§ 327.8 - Disclosure of personal information to other agencies and third parties.

§ 327.8 Disclosure of personal information to other agencies and third parties.

(a) Disclosures and nonconsensual disclosures.

(1) All requests made by DeCA individuals for personal information about other individuals (third parties) will be processed under DeCA Directive 30-12^[7] except when the third party personal information is contained in the Privacy record of the individual making the request.

(2) For the purposes of disclosure and disclosure accounting, the Department of Defense is considered a single agency.

(3) Personal information from DeCA systems of records will not be disclosed outside the DoD unless:

(i) The record has been requested by the individual to whom it pertains,

(ii) Written consent has been given by the individual to whom the record pertains for release to the requesting agency, activity, or individual, or

(iii) The release is pursuant to one of the specific nonconsensual purposes set forth in the Act.

(4) Records may be disclosed without the consent of a DeCA individual to any DoD official who has need for the record in the performance of their assigned duties. Rank, position, or title alone does not authorize this access. An official need for this information must exist.

(5) DeCA records must be disclosed if their release is required by 32 CFR part 285, which is implemented by DeCA Directive 30-12.^[8] 32 CFR part 285 requires that records be made available to the public unless exempt from disclosure under the FOIA.

(b) Normally releasable information. Personal information that is normally releasable without the consent of a DeCA individual that does not imply a clearly unwarranted invasion of personal privacy:

(1) Civilian employees:

(i) Name,

(ii) Present and past position titles,

(iii) Present and past grades,

(iv) Present and past salaries,

(v) Present and past duty stations,

(vi) Office or duty telephone numbers,

(2) Military members:

(i) Full name,

(ii) Rank,

(iii) Date of rank,

(iv) Gross salary,

(v) Past duty assignments,

(vi) Present duty assignments,

(vii) Future assignments that are officially established,

(viii) Office or duty telephone numbers,

(ix) Source of commission,

(x) Promotion sequence number,

(xi) Awards and decorations,

(xii) Attendance at professional military schools,

(xiii) Duty status at any given time.

(3) All disclosures of personal information on civilian employees shall be made in accordance with the Office of Personnel Management (OPM) and all disclosures of personal information on military members shall be made in accordance with the standards established by 32 CFR part 285.

(4) The release of DeCA employees' home addresses and home telephone numbers is considered a clearly unwarranted invasion of personal privacy and is prohibited; however, these may be released without prior consent of the employee if:

(i) The employee has indicated previously that he or she consents to their release,

(ii) The releasing official was requested to release the information under the provisions of 32 CFR part 285.

(5) Before listing home addresses and home telephone numbers in any DeCA telephone directory, give the individuals the opportunity to refuse such a listing.

(c) Disclosures for established routine uses.

(1) Records may be disclosed outside of DeCA without consent of the individual to whom they pertain for an established routine use.

(2) A routine use shall:

(i) Be compatible with the purpose for which the record was collected;

(ii) Indicate to whom the record may be released;

(iii) Indicate the uses to which the information may be put by the receiving agency; and

(iv) Have been published previously in the Federal Register.

(3) A routine use will be established for each user of the information outside DeCA who need official access to the records. This use may be discontinued or amended without the consent of the individual/s involved. Any routine use that is new or changed is published in the Federal Register 30 days before actually disclosing the record. In addition to routine uses established by DeCA individual system notices, blanket routine uses have been established. See Appendix C to this part.

(d) Disclosure without consent. DeCA records may be disclosed without the consent of the individual to whom they pertain to another agency within or under the control of the U.S. for a civil or criminal law enforcement activity if:

(1) The civil or criminal law enforcement activity is authorized by law (Federal, State, or local); and

(2) The head of the agency or instrumentality (or designee) has made a written request to the Component specifying the particular record or portion desired and the law enforcement activity for which it is sought.

(3) Blanket requests for any and all records pertaining to an individual shall not be honored. The requesting agency or instrumentality must specify each record or portion desired and how each relates to the authorized law enforcement activity.

(4) This disclosure provision applies when the law enforcement agency or instrumentality request the record, If the DoD Component discloses a record outside the DoD for law enforcement purposes without the individual's consent and without an adequate written request, the disclosure must be pursuant to an established routine use, such as the blanket routine use for law enforcement.

(e) Disclosures to the public from health care records.

(1) The following general information may be released to the news media or public concerning a DeCA employee treated or hospitalized in DoD medical facilities and non-Federal facilities for whom the cost of the care is paid by DoD:

(i) Personal information concerning the patient that is provided in § 327.8 and under provisions of 32 CFR part 285.

(ii) The medical condition such as the date of admission or disposition and the present medical assessment of the individual's condition in the following terms if the medical doctor has volunteered the information:

(A) The individual's condition is presently (stable) (good) (fair) (serious) or (critical), and

(B) Whether the patient is conscious, semi-conscious or unconscious.

(2) Detailed medical and other personal information may be released on a DeCA employee only if the employee has given consent to the release. If the employee is not conscious or competent, no personal information, except that required by 32 CFR part 285, will be released until there has been enough improvement in the patient's condition for them to give informed consent.

(3) Any item of personal information may be released on a DeCA patient if the patient has given consent to its release.

(4) This part does not limit the disclosure of personal medical information for other government agencies' use in determining eligibility for special assistance or other benefits provided disclosure in pursuant to a routine use.

Footnotes - 327.8

^[7] See footnote 3 to § 327.5.

^[8] See footnote 3 to § 327.5.