32 CFR 806b.11 - When to give Privacy Act Statements (PAS).
(a) Give a PAS orally or in writing to the subject of the record when you are collecting information from them that will go in a system of records. Note: Do this regardless of how you collect or record the answers. You may display a sign in areas where people routinely furnish this kind of information. Give a copy of the Privacy Act Statement if asked. Do not ask the person to sign the Privacy Act Statement.
(b) A Privacy Act Statement must include four items:
(1)Authority: The legal authority, that is, the U.S.C. or Executive Order authorizing the program the system supports.
(2)Purpose: The reason you are collecting the information and what you intend to do with it.
(3)Routine Uses: A list of where and why the information will be disclosed outside DoD.
(4)Disclosure: Voluntary or Mandatory. (Use Mandatory only when disclosure is required by law and the individual will be penalized for not providing information.) Include any consequences of nondisclosure in non-threatening language.