CFR > Title 32 - National Defense > SUBTITLE A—Department of Defense > CHAPTER VII—DEPARTMENT OF THE AIR FORCE (parts 800 to 989) > SUBCHAPTER A—ADMINISTRATION (parts 800 to 809a) > PART 806b—PRIVACY ACT PROGRAM > SUBPART A—Overview of the Privacy Act Program (§806b.1 to §806b.7) > 806b.7—Responsibilities.

806b.7—Responsibilities.

(a) The Air Force Chief Information Officer is the senior Air Force Privacy Official with overall responsibility for the Air Force Privacy Act Program.
(b) The Office of the General Counsel to the Secretary of the Air Force, Fiscal and Administrative Law Division (GCA) makes final decisions on appeals.
(c) The General Litigation Division, Air Force Legal Services Agency (JACL), receives Privacy Act appeals and provides recommendations to the appellate authority. Service unique appeals, from combatant commands, should go through the respective chain of command.
(d) The Plans and Policy Directorate, Office of the Chief Information Officer manages the program through the Air Force Privacy Act Officer who:
(1) Administers procedures outlined in this part.
(2) Reviews publications and forms for compliance with this part.
(3) Reviews and approves proposed new, altered, and amended systems of records; and submits system notices and required reports to the Defense Privacy Office.
(4) Serves as the Air Force member on the Defense Privacy Board and the Defense Data Integrity Board.
(5) Provides guidance and assistance to Major Commands, field operating agencies, direct reporting units and combatant commands for which AF is executive agent in their implementation and execution of the Air Force Privacy Program. Ensures availability of training and training tools for a variety of audiences.
(6) Provides advice and support to those commands to ensure that information requirements developed to collect or maintain personal data conform to Privacy Act standards; and that appropriate procedures and safeguards are developed, implemented, and maintained to protect the information.
(e) Major Command commanders, and Deputy Chiefs of Staff and comparable officials at Secretary of the Air Force and Headquarters United States Air Force offices implement this part.
(f) 11th Communications Squadron will provide Privacy Act training and submit Privacy Act reports for Headquarters United States Air Force and Secretary of the Air Force offices.
(g) Major Command Commanders: Appoint a command Privacy Act officer, and send the name, office symbol, phone number, and e-mail address to Air Force Chief Information Officer/P.
(h) Major Command and Headquarters Air Force Functional Chief Information Officers:
(1) Review and provide final approval on Privacy Impact Assessments (see appendix E of this part).
(2) Send a copy of approved Privacy Impact Assessments to Air Force Chief Information Officer/P.
(i) Major Command Privacy Act Officers:
(1) Train base Privacy Act officers. May authorize appointment of unit Privacy Act monitors to assist with implementation of the program.
(2) Promote Privacy Act awareness throughout the organization.
(3) Review publications and forms for compliance with this part (do forms require a Privacy Act Statement; is Privacy Act Statement correct?).
(4) Submit reports as required.
(5) Review system notices to validate currency.
(6) Evaluate the health of the program at regular intervals using this part as guidance.
(7) Review and provide recommendations on completed Privacy Impact Assessments for information systems.
(8) Resolve complaints or allegations of Privacy Act violations.
(9) Review and process denial recommendations.
(10) Provide guidance as needed to functionals on implementing the Privacy Act.
(j) Base Privacy Act Officers:
(1) Provide guidance and training to base personnel.
(2) Submit reports as required.
(3) Review publications and forms for compliance with this part.
(4) Review system notices to validate currency.
(5) Direct investigations of complaints/violations.
(6) Evaluate the health of the program at regular intervals using this part as guidance.
(k) System Managers:
(1) Manage and safeguard the system.
(2) Train users on Privacy Act requirements.
(3) Protect records from unauthorized disclosure, alteration, or destruction.
(4) Prepare system notices and reports.
(5) Answer Privacy Act requests.
(6) Records of disclosures.
(7) Validate system notices annually.
(8) Investigate Privacy Act complaints.
(l) System owners and developers:
(1) Decide the need for, and content of systems.
(2) Evaluate Privacy Act requirements of information systems in early stages of development.
(3) Complete a Privacy Impact Assessment and submit to the Privacy Act Officer.