24 CFR §16.11

1. (a)The Department may disclose a record pertaining to an individual to a person other than the individual only in the following instances:
   1. (1)Upon written request by the individual, including authorization under § 16.5(e);
   2. (2)With the prior written consent of the individual;
   3. (3)To a parent or legal guardian under 5 U.S.C. 552a(h); and,
   4. (4)When required by the Act and not covered explicitly by the provisions of 5 U.S.C. 552a(b); and,
   5. (5)When permitted under 5 U.S.C. 552a(b) (1) through (11), which read as follows:
2. (b)The situations referred to in paragraph (a)(4) of this section include the following:
   1. (1)5 U.S.C. 552a(c)(4) requires dissemination of a corrected or amended record or notation of a disagreement statement by the Department in certain circumstances:
   2. (2)5 U.S.C. 552(a)(g) authorizes civil action by an individual and requires disclosure by the Department or the court;
   3. (3)Section 5(e)(2) of the Act authorizes release of any records or information by the Department to the Privacy Protection Study Commission upon request of the Chairman; and
   4. (4)Section 6 of the Act authorizes the Office of Management and Budget to provide the Department with continuing oversight and assistance in implementation of the Act.
3. (c)The Department shall make an accounting of each disclosure of any record contained in a system of records in accordance with 5 U.S.C. 552a(c) (1) and (2). Except for a disclosure made under 5 U.S.C. 552a(b)(7), the Privacy Act Officer shall make such accounting available to any individual, insofar as it pertains to that individual, on request submitted in accordance with § 16.4. The Privacy Act Officer shall make reasonable efforts to notify any individual when any record in a system of records is disclosed to any person under compulsory legal process, promptly upon being informed that such process has become a matter of public record.