DEPARTMENT OF DEFENSE PRIVACY PROGRAM

1 DoD DEPARTMENT OF DEFENSE PRIVACY PROGRAM May 14, 2007 OFFICE OF THE DIRECTOR, ADMINISTRATION AND MANAGEMENT DoD , May 14, 2007 2 FOREWORD This Regulation is reissued under the authority of DoD Directive , DoD PRIVACY PROGRAM , May 8, 2007 (Reference (a)). It provides guidance on section 552a of title 5 United States Code ( ), the PRIVACY Act of 1974, as amended, (Reference (b)), and prescribes uniform procedures for implementation of the DoD PRIVACY PROGRAM . DoD , DEPARTMENT of DEFENSE PRIVACY PROGRAM , August 13, 1983, is hereby canceled.

2 This Regulation applies to the Office of the Secretary of DEFENSE , the Military Departments, the Chairman of the Joint Chiefs of Staff, the Combatant Commands, the Inspector General of the DEPARTMENT of DEFENSE , the DEFENSE Agencies, the DoD Field Activities, and all other organizational entities within the DEPARTMENT of DEFENSE (hereafter referred to as the DoD Components ). The provisions of this Regulation shall be applicable by contract or other legally binding action to Government contractors whenever a DoD contract requires the performance of any activities associated with maintaining a system of records, including the collection, use, and dissemination of records on behalf of the contracting DoD Component.

3 When maintaining a system of records or a portion of a system of records, contractors and their employees shall be considered employees of the contracting DoD Component for purposes of the criminal penalties of the Act. This Regulation does not apply to: Requests for information made under the Freedom of Information Act (DoD Directive ) (Reference (c)). They are processed in accordance with DoD (Reference (d)). Requests for information from systems of records controlled by the Office of Personnel Management (OPM), although maintained by a DoD Component.

4 These are processed in accordance with policies established by OPM (Reference (e)). Requests for personal information from the General Accountability Office. These are processed in accordance with DoD Directive (Reference (f)). Requests for personal information from Congress. These are processed in accordance with DoD Directive (Reference (g)), except for the specific provisions in Chapter 4 of this Regulation. DoD , May 14, 2007 3 This Regulation is effective immediately and its use is mandatory for all DoD Components. The Heads of the DoD Components may issue supplementary instructions only when necessary to provide for unique requirements within their Components.

5 Such instructions may not conflict with the provisions of this Regulation. Send recommended changes to this Regulation to the following address: Director, DEFENSE PRIVACY Office 1901 South Bell Street, Room 920 Arlington, VA 22202-4512 The DoD Components may obtain copies of this Regulation through their own publication channels. Approved for public release; distribution unlimited. Copies are available via the World Wide Web at Authorized registered users may obtain copies of the publication from the DEFENSE Technical Information Center, 8725 John J.

6 Kingman Road, Fort Belvoir, VA 22060-6218. Other Federal Agencies and the public may obtain copies from the DEPARTMENT of Commerce, National Technical Information Service, 5285 Port Royal Road, Springfield, VA 22161. DoD , May 14, 2007 TABLE OF CONTENTS 4 TABLE OF CONTENTS Page FOREWORD 2 TABLE OF CONTENTS 4 REFERENCES 7 DEFINITIONS 8 CHAPTER 1 SYSTEMS OF RECORDS 11 GENERAL 11 STANDARDS OF ACCURACY 13 GOVERNMENT CONTRACTORS 13 SAFEGUARDING PERSONAL INFORMATION 15 NOTIFICATION WHEN INFORMATION IS LOST.

7 STOLEN OR 16 COMPROMISED CHAPTER 2 COLLECTING PERSONAL INFORMATION 18 GENERAL CONSIDERATIONS 18 FORMS 20 CHAPTER 3 - ACCESS BY INDIVIDUALS 22 INDIVIDUAL ACCESS TO PERSONAL INFORMATION 22 DENIAL OF INDIVIDUAL ACCESS 27 AMENDMENT OF RECORDS 29 REPRODUCTION FEES 35 CHAPTER 4 DISCLOSURE OF PERSONAL INFORMATION TO OTHER 37 AGENCIES AND THIRD PARTIES CONDITIONS OF DISCLOSURE 37 NON-CONSENSUAL CONDITIONS OF DISCLOSURES 38 DISCLOSURES TO COMMERCIAL ENTERPRISES 46 DISCLOSURES TO THE PUBLIC FROM MEDICAL RECORDS 47 DISCLOSURE ACCOUNTING 47 CHAPTER 5 EXEMPTIONS 49 USE AND ESTABLISHMENT OF EXEMPTIONS 49 ACCESS EXEMPTON 51 GENERAL EXEMPTIONS 51 SPECIFIC EXEMPTIONS 52 DoD , May 14.

8 2007 TABLE OF CONTENTS 5 CHAPTER 6 PUBLICATION REQUIREMENTS 54 FEDERAL REGISTER PUBLICATION 54 EXEMPTION RULES 56 SYSTEM NOTICES 56 NEW AND ALTERED RECORD SYSTEMS 62 AMENDMENT AND DELETION OF SYSTEM NOTICES 66 CHAPTER 7 TRAINING REQUIREMENTS 67 STATUTORY TRAINING REQUIREMENTS 67 OMB TRAINING GUIDELINES 67 DoD TRAINING programs 67 TRAINING METHODOLOGY AND PROCEDURES 68 FUNDING FOR TRAINING 68 CHAPTER 8 REPORTS 69 REQUIREMENT FOR REPORTS 69 SUSPENSE FOR SUBMISSION OF REPORTS 69 REPORTS CONTROL SYMBOL 69 CHAPTER 9 INSPECTIONS 70 PRIVACY ACT INSPECTIONS 70 INSPECTION REPORTING 70 CHAPTER 10 PRIVACY ACT VIOLATIONS 71 ADMINISTRATIVE REMEMDIES 71 CIVIL ACTIONS 71 CIVIL REMEDIES 71 CRIMINAL PENALTIES 71 LITIGATION STATUS SHEET 71 LOST, STOLEN, OR COMPROMISED INFORMATION 72 CHAPTER 11 COMPUTER MATCHING PROGRAM PROCEDURES 74 GENERAL 74 COMPUTER MATCHING PUBLICATION AND 75 REVIEW REQUIREMENTS COMPUTER MATCHING AGREEMENTS (CMA) 76 APPENDICES AP1.

9 SAFEGUARDING PERSONALLY IDENTIFIABLE INFORMATION 79 AP2. SAMPLE NOTIFICATION LETTER 82 AP3. DoD BLANKET ROUTINE USES 83 AP4. PROVISIONS OF THE PRIVACY ACT FROM WHICH A 86 GENERAL OR A SPECIFIC EXEMPTION MAY BE CLAIMED AP5. SAMPLE OF NEW OR ALTERED SYSTEM OF RECORDS 89 NOTICE IN FEDERAL REGISTER FORMAT AP6. FORMAT FOR NEW OR ALTERED SYSTEM REPORT 98 DoD , May 14, 2007 TABLE OF CONTENTS 6 AP7. SAMPLE AMENDMENTS AND DELETIONS TO SYSTEMS 102 NOTICES IN FEDERAL REGISTER FORMAT AP8. LITIGATION STATUS SHEET 107 DoD , May 14, 2007 DEFINITIONS 7 REFERENCES (a) DoD Directive , DoD PRIVACY PROGRAM , May 8, 2007 (b) Section 552a of title 5, United States Code (c) DoD Directive , DoD Freedom of Information (FOIA) PROGRAM , October 28, 2005 (d) DoD , DoD Freedom of Information Act PROGRAM , September 1998 (e) Title 5, Code of Federal Regulations, Parts 293, 294, 297, 735, and 736, current edition (f) DoD Directive , General Accountability Office (GAO) and Comptroller General Access to Records, September 11, 1997 (g)

10 DoD Directive , Provision of Information to Congress, January 30, 1978 (h) DoD , Information Security PROGRAM , January 14, 1997 (i) Section 3303a of title 44, United States Code (j) Federal Acquisition Regulation, Subpart , Protection of Individual PRIVACY , current edition (k) Section 3711(e) of title 31, United States Code (l) Executive Order 9397, Numbering System for Federal Accounts Relating to Individual Persons, November 30, 1943 (m) DoD Instruction , DoD Forms Management PROGRAM , May 31, 1990 (n) Section 1746 of title 28, United States Code (o) DoD , DoD Health Information PRIVACY Regulation, January 24, 2003 (p) Section 552 of title 5, United States Code, as amended (q) Public Law 86-36, National Security Agency-Officers and Employees, (r) Sections 130b, 424, 3013, 5013, and 8013 of title 10, United States Code (s) Section 6 of title 13, United States Code (t) DoD Directive , Indebtedness of Military Personnel, October 27, 1994 (u) Section 3056 of title 18, United States Code (v)