(a) General. Any information used in whole or in part in making a determination about an individual's rights, benefits, or privileges under FEMA programs will be collected directly from the subject individual to the extent practicable. The system manager also shall ensure that information collected is used only in conformance with the provisions of the Act and these regulations.

(b) Solicitation of information. System managers shall ensure that at the time information is solicited the solicited individual is informed of the authority for collecting that information, whether providing the information is mandatory or voluntary, the purpose for which the information will be used, the routine uses to be made of the information, and the effects on the individual, if any, of not providing the information. The Director, Records Management Division, Office of Management and Regional Administrators shall ensure that forms used to solicit information are in compliance with the Act and these regulations.

(c) Solicitation of Social Security numbers. Before an employee of FEMA can deny to any individual a right, benefit, or privilege provided by law because such individual refuses to disclose his/her social security account number, the employee of FEMA shall ensure that either:

(1) The disclosure is required by Federal statute; or

(2) The disclosure of a social security number was required under a statute or regulation adopted before January 1, 1975, to verify the identity of an individual, and the social security number will become a part of a system of records in existence and operating before January 1, 1975.

(d) Soliciting information from third parties. An employee of FEMA shall inform third parties who are requested to provide information about another individual of the purposes for which the information will be used.