Navigate

UL-2

UL-2: Information Sharing With Third Parties

The organization:

UL-2a.: Shares personally identifiable information (PII) externally, only for the authorized purposes identified in the Privacy Act and/or described in its notice(s) or for a purpose that is compatible with those purposes;

UL-2b.: Where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically describe the PII covered and specifically enumerate the purposes for which the PII may be used;

UL-2c.: Monitors, audits, and trains its staff on the authorized sharing of PII with third parties and on the consequences of unauthorized use or sharing of PII; and

UL-2d.: Evaluates any proposed new instances of sharing PII with third parties to assess whether the sharing is authorized and whether additional or new public notice is required.

Supplemental

The organization Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO) and, where appropriate, legal counsel review and approve any proposed external sharing of PII, including with other public, international, or private sector entities, for consistency with uses described in the existing organizational public notice(s). When a proposed new instance of external sharing of PII is not currently authorized by the Privacy Act and/or specified in a notice, organizations evaluate whether the proposed external sharing is compatible with the purpose(s) specified in the notice. If the proposed sharing is compatible, organizations review, update, and republish their Privacy Impact Assessments (PIAs), System of Records Notices (SORNs), website privacy policies, and other public notices, if any, to include specific descriptions of the new uses(s) and obtain consent where appropriate and feasible. Information- sharing agreements also include security protections consistent with the sensitivity of the information being shared.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to UL-2.

Control	Description
AP-2	The organization describes the purpose(s) for which personally identifiable information (PII) is collected, used, maintained, and shared in its privacy notices.
AR-3	The organization: AR-3a.: Establishes privacy roles, responsibilities, and access requirements for contractors and service providers; and AR-3b.: Includes privacy requirements in contracts and other acquisition-related documents.
AR-4	The organization monitors and audits privacy controls and internal privacy policy [Assignment: organization-defined frequency] to ensure effective implementation.
AR-5	The organization: AR-5a.: Develops, implements, and updates a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures; AR-5b.: Administers basic privacy training [Assignment: organization-defined frequency, at least annually] and targeted, role-based privacy training for personnel having responsibility for personally identifiable information (PII) or for activities that involve PII [Assignment: organization-defined frequency, at least annually]; and AR-5c.: Ensures that personnel certify (manually or electronically) acceptance of responsibilities for privacy requirements [Assignment: organization-defined frequency, at least annually].
AR-8	The organization: AR-8a.: Keeps an accurate accounting of disclosures of information held in each system of records under its control, including: AR-8a.1.: Date, nature, and purpose of each disclosure of a record; and AR-8a.2.: Name and address of the person or agency to which the disclosure was made; AR-8b.: Retains the accounting of disclosures for the life of the record or five years after the disclosure is made, whichever is longer; and AR-8c.: Makes the accounting of disclosures available to the person named in the record upon request.
DI-1	The organization: DI-1a.: Confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the accuracy, relevance, timeliness, and completeness of that information; DI-1b.: Collects PII directly from the individual to the greatest extent practicable; DI-1c.: Checks for, and corrects as necessary, any inaccurate or outdated PII used by its programs or systems [Assignment: organization-defined frequency]; and DI-1d.: Issues guidelines ensuring and maximizing the quality, utility, objectivity, and integrity of disseminated information.
DI-2	The organization: DI-2a.: Documents processes to ensure the integrity of personally identifiable information (PII) through existing security controls; and DI-2b.: Establishes a Data Integrity Board when appropriate to oversee organizational Computer Matching Agreements and to ensure that those agreements comply with the computer matching provisions of the Privacy Act.
IP-1	The organization: IP-1a.: Provides means, where feasible and appropriate, for individuals to authorize the collection, use, maintaining, and sharing of personally identifiable information (PII) prior to its collection; IP-1b.: Provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the collection, use, dissemination, and retention of PII; IP-1c.: Obtains consent, where feasible and appropriate, from individuals prior to any new uses or disclosure of previously collected PII; and IP-1d.: Ensures that individuals are aware of and, where feasible, consent to all uses of PII not initially described in the public notice that was in effect at the time the organization collected the PII.
TR-1	The organization: TR-1a.: Provides effective notice to the public and to individuals regarding: (i) its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII); (ii) authority for collecting PII; (iii) the choices, if any, individuals may have regarding how the organization uses PII and the consequences of exercising or not exercising those choices; and (iv) the ability to access and have PII amended or corrected if necessary; TR-1b.: Describes: (i) the PII the organization collects and the purpose(s) for which it collects that information; (ii) how the organization uses PII internally; (iii) whether the organization shares PII with external entities, the categories of those entities, and the purposes for such sharing; (iv) whether individuals have the ability to consent to specific uses or sharing of PII and how to exercise any such consent; (v) how individuals may obtain access to PII; and (vi) how the PII will be protected; and TR-1c.: Revises its public notices to reflect changes in practice or policy that affect PII or changes in its activities that impact privacy, before or as soon as practicable after the change.

Enhancements

The controls below (if any) add on to the requirements of UL-2.

Control	Description
No controls

Related CCIs

The CCIs below are tied to UL-2.

CCI	Definition
CCI-003589	The organization shares personally identifiable information (PII) externally, only for the authorized purposes identified in the Privacy Act and/or described in its notice(s) or for a purpose that is compatible with those purposes.
CCI-003590	The organization, where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically describe the personally identifiable information (PII) covered.
CCI-003591	The organization, where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically enumerate the purposes for which the personally identifiable information (PII) may be used.
CCI-003592	The organization monitors its staff on the authorized sharing of personally identifiable information (PII) with third parties.
CCI-003593	The organization audits its staff on the authorized sharing of personally identifiable information (PII) with third parties.
CCI-003594	The organization trains its staff on the authorized sharing of personally identifiable information (PII) with third parties.
CCI-003595	The organization trains its staff on the consequences of unauthorized use or sharing of personally identifiable information (PII).
CCI-003596	The organization evaluates any proposed new instances of sharing personally identifiable information (PII) with third parties to assess whether the sharing is authorized.
CCI-003597	The organization evaluates any proposed new instances of sharing personally identifiable information (PII) with third parties to assess whether additional or new public notice is required.