(b)(i) The Contracting officer shall reference the following documents in solicitations and contracts that require the design, development, or operation of a system of records:

(A) DoD Directive 5400.11 (DoD Privacy and Civil Liberties Programs).

(B) DoD 5400.11-R (DoD Privacy Program).

(C) Regulations for community-specific protected information, as applicable, e.g. DoD Manual 6025.18, Implementation of the Health Insurance Portability and Accountability Act (HIPPA) Privacy Rule in DoD Health Care Programs..

(ii) The Contracting officer will ensure that work statements that require the design, development, or operation of a system of records include procedures to follow in the event of a Personal Identifiable Information (PII) breach.

(iii) The Contracting officer should ensure that Government surveillance plans for contracts that require the design, development, or operation of a system of records include monitoring of the contractor’s adherence to Privacy Act/PII regulations. The assessing official should document contractor-caused breaches or other incidents related to PII in past performance reports. (See AFARS 5142.1503-90(b).) Such incidents include instances in which the contractor did not adhere to Privacy Act/PII contractual requirements.

(a) Contracting officers must follow instructions in Army Regulation (AR) 25-55 (The Department of the Army Freedom of Information Act Program) for the denial of, or release of, acquisition information.

(b)(i) The Assistant Secretary of the Army (Acquisition, Logistics and Technology) has delegated the initial denial authority to act on requests for procurement records under the Freedom of Information Act, except those procurement records under the purview of the Chief of Engineers and the Commander, Army Materiel Command, to the heads of the contracting activities (HCAs). The HCAs may further delegate this authority only to the senior contracting official (SCO).

(ii) If the Contracting officer concludes that he/she should deny some or all information requested, he/she must prepare the proposed response for the HCA in accordance with AR 25-55. The response must include appeal language substantially the same as the following:

“You may appeal, in whole or in part, this denial to the Secretary of the Army (attn: Office of the General Counsel). In the event you decide to appeal, your letter of appeal must be postmarked no later than 60 calendar days after the date of this denial letter. Please address your appeal to (HCA address). This denial is made on behalf of the Initial Denial Authority, (name and title), by (name and rank), HCA (office).” (Substitute SCO for HCA if the SCO is the HCA’s designee .)

(iii) Contracting officers in contracting activities other than the Army Materiel Command and the United States Army Corps of Engineers must send the proposed denial response to the HCA or, if delegated, to the SCO. Include copies of the records recommended for denial with a justification for the denial. Contracting officers in the Army Materiel Command and the United States Army Corps of Engineers must follow the procedures specified by their headquarters.

(iv) After coordination with counsel, the HCA will provide the denial response, modified, if necessary, to the requestor.

(v) Within three working days of receipt of appeals, HCAs must send notice, the appeal and the documents required by AR 25-55 to the Office of the General Counsel at the following address:

ATTN: SAGC

General Counsel

104 Army Pentagon

Washington, DC 20310-0104.