28 CFR 22.26: Requests for transfer of information.

(a) Requests for transfer of information identifiable to an individual shall be submitted to the person submitting the Privacy Certificate pursuant to § 22.23.

(b) Except where information is requested by BJA, OJJDP, BJS, NIJ, or OJP, the request shall describe the general objectives of the project for which information is requested, and specifically justify the need for such information in identifiable form. The request shall also indicate, and provide justification for the conclusion that conduct of the project will not, either directly or indirectly, cause legal, economic, physical, or social harm to individuals whose identification is revealed in the transfer of information.

(c) Data may not be transferred pursuant to this section where a clear showing of the criteria set forth above is not made by the person requesting the data.