(a) Records maintained in a Privacy Act system of records shall not be released except by the Government or at the Government's direction regardless of whether the Government or a contractor acting on behalf of the Government is maintaining the records. Examples of systems of records are:

(1) Personnel, payroll and background records about any officer or employee of DOT, or other person, including his or her residential address;

(2) Medical histories and medical records concerning individuals, including applications for licenses; and

(3) Any other record containing information about an individual which includes that individual's name or other personal identifier.

(b) Examples of records to which the Privacy Act does not apply are:

(1) Records that are maintained by a contractor on individuals employed by the contractor in the process of providing goods and services to the Federal government; and

(2) Student records generated in connection with the student's attendance (e.g., admission forms, grade reports) at an educational institution contracted by the agency to provide training to students. These records must be similar to those maintained on other students and must not be commingled with records of other students.

DOT rules and regulations implementing the Privacy Act of 1974 are located at 49 CFR part 10.