(a) Unauthorized disclosure. Criminal penalties may be imposed against any officer or employee of NACIC who, by virtue of employment, has possession of or access to NACIC records which contain information identifiable with an individual, the disclosure of which is prohibited by the Privacy Act or by these rules, and who, knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive same.

(b) Unauthorized maintenance. Criminal penalties may be imposed against any officer or employee of NACIC who willfully maintains a system of records without meeting the requirements of section (e)(4) of the Privacy Act, 5 U.S.C. 552a. The Coordinator and the Director of NACIC are authorized independently to conduct such surveys and inspect such records as necessary from time to time to ensure that these requirements are met.

(c) Unauthorized requests. Criminal penalties may be imposed upon any person who knowingly and willfully requests or obtains any record concerning an individual from NACIC under false pretenses.