CFR Subpart B

CFR Subpart B
in effect

15 C.F.R. § 4.21 Purpose and scope.

(a) This subpart establishes policies and procedures for implementing the Privacy Act of 1974, as amended (5 U.S.C. 552a). The main objectives of the subpart are to facilitate full exercise of rights conferred on individuals under the Act, and to protect the privacy of individuals on whom the Department maintains records in systems of records under the Act. (b) The Department shall act promptly and in accordance with the Act upon receipt of any inquiry, request or appeal from a citizen of the United States or an alien lawfully admitted for permanent residence into the United States, regardless of the individual's age. Further, the Department shall maintain only such information on individuals as is relevant and necessary to the performance of its lawful functions; maintain that information with such accuracy, relevancy, timeliness, and completeness as is reasonably necessary to assure fairness in determinations made by the Department about the individual; obtain information from the individual to the extent practicable; and take every reasonable step to protect that information from unwarranted disclosure. The Department shall maintain no record describing how an individual exercises rights guaranteed by the First Amendment unless expressly authorized to do so by statute or by the individual about whom the record is maintained, or unless to do so is pertinent to and within the scope of an authorized law enforcement activity. An individual's name and address shall not be sold or rented by the Department unless such action is specifically authorized by law. (c) This subpart applies to all components of the Department. Components may promulgate supplementary orders and rules not inconsistent with this subpart. (d) The Assistant Secretary for Administration is delegated responsibility for maintaining this subpart, for issuing such orders and directives internal to the Department as are necessary for full compliance with the Act, and for publishing all required notices concerning systems of records. (e) Matters outside the scope of this subpart include: (1) Requests for records that do not pertain to the requester, or to the individual about whom the request is made if the requester is the parent or guardian of the individual; (2) Requests involving information pertaining to an individual that is in a record or file but not within the scope of a system of records notice published in the Federal Register; (3) Requests to correct a record if a grievance procedure is available to the individual either by regulation or through a provision in a collective bargaining agreement with the Department or a component of the Department, and the individual has initiated, or expressed in writing the intention of initiating, such a grievance procedure; and (4) Requests for employee-employer services and counseling that were routinely granted prior to enactment of the Act, including, but not limited to, test calculations of retirement benefits, explanations of health and life insurance programs, and explanations of tax withholding options. (f) Any request for records that pertains to the requester, or to the individual about whom the request is made if the requester is the parent or guardian of the individual, shall be processed under the Act and this subpart and under the Freedom of Information Act and the Department's implementing regulations at subpart A of this part, regardless whether the Act or the Freedom of Information Act is mentioned in the request.

15 C.F.R. § 4.22 Definitions.

(a) All terms used in this subpart which are defined in 5 U.S.C. 552a shall have the same meaning herein. (b) As used in this subpart: (1) Act means the “Privacy Act of 1974, as amended (5 U.S.C. 552a)”. (2) Appeal means a request by an individual to review and reverse an initial denial of a request from that individual for correction or amendment. (3) Component means any office, division, bureau or other unit of the Department listed in appendix A to this part (except that a regional office of a larger office or other unit does not constitute a separate component). (4) Department means the Department of Commerce. (5) Inquiry means either a request for general information regarding the Act and this subpart or a request from an individual (or that individual's parent or guardian) that the Department determine whether it has any record in a system of records that pertains to that individual. (6) Person means any human being and also shall include, but is not limited to, corporations, associations, partnerships, trustees, receivers, personal representatives, and public or private organizations. (7) Privacy Act Officer means those officials, identified in appendix B to this part, who are authorized to receive and act upon inquiries, requests for access, and requests for correction or amendment. (8) Request for access means a request from an individual or an individual's parent or guardian to see a record pertaining to that individual in a particular system of records. (9) Request for correction or amendment means a request from an individual or an individual's parent or guardian that the Department change (by correction, amendment, addition or deletion) a particular record pertaining to that individual in a system of records. (10) Un-redacted SSN Mailed Documents Listing (USMDL) means the Department approved list, as posted at www.commerce.gov/privacy, designating those documents for which the inclusion of SSN is determined to be necessary to fulfill a compelling Department business need when the documents are requested by individuals outside the Department or other Federal agencies, as determined jointly by the Senior Agency Official for Privacy and the Departmental Privacy Act Officer.

15 C.F.R. § 4.23 Procedures for making inquiries.

(a) Any individual, regardless of age, who is a citizen of the United States or an alien lawfully admitted for permanent residence into the United States may submit an inquiry to the Department. The inquiry should be made either in person or by mail addressed to the appropriate component identified in appendix A to this part or to the official identified in the notification procedures paragraph of the systems of records notice published in the Federal Register. 2 If an individual believes the Department maintains a record pertaining to him or her but does not know which system of records might contain such a record and/or which component of the Department maintains the system of records, assistance in person or by mail will be provided at the first address listed in appendix A to this part. (b) Inquiries submitted by mail should include the words “PRIVACY ACT INQUIRY” in capital letters at the top of the letter and on the face of the envelope. If the inquiry is for general information regarding the Act and this subpart, no particular information is required. The Department reserves the right to require compliance with the identification procedures appearing at § 4.24(d). If the inquiry is a request that the Department determine whether it has a record pertaining to the individual, the following information should be submitted: (1) Name of individual whose record is sought; (2) Statement that individual whose record is sought is either a U.S. citizen or an alien lawfully admitted for permanent residence; (3) Identifying data that will help locate the record (for example, maiden name, occupational license number, period or place of employment, etc.); (4) Record sought, by description and by record system name, if known; (5) Action requested (that is, sending information on how to exercise rights under the Act; determining whether requested record exists; gaining access to requested record; or obtaining copy of requested record); (6) Copy of court guardianship order or minor's birth certificate, as provided in § 4.24(d)(3), but only if requester is guardian or parent of individual whose record is sought; (7) Requester's name (printed), signature, address, and (optional) telephone number; (8) Date; and, (9) Certification of request by notary or other official, but only if (i) Request is for notification that requested record exists, for access to requested record, or for copy of requested record; (ii) Record is not available to any person under 5 U.S.C. 552; and (iii) Requester does not appear before an employee of the Department for verification of identity. (c) Any inquiry which is not addressed as specified in paragraph (a) of this section or which is not marked as specified in paragraph (b) of this section will be so addressed and marked by Department personnel and forwarded immediately to the responsible Privacy Act Officer. An inquiry which is not properly addressed by the individual will not be deemed to have been “received” for purposes of measuring the time period for response until actual receipt by the Privacy Act Officer. In each instance when an inquiry so forwarded is received, the Privacy Act Officer shall notify the individual that his or her inquiry was improperly addressed and the date the inquiry was received at the proper address. (d)(1) Each inquiry received shall be acted upon promptly by the responsible Privacy Act Officer. Every effort will be made to respond within ten working days (i.e., excluding Saturdays, Sundays and legal public holidays) of the date of receipt at the proper address. If a response cannot be made within ten working days, the Privacy Act Officer shall send an acknowledgment during that period providing information on the status of the inquiry and asking for such further information as may be necessary to process the inquiry. The first correspondence sent by the Privacy Act Officer to the requester shall contain the Department's control number assigned to the request, as well as a statement that the requester should use that number in all future contacts with the Department. The Department shall use that control number in all subsequent correspondence. (2) If the Privacy Act Officer fails to send an acknowledgment within ten working days, as provided in paragraph (d)(1) of this section, the requester may ask the Assistant General Counsel for Litigation, Employment, and Oversight to take corrective action. No failure of a Privacy Act Officer to send an acknowledgment shall confer administrative finality for purposes of judicial review. (e) An individual shall not be required to state a reason for or otherwise justify his or her inquiry. (f) Special note should be taken that certain agencies are responsible for publishing notices of systems of records having Government-wide application to other agencies, including the Department. The agencies known to be publishing these general notices and the types of records covered therein appear in appendix C to this part. These general notices do not identify the Privacy Act Officers in the Department to whom inquiries should be presented or mailed. The provisions of this section, and particularly paragraph (a) of this section, should be followed in making inquiries with respect to such records. Such records in the Department are subject to the provisions of this part to the extent indicated in appendix C to this part. The exemptions, if any, determined by the agency publishing a general notice shall be invoked and applied by the Department after consultation, as necessary, with that other agency.

15 C.F.R. § 4.24 Procedures for making requests for records.

(a) Any individual, regardless of age, who is a citizen of the United States or an alien lawfully admitted for permanent residence into the United States may submit a request to the Department for access to records. The request should be made either in person or by mail addressed to the appropriate office listed in appendix A to this part. (b) Requests submitted by mail should include the words “PRIVACY ACT REQUEST” in capital letters at the top of the letter and on the face of the envelope. Any request which is not addressed as specified in paragraph (a) of this section or which is not marked as specified in this paragraph will be so addressed and marked by Department personnel and forwarded immediately to the responsible Privacy Act Officer. A request which is not properly addressed by the individual will not be deemed to have been “received” for purposes of measuring time periods for response until actual receipt by the Privacy Act Officer. In each instance when a request so forwarded is received, the Privacy Act Officer shall notify the individual that his or her request was improperly addressed and the date the request was received at the proper address. (c) If the request follows an inquiry under § 4.23 in connection with which the individual's identity was established by the Department, the individual need only indicate the record to which access is sought, provide the Department control number assigned to the request, and sign and date the request. If the request is not preceded by an inquiry under § 4.23, the procedures of this section should be followed. (d) The requirements for identification of individuals seeking access to records are: (1) In person. Each individual making a request in person shall be required to present satisfactory proof of identity. The means of proof, in the order of preference and priority, are: (i) A document bearing the individual's photograph (for example, driver's license, passport or military or civilian identification card); (ii) A document, preferably issued for participation in a Federally-sponsored program, bearing the individual's signature (for example, unemployment insurance book, employer's identification card, national credit card, and professional, craft or union membership card); and, (iii) A document bearing neither the photograph nor the signature of the individual, preferably issued for participation in a Federally-sponsored program (for example, Medicaid card). If the individual can provide no suitable documentation of identity, the Department will require a signed statement asserting the individual's identity and stipulating that the individual understands the penalty provision of 5 U.S.C. 552a(i)(3) recited in § 4.32(a). In order to avoid any unwarranted disclosure of an individual's records, the Department reserves the right to determine the adequacy of proof of identity offered by any individual, particularly if the request involves a sensitive record. (2) Not in person. If the individual making a request does not appear in person before a Privacy Act Officer or other employee authorized to determine identity, then identity must be determined by: (i) A certification of a notary public or equivalent officer empowered to administer oaths must accompany the request under the circumstances prescribed in § 4.23(b)(9). The certification in or attached to the letter must be substantially in accordance with the following text: (ii) Statement of identity made under 28 U.S.C. 1746, a law that permits statements to be made under penalty of perjury as a substitute for notarization. (3) Parents of minors and legal guardians. An individual acting as the parent of a minor or the legal guardian of the individual to whom a record pertains shall establish his or her personal identity in the same manner prescribed in either paragraph (d)(1) or (d)(2) of this section. In addition, such other individual shall establish his or her identity in the representative capacity of parent or legal guardian. In the case of the parent of a minor, the proof of identity shall be a certified or authenticated copy of the minor's birth certificate. In the case of a legal guardian of an individual who has been declared incompetent due to physical or mental incapacity or age by a court of competent jurisdiction, the proof of identity shall be a certified or authenticated copy of the court's order. For purposes of the Act, a parent or legal guardian may represent only a living individual, not a decedent. A parent or legal guardian may be accompanied during personal access to a record by another individual, provided the provisions of § 4.25(f) are satisfied. (e) If the provisions of this subpart are alleged to impede an individual in exercising his or her right to access, the Department will consider, from an individual making a request, alternative suggestions regarding proof of identity and access to records. (f) An individual shall not be required to state a reason for or otherwise justify his or her request for access to a record. City of ____ County of ____. (Name of individual), who affixed (his) (her) signature below in my presence, came before me, a (title), in and for the aforesaid County and State, this __ day of __, 20_, and established (his) (her) identity to my satisfaction. My commission expires ____. Signature: ______.; or

15 C.F.R. § 4.25 Disclosure of requested records to individuals.

(a)(1) The responsible Privacy Act Officer shall act promptly upon each request. Every effort will be made to respond within ten working days (i.e., excluding Saturdays, Sundays and legal public holidays) of the date of receipt. If a response cannot be made within ten working days due to unusual circumstances, the Privacy Act Officer shall send an acknowledgment during that period providing information on the status of the request and asking for any further information that may be necessary to process the request. “Unusual circumstances” shall include circumstances in which: (i) A search for and collection of requested records from inactive storage, field facilities or other establishments is required; (ii) A voluminous amount of data is involved; (iii) Information on other individuals must be separated or expunged from the particular record; or (iv) Consultations with other agencies having a substantial interest in the determination of the request are necessary. (2) If the Privacy Act Officer fails to send an acknowledgment within ten working days, as provided in paragraph (a)(1) of this section, the requester may ask the Assistant General Counsel for Litigation, Employment, and Oversight to take corrective action. No failure of a Privacy Act Officer to send an acknowledgment shall confer administrative finality for purposes of judicial review. (3) Inclusion of SSNs on responsive documents. (i) The Department shall redact SSNs from responsive documents provided to requesters where feasible. Where full redaction is not feasible, partial redaction to create a truncated SSN shall be preferred to no redaction. The following conditions must be met for the inclusion of an unredacted (full) SSN or partially redacted (truncated) SSN on a responsive document: (ii) The inclusion of the full SSN or truncated SSN of an individual must be required or authorized by law, (iii) The inclusion of the full SSN or truncated SSN of an individual must be determined by the Senior Agency Official for Privacy and Departmental Privacy Act Officer to be necessary to fulfill a compelling Department business need; and (iv) The full SSN of an individual may be included only on documents listed on the USMDL. (4) The following requirements apply when the Department mails or delivers responsive documents containing SSNs or truncated SSNs: (i) The full SSN of an individual may be included only on documents listed on the USMDL. (ii) For documents that are listed on the USMDL and that include the full SSN of an individual, the signature of the recipient is required upon delivery. (iii) For documents that include the truncated form of the SSN of an individual, the signature of the recipient is required upon delivery. (iv) The full SSN, the truncated SSN, any part of the SSN of an individual must not be visible from the outside of the envelope or package. (b) Grant of access: (1) Notification. An individual shall be granted access to a record pertaining to him or her, unless the provisions of paragraph (g)(1) of this section apply. The Privacy Act Officer shall notify the individual of a determination to grant access, and provide the following information: (i) The methods of access, as set forth in paragraph (b)(2) of this section; (ii) The place at which the record may be inspected; (iii) The earliest date on which the record may be inspected and the period of time that the records will remain available for inspection. In no event shall the earliest date be later than thirty calendar days from the date of notification; (iv) The estimated date by which a copy of the record will be mailed and the fee estimate pursuant to § 4.31. In no event shall the estimated date be later than thirty calendar days from the date of notification; (v) The fact that the individual, if he or she wishes, may be accompanied by another individual during personal access, subject to the procedures set forth in paragraph (f) of this section; and, (vi) Any additional prerequisites for granting access to a specific record. (2) Methods of access. The following methods of access to records by an individual may be available depending on the circumstances of a given situation: (i) Inspection in person may be had in the office specified by the Privacy Act Officer granting access, during the hours indicated in appendix A to this part; (ii) Transfer of records to a Federal facility more convenient to the individual may be arranged, but only if the Privacy Act Officer determines that a suitable facility is available, that the individual's access can be properly supervised at that facility, and that transmittal of the records to that facility will not unduly interfere with operations of the Department or involve unreasonable costs, in terms of both money and manpower; and, (iii) Copies of documents may be mailed at the request of the individual and may be subject to payment of the fees prescribed in §§ 4.25(a)(3) and 4.31. In the event that the Department, at its own initiative, elects to provide a copy by mail, no fee will be charged to the individual. (iv) Copies of documents listed on the USMDL that include full SSNs and that are requested by an individual are subject to payment of the fees prescribed in § 4.31. (v) Documents containing SSNs or truncated SSNs that are required to be returned by the individual to the Department will be mailed or delivered along with a prepaid mail or delivery service envelope at the expense of the Department. (c) Access to medical records is governed by the provisions of § 4.26. (d) The Department shall supply such other information and assistance at the time of access as to make the record intelligible to the individual. (e) The Department reserves the right to limit access to copies and abstracts of original records, rather than the original records. This election would be appropriate, for example, when the record is in an automated data medium such as tape or disc, when the record contains information on other individuals, and when deletion of information is permissible under exemptions (for example, 5 U.S.C. 552a(k)(2)). In no event shall original records of the Department be made available to the individual except under the immediate supervision of the Privacy Act Officer or his or her designee. (f) Any individual who requests access to a record pertaining to that individual may be accompanied by another individual of his or her choice. “Accompanied” includes discussing the record in the presence of the other individual. The individual to whom the record pertains shall authorize the presence of the other individual in writing. The authorization shall include the name of the other individual, a specific description of the record to which access is sought, the Department control number assigned to the request, the date, and the signature of the individual to whom the record pertains. The other individual shall sign the authorization in the presence of the Privacy Act Officer. An individual shall not be required to state a reason or otherwise justify his or her decision to be accompanied by another individual during personal access to a record. (g) Initial denial of access: (1) Grounds. Access by an individual to a record that pertains to that individual will be denied only upon a determination by the Privacy Act Officer that: (i) The record is exempt under § 4.33 or 4.34, or exempt by determination of another agency publishing notice of the system of records, as described in § 4.23(f); (ii) The record is information compiled in reasonable anticipation of a civil action or proceeding; (iii) The provisions of § 4.26 pertaining to medical records have been invoked; or (iv) The individual unreasonably has failed to comply with the procedural requirements of this part. (2) Notification. The Privacy Act Officer shall give notice of denial of access to records to the individual in writing, and the notice shall include the following information: (i) The Privacy Act Officer's name and title or position; (ii) The date of the denial; (iii) The reasons for the denial, including citation to the appropriate section of the Act and this part; (iv) The individual's opportunities, if any, for further administrative consideration, including the identity and address of the responsible official. If no further administrative consideration within the Department is available, the notice shall state that the denial is administratively final; and, (v) If stated to be administratively final within the Department, the individual's right to judicial review provided under 5 U.S.C.552a(g)(1), as limited by 5 U.S.C. 552a(g)(5). (3) Administrative review. If a Privacy Act Officer issues an initial denial of a request, the individual's opportunities for further consideration shall be as follows: (i) As to denial under paragraph (g)(1)(i) of this section, two opportunities for further consideration are available in the alternative: (A) If the individual contests the application of an exemption to the records, the review procedures in § 4.25(g)(3)(ii) shall apply; or, (B) If the individual challenges the validity of the exemption itself, the individual must file a petition for the issuance, amendment, or repeal of a rule under 5 U.S.C. 553(e). If the exemption was determined by the Department, such petition shall be filed with the Assistant Secretary for Administration. If the exemption was determined by another agency (as described in § 4.23(f)), the Department will provide the individual with the name and address of the other agency and any relief sought by the individual shall be that provided by the regulations of the other agency. Within the Department, no such denial is administratively final until such a petition has been filed by the individual and disposed of on the merits by the Assistant Secretary for Administration. (ii) As to denial under paragraphs (g)(1)(ii) of this section, (g)(1)(iv) of this section or (to the limited extent provided in paragraph (g)(3)(i)(A) of this section) paragraph (g)(1)(i) of this section, the individual may file for review with the Assistant General Counsel for Litigation, Employment, and Oversight, as indicated in the Privacy Act Officer's initial denial notification. The individual and the Department shall follow the procedures in § 4.28 to the maximum extent practicable. (iii) As to denial under paragraph (g)(1)(iii) of this section, no further administrative consideration within the Department is available because the denial is not administratively final until expiration of the time period indicated in § 4.26(a). (h) If a request is partially granted and partially denied, the Privacy Act Officer shall follow the appropriate procedures of this section as to the records within the grant and the records within the denial.

15 C.F.R. § 4.26 Special procedures: Medical records.

When a request for access involves medical or psychological records, the records will be reviewed by the Department's medical officer for a determination on whether disclosure would be harmful to the individual to whom they relate. If it is determined that disclosure would be harmful, the Department may refuse to disclose the records directly to the requester but shall transmit them to a doctor authorized in writing by the individual to whom the records relate to receive the documents. If an individual refuses to provide written authorization to release his or her medical records to a doctor, barring any applicable exemption, the Department shall give the individual access to his or her records by means of a copy, provided without cost to the requester, sent registered mail, return receipt requested.

15 C.F.R. § 4.27 Procedures for making requests for correction or amendment.

(a) Any individual, regardless of age, who is a citizen of the United States or an alien lawfully admitted for permanent residence into the United States may submit a request for correction or amendment to the Department. The request should be made either in person or by mail addressed to the Privacy Act Officer who processed the individual's request for access to the record, and to whom is delegated authority to make initial determinations on requests for correction or amendment. The offices of Privacy Act Officers are open to the public between the hours of 9 a.m. and 4 p.m. Monday through Friday (excluding Saturdays, Sundays, and legal public holidays). (b) Requests submitted by mail should include the words “PRIVACY ACT REQUEST” in capital letters at the top of the letter and on the face of the envelope. Any request that is not addressed as specified in paragraph (a) of this section or that is not marked as specified in this paragraph will be so addressed and marked by Department personnel and forwarded immediately to the responsible Privacy Act Officer. A request that is not properly addressed by the individual will not be deemed to have been “received” for purposes of measuring the time period for response until actual receipt by the Privacy Act Officer. In each instance when a request so forwarded is received, the Privacy Act Officer shall notify the individual that his or her request was improperly addressed and the date the request was received at the proper address. (c) Since the request, in all cases, will follow a request for access under § 4.25, the individual's identity will be established by his or her signature on the request and use of the Department control number assigned to the request. (d) A request for correction or amendment should include the following: (1) Specific identification of the record sought to be corrected or amended (for example, description, title, date, paragraph, sentence, line and words); (2) The specific wording to be deleted, if any; (3) The specific wording to be inserted or added, if any, and the exact place at which it is to be inserted or added; and, (4) A statement of the basis for the requested correction or amendment, with all available supporting documents and materials that substantiate the statement. The statement should identify the criterion of the Act being invoked, that is, whether the information in the record is unnecessary, inaccurate, irrelevant, untimely or incomplete.

15 C.F.R. § 4.28 Agency review of requests for correction or amendment.

(a)(1)(i) Not later than ten working days (i.e., excluding Saturdays, Sundays and legal public holidays) after receipt of a request to correct or amend a record, the Privacy Act Officer shall send an acknowledgment providing an estimate of time within which action will be taken on the request and asking for such further information as may be necessary to process the request. The estimate of time may take into account unusual circumstances as described in § 4.25(a). No acknowledgment will be sent if the request can be reviewed, processed and the individual notified of the results of review (either compliance or denial) within the ten working days. Requests filed in person will be acknowledged in writing at the time submitted. (ii) If the Privacy Act Officer fails to send the acknowledgment within ten working days, as provided in paragraph (a)(1)(i) of this section, the requester may ask the Assistant General Counsel for Litigation, Employment, and Oversight, or in the case of a request to the Office of the Inspector General, the Counsel to the Inspector General, to take corrective action. No failure of a Privacy Act Officer to send an acknowledgment shall confer administrative finality for purposes of judicial review. (2) Promptly after acknowledging receipt of a request, or after receiving such further information as might have been requested, or after arriving at a decision within the ten working days, the Privacy Act Officer shall either: (i) Make the requested correction or amendment and advise the individual in writing of such action, providing either a copy of the corrected or amended record or, in cases in which a copy cannot be provided, a statement as to the means by which the correction or amendment was effected; or (ii) Inform the individual in writing that his or her request is denied and provide the following information: (A) The Privacy Act Officer's name and title or position; (B) The date of the denial; (C) The reasons for the denial, including citation to the appropriate sections of the Act and this subpart; and (D) The procedures for appeal of the denial as set forth in § 4.29, including the address of the Assistant General Counsel for Litigation, Employment, and Oversight, or in the case of a request to the Office of the Inspector General, the address of the Counsel to the Inspector General. (3) The term promptly in this section means within thirty working days (i.e., excluding Saturdays, Sundays and legal public holidays). If the Privacy Act Officer cannot make the determination within thirty working days, the individual will be advised in writing of the reason for the delay and of the estimated date by which the determination will be made. (b) Whenever an individual's record is corrected or amended pursuant to a request from that individual, the Privacy Act Officer shall notify all persons and agencies to which the corrected or amended portion of the record had been disclosed prior to its correction or amendment, if an accounting of such disclosure required by the Act was made. The notification shall require a recipient agency maintaining the record to acknowledge receipt of the notification, to correct or amend the record, and to apprise any agency or person to which it had disclosed the record of the substance of the correction or amendment. (c) The following criteria will be considered by the Privacy Act Officer in reviewing a request for correction or amendment: (1) The sufficiency of the evidence submitted by the individual; (2) The factual accuracy of the information to be corrected or amended; (3) The relevance and necessity of the information in terms of the purpose for which it was collected; (4) The timeliness and currency of the information in light of the purpose for which it was collected; (5) The completeness of the information in terms of the purpose for which it was collected; (6) The degree of risk that denial of the request could unfairly result in determinations adverse to the individual; (7) The character of the record sought to be corrected or amended; and, (8) The propriety and feasibility of complying with the specific means of correction or amendment requested by the individual. (d) The Department will not undertake to gather evidence for the individual, but does reserve the right to verify the evidence the individual submits. (e) Correction or amendment of a record requested by an individual will be denied only upon a determination by the Privacy Act Officer that: (1) The individual has failed to establish, by a preponderance of the evidence, the propriety of the correction or amendment in light of the criteria set forth in paragraph (c) of this section; (2) The record sought to be corrected or amended is part of the official record in a terminated judicial, quasi-judicial or quasi-legislative proceeding to which the individual was a party or participant; (3) The information in the record sought to be corrected or amended, or the record sought to be corrected or amended, is the subject of a pending judicial, quasi-judicial or quasi-legislative proceeding to which the individual is a party or participant; (4) The correction or amendment would violate a duly enacted statute or promulgated regulation; or, (5) The individual unreasonably has failed to comply with the procedural requirements of this part. (f) If a request is partially granted and partially denied, the Privacy Act Officer shall follow the appropriate procedures of this section as to the records within the grant and the records within the denial.

15 C.F.R. § 4.29 Appeal of initial adverse agency determination on correction or amendment.

(a) If a request for correction or amendment is denied initially under § 4.28, the individual may submit a written appeal within thirty calendar days of the date of the initial denial. The appeal must be received by the General Counsel, or by the Counsel to the Inspector General in the case of an appeal of an initial adverse determination by the Office of Inspector General, during normal business hours (8:30 a.m. to 5:00 p.m., Eastern Time, Monday through Friday) within 30 calendar days of the date of the initial denial. Appeals arriving after normal business hours will be deemed received on the next normal business day. If the 30th calendar day falls on a Saturday, Sunday, or a legal public holiday, an appeal received by 5:00 p.m., Eastern Time, the next business day will be deemed timely. (b)(1) An appeal from a request to a component other than the Office of the Inspector General should be addressed to the Assistant General Counsel for Litigation, Employment, and Oversight, U.S. Department of Commerce, Room 5875, 14th and Constitution Avenue NW., Washington, DC 20230. An appeal should include the words “Privacy Act Appeal” at the top of the letter and on the face of the envelope. An appeal not addressed and marked as provided herein will be so marked by Department personnel when it is so identified, and will be forwarded immediately to the Assistant General Counsel for Litigation, Employment, and Oversight. An appeal which is not properly addressed by the individual will not be deemed to have been “received” for purposes of measuring the time periods in this section until actual receipt by the Assistant General Counsel for Litigation, Employment, and Oversight. In each instance when an appeal so forwarded is received, the Assistant General Counsel for Litigation, Employment, and Oversight shall notify the individual that his or her appeal was improperly addressed and the date on which the appeal was received at the proper address. (2) An appeal of an initial adverse determination on correction or amendment by the Office of Inspector General should be addressed to the Counsel to the Inspector General, U.S. Department of Commerce, Room 7898C, 14th and Constitution Avenue NW., Washington, DC 20230. An appeal should include the words “Privacy Act Appeal” at the top of the letter and on the face of the envelope. An appeal not addressed and marked as provided herein will be so marked by Department personnel when it is so identified, and will be forwarded immediately to the Counsel to the Inspector General. An appeal which is not properly addressed by the individual will not be deemed to have been “received” for purposes of measuring the time periods in this section until actual receipt by the Counsel to the Inspector General. In each instance when an appeal so forwarded is received, the Counsel to the Inspector General shall notify the individual that his or her appeal was improperly addressed and the date on which the appeal was received at the proper address. (c) The individual's appeal shall be signed by the individual, and shall include a statement of the reasons for why the initial denial is believed to be in error, and the Department's control number assigned to the request. The Privacy Act Officer who issued the initial denial shall furnish to the Assistant General Counsel for Litigation, Employment, and Oversight, or in the case of an initial denial by the Office of the Inspector General, to the Counsel to the Inspector General, the record(s) the individual requests to be corrected or amended, and all correspondence between the Privacy Act Officer and the requester. Although the foregoing normally will comprise the entire record on appeal, the Assistant General Counsel for Litigation, Employment, and Oversight, or in the case of an initial denial by the Office of the Inspector General, the Counsel to the Inspector General, may seek any additional information necessary to ensure that the final determination is fair and equitable and, in such instances, disclose the additional information to the individual to the greatest extent possible, and provide an opportunity for comment thereon. (d) No personal appearance or hearing on appeal will be allowed. (e) The Assistant General Counsel for Litigation, Employment, and Oversight, or in the case of an initial denial by the Office of the Inspector General, the Counsel to the Inspector General, shall act upon the appeal and issue a final determination in writing not later than thirty working days (i.e., excluding Saturdays, Sundays and legal public holidays) from the date on which the appeal is received, except that the Assistant General Counsel for Litigation, Employment, and Oversight, or in the case of an initial denial by the Office of the Inspector General, the Counsel to the Inspector General, may extend the thirty days upon deciding that a fair and equitable review cannot be made within that period, but only if the individual is advised in writing of the reason for the extension and the estimated date by which a final determination will be issued. The estimated date should not be later than the sixtieth day after receipt of the appeal unless unusual circumstances, as described in § 4.25(a), are met. (f) If the appeal is determined in favor of the individual, the final determination shall include the specific corrections or amendments to be made and a copy thereof shall be transmitted promptly to the individual and to the Privacy Act Officer who issued the initial denial. Upon receipt of such final determination, the Privacy Act Officer shall promptly take the actions set forth in § 4.28(a)(2)(i) and (b). (g) If the appeal is denied, the final determination shall be transmitted promptly to the individual and state the reasons for the denial. The notice of final determination shall inform the individual that: (1) The individual has a right under the Act to file with the Assistant General Counsel for Litigation, Employment, and Oversight, or in the case of an initial denial by the Office of the Inspector General, the Counsel to the Inspector General, a concise statement of reasons for disagreeing with the final determination. The statement ordinarily should not exceed one page and the Department reserves the right to reject an excessively lengthy statement. It should provide the Department control number assigned to the request, indicate the date of the final determination and be signed by the individual. The Assistant General Counsel for Litigation, Employment, and Oversight, or in the case of an initial denial by the Office of the Inspector General, the Counsel to the Inspector General, shall acknowledge receipt of such statement and inform the individual of the date on which it was received; (2) Any such disagreement statement submitted by the individual would be noted in the disputed record, and filed with it; (3) The purposes and uses to which the statement would be put are those applicable to the record in which it is noted, and that a copy of the statement would be provided to persons and agencies to which the record is disclosed subsequent to the date of receipt of such statement; (4) The Department would append to any such disagreement statement a copy of the final determination or summary thereof, which also would be provided to persons and agencies to which the disagreement statement is disclosed; and (5) The individual has a right to judicial review of the final determination under 5 U.S.C. 552a(g)(1)(A), as limited by 5 U.S.C. 552a(g)(5). (h) In making the final determination, the Assistant General Counsel for Litigation, Employment, and Oversight, or in the case of an initial denial by the Office of the Inspector General, the Counsel to the Inspector General, shall employ the criteria set forth in § 4.28(c) and shall deny an appeal only on grounds set forth in § 4.28(e). (i) If an appeal is partially granted and partially denied, the Assistant General Counsel for Litigation, Employment, and Oversight, or in the case of an initial denial by the Office of the Inspector General, the Counsel to the Inspector General, shall follow the appropriate procedures of this section as to the records within the grant and the records within the denial. (j) Although a copy of the final determination or a summary thereof will be treated as part of the individual's record for purposes of disclosure in instances where the individual has filed a disagreement statement, it will not be subject to correction or amendment by the individual. (k) The provisions of paragraphs (g)(1) through (g)(3) of this section satisfy the requirements of 5 U.S.C. 552a(e)(3).

15 C.F.R. § 4.30 Disclosure of record to person other than the individual to whom it pertains.

(a) The Department may disclose a record pertaining to an individual to a person other than the individual to whom it pertains only in the following instances: (1) Upon written request by the individual, including authorization under § 4.25(f); (2) With the prior written consent of the individual; (3) To a parent or legal guardian under 5 U.S.C. 552a(h); (4) When required by the Act and not covered explicitly by the provisions of 5 U.S.C. 552a(b); and (5) When permitted under 5 U.S.C. 552a(b)(1) through (12), as follows: 3 (i) To those officers and employees of the agency that maintains the record who have a need for the record in the performance of their duties; (ii) Required under 5 U.S.C. 552; (iii) For a routine use as defined in 5 U.S.C. 552a(a)(7); (iv) To the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of Title 13 of the U.S. Code; (v) To a requester who has provided the agency with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable; (vi) To the National Archives and Records Administration as a record that has sufficient historical or other value to warrant its continued preservation by the United States Government, or for evaluation by the Archivist of the United States, or the designee of the Archivist, to determine whether the record has such value; (vii) To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency which maintains the record, specifying the particular portion desired and the law enforcement activity for which the record is sought; (viii) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if upon such disclosure notification is transmitted to the last known address of such individual; (ix) To either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee; (x) To the Comptroller General, or any of his or her authorized representatives, in the course of the performance of the duties of the General Accounting Office; (xi) Pursuant to the order of a court of competent jurisdiction; or (xii) To a consumer reporting agency in accordance with 31 U.S.C. 3711(e). (b) The situations referred to in paragraph (a)(4) of this section include the following: (1) 5 U.S.C. 552a(c)(4) requires dissemination of a corrected or amended record or notation of a disagreement statement by the Department in certain circumstances; (2) 5 U.S.C. 552a(d) requires disclosure of records to the individual to whom they pertain, upon request; and (3) 5 U.S.C. 552a(g) authorizes civil action by an individual and requires disclosure by the Department to the court. (c) The Privacy Act Officer shall make an accounting of each disclosure by him of any record contained in a system of records in accordance with 5 U.S.C. 552a(c)(1) and (2). Except for a disclosure made under 5 U.S.C. 552a(b)(7), the Privacy Act Officer shall make such accounting available to any individual, insofar as it pertains to that individual, upon any request submitted in accordance with § 4.24. The Privacy Act Officer shall make reasonable efforts to notify any individual when any record in a system of records is disclosed to any person under compulsory legal process, promptly upon being informed that such process has become a matter of public record.

15 C.F.R. § 4.31 Fees.

(a) The only fee to be charged to an individual under this part is for duplication of records at the request of the individual. Components shall charge a fee for duplication of records under the Act in the same way in which they charge a duplication fee under § 4.11, except as provided in this section. Accordingly, no fee shall be charged or collected for: search, retrieval, or review of records; copying at the initiative of the Department without a request from the individual; transportation of records; or first-class postage. (b) The Department shall provide an individual one copy of each record corrected or amended pursuant to the individual's request without charge as evidence of the correction or amendment. (c) As required by the United States Office of Personnel Management in its published regulations implementing the Act, the Department shall charge no fee for a single copy of a personnel record covered by that agency's Government-wide published notice of systems of records.

15 C.F.R. § 4.32 Penalties.

(a) The Act provides, in pertinent part: (b) A person who falsely or fraudulently attempts to obtain records under the Act also may be subject to prosecution under such other criminal statutes as 18 U.S.C. 494, 495 and 1001. Any person who knowingly and willfully requests or obtains any record concerning an individual from an agency under false pretenses shall be guilty of a misdemeanor and fined not more than $5,000. (5 U.S.C. 552a(i)(3)).

15 C.F.R. § 4.33 General exemptions.

(a) Individuals may not have access to records maintained by the Department but which were provided by another agency which has determined by regulation that such information is subject to general exemption under 5 U.S.C. 552a(j). If such exempt records are within a request for access, the Department will advise the individual of their existence and of the name and address of the source agency. For any further information concerning the record and the exemption, the individual must contact that source agency. (b) The general exemptions determined to be necessary and proper with respect to systems of records maintained by the Department, including the parts of each system to be exempted, the provisions of the Act from which they are exempted, and the justification for the exemption, are as follows: (1) Individuals identified in Export Transactions—COMMERCE/BIS-1. Pursuant to 5 U.S.C. 552a(j)(2), these records are hereby determined to be exempt from all provisions of the Act, except 5 U.S.C. 552a(b), (c)(1) and (2), (e)(4)(A) through (F), (e)(6), (7), (9), (10), and (11), and (i). These exemptions are necessary to ensure the proper functioning of the law enforcement activity, to protect confidential sources of information, to fulfill promises of confidentiality, to maintain the integrity of the law enforcement process, to avoid premature disclosure of the knowledge of criminal activity and the evidentiary bases of possible enforcement actions, to prevent interference with law enforcement proceedings, to avoid disclosure of investigative techniques, and to avoid endangering law enforcement personnel. Section 12(c) of the Export Administration Act of 1979, as amended, also protects this information from disclosure. (2) Fisheries Law Enforcement Case Files—COMMERCE/NOAA-5. Pursuant to 5 U.S.C. 552a(j)(2), these records are hereby determined to be exempt from all provisions of the Act, except 5 U.S.C. 552a (b), (c) (1) and (2), (e) (4) (A) through (F), (e) (6), (7), (9), (10), and (11), and (i). These exemptions are necessary to ensure the proper functioning of the law enforcement activity, to protect confidential sources of information, to fulfill promises of confidentiality, to prevent interference with law enforcement proceedings, to avoid the disclosure of investigative techniques, to avoid the endangering of law enforcement personnel, to avoid premature disclosure of the knowledge of criminal activity and the evidentiary bases of possible enforcement actions, and to maintain the integrity of the law enforcement process. (3) Investigative and Inspection Records—COMMERCE/DEPT-12. Pursuant to 5 U.S.C. 552a(j)(2), these records are hereby determined to be exempt from all provisions of the Act, except 5 U.S.C. 552a (b), (c) (1) and (2), (e)(4) (A) through (F), (e) (6), (7), (9), (10), and (11), and (i). These exemptions are necessary to ensure the proper operation of the law enforcement activity, to protect confidential sources of information, to fulfill promises of confidentiality, to prevent interference with law enforcement proceedings, to avoid the disclosure of investigative techniques, to avoid the endangering of law enforcement personnel, to avoid premature disclosure of the knowledge of criminal activity and the evidentiary bases of possible enforcement actions, and to maintain the integrity of the law enforcement process. (4) Access Control and Identity Management System—COMMERCE/DEPT-25. Pursuant to 5 U.S.C. 552a(j)(2), these records are hereby determined to be exempt from all provisions of the Act, except 5 U.S.C. 552a(b), (c)(1) and (2), (e)(4)(A) through (F), (e)(6), (7), (9), (10), and (11), and (i). These exemptions are necessary to ensure the proper functioning of the law enforcement activity, to protect confidential sources of information, to fulfill promises of confidentiality, to maintain the integrity of the law enforcement process, to avoid premature disclosure of the knowledge of criminal activity and the evidentiary bases of possible enforcement actions, to prevent interference with law enforcement proceedings, to avoid disclosure of investigative techniques, and to avoid endangering law enforcement personnel. (5) Investigation and Threat Management Records—COMMERCE/DEPT-27. Pursuant to 5 U.S.C. 552a(j)(2), these records are hereby determined to be exempt from all provisions of the Act, except 5 U.S.C. 552a(b), (c)(l) and (2), (e)(4)(A) through (F), (e)(6), (7), (9), (10), and (11), and (i). These exemptions are necessary to ensure the proper functioning of the law enforcement activity of the agency, to prevent disclosure of classified information as required by Executive Order 13526, to assure the protection of the President, to prevent subjects of investigation from frustrating the investigatory process, to prevent the disclosure of investigative techniques, to fulfill commitments made to protect the confidentiality of information, and to avoid endangering these sources and law enforcement personnel.

15 C.F.R. § 4.34 Specific exemptions.

(a)(1) Certain systems of records under the Act that are maintained by the Department may occasionally contain material subject to 5 U.S.C. 552a(k)(1), relating to national defense and foreign policy materials. The systems of records published in the Federal Register by the Department that are within this exemption are: COMMERCE/BIS-1, COMMERCE/ITA-2, COMMERCE/ITA-3, COMMERCE/NOAA-11, COMMERCE/PAT-TM-4, COMMERCE/DEPT-12, COMMERCE/DEPT-13, COMMERCE/DEPT-14, COMMERCE/DEPT-25, and COMMERCE/DEPT-27. (2) The Department hereby asserts a claim to exemption of such materials wherever they might appear in such systems of records, or any systems of records, at present or in the future. The materials would be exempt from 5 U.S.C. 552a (c)(3), (d), (e)(1), (e)(4) (G), (H), and (I), and (f), because the materials are required by Executive order to be kept secret in the interest of the national defense and foreign policy. (b) The specific exemptions determined to be necessary and proper with respect to systems of records maintained by the Department, including the parts of each system to be exempted, the provisions of the Act from which they are exempted, and the justification for the exemption, are as follows: (1) Exempt under 5 U.S.C. 552a(k)(1). The systems of records exempt hereunder appear in paragraph (a) of this section. The claims for exemption of COMMERCE/DEPT-12, COMMERCE/BIS-1, COMMERCE/NOAA-5, COMMERCE/DEPT-25, and COMMERCE/DEPT-27 under this paragraph are subject to the condition that the general exemption claimed in § 4.33(b) is held to be invalid. (2)(i) Exempt under 5 U.S.C. 552a(k)(2). The systems of records exempt (some only conditionally), the sections of the Act from which exempted, and the reasons therefor are as follows: (A) Individuals identified in Export Administration compliance proceedings or investigations—COMMERCE/BIS-1, but only on condition that the general exemption claimed in § 4.33(b)(1) is held to be invalid; (B) Individuals involved in export transactions—COMMERCE/ITA-2; (C) Fisheries Law Enforcement Case Files—COMMERCE/NOAA-5, but only on condition that the general exemption claimed in § 4.33(b)(2) is held to be invalid; (D) Investigative and Inspection Records—COMMERCE/DEPT-12, but only on condition that the general exemption claimed in § 4.33(b)(3) is held to be invalid; (E) Investigative Records—Persons Within the Investigative Jurisdiction of the Department—COMMERCE/DEPT-13; (F) Access Control and Identity Management System—COMMERCE/DEPT-25, but only on condition that the general exemption claimed in § 4.33(b)(4) is held to be invalid; (G) Investigation and Threat Management Records—COMMERCE/DEPT-27, but only on condition that the general exemption claimed in § 4.33(b)(4) is held to be invalid; (ii) The foregoing are exempted from 5 U.S.C. 552a (c)(3), (d), (e)(1), (e)(4)(G), (H), and (I), and (f). The reasons for asserting the exemption are to prevent subjects of investigation from frustrating the investigatory process; to ensure the proper functioning and integrity of law enforcement activities; to prevent disclosure of investigative techniques; to maintain the ability to obtain necessary information; to fulfill commitments made to sources to protect their identities and the confidentiality of information; and to avoid endangering these sources and law enforcement personnel. Special note is taken that the proviso clause in this exemption imports due process and procedural protections for the individual. The existence and general character of the information exempted shall be made known to the individual to whom it pertains. (3)(i) Exempt under 5 U.S.C. 552a(k)(4). The systems of records exempt, the sections of the Act from which exempted, and the reasons therefor are as follows: (A) Special Censuses, Surveys, and Other Studies—COMMECE/CENSUS-3; (B) Economic Survey Collection—COMMERCE/CENSUS-4; (C) Decennial Census Program—COMMERCE/CENSUS-5; (D) Population Census Records for 1910 & All Subsequent Decennial Census—COMMERCE/CENSUS-6; (E) Other Agency Surveys & Reimbursable—COMMERCE/CENSUS-7; (F) Statistical Administrative Records System—COMMERCE/CENSUS-8; (G) Longitudinal Employer-Household Dynamics System—COMMERCE/CENSUS-9; and (H) Foreign Trade Statistics—COMMERCE/CENSUS-12. (ii) The foregoing are exempted from 5 U.S.C. 552a(c)(3), (d), (e)(1), (e)(4)(G) (H), and (I), and (f). The reasons for asserting the exemption are to comply with the prescription of Title 13 of the United States Code, especially sections 8 and 9 relating to prohibitions against disclosure, and to avoid needless consideration of these records whose sole statistical use comports fully with a basic purpose of the Act, namely, that no adverse determinations are made from these records as to any identifiable individual. (4)(i) Exempt under 5 U.S.C. 552a(k)(5). The systems of records exempt (some only conditionally), the sections of the Act from which exempted, and the reasons therefor are as follows: (A) Applications to U.S. Merchant Marine Academy (USMMA)—COMMERCE/MA-1; (B) USMMA Midshipman Medical Files—COMMERCE/MA-17; (C) USMMA Midshipman Personnel Files—COMMERCE/MA-18; (D) USMMA Non-Appropriated Fund Employees—COMMERCE/MA-19; (E) Applicants for the NOAA Corps—COMMERCE/NOAA-I; (F) Commissioned Officer Official Personnel Folders—COMMERCE/NOAA-3; (G) Conflict of lnterest Records, Appointed Officials—COMMERCE/DEPT-3; (H) Investigative and Inspection Records—COMMERCE/DEPT-12, but only on condition that the general exemption claimed in § 4.33(b)(3) is held to be invalid; (I) Investigative Records—Persons within the Investigative Jurisdiction of the Department COMMERCE/DEPT-13; (J) Litigation, Claims, and Administrative Proceeding Records—COMMERCE/DEPT-14; (K) Access Control and Identity Management System—COMMERCE/DEPT-25, but only on condition that the general exemption claimed in § 4.33(b)(4) is held to be invalid; and (L) Investigation and Threat Management Records—COMMERCE/DEPT-27, but only on condition that the general exemption claimed in § 4.33(b)(4) is held to be invalid. (ii) The foregoing are exempted from 5 U.S.C. 552a (c)(3), (d), (e)(1), (e)(4) (G), (H), and (I), and (f). The reasons for asserting the exemption are to maintain the ability to obtain candid and necessary information, to fulfill commitments made to sources to protect the confidentiality of information, to avoid endangering these sources and, ultimately, to facilitate proper selection or continuance of the best applicants or persons for a given position or contract. Special note is made of the limitation on the extent to which this exemption may be asserted. The existence and general character of the information exempted will be made known to the individual to whom it pertains. (c) At the present time, the Department claims no exemption under 5 U.S.C. 552a(k) (3), (6) and (7).

Starting a business? Corpus forms LLCs in all 50 states and DC.