PRIVACY ACTFederal Workers’ Compensation Conference 2014

Department of Labor

*

*

*

*

PRIVACY ACT/ SYSTEMS OF RECORDS

WHAT IS THE PRIVACY ACT?

WHAT INFORMATION CAN BE RELEASED ABOUT A WORKERS’ COMPENSATION CASE? TO WHOM?

WHAT IS A SYSTEM OF RECORDS AND HOW DOES IT FIT IN THE PICTURE?

*

*

Structure of the Privacy Act

ESTABLISHES RIGHTS (INDIVIDUALS)

CREATES RESPONSIBILITIES (AGENCIES)

PROVIDES OVERSIGHT MECHANISMS

NOT JUST ACCESS AND DISCLOSURE—RECORDS MANAGEMENT IS KEY

“No Disclosure Without Consent”

*

*

RIGHTS FOR INDIVIDUALS 

NOTIFICATION (GENERAL, SPECIFIC)

ACCESS TO RECORDS ABOUT ONESELF

AMENDMENT OF RECORDS IN ERROR

ABILITY TO SUE TO ENFORCE WRONGS

PRIVACY ACT

AGENCY RESPONSIBILITIES

  ESTABLISH REGULATIONS

  MAINTAIN RECORDS TO CERTAIN STANDARDS

  PROTECT RECORDS FROM DISCLOSURE

  NOTIFY THE PUBLIC (general, specific)

*

*

TERM: RECORD
        - INFORMATION ABOUT AN INDIVIDUAL

EDUCATION, FINANCIAL TRANSACTIONS, MEDICAL HISTORY, AND CRIMINAL AND EMPLOYMENT HISTORY
        - INDIVIDUAL IDENTIFIER

NAME, IDENTIFYING NUMBER, SYMBOL, OR OTHER IDENTIFYING PARTICULAR ASSIGNED TO INDIVIDUAL, SUCH AS FINGERPRINT, VOICE PRINT, BIOMETRIC OR PHOTOGRAPH

PRIVACY ACT

*

*

TERM: SYSTEM OF RECORDS
        - GROUP OF RECORDS
        - UNDER THE CONTROL OF A FEDERAL AGENCY
        - RETRIEVED BY INDIVIDUAL IDENTIFIER ON A REGULAR BASIS

PRIVACY ACT

*

*

TERM: ROUTINE USE
        - ALLOWS FOR THE DISCLOSURE OF A RECORD OUTSIDE OF THE AGENCY WITHOUT CONSENT (BECAUSE OF NOTIFICATION TO THE INDIVIDUAL AT THE TIME OF COLLECTION)
        - DISCLOSURE MUST BE “FOR A PURPOSE WHICH IS COMPATIBLE WITH THE PURPOSE FOR WHICH [THE INFORMATION] WAS COLLECTED”

PRIVACY ACT

*

*

PURPOSE of the PRIVACY ACT:

BALANCE GOVERNMENT’S NEED TO

MAINTAIN INFORMATION

WITH 

THE RIGHTS OF INDIVIDUALS

TO BE PROTECTED AGAINST THE UNWARRANTED INVASION OF THEIR PRIVACY

No Disclosure Without Consent

*

*

1. RESTRICT DISCLOSURE (No Disclosure Without Consent)

2. GRANT INDIVIDUALS INCREASED RIGHTS OF ACCESS

3. GRANT INDIVIDUALS RIGHT TO SEEK AMENDMENT OF AGENCY RECORDS

4. ESTABLISH A CODE OF 

“FAIR INFORMATION PRACTICES”

FOUR BASIC POLICY OBJECTIVES

*

*

*

*

REMEMBER--A DISCLOSURE MAY BE WRITTEN (MOST DISCLOSURES ARE)

BUT THERE ARE ORAL DISCLOSURES AS WELL

AND ALL DISCLOSURES 

(INCLUDING DISCLOSURES FROM AQS) ARE COVERED BY 

PRIVACY ACT PRINCIPLES

PRIVACY ACT SYSTEM OF RECORDSOFFICIAL NAME:	DOL/GOVT-1 Office of Workers’ Compensation Programs, Federal Employees’ Compensation Act File

*

*

1. FEDERAL EMPLOYEE  DISCLOSURE OF INFORMATION PROHIBITED FROM  DISCLOSURE

--(all three)--MISDEMEANOR, FINE NOT > $5,000

PRIVACY ACT—CRIMINAL PENALTIES (INDIVIDUALS)

3. ANYONE, INCLUDING A FEDERAL EMPLOYEE, 

REQUESTS OR OBTAINS ANY RECORD UNDER 

FALSE PRETENSES

2. FEDERAL EMPLOYEE WILLFULLY 

MAINTAINS A SYSTEM OF RECORDS

WITHOUT MEETING NOTICE REQUIREMENTS

*

*

These provisions are solely criminal, and create no private right of action against a federal employee individually

In other words, if you violate an individual’s privacy, the individual can only sue the government

	BUT THE GOVERNMENT CAN PROSECUTE YOU

PRIVACY ACT

*

*

CIVIL REMEDIES—AMENDMENT, ACCESS, ACCURACY, & OTHER DAMAGES

SUIT IS AGAINST FEDERAL AGENCY ONLY—INDIVIDUAL FEDERAL EMPLOYEE IS NOT ABLE TO BE SUED FOR MONEY DAMAGES UNDER THE PRIVACY ACT

PRIVACY ACT—CIVIL REMEDIES

*

*

SYSTEMS OF RECORDS

WORKERS’ COMPENSATION

RECORDS BELONG TO DOL, 

AND DOL ONLY

ANY RECORDS THE EMPLOYING 

AGENCY HAS, INCLUDING 

COPIES, BELONG TO DOL

*

*

PRIVACY ACT

WHAT DOES THAT MEAN?

ANY RECORDS THE AGENCY HAS BELONG TO DOL, AND CAN ONLY BE RELEASED IN ACCORDANCE WITH DOL’S PUBLISHED ROUTINE USES, AND WITH DOL’S INTERPRETATION 

*

*

SYSTEMS OF RECORDS

WHAT ARE DOL’S PUBLISHED ROUTINE USES?

In addition to the 12 universal routine uses that apply to all DOL systems of records, there are 17 of them in DOL/GOVT-1

Examples:

- third party in a third party action

- employing agency at time of

injury to verify billing, check status 

of claim, consider rehire, etc.

- potential employers for return to 

work consideration

*

*

SYSTEMS OF RECORDS

- Rehab agencies for evaluation

 Physicians for use in treatment

- Health insurance or medical/welfare plans for clarification of billing responsibility

- Labor union acting on behalf

 of the employee

- dual benefits issues

*

*

Distinguish Between “Right of Access” Disclosures and “Routine Use” Disclosures
        - Disclosure to the subject of the record (the FECA claimant), while appropriate, authorized, and required by 5 U.S.C. § 552a(d)(1) (individual’s right of access), is not a disclosure pursuant to a routine use
        - Examples of routine use disclosures:

Example—routine use e of DOL/GOVT-1 authorizes release of FECA file information to physicians treating or examining a FECA claimant

Another example—routine use o allows release of FECA file information to a Member of Congress in response to a request for assistance to a claimant

*

*

SYSTEMS OF RECORDS

SO...WHAT DOES THIS MEAN?

Think It Through ...

WORKERS’ COMP DATA CAN

BE RELEASED ONLY FOR THE

ROUTINE USES ESTABLISHED

BY DOL 

*

*

WHEN YOU RELEASE DATA, YOU CAN RELEASE ONLY THAT PART OF THE RECORD THAT IS NECESSARY TO MEET THE ROUTINE USEIT IS A VIOLATION OF THE PRIVACY ACT IF YOU GIVE ANY INFORMATION NOT COVERED BY THE ROUTINE USES TO ANYONEWHEN IN DOUBT, CALL OWCP

*

*

Personally Identifiable Information (PII)

The department defines PII as information

    “whose disclosure could result in harm to the individual whose name or identity is linked to that information.  Examples include, but are not limited to, social security number; credit card number; bank account number; residential address; residential or personal telephone; biometric identifier (image, fingerprint, iris, etc.); date of birth; mother’s maiden name; criminal records; medical records; and financial records.  The conjunction of one data element with one or more additional elements increases the level of sensitivity and/or propensity to cause harm in the event of compromise.”

*

*

DISCLOSURE 	YES/NO??
        - EMPLOYING AGENCY

OIG—YES (IF INVESTIGATING FECA FRAUD)

INJURY COMP—YES

SECURITY OFFICE—YES, with limitations

SUPERVISOR—YES, IF RTW, and with limitations

EEO INVESTIGATOR—NO (with PA WAIVER, YES)

PERSONNEL ACTION—NO

AGENCY ATTORNEY—NO (if assisting agency with FECA case itself, YES)

BUDGET OFFICE—YES, summary information only

SAFETY AND HEALTH—YES, with limitations

UNION REPRESENTATIVE—YES, but only if representing claimant before OWCP

*

*

“YES” DOES NOT MEAN UNQUALIFIED YES
        - It is important to remember that, unless you have a Privacy Act waiver signed by the FECA claimant, or are responding to a first person request by the claimant,
        - you always must confirm that the expected use of the information is compatible with the routine use, and 
        - you disclose the least amount of information necessary for the recipient’s anticipated use.

*

*

Privacy Act/FECA References
        - Main DOL Privacy Act Systems Page  http://www.dol.gov/sol/privacy/main.htm 
        - DOL/GOVT-1 Systems Notice  http://www.dol.gov/sol/privacy/dol-govt-1.htm
        - DOL Universal Routine Uses  http://www.dol.gov/sol/privacy/intro.htm
        - DOL’s assertion of control  http://www.dol.gov/sol/privacy/gov-wide.htm