At least annually, the FHFA Privacy Act Officer or the Senior Agency Official for Privacy will inform employees about the provisions of the Privacy Act, including the Privacy Act's civil liability and criminal penalty provisions. Unless otherwise permitted by law, an authorized FHFA or FHFA-OIG employee shall—

Collect from individuals only information that is relevant and necessary to discharge FHFA or FHFA-OIG responsibilities;

Collect information about an individual directly from that individual whenever practicable;

Inform each individual from whom information is collected of—

The legal authority to collect the information and whether providing it is mandatory or voluntary;

The principal purpose for which FHFA or FHFA-OIG intends to use the information;

The routine uses FHFA or FHFA-OIG may make of the information; and

The effects on the individual, if any, of not providing the information.

Ensure that the employee's office does not maintain a system of records without public notice and notify appropriate officials of the existence or development of any system of records that is not the subject of a current or planned public notice;

Maintain all records that are used in making any determination about an individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to ensure fairness to the individual in the determination;

Except for disclosures made under FOIA, make reasonable efforts, prior to disseminating any record about an individual, to ensure that the record is accurate, relevant, timely, and complete;

When required by the Privacy Act, maintain an accounting in the specified form of all disclosures of records by FHFA or FHFA-OIG to persons, organizations, or Federal agencies;

Maintain and use records with care to prevent the unauthorized or inadvertent disclosure of a record to anyone; and

Notify the appropriate official of any record that contains information that the Privacy Act does not permit FHFA or FHFA-OIG to maintain.