(1) Unauthorized disclosure. Criminal penalties may be imposed against any ODNI staff who, by virtue of employment, has possession or access to ODNI records which contain information identifiable with an individual, the disclosure of which is prohibited by the Privacy Act or by these rules, and who, knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it.

(2) Unauthorized maintenance. Criminal penalties may be imposed against any ODNI staff who willfully maintains a system of records without meeting the requirements of subsection (e)(4) of the Privacy Act, 5 U.S.C. 552a. The D/IMO, the Civil Liberties Protection Officer, the General Counsel, and the Inspector General are authorized independently to conduct such surveys and inspect such records as necessary from time to time to ensure that these requirements are met.

(3) Unauthorized requests. Criminal penalties may be imposed upon any person who knowingly and willfully requests or obtains any record concerning an individual from the ODNI under false pretenses.