10 CFR §37.31

1. (a)Each licensee who obtains background information on an individual under this subpart shall establish and maintain a system of files and written procedures for protection of the record and the personal information from unauthorized disclosure.
2. (b)The licensee may not disclose the record or personal information collected and maintained to persons other than the subject individual, his or her representative, or to those who have a need to have access to the information in performing assigned duties in the process of granting or denying unescorted access to category 1 or category 2 quantities of radioactive material, safeguards information, or safeguards information-modified handling. No individual authorized to have access to the information may disseminate the information to any other individual who does not have a need to know.
3. (c)The personal information obtained on an individual from a background investigation may be provided to another licensee:
   1. (1)Upon the individual's written request to the licensee holding the data to disseminate the information contained in his or her file; and
   2. (2)The recipient licensee verifies information such as name, date of birth, social security number, gender, and other applicable physical characteristics.
4. (d)The licensee shall make background investigation records obtained under this subpart available for examination by an authorized representative of the NRC to determine compliance with the regulations and laws.
5. (e)The licensee shall retain all fingerprint and criminal history records (including data indicating no record) received from the FBI, or a copy of these records if the individual's file has been transferred, on an individual for 3 years from the date the individual no longer requires unescorted access to category 1 or category 2 quantities of radioactive material.