UL-2 - Information Sharing With Third Parties
Control requirements
UL-2 (a)
Share personally identifiable information (PII) externally, only for the authorized purposes identified in the Privacy Act and/or described in its notice(s) or for a purpose that is compatible with those purposes.
UL-2 (b)
Where appropriate, enter into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically describe the PII covered and specifically enumerate the purposes for which the PII may be used.
UL-2 (c)
Monitor, audit, and train the staff on the authorized sharing of PII with third parties and on the consequences of unauthorized use or sharing of PII.
UL-2 (d)
Evaluate any proposed new instances of sharing PII with third parties to assess whether the sharing is authorized and whether additional or new public notice is required.