§ 304.32 Employee standards of conduct.

The agency will inform its employees of the provisions of the Privacy Act, including the scope of its restriction against disclosure of records maintained in a system of records without the prior written consent of the individual involved, and the Act's civil liability and criminal penalty provisions. Unless otherwise permitted by law, an employee of the agency will:

(a) Collect from individuals and maintain only the information that is relevant and necessary to discharge the agency's responsibilities;

(b) Collect information about an individual directly from that individual to the greatest extent practicable when the information may result in an adverse determination about an individual's rights, benefits, or privileges under Federal programs;

(c) Inform each individual from whom information is collected of the information set forth in § 304.31(b);

(d) Ensure that the agency maintains no system of records without public notice and also notify appropriate agency officials of the existence or development of any system of records that is not the subject of a current or planned public notice;

(e) Maintain all records that are used by it in making any determination about an individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to ensure fairness to the individual in the determination;

(f) Except as to disclosures made to an agency or made under the FOIA, make reasonable efforts, prior to disseminating any record about an individual, to ensure that the record is accurate, relevant, timely, and complete;

(g) Maintain no record describing how an individual exercises his or her First Amendment rights unless such maintenance is expressly authorized by statute or by the individual about whom the record is maintained or is pertinent to and within the scope of an authorized law enforcement activity;

(h) When required by the Privacy Act, maintain an accounting in the specified form of all disclosures of records by the agency to persons, organizations, or agencies;

(i) Maintain and use records with care in order to prevent the unauthorized or inadvertent disclosure of a record to anyone; and

(j) Notify the appropriate agency official of any record that contains information that the Privacy Act does not permit the agency to maintain.