[Code of Federal Regulations]
[Title 5, Volume 2]
[Revised as of January 1, 2004]
From the U.S. Government Printing Office via GPO Access
[CITE: 5CFR1001.102]

[Page 606-607]
 
                    TITLE 5--ADMINISTRATIVE PERSONNEL
 
          CHAPTER I--OFFICE OF PERSONNEL MANAGEMENT (CONTINUED)
 
PART 1001_EMPLOYEE RESPONSIBILITIES AND CONDUCT--Table of Contents
 
Sec. 1001.102  Privacy Act rules of conduct.

    (a) An employee should avoid any action which results in the 
appearance of using public office to collect or gain access to personal 
data about individuals beyond that required by or authorized for the 
performance of assigned duties.
    (b) An employee should not use any personal data about individuals 
for any purpose other than required and authorized in the performance of 
assigned duties; or disclose any such information to other agencies or 
persons not expressly authorized to receive or have access to such 
information, and should make any such authorized disclosures in 
acordance with established regulations and procedures.
    (c) Each employee, and especially an employee who has access to or 
is engaged in any way in the handling of information subject to the 
Privacy Act of 1974, shall acquaint himself or herself with the 
regulations of this subsection as well as the pertinent provisions of 
the Privacy Act relating to the treatment of such information. 
Particular attention is directed to the following provisions of the 
Privacy Act:
    (1) 5 U.S.C. 552a(e)(7)--The prohibition against maintaining any 
information regarding how any individual exercises First Amendment 
rights (including political or religious beliefs, and the freedom of 
speech, press, and assembly) unless expressly authorized by statute or 
the individual.
    (2) 5 U.S.C. 552a(b)--The prohibition against disclosure of certain 
personal data without the prior written consent of the individual, 
except under certain limited conditions.
    (3) 5 U.S.C. 552a(e)(1)--The prohibition against collecting or 
maintaining any personal data about individuals, except as necessary and 
relevant to perform a function of the Office which is authorized by 
statute or Executive order.
    (4) 5 U.S.C. 552a(e)(2)--The requirement to collect information 
which may result in an adverse determination about an individual from 
that individual whenever practicable.
    (5) 5 U.S.C. 552a(e)(3)--The requirement to inform individuals from 
whom information about themselves is solicited of the authority under 
which the solicitation is made and whether the disclosure of the 
information is mandatory, the purposes for which the information will be 
used, the routine uses which may be made of the information, and the 
consequences of failure to provide such information.
    (6) 5 U.S.C. 552a(b) and (e)(10)--The obligation of employees to 
comply with established safeguards and procedures to protect personal 
data from anticipated threats or hazards to the security or integrity of 
the data which

[[Page 607]]

could result in substantial harm, embarrassment, inconvenience, or 
unfairness to an individual about whom information is maintained.
    (7) 5 U.S.C. 552a(c) (1), (2), and (3)--The obligation of employees 
to maintain an accounting of all disclosures of personal information 
from systems of records, except for those disclosures made within the 
Office to persons having an official need to know or to the public under 
the Freedom of Information Act (5 U.S.C. 552).
    (8) 5 U.S.C. 552a(e) (5) and (6)--The obligation of employees to 
assure that any personal information about individuals is as accurate, 
relevant, timely and complete as is reasonably necessary to assure 
fairness to the individual at such time as any such information is 
utilized by the Office in making a determination about the individual or 
when the information is disclosed.
    (9) 5 U.S.C. 552a(d) (1), (2), and (3)--The obligation of employees 
to permit individuals to have access to records pertaining to themselves 
in accordance with established Office procedures and to have an 
opportunity to request that such records be amended.
    (10) 5 U.S.C. 552a(c)(4) and (d)(4)--The obligation to inform prior 
recipients of personal data when a record is amended pursuant to the 
request of an individual or a statement of disagreement has been filed, 
and to advise any subsequent recipients of the disputed information.
    (11) 5 U.S.C. 552a(n)--The prohibition against renting or selling 
lists of names and addresses unless specifically authorized by law.
    (12) 5 U.S.C. 552a(i) (1), (2), and (3)--The criminal penalties to 
which an employee may be subject for failing to comply with certain 
provisions of the Privacy Act of 1974.

[53 FR 13097, Apr. 21, 1988. Redesignated at 61 FR 36996, July 16, 1996]