(a) Handling of records subject to the Act. Employees whose duties require handling of records subject to the Privacy Act shall, at all times, take care to protect the integrity, security and confidentiality of these records.

(b) Disclosure of records. No employee of the Department may disclose records subject to the Privacy Act unless disclosure is permitted under §2.56 or is to the individual to whom the record pertains.

(c) Alteration of records. No employee of the Department may alter or destroy a record subject to the Privacy Act unless (1) such alteration or destruction is properly undertaken in the course of the employee's regular duties or (2) such alteration or destruction is required by a decision under §§2.70 through 2.75 or the decision of a court of competent jurisdiction.

(d) Bureau responsibility. The bureau responsible for a system of records shall be responsible for assuring that employees with access to the system are made aware of the requirements of this section and of 5 U.S.C. 552a(i)(1), which imposes criminal penalties for knowingly and willfully disclosing a record about an individual without the written request or consent of that individual unless disclosure is permitted under one of the exceptions listed in §2.56 (b) and (c).