(a) Handling of records subject to the Act. Employees whose duties require handling of records subject to the Privacy Act shall, at all times, take care to protect the integrity, security and confidentiality of these records.

(b) Disclosure of records. No employee of the Commission may disclose records subject to the Privacy Act unless disclosure is permitted under § 700.267 or is to the individual to whom the record pertains.

(c) Alteration of records. No employee of the Commission may alter or destroy a record subject to the Privacy Act unless (1) such alteration or destruction is properly undertaken in the course of the employee's regular duties or (2) such alteration or destruction is required by a decision under §§ 700.287-700.295 or the decision of a court of competent jurisdiction.