12 CFR §404.36

In addition to compliance with the requirements of this subpart, demands to provide testimony and/or produce records that concern information protected by the Privacy Act, 5 U.S.C. 552a, or any other authority mandating confidentiality of certain classes of records or information, must also satisfy the requirements for disclosure imposed by such authority before records may be produced or testimony given.