14 CFR § 1212.201 - Requesting a record.
(a) Individuals may request access to their Privacy Act records, either in person, in writing, or electronically.
(b) Individuals may also authorize a third party to have access to their Privacy Act records. This authorization shall be in writing, signed by the individual, or submitted electronically. Requests must contain the individual's address or email address, as well as the name, address or email address of the representative being authorized access. The identities of both the subject individual and the representative must be verified in accordance with the procedures set forth in § 1212.202.
(c)
(1) In-person or written requests must be directed to the appropriate system manager, or, if unknown, to the Center Privacy Manager or Freedom of Information Act (FOIA) Office at NASA Headquarters or Field Center. The request should be identified clearly on the envelope and on the letter as a “Request Under the Privacy Act.”
(2) Electronic requests may be initiated online at https://www.nasa.gov/about/highlights/HP_Privacy.html.
(3) Where possible, requests should contain the following information to ensure timely processing:
(i) Name and address of subject.
(ii) Email address of subject, for electronic requests only.
(iii) Identity of the system of records.
(iv) Nature of the request.
(v) Identifying information specified in the applicable system notice to assist in identifying the request, such as location of the record, if known, full name, birth date, time periods in which the records are believed to have been compiled, etc.
(d) NASA has no obligation to comply with a nonspecific request for access to information concerning an individual, e.g., a request to provide copies of “all information contained in your files concerning me,” although a good faith effort will be made to locate records if there is reason to believe NASA has records on the individual. If the request is so incomplete or incomprehensible that the requested record cannot be identified, additional information or clarification will be requested in the acknowledgement, and assistance to the individual will be offered as appropriate.
(e) If the Center Privacy Manager receives a request for access, the Privacy Manager will record the date of receipt and immediately forward the request to the responsible system manager for handling.
(f) If the Center FOIA Office receives a first party request for records or access, the FOIA Office will process the request under the Privacy Act pursuant to this part.
(g) Normally, the system manager shall respond to a request for access within 10 business days of receipt of the request and the access shall be provided within 30 business days of receipt.
(1) In response to a request for access, the system manager or Privacy Act Officer shall:
(i) Notify the requester that there is no record on the individual in the system of records and inform the requester of the procedures to follow for appeal (see § 1212.4);
(ii) Notify the requester that the record is exempt from disclosure, cite the appropriate exemption, and inform the requester of the procedures to follow for appeal (see § 1212.4);
(iii) Upon request, promptly provide copies of the record, subject to the fee requirements (see § 1212.204); or
(iv) Make the individual's record available for personal inspection in the presence of a NASA representative.
(2) Unless the system manager agrees to another location, personal inspection of the record shall be at the location of the record as identified in the system notice.
(3) When an individual requests records in a system of records maintained on a third party, the request shall be processed as a FOIA request under 14 CFR part 1206. If the records requested are subject to release under FOIA (5 U.S.C. 552(b)), then a Privacy Act exemption may not be invoked to deny access.
(4) When an individual requests records in a system of records maintained on the individual, the request shall be processed under this part. NASA will not rely on exemptions contained in FOIA to withhold any record which is otherwise accessible to the individual under this part.