29 CFR § 2400.6 - Procedures for requesting records.
The purpose of this section is to provide procedures by which an individual may gain access to his records.
(a) Submission of requests for access -
(1) Manner. An individual seeking information regarding the contents of records systems or access to records about himself in a system of records should present a written request to that effect either in person or by mail to the Privacy Officer, OSHRC, One Lafayette Centre, 1120-20th Street, NW., Ninth Floor, Washington, DC 20036-3457.
(2) Specification of records sought. Requests for access to records shall describe the nature of the record sought, the approximate dates covered by the record, and the system in which the record is thought to be included as described in the “Notification” for that system as published in the Federal Register. The requester should also indicate whether he wishes to review the record in person or obtain a copy by mail. If the information supplied is insufficient to locate or identify the record, the requester shall be notified promptly and, if necessary, informed of additional information required.
(3) Period for response. Upon receipt of an inquiry the Privacy Officer shall respond promptly to the request and no later than 10 working days from receipt of such inquiry.
(b) Verification of identity. The following standards are applicable to any individual who requests records concerning himself:
(1) An individual seeking access to records about himself in person may establish his identity by the presentation of a single document bearing a photograph (such as a passport, employee identification card, or valid driver's license) or by the presentation of two items of identification which do not bear a photograph but do bear both a name and address (such as a valid driver's license, or credit card).
(2) An individual seeking access to records about himself by mail shall establish his identity by a signature, address, date of birth, place of birth, employee identification number, if any, and one other identifier such as a photocopy of an identifying document.
(3) An individual seeking access to records about himself by mail or in person who cannot provide the necessary documentation of identification may provide a notarized statement, or a declaration in accordance with 28 U.S.C. 1746, swearing or affirming to his identity and to the fact that he understands the penalties for false statements pursuant to 18 U.S.C. 1001. Forms for notarized statements may be obtained on request from the Privacy Officer.
(c) Verification of guardianship. The parent or guardian of a minor or a person judicially determined to be incompetent and seeking to act on behalf of such minor or incompetent shall, in addition to establishing his own identity, establish the identity of the minor or other person he represents as required in paragraph (b) of this section and establish his own parentage or guardianship of the subject of the record by furnishing either a copy of a birth certificate showing parentage or a court order establishing the guardianship.
(d) Accompanying persons. An individual seeking to review records about himself may be accompanied by another individual of his own choosing. Both the individual seeking access and the individual accompanying him shall be required to sign a form provided by OSHRC indicating that OSHRC is authorized to discuss the contents of the subject record in the presence of both individuals.
(e) When compliance is possible - (1) The Privacy Officer shall inform the requester of the determination to grant the request and shall make the record available to the individual in the manner requested, that is, either by forwarding a copy of the information to him or by making it available for review, unless:
(i) It is impracticable to provide the requester with a copy of a record, in which case the requester shall be so notified, and, in addition, be informed of the procedures set forth in paragraph (b) of this section, or
(ii) The Privacy Officer has reason to believe that the cost of a copy of a record is considerably more expensive than anticipated by the requester, in which case he shall notify the requester of the estimated cost, and ascertain whether the requester still wishes to be provided with a copy of the information.
(2) Where a record is to be reviewed by the requester in person, the Privacy Officer shall inform the requester in writing of:
(i) The date on which the record shall become available for review, the location at which it may be reviewed, and the hours for inspection;
(ii) The type of identification that shall be required in order for him to review the record;
(iii) Such person's right to have a person of his own choosing accompany him to review the record; and
(iv) Such person's right to have a person other than himself review the record.
(3) If the requester seeks to inspect the record without receiving a copy, he shall not leave OSHRC premises with the record and shall sign a statement indicating he has reviewed a specific record or category of record.
(f) Response when compliance is not possible. A reply denying a written request to review a record shall be in writing signed by the Privacy Officer and shall be made only if such a record does not exist or does not contain personal information relating to the requester, or is exempt. This reply shall include a statement regarding the determining factors of denial, and the requester's rights to administrative appeal and thereafter judicial review in a district court of the United States.