24.104
Contract clauses
Insert Privacy Act clauses 52.224-1 and 52.224-2 in contracts requiring contractors to handle systems of records on individuals.
Overview
FAR 24.104 mandates the inclusion of specific Privacy Act clauses in solicitations and contracts when a contractor is required to design, develop, or operate a system of records on individuals to fulfill an agency function. This ensures that contractors are aware of and comply with the Privacy Act requirements regarding the handling of personal information. The two required clauses are 52.224-1 (Privacy Act Notification) and 52.224-2 (Privacy Act), which outline the contractor's responsibilities for protecting individual privacy and complying with federal privacy regulations.
Key Rules
- Clause 52.224-1, Privacy Act Notification
- Notifies contractors that the Privacy Act applies to the contract and that they may be required to design, develop, or operate a system of records on individuals.
- Clause 52.224-2, Privacy Act
- Establishes the contractor's obligations for compliance with the Privacy Act, including safeguarding personal data and following agency procedures for handling records.
Responsibilities
- Contracting Officers: Must insert the specified Privacy Act clauses in applicable solicitations and contracts.
- Contractors: Must comply with the requirements of the Privacy Act as outlined in the clauses, including proper handling and protection of personal information.
- Agencies: Oversee contractor compliance with privacy requirements and ensure proper clause inclusion.
Practical Implications
- This section exists to ensure that contractors are contractually bound to protect individual privacy when handling systems of records.
- It impacts daily contracting by requiring careful review of contract scope and ensuring the correct clauses are included.
- Common pitfalls include failing to include the required clauses or misunderstanding the scope of "system of records," which can lead to noncompliance with federal privacy laws.