of their duties and the use is compatible with the purpose for which the record is maintained. This includes, for example, transfer of information between components when civilians or military personnel assigned or affiliated with one component are processed by an activity of another component such as Armed Forces Examination and Entrance Stations (AFEES), Air Terminals, or Defense Investigative Service (DIS).

(2) Required to be disclosed to a member of the public by the Freedom of Information Act (5 U.S.C. 552). Some examples of personal information pertaining to military personnel, which normally are released without an unwarranted invasion of privacy are: name, rank, date of rank, salary, present and past duty assignments, future assignments which have been finalized, office phone number, source of commission, military and civilian educational level, and promotion sequence number. Disclosure of personal information pertaining to civilian employees shall be made in accordance with the Federal Personnel Manual.

(3) For a routine use as defined in § 286a.6 and described in § 286a.12.

(4) To the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity authorized by law.

(5) To a recipient who has provided the Department of Defense or Component with advance adequate written assurance that (i) the record will be used solely as a statistical research or reporting record; (ii) the record is to be transferred in a form that is not individually identifiable (i.e. the identity of the individual cannot be determined by combining various statistical records); and (iii) will not be used to make any decisions about the rights, benefits or entitlements of an individual.

(6) To the National Archives of the United States as a record which has sufficient historical or other value to warrant its continued preservation by the United States Government, or for evaluation by the Administrator of General Services or his designee to determine whether the record has such value. A record transferred to a Federal records center for safekeeping or storage does not fall within this categoy since Federal records center personnel act on behalf of the Department of Defense in this instance and the records remain under the control of the DoD Component.

No disclosure accounting record of the transfer of records to Federal records centers need be maintained.

(7) To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the DoD Component which maintains the record specifying the particular portion desired and the law enforcement activity for vhich the record is sought. Blanket requests for all records pertaining to an individual will not be accepted. A record may also be disclosed to a law enforcement agency at the initiative of the DoD Component which maintains the record when criminal conduct is suspected, provided that such disclosure has been established in advance as a "routine use."

(8) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if upon such disclosure notification is transmitted to the last known address of the individual to whom the record pertains.

(9) To either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, or any joint committee.

(10) To the Comptroller General, or any of his authorized representatives, in the course of the performance of the duties of the General Accounting Office.

(11) Pursuant to the order of a court of competent jurisdiction.

(i) When a record is disclosed under compulsory legal process and when the issuance of that order or subpoena is made public by the court which issued it, make reasonable efforts to notify the individual to whom the record pertains. This may be accomplished by notifying the individual by mail at his most recent address as contained in the DoD Component's records.

(ii) Upon being served with an order to disclose a record, the DoD Component shall endeavor to determine whether the issuance of the order is a matter of public record and, if it is not, seek to be advised when it becomes public. An accounting of the disclosure shall be made at the time the Component complies with the order or subpoena.

(c) Each DoD Component, with respect to each system of records under its control, shall:

(1) Except for disclosures made under paragraph (b)(1) and (2) of this section, keep an accurate accounting of the date, nature, and purpose of each disclosure of a record to any person or to another agency; and the name and address of the person or agency to whom the disclosure is made. A DOD Component need not make a notation on a single document of every disclosure of a particular record, provided it can construct from its system the required accounting information (i) when required by the individual; (ii) when necessary to inform previous recipients of any amended records or (iii) when providing a cross reference to the justification or basis upon which the disclosure was made (including any written documentation as required in the case of the release of records for statistical or law enforcement purposes).

(2) Retain the accounting made under subparagraph (1) of this paragraph, for at least 5 years after the last disclosure or the life of the record, whichever is longer. No record of the disclosure of this accounting need be maintained.

(3) Upon request of the individual to whom the record pertains, make available to that individual all information in its accounting of disclosures except that pertaining to disclosures for law enforcement purposes pursuant to paragraph (b) (7) this section.

(d) Names and addresses. (1) An individual's name and address may not be sold or rented by a component unless such action is specifically authorized by law. This provision shall not be construed to require the withholding of names and addresses otherwise permitted to be made public.

(2) Lists or compilations of names and home addresses, or single home addresses will not be disclosed, without the consent of the individual involved, to the public including, but not limited to, individual congressmen, creditors, and commercial and financial institutions. Requests for home addresses may be referred to the last known address of the individual for reply at his discretion and the requester will be notified accordingly. This prohibition may be waived when circumstances of a case indicate compelling and overriding interests.

§ 286a.9 Collection of personal information from individuals.

(a) Collection directly from individual. Personal information shall be collected

to the greatest extent practicable directly from the individual when the information may result in adverse determinations about an individual's rights, benefits, and privileges under Federal programs. The collection of information from third parties shall be minimized. Exceptions to this policy may be made under certain circumstances, such as the following:

(1) There is a need to ensure accuracy of information supplied by an individual by verifying with a third party, such as in the case of verifying information for a security clearance.

(2) The nature of the information is such that it can only be obtained from a third party, such as an employee's performance in a previous job or assignment.

(3) Obtaining the information from the individual would present exceptional practical difficulties or would result in unreasonable cost.

order)

(b) Informing individuals from whom information is requested. Each individual who is asked to supply personal information must be told of (1) the authority (statute or executive which authorizes its solicitation; (2) the principal purpose or purpose for which it is to be used; (3) the routine uses to be made of it; (4) whether furnishing such information is mandatory or voluntary; and (5) the effects on him, if any, of not providing it. This notice to the individual may be made on the form which the DoD Component uses to collect the information or on a separate form which can be retained by the individual. This advice must be given regardless of the media used in requesting information, whether it is a "form" in the usual sense (i.e., a preprinted document with a control number and an edition date) or a format, questionnaire, survey sheet, or report rendered on a blank sheet.

(i) "Forms" in use prior to September 27, 1975. Forms in use before September 27, 1975 which are to be used on and after that date, must meet the notice requirements by use of a separate statement to accompany each form subject to the provisions of the Privacy Act of 1974. The statement will be assigned the identifying number used in collecting the information and the suffix "Privacy Act Statement", as follows:

(A) For forms in regularly issued, numbered series, the Privacy Act Statement shall bear the same number as the form to which it pertains.

EXAMPLE: For DD Form 398, Statement of Personal History, the applicable notice to each individual asked to complete the form will be identified as "DD Form 398-Privacy Act Statement".

(B) For unnumbered formats, questionnaires, survey forms and reports, the Privacy Act Statement will bear the report control symbol or OMB Approval Number under the authority of which the information if applicable.

EXAMPLE: For the Air Force Junior ROTC Survey for AFJROTC Cadets (Format A), the applicable notice to each individual asked to complete the questionnaire will be identified as "OMB Approval No. 21-R0268Privacy Act Statement".

(ii) "Forms" Initiated or Revised On and After September 27, 1975. As forms are revised or new ones issued the Privacy Act Statement shall be incorporated, if practical, in the body of each form, format, questionnaire, survey sheet or report initiated or revised which is used to collect personal information on or after September 27, 1975. Where feasible the Privacy Act Statement when incorporated on a form, format, etc. should be positioned such a manner that the individual will be informed of the information required by the Act before he begins to furnish any of the information requested.

(iii) Responsibilities. (A) The proponent (i.e., the initiator) has the final responsibility for determining whether a form, format, questionnaire, survey, or report requires a Privacy Act Statement. Statements should be sufficiently complete and specific but, at the same time, be concise and couched in easily understood language.

(B) Forms and information management officers at all echelons within DoD Components must assure that Privacy Act Statements are available and that new forms contain the Privacy Act statements, if required.

(C) No component may deny any individual any right, benefit, or privilege provided by law because of such individual's refusal to disclose his (SSN), unless such disclosure is (1) required by Federal statute or (2) to any component maintaining a system of records in existence and operating before January 1, 1975, if such disclosure was required under statute or regulation adopted prior to such date to verify the identity of an individual. Executive Order No. 9397, November 22, 1943, authorizes components

to use SSN as a system of numerical identification of individuals.

(D) Any DoD Component which requests an individual to disclose his SSN must inform that individual (1) whether that disclosure is mandatory or voluntary; (2) by what statutory or other authority such number is solicited; and (3) what uses will be made of it.

(E) If disclosure of the SSN is not required by Federal statute or is not for a system of records in existence and operating prior to January 1, 1975, DOD Components are not precluded from requesting it from individuals concerned. However, the separate Privacy Act Statement for the SSN alone, or a merged Privacy Act Statement, covering not only the SSN but also other items of personal information, must make clear that the disclosure of the SSN is voluntary. If, in such instances, the individual refuses to disclose it, the DoD Component concerned must be prepared to identify him by alternate means.

§ 286a.10 Exemptions.

The Head of the Component shall designate the Component systems of records which are to be exempted from certain provisions of the Privacy Act of 1974, and they shall cause to be published in the FEDERAL REGISTER, information specifying the name of each designated system, the specific provisions of the act from which each system is to be exempted, and the reasons for each exemption of the record system.

(a) General Exemptions. To qualify for a general exemption, as defined in the Privacy Act of 1974, Component or element thereof which performs as its principal function any activity pertaining to the enforcement of criminal laws, including police efforts to prevent, control, or reduce crime or to apprehend criminals, and the activities of prosecutors, courts, correctional, probation, pardon, or parole authorities. Such system of records must consist of:

(1) Information compiled for the purpose of identifying individual criminal offenders and alleged offenders and containing only identifying data and notations of arrests, the nature and disposition of criminal charges, sentencing, confinement, release, and parole and probation status;

(2) Information compiled for the purpose of a criminal investigation, including reports of informants and investi

gators, and associated with an identifiable individual; or

(3) Reports identifiable to an individual compiled at any stage of the process of enforcement of the criminal laws from arrest or indictment through release from supervision.

(b) Specific Exemptions. To qualify for a specific exemption, as defined by the Privacy Act of 1974 the system of records must be:

(1) Specifically authorized under criteria established under an Executive Order to be kept classified in the interest of national defense or foreign policy and are in fact properly classified pursuant to such Executive Order;

(2) Investigatory material compiled for law enforcement purposes, other than material covered under a general exemption; however, an individual shall not be denied access to information which has been used to deny him a right or privilege unless disclosure would reveal a confidential source. Components shall establish procedures governing the granting of confidentiality;

(3) Maintained in connection with providing protective service to the President of the United States or other individuals protected pursuant to 18 U.S.C. section 3056;

(4) Used only to generate aggregate data or for other similarly evaluative or analytic purposes and which are not used to make decisions on the rights, benefits, or entitlements of individuals except for the disclosure of a census record permitted by 13 U.S.C. section 8;

(5) Investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for Federal civilian employment, military service, Federal contracts, or access to classified information, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence, or prior to September 27, 1975, under an implied promise that the identity of the source would be held in confidence. Components shall establish procedures governing the granting of confidentiality;

(6) Testing or examination material used solely to determine individual qualifications for appointment or promotion in the Federal service the disclosure of which would compromise the objectivity

or fairness of the testing or examination process; or

(7) Evaluation material used to determine potential for promotion in the Armed Services, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence or prior to September 27, 1975, under an implied promise that the identity of the source would be held in confidence. DoD Components shall specify those categories of individuals for whom pledges of confidentiality may be made when obtaining information on an individual's suitability for promotion.

§ 286a.11 Systems of records.

(a) Contents. (1) Each DoD Component or element thereof shall maintain in its records systems only such personal information as is relevant and necessary to accomplish a purpose or mission required by statute or Executive Oder of the President.

(2) Components shall identify the specific provision of law, or Executive Order, which provides authority for the maintenance of information in each system of records.

(3) Statutory or regulatory authority to establish and maintain a system of records does not convey unlimited authority to collect and maintain all information which may be useful or convenient to have. The proponent of each system of records will evaluate each category of information in a system for both necessity and relevance. In performing this evaluation the following points will be considered:

(i) Relationship of each item of information to the statutory or regulatory purpose for which the system is maintained.

(ii) Specific adverse consequence of not collecting each category of information.

(iii) Possibility of meeting the information requirement through use of information not individually identifiable or through sampling techniques.

(iv) Length of time that the information is needed and, where appropriate, techniques for purging parts of the record.

(v) Financial cost of information maintenance compared to risk or adverse consequence of not maintaining it.

(vi) Necessity and relevance of this information to all individuals included in the system.

(4) Collection will be discontinued for each category or item of information which after the above evaluation does not appear to be reasonably justifiable. Moreover, such information will be withdrawn and destroyed provided it can be economically segregated from necessary and relevant information.

(5) The evaluation prescribed above will be performed by each proponent of a system of records:

(i) During the design phase of a new system of records or a change in an existing system of records.

(ii) Annually, prior to the republication of all system notices in the FEDERAL REGISTER.

(b) Publication of record system notices (1) General. The Privacy Act of 1974 requires that a notice of the existence of each system of records, be published in the FEDERAL REGISTER.

(2) Record system notices. DoD Components proposing new systems shall prepare system notices according to § 286a.12 at least 30 days before the proposed system change may be legally implemented. Initial system notices, will be submitted to the OASD(C).

(3) Change to existing systems requiring advanced public notice. (i) The following proposed changes to an existing system must be published in the FEDERAL REGISTER for public comment at least 30 days before the changes are implemented:

(A) Those which expand the categories of individuals on whom records are maintained.

(B) Those which add new categories of records to the system.

(C) Those which add new categories of sources.

(D) New or changed routine uses which involve disclosure to a new category of recipient.

(E) Changes in procedures governing

access.

(ii) Notices of proposed changes to existing systems will be submitted to OASD(C).

(4) Changes to existing systems not requiring advanced public notice. Changes in records systems not stated in subparagraph (3) of this paragraph, do not require advanced publication, but must be submitted for inclusion in the annual consolidated listing of records systems. Accordingly, each DoD

Component shall establish procedures to ensure that all such changes are forwarded for submission to OASD (C) by May 31 of each year for annual publication in the FEDERAL REGISTER.

(5) Reports concerning new and changed systems. Concurrently with subparagraphs (2) and (3) of this paragraph, OASD(C) shall provide the Office of Management and Budget and the Privacy Protection Study Commission advanced notice of proposals to establish new systems or to change routine uses of existing systems.

(6) DoD component issuances. Each DoD Component shall ensure that information contained in each system notice, as published in the FEDERAL REGISTER, is incorporated or otherwise published in DoD Component issuance (s) to ensure uniform system use and maintenance. DoD Components shall take immediate action to either publish a system notice, or discontinue, any system of records not contained in an internal issuance.

(c) Standards of accuracy. (1) Records used by a DoD Component in making determinations about an individual will be maintained with such accuracy, relevance, timeliness and completeness as is reasonably necessary to ensure fairness to the individual in any determination.

(2) Prior to disseminating any record about an individual to any person other than a Federal agency unless the dissemination is made pursuant to the Freedom of Information Act, reasonable efforts will be made to ensure that such records are accurate, complete, timely, and relevant for agency purposes.

(d) Restriction on maintenance of certain records. Maintenance of a system of records describing how individuals exercise rights guaranteed by the First Amendment are prohibited unless expressly authorized by Federal Statute or by the individual concerned, unless pertinent to and within the scope of an authorized law enforcement activity. The exercise of these rights includes, but is not limited to, religious and political beliefs, freedom of speech and the press, and the right of assembly and to petition.

(e) Rules of conduct. The head of each DoD Component shall assure that persons, including government contractors or their employees, involved in the design, development, operation, maintenance or contol of any system of records, as defined in S286a.6, are informed of all requirements to protect the privacy of the individuals who are subjects of