(a) ODNI will not maintain a record unless:
(1) It is relevant and necessary to accomplish an ODNI function required by statute or Executive Order;
(2) It is acquired to the greatest extent practicable from the subject individual when ODNI may use the record to make any determination about the individual;
(3) The individual providing the record is informed of the authority for providing the record (including whether providing the record is mandatory or voluntary), the principal purpose for maintaining the record, the routine uses for the record, and what effect refusing to provide the record may have;
(4) It is maintained with such accuracy, relevance, timeliness and completeness as is reasonably necessary to ensure fairness to the individual in the determination;
(b) Except as to disclosures made to an agency or made under the FOIA, ODNI will make reasonable efforts prior to disseminating a record about an individual, to ensure that the record is accurate, relevant, timely, and complete;
(c) ODNI will not maintain or develop a system of records that is not the subject of a current or planned public notice;
(d) ODNI will not adopt a routine use of information in a system without notice and invitation to comment published in the Federal Register at least 30 days prior to final adoption of the routine use;
(e) To the extent ODNI participates with a non-Federal agency in matching activities covered by section (8) of the Act, ODNI will publish notice of the matching program in the Federal Register;
(f) ODNI will not maintain a record which describes how an individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the subject individual, or unless pertinent to and within the scope of an authorized law enforcement activity;
(g) When required by the Act, ODNI will maintain an accounting of all disclosures of records by the ODNI to persons, organizations or agencies;
(h) Each ODNI component shall implement administrative, physical and technical controls to prevent unauthorized access to its systems of records, to prevent unauthorized disclosure of records, and to prevent physical damage to or destruction of records;
(i) ODNI will establish rules and instructions for complying with the requirements of the Privacy Act, including notice of the penalties for non-compliance, applicable to all persons involved in the design, development, operation or maintenance of any system of records.