December 24, 1997

Mr. Karl Auerbach
218 Carbonera Drive
Santa Cruz, CA 95060-1500

Dear Mr. Auerbach:

Thank you for your patience in awaiting our response. We felt it was important, however, to answer fully your November 16, 1997 letter, especially since it is not uncommon for individuals unfamiliar with federal disclosure statutes to confuse the Privacy Act with the Freedom of Information Act (FOIA). For example, you mistakenly maintain that the statutory response dates applicable to FOIA requests similarly apply to the Privacy Act, and that clearly is not the case. Although National Science Foundation regulations certainly state that the agency will attempt to respond to Privacy Act requests within ten working days, there is no statutory deadline. And I am sure you appreciate the legal and factual difference between asking for whether records exist and seeking to amend a Privacy Act record pertaining to you.

Specifically, you ask us to inform you "of the existence of records pertaining to [you]" in what you assert to be a Privacy Act system of records referred to as the "domain name database." NSF maintains no such system of records and, consequently, cannot have "failed to publish notice of this system of records in the Federal Register" as you incorrectly state.

The Privacy Act's provisions apply to systems of records maintained by a Federal agency. 5 U.S.C 552a(e). A "system of records" includes only records under the control of the agency from which information is retrieved by an individual identifier. 5 U.S.C 552a(a)(5). The Privacy Act's definition of "agency" at 5 U.S.C 552a(a)(1) is the same as is defined in the Freedom of Information Act. See 5 U.S.C 552(f)(1)

The United States Supreme Court in Department of Justice v. Tax Analysts, 492 U.S. 136 (1989), established a two-pronged test for determining whether material constitutes an agency record". First, a federal agency must "either create or obtain" the materials. Id. at 144, citing Kissinger n Reporters Committee for Freedom of the Press, 445 U.S. 136 (1980), and Forsham v. Harris, 445 U.S. 169 (1980). Second, the agency "must be in control of the requested materials at the time the FOIA request is made." Tax Analysts, 492 U.S. at 145. Moreover, the Court held, "[b]y control we mean that the materials have come into the agency's possession in the legitimate conduct of its official duties." Id.

Network Solutions, Inc. (NSI) maintains records for its own use in administering certain domain names under a cooperative agreement with NSF, NCR-9218742. The so-called domain name database to which you refer consists of information collected, maintained and used by NSI pursuant to that cooperative agreement, which is a type of federal assistance award made by NSF under the Federal Grant and Cooperative Agreement Act of 1977, 4 U.S.C. 503, where the agency transfers money to the recipient to accomplish a public purpose of support or stimulation. NSF Grant Policy Manual 210.

NSF has neither created nor obtained the records NSI uses in day-to-day administration of domain name registration activities. The agency does not possess the database and cannot access it electronically (except in the same manner that is available to you and the general public through the Internet). Neither does NSF control the requested database. NSF has never acquired the database and, accordingly, has never integrated the database into NSF's files. Neither does the agency nor its employees retrieve, use, or rely on the data in conducting official agency duties or accomplishing any agency function. Thus, the requested database is not an agency record. See id. at 145-47.¹

Private organizations like NSI that receive federal financial assistance grants are not within the definition of "agency," Forsham v. Harris, 445 U.S. 169, 179 (1980), and the documents created by a grant recipient are the property of the recipient, not the Federal Government. Id. at 180-81.² The "written data generated, owned, and possessed by a privately controlled organization receiving federal study grants are not 'agency records' within the meaning of the Act when copies of those data have not been obtained by a federal agency subject to the FOIA." Id. at 171. Nor does the agency's right of access to the materials change this result. Tax Analysts, supra at 144. Rather, "the FOIA applies to records which have been in fact obtained, and not to records which merely could have been obtained." Id. at 186 (emphasis in original).³

Similarly, the records of recipients of federal grants fall outside the purview of the Privacy Act. General federal supervision of grantees remains insufficient to establish the substantial federal control and supervision necessary to characterize the grantee as a "federal" entity or instrumentality. Dennie v. University of Pittsburgh School of Medicine, 589 F. Supp. 348, 352 (D.V.I. 1984), aff'd, 770 F. 2d 1068 (3d Cir. 1985) citing Forsham. Applying Forsham to a claim under the Privacy Act, the Dennie court concluded that "absent extensive detailed and virtually day-to-day supervision" -- the standard of Forsham, "the recipient of public funds does not become a federal instrumentality" for Privacy Act purposes. Thus, the Federal agency has no obligation to insure that records held by its grantee are maintained in compliance with the Privacy Act. Id at 352-53.⁴

NSF maintains no such supervision and control over NSI databases. The terms of the cooperative agreement make clear that NSI -- as the awardee -- has primary responsibility for carrying out the agreement while NSF conducts oversight, monitoring, and evaluation of the awardee's performance. As in Forsham, supra at 172-73 and Dennie, supra at 352, NSF exercises limited oversight over the funded activity including review of periodic reports submitted by the grantee and agency approval of major program or budgetary changes, while NSI conducts the day-to-day administrative activities under the agreement. NSF's general oversight does not establish agency control of the database. See Forsham at 182 and Dennie at 352-53.

Thus, your assertion that the "domain name database" is an NSF system of records is incorrect, and NSF maintains no system of records responsive to your request.

¹ Compare Tax Analysts, supra at 145-148 (agency had records in its possession at the time of the request, had placed them in its official case files, and was routinely using the records in the performance of its official duties); Burka v. HHS, 87 F.3d 508,515 (D.C. Cir. 1996) (agency exercised control over data tapes in the possession of its contractor sufficient to render them "agency records" for FOIA purposes where the agency ordered creation of the records, plans to take physical possession of the tapes at the end of the project, has indicated it will disclose the information after the agency's publication schedule is completed and prohibited the contractor from making any independent disclosures, and has read and relied significantly on the information in writing articles and establishing agency policies); and St Paul's Benev. Educ. Inst v. U.S., 506 F. Supp. 823, 829 (ND. Ga. 1980) (computer tape possessed by the agency; facts reveal the agency did "create or obtain a record," which is now in its possession, and that it may certainly rely or use this record in the future because of the importance of the data).