Sign In
  • Question

    Where can I find simple, clear written information defining the intent of this clause. Lots of legal language, but nothing that is simple and to the point. What is the intent of this clause - for companies to have training and a process to protect their employees, or for contracts/subcontractors to have training/process when they are accessing government systems, and have access to government employees personal identifiable information?


    Answer

    Your question was in regard to FAR 52.224-3 Privacy Training. Specifically, you wanted to know “Where can I find simple, clear written information defining the intent of this clause.  Lots of legal language, but nothing that is simple and to the point.  What is the intent of this clause - for companies to have training and a process to protect their employees, or for contracts/subcontractors to have training/process when they are accessing government systems, and have access to government employees personal identifiable information?” You stated that “As a subcontractor, we have taken exception to this clause on multiple contracts as the effort of the Quote/PO does not require our employees to have access to a system of records, to personal identifiable information to the Prime, or Government. employees, or to store, maintain etc. this type of information.  We are getting pushback from our Prime stating we are required to meet this requirement for our internal employees by being a supplier to a DoD contract, and the intent has nothing to do with government employees or systems.”

    FAR 24.302 states “(a) The contracting officer shall insert the clause at FAR 52.224-3, Privacy Training, in solicitations and contracts when, on behalf of the agency, contractor employees will--

    (1) Have access to a system of records;

    (2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information; or

    (3) Design, develop, maintain, or operate a system of records.

    (b) When an agency specifies that only its agency-provided training is acceptable, use the clause with its Alternate I.”

    Based on our emails back and forth, you stated that “We are a semiconductor manufacturing company, offering standard products, services (via our Foundry), technology and RF solutions.  I support the Defense/Aerospace customers (both direct government and primes), responding to FAR/DFAR (and other agency) flow downs on both contract and subcontract activity.” So, you are simply providing semiconductors as a subcontractor and do not have access to any PII. Based on what you have provided to me, I do not see how FAR Clause 52.224-3 would apply to you as a subcontractor providing semiconductors.

    The intent of the clause is that if a Prime/Subcontractor does have access to a system of records or if the Prime/Subcontractor does create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information; or design, develop, maintain, or operate a system of records, that they have the proper training to prevent disclosure of the PII.

    I recommend running your interpretation past your legal counsel as well since you stated (in our emails) the Prime Contractor’s legal counsel has expressed an opinion.

    Open full Question Details
Chat with DAU Assistant
Bot Image