EPIC logo

The Privacy Act of 1974

Introduction | History | Provisions | Exceptions | News | Resources | Cases

Introduction

The Privacy Act of 1974, Public Law 93-579, was created in response to concerns about how the creation and use of computerized databases might impact individuals' privacy rights. It safeguards privacy through creating four procedural and substantive rights in personal data. First, it requires government agencies to show an individual any records kept on him or her. Second, it requires agencies to follow certain principles, called "fair information practices," when gathering and handling personal data. Third, it places restrictions on how agencies can share an individual's data with other people and agencies. Fourth and finally, it lets individuals sue the government for violating its provisions.

There are, however, several exceptions to the Privacy Act. For one thing, government agencies that are engaged in law enforcement can excuse themselves from the Act's rules. Agencies have also circumvented information sharing rules by exploiting a "routine use" exemption.

History

In the course of its daily business, the federal government necessarily keeps hundreds of databases on individual people. As technology advanced through the 1960s and 70s, it became easier for agencies to cross-reference individuals’ personal data. Citizens and legislators began to contemplate the ways that this information, if compiled, could be abused. With computers able to search through and cross-reference files quickly and easily, it was clear that various details of a person’s life could be compiled into a single database.

The HEW Report

In 1973, the Department of Health, Education, and Welfare (HEW) issued a report entitled Records, Computers, and the Rights of Citizens. This report recommended that Congress enact legislation adopting a Code of Fair Information practice for automated personal data systems. This Code consisted of the following principles:

The HEW Report also made specific recommendations for laws that would implement and enforce this Code. These recommendations required organizations keeping automated databases on individuals to: (1) enact safeguards to protect this data, and (2) report to the public each year what databases they were keeping and what kinds of information they held. The HEW Report also set out a list of rights that individual "data subjects" (people whose personal information was being stored) should have. Many of these recommendations eventually became part of the Privacy Act of 1974.

The HEW Report also extensively studied the issue of the Social Security number (SSN). This was a particular concern because the SSN seemed to be the most likely candidate for creating a "standard universal identifier," or SUI, which could be used as a key to link all of the records kept on a person by all agencies. Because of this risk, the HEW Report recommended that the SSN should only be used where it is absolutely necessary (for instance, by the Social Security Administration in delivering benefits, or where existing laws required agencies to use the SSN), and that no agency should require someone to give their SSN out unless Congress specifically required it. These recommendations were also evident in the final text of the Privacy Act.

Debate and Passage of the Act

The Privacy Act was created as a compromise between two separate bills, one introduced in the House of Representatives, one in the Senate. The Senate bill, S. 3418, tended to have stricter requirements for the government than did the House bill, including harsher penalties for violations of the Act and the creation of a Privacy Protection Commission to oversee the Act's implementation. The House bill, H.R. 16373, also required that certain violations of the Act be "willful, arbitrary, or capricious" before damages would be assessed against the government, while the Senate required only that the Act be violated. Both bodies considered the differing bills late in the session, and then decided to reconcile the language in an informal meeting between House and Senate staffers. Among the major compromises were the following:

These changes, along with several others, harmonized the two bills, and with final changes made by the Senate, the amended Act was passed by the Senate on December 17, and by the House on the 18th. President Ford signed the Privacy Act into law by the new year.

The Privacy Protection Study Commission's Report

The Act called for the creation of the Privacy Protection Study Commission ("PPSC"), which issued its report on the Privacy Act in 1977. This report, entitled Personal Privacy in an Information Society, concluded that, while the Privacy Act of 1974 was a great step forward, it did not result in the benefits intended by Congress. The PPSC felt that much of the language of the Privacy Act was unclear, and that the reliance on the definition of "systems of records" was problematic. This is because the definition of "system of records" only included those databases that retrieved information by name, SSN, or other individually identifiable information. Thus, a database containing a person's name and Social Security number might not be covered by the Privacy Act simply because it was not indexed by name, SSN, etc. For example, to circumvent Privacy Act requirements, some agencies had created employee databases that classified individuals by rank, rather than SSN or name.

The Commission also found that the publication of databases in the Federal Register was helpful, though of limited impact, since public readership of the Federal Register is not particularly broad. Also, the PPSC said that the information disclosed by agencies in their publications was often lacking in details like how systems are used internally by agencies. Regarding individual access, the Commission found that very few people had made use of the Privacy Act's access provisions in the years since its passage. It attributed this shortcoming to the lack of awareness of the Privacy Act's provisions (compared to the relatively well-known Freedom of Information Act) and to the sweeping exceptions provided for the CIA and other major law enforcement agencies. Criticism also fell on agencies for not applying consistent criteria for measuring Privacy Act compliance. Often, many middle and lower-level personnel misunderstood the terms of the Act and would improperly cite it as a reason for withholding information from individuals.

The Privacy Act's Provisions

To Whom the Act Applies

The Privacy Act, unlike the Freedom of Information Act, only covers U.S. citizens and permanent residents. Thus, only a citizen or permanent resident can sue under the Privacy Act.

In addition, the Act applies only to certain federal government agencies (except for Section 7 of the Act, which places limits on the Social Security Number that apply to federal, state, and local governments). Aside from Section 7, state and local governments are not covered by the Privacy Act, though individual states may have their own laws regarding record keeping on individuals. Executive departments, military departments, independent regulatory agencies, and government-controlled corporations are all covered by the Act. This means that government controlled companies like the U.S. Postal Service should be covered as well as the military and executive agencies like the Department of Education, the FDA, and FBI, to name just a few. Neither house of Congress is included in this definition, though the Office of the President is.

The Act often refers to "systems of records." A system of records is defined as any group of records where information is retrieved by the name of the individual or by an individual identifier. Databases and collections of records that do not allow retrieval of information on particular individuals are not included.

Public Notice Requirements

In order to prevent the existence of secret databases, agencies must publish the details of all their systems of records in the Federal Register. The publication must cover intended uses of the system, and allow for interested persons to submit written data, views, or arguments to the agency. Any time that an agency wishes to establish or significantly change a system of records, it must also notify in advance the Committee on Government Operations of the House of Representatives, the Committee on Governmental Affairs of the Senate, and the Office of Management and Budget. These bodies will then evaluate the probable or potential effect of the proposal on the rights of individuals.

Important provisions requiring the President to submit a report every two years on oversight of the Privacy Act were repealed in 1995 by Public Law 104-66, the Federal Reports Elimination and Sunset Act of 1995.

Access to Records

The Privacy Act requires any agency maintaining a system of records to give an individual access to any records they might have about him. He should be allowed to review the record, and make copies of it. If the record is incomplete or in error, he is also entitled to ask that his record be corrected. The agency must then respond to this request within ten business days, either by making the requested changes or by telling the person why they have refused to alter his record. The agency must then tell the person who to talk to if he wants a higher official to review the refusal.

If the individual decides to appeal, the agency has thirty business days to complete a review of the refusal. The agency can extend this thirty-day limit, but only "for good cause shown." If, after the review, the agency still decides not to change the record, the individual can file a statement explaining why he disagrees with the agency's refusal. The agency must include this statement with any copies of the record that it discloses from that time on. The agency is also required to tell the individual what he can do to take the case to a court.

Requirements for Government Disclosure of Information

Subsection (b) of the Privacy Act limits a government agency's ability to disclose information placed in a system of records. The agency may only disclose such information if it has permission from the individual or if it can meet one of the twelve following conditions:

    1. The disclosure is to an agency employee who normally maintains the record and need it in the performance of duty;
    2. The disclosure is made under the Freedom of Information Act;
    3. The disclosure is for a "routine use;"
    4. The disclosure is to the Census Bureau for the purposes of a census survey;
    5. The disclosure is to someone who has adequately notified the agency in advance that the record is to be used for statistical research or reporting, and the record is transferred without individually identifying data;
    6. The disclosure is to the National Archives and Records Administration as a record of historical value;
    7. The disclosure is to an agency "of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity," and if the record is provided in response to a written request by the head of the agency;
    8. The disclosure is made where there are "compelling circumstances" affecting someone's health or safety, and the person whose health or safety is affected is sent a notification of the disclosure;
    9. The disclosure is made to Congress, or any committee or subcommittee within Congress;
    10. The disclosure is made to the Comptroller General in the course of the duties of the General Accounting Office;
    11. The disclosure is made pursuant to a court order;
    12. The disclosure is made to a consumer reporting agency in accordance with 31 U.S.C. 3711(e).

Audit Trails

Subsection (c) states that an agency must also keep accurate accounts of when and to whom it has disclosed personal records. This includes contact information for the person or agency that requested the personal records. These accounts should be kept for five years, or the lifetime of the record, whichever is longer. Unless the records were shared for law enforcement purposes, the accounts of the disclosures should be available to the data subject upon request.

Data Minimization Requirements

An agency should maintain in its records only the minimum amount of information "relevant and necessary" to accomplish its purposes. If the information to be collected might have an adverse effect upon an individual (by reducing her rights, benefits, or privileges), the agency must collect as much data as it practicably can from the individual herself. When collecting this information from the individual, the agency must tell the individual what law or executive order authorized the agency to collect the information; the routine uses to which the data may be put; and the effects that might result from the individual not providing the information requested.

Protection of First Amendment Rights

Agencies cannot maintain any records "describing how an individual exercises rights guaranteed by the First Amendment" unless: (1) a separate statute authorizes the agency to maintain the records; (2) the individual authorizes the agency to maintain the records; or (3) the records are maintained "pertinent to and within the scope of an authorized law enforcement activity."

Limits on Agency Data Sharing

One of the most important aspects of the Privacy Act is that it restricts the sharing of information between government agencies. It does this by limiting "matching programs," which it defines as the computerized comparison of databases in order to determine the status, rights, or benefits of the individuals within those systems of records. Matching programs can be used to share information between federal agencies, or between a federal and a non-federal agency (remember that in the text of the Privacy Act, "agency" almost always means a federal agency. However, the provisions limiting matching programs apply to non-federal agencies as well).

The Privacy Act prohibits agencies from running matching programs on systems of records, unless there is a written agreement between the agencies. This agreement must be given to the Committee on Governmental Affairs of the Senate and the Committee on Government Operations of the House, and should also be made available to the public. The agreement can only last 18 months, though it can be renewed each year as long as it does not change. Any changes must be reported just as a new system of records would be. The matching agreement must state:

If an agency sharing information (the "source agency") thinks that the recipient agency is not abiding by all of the necessary regulations, it cannot disclose any records to the recipient agency. Nor may the matching agreement be renewed unless the recipient agency certifies that it has complied with all of the provisions of the matching agreement, and the source agency has no reason to believe that this certification is inaccurate.

Every agency that uses a matching program must have a Data Integrity Board. This Board must consist of senior officials of the agency, including the Inspector General of the agency (if there is one) and any official selected to oversee Privacy Act compliance. The Data Integrity Board must review and approve all data matching agreements, to make sure that the agency is complying with all laws and guidelines. This review must be carried out each year for all new and existing matching programs. The results of this review must be submitted in an annual report to the Office of Management and Budget, and the report must also be made available to the public on request. The Board also should act as a clearinghouse for any information on the accuracy, completeness, and reliability of records. The authority of the Data Integrity Board also extends to any agency matching activities, not just matching programs.

If the Data Integrity Board refuses to allow a proposed matching agreement, either agency proposing the agreement can appeal to the Director of the Office of Management and Budget.

Penalties for Violating the Act: Civil Remedies

The Privacy Act provides for both civil and criminal penalties for violating certain sections. If an agency refuses to amend an individual's record upon request, the individual can sue in civil court to have the record amended. In this case, the court can also award the individual reasonable attorney's fees and other litigation costs, to be paid by the United States.

If an agency refuses to allow an individual access to his records as required in subsection (d)(1), the individual can sue in civil court to have the records produced. The court that decides this suit will have the ability to review the records "in camera" (privately) to see if the agency has properly claimed one of the exemptions allowed to them. The court can also make the United States pay for reasonable attorney's fees.

If an agency has violated any other section of the Privacy Act, and a court finds that the violation is "intentional or willful," the court can make the United States pay to the individual actual damages suffered as a result of the violation (but in no case shall a person entitled to recovery receive less than the sum of $1,000), along with costs and reasonable attorney's fees.

Penalties for Violating the Privacy Act: Criminal Penalties

If any officer or employee of a government agency knowingly and willfully discloses personally identifiable information will be found guilty of a misdemeanor and fined a maximum of $5,000. Also, if any agency employee or official willfully maintains a system of records without disclosing its existence and relevant details as specified above can be fined a maximum of $5,000. The same misdemeanor penalty (and $5,000 maximum fine) can be applied to anyone who knowingly and willfully requests an individual's record from an agency under false pretenses.

OMB Oversight

The Privacy Act gives the Director of the Office of Management and Budget the power to develop regulations and guidelines on how agencies should implement the Act. Thus, the OMB's interpretations of the language of the Privacy Act hold a great deal of authority.

Limitations on the Use of the Social Security Number

Section 7 of the Privacy Act says that no federal, state, or local government agency can require someone to give out their Social Security number in order for the individual to receive any right, benefit, or privilege provided by law. However, this section does not apply to any disclosure that is "required by a federal statute," or that is being used in a system of records that existed before January 1, 1975. Whenever a government agency requests disclosure of the Social Security number, it must tell the individual whether the disclosure is mandatory or voluntary, what laws give the agency the authority to request the Social Security number, and how the number will be used.

Exceptions to the Privacy Act

As much as the Privacy Act does to protect individual privacy, numerous exceptions to it exist. These exceptions (as well as the practical difficulties involved with maintaining and regulating such a vast system of databases) mean that individual privacy is not often as carefully protected as the drafters of the Privacy Act might have liked. Since "records," "systems of records" and "agencies" are narrowly defined, the Act may not cover many types of databases and data-gathering activities. Also, there are certain exceptions given for "law enforcement purposes." Finally, the "routine use" exception allows government agencies to disclose individually identifiable information simply by stating their plans to disclose that type of information when they create or alter the database.

"Records" and "Systems of Records"

The Privacy Act defines a "record" as any type of information that includes a person's "name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph." While it may have been extremely difficult in 1974 to affect someone's privacy without knowing their name, Social Security number or appearance, the sophistication of today's databases make it much easier to single out an individual from a set of facts, none of which is in itself an "identifying particular."

The Act also limits "systems of records" to those groups of records "from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual." As the Privacy Protection Study Commission noted, many databases contain personally identifiable information, but do not retrieve records by that information. Any such databases would be exempt from the provisions of the Privacy Act, though they might contain the same information and might still be used in the same way that an officially recognized "system of records" would be.

Law Enforcement Purposes

Exemptions for "law enforcement purposes" are scattered throughout the Privacy Act. The reasons for law enforcement exceptions are clear: it would be counterproductive to give criminal suspects under surveillance the ability to request files on current investigations about them. Thus, "matching programs" do not include matches performed during a specific investigation of a particular person. Also, law enforcement agencies can exempt themselves from many of the Privacy Act's requirements if the agency's main function pertains to the enforcement of criminal laws and if the system of records contains information on: (A) information about offenders or alleged offenders, such as arrest and sentencing records; (B) information compiled for the purpose of a criminal investigation associated with a particular individual; or (C) reports identifiable to an individual compiled at any stage of enforcing criminal laws, from arrest through release from supervision.

However, there are specific areas of the Privacy Act that law enforcement cannot exempt itself from. A law enforcement agency must abide by the disclosure rules of subsection (b), meaning that they cannot disclose personally identifiable information unless they have consent or the disclosure falls within one of the twelve conditions mentioned in the Requirements for Government Disclosure of Information section above. The agency must also still keeps records on who has requested information under the Privacy Act. The law enforcement agency also must publish the existence and character of its database in the Federal Register, including routine uses, data storage policies, and contact information for the official responsible for the system. Law Enforcement agencies must also still abide by fair information practices, meaning that they must ensure reasonable accuracy, completeness, timeliness and relevance of records; they must make reasonable efforts to tell an individual when their records have been disclosed due to a court order or a subpoena; and they must establish appropriate rules of conduct and safeguards to protect the privacy and security of the information.

Routine Use

One of the most commonly abused provisions of the Privacy Act is the "routine use" exception. One of the twelve reasons that an agency might be allowed to disclose personal information is if the disclosure is "for a routine use as defined in subsection (a)(7) of this section and described under subsection (e)(4)(D) of this section."

Subsection (a)(7) simply defines "routine use" as "the use of such record for a purpose which is compatible with the purpose for which it was collected." Note that a routine use does not have to be a purpose identical to the purpose for which the record was collected, only a compatible purpose. This phrasing can often lead to "mission creep" for a system of records, in which the routine uses for a particular database gradually increase until its scope is far greater than its originally stated goals.

Subsection (e)(4)(D) simply requires that the routine uses be stated in the Federal Register. While this might suggest that all potential routine uses must be listed, the reality is that these listings are often so broad as to include all potential uses of the data. While some court decisions have limited how broadly an agency can describe "routine uses" (see Britt v. Naval Investigative Service below), a large number of uses can still be covered by a short, general statement.

News

Resources

Cases

EPIC Privacy Page | EPIC Home Page

Last Updated: August 26, 2003
Page URL: http://www.epic.org/privacy/1974act/default.html