CFR > Title 32 - National Defense > SUBTITLE A—Department of Defense > CHAPTER I—OFFICE OF THE SECRETARY OF DEFENSE (parts 1 to 399) > SUBCHAPTER O—PRIVACY PROGRAM (parts 310 to 327) > PART 318—DEFENSE THREAT REDUCTION AGENCY PRIVACY PROGRAM > 318.4—Policy.

318.4—Policy.

(a) It is DTRA policy that:
(1) The personal privacy of an individual shall be respected and protected. Personal information shall be collected, maintained, used, or disclosed to insure that:
(2) It shall be relevant and necessary to accomplish a lawful DTRA purpose required to be accomplished by Federal statute or Executive order;
(3) It shall be collected to the greatest extent practicable directly from the individual;
(4) The individual shall be informed as to why the information is being collected, the authority for collection, what uses will be made of it, whether disclosure is mandatory or voluntary, and the consequences of not providing the information;
(5) It shall be relevant, timely, complete and accurate for its intended use; and
(6) Appropriate administrative, technical, and physical safeguards shall be established, based on the media (e.g., paper, electronic, etc.) involved, to ensure the security of the records and to prevent compromise or misuse during storage or transfer.
(b) No record shall be maintained on how an individual exercises rights guaranteed by the First Amendment to the Constitution, except as specifically authorized by statute; expressly authorized by the individual on whom the record is maintained; or when the record is pertinent to and within the scope of an authorized law enforcement activity.
(c) Notices shall be published in the Federal Register and reports shall be submitted to Congress and the Office of Management and Budget, in accordance with, and as required by 5 U.S.C. 552a, OMB Circular A-130, and 32 CFR part 310, as to the existence and character of any system of records being established or revised by the DoD Components. Information shall not be collected, maintained, or disseminated until the required publication/review requirements are satisfied.
(d) Individuals shall be permitted, to the extent authorized by this part:
(1) To determine what records pertaining to them are contained in a system of records;
(2) Gain access to such records and obtain a copy of those records or a part thereof;
(3) Correct or amend such records on a showing the records are not accurate, relevant, timely, or complete.
(4) Appeal a denial of access or a request for amendment.
(e) Disclosure of records pertaining to an individual from a system of records shall be prohibited except with the consent of the individual or as otherwise authorized by 5 U.S.C. 552a and 32 CFR part 286. When disclosures are made, the individual shall be permitted, to the extent authorized by 5 U.S.C. 552a and 32 CFR part 310, to seek an accounting of such disclosures from DTRA.
(f) Computer matching programs between DTRA and Federal, State, or local governmental agencies shall be conducted in accordance with the requirements of 5 U.S.C. 552a, OMB Circular A-130, and 32 CFR part 310.
(g) DTRA personnel and Systems Managers shall conduct themselves, pursuant to established rules of conduct, so that personal information to be stored in a system of records shall only be collected, maintained, used, and disseminated as authorized by this part.