DOE O 1800.1A Chg 1, Privacy Act

U.S. Department of Energy ORDER Washington, D.C. DOE 1800.1A 8-31-84 SUBJECT: PRIVACY ACT 1. 2. 3. 4. PURPOSE. To establish guidelines and procedures for implementing the privacy Act of 1974 (Public Law 93-579, Title 5 U.S.C. 552a) in the Department of Energy (DOE). CANCELLATION. DOE 180001, PRIVACY ACT, of 5-18-81. SCOPE. This Order applies to all DOE Elements and contractors performing work the DOE as provided by law and/or contract and as implemented by the appropriate contracting Officer. REFERENCES. a. b. c. d. e. f. Privacy Act of 1974 (Public Law 93-579, 88 Stat. 1896 (Title 5 U.S.C. 552a)) as amended, which establishes the guidelines and regulations to the Privacy Act. Freedom of Information Act of 1974, Public Law 93-502, Title 5 U.S. C. 552, as amended, which establishes guidelines and regulations to imple- ment the Freedom of Information Act. DOE Privacy Act Regulations, Title 10 Code of Federal Regulations (CFR) 1008, ‘Records Maintained on Individuals,” of 10-16-80, which establishes the procedures to implement the Privacy Act of 1974 within the DOE. Office of Management and Budget ((MB) Memorandum, “Implementation, Guidelines, and Responsibilities, m 40 Federal Register 28949, of 7-9-75, as amended, which establishes Privacy Act guidelines. OMB Memorandum, “Computer Match Checklist and Model Control System and Resource Document for Conducting Computer Matching Projects Involving Individual Privacy Data," of 12-29-83, which provides instructions for the preparation of a computer match checklist to be completed by each Department engaging in or providing data for computer matching of Federal data records conducted by Federal, state, or local entities. OMB Memorandum, ‘Revised Supplemental Guidance for Conducting Matching programs,” of 5-11-82, which updates and simplifies computerized matching programs. 2 g. h. f. j. DOE 1800.lA 8-31-84 OMB Memorandum, ‘Revised Supplemental Guidance on Implementation of the Privacy Act of 1974,” 49 FR 12338, of 3-29-84, which clarifies the rela- tionship between the Privacy Act and the Freedom of information Act and improves agency implementation of both Acts. DOE 1323.1A, CONGRESSIONAL REPORTS MONITORING SYSTEM, of 7-13-84, which l stablishes. procedures to assure that reports to the Congress, its committees, or officers are appropriately prepared and submitted when due. DOE 1360.2, COMPUTER SECURITY PROGRAM FOR UNCLASSIFIED COMPUTER SYSTEMS, of 3-9-79, which establishes policies and procedures for safe- guarding sensitive unclassified information processed, stored, or pro- duced on DOE computer systems. DOE 1900.2A. PROCEDURES FOR PROCESSING FEDERAL REGISTER DOCUMENTS, of 11-9-82, which defines responsibilities for the administrative manage- ment of “Federal RegisterM documents, including approval, promulgation, and certification of all DOE proposed and final rules, regulations, and official documents, l xcept those of the Federal Energy Regulatory Commission. 5. POLICIES. a. It is the policy of DOE to facilitate full exercise of rights conferred on individuals under the Privacy Act and to ensure the protection of the privacy of individual on whom the DOE maintains records in a system of records. b. Requests for information in the possession of DOE will be promptly responded to in accordance with the Privacy Act upon receipt of any request or appeal from a citizen of the United States or an alien lawfully admitted for permanent residence. c. The DOE shall:

(1) (2) (3) Maintain only such information about an individual as is relevant and necessary to accomplish l purpose of the l gency rewired to be accomplished by statute or by executive order of the President; Maintain information with accuracy, relevancy; timeliness, and completeness as is reasonably necessary to ensure fairness in determinations made by the DOE about the individual; Obtain information directly from the individual, to the extent practicable; DOE 1800.1A 8-31-84 (4) (5) (6) (7) (8) (9) d. The 3 Establish appropriate safeguards to protect information from unwarranted disclosure; Maintain no record describing how an individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual about whom the record is maintained unless pertinent to and within the scope of an authorized law l nforcement activity; Notify the individual before his or her records are disclosed pursuant to compulsory process; Disclose records to persons other than the individual only as provided for in subsection b of the Privacy Act; Unless specifically authorized by law, not sell or rent an individual’s name and address. However, this policy shall not be construed to require the withholding of names and addresses other- wise permitted to be made public; and Coordinate requests as appropriate with other agencies and nations. policies and procedures stated in this Order apply to all DOE elements and DOE contractors and their employees to the extent required by Title 5 U.S. C. 552a(m). Matters outside the applicability of this Order include the following: (1) Requests made only under the Freedom of Information Act (Title 5 U.S.C. 552); (2) Requests involving information pertaining to an individual which is not within a system of records as defined in the Privacy Act; (3) Requests to correct a record where a grievance procedure iS available to the individual either by regulation or by provision in a collec- tive bargaining agreement with the DOE; and (4) Requests for employee-employer services and counseling which were routinely granted prior to enactment of the Privacy Act, including, but not limited to, test calculations of retirement benefits, l xplanations of health and life insurance programs, and tax withholding options. These services and counseling will continue as before the l nactment of the Privacy Act. DOE 1800.1A 8-31-84 e. The selection of the appropriate method for processing an individual’s request for records depends on the status or capacity of the individual, the wording of the request, and the character of the records requested. The DOE anticipates the following situations and will undertake processing as indicated: (1) (2) (3) (4) (5) (6) When an Individual requests his or her own records l nd only cites the Privacy Act, the request shall be processed under the Privacy Act and the DOE implanting regulations; When l n individual requests his or her own records and only cites the Freedom of Information Act, the request shall be processed under the Freedom of Information Act and the DOE Implementing regulations; When an Individual requests his or her own records and cites both the Privacy Act and the Freedom of Information Act, the request shall be processed under the Privacy Act and the DOE implementing regulations; When an individual requests his or her own records and cites neither the Privacy Act nor the Freedom of Information Act, the request shall be processed under the Privacy Act and the DOE implementing regulations;

When a parent, guardian, or legal representative requests informa- tion on behalf of an individual the request shall be processed as though the request was submitted by that individual; and When an individual or other person requests records pertaining to a third party, l nd neither the Freedom of Information nor Privacy Act are cited the request shall be processed under the Freedom of Information Act and the DOE implementing regulations, l xcept as provided on page 4, subparagraph e(5). 6. DEFINITIONS. l . b. c. Appeal is a request by an Individual that l n Initial l gency denial of a request for access, correction, or amendment to a record of that individual be reviewed l nd reversed. is the Director of Hearings and Appeals . Appropriate General Counsel or Field Counsel iS the General Counsel provided for in section 202(b) of the DOE Organization Act or any WE attorney designated by the General Counsel as having responsi- bility for counseling on Privacy Act matters. Appropriate Appeal Authority (HG-1) or his or her designee. 4 DOE 1800.1A 5 8-31-84 d. e. f. h. i. j. k. 1. m. n. Computer Match is the computerized omparison of two or more automated systems of records, “at least one of which is a Federal system, identify individuals common to two or more of the record systems unique to one of the record systems. Computer Match Checklist is a required comparison to all matching programs of agencies subject to the Privacy Act. Deemed to Have Been Received is the determination by which the establishes the commencement of the 10 working days (excluding Sunday, and Federal holidays) response period. to or DOE Saturday, Individual is any United States citizen or l n alien lawfully admitted for permanent residence in the United States. It does not include corporations, associations, partnerships, trustees, receivers, and public or private organizations. Legal Representative is a designee appointed by a requester to act or represent the requester. Parent or Legal Guardian is a designee who exercises the legal rights of a minor or an Individual declared incompetent due to physical or mental incapacity or age by a court of competent jurisdiction. Privacy Act Officer is an official designated by the Director of Administration (MA-2) to administer the Privacy Act. Proposed New System is a system of records for which a notice and report to the OMB and the Congress are being prepared. Record is any item, collection, or grouping of information about an individual that is maintained by or for the DOE including, but not limited to, education, financial transactions, medical history, criminal or employment history that contains an individual’s name or other identifying number, symbol, or particulars assigned to an individual. Request is a written inquiry by an individual (or that individual’s parent, legal guardian or representative) for any record maintained in a system of records which pertains to that individual. Request for Access is a written request by an individual or his or her l uthorized legal representative or guardian, or parent, to review a record which is in a particular system of records and pertains ‘to that individual. g. 6 O. p. q. r. s. DOE 1800.1A 8-31-84 Request for Correction or Amendment is a Written request by an individual, parent, or legal guardian or representative that the DOE change, believes is incomplete. Routine Use purpose for

amend, or correct a record which the individual inaccurate, unnecessary, irrelevant, untimely, or is the disclosure of a record compatible with the which it was collected. Statistical Record is a record in a system of records maintained only for statistical research or reporting purposes l nd not used in whole or in part in making any determination about an identifiable individual, except as provided by Title 12 U.S.C. 8. System Manager is the official designated by WE in a system notice published in the "Federal Register" System of Records is a group of any from which information is retrieved by some identifying number, symbol, individual. BY ORDER OF THE SECRETARY OF ENERGY: to maintain a system of records. records under the control of DOE by the name of an individual or or particulars assigned to an WILLIAM S. HEFFELFINGER Director of Ministration DOE 1800.1A 8-31-84 TABLE OF CONTENTS i(and ii) CHAPTER I - RESPONSIBILITIES AND AUTHORITIES 1. 2. 4. 5. 6. 8. 10. 11. Assistant Secretary for Defense Programs . . . . . . . . . . . . . . . . . . . . . . . . . Director of Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Director of Hearings and Appeals .......................... Appropriate General Counsel or Field Counsel . . . . . . . . . . . . . . . . . . . . . Director of Administrative Services . . . . . . . . . . . . . . . . . . . . . . . . . Director of Personnel . . . . . . .... . . . . . . . . . . . . . . . . . . . . . Director of Classification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Heads of Field Organizations . . . . . . . . . . . . . . . . . . . . . . . Privacy Act Officer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . System Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . Headquarters Privacy Act Officer . . . . . . . . . . . . . . . . . . . . . . . Page I-1 I-1 I-1 I-1 I-2 I-2 I-2 I-3 I-3 I-4 I-5 CHAPTER II - ACTION ON INITIAL REQUEST 1. 3. 4. 5. 6. 7. Procedures for Inquiries, Times, Places, and Requirements for Identification of Individuals Making Requests for Access, Correction, or Amendment of Records . . . . . . . . . . . . . . . . . . . . . . II-1 Disclosure of Information to Individuals .......................II-3 Disclosure of Records to Persons Other than an Individual to Whom It Pertains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II-5 Medical Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II-6 Exemptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II-7 Review of Request for Correction or Amendment of Record ....... II-9 Appeal of Initial Adverse Agency Determination on Access, Correction, or Amendment .. . . . . . . . . . . . . . . . . . . . . . . . . . II-11 Penalties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II-14 Fees ............................................ II-14 CHAPTER III - NEW SYSTEMS AND AMENDMENTS T0 EXISTING SYSTEM OF RECORDS 1. Requirements for System Notices . . .. . . . . . . . . . . . . . . . . . . . . III-1 2. Content of Records on New l nd Significantly Altered System of Records . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . III-2 3. Content of System Notices . . . . . . . . . . . . . . . . . . . . . . III-2 4. Content of Federal Register Notices ....................... III-3 5. Responsibilities of System Managers . . . . . . . . . . . . . . . . . . . . . . III-3 6. Responsibilities of Headquarters Privacy Act Officer . . . . . . . . . . . . . III-4

7. 9. 2. DOE 1800.1A 8-31-84 I-1 CHAPTER I RESPONSIBILITIES AND AUTHORITIES 1. ASSISTANT SECRETARY FOR DEFENSE PROGRAMS (DP-1). a. b. c. d. Concurs in final determinations concerning the disclosure or denial of all classified information or information in systems of records pertaining to security. Concurs in all responses to requests for and final determinations on l ppeals concerning records which contain Unclassified Controlled Nuclear Information controlled under section 148 of the Atomic Energy Act of 1954, as amended. Consults with privacy act officer to arrange procedures to be followed in granting an individual access to classified information in a record or system of records pertaining to an individual. Provides a site for the review of any classified records determined to be accessible. 2. DIRECTOR OF ADMINISTRATION (MA-2). a. Administers departmentwide Privacy Act activities. b. Designates privacy act officers. 3. DIRECTOR OF HEARINGS AND APPEALS (W-l). a. Makes determinations on appeals of denials of all initial requests, except those denials relating to records maintained in Governmentwide systems of records reported by the Office of Personnel Management and Issues decisions to requester. b. Obtains concurrence from the Assistant Secretary for Defense Programs as appropriate regarding classtified materials or information falling within the scope of Section 148 of the Atomic Energy Act of 1954, as amended (Title 12 U.S.C. 2168). c. Provides copies of all appeals and subsequent decisions to the privacy l ct officer. 4. APPROPRIATE GENERAL COUNSEL OR FIELD COUNSEL. 1 . Provides legal advice to DOE employees concerning the Privacy Act. I-2 DOE 1800.1A 8-31-84 b. Concurs in all determinations to grant or deny a request for access, correction, or amendment of a record maintained in a system of records. c. Assists the Department of Justice in representing the DOE in litigation involving the Privacy Act. d. Headquarters counsel acts as a liaison between the Department of Justice and the OMB on issues and litigation arising under the Privacy Act. 5. DIRECTOR OF MINISTRATIVE SERVICES (MA-23). a. Develops and administers departmentwide policies, standards, l nd proce- dures to implement the provisions of the Privacy Act. b. Supervises the operation of the Headquarters Privacy Act Office. c. Ensures special d. Ensures e. Ensures altered the preparation of the annual report to the MB and any other reports. the annual review of the notice of system of records. the publishing in the "Federal Register" of notices of new or system of records. 6. DIRECTOR OF PERSONNEL (MA-20). Delegates to appropriate personnel officers responsibilities outlined as follows: a. Maintains l nd controls official personnel files for Headquarters, exclusive of the Office of the Inspector General, l nd provides facilities for their review l nd inspection by current employees properly identified and l uthorized representatives of employees. b. Upon receipt of a directive to amend an official personnel file, inserts the amendment and informs the requester and the privacy act officer of the completion of amendment and provides a copy of the corrected-record to the requester. 7. DIRECTOR OF CLASSIFICATION (DP-32). a . Concurs in all responses tO requests for classified or classifiable records. b. Coordinates reviews with other agencies and nations where their classified information may be contained in requested records.

I-3DOE 1800.1A 8-31-84 8. HEADS OF FIELD ORGANIZATIONS. a. Recommends a privacy act officer for his or her respective location for designation by the Director of Administration. b. Reviews his or her own system of records annually to ensure compliance with the provisions of the Privacy Act. c. Provides information on system of records in his or her custody to Headquarters privacy act officer. 9. PRIVACY ACT OFFICER. a. b. c. d. e. f. g. h. f. Determines whether record is a proper request inquiry for access, correction, or amendment to a under the Privacy Act. Provides information on records in his or her custody to the Head- quarters privacy act officer for inclusion in the annual report. Designates a primary system manager, who shall be responsible for the search, coordination, and response to the request. Ascertains which organization has primary responsibility of the records requested and identifies the appropriate principle system manager where a request entails records under the jurisdiction of more than one system manager. Assists the requester in reformulating an improper request for access, correction, or amendment for a record in a system of records. Consults with the system manager l nd the appropriate General Counsel on any recommendation to deny a request for fee waiver for correspondence other than Headquarters controlled. Determines fees to be charged for costs of reproducing records requested. Submits all fee determinations for collection to appropriate financial official. Notifies the system manager l nd provides Headquarters privacy act officer with a copy of the final letter of Headquarters controlled correspondence to the requester. I-4 j. k. l. m. n. o. DOE 1800.1A 8-31-84 Develops and maintains a status reporting system to ensure that requests and appeals are responded to within designated time limits or that extensions are secured, as appropriate. Consults with appropriate DOE medical officer and/or the personal phy- sician of the requester on the release of medical records. Requires and verifies the identification of each requester of infor- mation as required by Title 10 CFR 1008.4. Identifies and reviews the records encompassed by requests and advises the requester within 10 working days (excluding Saturday, Sunday, and Federal holidays), unless otherwise extended, whether the request is to be granted or denied. Prepares and submits to Headquarters privacy act officer a computer match checklist before any matches are initiated. Reviews systems of records to verify if systems are applicable to any matching programs. Prepares a notice of the agency’s Intention, to be published in the "Federal Register" prior to disclosing records outside the agency for matching purposes. Maintains adequate internal controls on approvals and operations of computer matching activities. Notifies the system manager when the requester, or someone acting on his or her behalf, appeals either the decision to withhold the requested information or not to amend the requester’s file. 10. SYSTEM MANAGER. a. b. c. Develops and maintains a status reporting system to ensure that requests and appeals are responded to-within the time constraints or that extensions are secured as appropriate. Transmits nonclassified material requested under the Privacy Act to the privacy act officer with recommendations to grant or deny access in full or partially and concurs on all approvals and denials of requests.

Secures the concurrence from the Assistant Secretary for Defense Programs and the appropriate general counsel on all requests for information controlled under the Atomic Energy Act of 1954, as amended. DOE 1800.1A I-5 (and I-6) 8-31-84 d. Secures the concurrence of the appropriate general counsel on all recommendations for denial of access. e. Reviews all requests for correction or amendment of records and provides recommended decisions with basis for denial to appropriate privacy act officer. f. Estimates costs of reproducing requested documents when fees are to be charged, and notifies the privacy act officer. g. Recommends denial or acceptance of requests for fee waivers not controlled by Headquarters in conjunction with l ppropriate general counsel. h. Provides copies of exempt records to the appropriate appeal authority when requested. i. Notifies the computer protection program manager, Office of Computer Services and Telecommunications Management (MA-24), who certifies that protection specifications are adequate for new systems and amendments to existing systems of records. 11. HEADQUARTERS PRIVACY ACT OFFICER (MA-232.1). Carries out Privacy act officer functions as listed on page 1-3, paragraph 9, for Headquarters. In addition: a. b. c. d. e. f. g. h. Provides guidance to DOE personnel on implementation and responsi- bilities of the Privacy Act; Prepares the annual report to the OMB; Ensures appropriate training for DOE officials responsible for the implementation of the Privacy Act; Reviews established systems of records and published notices for compliance with the Privacy Act; Publishes notices and rules, as rquired; Submits "Report on New and Altered Systems" to the OMB and Congress; Consults with General Counsel, as appropriate, on requests for fee waiver regarding Headquarters controlled correspondence; and Controls and determines responsive program office for all Headquarters controlled correspondence. DOE 1800.1A 8-31-84 II-1 CHAPTER II ACTION ON INITIAL REQUESTS 1. PROCEDURES FOR INQUIRIES, TIMES, PLACES, AND REQUIREMENTS FOR IDENTIFICATION INDIVIDUALS MAKING REQUESTS FOR ACCESS, CORRECTION OR AMENDMENTOF a. If an Individual believes DDE maintains a record pertaining to that” Individual but cannot identify the appropriate system of records the l ppropriate privacy act officer shall provide assistance. b. DOE F 1800, "Privacy Act Information Requests" (Attachment II-l), should be used by a requester to make inquiries under the Privacy Act. If an individual does not use the official form, the top of the request should bear the words ‘Privacy Act," "Privacy Act Access," or "Privacy Act Amendment," as applicable, in capital letters. If the inquiry is for general information about the Privacy Act, no particular designa- tion is required. If the request is for access to records that the DOE maintains in a system of records, the requests shall: (1) Be in writing and signed by the individual making the request; (2) State that the request is a "Privacy Act Access," or "Privacy Act Amendment” request; (3) Establish his or tier identity by: (a) Including with the request, if submitted by mail, a photocopy of two identifying documents bearing his or her name and signature, which shall bear the current home or business l ddress and date of birth; l nd (b) Appearing at the appropriate DOE location during regular business hours and presenting either of the following;

1 One identifying document bearing the individuals name and signature, current home or business address, and date of birth, or 2 Two identifying documents bearing the individual's name l nd signature, one of which shall bear the individual’s current home or business address l nd date of birth; (4) Provide such other proof of identity as the privacy act officer deems satisfactory. OF II-2 c. d. (5) (6) (7) (8) DOE 1800.1A 8-31-84 Establish identity in a representative capacity of parent or legal guardian. In case of parent of a minor, proof of identity shall be a certified and/or authenticated copy of the minor’s birth certificate. In case of legal guardian of a person who has been declared incompetent due to physical or mental capacity or a e by a court of competent Jurisdiction, the proof of identity shall be a certified or authenticated copy of the order from the court of competent Jurisdiction. Establish identity in capacity of legal representative with a notorized statement from the individual l ttesting that such disclosure be made available to his or her designated legal representative. Submit a notorized statement attesting to his or her identity and understanding of the criminal penalties provided under section 1001 of Title 18 of the United States Code for making false state- ments to a Government agency and under subsection (i) (3) of the Privacy Act for obtaining records under false pretenses, if he or she is unable to produce satisfactory evidence of identity under paragraph (3) or (5) of this section, or if the privacy act officer or the appropriate system manager determines that the information in a record is so sensitive that unauthorized access could cause harm or embarrassment to the individual whose record is involved. Proof of United States citizenship or permanent resident alien status. Any request not addressed and marked l s specified in paragraph (b) of this section shall be forwarded immediately to the appropriate privacy act officer. An improperly l ddressed request will not be deemed to have been received for purposes of measuring time limits for response to the requester until actual receipt by the appropriate privacy act officer. The individual making the request shall be notified of the date when the request was officer. Each request received shall be acted upon privacy act officer should be provided to working days (excluding Saturday, Sunday, date of receipt. If a response cannot be received by the privacy act promptly. A response by the the requester within 10 and Federal holidays) of the provided within the 10 work- ing days, the privacy act Officer shall send an interim response advising the requester of the status of the request, including an esti- mate of the time within which action is expected to be taken on the request l nd l sking for further information, as may be necessary, to DOE 1800.1A 3-31-84 II-3 respond to the request. Action will be completed as soon as possible, but not later than 20 working days after receipt of the original speci- fic inquiry. e. In cases of unusual circumstances (request of records from inactive storage, a voluminous amount of data is involved, or consultations with other agencies having a substantial Interest in the determinations of the request are necessary) that l ction cannot be completed within the initial 20 working days, the privacy act officer will advise the indi- vidual of the reason for the delay and the date by which l ction can be expected to be completed.

f. The initial correspondence sent to the requester shall contain the control number assigned to the request by the privacy act officer and, to facilitate processing of the request, the requester should use the control number in future correspondence pertaining to the request. The DOE shall use the control number in all subsequent correspondence per- taining to that request. g. An individual shall not be required to state a reason or otherwise Justify his or her inquiry. 2. DISCLOSURE OF INFORMATION TO INDIVIDUALS. a. An individual shall be granted access to a record pertaining to him or her, except where the provisions on page II-5, subparagraph g apply. b. The privacy act officer shall notify the individual of a determination to grant access and provide the following information: (1) (2) (3) (4) (5) Whether there is information or a record pertaining to the requester that is contained in a system of records; The methods of access; The place at which the record may be inspected; The earliest date on which the record may be inspected and the period of time that the records will remain l vailable for inspection. In no event shall the earliest date be later than 30 calendar days from the date of notification; A notification that copies of the records are enclosed, or the estimated date by which 1 copy of the record could be mailed and the estimate of fees that would be charged to provide other than the first copy of the record. II-4 c. d. e. f. DOE 1800.1A 8-31-84 (6) The fact that the individual, if he or she wishes, may be accom- panied by another person during the in-person review of the record or information, provided that the individual shall first furnish to the privacy act officer a written statement authorizing disclosure of that individual’s record in the accompanying per- son’s presence; and (7) Any additional requirements that must be satisfied in order to provide information about or to grant access to the requested record or information. The following methods of access to records by an individual may be l vatlable depending on the circumstances of a given situation: (1) (2) (3) Inspection in person in an office specified by the privacy act officer; Transfer of copies of the requested records to a Federal facility more convenient to the individual may be arranged, but only if it is determined that a suitable facility is available, that the individual’s access can be properly supervised at that facility, and that transmittal of the record copies to that facility will not unduly interfere with operations of the DOE or involve unreasonable costs, In terms of both money and staff resources; and The requested number of copies in addition to the initial copy may be mailed at the request of the individual. Access to medical records is governed by the provisions on pages II-6 and 7. The DOE shall supply such other information and assistance at the time of access as to make the record intelligible to the requester. The DOE reserves the right to limit access to copies and abstracts of original records. This election would be appropriate when the record is in an automated data media such as tape or disc, and when deletion of information is permissible under an exemption. In no event shall original records of the DOE be made available to the individual except under the immediate supervision of either the privacy act officer, system manager, or his or her designee. Subsection 2071(a) of Title 18 U.S.C. makes it a crime to conceal, mutilate, or destroy any record filed in a public office or attempt to do any of the foregoing.

DOE 1800.1A 8-31-84 II-5 g. Access by an individual to a record which pertains to that individual will be denied only upon a determination by the Privacy act (1) (2) (3) (4) h. The officer that: . The record is exempt as indicated on pages II-7 and II-8; The record is information compiled in reasonable anticipation of a civil action or proceeding; The provisions set forth on pages II-6 and II-7 pertaining to medi- cal records temporarily have been invoked; and The individual has failed to comply with the procedural require- ments of this Order. privacy act officer shall give notice of denial of access to records to the individual in writing and shall include the following information: (1) The system manager’s name and title; (2) The date of the denial; (3) The reasons for the denial, including citation of the appropriate Privacy Act section; and (4) The individual’s opportunities for further administrative appeal, including the name, title, and business address of the official responsible for administrative and judicial reviews. 3. DISCLOSURE OF RECORDS TO PERSONS OTHER THAN AN INDIVIDUAL TO WHOM IT PERTAINS. The DOE may disclose a record pertaining to an Individual to a person other than an individual to whom it pertains only in the following instances: a. Upon written request by an Individual and the requirements stated on page II-1, paragraph 1; b. To a parent or legal guardian under Title 5 U.S.C. 552a(h); but disclo- sure to a parent or legal guardian shall not limit the rights of minors to access their own records; II-6 c. d. e. 8-31-84 To a legal representative with a notarized authorization from an individual permitting such disclosure on his or her behalf; When required by the Privacy Act and not covered explicitly by the provisions of Title 5 U.S.C. 552a(b); and When permitted under Title follows: (1) TO those officers and in the performance of 5 U.S.C. 552a(b)(1) through (11), as employees of DOE who maintain a record their duties; (2) Required under Title 5 U.S.C. 552 (the Freedom of Information Act); (3) For a routine use as defined in paragraph (a)(7) of the Privacy Act and described under subsection (e)(4)(D); (4) To the Bureau of the Census for purposes of planning or carrying out a census, survey, or related activity pursuant to the provi- sions of Title 13; (S) TO a recipient who has provided the DOE with adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable; (6) To the National Archives of the United States as a record which has sufficient historical or other value to warrant its continued preser- vation by the Federal Government or for evaluation by the Administrator, General Services Administration, or his or her designee to determine whether the record has such value; and (7) To l nether agency or an instrumentality of any governmental jurisdiction within or under the control of the United States for l criminal law enforcement activity as authorized by law... l nd If the head of the agency or instrumentality request to the l gency which maintains the record law l nforcement activity for which the record is 4. MEDICAL RECORDS. has made a written specifying the sought. 1. If the privacy act officer believes based upon a recommendation of the system manager and the appropriate DOE medical officer, that disclosure of medical and/or psychological information directly to an individual could have an adverse effect upon that individual, the individual

DOE 1800.1A DOE 1800.1A 8-31-84 (1) (2) (3) II-7 Designate in writing a physician or mental health professional to whom the records are to be disclosed; Submit a signed statement by his or her physician or a mental health professional indicating that in his or her view, disclosure of the requested records or information directly to an individual would not have an adverse effect upon that individual; l nd Obtain specific, written consent for the DOE to consult the indivi- dual’s physician or mental health professional in the event the DOE believes such consultation is l dvisable, l nd the individual con- sents to give such authorization. The DOE shall pay no cost for any such consultation. b. If an individual refuses in writing to give the names and consents set forth on pages II-6 and II-7, paragraph a, and the DOE has determined that disclosure could have an adverse effect upon an individual, the privacy act officer shall obtain a written statement from the appro- priate DOE medical officer, deny the request, l nd provide appeal rights to the requester. 5. EXEMPTIONS. a. Section 552a(j) of Title 5 U.S.C. allows the exemption of any system of records within the DOE from any part of section 552a except subsections (b), (c)(1) and (2), (e)(4)(A) through (f), (e)(6), (7), (9), (10), (11), and (i) of the Privacy Act If the system of records is maintained by a DOE element which performs as its principal functions any activity pertaining to the l nforcement of criminal laws, including police efforts to prevent, control, or reduce crime or to apprehend criminals which consists of: (1) information compiled for the purpose of identifying individual criminal offenders and alleged offenders; (2) information compiled for the purpose of a criminal Investigation, including reports of informants l nd investigators associated with an identifiable individual; or (3) reports identifiable to an individual compiled at any stage of the process of l nforcement of criminal laws or for arrest or indictment-through release from supervision. b. Section 552a(k) of Title 5 U.S.C. allows the exemption of l ny system of records within the DOE from subsection (c)(3), (d), (e)(l), (e)(4)(6), (H), and (I), and (f) of section 3 of the Privacy Act, If the system of records consists of: (1) Records “that are specifically l uthorized under criteria estab- lished under executive order to be kept secret in the interest of national defense or foreign policy and are in fact properly classified pursuant to such executive order; (2) (3) (4) (5) (6) (7) DOE 1800.1A 8-31-84 Investigatory material compiled for law enforcement purposes, provided, however, that if an individual is denied any right, privilege, or benefit to which he or she would otherwise be entitled by Federal law or for which he or she would otherwise be eligible, as a result of the maintenance of such material, such material shall be provided to such individual, except to the extent that it would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence, or, prior to the effective date of this section under an implied promise that the identity of the source would be held in confidence; Records maintained in connection with providing protective services to the President of the United States or other individuals pursuant to section 3055 of Title 18 U.S.C.;

Records required by statute to be maintained and used solely as statistical records; Investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for Federal civilian employment, military services, Federal contracts, or access to classified information, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the Government under an expressed promise that the identity of the source would be held in confidence, or, prior to the effective date of this section, under an implied promise that the identity of the source would be held in confidence; Testing or examination materials used solely to determine individual qualifications for appointment or promotion in the Federal service the disclosure of which comprises the objectivity or fairness of the testing or examination processes; and Evaluation material used to determine potential for promotion in the armed services, but only to the extent that the disclosure of such material would reveal the Identity of the source who furnished information to the Government under an express promise that the identity of the source would be held in confidence, or, prior to the effective date of this section, under an implied promise that the identity of the source would be held in confidence. II-8 DOE 1800.1A 8-31-84 II-9 6. REVIEW OF REQUEST FOR CORRECTION OR AMENDMENT OF RECORD. a. Not later than 10 working days (excluding Saturday, Sunday, and Federal holidays) after receipt of a request to correct or amend a record, the privacy act officer shall send an acknowledgment providing an estimate of time within which action will be taken on the request and asking for such further information as may be necessary to process the request. The l stimate of time may take into account unusual circumstances as described on page II-3, paragraph e. No acknowledgment shall be sent If the request can be reviewed, processed, and the individual notified of the results of review (either compliance or denial) within 10 working days. b. If the privacy act officer cannot make the determination within 10 working days, the individual shall be advised in writing of the reason for delay and the date (within 20 working days) a decision is expected to be made. c. An individual’s identity shall be established by his or her signature on the request since the request will follow a request for access. d. After acknowledging receipt of a request and receiving such further information as might have been requested, or after arriving at a deci- sion within 10 working days, the privacy act officer promptly shall either: (1) Instruct the system manager(s) to make the requested correction or amendment and advise the individual in writing of such action, providing either a copy of the corrected or amended record or a statement as to the means whereby the correction or amendment was effected in cases where a copy cannot be provided (for example: erasure of information from a record maintained only in magneti- cally recorded computer files); or (2) Inform the individual in writing that his or her request is denied and provide the following information: (a) The (b) The (c) The system manager(s) name and title; date of the denial; reasons for the denial, including citation of the : appropriate section of the-Privacy Act; (d) The procedures for appeal of the denial as set forth on page II-11, paragraph 7, including the name and address of the appropriate appeal authority; and

II-10 e. f. DOE 1800.1A 8-31-84 (e) Notification of the right of the individual to judicial review of the denial and to file a statement of disagreement. Whenever an individual’s record is corrected or amended pursuant to a request by that individual, the privacy act officer or the system manager, aS appropriate, shall ensure notification of all persons and agencies to which the corrected or amended portion of the record had been disclosed prior to Its correction or amendment. The notifica- tion shall require a recipient agency maintaining the record to acknowledge receipt of the notification, to correct or amend the record, and to apprise an agency or person to which it had disclosed the record of the substance of the correction or amendment. The following criteria shall be considered by the and the system manager in reviewing a request for amendment: (1) The sufficiency of the evidence submitted by (2) The factual accuracy of the information; privacy act officer correction or the individual; (3) The relevance and necessity of the information in relation to the purpose for which it was collected; (4) The timeliness and currency of the information in relation to the purpose for which it was collected; (5) The completeness of the information in terms of the purpose for which it was collected; (6) The degree of risk that denial of the request could unfairly result in determinations adverse to the individual; (7) The character of the record sought to be corrected or mended; (8) The propriety and feasibility of complying with the specific means of correction or amendment requested by the individual; (9) Whether such information is relevant or necessary to accomplish a purpose DOE is required to implement by statute or Executive order; and (10) If the information is to be used by DOE in making a determination about an individual, whether the requester believes such information is accurate, relevant, timely, or complete as is reasonably necessary to ensure fairness. DOE 1800.1A II-11 8-31-84 g. The DOE shall not undertake to gather evidence for an individual, but does reserve the right to verify the evidence which an individual submits. h. Correction or amendment of a record requested by an individual shall be denied only upon a determination by the privacy act officer that: (1) (2) (3) (4) (5) An individual has failed to establish, by a preponderance of evidence, the propriety of the correction or amendment in light of the criteria set forth on page 11-10, subparagraph f; The record sought to be corrected or unended is part of the official record in a terminated judicial, quasi-judicial, or quasi-legislative proceeding to which the individual was a party or participant; The information in the record or record sought to be corrected or amended is the subject of a pending judicial, quasi-judicial, or quasi-legislative proceeding to which an individual is a party or participant; The correction or amendment violates a duly enacted statute or promulgated regulation; and An individual has failed to comply with the procedural requirements of this Order. 7. APPEAL OF INITIAL ADVERSE AGENCY DETERMINATION ON ACCESS, CORRECTION, OR a. b. c. When a request for access, correction, or amendment has been denied, an individual may submit a written appeal within 30 calendar days after receipt of the initial denial. When an appeal is submitted by mail, the postmark is conclusive as to timeliness.

An appeal must be in writing and must be signed by an individual. The words "PRIVACY ACT APPEAL" shall appear in all capital letters on the letter and envelope. Appeals of denials relating to records maintained in Governmentwide systems of records established by the Office of Personnel Management shall be filed, as appropriate, with the Assistant Director for Work Force Information, Compliance and Investigation Group, Office of Personnel Management. Room 5431. 1900 E Street, NW. Washington, DC 20415. AMENDMENT. II-12 d. e. f. g. h. i. j. k. DOE 1800.1A 8-31-84 All other appeals relating to DOE records shall be directed to the Director of Hearings and Appeals, HG-1, Department of Energy, 1000 Independence Avenue, SW, Washington, DC 20585. An appeal not addressed and marked as provided herein shall be marked by DOE personnel when it is so identified, and shall be forwarded immediately to the appeal authority. An appeal which is not properly addressed by an individual shall not be ‘Deemed to have been Recelved" for purposes of measuring the time periods until actual receipt by the appeal authority. In each Instance when an appeal so forwarded is received, the appeal authority shall notify the individual that his or her appeal was addressed improperly and the date when the appeal was received at the proper address. An individual’s appeal paper shall include the control number assigned by DOE and a statement of reasons why the initial denial is believed to be in error. The appeal shall be signed by the individual. The record which an individual requests be corrected or amended and all correspondence between the privacy act officer and the requester shall be supplied by the privacy act officer who issued the initial denial. While the foregoing normally will comprise the entire record on appeal, the appeal authority may seek additional information necessary to ensure that the final determination is fair and equitable and, in such instances, that additional information shall be disclosed to the greatest extent possible to an individual and an opportunity provided for comment thereon. No personal appearance or hearing on an appeal shall be allowed. The appeal authority shall act upon the appeal and issue a final deter- mination in writing not later than 20 working days (excluding Saturday, Sunday, and Federal holidays) from the date on which the appeal is received; provided, the appeal authorfty may extend the 20 working day period upon deciding that affair and equitable review cannot be made within that period, but only if the individual is advised, in writing, of the reason for the extension and the estimated date by which a final determination will be issued. If the appeal Is determined in favor of an individual, the final determination shall include the specific corrections or amendments to be made and a copy thereof shall be transmitted promptly both to the Individual and to the privacy act officer who issued the initial denial. Upon receipt of a final determination, the privacy act officer shall promptly take actions set forth on page II-10, subparagraph a . DOE 1800.1A II-13 8-31-84 1. If an appeal for access is denied, the final determination shall state the reasons for the denial and shall be transmitted promptly to the individual, the privacy act officer, and the appropriate system manager. The determination shall include a statement iden- tifying the right of the individual to administrative and judicial reviews pursuant to Title 5 U.S.C. 552a(g)(l)(A) as limited by Title 5 U.S. C. 552a(g)(5).

m. If an appeal is denied for correction or amendment, the final determination shall be transmitted promptly to the individual, the privacy act officer, and the system manager stating the reasons for the denial. n. The notice of final determination shall also inform the individual of the following: (1) (2) (3) (4) The right of the individual under the Privacy Act to file a concise statement of reasons for disagreeing with the final determination. Such a statement shall be filed with the privacy act officer who shall acknowledge receipt of such statement and inform the requester of the date of receipt; The fact a disagreement statement was filed by the requester shall be noted in the disputed record that the purposes and uses to which the statement will be put are those applicable to the record in which it is noted and that a copy of the statement will be provided to persons and agencies to which the record is disclosed subsequent to the date of receipt of such statement; The fact that the WE will append to any such disagree- ment statement filed by the individual, a copy of the final determination or summary thereof which also will be provided to persons and agencies to which the disagreement statement is disclosed; and The right of the individual to judicial review of the final determination under Title 5 U.S.C. 552a(g)(l)(A), as limited Title 5 U.S.C. 552a(g)(5). by O. Although a copy of the final determination or a summary thereof shall be treated as part of the individual’s record for purposes of disclosure where the individual has filed a disagreement statement, it shall not be subject to correction or amendment by the requester. II-14 DOE 1800.1A 8-31-84 8. PENALTIES. a. b. c. d. Any officer or employee of the DOE, who by virtue of his or her employment or official position, has possession of, or access to, agency records which contain individually identifiable information the disclosure of which is prohibited by this section (Title 5 U.S.C. 552a(i)(l)) or by rules or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. Any officer or employee of the DOE who willfully maintains a system of records without meeting the notice requirements of subsection (e)(4) shall be guilty of a misdemeanor and fined not more than $5,000 (Title 5 U.S.C. 552a(l)(2)). Any person who knowingly and willfully requests or obtains any record concerning an individual from any agency under false pretenses shall be guilty of a misdemeanor and fined not more than $5,000 (Title 5 U.S.C. 552a (f)(3). A person who falsely or fraudulently attempts to obtain records under the Privacy Act may-also be subject-to prosecution (Title 10 U.S.C. 494, 495, and 1001). 9. FEES. a. b. A copying fee totallng $25 or less shall be waived, but the copying fees for requests determined by the DOE, to be related from the same individual shall be aggregated to determine the total fee. Charges in excess of $25 shall Include the initial waived nominal fee of $25 in addition to further costs. A copying fee shall not be charged or collected, or alternatively, it may be reduced, when it Is determined by the privacy act officer, based on a petition, that the petitioning Individual is indigent and DOE resources permit a waiver of all or part of the fee. An individual is deemed to be indigent when he or she is without income or resources sufficient to pay fees.

(1) No fees shall be charged or collected for the following: search for and retrieval of the records; review of the records; copying at the initiative of the DOE without a request from the requester; transportation of records and postage. DOE 1800.1A 8-31-84 c. d. e. (2) (3) The (1) (2) (3) (4) (5) (6) (7) (8) II-15 (and II-16) It is the policy of the DOE to provide an individual with one copy of each record corrected or amended pursuant to his or her request without charge as evidence of the correction or amendment. As required by the Office of Personnel Management in its publi regulations implementing the Privacy Act, the DOE will charge fee for a single copy of a personnel record covered by its Governmentwide published notice of systems of records. copying fees prescribed by page II-14, paragraph 9, shall be: Each page copy up to 8-1/2” x 14” made by photocopy or similar process - $0.10; Each Each Each Each Each Each copy of microfilm frame printed on paper - $0.30; aperture card - $0.30; 105mm fiche - $0.30; 100’ roll of 35mm microfilm - $7.00; 100' roll of 16mm microfilm - $6.00; page of computer printout without regard to the number of carbon copies concurrently printed - $0.25; and Other copying forms (e.g., typing or printing) shall be charged at total cost, including-personnel and equipment costs. Payments shall be made by U.S. currency, personal check, or money order payable to U.S. Department of Energy, and forwarded to the designated billing office. Appropriate payment may be required in the form of a certified check. shed no Special and additional services provided at the request of the individ- ual, such as certification or authentication, postal insurance, and special mailing arrangement costs shall be charged to the individual in accordance with other published regulations of the Department pursuant to statute (Title 31 U.S.C. 9701). DOE 1800.1A 8-31-84 Attachment II-1 Page 1 PRIVACY ACT INFORMATION REQUEST Attachment 1 Page 2 DOE 1800.1A 8-31-84 PRIVACY ACT INFORMATION REQUEST Section 12 Penalties (a) The Privacy Act provides, in pertinent part: Any person who knowingly and willfully requests or obtains any record concerning an individual from any agency under false pretenses shall be guilty of a misdemeanor and fined not more than $5,000 (Title 5 U.S.C. 552a(f)(3)). (b) A person who falsely or fraudulently attempts to obtain records under the Privacy Act may also be subject to prosecution under such other criminal statutes as Title 18 U.S.C. 494, 495, and 1001. DOE 1800.1A 8-31-84 CHAPTER III NEW SYSTEMS AND AMENDMENTS TO EXISTING SYSTEM OF RECORDS III-1 1. REQUIREMENTS FOR SYSTEM NOTICES. The Privacy Act prohibits the maintenance of secret system of records. The Privacy Act, therefore, requires that notices of new and altered system of records be provided to the Congress and the OMB and published in the "Federal Register." a. A new system of records is defined as a system of records for which no system notice has been published in the "Federal Register." This in- cludes systems of records that have been withdrawn, suspended, canceled, or terminated. b. The establishment of a new system of records requires the following: (1) Submission to the Congress and the OMB of a "Report on a New System of Records" 60 calendar days before the system is implemented; and (2) Publication in the “Federal Register" of a system notice, to include a provision for a public comment period of 30 calendar days.

c. A system of records is considered to be significantly altered when the change to the system: (1) (2) (3) Increases or changes the number or type of individuals on whom records are maintained. Changes involving the number, rather than the types of individuals about whom records are kept, need only be reported when the change significantly alters the character and purpose of the system of records; Expands the type or categories of information maintained. For example: if an employee’s file is expanded to include data on education and training, this would be considered an expansion of the types or categories of information maintained and would have to be reported; Alters the manner in which the records are organized, indexed, or retrieved, changing the nature or scope of these records, that is, combining two or more existing systems or splitting an existing system into two or more different systems such as might occur in a centralization or decentralization of organizational respon- sibilities; III-2 DOE 1800.1A 8-31-84 d. e. f. (4) Alters the purpose for which the information in the system is used; (5) Changes the equipment configuration (that is, hardware or software on which the system is operated so as to create the potential for either greater or easier access); and (6) Changes the procedures associated with the system which affects an individual’s exercise of his or her rights. Significant alteration of a system of records requires the submission to the Congress and the OMB of a ‘Report on Altered Systems of Records" 60 calendar days before the alteration is Implemented and publication in the "Federal Register" of a revised system notice, as described on pages III-2 and III-3, paragraph 3. Amendments to systems that do not meet the criteria set forth above for significantly altered systems of records require only the publication in the "Federal Register” of a revised system notice. Amendments of this type include the establishment of new routine uses for a system of records, but when a Federal Register Notice is published for a new routine use, 30 calendar days must be allowed for public comment. Any removal of a routine use will not require a notice or a report to the "Federal Register," but a notification of such a removal shall be reported to the Headquarters privacy act officer within 30 calendar days after determination of removal. 2. CONTENT OF RECORDS ON NEW AND SIGNIFICANTLY ALTERED SYSTEM OF RECORDS. Reports on new and signi ficantly altered system of records shall include the a. b. c. following: Transmittal letters to the Speaker of the House of Representatives, the President of the Senate, and the Director of the OMB; A brief narrative statement which describes the purposes of the new system or alteration to existing system; A copy of the system notice. 3. CONTENT OF SYSTEM NOTICES. The system notice existence and nature of the system and shall, following: a. The name and location of the system; must inform the public of the therefore, contain the b. The categories of individuals on records are reaaintained in the system; DOE 1800.1A 8-31-84 III-3 c. The categories of records maintained in the system; d. Each routine use of the records contained in the system, including the categories of users and the purpose of such use; e. Policies and practices regarding storage, retrievability, access controls, retention, and records disposition; f. The title and business address of the agency official who is responsible for the system records;

g. Procedures whereby an individual can be notified at his or her request if the system of records contains a record pertaining to him or her; h. Procedures whereby an individual can be notified at his or her request how he or she can gain access to any record pertaining to him or her contained in system of records, and how he or she can contest its con- tent; and i. The categories of sources of records In the system. 4. CONTENT OF FEDERAL REGISTER NOTICES. Federal Register Notices shall include the following: a. A preamble, in Federal Register Notice format, stating the name of the system of records , authority for the system, nature and purpose of the new system, change to an existing system, and invitation for public comment, including the name, title, and business address of the official to whom comments should be sent; and b. The text of the new or revised system notice. 3. RESPONSIBILITIES OF SYSTEM MANAGERS. When the establishment, alteration, or amendment of a system of records Is planned, the system manager shall prepare and submit appropriate documentation to the Headquarters privacy act officer through the cognizant privacy act officer. Three original copies Of each shall be provided. In the case of "Records on New or Altered Systems," the three copies shall be identical, except that one of each report shall be addressed to the Speaker of the House of Representatives, the President of the Senate, and the Director of the OMB. Documents shall be prepared for the signature of the Director of Administration, and shall have appropriate concurrences of the system manageras DOE organization. Records on a New and Altered Systems” shall be submitted to the Headquarters privacy U.S. Department of Energy Washington, D.C. PAGE CHANGE 1 DOE 1800.1A Chg 1 5-18-92 SUBJECT: PRIVACY ACT 1. PURPOSE . To transmit revised pages to DOE 1800.1A, PRIVACY ACT, of 8-31-84. 2. EXPLANATION OF CHANGE. To make organizational title and routing symbol editorial revisions required by SEN-6. No substantive changes have been made. 3. FILING INSTRUCTIONS. a. Remove Page Dated Insert Page Dated 5 and 6 8-31-84 5 and 6 5-18-92 i (and ii) 8-31-84 i (and ii) 5-18-92 I-1 thru I-5 8-31-84 I-1 thru I-5 5-18-92 (and I-6) (and I-6) I I I -3 8-31-84 III -3 5-18-92 III-4 8-31-84 III-4 8-31-84 b. After filing the attached pages, this transmittal may be discarded. BY ORDER OF THE SECRETARY OF ENERGY: Resource Management DONALD W. PEARMAN, JR. Acting Director Administration and Human DISTRIBUTION: INITIATED BY: All Departmental Elements Office of Administrative Services DOE 1800.1A Chg 1 5-18-92 5 d. e. f. g. h. i. j. k. 1. m. n. Computer Match is the computerized comparison of two or more automated systems of records, at least one of which is a Federal system, to identify individuals common to two or more of the record systems or unique to one of the record systems. Computer Match Checklist is a required comparison to all matching programs of agencies subject to the Privacy Act. Deemed to Have Been Received is the determination by which the DOE establishes the commencement of the 10 working days (excluding Saturday, Sunday, and Federal holidays) response period. Individual is any United States citizen or an alien lawfully admitted for permanent residence in the United States. It does not include corporations, associations, partnerships, trustees, receivers, and public or private organizations.

Legal Representative is a designee appointed by a requester to act or represent the requester. Parent or Legal Guardian is a rights of a minor or an indivi physical or mental incapacity jurisdiction. designee who exercises the legal dual declared incompetent due to or age by a court of competent Privacy Act Officer is an official designated by the Director of Administration and Human Resource Management to administer the Privacy Act. Proposed New System is a system of records for which a notice and report to the OMB and the Congress are being prepared. Record is any item, collection, or grouping of information about an individual that is maintained by or for the DOE including, but not limited to, education, financial transactions, medical history, criminal or employment history that contains an individual’s name or other identifying number, symbol, or particulars assigned to an individual. Request is a written inquiry by an individual (or that individual’s parent, legal guardian or representative) for any record maintained in a system of records which pertains to that individual. Request for Access is a written request by an individual or his or her authorized legal representative or guardian, or parent, to review a record which is in a particular system of records and pertains to that individual. Vertical line denotes change. 6 DOE 1800.1A Chg 1 5-18-92 o. p. q. r. s. Request for Correction or Amendment individual, parent, or legal guardian or representative that the DOE is a written request by an change, amend, or correct a record which the individual believes is inaccurate, unnecessary, irrelevant, untimely, or incomplete. Routine Use is the disclosure of a record compatible with the purpose for which it was collected. Statistical Record is a record in a system of records maintained only for statistical research or reporting purposes and not used in whole or in part in making any determination about an identifiable individual, except as provided by Title 12 U.S.C. 8. System Manager is the official designated by DOE in a system notice published in the “Federal Register” to maintain a system of records. System of Records is a group of any records under the control of DOE from which information is retrieved by the name of an individual or by some identifying number, symbol, or particulars assigned to an individual. BY ORDER OF THE SECRETARY OF ENERGY: DONALD W. PEARMAN, JR. Acting Director Administration and Human Resource Management Vertical line denotes change. DOE 1800. 1A Chg 1 5-18-92 i (and ii) TABLE OF CONTENTS CHAPTER I - RESPONSIBILITIES AND AUTHORITIES Page 2. 3. 4. 6. 7. 8. 10. Director of Security Affairs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Director of Administration and Human Resource Management . . . . . . . I-1 Director of Hearings and Appeals . . . . . . . . . . . . . . . . . . . . . . . . . . I-1 Appropriate General Counsel or Field Counsel . . . . . . . . . . . . . . . . . . I-2 Director of Administrative Services . . . . . . . . .. . . . . . . . . . . . . . I-2 Director of Personnel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I-2 Heads of Field Elements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Privacy Act Officer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I-3 System Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I-4 Headquarters Privacy Act Officer........................... I-5

CHAPTER II - ACTION ON INITIAL REQUEST 1. Procedures for Inquiries, Times, Places, and Requirements for Identification of Individuals Making Requests for Access, Correction, or Amendment of Records . . . . . . . . . . . . . . . . . . . . . 2. Disclosure of Information to Individuals . . . . . . . . . . . . . . . . . . . 3. Disclosure of Records to Persons Other than an Individual to Whom It Pertains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4. Medical Records ............................................ 5. Exemptions . . . . . . . . . . . . . . . . . 6. . . . . . . . . . . . . . . . . . . . . . . . . . . Review of Request for Correction or Amendment of Record . .. . . . 7. Appeal of Initial Adverse Agency Determination on Access, Correction, or Amendment . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8. Penalties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9. Fees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . CHAPTER 111 - NEW SYSTEMS AND AMENDMENTS TO EXISTING SYSTEM OF RECORDS II-1 II-3 II-5 I-6 II-7 II-9 II-11 II-14 II-14 Requirements for System Notices . . . . . . . . . . . . . . . . . . . . . . . . . . . III-1 2. Content of Records on New and Significantly Altered System of Records III-2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3. Content of System Notices III-2. . . . . . . . . . . . . . . . . . . . . . . . . . . 4. Content of Federal Register Notices . . . . . . . . . . . . . . . . . . . . . . . III-3 5. Responsibilities of System Managers . . . . . . . . . . . . . . . . . . . . . . . . III-3 6. Responsibilities of Headquarters Privacy Act Officer ........ III-4 Vertical line denotes change. 1. I-1 I-2 5. 9. 1. DOE 1800.1A Chg 1 5-18-92 CHAPTER I RESPONSIBILITIES AND AUTHORITIES I-1 I 1. DIRECTOR OF SECURITY AFFAIRS (SA-1). a. Concurs in final determinations concerning the disclosure or denial of all classified information or information in systems of records pertaining to security. b. Concurs in all responses to requests for and final determinations on appeals concerning records which contain Unclassified Controlled Nuclear Information controlled under section 148 of the Atomic Energy Act of 1954, as amended. c. Consults with privacy act officer to arrange procedures to be followed in granting an individual access to classified information in a record or system of records pertaining to an individual. d. Provides a site for the review of any classified records determined to be accessible. e. Concurs in all responses to requests for classified or classifiable records. f. Coordinates reviews with other agencies and nations where their classified information may be contained in requested records. 2. DIRECTOR OF ADMINISTRATION AND HUMAN RESOURCE MANAGEMENT (AD-l). a. Administers departmentwide Privacy Act activities. b. Designates privacy act officers. 3. DIRECTOR OF HEARINGS AND APPEALS (HG-1). a. Makes determinations on appeals of denials of all initial requests, except those denials relating to records maintained in Government- wide systems of records reported by the Office of Personnel Management and issues decisions to requester. b. Obtains concurrence from the Director of Security Affairs as appropriate regarding classified materials or information falling within the scope of Section 148 of the Atomic Energy Act of 1954, as amended (Title 12 U.S.C. 2168).

c. Provides copies of all appeals and subsequent decisions to the privacy act officer. Vertical line denotes change. I-2 DOE 1800.1A Chg 1 5-18-92 4. APPROPRIATE GENERAL COUNSEL OR FIELD COUNSEL. a. Provides legal b. Concurs in all correction, or records. advice to DOE employees concerning the Privacy Act. determinations to grant or deny a request for access, amendment of a record maintained in a system of c. Assists the Department of Justice in representing the DOE in litigation involving the Privacy Act. d. Headquarters counsel acts as a liaison between the Department of Justice and the OMB on issues and litigation arising under the Privacy Act. 5. DIRECTOR OF ADMINISTRATIVE SERVICES (AD-60). a. Develops and administers departmentwide policies, standards, and procedures to implement the provisions of the Privacy Act. b. Supervises the operation of the Headquarters Privacy Act Office. c. Ensures the preparation of the annual report to the OMB and any other special reports. d. Ensures the annual review of the notice of system of records. e. Ensures the publishing in the “Federal Register” of notices of new or altered system of records. 6. DIRECTOR OF PFRSONNEL (AD-50). Delegates to appropriate personnel officers responsibilities outlined as follows: a. Maintains and controls official personnel files for Headquarters, exclusive of the Office of the Inspector General, and provides facilities for their review and inspection by current employees properly identified and authorized representatives of employees. b. Upon receipt of a directive to amend an official inserts the amendment and informs the requester officer of the completion of amendment and provi corrected record to the requester. 7. HEADS OF FIELD ELEMENTS. a. Recommends a privacy act officer for his or her I personnel file, and the privacy act des a copy of the respective location for designation by the Director of Administration and Human Resource Management. Vertical line denotes change. DOE 1800.1A Chg 1 I -3 5-18-92 b. Reviews his or her own system of records annually to ensure compliance with the provisions of the Privacy Act. c. Provides information on system of records in his or her custody to Headquarters privacy act officer. 8 . PRIVACY ACT OFFICER. a. Determines whether request for access, correction, or amendment to a record is a proper inquiry under the Privacy Act. b. Provides information on records in his or her custody to the Headquarters privacy act officer for inclusion in the annual report. c. Designates a primary system manager, who shall be responsible for the search, coordination, and response to the request. d. Ascertains which organization has primary responsibility of the records requested and identifies the appropriate principle system manager where a request entails records under the jurisdiction of more than one system manager. e. Assists the requester in reformulating an improper request for access, correction, or amendment for a record in a system of records. f. Consults with the system manager and the appropriate General Counsel on any recommendation to deny a request for fee waiver for correspondence other than Headquarters controlled. g. Determines fees to be charged for costs of reproducing records requested. h. Submits all fee determinations for collection to appropriate financial official. i. Notifies the system manager and provides Headquarters privacy act officer with a copy of the final letter of Headquarters controlled correspondence to the requester.

j. Develops and maintains a status reporting system to ensure that requests and appeals are responded to within designated time limits or that extensions are secured, as appropriate. k. Consults with appropriate DOE medical officer and/or the personal physician of the requester on the release of medical records. Vertical line denotes change. I-4 DOE 1800.1A Chg 1 5-18-92 l. Requires and verifies the identification of each requester of information as required by Title 10 CFR 1008.4. m. Identifies and reviews the records encompassed by requests and advises the requester within 10 working days (excluding Saturday, Sunday, and Federal holidays), unless otherwise extended, whether the request is to be granted or denied. n. Prepares and submits to Headquarters privacy act officer a computer match checklist before any matches are initiated. 0. Reviews systems of records to verify if systems are applicable to any matching programs. p. Prepares a notice of the agency’s intention, to be published in the “Federal Register” prior to disclosing records outside the agency for matching purposes. q. Maintains adequate internal controls on approvals and operations of computer matching activities. r. Notifies the system manager when the requester, or someone acting on his or her behalf, appeals either the decision to withhold the requested information or not to amend the requester’s file. I 9. SYSTEM MANAGER. a. Develops and maintains a status reporting system requests and appeals are responded to within the that extensions are secured as appropriate. b. Transmits nonclassified material requested under to ensure that time constraints or the Privacy Act to I the privacy act officer with recommendations to grant or deny access in full or partially and concurs on all approvals and denials of requests. c. Secures the concurrence from the Director of Security Affairs and the appropriate general counsel on all requests for information controlled under the Atomic Energy Act of 1954, as amended. d. Secures the concurrence of the appropriate general counsel on all recommendations for denial of access. e. Reviews all requests for correction or amendment of records and provides recommended decisions with basis for denial to appropriate privacy act officer. Vertical line denotes change. DOE 1800. 1A Chg 1 I-5 (and I-6) 5-18-92 f. Estimates costs of reproducing requested documents when fees are to be charged, and notifies the privacy act officer. g. Recommends denial or acceptance of requests for fee waivers not controlled by Headquarters in conjunction with appropriate general counsel. h. Provides copies of exempt records to the appropriate appeal authority when requested. I i. Notifies the computer protection program manager, Office of Information Resources Management (AD-20), who certifies that protection specifications are adequate for new systems and amendments to existing systems of records. I 10. HEADQUARTERS PRIVACY ACT OFFICER (AD-621). Carries out privacy act officer functions as listed on page I-3, paragraph 8, for Headquarters. In addition: a. Provides guidance to DOE personnel on implementation and responsibilities of the Privacy Act; b. Prepares the annual report to the OMB; c. Ensures appropriate training for DOE officials responsible for the implementation of the Privacy Act; d. Reviews established systems of records and published notices for compliance with the Privacy Act; e. Publishes notices and rules, as required;

f. Submits “Report on New and Altered Systems” to the OMB and Congress; g. Consults with General Counsel, as appropriate, on requests for fee waiver regarding Headquarters controlled correspondence; and h. Controls and determines responsive program office for all Headquarters controlled correspondence. Vertical line denotes change. DOE 1800.1A Chg 1 5-18-92 c. The categories III-3 of records maintained in the system; d. Each routine use of the records contained in the system, including the categories of users and the purpose of such use; e. Policies and practices regarding storage, retrievability, access controls, retention, and records disposition; f. The title and business address of the agency offi responsible for the system records; g. Procedures whereby an individual can be notified cial who is at his or request if the system of records contains a record pertain or her; h. Procedures whereby an individual can be notified at his or her ing to him her request how he or-she can gain access to any record pertaining to him or her contained in system of records, and how he or she can contest its content; and i. The categories of sources of records in the system. 4. CONTENT OF FEDERAL REGISTER NOTICES. Federal Register Notices shall include the following: a. A preamble, in Federal Register Notice format, stating the name of the system of records, authority for the system, nature and purpose of the new system, change to an existing system, and invitation for public comment, including the name, title, and business address of the official to whom comments should be sent; and b. The text of the new or revised system notice. 5. RESPONSIBILITIES OF SYSTEM MANAGERS. When the establishment, alteration, or amendment of a system of records is planned, the system manager shall prepare and submit appropriate documentation to the Headquarters privacy act officer through the cognizant privacy act officer. Three original copies of each shall be provided. In the case of “Records on New or Altered Systems,” the three copies shall be iden- tical, except that one of each report shall be addressed to the Speaker of the House of Representatives, the President of the Senate, and the Director of the OMB. Documents shall be prepared for the signature of the Director of Administration and Human Resource Management, and shall have appropriate concurrences of the system manager’s DOE organization. Records on “New and Altered Systems” shall be submitted to the Vertical line denotes change. III-4 DOE 1800.1A 8-31-84 Headquarters privacy act officer sufficiently in advance of the implementation of the new or altered system to permit 60 calendar days advance notice to the Congress and the OMB. Advance notice of 30 calendar days is required for the establishment of routine uses for system records. 6. RESPONSIBILITIES OF HEADQUARTERS PRIVACY ACT OFFICER. Upon receiving the documents shall review and forward them to appropriate Headquarters officials, as required in DOE 1323.1A. Documents shall then be transmitted to the Congress, the Director of the OMB, and Office of the Federal Register. Upon publication of the Federal Register notice, the Headquarters privacy act officer shall forward the Notice to the system manager, so that new systems or changes shall be implemented upon expiration of the Notice periods. Any comments received from the Congress, the OMB, or the public shall be referred to the system manager for response.