322.3—Policy.
(a)
The National Security Agency/Central Security Service shall maintain in its records only such information about an individual that is relevant and necessary to accomplish a purpose of the Agency, and that is required or authorized to be maintained by statute or Executive Order. Information about an individual shall, to the greatest extent practicable, be collected directly from the individual if the information may result in adverse determinations about the individual's rights, benefits, and privileges under any Federal program. Records used by this Agency in making adverse determinations about an individual shall be maintained with such accuracy, relevance, timeliness and completeness as is reasonably necessary to assure fairness to the individual. The Agency shall protect the privacy of individuals identified in its records, and shall permit an individual to request access to personal information in records on himself/herself and to request correction or amendment of factual information contained in such records. These policies are consistent with the spirit and intent of the PA, and are subject to exemptions under the Act, as defined in § 322.7, and legal requirements to protect sensitive NSA information such as the intelligence sources and methods the Agency employs to fulfill its mission.
(b)
Pursuant to written requests submitted in accordance with the PA, the NSA/CSS shall make records available consistent with the Act and the need to protect government interests pursuant to subsections (d) and (k) of the Privacy Act. Oral requests for information shall not be accepted. Before the Agency responds to a request, the request must comply with the provisions of this part.
(c)
In order that members of the public have timely access to unclassified information regarding NSA activities, requests for information that would not be withheld if requested under the FOIA or the PA may be honored through appropriate means without requiring the requester to invoke the FOIA or the PA. Although a record may require minimal redaction before its release, this fact alone shall not require the Agency to direct the requester to submit a formal FOIA or PA request for the record.