(a) Neither general nor specific exemptions are established automatically for any system of records. The head of the DoD Component maintaining the system of records must make a determination whether the system is one for which an exemption properly may be claimed and then propose and establish an exemption rule for the system. No system of records within the Department of Defense shall be considered exempted until the head of the Component has approved the exemption and an exemption rule has been published as a final rule in the Federal Register.

(b) No system of records within NSA/CSS shall be considered exempt under subsection (j) or (k) of the Privacy Act until the exemption rule for the system of records has been published as a final rule in the Federal Register.

(c) An individual is not entitled to have access to any information compiled in reasonable anticipation of a civil action or proceeding (5 U.S.C. 552a(d)(5)).

(d) Proposals to exempt a system of records will be forwarded to the Defense Privacy Office, consistent with the requirements of 32 CFR part 310, for review and action.

(e) Consistent with the legislative purpose of the Privacy Act of 1974, NSA/CSS will grant access to nonexempt material in the records being maintained. Disclosure will be governed by NSA/CSS's Privacy Regulation, but will be limited to the extent that the identity of confidential sources will not be compromised; subjects of an investigation of an actual or potential criminal or civil violation will not be alerted to the investigation; the physical safety of witnesses, informants and law enforcement personnel will not be endangered, the privacy of third parties will not be violated; and that the disclosure would not otherwise impede effective law enforcement. Whenever possible, information of the above nature will be deleted from the requested documents and the balance made available. The controlling principle behind this limited access is to allow disclosures except those indicated above. The decisions to release information from these systems will be made on a case-by-case basis.

(f) Do not use an exemption to deny an individual access to any record to which he or she would have access under the Freedom of Information Act (5 U.S.C. 552).

(g) Disclosure of records pertaining to personnel, or the functions and activities of the National Security Agency shall be prohibited to the extent authorized by Pub. L. No. 86-36 (1959) and 10 U.S.C. 424.

(h) Exemptions NSA/CSS may claim.

(1) General exemption. The general exemption established by 5 U.S.C. 552a(j)(2) may be claimed to protect investigative records created and maintained by law enforcement activities of the NSA.

(2) Specific exemptions. The specific exemptions permit certain categories of records to be exempt from certain specific provisions of the Privacy Act.

(i) (k)(1) exemption. Information properly classified under Executive Order 12958 and that is required by Executive Order to be kept secret in the interest of national defense or foreign policy.

(ii) (k)(2) exemption. Investigatory information compiled for law-enforcement purposes by non-law enforcement activities and which is not within the scope of Sec. 310.51(a). If an individual is denied any right, privilege or benefit that he or she is otherwise entitled by federal law or for which he or she would otherwise be eligible as a result of the maintenance of the information, the individual will be provided access to the information except to the extent that disclosure would reveal the identity of a confidential source. This subsection when claimed allows limited protection of investigative reports maintained in a system of records used in personnel or administrative actions.

(iii) (k)(3) exemption. Records maintained in connection with providing protective services to the President and other individuals identified under 18 U.S.C. 3506.

(iv) (k)(4) exemption. Records maintained solely for statistical research or program evaluation purposes and which are not used to make decisions on the rights, benefits, or entitlement of an individual except for census records which may be disclosed under 13 U.S.C. 8.

(v) (k)(5) exemption. Investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for federal civilian employment, military service, federal contracts, or access to classified information, but only to the extent such material would reveal the identity of a confidential source. This provision allows protection of confidential sources used in background investigations, employment inquiries, and similar inquiries that are for personnel screening to determine suitability, eligibility, or qualifications.

(vi) (k)(6) exemption. Testing or examination material used solely to determine individual qualifications for appointment or promotion in the federal or military service, if the disclosure would compromise the objectivity or fairness of the test or examination process.

(vii) (k)(7) exemption. Evaluation material used to determine potential for promotion in the Military Services, but only to the extent that the disclosure of such material would reveal the identity of a confidential source.