Request for Privacy Act Records

The Privacy Act is one of the key laws governing the protection of information about individuals. Under the Privacy Act, which only applies to federal agencies, BPA must limit the collection, maintenance, use, and dissemination of personal information. Unlike the FOIA, which provides the same access to agency records for everyone, the Privacy Act provides additional access to records about yourself when those records are contained in a Privacy Act System of Records (SOR). In certain circumstances, guardians and authorized representatives may also request records about you under the Privacy Act.

Privacy Act Records

Privacy Act records are records about individuals that are regularly retrieved by a personal identifier, such as a name or a unique identification number. Most of BPA’s Privacy Act records concern employees, and include, for instance, personnel records, official government travel records, and training records. Federal agencies are required to organize such records into Privacy Act Systems of Records, and to inform individuals about the maintenance of the records through Privacy Act System of Records Notices published in the Federal Register. For the purposes of the Privacy Act, a “system” is defined as a group or category of records. Records in the same system may be stored in a variety of different places or formats. You can find a complete list of Systems of Records used by BPA here.

Privacy Act Requests and FOIA

When you request records under the Privacy Act, we process your request under both the Privacy Act and the FOIA. Some records that are about individuals are not part of Privacy Act Systems of Records and are therefore not available under the Privacy Act. For instance, although they may be about individuals, e-mails are usually not part of a Privacy Act System of Records. These records may instead be available under the FOIA. Processing your request using both statutes assures that you receive maximum disclosure of responsive records.

Exemptions

The Privacy Act authorizes a federal agency to redact a very limited amount of information from Privacy Act records before it releases the records to you. BPA may redact the following kinds of information:

• Information compiled in reasonable anticipation of a civil action or proceeding
• Information related to non-criminal law enforcement matters
• Investigatory information used to determine eligibility or suitability for federal civilian employment

Other exemptions to the Privacy Act, including an exemption for classified information, rarely apply to BPA records.

Filing Privacy Act Requests

Privacy Act Requests

Individuals, or their authorized representatives, may request access to records about themselves held by BPA. Individuals may also use the Privacy Act compliant process to request the correction of their information maintained in a DOE System of Record.

Individuals should submit a Privacy Act request by completing a Privacy Act Information Request Form.

If you chose not to use the Privacy Act Request Form, you will need to submit a written request that includes the following information:

• Name, address, date of birth, social security number, employee identification number (if any), and signature
• Type of record requested
• Brief description of the nature, time, place, and circumstances of your association with BPA
• Other information that would assist BPA to determine if the requested information exists in our records

Completion of the Privacy Act Request Form, including providing copies of identification, is voluntary. However, declining to provide the requested information may delay or increase of DOE’s difficulty of locating records responsive to your request.

ESTABLISHING VALID IDENTIFICATION OF THE REQUESTING INDIVIDUAL:

You, or your authorized representative, will be asked to provide two (2) forms of identification, with your submitted request. Pursuant to 10 CFR, § 1008.4 (b) (1) and (b) (2), an individual making a request may establish identity by:

1. Including with the request, if submitted by mail, a photocopy of two identifying documents bearing name and signature, one of which shall bear current home or business address and date of birth and one of which must include your photograph.
2. Appearing at the BPA Headquarters building during business hours and presenting either of the following:
   • One identifying document bearing the individual’s full name, photograph, and signature; or
   • Two identifying documents bearing the individual’s full name and signature, one of which shall bear their current home or business address and date of birth.
3. If the individual making the request is unable to produce satisfactory evidence of identity, the individual making the request may be required by the Privacy Act Officer to submit a notarized statement attesting to his identity and his understanding of the criminal penalties provided under section 1001 of title 18 of the United States Code for making false statements to a Government agency and under subsection (i) (3) of the Act for obtaining records under false pretenses.

Ways to Submit a Privacy Act Request

1. Through the government’s central website for FOIA:
   • Go to FOIA.gov.
   • Click the Start your Request button.
   • In the box that says ‘Type agency name,’ type BPA and then click the Search button.
   • On the next screen, click the ‘Start FOIA’ request button.
   • On the next screen, fill in the required information.
   • At step 3 of 6, use the upload tool to attach your completed Privacy Act Request Form and identify-verification documents, as described above.
   • Click the Submit request button.
2. Via email:
   • Email your completed Privacy Act Form and identity-verification documents described above, to FOIA@bpa.gov.
   • Please encrypt your request form using Entrust or password protect your form (instructions on how to password protect Adobe PDF files) prior to sending your request. 
3. In writing:
   
   • Mail your completed Privacy Act Form and identity-verification documents, described above, to:

     The Bonneville Power Administration Privacy Act Request Office, CGI-7 P.O. Box 3621 Portland, OR 97208-3621

Response Time

Like FOIA requests, we process Privacy Act requests on a first-in, first-out basis, with complex requests processed in a separate queue to avoid undue delay in responding to simple requests. BPA is required to respond to your request as soon as possible, but not later than 20 days after the receipt of your request. If we are required to retrieve records from archives, review a voluminous amount of records, or consult with other agencies, our office will contact you to inform you of the reasons for delay and the expected date of response.

Fees

Most Privacy Act requests do not result in any fee to the requester. Fees may be charged for copying Privacy Act records, but not for searching or reviewing records. Paper copies cost $0.10 per page, and the first 100 pages are provided for free. If fees total $15.00 or less, BPA waives the fee and all pages are provided for free.

Administrative Appeals

Under the Department of Energy’s Privacy Act regulations permit administrative appeals, you may appeal the response to your request within 30 calendar days using the process described in the Appeals section of How to Submit a FOIA Request. If your appeal is denied by the Department of Energy, you may sue BPA in federal court.

Third-Party Access to Your Privacy Act Records

One of the primary purposes of the Privacy Act is to limit the disclosure of records about individuals. BPA can only disclose Privacy Act records in the following limited circumstances:

• To BPA or Department of Energy employees who need the record for official business purposes
• When required under the Freedom of Information Act
• For routine uses that are (a) specifically identified in the relevant System of Records Notice and (b) compatible with the original purpose for collecting the information
• For compelling reasons of health or safety
• For civil or criminal law enforcement, or under the order of a court of competent jurisdiction
• To the Bureau of the Census, National Archives, Congress, or the Comptroller General
• In anonymized form, for statistical research or reporting
• To consumer reporting agencies as required by the Debt Collection Act

If you believe that your Privacy Act records have been disclosed unlawfully, please contact this office immediately at (503) 872-7740. You may sue BPA in federal court for unlawful disclosure.