I. What is the Privacy Act?
The Privacy Act was passed in 1974 amid an increasing concern about individuals’ loss of control over personal information collected by the federal government in the computer age. It forbids federal executive branch agencies from disclosing personal information about individuals without their permission.1 It also provides an avenue for people to obtain records related to themselves. Finally, it sets out restrictions on the sharing of such personal information within government and mandates policies for the collection, storage and use of such records.
The act contains 12 “exceptions” to the “no disclosure without consent” rule.2 For example, proper requests by federal law enforcement agencies in furtherance of specific enforcement activity or records required to be disclosed pursuant to a court order do not require the consent of the individual before disclosure.3 Most importantly for journalists, the Privacy Act contains a specific exception to the “no consent” rule for any record that is “required” to be disclosed under the federal FOIA.4
Privacy Act provisions generally apply to records that are contained in a “system of records.” A system of records is defined under the act as any record under agency control “from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to that individual.”5 This means that in order for the Privacy Act to be invoked, an agency must actually retrieve the records sought by searching for the personal identifier and not merely have the capability to do so.6
Agencies will frequently post online the categories of records they claim are covered by the Privacy Act through what are known as System of Records Notices (SORNs). SORNs will generally set forth the particulars of the type of records covered including, among other things, the kind of information contained in the record, where it is held, how it is used within the agency and records management procedures.
For additional information about the Privacy Act and how to request records under it, see our Federal Open Government Guide.
1 See generally Privacy Act of 1974, found at 5 U.S.C. § 552a (2012).
2 See id. at § 552a(b) (“No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless the disclosure of the records would be” [12 exceptions follow]).
3 See id. at §§ 552a(b)(7), (b)(11).
4 See id. at § 552a(b)(2) (Specifically, the law states that an agency shall not disclose the record without consent of the individual unless the disclosure would be “required under section 552 of this title [the federal Freedom of Information Act]”).
5 See id. at § 552a(a)(5).
6 See Office of Management and Budget, Privacy Act Implementation, Guidelines and Responsibilities, OMB Circular No. A-108, 40 Fed. Reg. 28948, 28952 (July 9, 1975).
Connect with us:
