28 CFR 22.28: Use of data identifiable to a private person for judicial, legislative or administrative purposes.

(a) Research or statistical information identifiable to a private person shall be immune from legal process and shall only be admitted as evidence or used for any purpose in any action, suit, or other judicial, legislative or administrative proceeding with the written consent of the individual to whom the data pertains.

(b) Where consent is obtained, such consent shall:

(1) Be obtained at the time that information is sought for use in judicial, legislative or administrative proceedings;

(2) Set out specific purposes in connection with which information will be used;

(3) Limit, where appropriate, the scope of the information subject to such consent.