Privacy Act request guide

SBA does not charge fees for search or review of records disclosed from a Privacy Act system of records requested by the individual to whom the record pertains, and provides a single copy free for the requester’s review. However, for copies of records disclosed from Privacy Act Systems of Records under the FOIA, fees applicable to processing FOIA requests are charged as described in SBA regulations part 102.6.

Once SBA has processed a request, a written initial determination letter will be provided. This letter will advise whether SBA is withholding any information pursuant to one or more of the exemptions to the Privacy Act (as discussed below).

There are two general and seven specific exemptions in the Privacy Act. The two general exemptions cover:

• All records maintained by the Central Intelligence Agency (not applicable to SBA)
• Selected records maintained by an agency or component thereof which performs as its principal functions any activity pertaining to the enforcement of criminal laws (only used by SBA’s Office of the Inspector General).

In addition, the Privacy Act provides seven specific exemptions:

• Information that is properly classified in the interest of national defense or foreign policy;
• Investigatory material compiled for law enforcement purposes not covered by the general exemptions. The specific law enforcement exemption is limited when — as a result of the maintenance of the records — an individual is denied any right, privilege, or benefit to which he or she would be entitled by federal law or for which he or she would otherwise be entitled. In such cases, disclosure is required except where it would reveal the identity of a confidential source who furnished information to the government under an express promise that the identity of the source would be held in confidence.
• Information maintained in connection with providing protective services to the President of the United States or other individuals who receive protection from the Secret Service;
• Information required by statute to be maintained and used solely as statistical records;
• Investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for federal civilian employment, military service, federal contracts, or access to classified information, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the government under an express promise that the identity of the source would be held in confidence;
• Testing or examination material used solely to determine individual qualifications for appointment or promotion in the federal service, but only to the extent that the disclosure of such material would compromise the objectivity or fairness of the testing or examination process;
• Evaluation material used to determine potential for promotion in the armed services, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the government under an express promise that the identity of the source would be held in confidence.

Upon receiving SBA’s initial determination letter, a requester will have 60 calendar days to submit an appeal if SBA has decided to deny a Privacy Act request for:

• Access to records
• Amendment or correction of records

All appeals must be made in writing, directed to this office as identified in SBA’s initial determination letter, and addressed as follows:

FOI/PA Office
U.S. Small Business Administration
409 3rd St., SW
Washington, DC 20416

This office will make a determination in writing. A decision affirming an adverse determination in whole or part will include a brief statement of the reason(s), include any Privacy Act exemptions applied and inform the requester of the Privacy Act provisions for court review of the decision. If the adverse determination is reversed or modified in whole or part, we will notify the requester that their request will be reprocessed in accordance with the appellate decision.

Federal laws and guidelines

• The E-Government Act of 2002, Sec. 208 on Privacy Provisions (see Appendix B)
• The Privacy Act of 1974 (5 U.S.C. 552a)
• Office of Management and Budget (OMB) Circular A-130: Management of Federal Information Resources, Appendix I on Maintaining Records About Individuals
• Office of Personnel Management Privacy Act Regulations on Personnel Records (5 CFR 297)
• SBA's Freedom of Information Act website
• List of Department of Justice Privacy Act resources
• Freedom Of Information Act (FOIA) references

Website privacy requirements

• OMB privacy policy for federal websites
• Complying with the Children’s On-Line Privacy Protection Act (when websites are directed to children 13 years and under).  Federal Trade Commission guidelines
• OMB guidelines on the E-Government Act of 2002, Sec. 208 on Privacy Provisions

Other laws and guidelines that support the Privacy Act

• The Freedom of Information Act (5 U.S.C. 552)
• The Paperwork Reduction Act of 1995 (As amended by the Clinger-Cohen Act) (44 U.S.C. 3501) 
• The Federal Information Security Modernization Act

Under the Privacy Act, you may request:

• Access to records pertaining to youand contained in a Privacy Act system of records,
• An accounting of SBA disclosures of your personal information to others, and/or
• Correction or amendment of records about you that are maintained in a Privacy Act system of records.

You may also make requests on behalf of a minor child if you are the child’s parent or legal guardian and demonstrate that you are acting in the child’s best interests.

To avoid delays in processing, your request should include three basic elements:

• State that access is sought or requesting correction/amendment of records under the Privacy Act (or under the Privacy Act and the FOIA, as described above).
• Include your name, address, date of birth, employee identification number (if any), signature, and proof of identity (as discussed below).
• Describe the requested records or information as specifically as possible. Whenever possible, SBA's Privacy Act systems of records should be identified that you want the agency to search.

You may submit a written and signed Privacy Act request to SBA in person or by mail or facsimile (fax) to the field or program office you believe maintains the records you seek or to our office. Addresses for all SBA program and field offices are available on our website. Privacy Act requests can also be submitted via FOIAonline. Privacy Act requests may be submitted via fax or hard copy, since a signature must accompany Privacy Act requests.

When our office receives a Privacy Act request, we will provide the requester with a written acknowledgment of receipt of their request. The letter will indicate the name and telephone number of the SBA office where their request is being referred and whom they should contact if there are questions regarding the processing and/or status of the request. An SBA program or field office that receives a request directly will process it if it determines that it is the correct office. If the receiving office determines that it is not the best office to process the request, the requester will be notified as to which SBA office(s) will respond to their request.

Processing depends on whether the requester is seeking access to, or requesting correction/ amendment of your records, as follows:

• Access to records: The system manager for the Privacy Act system(s) of records identified in the request or who is likely to have the responsive records will search for responsive records. Ordinarily the search will include only those records that are in the possession of the office as of the date that office begins its search for them. The system manager will determine whether access can be granted, prepare the agency response that is sent and provide a copy of any releasable records; and,
• Corrections or amendments: The system manager who has control of the record(s) sought for correction or amendment, shall determine whether to authorize or deny the request and prepare the agency response that is sent.

The Privacy Act does not impose a response time for agency responses to requests. However, SBA’s regulations establish that it will send a written acknowledgement of receipt of a request within 10 working days and that a requester will be notified of the agency determination on their Privacy Act request within 30 working days of receipt of the request. SBA has a statutory responsibility to respond to a correction or amendment request within 10 working days.

If a requester is still in disagreement with the agency’s decision regarding their appeal of a denial related to correction or amendment of the specified record(s), they may submit a written statement of disagreement to the office that maintains the record involved. That office will mark the original record to indicate that the information is disputed, that a statement of disagreement exists, and where the statement of disagreement is located within the system of records.

If a requester has filed an appeal and/or a statement of disagreement, but they still believe that SBA has not handled their request in accordance with the Privacy Act, they have the right to challenge the agency’s decision in a lawsuit. The appellate response from this office will inform the requester that they may file their suit in the district court of the United States in the district in which they reside or have a principal place of business, the district in which the relevant agency records are maintained, or the District of Columbia.

The Privacy Act also provides a civil remedy whenever an agency fails to maintain records in a manner that is accurate, complete, timely, and/or relevant, as is necessary to ensure fairness in any agency determination, in the event that the agency makes a determination that is adverse to an individual’s interests. They may also sue an agency for failing to comply with any other provision of the Privacy Act in a manner that adversely affects them.

The privacy regulations for this office are set forth in Title 13, Part 102, Subpart B, of the Code of Federal Regulations.

An individual may submit a Privacy Act request for information only if they are a U.S. citizen or an alien who has been lawfully admitted for permanent residence in the United States.

In addition, they may only request information from SBA that is maintained in any of SBA’s Privacy Act Systems of Records Notices. These systems contain information regarding various categories of individuals including, but not limited to, current and former SBA employees, contractors, consultants, clients, applicants, and licensees.

An individual may request access to records concerning a minor child, if they are the child’s parent or legal guardian and demonstrate that they are acting in the child’s best interests. In addition, an individual may request access to records concerning another eligible individual, as long as they can provide verifiable written authorization from that person designating them as a representative acting on his or her behalf. However, any individual who willfully requests or obtains any information under false pretenses is guilty of a misdemeanor and may be fined up to $5,000, pursuant to 5 U.S.C. 552a(i)(3).

This office has responsibility for both the Privacy Act and the Freedom of Information Act (FOIA), which establishes a presumption that any person has the right to request access to records in the possession of the executive branch of the federal government.

While the two acts are considered companion acts, they have different procedures and exemptions. Consequently, information that is exempt from disclosure under one act may be disclosable under the other. In order to take maximum advantage of both acts, you should cite both laws when requesting access to SBA records that contain information only about yourself. When requesting records that contain information about other individuals or entities, only the FOIA applies.

It is SBA’s policy to automatically handle requests in a manner that maximizes the amount of information that is releasable. If there is any doubt about which act to use in requesting information from SBA, you should cite both acts.

While neither act grants an absolute right to examine government documents, both acts give the right to request records and to receive a response to a request also provide a right to appeal the denial and, if necessary, to challenge it in court (as discussed elsewhere in this guide).