(a) General. The DNI has determined that invoking exemptions under the Privacy Act and continuing exemptions previously asserted by agencies whose records ODNI receives is necessary: to ensure against the release of classified information essential to the national defense or foreign relations; to protect intelligence sources and methods; and to maintain the integrity and effectiveness of intelligence, investigative and law enforcement processes. Accordingly, as authorized by the Privacy Act, 5 U.S.C. 552a, subsections (j) and (k), and in accordance with the rulemaking procedures of the Administrative Procedures Act, 5 U.S.C. 553, the ODNI shall:

1. (1) Exercise its authority pursuant to subsections (j) and (k) of the Privacy Act to exempt certain ODNI systems of records or portions of systems of records from various provisions of the Privacy Act; and
2. (2) Continue in effect and assert all exemptions claimed under Privacy Act subsections (j) and (k) by an originating agency from which the ODNI obtains records where the purposes underlying the original exemption remain valid and necessary to protect the contents of the record.

(b) Related policies.

1. (1) The exemptions asserted apply to records only to the extent they meet the criteria of subsections (j) and (k) of the Privacy Act, whether claimed by the ODNI or the originator of the records.
2. (2) Discretion to supersede exemption: Where complying with a request for access or amendment would not appear to interfere with or adversely affect a counterterrorism or law enforcement interest, and unless prohibited by law, the D/IMO may exercise his discretion to waive the exemption. Discretionary waiver of an exemption with respect to a record will not obligate the ODNI to waive the exemption with respect to any other record in an exempted system of records. As a condition of such discretionary access, ODNI may impose any restrictions (e.g., concerning the location of file reviews) deemed necessary or advisable to protect the security of agency operations, information, personnel, or facilities.
3. (3) Records in ODNI systems also are subject to protection under 50 U.S.C. 403-1(i), the provision of the National Security Act of 1947 which requires the DNI to protect intelligence sources and methods from unauthorized disclosure.