Document ID: ./input/supremecourt_opinions/opinions/10pdf/09-530.pdf
Page Number: 25.0

Cite as:  562 U. S. ____ (2011) 

21 

Opinion of the Court 

at 458–459. 

2 
Notwithstanding  these  safeguards,  respondents  argue
that  statutory  exceptions  to  the  Privacy  Act’s  disclosure 
bar, see §§552a(b)(1)–(12), leave its protections too porous
to  supply  a  meaningful  check  against  “unwarranted  dis-
closures,”  Whalen,  supra,  at  605.    Respondents  point  in 
particular  to  what  they  describe  as  a  “broad”  exception
for  “routine  use[s],”  defined  as  uses  that  are  “compatible
with  the  purpose  for  which  the  record  was  collected.” 
§§552a(b)(3), (a)(7). 

Respondents’  reliance  on  these  exceptions  rests  on  an
incorrect reading of both our precedents and the terms of
the Privacy Act.  As to our cases, the Court in Whalen and 
Nixon  referred  approvingly  to  statutory  or  regulatory 
protections against “unwarranted disclosures” and “undue 
dissemination”  of  personal  information  collected  by  the
Government.  Whalen, supra, at 605; Nixon, supra, at 458. 
Neither  case  suggested  that  an  ironclad  disclosure  bar  is
needed to satisfy privacy interests that may be “root[ed] in
the Constitution.”  Whalen, supra, at 605.  In Whalen, the 
New  York  statute  prohibiting  “[p]ublic  disclosure  of  the 
identity  of  patients”  was  itself  subject  to  several  excep-
tions.  429  U. S.,  at  594–595,  and  n. 12.    In  Nixon,  the 
protections  against  “undue  dissemination”  mentioned  in
the opinion were not even before the Court, but were to be
included  in  forthcoming  regulations  “mandate[d]”  by  the 
challenged  Act.  433  U. S.,  at  458;  see  id.,  at  437–439 
(explaining  that  the  Court  was  limiting  its  review  to  the
Act’s “facial validity” and was not considering the Admin-
istrator’s  forthcoming  regulations).    Thus,  the  mere  fact 
that  the  Privacy  Act’s  nondisclosure  requirement  is  sub-
ject to exceptions does not show that the statute provides 
insufficient protection against public disclosure. 

Nor  does  the  substance  of  the  “routine  use”  exception