(a) General. HUD shall process FOIA requests for information submitted to the Secretary by the GSEs in accordance with:

(1) HUD's FOIA and Privacy Act regulations, 24 CFR parts 15 and 16;

(2) 12 U.S.C. 4525, 4543, and 4546 and this subpart; and

(3) Other applicable statutes, regulations, and guidelines, including the Trade Secrets Act, 18 U.S.C. 1905, and Executive Order 12600. In responding to requests for data or information submitted by or relating to the GSEs, the Secretary may invoke provisions of these authorities to protect data or information from disclosure.

(b) Protection of confidential business information other than mortgage data and AHAR information. When a GSE seeks to protect from disclosure confidential business information, the GSE may seek protection of such confidential business information pursuant to the provisions of HUD's FOIA regulations at 24 CFR part 15, without regard to whether or not it is mortgage data or AHAR information.

(c) Processing of FOIA requests—

(1) FOIA Exemption (b)(4). HUD will process FOIA requests for confidential business information of the GSEs to which FOIA exemption 4 may apply in accordance with 24 CFR part 15, and the predisclosure notification procedures of Executive Order 12,600.

(2) FOIA Exemption (b)(8). Under section 1319F of FHEFSSA, the Secretary may invoke FOIA exemption (b)(8) to withhold from the public any GSE data or information contained in or related to examination, operating, or condition reports prepared by, on behalf of, or for the use of HUD. HUD may make data or information available for the confidential use of other government agencies in their official duties or functions, but all data or information remains the property of HUD and any unauthorized use or disclosure of such data or information may be subject to the penalties of 18 U.S.C. 641.

(3) Other FOIA exemptions. Under 24 CFR part 15, the Secretary may invoke other exemptions including, without limitation, exemption (b)(6) (5 U.S.C. 552(b)(6)), to protect data and information that would constitute a clearly unwarranted invasion of personal privacy.

(d) Protection of information by HUD officers and employees. The Secretary will institute all reasonable safeguards to protect data or information submitted by or relating to either GSE, including, but not limited to, advising all HUD officers and employees having access to data or information submitted by or relating to either GSE of the legal restrictions against unauthorized disclosure of such data or information under the executive branch-wide standards of ethical conduct, 5 CFR part 2635, and the Trade Secrets Act, 18 U.S.C. 1905. Officers and employees shall be advised of the penalties for unauthorized disclosure, ranging from disciplinary action under 5 CFR part 2635 to criminal prosecution.

(e) Protection of information by contractors.

(1) In contracts and agreements entered into by HUD where contractors have access to data or information submitted by or relating to either GSE, HUD shall include detailed provisions specifying that:

(i) Neither the contractor nor any of its officers, employees, agents, or subcontractors may release data submitted by or relating to either GSE without HUD's authorization; and

(ii) Unauthorized disclosure may be a basis for:

(A) Terminating the contract for default;

(B) Suspending or debarring the contractor; and

(C) Criminal prosecution of the contractor, its officers, employees, agents, or subcontractors under the Federal Criminal Code.

(2) Contract provisions shall require safeguards against unauthorized disclosure, including training of contractor and subcontractor agents and employees, and provide that the contractor will indemnify and hold HUD harmless against unauthorized disclosure of data or information belonging to the GSEs or HUD.

[60 FR 61888, Dec. 1, 1995, as amended at 65 FR 65089, Oct. 31, 2000]