36 CFR 903.10: Disclosure of records to persons or agencies.

(a) The Corporation will not disclose any record which is contained in a system of records, by any means of communication to any person or to another agency except:

(1) Pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains;

(2) To those officers and employees of the Corporation who have a need for the record in the performance of their duties;

(3) When required under 5 U.S.C. 522 (The Freedom of Information Act); or

(4) Pursuant to the conditions of disclosure contained in 5 U.S.C. 552a(b)(3) through 5 U.S.C. 522a(b)(11).

(b) The Privacy Protection Officer of the Corporation shall keep an accounting of each disclosure made pursuant to paragraph (a)(4) of this section, in accordance with 5 U.S.C. 552a(c). Except for disclosures made pursuant to 5 U.S.C. 552a(b)(7), the Privacy Protection Officer shall make the accounting kept under this paragraph available to an individual to whom the record pertains, upon his or her request. An individual requesting an accounting of disclosures should do so at the place, times and in the manner specified in § 903.3 (a) and (b).