"This NASA Policy Directive applies to NASA Headquarters and NASA Centers, including component facilities, and to contractors or other entities that create and/or maintain privacy information for, or on behalf of, NASA as specified in their contract or other governing agreement." . . . .