[Code of Federal Regulations]
[Title 49, Volume 8]
[Revised as of October 1, 2003]
From the U.S. Government Printing Office via GPO Access
[CITE: 49CFR1520.5]

[Page 289]
 
                        TITLE 49--TRANSPORTATION
 
   CHAPTER XII--TRANSPORTATION SECURITY ADMINISTRATION, DEPARTMENT OF 
                            HOMELAND SECURITY
 
PART 1520--PROTECTION OF SENSITIVE SECURITY INFORMATION--Table of Contents
 
Sec. 1520.5  Records and information protected by others.

    (a) Duty to protect information. The following persons must restrict 
disclosure of and access to sensitive security information described in 
Sec. 1520.7 (a) through (g), (j), (k), and (m) through (r), and, as 
applicable, Sec. 1520.7 (l) to persons with a need to know and must 
refer requests by other persons for such information to TSA or the 
applicable DOT administration:
    (1) Each person employed by, contracted to, or acting for a person 
listed in this paragraph (a).
    (2) Each airport operator under part 1542 of this chapter.
    (3) Each aircraft operator under part 1544 of this chapter.
    (4) Each foreign air carrier under part 1546 of this chapter.
    (5) Each indirect air carrier under part 1548 of this chapter.
    (6) Each aircraft operator under Sec. 1550.5 of this chapter.
    (7) Each person receiving information under Sec. 1520.3 (d).
    (8) Each person for which a vulnerability assessment has been 
authorized, approved, or funded by DOT, irrespective of the mode of 
transportation.
    (b) Need to know. For some specific sensitive security information, 
the Administrator may make a finding that only specific persons or 
classes of persons have a need to know. Otherwise, a person has a need 
to know sensitive security information in each of the following 
circumstances:
    (1) When the person needs the information to carry out DOT-approved, 
accepted, or directed security duties.
    (2) When the person is in training to carry out DOT-approved, 
accepted, or directed security duties.
    (3) When the information is necessary for the person to supervise or 
otherwise manage the individuals carrying to carry out DOT-approved, 
accepted, or directed security duties.
    (4) When the person needs the information to advise the persons 
listed in paragraph (a) of this section regarding any DOT security-
related requirements.
    (5) When the person needs the information to represent the persons 
listed in paragraph (a) of this section in connection with any judicial 
or administrative proceeding regarding those requirements.
    (c) Release of sensitive security information. When sensitive 
security information is released to unauthorized persons, any person 
listed in paragraph (a) of this section or individual with knowledge of 
the release, must inform DOT.
    (d) Violation. Violation of this section is grounds for a civil 
penalty and other enforcement or corrective action by DOT.
    (e) Applicants. Wherever this part refers to an aircraft operator, 
airport operator, foreign air carrier, or indirect air carrier, those 
terms also include applicants for such authority.
    (f) Trainees. An individual who is in training for a position is 
considered to be employed by, contracted to, or acting for persons 
listed in paragraph (a) of this section, regardless of whether that 
individual is currently receiving a wage or salary or otherwise is being 
paid.