22 C.F.R. § 1101.3 – General policy: Collection and use of personal information.

(a) Heads of Divisions, Branches, and the projects shall ensure that all Section personnel subject to their supervision are advised of the provisions of the Act, including the criminal penalties and civil liabilities provided therein, and that Section personnel are made aware of their responsibilities to protect the security of personal information, to assure its accuracy, relevance, timeliness and completeness, to avoid unauthorized disclosure either orally or in writing, and to ensure that no system of records concerning individuals, no matter how small or specialized, is maintained without public notice.
(b) Section personnel shall:
1. (1) Collect no information of a personal nature from individuals unless authorized to collect it to achieve a function or carry out a responsibility or function of the Section.
2. (2) Collect from individuals only that information which is necessary to Section responsibilities or functions;
3. (3) Collect information, wherever possible, directly from the individual to whom it relates;
4. (4) Inform individuals from whom information is collected of the authority for collection, the purpose thereof, the uses that will be made of the information, and the effects, both legal and practical, of not furnishing the information;
5. (5) Neither collect, maintain, use nor disseminate information concerning an individual's religious or political beliefs or activities or his membership in associations or organizations, unless (i) the individual has volunteered such information for his own benefit; (ii) the information is expressly authorized by statute to be collected, maintained, used or disseminated; or (iii) the activities involved are pertinent to and within the scope of an authorized investigation or adjudication activity;
6. (6) Advise an individual's supervisors of the existence or contemplated development of any system of records which retrieves information about individuals by individual identified;
7. (7) Maintain an accounting of all disclosures of information to other than Section personnel;
8. (8) Disclose no information concerning individuals to other than Section personnel except when authorized by the Act or pursuant to a routine use published in the Federal Register;
9. (9) Maintain and process information concerning individuals with care in order to ensure that no inadvertent disclosure of the information is made to other than Section personnel; and
10. (10) Call to the attention of the PA Officer any information in a system maintained by the Section which is not authorized to be maintained under the provisions of the Act, including information on First Amendment activities, information that is inaccurate, irrelevant or so incomplete as to risk unfairness to the individual concerned.
(c) The system of records maintained by the Section shall be reviewed annually by the PA Officer to ensure compliance with the provisions of the Act.
(d) Information which may be used in making determinations about an individual's rights, benefits, and privileges shall, to the greatest extent practicable, be collected directly from that individual. In deciding whether collection of information from an individual, as opposed to a third party source, is practicable, the following criteria, among others, may be considered:
1. (1) Whether the nature of the information sought is such that it can only be obtained from a third party;
2. (2) Whether the cost of collecting the information from the individual is unreasonable when compared with the cost of collecting it from a third party;
3. (3) Whether there is a risk that information requested from the third parties, if inaccurate, could result in an adverse determination to the individual concerned;
4. (4) Whether the information, if supplied by the individual, would have to be verified by a third party; or
5. (5) Whether provisions can be made for verification by the individual of information collected from third parties.
(e) Employees whose duties require handling of records subject to the Act shall, at all times, take care to protect the integrity, security and confidentiality of these records.
(f) No employee of the section may alter or destroy a record subject to the Act unless (1) such alteration or destruction is properly undertaken in the course of the employee's regular duties or (2) such alteration or destruction is required by a decision of the Commissioner or the decision of a court of competent jurisdiction.