20. Privacy Act

• Pages: 1073-1109

1073

PRIVACY ACT

20

1073

Privacy

Act

Citations:

5 U.S.C. §552a (Supp. IV 2004), enacted December 31, 1974 by Pub. L.

No. 93579, §3, 88 Stat. 1897; significantly amended by Pub. L. No. 94183,

§2(2), 89 Stat. 1057, December 31, 1975; Pub. L. No. 97--365, §2, 96 Stat.

1749, October 25, 1982; Pub. L. No. 97375, title II, §201(a), (b), 96 Stat.

1821, December 21, 1982; Pub. L. No. 97-452, §2(a)(1), 96 Stat. 2478,

January 12, 1983; Pub. L. No. 98-477, §2(c), 98 Stat. 2211, October 15,

1984; Pub. L. No. 98-497, title I, §107(g), 98 Stat. 2292, October 19, 1984;

Pub. L. No. 100503, §§28, 102 Stat. 25072514, October 18, 1988; and Pub.

L. No. 101508, title VII, §7201(b)(1), 104 Stat. 1388(3), November 5, 1990;

Pub. L. No. 103-66, title XIII, Ch. 2, subch. A, pt. V, §13581(c), 107 Stat.

611, August 10, 1993; Pub. L. No. 104-193, title I, §110(w), 110 Stat. 2175,

August 22, 1996; Pub. L. No.104-226, §1(b)(3), 110 Stat. 3033, October 2,

1996; Pub. L. No.104-316, title I, §115(g)(2)(b), 110 Stat. 3835, October

19, 1996; Pub. L. No. 105-34, title IX, subtitle C, §1026(b)(2), 111 Stat.

925, August 5, 1997; Pub. L. No.105-362, title XIII, §1301(d), 112 Stat.

3292, November 10, 1998; Pub. L. No. 107-306, 116 Stat. 2390, November

27, 2002; Pub. L. No. 108-271, 118 Stat. 814, July 7, 2004.

Lead Agency:

Office of Management and Budget, Office of Information and Regula-

tory Policy, Old Executive Office Building, Washington, DC 20503 (202)

3955897 or (202) 395-3647.

Overview:

The Privacy Act of 1974 represents Congressional response to concerns

about government uses of information collected about private individuals.

The Act gives individuals greater control over gathering, dissemination, and

1074 PRIVACY ACT

20

ensuring accuracy of information collected about themselves by agencies.

(Miller v. U.S., 630 F. Supp. 347 (E.D.N.Y. 1986)). The main purpose of the

Act is to forbid disclosure unless it is required by the Freedom of Informa-

tion Act. (Lovell v. Alderete, 630 F.2d 428 (5th Cir. 1980)). To protect indi-

vidual privacy, the Act constrains executive branch recordkeeping, defines

the individual’s right to access certain records, limits agency disclosure of

records containing an individual’s private information, establishes safeguards

to protect records concerning individuals, and provides remedies for agency

violation of the Act’s provisions.

Scope. The Act covers records maintained by agencies as defined in FOIA.

The Act applies to, including Cabinet level departments, independent regula-

tory agencies, military departments, and government corporations (5 U.S.C.

§552a(a)(1)). It does not apply to the legislative branch, national banks (U.S.

v. Miller, 643F.2d 713 (10th Cir. 1981)), or Amtrak (Ehm v. National R.R.

Passenger Corp., 732 F.2d 1250 (5th Cir. 1984), cert. denied, 469 U.S. 982

(1984)). See Alexander v. FBI, 971 F. Supp. 603, 606-07 (D.D.C. 1997)

(recognizing that definition of “agency” under Privacy Act is same as in

FOIA and that courts have interpreted that definition under FOIA to exclude

President’s immediate personal staff and units within Executive Office of

President whose sole function is to advise and assist President, but rejecting

such limitation with regard to “agency” as used in Privacy Act due to differ-

ent purposes that two statutes serve); Shannon v. General Elec. Co., 812 F.

Supp. 308, 313, 315 n.5 (N.D.N.Y. 1993) (noting that there is “no dispute”

that GE falls within definition of “agency” subject to requirements of Pri-

vacy Act where, pursuant to contract, it operated Department of Energy-

owned lab under supervision, control, and oversight of Department and where

by terms of contract GE agreed to comply with Privacy Act).

A record is a collection or grouping of information about an individual

that, for example, may include educational, financial, or biographical infor-

mation together with personal identifiers such as names, photos, numbers, or

fingerprints. (5 U.S.C. §552a(a)(4)). It does not apply to all government

records and documents that may contain an individual’s name or other pri-

vate information. For example, it does not include private notes of a supervi-

sor if such notes are not used by the agency to make decisions (Johnston v.

Horne, 875 F.2d 1415 (9th Cir. 1989)), but such notes may become subject to

the Act if they become part of an agency’s decision. (Chapman v. NASA, 682

F.2d 526 (5th Cir. 1982), cert. denied, 469 U.S. 1038 (1984)). It also does

not apply to information in documents obtained from independent sources of

information, even though identical information may be in an agency’s system

of records (Thomas v. DOE, 719 F.2d 342 (10th Cir. 1983)).

1075

PRIVACY ACT

20

The Act focuses on “systems of records” established, maintained, or con-

trolled by an agency. A “system of records” is a group of any records where

individual names or other individual identifiers can be used to retrieve the

information (5 U.S.C. §552a(a)(5)). Agencies may maintain records covered

by the Act only when they are relevant and necessary to accomplish the agency’s

purpose (5 U.S.C. §552(e)(1)). The D.C. Circuit addressed the “system of

records” definition in the context of computerized information in Henke v.

United States Dep’t of Commerce, 83 F.3d 1453 (D.C. Cir. 1996), and noted

that “the OMB guidelines make it clear that it is not sufficient that an agency

has the capability to retrieve information indexed under a person’s name, but

the agency must in fact retrieve records in this way in order for a system of

records to exist.” Id. at 1460 n.12. The D.C. Circuit looked to Congress’s use

of the words “is retrieved” in the statute’s definition of a system of records

and focused on whether the agency “in practice” retrieved information. Id. at

1459-61.

Access to Records. Where the agency is authorized to keep records cov-

ered by the Act, an individual has a right of access to records concerning him

or her. This is a central protection of the Act for individuals. The individual

has a right to:

•Copy any or all of the record (§552a(d)(1));

•Request amendment of the record (§552a(d)(2)) and to file a concise

statement of disagreement if the agency refuses to amend the record

that will be provided to all persons to whom the record is disclosed

(§552a(d)(4));

•Request an accounting from the agency on the date, nature, and pur-

pose of each disclosure of the record (§552a(c)).

The individual has an absolute right to access and need not provide any

reason for seeking access (FTC v. Shaffner, 626 F.2d 32 (7th Cir. 1980)).

Agency Requirements. For each system of records an agency main-

tains, it must:

•Publish in the Federal Register the name and location of the system;

the categories of individuals contained in the system; the routine use

of the records; agency policies concerning the records including stor-

age, retrieval, access, retention and disposal; the person, including

title and address, responsible for the system; the method used to

notify individuals how to gain access to records about themselves;