(a) No Bureau component may contract for the operation of a record system by or on behalf of the Bureau without the express written approval of the Director or the Director's designee.

(b) Any contract which is approved shall contain the standard contract requirements promulgated by the General Services Administration (GSA) to ensure compliance with the requirements imposed by the Privacy Act. The contracting component shall have the responsibility to ensure that the contractor complies with the contract requirements relating to privacy.