scope:

Purpose

The purpose of this regulation is to establish and maintain a comprehensive Army Privacy and Civil Liberties Program that complies with applicable statutory, regulatory, and policy requirements. Army policy concerning the privacy and civil liberties of individuals and the Army's responsibilities for compliance with the Privacy Act (PA) are as follows:

a. Comply with all applicable guidelines-

(1) Privacy and civil liberties related laws, including requirements of the PA of 1974, while ensuring that the PA system of records notices (SORNs) are published, revised, and rescinded, as required.

(2) Privacy statutes and policies governing the disclosure or dissemination of information, and any other valid access, use, and dissemination restrictions.

(3) Executive orders (EOs), Intelligence Community directives, and other applicable guidance to DoD Components conducting intelligence activities with respect to privacy and civil liberties matters (for example, EO 12333 and DoDM 5240.01).

b. Maintain all records with personally identifiable information (PII) in accordance with AR 25-400-2 which mandates use of the Army records retention schedule according to the National Archives and Records Administration.

c. Limit the creation, collection, use, processing, storage, maintenance, dissemination, and disclosure of PII to that which is legally authorized, relevant, and reasonably deemed necessary to accomplish the Army's function.

d. Impose conditions when sharing PII with other federal and non-federal agencies or entities (including the selection and implementation of particular security and privacy controls) that govern the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal of the PII, where appropriate. This will be accomplished using written agreements, including contracts, data use agreements, information exchange agreements, and memoranda of understanding.

e. Maintain adequate procedures to receive, investigate, respond to, and redress complaints from individuals who allege that the organization has violated their privacy and civil liberties.

f. Prohibit reprisals or the threat of reprisals against individuals who make complaints or disclose information that indicates a possible violation of privacy protections or civil liberties in the administration of the programs and operations of the Federal Government to the privacy or civil liberties officers as described in Subsection (a) or (b) of Section 2000ee-1, Title 42, United States Code (42 USC 2000ee-1).

g. Ensure no reprisals or threats of reprisal take place against individuals who make complaints, unless the complaint was made or the information was disclosed with the knowledge that it was false or with willful disregard for its truth or falsity.

h. This regulation does not create any rights, privileges, or benefits, substantive or procedural, enforceable by any party against the United States, its departments, agencies, other entities, its officers, or any other persons.