The Privacy Act

Amid the passage of open meetings and open records laws, the federal government also recognized a citizen’s right to avoid improper distribution of data it keeps about them. The 1974 Privacy Act also allows citizens to find out what information the government keeps on them, primarily in order to ensure its accuracy.

How the Privacy Act works

The Privacy Act, like FOIA, is relatively simple to use. Identify the agency that you think may have records about you — such as the FBI, CIA or IRS. Send a request letter giving the agency enough information so it can be sure of your identity and know which files to search. (See the sample letter.)

For broadest coverage, a request for your own records should invoke both the Privacy Act and FOIA. Agencies cannot rely on exemptions in the Privacy Act to withhold information that would otherwise be available under FOIA. And if a FOIA exemption may apply to a record otherwise available under the Privacy Act, that record must be released under the Privacy Act.

Also, because the Privacy Act only entitles you to see records contained within a “system” of records, FOIA may provide broader access to records. For instance, the Privacy Act does not entitle a requester to have an electronic name search made, but FOIA requires agencies to search electronic as well as paper records in responding to a FOIA request.

It is important to note that the Privacy Act prohibits executive branch agencies from sharing certain personal information about other people. In fact, the Privacy Act is frequently used to deny FOIA requests for information about individuals.

You can request that the agency search its central files in Washington, D.C., as well as regional and local offices throughout the country. FBI headquarters in Washington, D.C., however, will not honor requests for searches of field office files. If you think one of the FBI’s 49 field offices has records about you, you must make a separate Privacy Act request directly to that field office.

Unlike FOIA, the Privacy Act does not permit agencies to charge anyone for the time it takes to search for requested records. Duplication fees are charged, however. These are normally at the rate of between 3 and 25 cents per page.

The Privacy Act does not require agencies to process your request within 20 business days, as does FOIA. However, under guidelines issued by the Office of Management and Budget, agencies “should” acknowledge receipt of Privacy Act requests within 10 business days, advising whether the request will be granted, and provide access to the records within 30 business days.94

Federal agencies have different requirements for what type of proof of identification must be submitted by Privacy Act requesters. Generally, you can meet all agency requirements, including those of the FBI, by stating your full name, Social Security number and date and place of birth, and having your signature on the request letter notarized. You are not required to have a notary. You may instead write that you swear that you are the undersigned “under penalty of perjury.” It may also be helpful to enclose copies of a standard piece of identification, such as a birth certificate or driver’s license.

In addition, you may want to provide other names and nicknames you have used, your history of foreign travel, past home addresses, periods of government employment, participation in political groups, demonstrations, etc. Decide for yourself how much of this type of information you want to provide.

One provision of the Privacy Act of special interest to journalists, authors and scholars prohibits federal agencies from maintaining any records “describing how any individual exercises rights guaranteed by the First Amendment” unless done under authorization of a statute or within the scope of an “authorized law enforcement activity.”95

There have been few court cases to date interpreting this provision. It appears, however, that this law prohibits the government from all unnecessary monitoring of the professional activities of members of the press, as well as authors, scholars and researchers. If the government is found to maintain these types of records unlawfully, “in such a manner as to have an adverse effect on an individual,” the Privacy Act permits that individual to file a civil suit against the agency and, in some cases, recover monetary damages and attorney fees.

Journalists needing assistance using the Privacy Act to request records should contact the Reporters Committee at 1-800-336-4243 or by e-mail at hotline@rcfp.org.

How Privacy Act lawsuits affect journalists

When information held by an executive branch agency is made public that “outs” otherwise private citizens, those citizens have a claim against the government for releasing into the public sphere what they believe to be private information about themselves. Journalists often rely on confidential government sources to obtain and report information of public interest that can concern otherwise private individuals, and when those private persons need ammunition for their lawsuits, they may well subpoena reporters to name names.

Nuclear scientist Wen Ho Lee used the Privacy Act to sue for damages after his name was leaked in connection to alleged spying for the Chinese government before any charges had been filed against him. Lee was never charged with any crimes related to espionage and pled guilty only to mishandling of information. Five media organizations agreed to pay him $750,000, in conjunction with a government settlement of $895,000, to avoid reporters having to reveal the confidential sources they relied on. Six reporters had been ordered to give testimony about their sources.

In another case, former Army scientist Steven Hatfill’s name was leaked to the press as a “person of interest” in the investigation of the 2001 anthrax attacks. In 2003, Hatfill sued under the Privacy Act over repeated leaks of investigative details in the case, also subpoenaing at least 13 journalists to reveal the names of government sources. Hatfill was ultimately cleared and settled with the government in 2008 for $5.8 million.

The most recent such case involves former U.S. Attorney Richard Convertino, whose name was leaked to the press after the Department of Justice investigated him for alleged misconduct during a Detroit terrorism trial. Convertino sued the Department of Justice under the Privacy Act and sent a subpoena to Free Press reporter David Ashenfelter. The reporter refused to testify, arguing that both the First Amendment and the Fifth Amendment privilege him from having to reveal his sources. As of early 2009, Convertino’s attorneys were seeking a contempt order against Ashenfelter for his refusal to testify, but the judge had not yet ruled.

Journalists who are subpoenaed in Privacy Act lawsuits should consult an attorney for advice. They may also call the Reporters Committee for assistance at 1-800-336-4243.


94 See Dep’t of Justice v. Reporters Comm., above.

95 See Nat’l Archives & Records Admin. v. Favish, above.