ABOUT THE OFFICE
Defense Privacy Board Advisory Opinions
INFORMATION ON FORMS ATTACHED TO SECURITY CONTAINERS OR FACILITIES IS SUBJECT TO THE PRIVACY ACT
Information consisting of names, home addresses and telephone numbers of persons designated as custodians of security storage containers or facilities, when contained in a system of records, is protected by the Privacy Act. Solicitation of such information is necessary to accomplish official Department of Defense (DoD) duties relating to protection of information stored in the containers or facilities, but it requires providing a Privacy Act advisory statement to individuals from whom and when the information is solicited. 5 U.S.C. § 552a(e)(3). This information, when appended to the exterior of a storage facility or container, is observable by any passer–by who may not be an officer or employee officially concerned with the activity. 5 U.S.C. § 552a(b)(1). Therefore, it is a disclosure subject to disclosure accounting requirements of the Act. 5 U.S.C. § 552a(c)(1). Such an accounting, however, would be impossible because of the difficulty of identifying all viewers.
The General Services Administration (GSA) has recognized that this information is subject to the Privacy Act and has revised Optional Form 63 to include a Privacy Act advisory statement and to instruct that the form be attached to the interiors of safes. When such a tag is placed inside a safe, the disclosure is limited to those officers and employees who have a need–to–know and a disclosure accounting is not required. 5 U.S.C. § 552a(b)(1)and (c)(1).
Alternatives to the disclosure accounting requirements when the information is to be displayed outside the security container or facility are:
- Request the individual's prior written consent for a single particular transaction; i.e., consent to disclosure of name, home address and telephone number for a particular safe, or
- Require notification of appropriate duty personnel with access to a control roster containing the custodians' information so they may be contacted in the case of a security problem.