physically secure during nonbusiness hours to prevent unauthorized personnel from obtaining access to the records. Automated systems shall comply with the security standards promulgated by the National Bureau of Standards.

(ii) System managers, with the approval of the head of their offices within a component, shall adopt access restrictions to insure that only those individuals within the agency who have a need to have access to the records for the performance of their duties have access to them. Procedures shall also be adopted to prevent accidental access to, or dissemination of, records.

(e) Prohibition against maintenance of records concerning First Amendment rights. No component shall maintain a record describing how any individual exercises rights guaranteed by the First Amendment (e.g. speech), unless the maintenance of such record is:

or

(1) Expressly authorized by statute,

(2) Expressly authorized by the individual about whom the record is maintained, or

(3) Pertinent to and within the scope of an authorized law enforcement activity. (See 5 U.S.C. 552a (e)(7))

(f) Notification of disclosure under compulsory legal process. Subject to 5 U.S.C. 552a(j) and §1.23(c)(1), when records concerning an individual are subpoenaed by a Grand Jury, Court, or quasijudicial agency, or disclosed in accordance with an ex parte court order pursuant to 26 U.S.C. 6103(i), the official served with the subpoena or court order shall make reasonable efforts to assure that notice of any disclosure is provided to the individual. Notice shall be provided within five working days of making the records available under compulsory legal process or, in the case of a Grand Jury subpoena or an ex parte order, within five days of its becoming a matter of public record. Notice shall be mailed to the last known address of the individual and shall contain the following information: the date and authority to which the subpoena is, or was returnable, or the date of and court issuing the ex parte order, the name and number of the case or proceeding, and the nature of the information sought and provided. Notice of

the issuance of a subpoena or an ex parte order is not required if the system of records has been exempted from the notice requirement of 5 U.S.C. 552a (e)(8) and this section, pursuant to 5 U.S.C. 552a (j) and §1.23 (c)(1), by a Notice of Exemption published in the FEDERAL REGISTER. (See 5 U.S.C. 552a (e)(8)).

(g) Emergency disclosure. If information concerning an individual has been disclosed to any person under compelling circumstances affecting health or safety, the individual shall be notified at the last known address within 5 days of the disclosure (excluding Saturdays, Sundays, and legal public holidays). Notification shall include the following information: The nature of the information disclosed, the person or agency to whom it was disclosed, the date of disclosure, and the compelling circumstances justifying the disclosure. Notification shall be given by the officer who made or authorized the disclosure. (See 5 U.S.C. 552a (b)(8)).

§1.23 Publication in the Federal Register-Notices of systems of records, general exemptions, specific exemptions, review of all systems.

(a) Notices of systems of records to be published in the FEDERAL REGISTER. (1) The Department shall publish a notice of the existence and character of all systems of records every 3 years in the FEDERAL REGISTER. An annual notice of systems of records is required to be published by the Office of the Federal Register in the publication entitled "Privacy Act Issuances", as specified in 5 U.S.C. 552a(f).

(2) Minor changes to systems of records shall be published annually. (See paragraph (d)(8) of this section)

(3) In addition, the Department shall publish in the FEDERAL REGISTER upon establishment or revision a notice of the existence and character of any new or revised systems of records. Unless otherwise instructed, each notice shall include:

(i) The name and location of the system;

(ii) The categories of individuals on whom records are maintained in the system;

(iii) The categories of records maintained in the system;

(iv) Each routine use of the records contained in the system, including the categories of users and the purpose of such use;

(v) The policies and practices of the component regarding storage, retrievability, access controls, retention, and disposal of the records;

(vi) The title and business address of the Treasury official who is responsible for the system of records;

(vii) The procedures of the component whereby an individual can be notified if the system of records contain a record pertaining to the individual, including reasonable times, places, and identification requirements.

(viii) The procedures of the component whereby an individual can be notified on how to gain access to any record pertaining to such individual that may be contained in the system of records, and how to contest its content; and

(ix) The categories of sources of records in the system. (See 5 U.S.C. 552a(e)(4))

(b) Notice of new or modified routine uses to be published in the FEDERAL REGISTER. At least 30 days prior to a new use or modification of a routine use, as published under paragraph (a)(3)(iv) of this section, each component shall publish in the FEDERAL REGISTER notice of such new or modified use of the information in the system and provide an opportunity for interested persons to submit written data, views, or arguments to the components. (See 5 U.S.C. 552a(e)(11))

(c) Promulgation of rules exempting systems from certain requirements—(1) General exemptions. In accordance with existing procedures applicable to a Treasury component's issuance of regulations, the head of each such component may adopt rules, in accordance with the requirements (including general notice) of 5 U.S.C. 553 (b) (1), (2), and (3), (c) and (e), to exempt any system of records within the component from any part of 5 U.S.C. 552a and these regulations except subsections (b) (sec. 1.24, conditions of disclosure), (c)(1) (sec. 1.25, keep accurate accounting of disclosures), (c)(2) (sec. 1.25, retain accounting for five years or life of record), (e)(4) (A) through (F) (paragraph (a) of this section, publication of

annual notice of systems of records), (e) (6) (sec. 1.22(d), accuracy of records prior to dissemination), (e)(7) (sec. 1.22(e), maintenance of records on First Amendment rights), (e)(9) (sec. 1.28, establish rules of conduct), (e)(10) (sec. 1.22(d)(3), establish safeguards for records), (e)(11) (paragraph (c) of this section, publish new intended use), and (i) (sec. 1.28(c), criminal penalties) if the systems of records maintained by the component which performs as its principal function any activity pertaining to the enforcement of criminal laws, including police efforts to prevent, control, or reduce crime or to apprehend criminals, and the activities of prosecutors, courts, correctional, probation, pardon, or parole authorities, and which consists of:

(i) Information compiled for the purpose of identifying individual criminal offenders and alleged offenders and consisting only of identifying data and notations of arrests, the nature and disposition of criminal charges, sentencing, confinement, release, and parole, and probation status;

(ii) Information compiled for the purpose of a criminal investigation, including reports of informants and investigators, and associated with an identifiable individual; or

(iii) Reports identifiable to an individual compiled at any stage of the process of enforcement of the criminal laws from arrest or indictment through release from supervision. (See 5 U.S.C. 552a(j))

(2) Specific exemptions. In accordance with existing procedures applicable to a Treasury component's issuance of regulations, the head of each such component may adopt rules, in accordance with the requirements (including general notice) of 5 U.S.C. 553 (b) (1), (2), and (3), (c), and (e), to exempt any system of records within the component from 5 U.S.C. 552a(c)(3) (sec. 1.25(c)(2), accounting of certain disclosures available to the individual), (d) (sec. 1.26(a), access to records), (e)(1) (sec. 1.22(a)(1), maintenance of information to accomplish purposes authorized by statute or executive order only), (e)(4)(G) (paragraph (a)(7) of this section, publication of procedures for notification), (e)(4)(H)

(paragraph (a)(8) of this section, publication of procedures for access and contest), (e)(4)(I) (paragraph (a)(9) of this section, publication of Sources of records), and (f) (sec. 1.26, promulgate rules for notification, access and contest), if the system of records is:

(i) Subject to the provisions of 5 U.S.C. 552(b)(1);

(ii) Investigatory material compiled for law enforcement purposes, other than material within the scope of subsection (j)(2) of 5 U.S.C. 552a and paragraph (a)(1) of this section. If any individual is denied any right, privilege, or benefit that such individual would otherwise be entitled to by Federal law, or for which such individual would otherwise be eligible, as a result of the maintenance of this material, such material shall be provided to the individual, except to the extent that the disclosure of the material would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence, or prior to September 27, 1975, under an implied promise that the identity of the source would be held in confidence;

(iii) Maintained in connection with providing protective services to the President of the United States or other individuals pursuant to 18 U.S.C. 3056;

(iv) Required by statute to be maintained and used solely as statistical records;

(v) Investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for Federal civilian employment, military service, Federal contracts, or access to classified information, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence, or, prior to September 27, 1975, under an implied promise that the identity of the source would be held in confidence;

(vi) Testing or examination material used solely to determine individual qualifications for appointment or promotion in the Federal service the disclosure of which would compromise the objectivity or fairness of the testing or examination process; or

(vii) Evaluation material used to determine potential for promotion in the armed services, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence, or, prior to September 27, 1975, under an implied promise that the identity of the source would be held in confidence.

(3) At the time that rules under this subsection are adopted, the head of the component shall include in the statement required under 5 U.S.C. 553(c) the reasons why the system of records is to be exempted from a provision of 5 U.S.C. 552a and this part. (See 5 U.S.C. 552a (j) and (k))

(d) Review and report to OMB. The Department shall ensure that the following reviews are conducted as often as specified below by each of the components who shall be prepared to report to the Departmental Disclosure Branch upon request the results of such reviews and any corrective action taken to resolve problems uncovered. Each component shall:

(1) Review every two years a random sample of the component's contracts that provide for the maintenance of a system of records on behalf of the component to accomplish a function of the component, in order to ensure that the working of each contract makes the provisions of the Act apply. (5 U.S.C. 552a(m)(1))

(2) Review annually component's recordkeeping and disposal policies and practices in order to assure compliance with the Act.

(3) Review routine use disclosures every 3 years, that are associated with each system of records in order to ensure that the recipient's use of such records continues to be compatible with the purpose for which the disclosing agency originally collected the information.

(4) Review every three years each system of records for which the component has issued exemption rules pursuant to section (j) or (k) of the Privacy Act in order to determine whether the exemption is needed.

(5) Review annually each ongoing matching program in which the component has participated during the year, either as a source or as a matching agency in order to assure that the requirements of the Act, the OMB Matching Guidelines, and the OMB Model Control System and checklist have been met.

(6) Review component's training practices annually to ensure that all component personnel are familiar with the requirements of the Act, these regulations and Departmental directives.

(7) Review annually the actions of component personnel that have resulted either in the agency being found civilly liable under section (g) of the Act, or an employee being found criminally liable under the provisions of section (i) of the Act, in order to determine the extent of the problem and to prevent future recurrences.

(8) Review annually each system of records notice to ensure that it accurately describes the system. Where minor changes are needed, publish an amended notice in the FEDERAL REGISTER. Minor changes shall be consolidated in one annual comprehensive publication. The term "minor change to a system of records" means a change that does not significantly change the system. More specifically, a minor change does not affect the character or purpose of the system and does not affect the ability of an individual to gain access to a record about the individual or to any information pertaining to such individual which is contained in the system; for example, changing the title of the system manager or the location of the system.

§1.24 Disclosure of records to person other than the individual to whom they pertain.

(a) Conditions of disclosure. No component of Treasury shall disclose any record which is contained in a system of records maintained by it by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, or the parent, if a minor, or legal guardian, if incompetent, of such individual,

unless disclosure of the record would be:

(1) To those offices and employees of the Department of the Treasury who have a need for the record in the performance of their duties;

(2) Retired under 5 U.S.C. 552 (subpart A of this part);

(3) For a routine use as defined in 5 U.S.C. 552a(a)(7) and §1.21(g) and as described under 5 U.S.C. 552a(e)(4)(D) and §1.23(a)(4);

(4) To the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of title 13 of the U.S. Code;

(5) To a recipient who has provided the component with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable;

(6) To the National Archives of the United States as a record which has sufficient historical or other value to warrant its continued preservation by the United States Government, or for evaluation by the Administrator of General Services or the designee of such official to determine whether the record has such value;

(7) To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity.

(i) If the activity is authorized by law; and

(ii) If the head of the agency or instrumentality has made a written request to the Department of the Treasury specifying the particular portion desired and the law enforcement activities for which the record is sought;

(8) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual, if upon such disclosure, notification is transmitted to the last known address of such individual;

(9) To either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee.

(10) To the Comptroller General, or the authorized representatives of such official, in the course of the performance of the duties of the General Accounting Office; or

(11) Pursuant to the order of a court of competent jurisdiction. (See 5 U.S.C. 552a(b))

§ 1.25 Accounting of disclosures.

(a) Accounting of certain disclosures. Each component, with respect to each system of records under its control, shall:

(1) Keep an accurate accounting of: (i) The date, nature, and purpose of each disclosure of a record to any person or to an agency made under 5 U.S.C. 552a (b) and §1.24; and (ii) the name and address of the person or agency to whom the disclosure is made;

(2) Retain the accounting made under paragraph (a)(1) of this section for at least five years or the life of the record, whichever is longer, after the disclosure for which the accounting is made; and

(3) Inform any person or other agency about any correction or notation of dispute made by the constitutent unit in accordance with 5 U.S.C. 552a (d) and §1.28 of any record that has been disclosed to the person or agency if an accounting of the disclosure was made. (See 5 U.S.C. 552(c).)

(b) Accounting systems. To permit the accounting required by paragraph (a) of this section, system managers, with the approval of the head of their offices within a component, shall establish or implement, a system of accounting for all disclosures of records, either orally or in writing, made outside the Department of the Treasury. Accounting records shall:

(1) Be established in the least expensive and most convenient form that will permit the system manager to advise individuals, promptly upon quest, what records concerning them have been disclosed and to whom:

re

(2) Provide, as a minimum, the identification of the particular record disclosed, the name and address of the person or agency to whom or to whom or to which disclosed, and the date, nature and purpose of the disclosure; and

(3) Be maintained for 5 years or until the record is destroyed or transferred

to the National Archives and Records Service for storage in records centers, in which event, the accounting pertaining to those records, unless maintained separately, shall be transferred with the records themselves.

(c) Exemptions from accounting requirements. No accounting is required for disclosure of records:

(1) To those officers and employees of the Department of the Treasury who have a need for the record in the performance of their duties; or

(2) If disclosure would be required under 5 U.S.C. 552 and Subpart A of this part.

(d) Access to accounting by individual. (1) Subject to paragraphs (c) and (d)(2) of this section, each component shall establish and set forth in the appendix to this subpart applicable to the component, procedures for making the accounting required under paragraph (a) of this section available to the individual to whom the record pertains and shall thereafter make such accounting available in accordance therewith at the request of the individual. The procedures may require the requester to provide reasonable identification.

(2) Access accountings of disclosure may be withheld from the individual named in the record only if the disclosures were (i) made under 5 U.S.C. 552a (b)(7) and §1.24 (a)(7), or (ii) under a system of records exempted from the requirements of 5 U.S.C. 552a(c)(3) in accordance with 5 U.S.C. 552 (j) or (k) and §1.23(c). (See 5 U.S.C. 552a(c)) $1.26 Procedures for notification and

access to records pertaining to individuals-format and fees for request for access.

(a) Procedures for notification and access. Each component shall establish, in accordance with the requirements of 5 U.S.C. 553, and set forth in the appendix to this subpart applicable to such component procedures whereby an individual can be notified, in response to a request, if any system of records named by the individual contains a record pertaining to that individual. In addition, such procedures shall set forth the requirements for access to such records. As a minimum such procedures shall specify the times during, and the places at which access will be