PART 3424—PROTECTION OF PRIVACY AND FREEDOM OF INFORMATION

(a) If the Privacy Act of 1974 (Privacy Act) applies to a contract, the contracting officer must specify in the contract the disposition to be made of the system or systems of records upon completion of performance. For example, the contract may require the contractor to completely destroy the records, to remove personal identifiers, to turn the records over to ED, or to keep the records but take certain measures to keep the records confidential and protect the individual's privacy.

(b) If a notice of the system of records has not been published in the Federal Register , the contracting officer may proceed with the acquisition but must not award the contract until the notice is published, unless the contracting officer determines, in writing, that portions of the contract may proceed without maintaining information subject to the Privacy Act. In this case, the contracting officer may—

(1) Award the contract, authorizing performance only of those portions not subject to the Privacy Act; and

(2) After the notice is published and effective, authorize performance of the remainder of the contract.

In this section, research means a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge. (34 CFR 97.102(d)) Research is considered to involve human subjects when a researcher obtains information about a living individual through intervention or interaction with the individual or obtains personally identifiable private information about an individual. Some categories of research are exempt in accordance with 34 CFR part 97.

(a) The contracting officer must insert the provision in 3452.224–71 (Notice about research activities involving human subjects) in any solicitation where a resultant contract will include, or is likely to include, research activities involving human subjects covered under 34 CFR part 97.

(b) The contracting officer must insert the clause at 3452.224–72 (Research activities involving human subjects) in any solicitation that includes the provision in 3452.224–71 (Notice about research activities involving human subjects) and in any resultant contract.

The Department's regulations implementing the Freedom of Information Act, 5 U.S.C. 552, are in 34 CFR part 5.

(b) The Department's policy is to release all information incorporated into a contract and documents that result from the performance of a contract to the public under the Freedom of Information Act. The release or withholding of documents requested will be made on a case-by-case basis. Contracting officers must advise offerors and prospective contractors of the possibility that their submissions may be released under the Freedom of Information Act, not withstanding any restrictions that are included at the time of proposal submission. A clause substantially the same as the clause at 3452.224–70 (Release of information under the Freedom of Information Act) must be included in all solicitations and contracts.

This subpart implements the Family Educational Rights and Privacy Act (FERPA or the Act), 20 U.S.C. 1232g. Additional FERPA-implementing regulations are found at 34 CFR part 99.

It is the Department's policy to designate as its authorized representative, for purposes of compliance with FERPA, any contractor that will collect or receive access to personally identifiable information (PII) from student education records in connection with the conduct of an audit, evaluation, study, compliance review, or other Federal law enforcement activity. The Department will notify such contractors, or prospective contractors, prior to award or during contract performance of their obligations to protect student privacy in compliance with FERPA. Further, the Department will incorporate into all relevant solicitations and contracts the provisions and clauses needed to implement FERPA requirements. The aforementioned policies do not apply to Federal Student Aid (FSA) contracts for the origination, servicing, or collection of student financial aid, provided such contracts do not include tasks relating to the conduct of an audit, evaluation, study, compliance review, or other enforcement activity.

During acquisition planning, the requiring activity, in consultation with the Department's Senior Agency Official for Privacy (SAOP) and Director of the Student Privacy Policy Office (SPPO Director), must review requirements to determine whether the contract will require the Department to share PII from students' education records with its contractor or authorize its contractor to collect such PII from students' education records for the purposes of conducting a study, evaluation, or audit of a federally supported education program, or the enforcement of Federal legal requirements that relate to such education programs. The requiring activity must notify the contracting officer of the determination.

The contracting officer must insert the clause at 3452.224–73 in all solicitations and contracts, including those for the acquisition of commercial products or commercial services, when a requiring activity has provided notification that a contractor will collect or receive access to PII from student education records in connection with carrying out an audit, evaluation, study, compliance review, or other Federal law enforcement activity on behalf of the Department. The contracting officer must fill out paragraph (b) of the clause at 3452.224–73 with the type(s) of PII to be collected or accessed by contractor.