer or acknowledge the request within 10 workdays of its receipt by FEMA. (b) The system manager, at his discretion, may accept oral requests for access subject to verification of identity. § 6.31 Special requirements for medical records. (a) A system manager who receives a request from an individual for access to those official medical records which belong to the U.S. Office of Personnel Management and are described in Chapter 339, Federal Personnel Manual (medical records about entrance qualifications or fitness for duty, or medical records which are otherwise filed in the Official Personnel Folder), shall refer the pertinent system of records to a Federal Medical Officer for review and determination in accordance with this section. If no Federal Medical Officer is available to make the determination required by this section, the system manager shall refer the request and the medical reports concerned to the Office of Personnel Management for determination. (b) If, in the opinion of a Federal Medical Officer, medical records requested by the subject individual indicate a condition about which a prudent physician would hesitate to inform a person suffering from such a condition of its exact nature and probable outcome, the system manager shall not release the medical information to the subject individual nor to any person other than a physician designated in writing by the subject individual, or the guardian or conservator of the individual. (c) If, in the opinion of a Federal Medical Officer, the medical information does not indicate the presence of any condition which would cause a prudent physician to hesitate to inform a person suffering from such a condition of its exact nature and probable outcome, the system manager shall release it to the subject individual or to any person, firm, or organization which the individual authorizes in writing to receive it. §6.32 Granting access. (a) Upon receipt of a request for access to non-exempt records, the system manager shall make these records available to the subject individual or shall acknowledge the request within 10 workdays of its receipt by FEMA. The acknowledgment shall indicate when the system manager will make the records available. (b) If the system manager anticipates more than a 10 day delay in making a record available, he or she also shall include in the acknowledgment specific reasons for the delay. (c) If a subject individual's request for access does not contain sufficient information to permit the system manager to locate the records, the system manager shall request additional information from the individual and shall have 10 workdays following receipt of the additional information in which to make the records available or to acknowledge receipt of the request and indicate when the records will be available. (d) Records will be available for authorized access during normal business hours at the offices where the records are located. A requestor should be prepared to identify himself or herself by signature; i.e., to note by signature the date of access and/or produce other identification verifying the signature. (e) Upon request, a system manager shall permit an individual to examine the original of a non-exempt record, shall provide the individual with a copy of the record, or both. Fees shall be charged in accordance with subpart F. (f) An individual may request to pick up a record in person or to receive it by mail, directed to the name and address provided by the individual in the request. A system manager shall not make a record available to a third party for delivery to the subject individual except for medical records as outlined in §6.31. (g) An individual who selects another person to review, or to accompany the individual in reviewing or obtaining a copy of the record must, prior to the disclosure, sign a statement authorizing the disclosure of the record. The system manager shall maintain this statement with the record. (h) The procedure for access to an accounting of disclosure is identical to the procedure for access to a record as set forth in this section. $6.33 Denials of access. (a) A system manager may deny an individual access to that individual's record only upon the grounds that FEMA has published the rules in the FEDERAL REGISTER exempting the pertinent system of records from the access requirement. These exempt systems of records are described in subpart G of this part. (b) Upon receipt of a request for access to a record which the system manager believes is contained within an exempt system of records he or she shall forward the request to the appropriate official listed below or to his or her delegate through normal supervisory channels. (1) Deputy Director (2) [Reserved] (3) Federal Insurance Administrator (4) Associate Directors (5) United States Fire Administrator (6) Chief of Staff (7) Office Directors (11) Regional Directors The system manager shall append to the request an explanation of the determination that the requested record is contained within an exempt system of records and a recommendation that the request be denied or granted. (c) In the event that the system manager serves in one of the positions listed in paragraph (b) of this section, he or she shall retain the responsibility for denying or granting the request. (d) The appropriate official listed in paragraph (b) of this section shall, in consultation with the Office of General Counsel and such other officials as deemed appropriate, determine if the request record is contained within an exempt system of records and: (1) If the record is not contained within an exempt system of records, the above official shall notify the system manager to grant the request in accordance with §6.32, or (2) If the record is contained within an exempt system said official shall; (i) Notify the requestor that the request is denied, including a statement justifying the denial and advising the requestor of a right to judicial review of that decision as provided in §6.57, or (ii) Notify the system manager to make record available to the requestor in accordance with §6.31, notwithstanding the record's inclusion within an exempt system. (e) The appropriate official listed in paragraph (b) of this section shall provide the Privacy Appeals Office with a copy of any denial of a requested ac cess. [44 FR 50293, Aug. 27, 1979, as amended at 48 FR 44543, Sept. 29, 1983; 50 FR 40006, Oct. 1, 1985; 51 FR 34604, Sept. 30, 1986] §6.34 Appeal of denial of access within FEMA. A requestor denied access in whole or in part, to records pertaining to that individual, exclusive of those records for which the system manager is the Director, may file an administrative appeal of that denial. Appeals of denied access will be processed in the same manner as processing for appeals from a denial of a request to amend a record set out in §6.55, regardless whether the denial being appealed is made at headquarters or by a regional official. Subpart D-Requests To Amend Records §6.50 Submission of requests to amend records. An individual who desires to amend any record containing personal information about the individual should direct a written request to the system manager specified in the pertinent FEDERAL REGISTER notice concerning FEMA's systems of records. A current FEMA employee who desires to amend personnel records should submit a written request to the FEMA Director of Personnel, Washington, DC 20472. Each request should include evidence of and justification for the need to amend the pertinent record. Each request should bear the legend "Privacy Act-Request to Amend Record" prominently marked on both the face of the request letter and the envelope. $6.51 Review of requests to amend records. (a) The system manager shall acknowledge the receipt of a request to amend a record within 10 workdays. If possible, the acknowledgment shall include the system manager's determination either to amend the record or to deny the request to amend as provided in §6.53. (b) When reviewing a record in response to a request to amend, the system manager shall assess the accuracy, relevance, timeliness, and completeness of the existing record in light of the proposed amendment and shall determine whether the request for the amendment is justified. With respect to a request to delete information, the system manager also shall review the request and the existing record to determine whether the information is relevant and necessary to accomplish an agency purpose required to be accomplished by statute or Executive Order. §6.52 Approval of requests to amend records. If the system manager determines that amendment of a record is proper in accordance with the request to amend, he or she promptly shall make the necessary corrections to the record and shall send a copy of the corrected record to the individual. Where an accounting of disclosure has been maintained, the system manager shall advise all previous recipients of the record of the fact that a correction has been made and the substance of the correction. Where practicable, the system manager shall advise the Privacy Appeals Officer that a request to amend has been approved. §6.53 Denial of requests to amend records. (a) If the system manager determines that an amendment of a record is improper or that the record should be amended in a manner other than that requested by an individual, he shall refer the request to amend and his determinations and recommendations to a (b) If the official listed in §6.33, after reviewing the request to amend record, determines to amend the record in accordance with the request, said official promptly shall return the request to the system manager with instructions to make the requested amendments in accordance with §6.52. (c) If the appropriate official listed in §6.33, after reviewing the request to amend a record, determines not to amend the record in accordance with the request, the requestor shall be promptly advised in writing of the determination. The refusal letter (1) shall state the reasons for the denial of the request to amend; (2) shall include proposed alternative amendments, if appropriate; (3) shall state the requestor's right to appeal the denial of the request to amend; and (4) shall state the procedures for appealing and the name and title of the official to whom the appeal is to be addressed. (d) The appropriate official listed in §6.33 shall furnish the Privacy Appeals Officer a copy of each initial denial of a request to amend a record. [44 FR 50293, Aug. 27, 1979, as amended at 45 FR 17152, Mar. 18, 1980] §6.54 Agreement to alternative amend ments. If the denial of a request to amend a record includes proposed alternative amendments, and if the requestor agrees to accept them, he or she must notify the official who signed the denial. That official immediately shall instruct the system manager to make the necessary amendments in accordance with §6.52. §6.55 Appeal of denial of request to amend a record. (a) A requestor who disagrees with a denial of a request to amend a record may file an administrative appeal of that denial. The requestor should address the appeal to the FEMA Privacy Appeals Officer, Washington, DC 20472. If the requestor is an employee of FEMA and the denial to amend involves a record maintained in the employee's Official Personnel Folder covered by an Office of Personnel Management Government-wide system notice, the appeal should be addressed to the Assistant Director, Information Systems, Agency Compliance and Evaluation Group, Office of Personnel Management, Washington, DC 20415. (b) Each appeal to the Privacy Act Appeals Officer shall be in writing and must be received by FEMA no later than 30 calendar days from the requestor's receipt of a denial of a request to amend a record. The appeal should bear the legend "Privacy Act-Appeal," both on the face of the letter and the envelope. (c) Upon receipt of an appeal, the Privacy Act Appeals Officer shall consult with the system manager, the official who made the denial, the General Counsel or a member of that office, and such other officials as may be appropriate. If the Privacy Act Appeals Officer in consultation with these officials, determines that the record should be amended, as requested, the system manager shall be instructed immediately to amend the record in accordance with §6.52 and shall notify the requestor of that action. (d) If the Privacy Act Appeals Officer, in consultation with the officials specified in paragraph (c) of this section, determines that the appeal should be rejected, the Privacy Act Appeals Officer shall submit the file on the request and appeal, including findings and recommendations, to the Deputy Director for a final administrative determination. (e) If the Deputy Director determines that the record should be amended as requested, he or she immediately shall instruct the system manager in writing to amend the record in accordance with §6.52. The Deputy Director shall send a copy of those instructions to the Privacy Act Appeals Officer, who shall notify the requester of that action. (f) If the Deputy Director determines to reject the appeal, the requestor shall immediately be notified in writing of that determination. This action shall constitute the final administrative determination on the request to amend the record and shall include: (1) The reasons for the rejection of the appeal. Proposed (2) alternative amendments, if appropriate, which the requestor subsequently may accept in accordance with §6.54. (3) Notice of the requestor's right to file a Statement of Disagreement for distribution in accordance with §6.56. (4) Notice of the requestor's right to seek judicial review of the final administrative determination, as provided in §6.57. (g) The final agency determination must be made no later than 30 workdays from the date on which the appeal is received by the Privacy Act Appeals Officer. (h) In extraordinary circumstances, the Director may extend this time limit by notifying the requestor in writing before the expiration of the 30 workdays. The Director's notification will include a justification for the extension. [44 FR 50293, Aug. 27, 1979, as amended at 45 FR 17152, Mar. 18, 1980] §6.56 Statement of disagreement. Upon receipt of a final administrative determination denying a request to amend a record, the requestor may file a Statement of Disagreement with the appropriate system manager. The Statement of Disagreement should include an explanation of why the requestor believes the record to be inaccurate, irrelevant, untimely, or incomplete. The system manager shall maintain the Statement of Disagreement in conjunction with the pertinent record, and shall include a copy of the Statement of Disagreement in any disclosure of the pertinent record. The system manager shall provide a copy of the Statement of Disagreement to any person or agency to whom the record has been disclosed only if the disclosure was subject to the accounting requirements of § 6.22. §6.57 Judicial review. Within 2 years of receipt of a final administrative determination as provided in §6.34 or §6.55, a requestor may seek judicial review of that determination. A civil action must be filed in the Federal District Court in which the requestor resides or has his or her principal place of business or in which the agency records are situated, or in the District of Columbia. Subpart E-Report on New Systems and Alterations of Existing Systems $6.70 Reporting requirement. (a) No later than 90 calendar days prior to the establishment of a new system of records, the prospective system manager shall notify the Privacy Appeals Officer of the proposed new system. The prospective system manager shall include with the notification a completed FEMA Form 11-2, System of Records Covered by the Privacy Act of 1974, and a justification for each system of records proposed to be established. If the Privacy Appeals Officer determines that the establishment of the proposed system is in the best interest of the Government, then no later than 60 calendar days prior to the establishment of that system of records, a report of the proposal shall be submitted by the Director or a designee thereof, to the President of the Senate, the Speaker of the House of Representatives, and the Administrator, Office of Information and Regulatory Affairs, Office of Management and Budget for |