32 CFR Appendix G to Part 275, Releasing Information Obtained From Financial Institutions
A. Financial records obtained under 12 U.S.C. chapter 35 shall be marked: “This record was obtained pursuant to the Right to Financial Privacy Act of 1978, 12 U.S.C. 3401et seq., and may not be transferred to another Federal Agency or Department without prior compliance with the transferring requirements of 12 U.S.C. 3412.”
B. Financial records obtained under this part shall not be transferred to another Agency or Department outside the Department of Defense unless the head of the transferring law enforcement office, personnel security element, or intelligence organization, or designee, certifies in writing that there is reason to believe that the records are relevant to a legitimate law enforcement inquiry, or intelligence or counterintelligence activity (to include investigation or analyses related to international terrorism) within the jurisdiction of the receiving Agency or Department. Such certificates shall be maintained with the DoD Component along with a copy of the released records.
C. Subject to paragraph D. of this appendix, unless a delay of customer notice has been obtained under Appendix H of this part, the law enforcement office or personnel security element shall, within 14 days, personally serve or mail to the customer, at his or her last known address, a copy of the certificate required by paragraph B., along with the following notice:
“Copies of or information contained in your financial records lawfully in possession of [name of Component] have been furnished to [name of Agency or Department] pursuant to the Right to Financial Privacy Act of 1978 for the following purposes: [state the nature of the law enforcement inquiry with reasonable specificity]. If you believe that this transfer has not been made to further a legitimate law enforcement inquiry, you may have legal rights under the Financial Privacy Act of 1978 or the Privacy Act of 1974.”
D. If a request for release of information is from a Federal Agency, as identified in E.O. 12333, authorized to conduct foreign intelligence or foreign counterintelligence activities, the transferring DoD Component shall release the information without notifying the customer, unless permission to provide notification is given in writing by the requesting Agency.
E. Whenever financial data obtained under this part is incorporated into a report of investigation or other correspondence; precautions must be taken to ensure that:
1. The reports or correspondence are not distributed outside the Department of Defense except in compliance with paragraph B.; and
2. The report or other correspondence contains an appropriate warning restriction on the first page or cover. Such a warning could read as follows:
“Some of the information contained herein (cite specific paragraph) is financial record information which was obtained pursuant to the Right to Privacy Act of 1978, 12 U.S.C. 3401et seq. This information may not be released to another Federal Agency or Department outside the Department of Defense except for those purposes expressly authorized by Act.”