310.10—General.
(1)
Consist of “records” (as defined in 310.4(r)) that are retrieved by the name of an individual or some other personal identifier; and
(b) Retrieval practices.
(1)
Records in a group of records that MAY be retrieved by a name or personal identifier are not covered by this part even if the records contain personal data and are under control of a DoD Component. The records MUST be retrieved by name or other personal identifier to become a system of records for the purpose of this part.
(i)
When records are contained in an automated (Information Technology) system that is capable of being manipulated to retrieve information about an individual, this does not automatically transform the system into a system of records as defined in this part.
(ii)
In determining whether an automated system is a system of records that is subject to this part, retrieval policies and practices shall be evaluated. If DoD Component policy is to retrieve personal information by the name or other unique personal identifier, it is a system of records. If DoD Component policy prohibits retrieval by name or other identifier, but the actual practice of the Component is to retrieve information by name or identifier, even if done infrequently, it is a system of records.
(2)
If records are retrieved by name or personal identifier, a system notice must be submitted in accordance with § 310.33.
(3)
If records are not retrieved by name or personal identifier but then are rearranged in such a manner that they are retrieved by name or personal identifier, a new systems notice must be submitted in accordance with § 310.33.
(4)
If records in a system of records are rearranged so that retrieval is no longer by name or other personal identifier, the records are no longer subject to this part and the system notice for the records shall be deleted in accordance with § 310.34.
(c) Relevance and necessity.
Information or records about an individual shall only be maintained in a system of records that is relevant and necessary to accomplish a DoD Component purpose required by a Federal statute or an Executive Order.
(d) Authority to establish systems of records.
Identify the specific statute or the Executive Order that authorizes maintaining personal information in each system of records. The existence of a statute or Executive Order mandating the maintenance of a system of records does not abrogate the responsibility to ensure that the information in the system of records is relevant and necessary. If a statute or Executive Order does not expressly direct the creation of a system of records, but the establishment of a system of records is necessary in order to discharge the requirements of the statute or Executive Order, the statute or Executive Order shall be cited as authority.
(e) Exercise of First Amendment rights.
(1)
Do not maintain any records describing how an individual exercises his or her rights guaranteed by the First Amendment of the U.S. Constitution except when:
(iii)
Maintenance of the information is pertinent to and within the scope of an authorized law enforcement activity.
(2)
First Amendment rights include, but are not limited to, freedom of religion, freedom of political beliefs, freedom of speech, freedom of the press, the right to assemble, and the right to petition.
(f) System Manager's evaluation.
(1)
Evaluate the information to be included in each new system before establishing the system and evaluate periodically the information contained in each existing system of records for relevancy and necessity. Such a review shall also occur when a system notice alteration or amendment is prepared (see § 310.33 and § 310.34 ).
(i)
The relationship of each item of information retained and collected to the purpose for which the system is maintained;
(ii)
The specific impact on the purpose or mission of not collecting each category of information contained in the system;
(iii)
The possibility of meeting the informational requirements through use of information not individually identifiable or through other techniques, such as sampling;
(g) Discontinued information requirements.
(1)
Stop collecting immediately any category or item of personal information for which retention is no longer justified. Also delete this information from existing records, when feasible.
(2)
Do not destroy any records that must be retained in accordance with disposal authorizations established under 44 U.S.C. 3303a, Examination by Archivist of Lists and Schedules of Records Lacking Preservation Value; Disposal of Records.”