Prior to the transfer of any identifiable information to persons other than BJA, OJJDP, BJS, NIJ, or OJP or project staff, an agreement shall be entered into which shall provide, as a minimum, that the recipient of data agrees that:

(a) Information identifiable to a private person will be used only for research and statistical purposes.

(b) Information identifiable to a private person will not be revealed to any person for any purpose except where the information has already been included in research findings (and/or data bases) and is revealed on a need-to-know basis for research or statistical purposes, provided that such transfer is approved by the person providing information under the agreement, or authorized under § 22.24(e).

(c) Knowingly and willfully using or disseminating information contrary to the provisions of the agreement shall constitute a violation of these regulations, punishable in accordance with the Act.

(d) Adequate administrative and physical precautions will be taken to assure security of information obtained for such purpose.

(e) Access to information will be limited to those employees or subcontractors having a need therefore in connection with performance of the activity for which obtained, and that such persons shall be advised of, and agree to comply with, these regulations.

(f) Project plans will be designed to preserve anonymity of private persons to whom information relates, including, where appropriate, required name-stripping and/or coding of data or other similar procedures.

(g) Project findings and reports prepared for dissemination will not contain information which can reasonably be expected to be identifiable to a private person.

(h) Information identifiable to a private person (obtained in accordance with this agreement) will, unless otherwise agreed upon, be returned upon completion of the project for which obtained and no copies of that information retained.