Attach 17.doc

Attachment 17, Section J

ATTACHMENT 17

Non-Disclosure Agreement

(National Driver Register Records Security and Maintenance Regulations)

National Driver Register Records Security and Maintenance Regulations It is essential that the National Driver Register (NDR) Records Security and Maintenance Regulations enumerated below be carefully studied by all NDR personnel (including computer center employees) to prevent misunderstandings resulting in a violation of office policy or Federal law, including the Privacy Act of 1974 (Public Law 93-579).

The Privacy Act was promulgated to promote governmental respect for the privacy of citizens by requiring Federal agencies to observe certain rules and regulations relating to the maintenance and use of personal information. It is intended to eliminate the collection and maintenance of irrelevant and unnecessary personal information, and to insure that information which collected is correct, timely and relevant to its purpose. The Act provides that any Federal employee may be convicted of a misdemeanor and fined not more than $5,000 for taking or failing to take certain actions, including wrongfully disclosing information.

The degree of security required is dictated by the sensitivity of the data processed and recorded. NDR records are, for the most part, already matters of public record within the originating State. Additionally, NDR records are highly abstracted as would benefit their index purpose. Although of a very low order of sensitivity, these records nevertheless contain privileged information, the nature of which compels NDR adherence to a set of security safeguard regulations which incorporate pertinent Privacy Act provisions. The following NDR security regulations prescribe relevant personnel conduct, restrictions, and policies.

I.

Physical Security of NDR Privileged Information and Data

· All NDR employees (including computer center employees) shall be orally briefed on NDR security requirements and their responsibilities.

· NDR contracts shall have security clauses and each contractor shall ensure that adequate security measures relevant to NDR sensitive materials are in effect at his place of business. NDR data will be stored in cabinets or other containers which are attended during working hours and when unattended are locked. Files will be stored in an attended room with controlled access which is locked when unattended. Automated machinery will have controlled access procedures in effect at all times.

· The master file shall be kept in the (vendor=s name) Computer Center, a limited access area. The source data files and extracts from source material shall be maintained in a building under surveillance of a 24-hour security force. In addition, the spaces in which the files are maintained shall be equipped with doors with proprietary locks which are locked when vacated.

· Sensitive matter shall not be left unattended outside the authorized working area and it shall at all times be concealed from casual observation by visitors. It must also not be communicated to non-NDR employees either orally or in writing without the express approval of the Chief, NDR.

· Sensitive matter designated for disposal shall be destroyed by burning, shredding, or pulverizing. Whatever method used, such destruction shall be so complete as to reasonably preclude the reconstruction or recovery of information which could be identifiable to a specific person.

· All disks, with the exception of those tapes exempted by the NDR Contracting Officer=s Technical Representative, shall be erased prior to returning them to the States or prior to disposing of them.

II.

Maintenance of NDR Records

· NDR personnel shall only maintain a register identifying each individual reported to them by a State, as an individual with respect to whom such State or political subdivision has denied, terminated, or temporarily withdrawn (except a withdrawal for less than six months based on a series of non-moving violations) an individual's license or privilege to operate a motor vehicle.

· All driver records maintained by NDR about any individual shall be done so with such accuracy, relevancy, timeliness and completeness as is reasonably necessary and possible to assure fairness to the individual in the event of disclosure.

· With the exception of the automatic master file deletion of records based on age, records shall be removed from the NDR master file only at the express request of authorized State officials. In accordance with individual State requirements copies of deleted records may be sent to the requesting State with a letter or notation as to what actions were taken and the reasons therefore.

III.

Protection of NDR Records

· No person shall, without permission, remove any record made available to him for inspection or copying from the place where it is made available. In addition, no person shall steal, alter, mutilate, obliterate, or destroy, in whole or in part, such a record.

· Section 641 of Title 18 of the United States Code provides, in pertinent part, as follows:

Whoever . . . steals, purloins, or knowingly converts to his use or the use of another, or without authority sells, conveys or disposes of any record . . . or thing of value of the United States or of any department or agency thereof . . . shall be fined not more than $10,000 or imprisoned for not more than 10 years or both; but if the value of such property does not exceed the sum of $100, he shall be fined not more than $1,000 or imprisoned not more than one year or both. . .

· Section 2071 of Title 18 of the United States Code provides, in pertinent part, as follows:

Whoever willfully and unlawfully conceals, removes, mutilates, obliterates, or destroys, or attempts to do so, or with intent to do so takes and carries away any record, proceeding, map, book, paper, document, or other thing, filed or deposited . . . in any public office, or with any . . . public officer of the Untied States, shall be fined not more than $2,000 or imprisoned not more than 3 years, or both.

IV.

Improper Disclosure of NDR Records

· Only at the request of a State driver licensing authority or a Federal department or agency, shall NDR personnel furnish information contained in the register and such information shall be furnished only to the requesting party and only with respect to an individual applicant for a motor vehicle operator's license or permit.

· As used in the National Driver Register Act, Public Law 89-563, the term "State" includes each of the several States, the Commonwealth of Puerto Rico, the District of Columbia, Guam, the Virgin Islands, the Canal Zone, and American Samoa.

· Section 3(i)1 of the Privacy Act provides as follows:

Any officer or employee of the Department who by virtue of his employment or official position, has possession of, or access to, agency records which contain individually identifiable information the disclosure of which is prohibited . . . and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

V.

Wrongfully Obtaining NDR Records Section 3(i)3 of the Privacy Act provides as follows:

Any person who knowingly and willfully requests or obtains any record concerning an individual from the Department under false pretenses shall be guilty of a misdemeanor and fined not more than $5,000.

VI.

Liability of Government Contractors When the Department provides by a contract for the operation by or on behalf of the Department of a system of records to accomplish a function of the Department, the requirements of the Department applicable to its own employees (e.g., NDR employees) shall be applied to such system. For purposes of criminal penalties spelled out in Sections IV and V above, any such contractor and any employee of the contractor, if the contract is agreed to on or after September 27, 1975, shall be considered, in accordance with Section 3(m) of the Privacy Act, to be an employee of the Department.

Acknowledgement We, the persons named below, either employed with, detailed to, or working under contract to the National Driver Register, National Highway Traffic Safety Administration, United States Department of Transportation, do hereby acknowledge, through affixation of our signatures, that we have carefully read the above NDR Records Security and Maintenance provisions and fully understand the contents thereof.

Name

Employer Date