Privacy Act

To protect citizens from invasions of privacy by the federal government, Congress passed the Privacy Act of 1974 (PL 93-579). The act permitted individuals for the first time to inspect information about themselves contained in federal agency files and to challenge, correct, or amend the material. The major provisions of the act:

• Permit an individual to have access to personal information in federal agency files and to correct or amend that information.
• Prevent an agency maintaining a file on an individual from making it available to another agency without the individual's consent.
• Require federal agencies to keep records that are necessary, lawful, accurate, and current, and to disclose the existence of all databanks and files containing information on individuals.
• Bar the transfer of personal information to other federal agencies for non-routine use without the individual's prior consent or written request.
• Require agencies to keep accurate accountings of transfers of records and make them available to the individual.
• Prohibit agencies from keeping records on an individual's exercise of First Amendment rights unless the records are authorized by statute, approved by the individual, or within the scope of an official law enforcement activity.
• Permit an individual to seek injunctive relief to correct or amend a record maintained by an agency and permit the individual to recover actual damages when an agency acts in a negligent manner that is “willful or intentional.”
• Exempt from disclosure records maintained by the Central Intelligence Agency; records maintained by law enforcement agencies; Secret Service records; statistical information; names of persons providing material used for determining the qualification of an individual for federal government service; federal testing material; and National Archives historical records.
• Provide that an officer or employee of an agency who violates provisions of the act be fined no more than $5,000.
• Prohibit an agency from selling or renting an individual's name or address for mailing list use.
• Require agencies to submit to Congress and to the Office of Management and Budget any plan to establish or alter records. Virtually all agencies of the executive branch have issued regulations to implement the Privacy Act.

  To locate a specific agency's regulations, consult the general index of the Code of Federal Regulations under “Privacy Act” or search in http://www.USA.gov, “Privacy Act.”

USA PATRIOT Act

Following the terrorist attacks of September 11, 2001, Congress passed the USA PATRIOT Act (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism; PL 107-56). Included in the USA PATRIOT Act are provisions that:

• Amend the federal criminal code to authorize the interception of wire, oral, and electronic communications to produce evidence of chemical weapons, terrorism, and computer fraud and abuse.
• Amend the Foreign Intelligence Surveillance Act of 1978 (FISA) to require an application for an electronic surveillance order or search warrant certifying that a significant purpose (formerly, the sole or main purpose) of the surveillance is to obtain foreign intelligence information. The administration of President George W. Bush aggressively defended its use of wiretaps approved by the Foreign Intelligence Surveillance Court, which handles intelligence requests involving suspected spies, terrorists, and foreign agents. Established under FISA, this court operates secretly within the Justice Department.

USA PATRIOT Improvement and Reauthorization Act of 2005 and USA PATRIOT Act Additional Reauthorizing Amendments Act of 2006

Some provisions of the USA PATRIOT Act were set to expire at the end of 2005. After a lengthy battle Congress voted to reauthorize the act with some of the more controversial provisions intact, including the FISA amendments and the electronic wiretap provisions. Civil libertarians were concerned with issues regarding four provisions: sections 206 (roving wiretaps), 213 (delayed notice warrants), 215 (business records), and 505 (national security letters). The Senate addressed some of these concerns in a separate bill, S 2271, USA PATRIOT Act Additional Reauthorizing Amendments Act of 2006.

On March 9, 2006, the president signed into law the USA PATRIOT Improvement and Reauthorization Act of 2005 as well as the USA PATRIOT Act Additional Reauthorizing Amendments Act of 2006.

The reauthorized USA PATRIOT Act allows for greater congressional oversight and judicial review of section 215 orders, section 206 roving wiretaps, and national security letters. In addition, the act included requirements for high-level approval for section 215 [Page 870]FISA orders for library, bookstore, firearm sale, medical, tax return, and educational records. The act also provided for greater judicial review for delayed notice (“sneak and peek”) search warrants. Fourteen of sixteen USA PATRIOT Act provisions were made permanent, and a new sunset date of December 31, 2009, was enacted for sections 206 and 215.

Homeland Security Act of 2002

The Homeland Security Act of 2002 was also passed in the aftermath of the September 11, 2001, terrorist attacks. It contains provisions that:

• Establish the Homeland Security Department.
• Exempt from criminal penalties any disclosure made by an electronic communication service to a federal, state, or local government. In making the disclosure, the service must believe that an emergency involving risk of death or serious physical injury requires disclosure without delay. Any government agency receiving such disclosure must report it to the attorney general.

Direct the secretary of homeland security to appoint a senior department official to take primary responsibility for information privacy policy.

Protect America Act and Subsequent Follow-up Legislation

On August 5, 2007, President George W. Bush signed the Protect America Act, which amended the Foreign Intelligence Surveillance Act of 1978 (FISA), declaring that nothing under its definition of “electronic surveillance” shall be construed to encompass surveillance directed at a person reasonably believed to be located outside the United States. Prior to this act, no court permission was obtained for surveillance of parties located outside the United States, though a warrant was required for electronic surveillance of targets within the United States. The Protect America Act allowed the Attorney General or the Director of National Intelligence to direct a third party (i.e., telecommunications provider) to assist with intelligence gathering about individuals located outside the United States and shields such parties from liability without a warrant from the FISA Court. The act did provide FISA Court oversight via requiring the Attorney General to submit to the FISA Court the procedures by which the government determines that such acquisitions do not constitute electronic surveillance. The Attorney General was required to report to the congressional intelligence and judiciary committees semiannually concerning acquisitions made during the previous six-month period.

The Protect America Act was designed as a temporary act to allow intelligence policy officials six months to establish a permanent law. The act expired 180 days later in January; it was briefly reauthorized and expired in February 2008. The Senate passed the FISA Amendments Act of 2007 (S. 2248) in February, which would make many of the provisions of the Protect America Act permanent. However, House leadership objected to many of the provisions. Instead, the House supported its version, the Respected Electronic Surveillance That is Overseen, Reviewed and Effective (RESTORE) Act (H. 3773). This act authorizes the Attorney General and the Director of National Intelligence to conduct electronic surveillance of persons outside the United States in order to acquire foreign intelligence, but places limitations, including: the methods must be conducted in a manner consistent with the fourth amendment to the U.S. Constitution and it prohibits targeting of persons reasonably believed to be in the United States (with exceptions). As amended, the bill allowed for limited retroactive immunity for telecommunications service providers. It provides for greater court oversight for targeting procedures, minimization procedures, and guidelines for obtaining warrants. The act is set to expire on December 31, 2009, when certain provisions of the PATRIOT Act expire. As of April 2009, the House and Senate were working out differences in language.