Employees who handle information on individuals should become familiar with the Corporate guidelines on the Privacy Act and privacy protection. Below are some situations which may require knowledge of Privacy Act procedures. If you have questions, contact the Privacy Program Manager.
Safeguarding Privacy Act Records
Consider how you handle the information you work with, and what measures you need to take to safeguard the personal information that you have about others
If you are creating a new system of records, developing or enhancing a application system or collecting a database containing information on individuals, contact the Privacy System of Records Clearance Officer to discuss how the information can be protected
Safeguarding requirements cover (1) physical security measures, (2) information management practices, and (3) computer system/network security
Disclosing Privacy Act Information to Others
Be careful that personal information is not disclosed to anyone unless that individual has received prior permission to see the information from the subject of the record, or disclosures of the record is authorized by law
Only employees who have a legitimate need for the record in the performance of their duties have legal access to specific personal information
Even if you may have legitimate access, sharing information on individuals to others who do not have a legitimate need for the information or who would not have access to this information otherwise is a violation of the law
Collecting Personal Information
Employees must collect only that personal information from an individual that is relevant and necessary to accomplish an authorized corporate function
When personal information is collected you must inform the individual in writing of the:
Purpose for collecting it
What related uses will be made of the information
Whether a response is mandatory or voluntary, and
What will be the effect if they refuse to respond
The information above is usually provided on a form given to the person providing the information.
Note: The notification described above is required for both paper and electronic forms; something to think about if you are posting Web forms on the Internet. Contact the Privacy System of Records Clearance Officer.
Access to Records, and Amendment Requests
When the subject of information in a Privacy Act System of Records makes a request to inspect or receive a copy of the information, there are certain procedures which must be followed. Contact the system manager of the file or database, or the Privacy System of Records Clearance Officer.
Not all information in a Privacy Act System of Records is made available to the subject of information in the system. There are Privacy Act exempted records which are listed in the FDIC Privacy Act Rules and Regulations.