48 CFR Part 3424 — Protection of Privacy and Freedom of Information

PART 3424—PROTECTION OF PRIVACY AND FREEDOM OF INFORMATION Authority: 5 U.S.C. 301. Source: 88 FR 60542, Sept. 1, 2023, unless otherwise noted. Subpart 3424.1—Protection of Individual Privacy 3424.103 Procedures. (a) If the Privacy Act of 1974 (Privacy Act) applies to a contract, the contracting officer must specify in the contract the disposition to be made of the system or systems of records upon completion of performance. For example, the contract may require the contractor to completely destroy the records, to remove personal identifiers, to turn the records over to ED, or to keep the records but take certain measures to keep the records confidential and protect the individual's privacy. (b) If a notice of the system of records has not been published in the Federal Register , (1) Award the contract, authorizing performance only of those portions not subject to the Privacy Act; and (2) After the notice is published and effective, authorize performance of the remainder of the contract. 3424.170 Protection of human subjects. In this section, research (a) The contracting officer must insert the provision in 3452.224-71 (Notice about research activities involving human subjects) in any solicitation where a resultant contract will include, or is likely to include, research activities involving human subjects covered under 34 CFR part 97. (b) The contracting officer must insert the clause at 3452.224-72 (Research activities involving human subjects) in any solicitation that includes the provision in 3452.224-71 (Notice about research activities involving human subjects) and in any resultant contract. Subpart 3424.2—Freedom of Information Act 3424.201 Authority. The Department's regulations implementing the Freedom of Information Act, 5 U.S.C. 552, are in 34 CFR part 5. 3424.203 Policy. (b) The Department's policy is to release all information incorporated into a contract and documents that result from the performance of a contract to the public under the Freedom of Information Act. The release or withholding of documents requested will be made on a case-by-case basis. Contracting officers must advise offerors and prospective contractors of the possibility that their submissions may be released under the Freedom of Information Act, not withstanding any restrictions that are included at the time of proposal submission. A clause substantially the same as the clause at 3452.224-70 (Release of information under the Freedom of Information Act) must be included in all solicitations and contracts. Subpart 3424.7—The Family Educational Rights and Privacy Act 3424.701 Authority. This subpart implements the Family Educational Rights and Privacy Act (FERPA or the Act), 20 U.S.C. 1232g. Additional FERPA-implementing regulations are found at 34 CFR part 99. 3424.702 Policy. It is the Department's policy to designate as its authorized representative, for purposes of compliance with FERPA, any contractor that will collect or receive access to personally identifiable information (PII) from student education records in connection with the conduct of an audit, evaluation, study, compliance review, or other Federal law enforcement activity. The Department will notify such contractors, or prospective contractors, prior to award or during contract performance of their obligations to protect student privacy in compliance with FERPA. Further, the Department will incorporate into all relevant solicitations and contracts the provisions and clauses needed to implement FERPA requirements. The aforementioned policies do not apply to Federal Student Aid (FSA) contracts for the origination, servicing, or collection of student financial aid, provided such contracts do not include tasks relating to the conduct of an audit, evaluation, study, compliance review, or other enforcement activity. 3424.703 Procedures. During acquisition planning, the requiring activity, in consultation with the Department's Senior Agency Official for Privacy (SAOP) and Director of the Student Privacy Policy Office (SPPO Director), must review requirements to determine whether the contract will require the Department to share PII from students' education records with its contractor or authorize its contractor to collect such PII from students' education records for the purposes of conducting a study, evaluation, or audit of a federally supported education program, or the enforcement of Federal legal requirements that relate to such education programs. The requiring activity must notify the contracting officer of the determination. 3424.704 Contract clause. The contracting officer must insert the clause at 3452.224-73 in all solicitations and contracts, including those for the acquisition of commercial products or commercial services, when a requiring activity has provided notification that a contractor will collect or receive access to PII from student education records in connection with carrying out an audit, evaluation, study, compliance review, or other Federal law enforcement activity on behalf of the Department. The contracting officer must fill out paragraph (b) of the clause at 3452.224-73 with the type(s) of PII to be collected or accessed by contractor.

Related documents

• 48 CFR Part 2124 — Protection of Privacy and Freedom of Information#511498
• 48 CFR Part 1324 — Protection of Privacy and Freedom of Information#511280
• 48 CFR Part 2924 — Protection of Privacy and Freedom of Information#511601
• 48 CFR Part 324 — Protection of Privacy and Freedom of Information#510980
• 48 CFR Part 924 — Protection of Privacy and Freedom of Information#511194