Source: http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/Far/24.htm
Timestamp: 2019-02-17 12:20:38
Document Index: 449495045

Matched Legal Cases: ['art 24', 'art 24', 'art 24', 'art 24', 'art 24', 'art 24']

FAR -- Part 24 Protection of Privacy and Freedom of Information
24.000 -- Scope of Part.
Subpart 24.1 -- Protection of Individual Privacy
24.101 -- Definitions.
24.102 -- General.
24.103 -- Procedures.
24.104 -- Contract Clauses.
Subpart 24.2 -- Freedom of Information Act
24.201 -- Authority.
24.202 -- Prohibitions.
24.203 -- Policy.
Subpart 24.3 – Privacy Training
24.301 – Privacy Training.
24.302 -- Contract Clause.
FAR -- Part 24
(FAC 2005-94)
“Personally identifiable information” means information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. (See Office of Management and Budget (OMB) Circular No. A-130, Managing Federal Information as a Strategic Resource).
(b) If one or more of those tasks will be required, the contracting officer shall --
The Freedom of Information Act (5 U.S.C. 552, as amended) provides that information is to be made available to the public either by --
(a) A proposal in the possession or control of the Government, submitted in response to a competitive solicitation, shall not be made available to any person under the Freedom of Information Act. This prohibition does not apply to a proposal, or any part of a proposal, that is set forth or incorporated by reference in a contract between the Government and the contractor that submitted the proposal. (See 10 U.S.C. 2305(g) and 41 U.S.C. 4702.)
(b) No agency shall disclose any information obtained pursuant to 15.403-3(b) that is exempt from disclosure under the Freedom of Information Act. (See 10 U.S.C. 2306a(d)(2)(C) and 41 U.S.C. 3505(b)(3).)
(b) Contracting officers may receive requests for records that may be exempted from mandatory public disclosure. The exemptions most often applicable are those relating to classified information, to trade secrets and confidential commercial or financial information, to interagency or intra-agency memoranda, or to personal and medical information pertaining to an individual. Other exemptions include agency personnel practices, and law enforcement. Since these requests often involve complex issues requiring an in-depth knowledge of a large and increasing body of court rulings and policy guidance, contracting officers are cautioned to comply with the implementing regulations of their agency and to obtain necessary guidance from the agency officials having Freedom of Information Act responsibility. If additional assistance is needed, authorized agency officials may contact the Department of Justice, Office of Information and Privacy. A Freedom of Information Act guide and other resources are available at the Department of Justice website under FOIA reference materials: http://www.usdoj.gov/oip .
(a) Contractors are responsible for ensuring that initial privacy training, and annual privacy training thereafter, is completed by contractor employees who--
(2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information on behalf of the agency; or
(3) Design, develop, maintain, or operate a system of records (see FAR subpart 24.1 and 39.105).
(b) Privacy training shall address the key elements necessary for ensuring the safeguarding of personally identifiable information or a system of records. The training shall be role-based, provide foundational as well as more advanced levels of training, and have measures in place to test the knowledge level of users. At a minimum, the privacy training shall cover--
(1) The provisions of the Privacy Act of 1974 (5 U.S.C. 552a), including penalties for violations of the Act;
(2) The appropriate handling and safeguarding of personally identifiable information;
(3) The authorized and official use of a system of records or any other personally identifiable information;
(4) The restriction on the use of unauthorized equipment to create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise access personally identifiable information;
(5) The prohibition against the unauthorized use of a system of records or unauthorized disclosure, access, handling, or use of personally identifiable information; and
(6) Procedures to be followed in the event of a suspected or confirmed breach of a system of records or unauthorized disclosure, access, handling, or use of personally identifiable information (see Office of Management and Budget guidance for Preparing for and Responding to a Breach of Personally Identifiable Information).
(c) The contractor may provide its own training or use the training of another agency unless the contracting agency specifies that only its agency-provided training is acceptable (see 24.302(b)).
(d) The contractor is required to maintain and, upon request, to provide documentation of completion of privacy training for all applicable employees.
(e) No contractor employee shall be permitted to have or retain access to a system of records, create, collect, use, process, store, maintain, disseminate, disclose, or dispose, or otherwise handle personally identifiable information, or design, develop, maintain, or operate a system of records, unless the employee has completed privacy training that, at a minimum, addresses the elements in paragraph (b) of this section.
(a) The contracting officer shall insert the clause at FAR 52.224-3, Privacy Training, in solicitations and contracts when, on behalf of the agency, contractor employees will--
(b) When an agency specifies that only its agency-provided training is acceptable, use the clause with its Alternate I.