TN 7 (04-19)

GN 03340.075 Access Request Denials and Privacy Act Appeals

The Privacy Act (PA) requires Federal agencies to tell an individual upon their request if they are the subject of a record in one of the agency’s systems of records and to permit the individual to inspect and copy the record. If, under the PA, we deny a request for an individual’s access to their own record, the records of their minor child, or those of a person to whom the individual serves as the legal guardian, we must advise the individual in writing of the reason for that denial, the name and title or position of the person responsible for the decision, and the individual’s right to appeal that decision.

Appeals of the denial decision should be sent to the Executive Director for the Office of Privacy and Disclosure, 6401 Security Boulevard, Baltimore, MD 21235-6401 within 30 days after the individual received notice from us denying all or part of their request, or, if later, within 30 days after the individual received materials we sent to them in partial compliance with their request.

EXCEPTION: The following situations—where procedural requirements to file a proper request have not been met—do not constitute denial of a PA request that would require a denial letter:

• •

  The individual cannot adequately prove his/her identity.

• •

  The individual has not complied with the special procedures for providing access to medical records, when required.

• •

  The individual has not identified the name of the system of records from which he or she is requesting information and the records to which he or she wishes to have access.

In these instances, provide a response to the individual that explains that they have not made a proper request in accordance with 20 C.F.R. Part 401 and the steps that must be taken to correct the deficiency in the request. Do not title or reference this response as a “denial,” and do not offer appeal rights in this response.

Contact OPD for guidance in instances where a requester has not made a proper request and the individual has threatened to sue the agency for access; the individual has made multiple improper requests; or the individual otherwise is having difficulty meeting agency procedural requirements and may be likely to sue the agency to obtain access.