4-3.2 Responding to Requester’s Request for Notification of or Access to Records About Himself or Herself Under the Privacy Act

4-3.2.1 Evaluating Under the FOIA a Request for Access by Requester to His or Her Records

As provided in 4-3.2.2.b and 4-3.2.9.b, the records custodian must, in some scenarios, evaluate a request for access to records about the requester under the FOIA’s disclosure provisions (see 4-4), as well as under the Privacy Act’s access provisions. This is the case even if the request does not cite the FOIA. This procedure provides the requester with the greatest access to records pertaining to the requester.

Note: A requester’s access to records about himself or herself under the FOIA is different than under the Privacy Act. A requester may qualify as a person under the FOIA (broader definition) (see 4-4.5.c) but not as an individual under the Privacy Act (narrower definition) (see 4-3.2.2.c). In addition, the requested records may qualify as records under the FOIA (broader definition) (see 4-4.5.d) but not qualify as records about the requester in a Postal Service system of records under the Privacy Act (narrower definition) (see 4-3.2.2). Further, the FOIA exclusions/exemptions (see 4-4.22 and 4-4.24) are different than the Privacy Act exemptions (see 4-3.2.9); although, in some cases, the exemptions are similar but not identical.

 

	Freedom of Information Act	Privacy Act of 1974
Citation for laws	Title 5 U.S.C. 552	Title 5 U.S.C. 552a
Citations for Postal Service regulations	Title 39 CFR 265 Handbook AS-353, Guide to Privacy, the Freedom of Information Act, and Records Management (Chapters 4 and 5).	Title 39 CFR 266 Handbook AS-353, Guide to Privacy, the Freedom of Information Act, and Records Management (Chapter 3 and Appendix).
Nature and purpose of the statute	The FOIA requires the Postal Service to disclose upon written request any record that is not covered by a FOIA exemption. The FOIA keeps the public informed about what our government is doing.	The Privacy Act (PA) grants individuals a right of access to their own records and imposes fair record-keeping requirements on the Postal Service. The PA balances the government’s need to know and the individual’s right to privacy.
Coverage	All agency records.	All agency records covered by a Privacy Act system of records (SOR) (a group of records kept about individuals and retrieved by a personal identifier). See the Appendix in Handbook AS-353.
Access provisions	Any person can gain access to non-exempt records.	Only to the subject of the record or appropriate designee. Applies only to U.S. citizens and aliens lawfully admitted for permanent residence. Access may be granted to third parties through “exceptions” (e.g., routine uses, authorized disclosures).
Fees	Search, review, and duplication fees based on identity of the requester.	Fees limited to duplication costs.
Records searches	Reasonable search of all records created or maintained by the USPS, including those in any Privacy Act system of records (SOR).	Search is limited to records contained in a USPS SOR (unless there is reason to believe that records exist in non-Privacy Act files).
Time limits	The FOIA states that agencies must respond within 20 working days; 10 additional working days granted in unusual or exceptional circumstances.	Acknowledge request within 10 working days of the request, provide records as soon as practical, and give the requester a date of availability if records are not immediately available.
Reasons to appeal Agency’s initial response	Adequacy of search; Failure to comply with time limits; Denial of information in full or in part; and Denial of fee waiver or expedited processing request.	Denial of access; and Denial of amendment request.

4-3.2.2 Determining Qualification as a Covered Individual, Record, and System of Records

1. General. In order for a notification or access request to be further considered under the Privacy Act, the requester must qualify as an individual, and the records inquired about or requested must qualify as records about the requester in a Postal Service system of records.
2. Evaluating Under the FOIA Requester’s Access Request for His or Her Records. If the requirements in paragraph a. are not met for an access request (e.g., because the requested records do not qualify as records in a system of records) but the requester is a person asking for access to records about himself or herself, the records custodian must also evaluate the request under the FOIA’s disclosure provisions (see 4-4). This is the case even if the request does not cite the FOIA.
3. Individual. Any citizen of the United States or alien lawfully admitted for permanent residence. An individual does not include the following:
1. An entity.
2. A deceased person who qualified as an individual prior to death.
3. An interested party of a deceased person who qualified as an individual prior to death when the interested party is inquiring about the existence of or requesting records about the deceased person solely on the basis of his or her status as such an interested party (the interested party does not succeed to the deceased person’s Privacy Act notification or access rights). Those interested parties include, but are not limited to, the following:
1. The executor or administrator of the deceased person’s estate.
2. The deceased person’s surviving family members.

Note: While an interested party may not “inherit” or succeed to a deceased individual’s Privacy Act rights, the interested party may nevertheless be given access to records under some circumstances. If the interested party claims a legal right to access records, consult your Area Law Office. In addition, in some instances, an interested party may have a right to disclosure of requested records about the deceased person under the FOIA’s disclosure provisions (see 4-4). Regarding FOIA Exemption 6, be aware that deceased individuals have a significantly diminished privacy interest in information subject to disclosure
(see 4-4.24.2.6).

The following may act on behalf of an individual, even without the express consent of an individual:

1. A parent of a minor who is an individual.
2. The legal guardian of an individual who has been declared incompetent due to physical or mental incapacity or age by a court of competent jurisdiction.
4. Maintain. Maintain, collect, use, or disseminate.
5. Record. Any item, collection, or grouping of information that meets all of the following requirements:
1. Is about an individual (including, but not limited to, his or her education, financial transactions, medical history, criminal history, or employment history).
2. Is maintained by the Postal Service.
3. Contains the individual’s name or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint, voice print, or photograph.
6. System of Records.
1. General. A group of any records under the Postal Service’s control from which information is retrieved by the individual’s name or by some number, symbol, or other identifying particular assigned to the individual. The Postal Service’s systems of records that it has identified under the Privacy Act are set forth in the Appendix.
2. Emails. Emails in the Postal Service’s email archive system do not qualify as records in a system of records (they are not retrieved by the individual’s name or identifying particular).
3. Uncirculated Personal Notes. Uncirculated personal notes kept by a Postal Service employee about an individual do not qualify as a record in a system of records.
7. Contractor-Developed or -Operated System. When the Postal Service contracts for the operation by or on behalf of the Postal Service of a system of records to accomplish a Postal Service function and that system meets the definition in paragraph f., the Privacy Act’s notification and access provisions in 4-3 apply to that system.

4-3.2.3 Determining Sufficiency of Form of Request

The records custodian must deny a notification or access request that is not in writing if it is required to be in writing pursuant to the procedures for a requester to make a notification or access request available at http://about.usps.com/who-we-are/foia/welcome.htm.

4-3.2.4 Determining Sufficiency of Content of Request

A notification or access request must contain a sufficiently detailed description of the records/system of records inquired about or requested to enable the records custodian to conduct a search for responsive records with a reasonable amount of effort. A notification or access request may not be denied for lack of a sufficient description until the records custodian has given the requester a reasonable amount of time to provide a sufficient description (see 4-3.2.12.b).

4-3.2.5 Verifying Requester’s Identity for Access Request

The records custodian must verify the identity of a requester who has submitted an access request to the extent necessary to ensure that the requester is the person he or she represents himself or herself to be. As appropriate under the circumstances of the access request, the requester may be required to comply with one of the following identification verification methods:

1. Certification of Identity. Provision of a completed Certification of Identity. A template certification of identity is available at http://about.usps.com/who-we-are/foia/welcome.htm.
2. Official Photo Identification. Provision of an official photo identification, which includes, but is not limited to, the following:
1. A valid driver’s license.
2. An unexpired passport.
3. An unexpired federal government-issued employee identification card.
3. Privacy Waiver. Provision of a completed Privacy Waiver if the records pertain to another individual available at http://about.usps.com/who-we-are/foia/welcome.htm.

An access request may not be denied for lack of sufficient identity verification until the records custodian has given the requester a reasonable amount of time to provide sufficient identity verification (see 4-3.2.12.b).

4-3.2.6 Searching for Responsive Records

If a notification or access request has not been resolved in some other manner, the records custodian must conduct a search of all of the records in the relevant system of records as described in the applicable system of records notice in the Appendix to locate records that are responsive to the request. The records custodian must notify the requester to the extent that no responsive records are found.

4-3.2.7 Determining Whether Records Responsive to Access Request Are Also About Someone Other Than the Requester

To the extent records responsive to an access request are also about someone other than the requester (e.g., records regarding selection for a position), the requester is not provided access to them under the Privacy Act’s access provisions in 4-3.2. Instead, the records custodian must determine whether their disclosure to the requester is appropriate under the Privacy Act’s external third-party disclosure provisions (e.g., the other person has requested or consented in writing to disclosure to the requester)
(see 4-3.3.3) or the FOIA’s disclosure provisions (see 4-4).

4-3.2.8 Considering Postal Reorganization Act Exemptions for an Access Request

The records custodian must consider the extent to which records responsive to an access request are exempt from such access under the Postal Reorganization Act (PRA) exemptions described in Exhibit 4-3.2.9. To the extent the responsive records are so exempt, the records custodian may deny the request on that basis, but must also consider the extent to which responsive records exempt from access under the PRA exemptions are also exempt from access under the Privacy Act exemptions (see 4-3.2.9). To the extent the responsive records are not exempt from access under the PRA exemptions, the records custodian must consider the extent to which they are exempt from access under the Privacy Act exemptions (see 4-3.2.9).

Exhibit 4-3.2.8 

Table of Postal Reorganization Act Exemptions

 

PRA Exemption	What is Exempt
39 U.S.C. 410(c)(1)	The name or address, past or present, of any Postal Service customer, except that the name and address of a specifically identified Postal Service customer is disclosed to the general public, upon request, in limited circumstances (see 4-2.2.1).
39 U.S.C. 410(c)(2)	Information of a commercial nature, including trade secrets, whether or not obtained from a person outside the Postal Service, which under good business practice would not be publicly disclosed.
39 U.S.C. 410(c)(3)	Information prepared for use in connection with the negotiation of collective bargaining agreements under 39 U.S.C. Chapter 12, or minutes of, or notes kept during, negotiating sessions conducted under such chapter.
39 U.S.C. 410(c)(4)	Information prepared in connection with proceedings under 39 U.S.C. Chapter 36 relating to rates, classification, and service changes.
39 U.S.C. 410(c)(5)	Reports and memoranda of consultants or independent contractors, except to the extent that they would be required to be disclosed if prepared within the Postal Service.
39 U.S.C. 410(c)(6)	Investigatory files, whether or not considered closed, compiled for law enforcement purposes, except to the extent available by law to a party other than the Postal Service. It is Postal Service policy to ordinarily make records compiled for law enforcement purposes available to the general public, upon request, unless the disclosure is covered by FOIA Exemption 7 (see 4-4.24.2.7).
39 U.S.C. 412	Prohibits the disclosure of mailing lists or other lists of names or addresses, past or present, of Postal Service customers or other persons to the public by any means for any purpose, except as specifically authorized by law. In response to a proper FOIA request, the Postal Service may, to the extent required by law, provide a listing of Postal Service employees working at a particular Postal Service facility. See 39 CFR 265.14(e). Regarding Privacy Act requests, the Postal Service may release a list of names and addresses of individuals pursuant to a written request by, or with the prior written consent of, each individual whose name and address is contained in such list, provided that such names and addresses are derived from records maintained by the Postal Service in a system of records as defined by the Privacy Act. See 39 CFR 266.3(b)(3)(iv). See 39 CFR 266.3(b)(3) for other exceptions not related to the FOIA or the Privacy Act.

4-3.2.9 Considering Privacy Act Exemptions

1. Notification Request. The records custodian must consider the extent to which records responsive to a notification request are exempt from such notification under the Privacy Act exemptions described in Exhibit 4-3.2.9. To the extent the responsive records are so exempt, the records custodian may deny the request.
2. Access Request. To the extent records responsive to an access request are not exempt from such access under the PRA exemptions (see 4-3.2.8), the records custodian must consider the extent to which they are exempt from such access under the Privacy Act exemptions described in Exhibit 4-3.2.9.
1. Not Covered Under PRA or Privacy Act Exemptions. To the extent records responsive to an access request are not exempt from such access under either the PRA exemptions or the Privacy Act exemptions, the records custodian must provide access to the requester (if the other conditions in 4-3 are met).
2. Not Covered Under PRA Exemptions But Covered Under Privacy Act Exemptions – Further Evaluation Under the FOIA. To the extent records responsive to an access request are not exempt from such access under the PRA exemptions, but are exempt from such access under the Privacy Act exemptions, the records custodian must also evaluate whether the responsive records must be disclosed under the FOIA’s disclosure provisions
   (see 4-4). This is the case even if the request does not cite the FOIA.

Exhibit 4-3.2.9 

Table of Privacy Act Exemptions

 

Privacy Act Exemption	What is Exempt
5 U.S.C. 552a(d)(5)	Information that was compiled in reasonable anticipation of a civil action or proceeding. (Applies only to access requests.)
5 U.S.C. 552a(j) Certain criminal law enforcement systems of records.	As identified in the portions of 39 CFR 266.8 and the Appendix invoking 5 U.S.C. 552a(j).
5 U.S.C. 552a(k) Includes, but is not limited to, systems of records that consist of the following: 1. Certain investigatory material compiled for law enforcement purposes (5 U.S.C. 552a(k)(2)). 2. Certain investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualification for federal civilian employment or access to classified information (5 U.S.C. 552a(k)(5)). 3. Certain testing or examination material used solely to determine individual qualification for appointment or promotion in the federal service (5 U.S.C. 552a(k)(6)).	As identified in the portions of 39 CFR 266.8 and the Appendix invoking 5 U.S.C. 552a(k). However, the requester must be provided notification of or access to responsive records that otherwise would be exempt under the portions of 39 CFR 266.8 and the Appendix invoking 5 U.S.C. 552a(k)(2) if the requester is denied any right, privilege, or benefit that he or she would otherwise be entitled to by federal law, or for which he or she would otherwise be eligible, as a result of the maintenance of the responsive records, except to the extent that the disclosure would reveal the identity of a source who furnished information to the U.S. Government under either of the following: 1. An express promise that the source’s identity would be held in confidence. 2. An implied promise made before the effective date of the Privacy Act that the source’s identity would be held in confidence.

4-3.2.10 Handling Medical or Psychological Records Responsive to an Access Request

The records custodian must not provide to the requester medical or psychological records about the requester responsive to an access request (including those received from the Department of Veterans Affairs, Public Health Service, or Office of Workers’ Compensation Programs) if in the medical officer’s judgment such access could have an adverse effect upon the requester. If the medical officer makes that determination, the medical officer instead transmits the responsive medical or psychological records to a medical doctor named by the requester, if any. In such cases, an accounting of the disclosure to the medical doctor named by the requester must be kept (see 4-3.5).

4-3.2.11 Assessing and Collecting Fees for Access Request

In response to an access request, the records custodian must provide the requester, at no charge, with hard copies of the first 100 pages of the first copy requested of the responsive records if the requester seeks hard copies of the responsive records. The requester is charged $.15 per page for each other page copied by the records custodian in hard copy. The records custodian must collect the total duplication fee before providing the copies to the requester and deposit the fee in Account Identifier Code (AIC) 127.

4-3.2.12 Responding to the Requester

1. Acknowledgment of Request. The records custodian must date stamp the notification or access request (if in a form that permits date stamping) and notify the requester of its receipt no later than 10 business days (excluding weekends and Postal Service holidays) after receipt by the Postal Service, unless the records custodian provides some other response to the requester as provided for in 4-3.2 within that time period.
2. Notification of Deficiency and Opportunity to Respond.
1. Notification Request. The records custodian must notify the requester as soon as practical of any deficiency in the sufficiency of the content of a notification request and give the requester a reasonable amount of time to provide a sufficiently detailed description of the records/system of records inquiry (see 4-3.2.4).
2. Access Request. The records custodian must notify the requester as soon as practical of any deficiency in the sufficiency of the content of an access request and give the requester a reasonable amount of time to provide a sufficiently detailed description of the requested records/system of records inquiry (see 4-3.2.4). The records custodian must also notify an access requester as soon as practical of any deficiency in identity verification and give the requester a reasonable amount of time to provide sufficient identity verification (see 4-3.2.5).
3. Notification of Duplication Fees. The records custodian must notify the requester as soon as practical of any duplication fees that will be charged with respect to the Postal Service’s making requested hard copies of records responsive to an access request.
4. Time Period for Other Actions. The records custodian must take the other actions described in 4-3.2 as soon as practical.
5. Response to Requester.
1. The response to the requester with respect to a notification or access request must be in writing, signed by the records custodian, and sent to the requester by Certified Mail, return receipt requested. If there are records responsive to an access request that will be made available to the requester for in-person inspection, the records custodian must follow the procedures in paragraph f.
2. If applicable, the records custodian must provide copies of records responsive to an access request in the form specified by the requester, if feasible (including hard copy or electronic format (e.g., on a disc or thumb drive)). Appropriate security measures must be taken to encrypt and otherwise protect copies provided in electronic format.
3. If the records custodian has made an adverse determination with respect to an access request (which includes, but is not limited to, a denial of the access request based on a Postal Reorganization Act or Privacy Act exemption or the determination that no responsive records exist), the response must state the reasons for the adverse determination.
4. If the records custodian has made an adverse determination with respect to a notification or access request, the response must contain the following notification to the requester of his or her administrative appeal rights:

“You have the right to appeal this response in writing sent by mail to the General Counsel, U.S. Postal Service, 475 L’Enfant Plaza SW, Washington, DC 20260-1101 and postmarked no later than 90 calendar days after the date of this letter. Your letter of appeal must include, as applicable:

1. A copy of your original written request, or a reasonable description of the records/system of records of or to which you sought notification or access if your request was not in writing;
2. A copy of this letter;
3. Copies of any other correspondence relating to your request;
4. A statement of the Postal Service’s action or failure to act that you are appealing;
5. A statement of the reasons why you believe the Postal Service’s action or failure to act was erroneous; and
6. A statement of the relief you seek.”
6. Providing In-Person Inspection of Records Responsive to Access Request. If the requester asks to conduct an in-person inspection of records responsive to an access request, the records custodian must follow these procedures:
1. The records custodian must notify the requester of the time, date, and location of the inspection, which ordinarily occurs during regular business hours at the facility where the responsive records are kept, but may occur at some other time or location reasonable under the circumstances of the request. If feasible, the records custodian must accommodate the requester’s preferred location, date, and time of inspection. A Postal Service employee must inspect/copy responsive records on his or her own time, except as provided for under collective bargaining agreements.
2. Before permitting the inspection to begin, the records custodian must conduct any necessary identity verification (see 4-3.2.5).
3. The records custodian must permit the requester to manually record the contents of the responsive records.
4. The records custodian must be present to observe the requester’s inspection of the responsive records.
5. If, at the conclusion of the inspection, the requester asks for the records custodian to provide copies of the responsive records, such copies must be furnished in the manner provided in
   4-3.2.11, 4-3.2.12.c., and 4-3.2.12.e.((2)).
6. The records custodian may make available to the requester a user-paid copying machine to make hard copies of the responsive records, beyond the hard copies of the first 100 pages of the first copy of the responsive records, which are provided to the requester at no charge (see 4-3.2.11).
7. The records custodian must permit the requester to have a person of his or her choosing accompany the requester to aid in the inspection (and, if applicable, the manual recording or copying of the responsive records if the requester submits a signed statement authorizing the person to do so) and discussion of the responsive records in the accompanying person’s presence.
8. At the conclusion of the inspection, the records custodian must ask the requester to sign a statement that he or she has inspected the responsive records and include a description of the responsive records. If the requester refuses to sign the statement, the records custodian must note the time, date, and location of the inspection and include a description of the responsive records in the administrative file, which the records custodian maintains relating to the request (see 4-3.2.13).
7. OPFs and eOPFs.
1. Current Employees. A current Postal Service employee who is requesting access to his or her electronic Official Personnel Folder (eOPF) should be advised of the option available to the employee to obtain direct access to his or her eOPF (viewing, printing, and, in most cases, requesting a copy) through the Postal Service’s LiteBlue website (https://liteblue.usps.gov). If the employee does not choose that option, or is not eligible to obtain a copy of his or her eOPF through the LiteBlue website, the records custodian must respond to the employee’s access request in accordance with the procedures in 4-3.2.
2. Former Employees. A former Postal Service employee who is seeking access to his or her eOPF stored at the National Personnel Records Center (NPRC) (part of the National Archives and Records Administration) or to his or her Official Personnel Folder (OPF) stored at the NPRC that was not converted to an eOPF must be advised of the option available to the former employee to request access to his or her eOPF or OPF directly from the NPRC through the procedures described at https://www.archives.gov/st-louis/civilian-personnel. If the former employee does not choose that option, he or she must submit a request for access to his or her eOPF or OPF to the final district Human Resources office or the Human Resources Shared Services Center. The request must receive a response in accordance with the procedures in 4-3.2. The Postal Service official must request the OPF from the NPRC in accordance with the procedures at https://www.archives.gov/st-louis/civilian-personnel/federal-agencies.html. The OPF may be retained for a maximum of 30 days after providing access to the requester in case there is a further need for it. Thereafter, the OPF must be returned to the NPRC by Registered Mail.
8. NACIs. Requesters who seek access to the results of their National Agency Check with Inquiries (NACI) conducted by the Office of Personnel Management (OPM) must be advised to request such access directly from OPM in accordance with the procedures at https://www.opm.gov/investigations/freedom-of-information-and-privacy-act-requests/.

4-3.2.13 Creating and Retaining the Administrative File

1. Creating the Administrative File. The records custodian must create an administrative file that memorializes how the notification or access request was processed, including, but not limited to, the following documentation:
1. All documents pertaining to the request and response, including, but not limited to, the following:
1. The notification or access request, if in writing, or a description of the records/system of records inquired about or requested, if the request was not in writing.
2. The final written response sent to the requester.
3. Any other written correspondence between the Postal Service and the requester.
2. Adequate documentation of the steps taken in conducting the search for responsive records, if any.
3. If applicable, the notes of the time, date, and location of the requester’s in-person inspection of the responsive records and description of those responsive records if the requester refuses to sign a statement containing that information
   (see 4-3.2.12.f.((8))).
4. To the extent not provided in paragraphs (1) – (3), documentation of the records responsive to the notification or access request, if any, and which records the requester was or was not provided notification of or access to, and the reasons.
2. Retaining the Administrative File. The records custodian must retain the administrative file for a period of 7 years from the end of the fiscal year in which the final written response on the notification or access request was sent to the requester.

4-3.2.14 Preserving the Responsive Records

The records custodian may not dispose of the records response to a notification or access request while they are the subject of the pending notification or access request, or an administrative appeal or Privacy Act litigation relating to the request.