Under the amended Act, agencies are allowed to share data with external partners only when three "safeguards" are met.