10 U.S.C. § 4662: Prohibition on the transfer of certain data on employees of the Department of Defense to third parties

Each contract entered into by the Department of Defense on or after the date of the enactment of this section shall include a provision prohibiting the contractor and each subcontractor under such contract from selling, licensing, or otherwise transferring covered individually identifiable Department employee data to any individual or entity other than the Federal Government, except to the extent required to perform such contract or a subcontract under such contract. This provision does not apply in circumstances where the transfer of such data would otherwise be authorized by law. appropriately considers the privacy risks to the employee of the Department of Defense to which such data relates; and is necessary in the interest of national security. the specific justification for providing the waiver; an identification of the contractor or subcontractor that is the subject of the waiver request; and an identification of the purpose of the sale, licensing, or transfer of covered individually identifiable Department employee data that is the subject of the waiver request. The term “covered individually identifiable Department employee data” means individually identifiable Department employee data obtained by a contractor or subcontractor described in subsection (a). identifies such employee; or which may be used to infer, by either direct or indirect means, the identity of such an employee to whom the information applies.