About the Office

DPCLO Guidance

Defense Privacy Board Advisory Opinions

DISCLOSURE OF RECORDS FROM SYSTEMS OF RECORDS TO A CONTRACTOR PURSUANT TO A CONTRACT

When an agency contracts for operation of a system of records to accomplish an agency function, the contract must cause the Privacy Act to apply to the system of records. Thus, the contractor and the contractor's employees will be considered to be employees of the agency and subject to the provisions of the Privacy Act. 5 U.S.C. § 552a(m).

The Office of Management and Budget Privacy Act Guidelines, 40 Fed. Reg. 28949, 28976 (July 9, 1975), state that the sole purpose of the contract might not be to operate a system of records, but the contract normally would provide that the contractor operate such a system as a specific requirement of the contract. If the contract can be performed only by operating a system of records, subsection (m) applies even though the contract does not provide expressly for operation of a system of records.

If the contract meets the requirements of subsection (m), the system of records operated by the contractor is deemed to be operated by the agency. Hence, disclosure of records to the contractor is authorized under 5 U.S.C. § 552a(b)(1) when the contract requires the contractor, explicitly or implicitly, to maintain a system of records to perform an agency function.