§310.21 Conditions of disclosure.
(a) Disclosures to third parties.
(1) The Privacy Act only compels disclosure of records from a system of records to the individuals to whom they pertain unless the records are contained in a system for which an exemption to the access provisions of this part has been claimed.
(2) Requests by other individuals (third parties) for the records of individuals that are contained in a system of records shall be processed under 32 CFR part 286 except for requests by the parents of a minor or the legal guardian of an individual for access to the records pertaining to the minor or individual.
(b) Disclosures among the DoD Components. For the purposes of disclosure and disclosure accounting, the Department of Defense is considered a single agency (see §310.22(a)).
(c) Disclosures outside the Department of Defense. Do not disclose personal information from a system of records outside the Department of Defense unless:
(1) The record has been requested by the individual to whom it pertains.
(2) The written consent of the individual to whom the record pertains has been obtained for release of the record to the requesting Agency, activity, or individual; or
(3) The release is authorized pursuant to one of the specific non-consensual conditions of disclosure as set forth in §310.22.
(d) Validation before disclosure. Except for releases made in accordance with 32 CFR part 286, the following steps shall be taken before disclosing any records to any recipient outside the Department of Defense, other than a Federal agency or the individual to whom it pertains:
(1) Ensure the records are accurate, timely, complete, and relevant for agency purposes;
(2) Contact the individual, if reasonably available, to verify the accuracy, timeliness, completeness, and relevancy of the information, if this cannot be determined from the record; or
(3) If the information is not current and the individual is not reasonably available, advise the recipient that the information is believed accurate as of a specific date and any other known factors bearing on its accuracy and relevancy.
Back to Top
§310.22 Non-consensual conditions of disclosure.
(a) Disclosures within the Department of Defense. (1) Records pertaining to an individual may be disclosed to a DoD official or employee provided:
(i) The requester has a need for the record in the performance of his or her assigned duties. The requester shall articulate in sufficient detail why the records are required so the custodian of the records may make an informed decision regarding their release;
(ii) The intended use of the record generally relates to the purpose for which the record is maintained; and
(iii) Only those records as are minimally required to accomplish the intended use are disclosed. The entire record is not released if only a part of the record will be responsive to the request.
(2) Rank, position, or title alone does not authorize access to personal information about others.
(b) Disclosures required by the FOIA. (1) All records must be disclosed if their release is required by FOIA (5 U.S.C. 552), as implemented by 32 CFR part 286. The FOIA requires records be made available to the public unless withholding is authorized pursuant to one of nine exemptions or one of three law enforcement exclusions under the Act.
(i) The DoD Component must be in receipt of a FOIA request and a determination made that the records are not withholdable pursuant to a FOIA exemption or exclusion before the records may be disclosed.
(ii) Records that have traditionally been released to the public by the Components may be disclosed whether or not a FOIA request has been received.
(2) The standard for exempting most personal records, such as personnel, medical, and similar records, is FOIA Exemption 6 (32 CFR part 286.12(e)). Under that exemption, records can be withheld when disclosure, if other than to the individual about whom the information pertains, would result in a clearly unwarranted invasion of the individual's personal privacy.
(3) The standard for exempting personal records compiled for law enforcement purposes, including personnel security investigation records, is FOIA Exemption 7(C) (32 CFR part 286.12(g)). Under that exemption, records can be withheld when disclosure, if other than to the individual about whom the information pertains, would result in an unwarranted invasion of the individual's personal privacy.
(4) If records or information are exempt from disclosure pursuant to the standards set forth in paragraphs (b)(2) and/or (b)(3) of this section, and the records are contained in a system of records (See §310.10(a) of subpart B, the Privacy Act (5 U.S.C. 552a) prohibits release.
(5) Personal information that is normally releasable—(i) DoD civilian employees. (A) Some examples of personal information regarding DoD civilian employees that normally may be released without a clearly unwarranted invasion of personal privacy include:
(1) Name.
(2) Present and past position titles.
(3) Present and past grades.
(4) Present and past annual salary rates.
(5) Present and past duty stations.
(6) Office and duty telephone numbers.
(7) Position descriptions.
(B) All disclosures of personal information regarding Federal civilian employees shall be made in accordance with OPM release policies (see 5 CFR part 293.311).
(ii) Military members. (A) While it is not possible to identify categorically information that must be released or withheld from military personnel records in every instance, the following items of personal information regarding military members normally may be disclosed without a clearly unwarranted invasion of their personal privacy:
(1) Full name.
(2) Rank.
(3) Date of rank.
(4) Gross salary.
(5) Past duty assignments.
(6) Present duty assignment.
(7) Future assignments that are officially established.
(8) Office or duty telephone numbers.
(9) Source of commission.
(10) Promotion sequence number.
(11) Awards and decorations.
(12) Attendance at professional military schools.
(13) Duty status at any given time.
(14) Home of record (identification of the state only).
(15) Length of military service.
(16) Basic Pay Entry Date.
(17) Official Photo.
(B) All disclosures of personal information regarding military members shall be made in accordance with 32 CFR part 286.
(iii) Civilian employees not under the authority of OPM. (A) While it is not possible to identify categorically those items of personal information that must be released regarding civilian employees not subject to 5 CFR parts 293, 294, and 297, such as nonappropriated fund employees, normally the following items may be released without a clearly unwarranted invasion of personal privacy:
(1) Full name.
(2) Grade or position.
(3) Date of grade.
(4) Gross salary.
(5) Present and past assignments.
(6) Future assignments, if officially established.
(7) Office or duty telephone numbers.
(B) All releases of personal information regarding civilian personnel in this category shall be made in accordance with 32 CFR part 286.
(6) When military or civilian personnel are assigned, detailed, or employed by the National Security Agency, the Defense Intelligence Agency, the National Reconnaissance Office, or the National Geospatial-Intelligence agency, information about such personnel may only be disclosed as authorized by Public Law 86-36 (“National Security Agency-Officers and Employees”) and 10 U.S.C 424 (“Disclosure of Organizational and Personnel Information: Exemption for Specified Intelligence Agencies”). When military and civilian personnel are assigned, detailed or employed by an overseas unit, a sensitive unit, or to a routinely deployable unit, information about such personnel may only be disclosed as authorized by 10 U.S.C. 130b (“Personnel in Overseas, Sensitive, or Routinely Deployed Units: Nondisclosure of Personally Identifying Information”).
(7) Information about military or civilian personnel that otherwise may be disclosable consistent with §310.22(b)(5) may not be releasable if a requester seeks listings of personnel currently or recently assigned/detailed/employed within a particular component, unit, organization or office with the Department of Defense if the disclosure of such a list would pose a privacy or security threat.
(c) Disclosures for established routine uses. (1) Records may be disclosed outside the Department of Defense pursuant to a routine use that has been established for the system of records that contains the records.
(2) A routine use shall:
(i) Be compatible with the purpose for which the record was collected;
(ii) Identify the persons or organizations to whom the record may be released;
(iii) Identify specifically the intended uses of the information by the persons or organization; and
(iv) Have been published in the Federal Register (see §310.32(i)).
(3) If a Federal statute or an E.O. of the President directs records contained in a system of records be disclosed outside the Department of Defense, the statute or E.O. serves as authority for the establishment of a routine use.
(4) New or altered routine uses must be published in the Federal Register at least 30 days before any records may be disclosed pursuant to the terms of the routine use (see subpart G of this part).
(5) In addition to the specific routine uses established for each of the individual system notices, blanket routine uses have been established (see appendix 3) that are applicable to all DoD system of records. However, in order for the blanket routine uses to apply to a specific system of records, the system notice shall expressly state that the blanket routine uses apply. These blanket routine uses are published only at the beginning of the listing of system notices for each Component in the Federal Register.
(d) Disclosures to the Bureau of the Census. Records in DoD systems of records may be disclosed without the consent of the individuals to whom they pertain to the Bureau of the Census for purposes of planning or carrying out a census survey or related activities pursuant to the provisions of 13 U.S.C. 6 (“Information from other Federal Departments and Agencies”).
(e) Disclosures for statistical research or reporting. (1) Records may be disclosed for statistical research or reporting but only after the intended recipient provides, in writing, the purpose for which the records are sought and assurances that the records will be used only for statistical research or reporting purposes.
(2) The records shall be transferred to the requester in a form that is not individually identifiable. DoD Components disclosing records under this provision are required to assure information being disclosed cannot reasonably be used in any way to make determinations about individuals.
(3) The records will not be used, in whole or in part, to make any determination about the rights, benefits, or entitlements of specific individuals.
(4) The written statement by the requester shall be made part of the Component's accounting of disclosures (See paragraph (a) of 310.25).
(f) Disclosures to the National Archives and Records Administration (NARA), General Services Administration (GSA). (1) Records may be disclosed to the NARA if they:
(i) Have historical or other value to warrant continued preservation; or
(ii) For evaluation by the Archivist of the United States, or his or her designee, to determine if a record has such historical or other value.
(2) Records transferred to a Federal Records Center (FRC) for safekeeping and storage do not fall within this category. These records are owned by the Component and remain under the control of the transferring Component. FRC personnel are considered agents of the Component that retains control over the records. No disclosure accounting is required for the transfer of records to the FRCs.
(g) Disclosures for law enforcement purposes. (1) Records may be disclosed to another Agency or an instrumentality of any Governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity, provided:
(i) The civil or criminal law enforcement activity is authorized by law;
(ii) The head of the law enforcement activity or a designee has made a written request specifying the particular records desired and the law enforcement purpose (such as criminal investigations, enforcement of a civil law, or a similar purpose) for which the record is sought; and
(iii) There is no Federal statute that prohibits the disclosure of the records.
(2) Blanket requests for any and all records pertaining to an individual shall not be honored absent justification.
(3) When a record is released to a law enforcement activity under this subparagraph, the disclosure accounting (see §310.25) for the release shall not be made available to the individual to whom the record pertains if the law enforcement activity requests that the disclosure not be disclosed.
(4) The blanket routine use for law enforcement (appendix C, section A) applies to all DoD Component systems notices (see paragraph (b)(6) of this section). This permits Components, on their own initiative, to report indications of violations of law found in a system of records to a law enforcement activity.
(5) Disclosures may be made to Federal, State, or local, but not foreign law enforcement agencies. Disclosures to Foreign law enforcement agencies may be made if a routine use has been established for the system of records from which the records are to be released.
(h) Emergency disclosures. (1) Records may be disclosed if disclosure is made under compelling circumstances affecting the health or safety of any individual. The affected individual need not be the subject of the record disclosed.
(2) When such a disclosure is made, the Component shall notify the individual who is the subject of the record. Notification sent to the last known address of the individual as known to the Component is sufficient.
(3) The specific data to be disclosed is at the discretion of the Component.
(4) Emergency medical information may be released by telephone.
(i) Disclosures to Congress. (1) Records may be disclosed to either House of the Congress or to any committee, joint committee or subcommittee of Congress if the release pertains to a matter within the jurisdiction of the committee. Disclosure is only authorized when in response to an official request on behalf of either House, committee, subcommittee, or joint committee.
(2) Requests from members of Congress who are seeking records in their individual capacity or on behalf of a constituent.
(i) Requests made in their individual capacity. Request for records shall be processed under the provisions of DoD 5400.7-R.
(ii) Requests made on behalf of constituents.
(A) The blanket routine use for “Congressional Inquiries” (see appendix C, section D) applies to all systems. When an individual requests the assistance of the Congressional member, the blanket routine use permits the disclosure of records pertaining to the individual without the express written consent of the individual.
(B) If necessary, accept constituent letters requesting a member of Congress to investigate a matter pertaining to the individual as written authorization to provide access to the records to the congressional member or his or her staff.
(C) When a Congressional inquiry indicates that the request is being made on the basis of a request from the individual to whom the record pertains, consent can be inferred even if the constituent request is not provided the Component. The verbal statement by a Congressional staff member is acceptable to establish that a request has been received by the Member of Congress from the person to whom the records pertain.
(D) If the constituent inquiry is being made on behalf of someone other than the individual to whom the record pertains, the Member of Congress shall be provided only that information releasable under DoD 5400.7-R. Advise the Congressional member that the written consent of the individual to whom the record pertains is required before any additional information may be disclosed. Do not contact individuals to obtain their consents for release to Congressional members unless a Congressional office specifically requests that this be done.
(E) Nothing in paragraph (i)(2)(ii)(A) of this section prohibits a Component, when appropriate, from providing the record directly to the individual and notifying the Congressional office that this has been done without providing the record to the Congressional member.
(3) See paragraph (e) of §310.20 for the policy on assessing fees for Members of Congress.
(4) Make a disclosure accounting each time a record is disclosed to either House of Congress, to any committee, joint committee, or subcommittee of Congress, or to any congressional member.
(j) Disclosures to the General Accountability Office. Records may be disclosed to the Comptroller General, or any of his authorized representatives, in the course of the performance of the duties of the General Accountability Office.
(k) Disclosures under court orders. (1) Records may be disclosed without the consent of the person to whom they pertain under a court order signed by a judge of a court of competent jurisdiction.
(2) When a record is disclosed under this provision, make reasonable efforts to notify the individual to whom the record pertains, if the legal process is a matter of public record.
(3) If the process is not a matter of public record at the time it is issued, seek information as to when the process is to be made public and make reasonable efforts to notify the individual at that time.
(4) Notification sent to the last known address of the individual as reflected in the records is considered a reasonable effort to notify.
(5) Make a disclosure accounting each time a record is disclosed under a court order or compulsory legal process.
(l) Disclosures to consumer reporting agencies. (1) Certain personal information may be disclosed to consumer reporting agencies as provided in the Federal Claims Collection Act (31 U.S.C. 3711(e)).
(2) Under the provisions of paragraph (l)(1) of this section, the following information may be disclosed to a consumer reporting agency:
(i) Name, address, taxpayer identification number (SSN), and other information necessary to establish the identity of the individual.
(ii) The amount, status, and history of the claim.
(iii) The Agency or program under which the claim arose.
(3) The Federal Claims Collection Act (31 U.S.C. 3711(e)) requires the system notice for the system of records from which the information will be disclosed, indicates that the information may be disclosed to a consumer reporting agency.
Back to Top
§310.23 Disclosures to commercial enterprises.
(a) General policy.
(1) Make releases of personal information to commercial enterprises under the criteria established by 32 CFR part 286.
(2) The relationship of commercial enterprises to their clients or customers and to the Department of Defense is not changed by this part.
(3) The DoD policy on personal indebtedness for military personnel is contained 32 CFR part 112, “Indebtedness of Military Personnel,” and for civilian employees in 5 CFR part 735.
(b) Release of personal information. (1) Any information that must be released under 32 CFR part 286, the “DoD Freedom of Information Act Program,” may be released to a commercial enterprise without the individual's consent (see paragraph (b) of §310.22).
(2) Commercial enterprises may present a signed consent statement setting forth specific conditions for release of personal information. Statements such as the following, if signed by the individual, are considered valid:
I hereby authorize the Department of Defense to verify my Social Security Number or other identifying information and to disclose my home address and telephone number to authorized representatives of (name of commercial enterprise) so that they may use this information in connection with my commercial dealings with that enterprise. All information furnished shall be used in connection with my financial relationship with (name of commercial enterprise).
(3) When a statement of consent as outlined in paragraph (b)(2) of this section is presented, provide the requested information if its release is not prohibited by some other regulation or statute.
(4) Blanket statements of consent that do not identify the Department of Defense or any of its Components, or that do not specify exactly the type of information to be released, may be honored if it is clear the individual in signing the consent statement intended to obtain a personal benefit (for example, a loan to buy a house) and was aware of the type of information that would be sought. Care should be exercised in these situations to release only the minimum amount of personal information essential to obtain the benefit sought.
(5) Do not honor requests from commercial enterprises for official evaluation of personal characteristics, such as evaluation of personal financial habits.
Back to Top
§310.24 Disclosures to the public from medical records.
(a) Disclosures from medical records are not only governed by the requirement of this part but also by the disclosure provisions of DoD 6025.18-R.”
(b) Any medical records that are subject to both this part and DoD 6025.18-R may only be disclosed if disclosure is authorized under both. If disclosure is permitted under this part (e.g., pursuant to a routine use), but the disclosure is not authorized under DoD 6025.18-R, disclosure is not authorized. If a disclosure is authorized under DoD 6025.18-R (e.g., releases outside the Department of Defense), but the disclosure is not authorized under this part, disclosure is not authorized.
Back to Top
§310.25 Disclosure accounting.
(a) Disclosure accountings. (1) Keep an accurate record of all disclosures made from any system of records except disclosures:
(i) To DoD personnel for use in the performance of their official duties; or
(ii) Under 5 U.S.C. 552, the FOIA.
(2) In all other cases a disclosure accounting is required even if the individual has consented to the disclosure of the information.
(3) Disclosure accountings:
(i) Permit individuals to determine to whom information has been disclosed;
(ii) Enable the activity to notify past recipients of disputed or corrected information (§310.19(i)); and
(iii) Provide a method of determining compliance with paragraph (c) of §310.21.
(b) Contents of disclosure accountings. As a minimum, disclosure accounting shall contain:
(1) The date of the disclosure.
(2) A description of the information released.
(3) The purpose of the disclosure.
(4) The name and address of the person or Agency to whom the disclosure was made.
(c) Methods of disclosure accounting. Use any system of disclosure accounting that shall provide readily the necessary disclosure information (see paragraph (a)(3) of this section).
(d) Accounting for mass disclosures. When numerous similar records are released, identify the category of records disclosed and include the data required by paragraph (b) of this section in a form that can be used to construct an accounting disclosure record for individual records if required (see paragraph (a)(3) of this section).
(e) Disposition of disclosure accounting records. Retain disclosure accounting records for 5 years after the disclosure or the life of the record, whichever is longer.
(f) Furnishing disclosure accountings to the individual. (1) Make available to the individual to whom the record pertains all disclosure accountings except when:
(i) The disclosure has been made to a law enforcement activity under paragraph (g) of §310.22 and the law enforcement activity has requested that disclosure not be made; or
(ii) The system of records has been exempted from the requirement to furnish the disclosure accounting under the provisions of §310.26(b).
(2) If disclosure accountings are not maintained with the record and the individual requests access to the accounting, prepare a listing of all disclosures (see paragraph (b) of this section) and provide this to the individual upon request.
Back to Top