Section 1. General requirements. Each agency that maintains a system of records subject to 5 U.S.C. 552a and the regulations of this subpart shall:

(a) Maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or by executive order of the President;

(b) Collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual's rights, benefits, and privileges under Federal programs;

(c) Inform each individual whom it asks to supply information, on the form which it uses to collect the information, or on a separate form that can be retained by the individual, of:

(1) The authority (whether granted by statute, or by executive order of the President) which authorizes the solicitation of the information and whether disclosure of such information is mandatory or voluntary;

(2) The principal purpose or purposes for which the information is intended to be used;

(3) The routine uses which may be made of the information, as published pursuant to paragraph (d)(4) of this section; and

(4) The effects on the individual, if any, of not providing all or any part of the requested information;

(d) Subject to the provisions of section 2 of this appendix, prepare for publication in the Federal Register at least annually a notice of the existence and character of each system it maintains, which notice shall include:

(1) The name and location(s) of the system;

(2) The categories of individuals on whom records are maintained in the system;

(3) The categories of records maintained in the system;

(4) Each routine use of the records contained in the system, including the categories of uses and the purpose of such use;

(5) The policies and practices of the agency regarding storage, retrievability, access controls, retention, and disposal of the records;

(6) The title and business address of the agency official who is responsible for the system of records;

(7) The agency procedures whereby an individual can be notified at his or her request if the system of records contains a record pertaining to the individual;

(8) The agency procedures whereby an individual can be notified at his or her request how the individual can gain access to any record pertaining to him or her contained in the system of records, and how he can contest its content; and

(9) The categories of sources of records in the system;

(e) Maintain all records which are used by the agency in making any determination about any individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the determination;

(f) Prior to disseminating any record about an individual to any person other than an agency, unless the dissemination is made pursuant to 5 U.S.C. 552a(b)(2), make reasonable efforts to assure that such records are accurate, complete, timely, and relevant for agency purposes;

(g) Maintain no record describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual about whom the record is maintained, or unless pertinent to and within the scope of an authorized law enforcement activity;

(h) Make reasonable efforts to serve notice on an individual when any record on such individual is made available to any person under compulsory legal process when such process becomes a matter of public record;

(i) Establish rules of conduct for persons involved in the design, development, operation, or maintenance of any system of records, or in maintaining any record, and instruct each such person with respect to such rules and the requirements of this section, including any other rules and procedures adopted pursuant to this section and the penalties for noncompliance;

(j) Establish appropriate administrative, technical, and physical safeguards to insure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity which could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained.

Sec. 2. Amendment of routine uses for an existing system of records, or establishment of a new system of records.

(a) Any agency which intends to add a routine use, or amend an existing one, in a system of records it maintains, shall, in accordance with 5 U.S.C. 552a(e)(11), ensure that at least 30 days advance notice of such action is given by publication in the Federal Register and an opportunity provided for interested persons to submit written data, views or arguments to the agency.

(b) Any agency which intends to establish a new system of records, or to alter any existing system of records, shall insure that adequate advance notice is provided to Congress and the Office of Management and Budget to permit an evaluation of the probable or potential effect of such action on the privacy and other personal or property rights of individuals or the disclosure of information relating to such individuals, and its effect on the preservation of the constitutional principles of federalism and separation of powers. Such notice is required for any new system of records and for any alteration in an existing one which will:

(1) Increase the number or types of individuals on whom records are maintained;

(2) Expand the type or amount of information maintained;

(3) Increase the number or categories of agencies or other persons who may have access to those records;

(4) Alter the manner in which the records are organized so as to change the nature or scope of those records (e.g., the combining of two or more existing systems);

(5) Modify the way the system operates at its location(s) in such a manner as to alter the procedures by which individuals can exercise their rights under this subpart; or

(6) Change the equipment configuration on which the system is operated so as to create the potential for greater access (e.g., adding a telecommunications capability).

Sec. 3. Accounting of certain disclosures. Each agency, with respect to each system of records under its control, shall:

(a) Except for disclosures made under 5 U.S.C. 552a(b)(1) and (2), keep an accurate account of:

(1) The date, nature, and purpose of each disclosure of a record to any person or agency outside the Department; and

(2) The name and address of the person or agency to whom the disclosure is made;

(b) Retain the accounting made under paragraph (a) of this section for the longer of a period of five years, after the date of the disclosure for which the accounting is made, or the life of the record disclosed;

(c) Except for disclosures made under 5 U.S.C. 552a(b)(7), make the accounting required under paragraph (a) of this section available to the individual named in the record at his or her request.

Sec. 4. Government contractors. When an agency within the Department provides by a contract for the operation by or on behalf of the agency of a system of records to accomplish an agency function, the agency shall, consistent with its authority, cause the requirements of this subpart to be applied to such system. For purposes of 5 U.S.C. 552a(i) any such contractor or any employee of such contractor shall be considered to be an employee of an agency and therefore subject to the criminal penalties set forth in 5 U.S.C. 552a(i).

Sec. 5. Mailing lists. No agency within the Department shall sell or rent any individual's name and address unless such action is specifically authorized by law. This section shall not be construed to require, or to authorize, the withholding of names and addresses whose disclosure is required by 5 U.S.C. 552.

Sec. 6. Social security account numbers. (a) No agency shall deny, or permit any State or local government with whom it is involved in a cooperative venture to deny, to any individual any right, benefit, or privilege provided by law because of such individual's refusal to disclose his or her social security account number.

(b) Paragraph (a) of this section shall not apply with respect to:

(1) Any disclosure required by Federal statute; or

(2) Any disclosure to any agency relating to a system of records it maintained prior to January 1, 1975, if such disclosure was required under statute or regulation adopted prior to that date, to verify the identity of an individual.

(c) Any agency in the Department which requests an individual to disclose his or her social security account number shall inform that individual whether the disclosure is mandatory or voluntary, by what statutory or other authority the number is solicited, and what uses will be made of it. The agency shall also insure that this information is provided by a State or local government with whom it is involved in a cooperative agreement.

Sec. 7. Annual report. Each agency in the Department shall submit to the Office of the General Counsel prior to March 30 of each year a report containing the following information related to implementation of 5 U.S.C. 552a:

(a) A summary of major accomplishments;

(b) A summary of major plans for activities in the upcoming year;

(c) A list of the systems which were exempted during the year from any of the operative provisions of this subpart pursuant to 5 U.S.C. 552a (j) and (k), whether or not the exemption was effected during that year, the number of instances with respect to each system exempted in which the exemption was invoked to deny access, and the reasons for invoking the exemption;

(d) A brief summary of changes to the total inventory of personal data system subject to this subpart including reasons for major changes; and

(e) A general description of operational experiences including estimates of the number of individuals (in relation to the total number of records in the system):

(1) Requesting information on the existence of records pertaining to them;

(2) Refusing to provide information;

(3) Requesting access to their records;

(4) Appealing initial refusals to amend records; and

(5) Seeking redress through the courts.

Sec. 8. Effect of 5 U.S.C. 552. No agency in the Department shall rely on any exemption in 5 U.S.C. 552 to withhold from an individual any record which is otherwise accessible to such individual under 5 U.S.C. 552a and this subpart.