20 CFR 402.20: Relationship between the FOIA and the Privacy Act of 1974.

(a) Coverage. The FOIA and the rules in this part apply to all SSA records. The Privacy Act, 5 U.S.C. 552a, applies to records that are about individuals, but only if the records are in a system of records.

(b) Requesting your own records. If you have filed a FOIA request and are an individual requesting your own records that are maintained in a system of records, or if you are a parent or legal guardian authorized to act under § 401.75 of this chapter who is seeking the records about a minor or individual who has been declared incompetent, your request may be handled under the Privacy Act. See § 401.40 of this chapter. If we handle your request under the Privacy Act, we will provide you with written notification with further processing instructions. Privacy Act requests are also processed under the FOIA, when appropriate, to give you the benefit of both statutes. You must verify your identity in accordance with our regulations. See § 401.45 of this chapter.