Denial authorities may withhold records using Privacy Act exemptions only when an exemption for the system of records has been published in the Federal Register as a final rule. Appendix D lists the systems of records that have published exemptions with rationale.