FOIA requests for information contained in a Privacy Act system of records.

§ 5.10 FOIA requests for information contained in a Privacy Act system of records. (a) Information subject to Privacy Act. (1) If a requester submits a FOIA request for information about him or herself that is contained in a Privacy Act system of records applicable to the requester ( i.e., the information contained in the system of records is retrieved by the component using the requester's name or other personal identifier, and the information pertains to an individual covered by the Privacy Act) the request will be processed under both the FOIA and the Privacy Act. (2) If the information the requester is seeking is not subject to the Privacy Act ( e.g., the information is filed under another subject, such as an organization, activity, event, or an investigation not retrievable by the requester's name or personal identifier), the request, if otherwise properly made, will be treated only as a FOIA request. In addition, if the information is covered by the Privacy Act and the requester does not provide proper verification of the requester's identity, the request, if otherwise properly made, will be processed only under the FOIA. (b) When both Privacy Act and FOIA exemptions apply. Only if both a Privacy Act exemption and a FOIA exemption apply can DHS withhold information from a requester if the information sought by the requester is about him or herself and is contained in a Privacy Act system of records applicable to the requester. (c) Conditions for release of Privacy Act information to third parties in response to a FOIA request. If a requester submits a FOIA request for Privacy Act information about another individual, the information will not be disclosed without that person's prior written consent that provides the same verification information that the person would have been required to submit for information about him or herself, unless— (1) The information is required to be released under the FOIA, as provided by 5 U.S.C. 552a (b)(2); or (2) In most circumstances, if the individual is deceased. (d) Privacy Act requirements. See DHS's Privacy Act regulations in 5 CFR part 5, subpart B for additional information regarding the requirements of the Privacy Act.