52.224-3 Privacy Training.

As prescribed in 24.302 , insert the following clause:

Privacy Training (Jan 2017)

(a) Definition. As used in this clause, "personally identifiable information" means information that

can be used to distinguish or trace an individual's identity, either alone or when combined with other

information that is linked or linkable to a specific individual. (See Office of Management and Budget

(OMB) Circular A-130, Managing Federal Information as a Strategic Resource).

(b) The Contractor shall ensure that initial privacy training, and annual privacy training thereafter,

is completed by contractor employees who-

(1) Have access to a system of records;

(2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle

personally identifiable information on behalf of an agency; or

(3) Design, develop, maintain, or operate a system of records (see also FAR subpart 24.3 and

39.105).

(c)

(1) "Privacy training shall address the key elements necessary for ensuring the safeguarding of

personally identifiable information or a system of records. The training shall be role-based, provide

foundational as well as more advanced levels of training, and have measures in place to test the

knowledge level of users. At a minimum, the privacy training shall cover-

(i) The provisions of the Privacy Act of 1974 (5 U.S.C. 552a), including penalties for violations of the

Act;

(ii) The appropriate handling and safeguarding of personally identifiable information;

(iii) The authorized and official use of a system of records or any other personally identifiable

information;

(iv) The restriction on the use of unauthorized equipment to create, collect, use, process, store,

maintain, disseminate, disclose, dispose or otherwise access personally identifiable information;

(v) The prohibition against the unauthorized use of a system of records or unauthorized disclosure,

access, handling, or use of personally identifiable information; and

(vi) The procedures to be followed in the event of a suspected or confirmed breach of a system of

records or the unauthorized disclosure, access, handling, or use of personally identifiable

information (see OMB guidance for Preparing for and Responding to a Breach of Personally

Identifiable Information).

(2) Completion of an agency-developed or agency-conducted training course shall be deemed to

satisfy these elements.
(d) The Contractor shall maintain and, upon request, provide documentation of completion of privacy

training to the Contracting Officer.

(e) The Contractor shall not allow any employee access to a system of records, or permit any

employee to create, collect, use, process, store, maintain, disseminate, disclose, dispose or otherwise

handle personally identifiable information, or to design, develop, maintain, or operate a system of

records unless the employee has completed privacy training, as required by this clause.

(f) The substance of this clause, including this paragraph (f), shall be included in all subcontracts

under this contract, when subcontractor employees will-

(1) Have access to a system of records;

(2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle

personally identifiable information; or

(3) Design, develop, maintain, or operate a system of records.

(End of clause)

Alternate I (Jan 2017). As prescribed in 24.302 (b), if the agency specifies that only its agencyprovided training is acceptable, substitute the following paragraph (c) for paragraph (c) of the basic

clause:

(c) The contracting agency will provide initial privacy training, and annual privacy training

thereafter, to Contractor employees for the duration of this contract.

Parent topic: 52.224 [Reserved]