Any information that is used in making a determination about your rights, benefits, or privileges under NARA programs is collected directly from you—the subject individual—to the greatest extent possible.

(a) Before collecting information from you, NARA will advise you of:

(1) The authority for collecting the information and whether providing the information is mandatory or voluntary;

(2) The purpose for which the information will be used;

(3) The routine uses of the information; and

(4) The effect on you, if any, of not providing the information.

(b) NARA ensures that forms used to record the information that you provide are in compliance with the Privacy Act and this part.

(a) Before a NARA employee or NARA contractor asks you to provide your social security number (SSN), he or she will ensure that the disclosure is required by Federal law or under a Federal law or regulation adopted before January 1, 1975.

(b) If you are asked to provide your SSN, the NARA employee or contractor must first inform you:

(1) Whether the disclosure is mandatory or voluntary;

(2) The statute or authority under which your SSN is solicited; and

(3) How your SSN will be used.

NARA will make every effort to gather information from you directly. When NARA solicits information about you from someone else, NARA will explain to that person the purpose for which the information will be used.

The system manager ensures that all records used by NARA to make a determination about any individual are maintained with such accuracy, relevancy, timeliness, and completeness as is reasonably possible to ensure fairness to you.

All NARA employees and contractors involved in the design, development, operation or maintenance of any system of records must review the provisions of the Privacy Act and the regulations in this part. NARA employees and contractors must conduct themselves in accordance with the rules of conduct concerning the protection of nonpublic information in the Standards of Ethical Conduct for Employees of the Executive Branch, 5 CFR 2635.703.

(a) The system manager ensures that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of records. In order to protect against any threats or hazards to their security or loss of integrity, paper records are maintained in areas accessible only to authorized NARA personnel. Electronic records are protected in accordance with the Computer Security Act, OMB Circular A-11 requiring privacy analysis in reporting to OMB, and are accessed via passwords from terminals located in attended offices. After hours, buildings have security guards and/or doors are secured and all entrances are monitored by electronic surveillance equipment.

(b) The system manager, at his/her discretion, may designate additional safeguards similar to or greater than those described in paragraph (a) of this section for unusually sensitive records.

(c) The system manager only permits access to and use of automated or manual personnel records to persons whose official duties require such access, or to you or to a representative designated by you.