Privacy Act of 1974

Biometric Research Databases and the Privacy Act of 1974

Professor Dorothy Glancy

Santa Clara University School of Law

“Improving Biometric and Forensic Technology: The Future of Research Datasets,” Gaithersburg, Maryland January 26, 2015
Do you recognize this man?

Sam J. Ervin, Jr.
In 1974 . . . 

• The Internet did not exist

•Cellular telephones did not exist

• Much less smart phones

•NIST, as NIST, did not exist

(It was the Bureau of Standards)
However, In 1974,

• Biometrics did exist

• Privacy Act referred to

• Finger prints

• “Voice prints”

• Photographs

as personal identifiers

• Databases existed

• In fact, there were about 863 federal 

agency “data banks” that maintained 

records containing personal information 

about millions of individuals.
Privacy Act 1974 focused on 

Databases – data banks

• US Senate Judiciary Subcommittee on Constitutional Rights study 

of federal agency data banks that contained personal information 

about individuals

• Federal Data Banks and Constitutional Rights

• Part of the Privacy Act’s legislative background

• I was privacy counsel to the Constitutional Rights Subcommittee

• My boss was Senator Sam Ervin, chairman of the subcommittee

• Part of my work included completing and publishing the study of just 

how many and what kinds of federal agency data banks were 

collecting personally identifiable information about individuals
Privacy Act of 1974

• Federal executive branch agencies, 

including the Executive Office of the President 

• Restricts personally identifiable information disclosure

• Restricts "matching programs“

• Requires fair information practices in maintenance of systems of 

records containing personal information

• Individual notice and consent before collection and disclosure

• Provides for individual access to that individual’s personal data 

• Restricts records of First Amendment activities

• Restricts use of Social Security Numbers as personal identifiers

• Requires Transparency through Federal Register publication of 

Systems of Records retrievable by personal identifiers, including 

biometrics

• Provides Civil and Criminal penalties for violations

• Private court actions by individuals

5 USC 552a - Effective September 27, 1975
Why should those who work with 

Biometric Research Datasets care 

about the Privacy Act of 1974?

• Calls out biometric identifiers for particular privacy concern

• Created Per

• sonally Identifiable Information (PII) concept

• Recognized

• Scale of Big Data systems matters

• Matching matters (Computer Matching Act, 1988)

• Disclosure requires notice to and consent by individual data 

subjects

• Published Systems of Personal Information Records

• Led to Privacy Impact Analysis (eGovernment Act of 2002)
Privacy Act of 1974

5 USC §552a(b) Disclosure and Matching Provisions

• "No agency shall disclose any record ... to any person, or to

another agency, except ... with the prior written consent of, the

individual to whom the record pertains, unless disclosure of 

the record would be --

- ... used solely as a statistical research or reporting record, 

and the record is to be transferred in a form that is not 

individually identifiable" [not defined]

• Restriction on "matching programs"

- Any computerized comparison of-- (i) two or more 

automated systems of records ... [certain exceptions]
Privacy Act of 1974

Record - individually identified

Personal information

Privacy Impact Analysis 

(PIA)

eGovernment Act

System of Records Notice 

(SORN)

Individual human being Accountability 
Thank you! 

Looking forward to your questions . . .

Biometric Research and the Privacy Act of 1974

Professor Dorothy Glancy

Santa Clara University School of Law

“Improving Biometric and Forensic Technology: The Future of Research Datasets,” 

Gaithersburg, Maryland January 26, 2015