310.52—Computer matching publication and review requirements.
(a)
DoD Components shall identify the systems of records that will be used in the match to ensure the publication requirements of subpart G have been satisfied. If the match will require disclosure of records outside the Department of Defense, Components shall ensure a routine use has been established, and that the publication and review requirements have been met, before any disclosures are made (see subpart G of this part).
(b)
If a computer matching program is contemplated, the DoD Component shall contact the DPO and provide information regarding the contemplated match. The DoD DPO shall ensure that any proposed computer matching program satisfies the requirements of the Privacy Act (5 U.S.C. 552a) and OMB Matching Guidelines ( 54 FR 25818 (June 19, 1989) ).
(c)
A computer matching agreement (CMA) shall be prepared by the Component, consistent with the requirements of § 310.53 of this subpart and submitted to the DPO. If the CMA satisfies the requirements of the Privacy Act (5 U.S.C. 552a) and OMB Matching Guidelines ( 54 FR 25818 (June 19, 1989) ), as well as this subpart, it shall be forwarded to the Defense Data Integrity Board (DIB) for approval or disapproval.
(1)
If the CMA is approved by the DIB, the DPO shall prepare and forward a report to both Houses of Congress and to OMB as required by, and consistent with, OMB Circular A-130, “Management of Federal Information Resources,” February 8, 1996, as amended. Congress and OMB shall have 40 days to review and comment on the proposed match. Any comments received must be resolved before matching can take place.
(2)
If the CMA is approved by the DIB, the DPO shall prepare and forward a match notice as required by OMB Circular A-130, “Management of Federal Information Resources,” February 8, 1996, as amended, for publication in the Federal Register. The public shall be given 30 days to comment on the proposed match. Any comments received must be resolved before matching can take place.