Authorities and Guidance

1. In the case of "personnel and medical and similar files, the disclosure would be a clearly unwarranted invasion of personal privacy" under 5 U.S.C. § 552(b)(6); or;
2. In the case of law enforcement investigatory records, the disclosure would "constitute an unwarranted invasion of personal privacy" under 5 U.S.C. § 552(b)(7)(C).

For example, information relating to persons missing in action or otherwise unaccounted for may be disclosed "pursuant to the order of a court of competent jurisdiction." 5 U.S.C. 552a(b)(11). [For a discussion of "order of a court of competent jurisdiction," see Defense Privacy Board Advisory Opinion 34.] In a case involving the families of military personnel missing in action, one court ordered, in part, that next of kin receiving governmental financial benefits which could be terminated by a status review be afforded "reasonable access to the information upon which the status review will be based." McDonald v. McLucas, 371 F. Supp. 831, 836 (S.D.N.Y. 1974). Since a status review is likely to require access to almost all significant information in a system of records pertaining to a member missing in action, this order constitutes sufficient authority under the Privacy Act for disclosure of almost any personal records of interest.

Information in a system of records also may be available to any person under the Freedom of Information Act (FOIA) if disclosure of the records concerned does not constitute a clearly unwarranted invasion of personal privacy. 5 U.S.C. 552(b)(6); 5 U.S.C. 552a(b)(2). In determining what information must be disclosed under this standard, a balancing test weighing the public interest in disclosure against the potential invasion of personal privacy should be conducted. See DoD 5400.7?R, paragraph 3?200, No. 6. See, e.g., Department of the Air Force v. Rose, 425 U.S. 352, 96 S. Ct. 1592, 48 L. Ed.2d 11 (1976); Church of Scientology v. Department of Defense, 611 F.2d 738 (9th Cir. 1979). Because facts and needs will differ in each case, the balancing test may require disclosure of information in one circumstance but not in another. See Getman v. National Labor Relations Board, 450 F.2d 670 (D.C. Cir. 1971); Robles v. Environmental Protection Agency, 484 F.2d 843 (4th Cir. 1973); Wine Hobby, USA, Inc. v. Bureau of Alcohol, Tobacco and Firearms, 502 F.2d 133 (3rd Cir. 1974).

Due to the unusual circumstances involved when a service member is missing in action or otherwise unaccounted for, next of kin may have a more compelling case for disclosure of a requested record than would other third parties. However, each request must be evaluated on its own merits.

Should the record subject's status be changed to "deceased," see Defense Privacy Board Advisory Opinion 2 concerning application of the Privacy Act and FOIA to decedents' records.

Reserve components of the Army and the Air Force include the Army and Air National Guards of the United States respectively, which are composed of federally recognized units and organizations of the Army or Air National Guard and members of the Army or Air National Guard who are also Reserves of the Army or Air Force. 10 U.S.C. §§ 3077 and 8077. 10 U.S.C. § 275 requires the Departments of the Army and the Air Force to maintain personnel records on all members of the federally recognized units and organizations of the Army and Air National Guards and on all members of the Army or Air National Guards who are also reserves of the Army and Air Force. Such records are "maintained" by the Army or Air Force for the purposes of the Privacy Act. These records are not all located at the National Guard Bureau. Some are in the physical possession of the state adjutant general. However, records need not be physically located in the agency for them to be maintained by the agency. See OMB Guidelines. Records located at the state level are under the direct control of the Army and Air Force in that they are maintained by the state under regulations (NGR 600 200 and AFR 35 44) implementing 10 U.S.C. § 275, and promulgated by authority of the Secretaries of the Army and the Air Force under 10 U.S.C. § 280. Therefore, the records are Army or Air Force records and subject to the provisions of the Privacy Act.

That the records are subject to the Privacy Act does not mean they cannot be used by the members of the state national guards. The state officials using and maintaining the records are members of the reserves (members of the Army or Air Force National Guard of the United States). Disclosure to them in performance of their duties is disclosure within the Department of Defense not requiring a published routine use or an accounting.

Therefore, charging fees is discretionary. However, as a general policy, the Department of Defense should not charge Members of Congress for records furnished when requested under the Privacy Act, unless the charge would be substantial. In no event should a fee less than $30.00 be determined substantial. In the case of constituent inquiries involving a substantial fee, a suggestion may be made that the Member of Congress advise the constituent that the information may be obtained by writing the appropriate office and paying reproduction costs. Additionally, the record may be examined at no cost if the constituent wishes to visit the record custodian.

However, the service record entry for home of record is intended to reflect the member's home at the time of entry into service or order to active duty. The Member of Congress or Congressional staff member may be more interested in the service member's legal residence for voting purposes or as entered on a W 4 form and as reflected by the member's pay record. Disclosure of home of record information to a Member of Congress or a Congressional staff member should include a caveat that it reflects only the home address at the time of entry into service or order to active duty.

The problem should not be resolved on a DoD wide scale because the formulation of specific procedures for disclosure accounting will involve consideration of a number of factors which will vary among the military departments and other DoD components. The factors include internal organizational relationships, the components' prescribed methods and responsibilities for responding to Congressional inquiries, and possibly the characteristics of the particular records and record systems involved.

The liaison activity should prepare a disclosure accounting and forward it to the custodian. The accounting should contain the name and address of the person to whom the disclosure was made and the Member of Congress for whom he or she works, as well as the date, nature and purpose of the disclosure. The name, rank, title and duty address of the person making the disclosure also should be included. The accounting must be kept for five years or the life of the record, whichever is longer.

The Privacy Act provides that "the parent of any minor . . . may act on behalf of the individual." 5 U.S.C. § 552a(h). This subsection ensures that minors have a means of exercising their rights under the Privacy Act. Office of Management and Budget Privacy Act Guidelines (OMB Guidelines), 40 Fed. Reg. 28949, 28970 (July 9, 1975). It does not preclude minors from exercising rights on their own behalf, independent of any parental exercise. Parental exercise of the minor's Privacy Act rights is discretionary. A Department of Defense (DoD) component may permit parental exercise of a minor's Privacy Act rights at its discretion, but the parent has no absolute right to exercise the minor's rights absent a court order or the minor's consent. See OMB Guidelines, 40 Fed. Reg. 56741, 56742 (December 4,1975). Further, the parent exercising a minor's rights under the Privacy Act must be doing so on behalf of the minor and not merely for the parent's benefit. DePlanche v. Califano, 549 F. Supp. 685 (W.D. Mich. 1982).

The age at which an individual is no longer a minor becomes crucial when an agency must determine whether a parent may exercise the individual's Privacy Act rights. With respect to records maintained by DoD components, the age of majority is 18 years unless a court order states otherwise or the individual, at an earlier age, marries, enlists in the military, or takes some other action that legally signifies attainment of majority status. Once an individual attains the age of majority, Privacy Act rights based solely on parenthood cease.

The Office of Management and Budget Privacy Act Guidelines, 40 Fed. Reg. 28949, 28973 (July 9, 1975), contain language from the Congressional Record suggesting that the record subject can learn the "substance and source of confidential information" if that information is used to deny him some right, benefit or privilege. However, such language does not refer to Privacy Act compliance. It refers to the possibility that revealing the identity of the confidential source might be required by due process or discovery rules in the course of an administrative or judicial challenge to an adverse action based on information supplied by the source.

Neither the Privacy Act nor the Office of Management and Budget Privacy Act Guidelines, however, specify a form for maintaining the accounting. See 40 Fed. Reg. 28949, 28956 (July 9, 1975). They require only that an accounting be maintained, that it be available to the individual to whom the record pertains, that it be used to advise previous recipients of corrections to records, and that it be maintained so a disclosure of records may be traced to the records disclosed. Individual records need not be marked to reflect disclosure unless necessary to satisfy this tracing requirement.

With respect to mass disclosures, if disclosures are of all records or all of a category of records, it is sufficient simply to identify the category of records disclosed, including the other information required under 5 U.S.C. § 552a(c), in a comprehensible form and make it available as required. Similarly, if disclosures occur at fixed intervals, a statement to that effect, as opposed to a statement at each occasion of disclosure, will satisfy the accounting requirement. If a mass disclosure is not of a complete category of records but, for example, of a random selection within a category, then the above information with a list of individuals whose records were disclosed could be maintained. Appropriate officials then could review this list to provide information to satisfy accounting provisions of the Act.

The Federal Personnel Manual (FPM) authorizes disclosure of information concerning a federal civilian employee's present and past position descriptions, grades, salaries, and duty stations (including office address) to any person under the FOIA if the information is not classified. The FPM further provides that credit firms may be provided more detailed information concerning tenure of employment, Civil Service status, length of service in the agency and the federal government, and certain information concerning separation of an employee.

When disclosure of particular information requested by a credit bureau would not be authorized under provisions described above, information about individuals may be disclosed from military or civilian personnel records by Department of Defense components with written consent of the subject employee or military member specifically authorizing the disclosure of the requested information. 5 U.S.C. § 552a(b).

The Office of Management and Budget Privacy Act Guidelines, 40 Fed. Reg. 28949, 28976 (July 9, 1975), state that the sole purpose of the contract might not be to operate a system of records, but the contract normally would provide that the contractor operate such a system as a specific requirement of the contract. If the contract can be performed only by operating a system of records, subsection (m) applies even though the contract does not provide expressly for operation of a system of records.

If the contract meets the requirements of subsection (m), the system of records operated by the contractor is deemed to be operated by the agency. Hence, disclosure of records to the contractor is authorized under 5 U.S.C. § 552a(b)(1) when the contract requires the contractor, explicitly or implicitly, to maintain a system of records to perform an agency function.

1. Below the title of the form and positioned so the individual will be advised of the requested information;
2. Within the body of the form with a notation of its location below the title of the form;
3. On the reverse of the form with a notation of its location below the title of the form;
4. Attached to the form as a tear–off sheet; or
5. Issued as a separate supplement to the form.

Implicit in providing a Privacy Act advisory statement is the notion of informed consent. An individual should be provided sufficient advice about a request for information to make an informed decision about whether or not to respond. See Office of Management and Budget Privacy Act Guidelines, 40 Fed. Reg. 28949, 28961 (July 9, 1975). The intent of the Privacy Act is to advise individuals requested to provide information about themselves for a system of records about the authority for collecting the information, the uses to be made of it, whether it is voluntary or mandatory to provide it, and the consequences of not providing it. Whenever an agency asks individuals for information about themselves for a system of records, a Privacy Act advisory statement must be provided. There is no difference between an Inspector General complaint which triggers a request for information and a medical form completed only after an individual voluntarily initiates a request for treatment. All agencies have determined that all medical forms require Privacy Act advisory statements.

If any information about an individual is maintained in a system of records; i.e., kept and retrieved by an individual's personal identifier, then a Privacy Act advisory statement is required. The individual must be told the authority that permits the agency to collect the information, whether it is mandatory to provide the information, the purposes and routine uses of the information, and the effects, if any, on the individual for not providing the information. Also, if the Social Security number (SSN) is requested, the individual must be told the federal statute or executive order of the President that allows solicitation of the SSN, whether it is mandatory to provide it, and the uses to be made of it.

For both the SSN and the other information about the individual, it will be voluntary for the individual to provide them, and the effects of not providing either may result in a delay or inability in providing information to the individual. The SSN will be used to retrieve information about the individual and to verify the individual's identity. The remaining items of the Privacy Act advisory statement (authority, purposes, and routine uses) must be derived from the component's recruiting system of records notice as published in the Federal Register.

1. The LES is mailed to the individual's home address;
2. The LES is handed out by office clerical personnel, either with or without the pay check; or
3. The LES is handed out in an envelope by office clerical personnel either with or without the pay check.

A reference to subject A in a file retrieved only by subject B's identifier would not be available to subject A under the Privacy Act. However, if an indexing capability exists so that the same file also is retrieved by subject A's identifier, then subject A and B, both, would have access to the entire record. See Voelker v. Internal Revenue Service, 646 F.2d 332 (8th Cir. 1981); Office of Management and Budget Privacy Act Guidelines, 40 Fed. Reg. 28949, 28957 (July 9, 1975).

A determination as to whether material is prepared in anticipation of a civil action or proceeding must be made on an ad hoc basis for each document in question. In making this determination, all circumstances must be considered, including intent of the author at the time a document was prepared and the presence or imminence of a civil action or proceeding. Note: This provision applies to access under the Privacy Act only and has no effect on access, if any, available under the Freedom of Information Act, 5 U.S.C. § 552, or rules of civil procedure. Further, this determination does not apply to work product not maintained in a system of records retrieved by a personal identifier.

Invoking the general exemption should be limited to certain systems of records maintained by only Department of Defense (DoD) criminal law enforcement activities. Such activities include police efforts to prevent, control and reduce crime or to apprehend criminals and the activities of prosecutors, courts, correctional, probation, pardon or parole authorities. The general exemption is not for systems of records maintained by any other DoD activity that may have copies of reports of criminal investigations. Congress intended that only activities which perform criminal law enforcement functions are entitled to this general exemption for a record system. Merely filing a few criminal law enforcement records in one of its records systems will not entitle an activity not involved in criminal law enforcement to invoke a general exemption for the entire system.

Individuals seeking access under the Privacy Act to criminal law enforcement records in the temporary custody of a command or activity should be directed to the organization that created the records. However, any activity's files concerning adjudication or other personnel actions based on criminal law enforcement records are the records, without the general exemption, of the using activity which shall respond to all Privacy Act requests other than those seeking access to or amendment of the criminal law enforcement record.

1. Records warranting permanent preservation for their historical or other value may be disclosed to the Archivist of the United States, or his representative, under the Privacy Act. See 5 U.S.C. § 552a(b)(6). Ownership of such records also may be transferred to the National Archives and Records Administration (NARA).
2. Records may be transferred to the various Federal Records Centers operated by NARA for temporary storage under the Privacy Act since such records continue to be maintained by the agency. See 5 U.S.C. § 552a(b)(1).
3. Records may be disclosed to the Archivist of the United States or the Administrator, General Services Administration, or their designees, to carry out records management inspections required by law. Such disclosures are authorized by the National Archives and Records Act of 1984. See 44 U.S.C. § 2904 and § 2906, as amended.

To allow non-consensual disclosure pursuant to a subpoena--grand jury or otherwise-–would permit disclosure of protected records at the whim of any litigant, whether prosecutor, criminal defendant, or civil litigant. Therefore, disclosure of records under subsection (b)(11) requires that the court specifically order disclosure. If there is a threat of punishment for contempt for ignoring a subpoena not approved by the court, the subpoena should be challenged by a motion to quash or modify.

To avoid being considered agency records, personal notes must meet certain requirements. Keeping or destroying the notes must be at the sole discretion of the author. Any requirement by superior authority, whether by oral or written directive, regulation or command policy, likely would cause the notes to become official agency records. Such notes must be restricted to the author's personal use as memory aids. Passing them to a successor or showing them to other agency personnel would cause them to become agency records. Chapman v. National Aeronautics and Space Administration, 682 F.2d 526 (5th Cir. 1982).

Even if personal notes do become agency records, they will not be within a system of records and subject to the Privacy Act unless they are retrieved by the individual's name or other identifying particular. Thus if they are filed only under the matter in which the subordinate acted or in a chronological record of office activities, the Privacy Act would not apply to them. However, they likely would be subject to disclosure to a person requesting them under the FOIA. Individuals who maintain personal notes about agency personnel should ensure their notes do not become records within systems of records. Maintaining a system of records without complying with the Privacy Act system notice requirement could subject the individual to criminal charges and a $5,000 fine. 5 U.S.C. § 552a(i)(2).

The Privacy Act, 5 U.S.C. § 552a, does not apply to labor organizations; hence, they are not obligated to meet the subsection (e)(3) requirement to provide Privacy Act advice to federal employees before obtaining information for a voluntary allotment of union dues. Any use of the Privacy Act advisory statement by a labor organization is voluntary and may result from express agreement with a DoD component or as a spontaneous union practice. The Standard Form 1187 used to authorize allotments from pay is required by the employee's finance office and information provided on the form will become part of a system of records from which information is retrieved using personal identifiers. If the employee furnishes the completed form to the DoD component, a Privacy Act advisory statement must be provided to the employee by the component. If the labor organization furnishes the completed form to the DoD component, no Privacy Act advisory statement is required unless the component and the labor organization have agreed otherwise.

The General Services Administration (GSA) has recognized that this information is subject to the Privacy Act and has revised Optional Form 63 to include a Privacy Act advisory statement and to instruct that the form be attached to the interiors of safes. When such a tag is placed inside a safe, the disclosure is limited to those officers and employees who have a need–to–know and a disclosure accounting is not required. 5 U.S.C. § 552a(b)(1)and (c)(1).

Alternatives to the disclosure accounting requirements when the information is to be displayed outside the security container or facility are:

1. Request the individual's prior written consent for a single particular transaction; i.e., consent to disclosure of name, home address and telephone number for a particular safe; or
2. Require notification of appropriate duty personnel with access to a control roster containing the custodians' information so they may be contacted in the case of a security problem.

Either of the following situations would invoke provisions of the Privacy Act:

1. Verifying a record requires the individual to examine and disclose whether the record is correct; thus, a request for verification is a request for the individual to republish as truthful the information about him or her; or
2. The individual is asked to identify any erroneous entries and furnish the correct data. When the request is soliciting corrections or additions to a record, it is soliciting information about the individual for a system of records.

1. The documents are filed in their official personnel records;

2. The documents previously were furnished to the named individuals; and

3. The documents were created prior to September 27, 1975.