By outsourcing, you mean disclosure to third countries. The Privacy Act requirement right now is that we can do that under an agreement or an arrangement with another country if it's for law enforcement purposes. It doesn't specify what sort of agreement, what sort of arrangement, but there needs to be an agreement that is arrived at with that country. There is nothing more specific required now.
My own experience is that I've seen a lot of these written agreements. There might be some disclosures that happen without agreements.