52.224-2 Privacy Act
Source: FAR 52.224-2 on acquisition.gov
Contractors must comply with the Privacy Act and ensure all subcontractors do the same when handling systems of records on individuals for federal agencies.
Overview
FAR 52.224-2, Privacy Act, requires contractors to comply with the Privacy Act of 1974 and related agency regulations when they are involved in the design, development, or operation of a system of records on individuals to accomplish an agency function. This clause ensures that contractors and their subcontractors handle personal information in accordance with federal privacy standards, and it establishes both civil and criminal liabilities for violations. The clause also defines key terms such as "operation of a system of records," "record," and "system of records on individuals," clarifying the scope of contractor responsibilities.
Key Rules
- Compliance with the Privacy Act
- Contractors must follow the Privacy Act and agency-specific rules when working on systems of records identified in the contract.
- Flowdown Requirements
- Contractors must include the Privacy Act notification and this clause in all relevant subcontracts and solicitations involving systems of records.
- Liability for Violations
- Contractors may be treated as agency employees for the purposes of the Act, and violations can result in civil actions or criminal penalties.
- Definitions
- The clause provides specific definitions for key terms to ensure clarity in compliance obligations.
Responsibilities
- Contracting Officers: Ensure the clause is included in applicable contracts and that systems of records are clearly identified.
- Contractors: Comply with the Privacy Act, flow down requirements to subcontractors, and understand liability implications.
- Agencies: Oversee contractor compliance and enforce privacy protections.
Practical Implications
- This clause exists to protect individuals’ personal information handled by contractors.
- It impacts daily operations by requiring strict privacy controls and documentation.
- Common pitfalls include failing to flow down the clause to subcontractors or misunderstanding the scope of "system of records."
As prescribed in 24.104 , insert the following clause in solicitations and contracts, when the design, development, or operation of a system of records on individuals is required to accomplish an agency function:
Privacy Act (Apr 1984)
(a) The Contractor agrees to-
(1) Comply with the Privacy Act of1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies-
(i) The systems of records; and
(ii) The design, development, or operation work that the contractor is to perform;
(2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and
(3) Include this clause, including this paragraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a system of records.
(b) In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.
(c)
(1) "Operation of a system of records," as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.
(2) "Record," as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.
(3) "System of records on individuals," as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.
(End of clause)