In plain English
FAR 52.224-3, Privacy Training, is a contract clause prescribed at FAR 24.302, most recently dated Jan 2017. The complete official text is reproduced below, verbatim, from GSA's published FAR source files.
Its own text directs the contractor to include it in certain subcontracts, subject to the conditions quoted in the flowdown section below.
Does it flow down to subcontracts?
Flows down conditionally — mandate with stated conditions
“(f) The substance of this clause, including this paragraph (f), shall be included in all subcontracts under this contract, when subcontractor employees will- (1) Have access to a system of records; (2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information; or (3) Design, develop, maintain, or operate a system of records.”— FAR 52.224-3, paragraph (f), official text
Required in subcontracts by OTHER clauses
These clauses direct that FAR 52.224-3 be included in certain subcontracts:
“(e) (1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c), and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1), in a subcontract for commercial products or commercial services. … (xxii) (A) 52.224-3, Privacy Training (Jan 2017) (5 U.S.C. 552a).”— FAR 52.212-5, Contract Terms and Conditions Required To Implement Statutes or Executive Orders—Commercial Products and Commercial Services
“(c) (1) The Contractor shall insert the following clauses in subcontracts for commercial products or commercial services: (i) 52.203-13, Contractor Code of Business Ethics and Conduct (Nov 2021) (41 U.S.C. 3509), if the subcontract exceeds the threshold specified in FAR 3.1004(a) on the date of subcontract award, and … … (xx) (A) 52.224-3, Privacy Training (Jan 2017) (5 U.S.C. 552a) if flow down is required in accordance with 52.224-3(f).”— FAR 52.244-6, Subcontracts for Commercial Products and Commercial Services
Where it's prescribed
As prescribed in 24.302 , insert the following clause:
Prescribing reference: FAR 24.302.
The official text, verbatim
As prescribed in 24.302 , insert the following clause:
Privacy Training (Jan 2017)
-
(a) Definition. As used in this clause, "personally identifiable information" means information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. (See Office of Management and Budget (OMB) Circular A-130, Managing Federal Information as a Strategic Resource).
-
(b) The Contractor shall ensure that initial privacy training, and annual privacy training thereafter, is completed by contractor employees who-
-
(1) Have access to a system of records;
-
(2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information on behalf of an agency; or
-
(3) Design, develop, maintain, or operate a system of records (see also FAR subpart 24.3 and 39.105).
-
-
(c)
-
(1) "Privacy training shall address the key elements necessary for ensuring the safeguarding of personally identifiable information or a system of records. The training shall be role-based, provide foundational as well as more advanced levels of training, and have measures in place to test the knowledge level of users. At a minimum, the privacy training shall cover-
-
(i) The provisions of the Privacy Act of 1974 (5 U.S.C. 552a), including penalties for violations of the Act;
-
(ii) The appropriate handling and safeguarding of personally identifiable information;
-
(iii) The authorized and official use of a system of records or any other personally identifiable information;
-
(iv) The restriction on the use of unauthorized equipment to create, collect, use, process, store, maintain, disseminate, disclose, dispose or otherwise access personally identifiable information;
-
(v) The prohibition against the unauthorized use of a system of records or unauthorized disclosure, access, handling, or use of personally identifiable information; and
-
(vi) The procedures to be followed in the event of a suspected or confirmed breach of a system of records or the unauthorized disclosure, access, handling, or use of personally identifiable information (see OMB guidance for Preparing for and Responding to a Breach of Personally Identifiable Information).
-
-
(2) Completion of an agency-developed or agency-conducted training course shall be deemed to satisfy these elements.
-
-
(d) The Contractor shall maintain and, upon request, provide documentation of completion of privacy training to the Contracting Officer.
-
(e) The Contractor shall not allow any employee access to a system of records, or permit any employee to create, collect, use, process, store, maintain, disseminate, disclose, dispose or otherwise handle personally identifiable information, or to design, develop, maintain, or operate a system of records unless the employee has completed privacy training, as required by this clause.
-
(f) The substance of this clause, including this paragraph (f), shall be included in all subcontracts under this contract, when subcontractor employees will-
-
(1) Have access to a system of records;
-
(2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information; or
-
(3) Design, develop, maintain, or operate a system of records.
-
(End of clause)
Alternate I (Jan 2017). As prescribed in 24.302 (b), if the agency specifies that only its agency-provided training is acceptable, substitute the following paragraph (c) for paragraph (c) of the basic clause:
(c) The contracting agency will provide initial privacy training, and annual privacy training thereafter, to Contractor employees for the duration of this contract.