Attachment_J.5_Agency_Procedures_for_Release_and_Security.pdf

NATIONAL AUTOMOTIVE SAMPLING SYSTEM

AGENCY PROCEDURES FOR

RELEASE AND SECURITY OF RESEARCH DATA

COLLECTED UNDER THE

NATIONAL AUTOMOTIVE SAMPLING SYSTEM

U.S. DEPARTMENT OF TRANSPORTATION

NATIONAL HIGHWAY TRAFFIC SAFETY ADMINISTRATION

NATIONAL CENTER FOR STATISTICS AND ANALYSIS

WASHINGTON, D.C. 20590

August 26, 1992

Editorial Revision: July 11, 2006

NATIONAL HIGHWAY TRAFFIC SAFETY ADMINISTRATION

gary.toth Text Box

ATTACHMENT 6

AGENCY PROCEDURES FOR RELEASE AND SECURITY OF RESEARCH

DATA COLLECTED UNDER THE NATIONAL AUTOMOTIVE SAMPLING SYSTEM

CONTENTS

A. Introduction

B. Data Controls B.1 Relation to the Privacy Act B.2 Relation to the Freedom of Information Act B.3 Completion of Quality Control Before Release

C. NASS General Estimate System C.1 Data Security

C.1.1 General Estimates System (GES) and Primary Sampling Unit (PSU) level

C.1.2 Quality Control and Data Entry Contractor Level

C.2 Data Release C.2.1 Police Traffic Crash Reports C.2.2 Automated Analysis File

D. NASS Crashworthiness Data System and National Motor Vehicle Crash Causation Survey D.1 Data Files and Constraints

D.1.1 Files Maintained

• Master Automated File

• Automated Analysis File

• Hard Copy Case File

• Source Document File

D.2 Data Release D.2.1 Release of Automated Analysis Files D.2.2 Release of Hard Copy Case Files D.2.3 Exclusions from Release

D.3 Data Review and Security D.3.1 PSU Level

• File Security

• Release of Case Information

• Deletion of Personal Identifiers at the PSU

D.3.2 Zone Center Level

• Protection of the Case File and Release of Case Information

• Removal of Source Documents from the Hard Copy Case File at the Zone Center D.3.3 Storage Contractor Level

• Master Automated File

• Automated Analysis File

• Hard Copy Case Files

• Source Document File

D.4 Subpoenas D.5 Medical Release Statement

E. Electronic Crash Reports

E.1 Police Accident Report (PAR) E.2 Access Codes

F. Laws Governing Driver Data F.1 Federal Privacy Act F.2 Federal Driver Privacy Protection Act

G. Acknowledgement Page

A. INTRODUCTION

The National Highway Traffic Safety Administration (NHTSA) is authorized by Statute (Title 49 U.S.C., Section 30166 and 30168 and Title 24, Section 403) to collect statistical data on motor vehicle traffic crashes to aid in the development, implementation and evaluation of motor vehicle and highway safety countermeasures. The National Automotive Sampling System (NASS) is the mechanism through which NHTSA collects nationally representative data on motor vehicle traffic crashes.

NASS has two major operating components: (1) The General Estimates System (GES) which collects data on a sample of police traffic crash reports; and (2) the Crashworthiness Data System (CDS)/National Motor Vehicle Crash Causation Survey (NMVCCS) which collects additional detailed information on a sample of police reported traffic crashes. The procedures outlined in this document govern the security and release of research data collected in the NASS GES and CDS/NMVCCS. These procedures are followed by NASS field contractors during data gathering, review, data processing during file automation, editing, storage, and analysis. The NASS management monitors these procedures through quality control practices, including case review, examination of the automated file, reporting and periodic field observation.

Regardless of the mode of data collection, the agencies and individuals are assured by the NASS researcher that any information obtained that identifies the individual will be held CONFIDENTIAL. The preservation of the confidentiality of individuals is statutorily mandated. This requirement serves to ensure the public trust in the program and enhance the researcher's ability to solicit the required information. For these reasons, the controls and established procedures described in this document are followed in the NASS General Estimates System and the NASS Crashworthiness Data System/National Motor Vehicle Crash Causation Survey.

B. DATA CONTROLS

The information solicited through the NHTSA's NASS GES and CDS/NMVCCS data collection programs: (1) is not retrievable by an individual's name or other personal identifier; (2) is disseminated in conformance with the Freedom of Information Act; (3) has personal identifiers deleted from releasable files;

and (4) is maintained under secured conditions to guard against tampering and unauthorized release.

B.1 Relation to the Privacy Act - The NASS files are not a system of records that are subject to the

Privacy Act. No names of individuals will be entered into automated or hard copy case files.

Reports of NASS crash data collections must be made available to the public in a manner which does not identify individuals (Public Law 89-564). Thus, cases will not be retrievable by any unique number, symbol, or other identifying variable assigned to the individual. The safeguards for privacy which are afforded by the NASS files are greater than those afforded by the Privacy Act because the personal information which the Privacy Act is designed to protect is deleted from all NASS files.

B.2 Relation to the Freedom of Information Act - When information is requested, it is the policy of

NHTSA, under the Freedom of Information Act, to search the files on the basis of non-personal identifiers supplied by the requestor, and retrieve what could possibly be the subject crash(es). If the search of these files does produce what could possibly be the subject crash(es), this information is then released to the inquiring party. When specific cases are requested, NHTSA cannot authenticate that the identified and released cases represent the crashes in question because unique identifiers are absent from the analysis files.

B.3 Completion of Quality Control Before Release - All information is collected, assembled, derived or computed by a contractor in accordance with requirements of the contract. The terms of the contract forbid the release of this information without prior written approval from NHTSA. NASS crash case information will not be released until all quality control procedures are completed.

C. NASS GENERAL ESTIMATES SYSTEM

The NASS General Estimates System (GES) obtains its data from a nationally representative probability sample selected from approximately 55,000 motor vehicle police-reported crashes on an annual basis. The data are obtained by GES data collectors in 60 geographic sites across the United States. These data collectors make weekly, biweekly, or monthly visits to approximately 469 police agencies within the 60 sites. During the visit, the data collectors list all police traffic crash reports not previously listed and then select a sample of the listed police traffic crash reports. The collector obtains copies of these selected police traffic crash reports and sends them to a designated center for coding. Trained personnel interpret and code data directly from the police traffic crash reports onto an electronic file. To protect individual privacy, no personal information such as names, addresses, specific crash location, etc., is coded.

C.1 Data Security

C.1.1 GES PSU Level - Access to police traffic crash reports at the GES PSU level is restricted to the GES researcher. The GES researcher obtains copies of selected police traffic crash reports and mails these copies to the GES designated center for data entry and quality control. To protect individual privacy, the researcher does not keep backup copies of police traffic crash reports.

C.1.2 Quality Control and Data Entry Level - During data interpretation and encoding, only the coders and coding supervisor have access to the police traffic crash reports.

Coding is done on personal computers connected to a network. Access to the network is controlled by a password and access to the file is limited to the quality control supervisor. Once the police traffic crash reports are coded, they are kept in locked cabinets until destroyed by NHTSA authorization.

C.2 Data Release

C.2.1 Police Traffic Crash Reports - Sanitized copies of police traffic crash reports are used to support public research studies. Electronic copies of these sanitized police traffic crash reports are made available to NHTSA engineers and data analysts for clinical review and analysis on the premises of the storage facility contractor. After being available one year for clinical research, the police traffic crash reports are destroyed.

C.2.2 Automated Analysis File - After the data file is created, quality checks are performed on the data. When these are completed, the electronic data are made available for public use. The file does not contain any personal identifiers.

D. NASS CRASHWORTHINESS DATA SYSTEM/NATIONAL MOTOR VEHICLE CRASH

CAUSATION SURVEY

In the NASS Crashworthiness Data System (CDS)/National Motor Vehicle Crash Causation Survey (NMVCCS), a national sample of motor vehicle traffic crashes is selected for the collection of data in sufficient detail to support the Agency's standards development and evaluation programs. The NASS CDS/NMVCCS collects data on approximately 8,000 motor vehicle traffic crashes annually, selected from police traffic crash reports at 24 sites.

The information on the sample of motor vehicle traffic crashes is collected by researchers under contract to NHTSA. The researcher relies upon three sources of data: (1) official documents (e.g., police traffic crash reports, and vehicle, highway and medical records); (2) physical evidence (e.g., scene characteristics and vehicle damage profile); and (3) interviews with individuals associated with the traffic crashes.

Cooperation is established with police agencies and hospitals to provide copies or transcripts of official records. Tow yards, police impound yards, and crash involved parties are contacted to obtain permission to inspect vehicles. Personal or telephone contact is made with people who were in the crashes to obtain information relevant to occupant characteristics and crash circumstances.

Cooperating agencies and individuals are assured by the researcher that any information obtained that identifies the individual will be held CONFIDENTIAL. For these reasons, the following procedures have been established for the NASS Crashworthiness Data System/National Motor Vehicle Crash Causation Survey.

D.1 DATA FILES AND CONSTRAINTS

D.1.1 Files Maintained - The NHTSA uses two types of files in its operation of the NASS CDS/NMVCCS, automated files and hard copy files. These files are:

• Master Automated File - This electronic file contains all of the source elements of a collected data set which are in computer format. After data collection and quality control phases are completed, this file serves as the protected archives of the data set and is not intended to be accessed by analysts. The file contains no names, addresses, license numbers, or vehicle registration numbers. It contains the full Vehicle Identification Number (VIN).

• Automated Analysis File - A computerized form of the data is prepared for analysis purposes by extracting most of the elements from the master automated file. This analysis file contains no personal or individual vehicle identification. It does not contain the sequential production portion of the VIN.

• Hard Copy Case File - This file contains the NASS CDS/NMVCCS data collection forms and photographs pertinent to crash cases. During the collection phase, this file is only accessible by the field operations staff (NASS CDS/NMVCCS Primary Sampling Unit and Zone Center personnel), NHTSA and other Federal officials directly associated with the management or review of the NASS Program. All official records (e.g., police traffic crash reports and medical records) are removed from the hard copy case file by the Zone Centers. Forms and photographs are thoroughly checked at the storage facility to remove all personal identifiers before the file is accessible by non-NHTSA analysts and other traffic safety users.

• Source Document File - Police traffic crash reports and medical records are removed from the hard copy case file by the Zone Centers following the quality control review process, packaged separately, and shipped to the storage facility and kept in a separate source document file. This file is only accessible by NHTSA engineers and data analysts directly associated with the management or review of the NASS Program. Police traffic crash reports and medical records are destroyed by the storage contractor after being available to NHTSA research staff for clinical analysis for three years. Other source documents (e.g., vehicle registration records), if included, are removed from the hard copy case file by the Zone Centers and destroyed.

D.2 DATA RELEASE

There are two NASS CDS/NMVCCS files which are made available to the public for clinical review and analysis, after all conditions of quality control are met. These are the NASS CDS/NMVCCS automated analysis file and the hard copy case file.

D.2.1 Release of Automated Analysis Files - To ensure that any data released is accurate, a number of conditions for quality control, documentation, completeness, and privacy must be met. The conditions are as follows:

• The data set has been edited and thoroughly analyzed for completeness, and acceptable quality and error levels.

• The production number portion of the VIN has been removed to eliminate the possibility of indirect privacy infringement. Direct disclosure is not a problem since data on the automated analysis file do not contain elements which identify specific individuals.

• The file is complete. That is, all data have been collected and a complete data set is available for analysis.

• Documentation covering sample design, element definitions, file condition, and access instructions are complete.

• NHTSA has completed a preliminary statistical analysis to augment other documentation when such a summary will materially increase the value of the data or reduce the likelihood of misinterpretation.

D.2.2 Release of Hard Copy Case Files - Release of hard copy case(s) from the hard copy storage facility by the contractor will be subject to NHTSA approval and completion of all necessary quality control. By virtue of the completion of quality control and the review for deletion of all personal identifiers, addresses, license numbers, and the production number portion of the VIN, assurance is made that no unauthorized release of data will occur.

D.2.3 Exclusions From Release - As stated above, no names or personal identifiers are stored in NASS automated files or hard copy case files. For purposes of vehicle identification in safety defect research, the full VIN is collected by NASS and entered into the master automated data file. Because the VIN, after analysis by trained experts, could be linked to specific individuals, release of the full VIN with a hard copy case or an automated file would potentially compromise the requirement (P.L. 89-564) that reports be made available to the public in a manner that does not identify individuals. For this reason, release of the full VIN is prohibited, as explained in section D.3.3.

D.3 DATA REVIEW AND SECURITY

D.3.1 PSU Level - The Primary Sampling Unit (PSU) is a city, county or group of counties in which crash data are collected by an organization under contract with the NHTSA. A predetermined sample of crash data is gathered in the PSU to support the NASS objectives by contractor employees who are referred to as researchers. Case control for confidentiality of the information gathered is executed through the following measures:

• File Security - All active cases at the PSU are maintained under secure conditions. Only those individuals hired by the contractor and/or authorized by the NHTSA are permitted access to hard copy or automated case information.

All case information collected by PSU researchers is submitted to the Zone Center, the NASS CDS/NMVCCS quality control contractor, after completion of the data collection process. The PSU does not retain copies of crash case reports that are submitted to the Zone Center.

• Release of Case Information - Details of case circumstances (i.e., encoded data, written information, descriptive information, etc.) are not released at the PSU level. All case information is submitted to the Zone Center for quality review after completion of the data collection process.

NASS CDS/NMVCCS PSU Researchers are not authorized to provide specific crash interpretation or analysis. Under no circumstances should a PSU Researcher render an opinion on the crash.

When inquiries (written or verbal) beyond those noted above are received by a NASS CDS/NMVCCS PSU researcher with regard to a particular NASS CDS/NMVCCS case, the requestor is advised as follows:

NHTSA forbids any of its contractors to release any information collected under the contract, or to be retained as a professional crash reconstructionist, or to serve as an expert witness;

The NASS CDS/NMVCCS researcher does not make judgments of culpability in the conduct of case data collection. Culpability is determined by law enforcement and judicial proceedings; and, Any request for information with regard to data collected on a crash case, must be formally addressed to the NHTSA.

• Deletion of Personal Identifiers at the PSU - The hard copy case file has some personal identifiers removed by the PSU, as may be required by local law or agreement, before submission to the Zone Center. Established PSU quality control procedures require that the hard copy case report be reviewed by another member of the PSU, other than the assigned researcher, to ensure that all personal labels, including personal medical identifiers, are removed and that other tasks are complete. Except where necessary to maintain complete quality control, personal identifiers are removed from the hard copy case file and any records submitted with the file to the Zone Center. Personnel identifiers are retained on vehicle slides (e.g., vehicle license number), and the police traffic crash report when the hard copy case file is submitted to the Zone Center. The Zone Center uses these identifiers to ascertain that the true crash-involved vehicle was observed. In addition, a small sample (less than 10 percent) of drivers or interview subjects are re-contacted to ensure interviews were conducted when so stated. These identifiers are removed from the hard copy case file by the storage contractor before the file is made available for public use by deleting the vehicle license number, street addresses, names and other identifying labels. The police traffic crash report and medical records are destroyed after a 3-year NHTSA clinical review period.

D.3.2 Zone Center Level - The Zone Center is the NASS CDS/NMVCCS quality control contractor who is responsible for the quality, quantity, completeness and timeliness of data received from a designated geographical region of NASS CDS/NMVCCS PSU locations. Completed hard copy case files are submitted to the Zone Center from the PSU teams via registered or return receipt mail. The hard copy case files are reviewed by the Zone Center staff for quality and completeness. After review, the NASS CDS/NMVCCS hard copy case files are stored at the Zone Center until NHTSA certifies that the file is closed and the quality control process is completed.

• Protection of the Case File and Release of Case Information All conditions of file security and release of case information at the PSU level are operational at the Zone Center level.

• Removal of Source Documents from the Hard Copy Case File at the Zone Center - When the quality control process is completed, the police traffic crash report and medical records are removed from the hard copy case file and shipped separately to the storage facility for NHTSA use only. After sanitization procedures are completed by the Zone Center, the hard copy case file is forwarded to the storage facility and made available for public use.

D.3.3 Storage Contractor Level

• Master Automated File - The only automated file having need of special security is the master automated file which contains the production number portion of the VIN. Master automated file security is protected by limiting access, first to the teams when data are being entered, and second to the Zone Centers when data quality is being reviewed. The only other possible access is through the Data Base Administrator at NHTSA who is assigned responsibility for automated data file building, maintenance and security, and the data processing contractor. The library copy of the master automated file is kept under secure conditions at the facility of the computer contractor. The operating version of the master automated file, which is on line at the facility of the computer contractor, is restricted to access only by selected automated file management staff who are approved by the Data Base Administrator. No analysts may access the master automated file without the permission of the Data Base Manager and the Director of the National Center for Statistics and Analysis (NCSA). Analysis of the master automated file is limited to analysts of the NCSA.

• Automated Analysis File - The automated analysis file contains no personal or individual vehicle identification. It does not contain the sequential production portion of the VIN. Access to this file by NHTSA analysts is controlled through user account passwords. Copies of the automated analysis file are made available to the public through the NASS computer contractor.

Individual access to all automated files is controlled through user account passwords that are periodically changed. The password library is kept under secure conditions by two personnel, one at the NHTSA and a second at the facility of the computer contractor.

• Hard Copy Case Files - The hard copy case file is entered into a storage file at the hard copy storage facility. Security is maintained by restricting access to the hard copy storage file only to designated file clerks of the storage facility contractor. Clerks withdraw cases for "viewing" or copying for shipment to NHTSA, other government agencies, outside organizations or individuals in accordance with the terms of the contract.After the storage facility contractor has sanitized the hard copy case file, it is made available for public use. The sanitization procedures include a review of the hard copy case file to ensure removal of official source documents (i.e., police traffic crash reports, medical records and autopsy reports) and to ensure that the hard copy case file is completely devoid of personal identifiers. The VIN is also reviewed to ensure that it does not contain the sequential production numbers which uniquely identify the vehicle. All non-coded interview information, as well as any margin comments and nonfactual data, are eliminated from the hard copy case file. All non-coded information that would identify the crash location is deleted.

• Source Document File - Medical records and police traffic crash reports are maintained in a separate file at the storage facility for a period of three years.

During this 3-year period, the medical records and police traffic crash reports are available only to NHTSA engineers and data analysts for clinical review and analysis on the premises of the storage facility contractor. The records and reports are destroyed after three years of storage.

D.4 SUBPOENAS

All subpoenas served on the contracting organization or any individual under its employment (with regard to the NASS CDS/NMVCCS) are to be immediately reported to NHTSA's Contracting Officer's Technical Representative (COTR). A copy of the subpoena is to be faxed or sent overnight mail to the COTR who will advise Agency legal staff of the subpoena.

When served with a subpoena that is NASS CDS/NMVCCS related, the contracting organization or individuals under its employment will not release any information nor take any action without approval from the NHTSA legal counsel.

When reporting the nature of the subpoenas, the contractor will give: (1) the name, address and telephone number of the requesting authority; (2) the due date for compliance; (3) the purpose of the subpoena (i.e., requested information or actions); and (4) its relation to associated NASS CDS/NMVCCS case work.

The NHTSA will promptly review the subpoena and prescribe an action that should be taken by the contracting organization or any individual under its employment.

When hard copy case material is subpoenaed before quality control is completed it will be released by the NHTSA after all conditions of quality control are met, including: (1) reviewing the material to extract all names, license and registration numbers; and (2) the production number portion of the VIN has been deleted in accordance with the statutory requirement to release cases with no personal identification (P.L. 89-564). All non-coded interview material, as well as any margin comments and recording of nonfactual data, will be extracted before release in accordance with the requirement that factual information in the case report be released (P.L. 898-564).

When hard copy case material is subpoenaed after completion of the quality control, it will be released after a review by the NHTSA to ensure that personal identifiers have been deleted in accordance with established quality control procedures.

By statutory requirement (P.L. 89-564) individuals when subpoenaed may testify in a judicial proceeding arising out of the crash investigated as to the facts obtained during investigation, but such testimony must be limited to the facts and not extended to opinion or hearsay.

D.5 MEDICAL RELEASE STATEMENT

Ordinarily, the NASS contractor and the NHTSA make arrangements with local hospitals to obtain medical injury information without compromising hospital policy on data release. If hospital policy requires a patient release, the researcher will attempt to obtain a signed release from the patient.

The release assures the patient that the medical information obtained will not be compromised by release of personal identifiers. An example of a medical release statement is given below:

"I, ______________________, hereby authorize the release of the necessary medical information from my medical records at (name of

Medical Institute) to provide for the identification of the initial injuries sustained in the motor vehicle crash in which I was involved.

This information is to be released only to authorized employees of (name of contractor) who are conducting motor vehicle traffic crash research for the United States Department of Transportation, National Highway Traffic Safety Administration, under the National Automotive Sampling System, Contract (DOT - Number).

I understand that no names, addresses, telephone numbers, or any other means of identifying me with the motor vehicle crash or injury data will be associated with the hard copy case report. Medical reports will be maintained for no longer than thirty (30) days after the date of this release by the (name of contractor). Before the National Highway Traffic Safety Administration (NHTSA) enters the hard copy case report into a public storage file, the medical report will be removed and may be used confidentially by the NHTSA as part of a clinical study of traffic crash injury consequences. At the end of three years, the report will be destroyed by the NHTSA storage facility clerk.@ patient's signature Date

E. ELECTRONIC CRASH REPORTS

State data systems are converting to electronic crash reporting systems. This allows for a reduction in the use of paper systems. The investigating police officer uses a desk top computer, lap top computer or a mobile data terminal to prepare the crash report. The report is sent electronically to the state data system.

E.1. POLICE ACCIDENT REPORT (PAR)

The PAR is prepared by the investigating police officer and is sent electronically to a supervisor for quality control. The PAR is sent to the state data system and is not maintained at the investigating police agency. The PAR is obtained at the state level, eliminating the local police jurisdiction's involvement.

E.2. Access Codes

NHTSA obtains access codes from the respective state agency so that it may retrieve

PARS electronically. From these access codes, the agency has direct access into the electronic system of the respective state. A limited set of employees and contractors of the agency are permitted to use the access codes and in no case will the codes be shared with the general public. Access granted is strictly regulated by the Federal Drivers Privacy Act (F.2).

F. LAWS GOVERNING DRIVER DATA

F.1. FEDERAL PRIVACY ACT

THE PRIVACY ACT OF 1974

5 U.S.C. § 552a

As Amended

§ 552a. Records maintained on individuals

(a) Definitions

For purposes of this section--

(1) the term "agency" means agency as defined in section 552(f) of this title;

(2) the term "individual" means a citizen of the United States or an alien lawfully admitted for permanent residence;

(3) the term "maintain" includes maintain, collect, use or disseminate;

(4) the term "record" means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph;

(5) the term "system of records" means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual;

(6) the term "statistical record" means a record in a system of records maintained for statistical research or reporting purposes only and not used in whole or in part in making any determination about an identifiable individual, except as provided by section 8 of Title 13;

(7) the term "routine use" means, with respect to the disclosure of a record, the use of such record for a purpose which is compatible with the purpose for which it was collected;

(8) the term "matching program"--

(A) means any computerized comparison of--

(i) two or more automated systems of records or a system of records with non- Federal records for the purpose of--

(I) establishing or verifying the eligibility of, or continuing compliance with statutory and regulatory requirements by, applicants for, recipients or beneficiaries of, participants in, or providers of services with respect to, cash or in-kind assistance or payments under Federal benefit programs, or (II) recouping payments or delinquent debts under such Federal benefit programs, or

(ii) two or more automated Federal personnel or payroll systems of records or a system of Federal personnel or payroll records with non-Federal records,

(B) but does not include--

(i) matches performed to produce aggregate statistical data without any personal identifiers;

(ii) matches performed to support any research or statistical project, the specific data of which may not be used to make decisions concerning the rights, benefits, or privileges of specific individuals;

(iii) matches performed, by an agency (or component thereof) which performs as its principal function any activity pertaining to the enforcement of criminal laws, subsequent to the initiation of a specific criminal or civil law enforcement investigation of a named person or persons for the purpose of gathering evidence against such person or persons;

(iv) matches of tax information (I) pursuant to section 6103(d) of the Internal Revenue Code of 1986, (II) for purposes of tax administration as defined in section 6103(b)(4) of such Code, (III) for the purpose of intercepting a tax refund due an individual under authority granted by section 404(e), 464, or 1137 of the Social Security Act; or (IV) for the purpose of intercepting a tax refund due an individual under any other tax refund intercept program authorized by statute which has been determined by the Director of the Office of Management and Budget to contain verification, notice, and hearing requirements that are substantially similar to the procedures in section 1137 of the Social Security Act;

(v) matches--

(I) using records predominantly relating to Federal personnel, that are performed for routine administrative purposes (subject to guidance provided by the Director of the Office of Management and Budget pursuant to subsection (v)); or

(II) conducted by an agency using only records from systems of records maintained by that agency;

if the purpose of the match is not to take any adverse financial, personnel, disciplinary, or other adverse action against Federal personnel; or

(vi) matches performed for foreign counterintelligence purposes or to produce background checks for security clearances of Federal personnel or Federal contractor personnel;

(vii) matches performed incident to a levy described in section 6103(k)(8) of the Internal Revenue Code of 1986; or

(viii) matches performed pursuant to section 202(x)(3) or 1611(e)(1) of the

Social Security Act (42 U.S.C. § 402(x)(3), § 1382(e)(1);

(9) the term "recipient agency" means any agency, or contractor thereof, receiving records contained in a system of records from a source agency for use in a matching program;

(10) the term "non-Federal agency" means any State or local government, or agency thereof, which receives records contained in a system of records from a source agency for use in a matching program;

(11) the term "source agency" means any agency which discloses records contained in a system of records to be used in a matching program, or any State or local government, or agency thereof, which discloses records to be used in a matching program;

(12) the term "Federal benefit program" means any program administered or funded by the Federal Government, or by any agent or State on behalf of the Federal Government, providing cash or in-kind assistance in the form of payments, grants, loans, or loan guarantees to individuals; and

(13) the term "Federal personnel" means officers and employees of the Government of the United States, members of the uniformed services (including members of the Reserve Components), individuals entitled to receive immediate or deferred retirement benefits under any retirement program of the Government of the United States (including survivor benefits).

(b) Conditions of disclosure

No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless disclosure of the record would be--

(1) to those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties;

(2) required under section 552 of this title;

(3) for a routine use as defined in subsection (a)(7) of this section and described under subsection (e)(4)(D) of this section;

(4) to the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of Title 13;

(5) to a recipient who has provided the agency with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable;

(6) to the National Archives and Records Administration as a record which has sufficient historical or other value to warrant its continued preservation by the United States Government, or for evaluation by the Archivist of the United States or the designee of the Archivist to determine whether the record has such value;

(7) to another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency which maintains the record specifying the particular portion desired and the law enforcement activity for which the record is sought;

(8) to a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if upon such disclosure notification is transmitted to the last known address of such individual;

(9) to either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee;

(10) to the Comptroller General, or any of his authorized representatives, in the course of the performance of the duties of the General Accounting Office;

(11) pursuant to the order of a court of competent jurisdiction; or

(12) to a consumer reporting agency in accordance with section 3711(e) of Title 31.

(c) Accounting of Certain Disclosures

Each agency, with respect to each system of records under its control, shall--

(1) except for disclosures made under subsections (b)(1) or (b)(2) of this section, keep an accurate accounting of--

(A) the date, nature, and purpose of each disclosure of a record to any person or to another agency made under subsection (b) of this section; and

(B) the name and address of the person or agency to whom the disclosure is made;

(2) retain the accounting made under paragraph (1) of this subsection for at least five years or the life of the record, whichever is longer, after the disclosure for which the accounting is made;

(3) except for disclosures made under subsection (b)(7) of this section, make the accounting made under paragraph (1) of this subsection available to the individual named in the record at his request; and

(4) inform any person or other agency about any correction or notation of dispute made by the agency in accordance with subsection (d) of this section of any record that has been disclosed to the person or agency if an accounting of the disclosure was made.

(d) Access to records

Each agency that maintains a system of records shall--

(1) upon request by any individual to gain access to his record or to any information pertaining to him which is contained in the system, permit him and upon his request, a person of his own choosing to accompany him, to review the record and have a copy made of all or any portion thereof in a form comprehensible to him, except that the agency may require the individual to furnish a written statement authorizing discussion of that individual's record in the accompanying person's presence;

(2) permit the individual to request amendment of a record pertaining to him and--

(A) not later than 10 days (excluding Saturdays, Sundays, and legal public holidays) after the date of receipt of such request, acknowledge in writing such receipt; and

(B) promptly, either--

(i) make any correction of any portion thereof which the individual believes is not accurate, relevant, timely, or complete; or

(ii) inform the individual of its refusal to amend the record in accordance with his request, the reason for the refusal, the procedures established by the agency for the individual to request a review of that refusal by the head of the agency or an officer designated by the head of the agency, and the name and business address of that official;

(3) permit the individual who disagrees with the refusal of the agency to amend his record to request a review of such refusal, and not later than 30 days (excluding Saturdays, Sundays, and legal public holidays) from the date on which the individual requests such review, complete such review and make a final determination unless, for good cause shown, the head of the agency extends such 30-day period; and if, after his review, the reviewing official also refuses to amend the record in accordance with the request, permit the individual to file with the agency a concise statement setting forth the reasons for his disagreement with the refusal of the agency, and notify the individual of the provisions for judicial review of the reviewing official's determination under subsection (g)(1)(A) of this section;

(4) in any disclosure, containing information about which the individual has filed a statement of disagreement, occurring after the filing of the statement under paragraph (3) of this subsection, clearly note any portion of the record which is disputed and provide copies of the statement and, if the agency deems it appropriate, copies of a concise statement of the reasons of the agency for not making the amendments requested, to persons or other agencies to whom the disputed record has been disclosed; and

(5) nothing in this section shall allow an individual access to any information compiled in reasonable anticipation of a civil action or proceeding.

(e) Agency requirements

Each agency that maintains a system of records shall--

(1) maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or by Executive order of the President;

(2) collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual's rights, benefits, and privileges under Federal programs;

(3) inform each individual whom it asks to supply information, on the form which it uses to collect the information or on a separate form that can be retained by the individual--

(A) the authority (whether granted by statute, or by Executive order of the President) which authorizes the solicitation of the information and whether disclosure of such information is mandatory or voluntary;

(B) the principal purpose or purposes for which the information is intended to be used;

(C) the routine uses which may be made of the information, as published pursuant to paragraph (4)(D) of this subsection; and

(D) the effects on him, if any, of not providing all or any part of the requested information;

(4) subject to the provisions of paragraph (11) of this subsection, publish in the Federal Register upon establishment or revision a notice of the existence and character of the system of records, which notice shall include--

(A) the name and location of the system;

(B) the categories of individuals on whom records are maintained in the system;

(C) the categories of records maintained in the system;

(D) each routine use of the records contained in the system, including the categories of users and the purpose of such use;

(E) the policies and practices of the agency regarding storage, retrievability, access controls, retention, and disposal of the records;

(F) the title and business address of the agency official who is responsible for the system of records;

(G) the agency procedures whereby an individual can be notified at his request if the system of records contains a record pertaining to him;

(H) the agency procedures whereby an individual can be notified at his request how he can gain access to any record pertaining to him contained in the system of records, and how he can contest its content; and

(I) the categories of sources of records in the system;

(5) maintain all records which are used by the agency in making any determination about any individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the determination;

(6) prior to disseminating any record about an individual to any person other than an agency, unless the dissemination is made pursuant to subsection (b)(2) of this section, make reasonable efforts to assure that such records are accurate, complete, timely, and relevant for agency purposes;

(7) maintain no record describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual about whom the record is maintained or unless pertinent to and within the scope of an authorized law enforcement activity;

(8) make reasonable efforts to serve notice on an individual when any record on such individual is made available to any person under compulsory legal process when such process becomes a matter of public record;

(9) establish rules of conduct for persons involved in the design, development, operation, or maintenance of any system of records, or in maintaining any record, and instruct each such person with respect to such rules and the requirements of this section, including any other rules and procedures adopted pursuant to this section and the penalties for noncompliance;

(10) establish appropriate administrative, technical and physical safeguards to insure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity which could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained;

(11) at least 30 days prior to publication of information under paragraph (4)(D) of this subsection, publish in the Federal Register notice of any new use or intended use of the information in the system, and provide an opportunity for interested persons to submit written data, views, or arguments to the agency; and

(12) if such agency is a recipient agency or a source agency in a matching program with a non-Federal agency, with respect to any establishment or revision of a matching program, at least 30 days prior to conducting such program, publish in the Federal Register notice of such establishment or revision.

(f) Agency rules

In order to carry out the provisions of this section, each agency that maintains a system of records shall promulgate rules, in accordance with the requirements (including general notice) of section 553 of this title, which shall--

(1) establish procedures whereby an individual can be notified in response to his request if any system of records named by the individual contains a record pertaining to him;

(2) define reasonable times, places, and requirements for identifying an individual who requests his record or information pertaining to him before the agency shall make the record or information available to the individual;

(3) establish procedures for the disclosure to an individual upon his request of his record or information pertaining to him, including special procedure, if deemed necessary, for the disclosure to an individual of medical records, including psychological records, pertaining to him;

(4) establish procedures for reviewing a request from an individual concerning the amendment of any record or information pertaining to the individual, for making a determination on the request, for an appeal within the agency of an initial adverse agency determination, and for whatever additional means may be necessary for each individual to be able to exercise fully his rights under this section; and

(5) establish fees to be charged, if any, to any individual for making copies of his record, excluding the cost of any search for and review of the record.

The Office of the Federal Register shall biennially compile and publish the rules promulgated under this subsection and agency notices published under subsection (e)(4) of this section in a form available to the public at low cost.

(g)(1) Civil remedies

Whenever any agency

(A) makes a determination under subsection (d)(3) of this section not to amend an individual's record in accordance with his request, or fails to make such review in conformity with that subsection;

(B) refuses to comply with an individual request under subsection (d)(1) of this section;

(C) fails to maintain any record concerning any individual with such accuracy, relevance, timeliness, and completeness as is necessary to assure fairness in any determination relating to the qualifications, character, rights, or opportunities of, or benefits to the individual that may be made on the basis of such record, and consequently a determination is made which is adverse to the individual; or

(D) fails to comply with any other provision of this section, or any rule promulgated thereunder, in such a way as to have an adverse effect on an individual, the individual may bring a civil action against the agency, and the district courts of the United States shall have jurisdiction in the matters under the provisions of this subsection.

(2)(A) In any suit brought under the provisions of subsection (g)(1)(A) of this section, the court may order the agency to amend the individual's record in accordance with his request or in such other way as the court may direct. In such a case the court shall determine the matter de novo.

(B) The court may assess against the United States reasonable attorney fees and other litigation costs reasonably incurred in any case under this paragraph in which the complainant has substantially prevailed.

(3)(A) In any suit brought under the provisions of subsection (g)(1)(B) of this section, the court may enjoin the agency from withholding the records and order the production to the complainant of any agency records improperly withheld from him. In such a case the court shall determine the matter de novo, and may examine the contents of any agency records in camera to determine whether the records or any portion thereof may be withheld under any of the exemptions set forth in subsection (k) of this section, and the burden is on the agency to sustain its action.

(B) The court may assess against the United States reasonable attorney fees and other litigation costs reasonably incurred in any case under this paragraph in which the complainant has substantially prevailed.

(4) In any suit brought under the provisions of subsection (g)(1)(C) or (D) of this section in which the court determines that the agency acted in a manner which was intentional or willful, the United States shall be liable to the individual in an amount equal to the sum of--

(A) actual damages sustained by the individual as a result of the refusal or…