Privacy Act

The Privacy Act of 1974 (5 U.S.C. 552a) is a federal law that requires each federal agency to follow privacy and records management rules for most compilations of personal information maintained by the agency. Changes in information technology have made significant parts of the act outdated.

The Privacy Act of 1974 has sometimes been called a Watergate reform because it became law at the end of the Congress that served during the resignation of President Richard Nixon. However, concerns about privacy and computers were widespread by the early 1970s, and the law's intellectual origins are deeper than a response to political events. Congressional hearings on privacy and computers date back to the mid-1960s.

In 1972, Elliot Richardson, then secretary of the Department of Health, Education and Welfare, established the Advisory Committee on Automated Personal Data Systems. Richardson worried that automated personal data systems presented a serious potential for harmful consequences, including infringement of basic liberties. The committee issued its report in July 1973. The report was influential in two major ways. First, the committee proposed for the first time the notion of a Code of Fair Information Practices as a redefinition of the somewhat confused concept of personal privacy. Later in the decade, European policy makers refined and adopted fair information practices as an organizing [Page 826]principle for privacy (or data protection) laws. Fair information practices remain a core international privacy concept into the 21st century, with the 1980 restatement by the Organization for Economic Cooperation and Development being the most important document. The committee also recommended the enactment of a federal law to establish a code of fair information practices to govern federal agency record keeping. The law that emerged is directly based on the committee's recommendations. Congress adopted many of the committee's ideas verbatim.

The Privacy Act of 1974 applies to federal agencies and can be applied to federal contractors maintaining systems of records on behalf of agencies. The act does not apply to recipients of federal funds, to taxexempt organizations, or to components of the Executive Office of the President that advise the president.

An important term in the act is system of records. The law mostly applies to systems of records that contain identifiable information about individuals that is retrieved by identifier. The test for whether personal records are a system is a factual test. Federal agencies maintain most, but not all, personal information in systems of records. Each agency must publish in the Federal Register descriptive notices for all systems of records. No agency or system is exempt from the publication requirement. The policy is that there should be no secret government record keeping.

Other general requirements include limitations on the maintenance and collection of personal data; notice requirements for personal information collection instruments; standards for accuracy, relevance, timeliness, and completeness; rules of conduct for agency personnel; and administrative, technical, and physical safeguards to ensure security and confidentiality of records.

The act limits disclosure, but it gives agencies broad authority to define for each system of records routine uses that authorize specific types of disclosure. The routine use provision offers considerable flexibility for applying a policy of limited disclosure to the wide range of federal recordkeeping activities. However, agencies have been regularly criticized for abusing the authority to establish routine uses. The act's disclosure limits do not conflict with the Freedom of Information Act (5 U.S.C. 552). Each act recognizes and accommodates policies of openness and privacy.

...