32 C.F.R. Subpart E—Disclosure of Personal Information to Other Agencies and Third Parties
Title 32 - National Defense
(a) Disclosures to third parties. (1) The Privacy Act only compels disclosure of records from a system of records to the individuals to whom they pertain. (2) All requests by individual for personal information about other individuals (third parties) shall be processed under the DoD Freedom of Information Program (32 CFR part 286), except for requests by the parents of a minor, or legal guardians of an individual, for access to the records pertaining to the minor or individual. (b) Disclosures among DoD Components. For the purposes of disclosure and disclosure accounting, the Department of Defense is considered a single agency (see §310.41(a)). (c) Disclosures outside the Department of Defense. Do not disclose personal information from a system of records outside the Department of Defense unless: (1) The record has been requested by the individual to whom it pertains. (2) The written consent of the individual to whom the record pertains has been obtained for release of the record to the requesting agency, activity, or individual, or (3) The release is for one of the specific nonconsensual purposes set forth in §310.41 of this part. (d) Validation before disclosure. Except for releases made in accordance with the Freedom of Information Act (5 U.S.C. 552), before disclosing any personal information to any recipient outside the Department of Defense other than a federal agency or the individual to whom it pertains: (1) Ensure that the records are accurate, timely, complete, and relevant for agency purposes; (2) Contact the individual, if reasonably available, to verify the accuracy, timeliness, completeness, and relevancy of the information, if the cannot be determined from the record; or (3) If the information is not current and the individual is not reasonably available, advise the recipient that the information is believed accurate as of a specific date and any other known factors bearing on its accuracy and relevancy. [51 FR 2364, Jan. 16, 1986. Redesignated at 56 FR 55631, Oct. 29, 1991, as amended at 56 FR 57800, Nov. 14, 1991] (a) Disclosures within the Department of Defense. (1) Records pertaining to an individual may be disclosed without the consent of the individual to any DoD official who has need for the record in the performance of his or her assigned duties. (2) Rank, position, or title alone do not authorize access to personal information about others. An official need for the information must exist before disclosure. (b) Disclosures under the Freedom of Information Act. (1) All records must be disclosed if their release is required by the Freedom of Information Act (5 U.S.C 552) see also the DoD Freedom of Information Program (32 CFR part 286). The Freedom of Information Act requires that records be made available to the public unless exempted from disclosure by one of the nine exemptions found in the Act. It follows, therefore, that if a record is not exempt from disclosure it must be disclosed. (2) The standard for exempting most personal records, such as personnel records, medical records, and similar records, is found in Exemption Number 6 of 32 CFR 286.31. Under that exemption, release of personal information can only be denied when its release would be a “clearly unwarranted invasion of personal privacy.” (3) Release of personal information in investigatory records including personnel security investigation records is controlled by the broader standard of an “unwarranted invasion of personal privacy” found in Exemption Number 7 of 32 CFR 286.31. This broader standard applies only to investigatory records. (4) See 32 CFR part 286 for the standards to use in applying these exemptions. (c) Personal information that is normally releasable—(1) DoD civilian employees. (i) Some examples of personal information regarding DoD civilian employees that normally may be released without a clearly unwarranted invasion of personal privacy include: (A) Name. (B) Present and past postion titles. (C) Present and past grades. (D) Present and past salaries. (E) Present and past duty stations. (F) Office or duty telephone numbers. (ii) All disclosures of personal information regarding federal civilian employees shall be made in accordance with the Federal Personnel Manual (FPM) 5 CFR parts 293, 294, 297 and 735. (2) Military members. (i) While it is not possible to identify categorically information that must be released or withheld from military personnel records in every instance, the following items of personal information regarding military members normally may be disclosed without a clearly unwarranted invasion of their personal privacy: (A) Full name. (B) Rank. (C) Date of rank. (D) Gross salary. (E) Past duty assignments. (F) Present duty assignment. (G) Future assignments that are officially established. (H) Office of duty telephone numbers. (I) Source of commission. (J) Promotion sequence number. (K) Awards and decorations. (L) Attendance at professional military schools. (M) Duty status at any given time. (ii) All releases of personal information regarding military members shall be made in accordance with the standards established by 32 CFR part 286. (3) Civilian employees not under the FPM. (i) While it is not possible to identify categorically those items of personal information that must be released regarding civilian employees not subject to the Federal Personnel Manual (5 CFR parts 293, 294, 297 and 735), such as nonappropriated fund employees, normally the following items may be released without a clearly unwarranted invasion of personal privacy: (A) Full name. (B) Grade or position. (C) Date of grade. (D) Gross salary. (E) Present and past assignments. (F) Future assignments, if officially established. (G) Office or duty telephone numbers. (ii) All releases of personal information regarding civilian personnel in this category shall be made in accordance with the standards established by 32 CFR part 286, the DoD Freedom of Information Program. (d) Release of home addresses and home telephone numbers. (1) The release of home addresses and home telephone numbers normally is considered a clearly unwarranted invasion of personal privacy and is prohibited. However, these may be released without prior specific consent of the individual if: (i) The individual has indicated previously that he or she interposes no objection to their release (see paragraphs (d)(3) and (4) of this section); (ii) The source of the information to be released is a public document such as commercial telephone directory or other public listing; (iii) The release is required by federal statute (for example, pursuant to federally-funded state programs to locate parents who have defaulted on child support payments (42 U.S.C. 653); or (iv) The releasing official releases the information under the provisions of the DoD Freedom of Information Act Program (32 CFR part 286). (2) A request for a home address or telephone number may be referred to the last known address of the individual for a direct reply by him or her to the requester. In such cases the requester shall be notified of the referral. (3) When collecting lists of home addresses and telephone numbers, the individual may be offered the option of authorizing the information pertaining to him or her to be disseminated without further permission for specific purposes, such as locator services. In these cases, the information may be disseminated for the stated purpose without further consent. However, if the information is to be disseminated for any other purpose, a new consent is required. Normally such consent for release is in writing and signed by the individual. (4) Before listing home addresses and home telephone numbers in DoD telephone directories, give the individuals the opportunity to refuse such a listing. Excuse the individual from paying any additional cost that may be associated with maintaining an unlisted number for government-owned telephone services if the individual requests his or her number not be listed in the directory under this part. (5) Do not sell or rent lists of individual names and addresses unless such action is specifically authorized. (e) Disclosures for established routine uses. (1) Records may be disclosed outside the Department of Defense without consent of the individual to whom they pertain for an established routine use. (2) A routine use shall: (i) Be compatible with and related to the purpose for which the record was compiled; (ii) Identify the persons or organizations to whom the record may be released; (iii) Identify specifically the uses to which the information may be put by the receiving agency; and (iv) Have been published previously in the (3) Establish a routine use for each user of the information outside the Department of Defense who need official access to the records. (4) Routine uses may be established, discontinued, or amended without the consent of the individuals involved. However, new or changed routine uses must be published in the (5) In addition to the routine uses established by the individual system notices, common blanket routine uses for all DoD-maintained systems of records have been established (see appendix C). These blanket routine uses are published only at the beginning of the listing of system notices for each Component in the (6) If the recipient has not been identified in the (f) Disclosures to the Bureau of the Census. Records in DoD systems of records may be disclosed without the consent of the individuals to whom they pertain to the Bureau of the Census for purposes of planning or carrying out a census survey or related activities pursuant to the provisions of 13 U.S.C. 8. (g) Disclosures for statistical research and reporting. (1) Records may be disclosed for statistical research and reporting without the consent of the individuals to whom they pertain. Before such disclosures the recipient must provide advance written assurance that: (i) The records will be used as statistical research or reporting records; (ii) The records will only be transferred in a form that is not individually identifiable; and (iii) The records will not be used, in whole or in part, to make any determination about the rights, benefits, or entitlements of specific individuals. (2) A disclosure accounting (see paragraph (a) of §310.44) is not required when information that is not identifiable individually is released for statistical research or reporting. (h) Disclosures to the National Archives and Records Administration (NARA). (1) Records may be disclosed without the consent of the individual to whom they pertain to the NARA if they: (i) Have historical or other value to warrant continued preservation; or (ii) For evaluation by the NARA to determine if a record has such historical or other value. (2) Records transferred to a Federal Records Center (FRC) for safekeeping and storage do not fall within this category. These remain under the control of the transferring Component, and the FRC personnel are considered agents of the Component which retains control over the records. No disclosure accounting is required for the transfer of records to the FRCs. (i) Disclosures for law enforcement purposes. (1) Records may be disclosed without the consent of the individual to whom they pertain to another agency or an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity, provided: (i) The civil or criminal law enforcement activity is authorized by law; (ii) The head of the law enforcement activity or a designee has made a written request specifying the particular records desired and the law enforcement purpose (such as criminal investigations, enforcement of a civil law, or a similar purpose) for which the record is sought; and (iii) There is no federal statute that prohibits the disclosure of the records. (2) Normally, blanket requests for access to any and all records pertaining to an individual are not honored. (3) When a record is released to a law enforcement activity under paragraph (i)(1) of this section, maintain a disclosure accounting. This disclosure accounting shall not be made available to the individual to whom the record pertains if the law enforcement activity requests that the disclosure not be released. (4) The blanket routine use for Law Enforcement (appendix C, section A.) applies to all DoD Component systems notices (see paragraph (e)(5) of this section). Only by including this routine use can a Component, on its own initiative, report indications of violations of law found in a system of records to a law enforcement activity without the consent of the individual to whom the record pertains (see paragraph (i)(1) of this section when responding to requests from law enforcement activities). (j) Emergency disclosures. (1) Records may be disclosed without the consent of the individual to whom they pertain if disclosure is made under compelling circumstances affecting the health or safety of any individual. The affected individual need not be the subject of the record disclosed. (2) When such a disclosure is made, notify the individual who is the subject of the record. Notification sent to the last known address of the individual as reflected in the records is sufficient. (3) The specific data to be disclosed is at the discretion of releasing authority. (4) Emergency medical information may be released by telephone. (k) Disclosures to Congress and the General Accounting Office. (1) Records may be disclosed without the consent of the individual to whom they pertain to either House of the Congress or to any committee, joint committee or subcommittee of Congress if the release pertains to a matter within the jurisdiction of the committee. Records may also be disclosed to the General Accounting Office (GAO) in the course of the activities of GAO. (2) The blanket routine use for “Congressional Inquiries” (see appendix C, section D.) applies to all systems; therefore, there is no need to verify that the individual has authorized the release of his or her record to a congressional member when responding to a congressional constituent inquiry. (3) If necessary, accept constituent letters requesting a member of Congress to investigate a matter pertaining to the individual as written authorization to provide access to the records to the congressional member or his or her staff. (4) The verbal statement by a congressional staff member is acceptable to establish that a request has been received from the person to whom the records pertain. (5) If the constituent inquiry is being made on behalf of someone other than the individual to whom the record pertains, provide the congressional member only that information releasable under the Freedom of Information Act (5 U.S.C. 552). Advise the congressional member that the written consent of the individual to whom the record pertains is required before any additional information may be released. Do not contact individuals to obtain their consents for release to congressional members unless a congressional office specifically requests that this be done. (6) Nothing in paragraph (k)(2) of this section prohibits a Component, when appropriate, from providing the record directly to the individual and notifying the congressional office that this has been done without providing the record to the congressional member. (7) See paragraph (e) of §310.33 for the policy on assessing fees for Members of Congress. (8) Make a disclosure accounting each time a record is disclosed to either House of Congress, to any committee, joint committee, or subcommittee of Congress, to any congressional member, or GAO. (l) Disclosures under court orders. (1) Records may be disclosed without the consent of the person to whom they pertain under a court order signed by a judge of a court of competent jurisdiction. Releases may also be made under the compulsory legal process of federal or state bodies having authority to issue such process. (2) When a record is disclosed under this provision, make reasonable efforts to notify the individual to whom the record pertains, if the legal process is a matter of public record. (3) If the process is not a matter of public record at the time it is issued, seek to be advised when the process is made public and make reasonable efforts to notify the individual at that time. (4) Notification sent to the last known address of the individual as reflected in the records is considered reasonable effort to notify. (5) Make a disclosure accounting each time a record is disclosed under a court order or compulsory legal process. (m) Disclosures to consumer reporting agencies. (1) Certain personal information may be disclosed to consumer reporting agencies as defined by the Federal Claims Collection Act of 1966, as amended (31 U.S.C. 952(d)). (2) Under the provisions of paragraph (m)(1) of this section, the following information may be disclosed to a consumer reporting agency: (i) Name, address, taxpayer identification number (SSN), and other information necessary to establish the identity of the individual. (ii) The amount, status, and history of the claim. (iii) The agency or program under which the claim arose. (3) The Federal Claims Collection Act of 1966, as amended (31 U.S.C. 952(d)) specifically requires that the system notice for the system of records from which the information will be disclosed indicates that the information may be disclosed to a “consumer reporting agency.” [51 FR 2364, Jan. 16, 1986. Redesignated at 56 FR 55631, Oct. 29, 1991, as amended at 56 FR 57800, Nov. 14, 1991; 62 FR 26389, May 14, 1997] (a) General policy. (1) Make releases of personal information to commercial enterprises under the criteria established by the DoD Freedom of Information Program (32 CFR part 286). (2) The relationship of commercial enterprises to their clients or customers and to the Department of Defense are not changed by this part. (3) The DoD policy on personal indebtedness for military personnel is contained in 32 CFR part 43a and for civilian employees in the Office of Personnel Management, Federal Personnel Manual (5 CFR part 550). (b) Release of personal information. (1) Any information that must be released under the Freedom of Information (5 U.S.C. 552) may be released to a commercial enterprise without the individual's consent (see paragraph (b) of §310.41 of this subpart). (2) Commercial enterprises may present a signed consent statement setting forth specific conditions for release of personal information. Statements such as the following, if signed by the individual, are considered valid:
I hereby authorize the Department of Defense to verify my Social Security Number or other identifying information and to disclose my home address and telephone number to authorized representatives of (name of commercial enterprise) so that they may use this information in connection with my commercial dealings with that enterprise. All information furnished will be used in connection with my financial relationship with (name of commercial enterprise). (3) When a statement of consent as outlined in paragraph (b)(2) of this section is presented, provide the requested information if its release is not prohibited by some other regulation or statute. (4) Blanket statements of consent that do not identify specifically the Department of Defense or any of its Components, or that do not specify exactly the type of information to be released, may be honored if it is clear that the individual in signing the consent statement intended to obtain a personal benefit (for example, a loan to buy a house) and was aware of the type information that would be sought. Care should be exercised in these situations to release only the minimum amount of personal information essential to obtain the benefit sought. (5) Do not honor request from commercial enterprises for official evaluation of personal characteristics, such as evaluation of personal financial habits. (a) Section applicability. This section applies to the release of information to the news media or the public concerning persons treated or hospitalized in DoD medical facilities and patients of nonfederal medical facilities for whom the cost of the care is paid by the Department of Defense. (b) General disclosure. Normally, the following may be released without the patient's consent. (1) Personal information concerning the patient. See 32 CFR part 286, The DoD Freedom of Information Act Program and paragraph (c) of §310.41. (2) Medical condition: (i) Date of admission or disposition; (ii) The present medical assessment of the individual's condition in the following terms if the medical doctor has volunteered the information: (A) The individual's condition is presently (stable) (good) (fair) (serious) or (critical), and (B) Whether the patient is conscious, semiconscious, or unconscious. (c) Individual consent. (1) Detailed medical and other personal information may be released in response to inquiries from the news media and public if the patient has given his or her informed consent to such a release. (2) If the patient is not conscious or competent, no personal information except that required by the Freedom of Information Act (5 U.S.C. 552) shall be released until there has been enough improvement in the patient to ensure he or she can give informed consent or a guardian has been appointed legally for the patient and the guardian has given consent on behalf of the patient. (3) The consent described in paragraph (c)(1) of this section regarding patients who are minors must be given by the parent of legal guardian. (d) Information that may be released with individual consent. (1) Any item of personal information may be released, if the patient has given his or her informed consent to its release. (2) Releasing medical information about patients shall be done with discretion, so as not to embarrass the patient, his or her family, or the Department of Defense, needlessly. (e) Disclosures to other government agencies. This subpart does not limit the disclosures of personal medical information to other government agencies for use in determining eligibility for special assistance or other benefits. [51 FR 2364, Jan. 16, 1986. Redesignated at 56 FR 55631, Oct. 29, 1991, as amended at 56 FR 57800, Nov. 14, 1991] (a) Disclosure accountings. (1) Keep an accurate record of all disclosures made from any system of records except disclosures: (i) To DoD personnel for use in the performance of their official duties; or (ii) Under 32 CFR part 286, The DoD Freedom of Information Program. (2) In all other cases a disclosure accounting is required even if the individual has consented to the disclosure of the information pertaining to him or her. (3) Disclosure accountings: (i) Permit individuals to determine to whom information has been disclosed; (ii) Enable the activity to notify past recipients of disputed or corrected information (§310.32(i)(1), subpart D); and (iii) Provide a method of determining compliance with paragraph (c) of §310.40. (b) Contents of disclosure accountings. As a minimum, disclosure accounting shall contain: (1) The date of the disclosure. (2) A description of the information released. (3) The purpose of the disclosure. (4) The name and address of the person or agency to whom the disclosure was made. (c) Methods of disclosure accounting. Use any system of disclosure accounting that will provide readily the necessary disclosure information (see paragraph (a)(3) of this section). (d) Accounting for mass disclosures. When numerous similar records are released (such as transmittal of payroll checks to a bank), identify the category of records disclosed and include the data required by paragraph (b) of this section in some form that can be used to construct an accounting disclosure record for individual records if required (see paragraph (a)(3) of this section). (e) Disposition of disclosure accounting records. Retain disclosure accounting records for 5 years after the disclosure or the life of the record, whichever is longer. (f) Furnishing disclosure accountings to the individual. (1) Make available to the individual to whom the record pertains all disclosure accountings except when: (i) The disclosure has been made to a law enforcement activity under paragraph (i) of §310.41 and the law enforcement activity has requested that disclosure not be made; or (ii) The system of records has been exempted from the requirement to furnish the disclosure accounting under the provisions of §310.50(b), subpart F. (2) If disclosure accountings are not maintained with the record and the individual requests access to the accounting, prepare a listing of all disclosures (see paragraph (b) of this section) and provide this to the individual upon request. [51 FR 2364, Jan. 16, 1986. Redesignated at 56 FR 55631, Oct. 29, 1991, as amended at 56 FR 57800, Nov. 14, 1991]
Title 32: National Defense
PART 310—DoD PRIVACY PROGRAM
Subpart E—Disclosure of Personal Information to Other Agencies and Third Parties
§ 310.40 Conditions of disclosure.
§ 310.41 Nonconsensual disclosures.
§ 310.42 Disclosures to commercial enterprises.
§ 310.43 Disclosures to the public from health care records.
§ 310.44 Disclosure accounting.
