subordinate commander. All delegations must be in writing. If an AARA's delegate denies access or amendment, the delegate must clearly state that he or she is acting on behalf of the AARA and identify the AARA by name and position in the written response to the requester. Denial of access or amendment by an AARA's delegate must have appropriate legal review. Delegations will not be made below the colonel (06) or GS/GM-15 level. Such delegations must not slow Privacy actions. AARAS will send the names, offices, telephone numbers of heir delegates to the Director of Information Systems for Command, Control, Communications and Computers, Headquarters, Department of the Army, ATTN: SAISIDP, Washington, DC 20310-0107; and the Department of the Army Privacy Review Board, Crystal Square 1, Suite 201, 1725 Jefferson Davis Highway, Arlington, VA 22202.

(1) The Administrative Assistant to the Secretary of the Army (AASA) for records of the Secretariat and its serviced activities, to include the personnel records maintained by the General Officer Management Office, personnel records pertaining to Senior Executive Service personnel serviced by the Office of the Secretary of the Army (OSA), and Equal Employment Opportunity (EEO) records from offices serviced by the OSA. The AASA will also serve as AARA for those records requiring the personal attention of the Secretary of the Army.

(2) The Inspector General (TIG) for TIG investigative records.

(3) The president or executive secretary of boards, councils, and similar bodies established by the Department of the Army to consider personnel matters, including the Army Board of Correction of Military Appeals, for records under their purview.

(4) The Deputy Chief of Staff for Personnel (DCSPER) for records of active and former non-appropriated fund employees (except those in the Army and Air Force Exchange Service), alcohol and drug abuse treatment records, behavioral science records, recruiting, Armed Services Vocational Aptitude Battery (ASVAB), equal opportunity, Junior Reserve Officers' Training Corps (ROTC), Senior ROTC Instructor, mili

tary academy cadet, selection, promotion, and reduction boards; special review boards; professional staff informational records; and entrance processing records (when records pertain to those not entering active duty).

(5) The Deputy Chief of Staff for Operations and Plans (DCSOPS) for military police records and reports and prisoner confinement and correctional records.

(6) Chief of Engineers (COE) for records pertaining to civil work (including litigation), military construction, engineer procurement, other engineering matters not under the purview of another AARA, ecology, and contractor qualifications.

(7) The Surgeon General (TSG) for medical records, except properly part of the Official Personnel Folder (OPM/ GOVT-1 system of records).

(8) Chief of Chaplains (CCH) for ecclesiastical records.

(9) The Judge Advocate General (TJAG) for legal records under TJAG responsibility.

(10) Chief, National Guard Bureau (NGB) for personnel records of the Army National Guard.

(11) Chief, Army Reserve (CAR) for personnel records of Army retired, separated and reserve military personnel members.

(12) Commander, United States Army Material Command (USAMC) for records of Army contractor personnel of the Army Material Command.

(13) Commander, United States Army Criminal Investigation Command (USACIDC) for criminal investigation reports and military police reports included therein.

(14) Commander, United States Total Army Personnel Command (PERSCOM) for personnel and personnel related records of Army members on active duty and current Federal appropriated fund civilian employees. (Requests from former civilian employees to amend a record in any OPM system of records such as the Official Personnel Folder should be sent to the Office of Personnel Management, Assistant Director for Workforce Information, Compliance and Investigations Group, 1900 E Street, NW., Washington, DC 20415-0001.

(15) Commander, U.S. Army Community and Family Support Center (USACFSC) for records relating to morale, welfare and recreation activities; community life programs; family action programs, retired activities, club management, Army emergency relief, consumer protection, retiree survival benefits, and records dealing with Department of the Army relationships and social security veteran's affairs, United Service Organizations, U.S. Soldiers' and Airmen's home and American Red Cross.

(16) Commander, U.S. Army Intelligence and Security Command (INSCOM) for intelligence, investigative and security records; foreign scientific and technological information; intelligence training, mapping and geodesy information; ground surveillance records; intelligence threat assess

ments; and missile intelligence data relating to tactical land warfare systems.

(17) Commander, Army and Air Force Exchange Service (AAFES) for records pertaining to employees, patrons, and other matters which are the responsibility of the Exchange Service.

(18) Commander, Military Traffic Management Command (MTMC) for transportation records.

(19) Director of Army Safety for safety records.

(20) Commander, U.S. Army Information Systems Command (USAISC) for records which do not fall within the functional area of another AARA.

(h) Department of the Army Privacy Review Board. The Department of the Army Privacy Review Board acts on behalf of the Secretary of the Army in deciding appeals from refusal of the appropriate AARAS to amend records. Board membership is comprised of the AASA, the Commander, USAISC, Pentagon, and TJAG, or their representatives. The AARA may serve as a nonvoting member when the Board considers matters in the AARA's area of functional specialization. The Commander, USAISC, Pentagon, chairs the Board and provides the recording secretary.

(i) Privacy Official. (1) Heads of Army Staff agencies and commanders of major Army commands and subordinate commands and activities will designate a privacy official who will serve

as a staff adviser on privacy matters. This function will not be assigned below battalion level.

(2) The privacy official will ensure that (i) requests are processed promptly and responsively, (ii) records subject to the Privacy Act in his/her command/ agency are described properly by a published system notice, (iii) privacy statements are included on forms and questionnaires that seek personnel information from an individual, and (iv) procedures are in place to meet reporting requirements.

[50 FR 42164, Oct. 18, 1985, as amended at 58 FR 51012, Sept. 30, 1993]

§ 505.2 Individual rights of access and amendment.

(a) Access under the Privacy Act. Upon a written or oral request, an individual or his/her designated agent or legal guardian will be granted access to a record pertaining to that individual, maintained in a system of records, unless the record is subject to an exemption and the system manager has invoked the exemption (see § 505.5), or the record is information compiled in reasonable anticipation of a civil action or proceeding. The requester does not have to state a reason or otherwise justify the need to gain access. Nor can an individual be denied access solely because he/she refused to provide his/her Social Security Number unless the Social Security Number was required for access by statute or regulation adopted prior to January 1, 1975. The request should be submitted to the custodian of the record.

(b) Notifying the individual. The custodian of the record will acknowledge requests for access within 10 work days of receipt. Records will be provided within 30 days, excluding Saturdays, Sundays, and legal public holidays.

(c) Relationship between the Privacy Act and the Freedom of Information Act. A Privacy Act request for access to records should be processed also as a Freedom of Information Act request. If all or any portion of the requested material is to be denied, it must be considered under the substantive provisions of both the Privacy Act and the

Freedom of Information Act. Any withholding of information must be justified by asserting a legally applicable exemption in each Act.

(d) Functional requests. If an individual asks for his/her record and does not cite, or reasonably imply, either the Privacy Act or the Freedom of Information Act, and another prescribing directive authorizes release, the records should be released under that directive. Examples of functional requests are military members asking to see their Military Personnel Records Jacket, or civilian employees asking to see their Official Personnel Folder.

(e) Medical records. If it is determined that releasing medical information to the data subject could have an adverse affect on the mental or physical health of that individual, the requester should be asked to name a physician to receive the record. The data subject's failure to designate a physician is not a denial under the Privacy Act and cannot be appealed.

(f) Third party information. Third party information pertaining to the data subject may not be deleted from a record when the data subject requests access to the record unless there is an established exemption (see §505.5(d)). However, personal data such as SSN and home address of third parties in the data subject's record normally do not pertain to the data subject and therefore may be withheld. Information about the relationship between the data subject and the third party would normally be disclosed as pertaining to the data subject.

(g) Referral of records. Requests for access to Army systems of records containing records that originated with other DOD Components or Federal agencies which claimed exemptions for them will be coordinated with or referred to the originator for release determination. The requester will be notified of the referral.

(h) Fees. Requesters will be charged only for the reproduction of requested documents. Normally, there will be no charge for the first copy of a record provided to the individual whose record it is. Thereafter, fees will be computed as set forth in AR 340–17.

(i) Denial of access. (1) The only officials authorized to deny a request from

a data subject for records in a system of records pertaining to that individual are the appropriate Access and Amendment Refusal Authorities (see

§ 505.1(f)), or the Secretary of the Army, acting through the General Counsel. Denial is appropriate only if the record:

(i) Was compiled in reasonable anticipation of a civil action or proceeding,

or

(ii) Is properly exempted by the Secretary of the Army from the disclosure provisions of the Privacy Act (see § 505.5), there is a legitimate governmental purpose for invoking the exemption, and it is not required to be disclosed under the Freedom of Information Act.

(2) Requests for records recommended to be denied will be forwarded to the appropriate AARA within 5 work days of receipt, together with the request, disputed records, and justification for withholding. The requester will be notified of the referral.

(3) Within the 30 work day period (see § 505.2(b)), the AARA will give the following information to the requester in writing if the decision is to deny the request for access:

(i) Official's name, position title, and business address;

(ii) Date of the denial;

(iii) Reasons for the denial, including citation of appropriate section(s) of the Privacy Act and this regulation;

(iv) The opportunity for further review of the denial by the General Counsel, Office, Secretary of the Army, The Pentagon, Washington, DC 20310, through the AARA within 60 calendar days. (For denials made by the Army when the record is maintained in one of OPM's government-wide systems of records, notices for which are described at appendix B, AR 340-21-8, an individual's request for further review must be addressed to the Assistant Director for Agency Compliance and Evaluation, Office of Personnel Management, 1900 E Street NW., Washington, DC 20415– 0001.)

(j) Amendment of records. (1) Individuals may request the amendment of their records, in writing, when such records are believed to be inaccurate as a matter of fact rather than judgment, irrelevant, untimely, or incomplete.

(2) The amendment procedures are not intended to permit challenge to a record that records an event that actually occurred nor are they designed to permit collateral attack upon that which has been the subject of a judicial or quasi-judicial action. Consideration of request for an amendment would be appropriate if it can be shown that circumstances leading up to the event that is recorded on the document were challenged through administrative procedures and found to be inaccurately described, that the document is not identical to the individual's copy, or that the document was not constructed in accordance with the applicable recordkeeping requirements prescribed. For example, the amendment provisions do not allow an individual to challenge the merits of an adverse action. However, if the form that documents the adverse action contains an error on the fact of the record (e.g., the individual's name is misspelled, an improper date of birth or SSN was recorded), the amendment procedures may be used to request correction of the record.

(3) US Army Criminal Investigations Command reports of investigation

(records in system notices AO501.08e Informant Register, AO508.11b Criminal Information Reports and Cross Index Card Files, and AO508.25a Index to Criminal Investigative Case Files) have been exempted from the amendment provisions of the Privacy Act. Requests to amend these reports will be considered under AR 195-2 by the Commander, US Army Criminal Investigations Command, action by the Commander, US Army Criminal Investigation Commander will constitute final action on behalf of the Secretary of the Army under that regulation.

(4) Records accessioned into the National Archives are exempted from the Privacy Act provision allowing individuals to request amendment of records. Most provisions of the Privacy Act apply only to those systems of records which are under the legal control of the originating agency; e.g., an agency's current operating files or records stored at a Federal records center.

(k) Procedures. (1) Requests to amend a record should be addressed to the custodian or system manager of that

record. The request must reasonably describe the record to be amended and the changes sought (i.e., deletion, addition, amendment). The burden of proof rests with the requester; therefore, the alteration of evidence presented to courts, boards, and other official proceedings is not permitted. (An individual acting for the requester must supply a written consent signed by the requester.)

(2) The custodian or system manager will acknowledge the request within 10 work days and make final response within 30 work days.

(3) The record for which amendment is sought must be reviewed by the proper system manager or custodian for accuracy, relevance, timeliness, and completeness so as to assure fairness to the individual in any determination made about that individual on the basis of that record.

(4) If the amendment is proper, the custodian or system manager will physically amend the record by adding or deleting information, or destroying the record or a portion of it, and notify the requester of such action.

(5) If the amendment is not justified, the request and all relevant documents, including the reasons for not amending, will be forwarded to the appropriate AARA within 5 work days and the requester so notified.

(6) The AARA, on the basis of the evidence, either will amend the record and notify the requester and the custodian of that decision, or will deny the request and inform the requester:

(i) of reasons for not amending; and (ii) Of his/her right to seek further review by the DA Privacy Review Board (through the AARA).

(7) On receipt of an appeal from a denial to amend, the AARA will append any additional records or background information that substantiates the refusal or renders the case complete and, within 5 work days of receipt, forward the appeal to the DA Privacy Review Board.

(8) The DA Privacy Review Board, on behalf of the Secretary of the Army, will complete action on a request for further review within 30 work days of its receipt by the AARA. The General Counsel may authorize an additional 30 days when unusual circumstances and

good cause so warrant. The Board may seek additional information, including the appellant's official file, if deemed relevant and necessary to deciding the appeal.

(i) If the Board determines that amendment is justified, it will amend the record and notify the requester, the AARA, the custodian of the record, and any prior recipients of the record.

(ii) If the Board denies the request, it will obtain the General Counsel's concurrence. Response to the appellant will include reasons for denial and the appellant's right to file a statement of disagreement with the Board's action and to seek judicial review of the Army's refusal to amend.

(9) Statements of disagreement will be an integral part of the record to which it pertains so the fact that the record is disputed is apparent to anyone who may have access to, use of, or need to disclose from it. The disclosing authority may include a brief summary of the Board's reasons for not amending the disputed record. The summary will be limited to the reasons stated to the individual by the Board.

(1) Privacy case files. Whenever an individual submits a Privacy Act request, a case file will be established; see system notice AO240.01DAAG. In no instance will the individual's request and Army actions thereon be included in the individual's personnel file. The case file will comprise the request for access/amendment, grants, refusals, coordination action, and related papers. This file will not be used to make any determinations about the individuals.

§ 505.3 Disclosure of personal information to other agencies and third parties.

(a) Disclosure without consent. The Army is prohibited from disclosing a record from a system of records without obtaining the prior written consent of the data subject, except when disclosure is:

(1) To those officers and employees of the Department of Defense who have a need for the record in the performance of their duties;

(2) Required under the Freedom of Information Act (see §505.3(c) for information normally releasable);

(3) Permitted by a routine use that has been published in the FEDERAL REGISTER;

(4) To the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to title 13 of the United States Code;

(5) To a recipient who has provided the Army with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable;

(6) To the National Archives of the United States as a record that has sufficient historical or other value to warrant its continued preservation by the U.S. Government, or for determination of such value by the Administrator of the General Services Administration (GSA), or designee. (Records sent to Federal Records Centers for storage remain under Army control; these transfers are not disclosures and do not therefore need an accounting.)

(7) To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the Army element which maintains the record. The request must specify the particular portion desired and the law enforcement activity for which the record is sought;

(8) To a person pursuant to a showing of compelling circumstances affecting the health and safety of an individual. Upon such disclosure, notification will be transmitted to the last known address of such individual;

(9) To either House of Congress, or to a committee or subcommittee to the extent that the subject matter falls within the jurisdiction of the committee or subcommittee;

(10) To the Comptroller General, or any authorized representative in the course of the performance of the duties of the General Accounting Office;

(11) Pursuant to the order signed by a judge of a court of competent jurisidiction. (Reasonable efforts must be made to notify the individual if the