Document ID: ./input/supremecourt_opinions/opinions/10pdf/09-530.pdf
Page Number: 26.0

22 

NASA v. NELSON 

Opinion of the Court 

relied  on  by  respondents  create  any  undue  risk  of  public 
dissemination.  None of the authorized “routine use[s]” of 
respondents’  background-check  information  allows  for 
release  to  the  public.    71  Fed.  Reg.  45859–45860,  45862
(2006);  60  Fed.  Reg.  63084  (1995),  as  amended,  75  Fed.
Reg.  28307  (2010).  Rather,  the  established  “routine 
use[s]”  consist  of  limited,  reasonable  steps  designed  to 
complete the background-check process in an efficient and
orderly  manner.  See  Whalen,  supra,  at  602  (approving
disclosures to authorized New York Department of Health
employees  that  were  not  “meaningfully  distinguishable” 
from  routine  disclosures  “associated  with  many  facets  of 
health  care”).  One  routine  use,  for  example,  involves  a
limited  disclosure  to  persons  filling  out  Form  42  so  that 
designated references can “identify the individual” at issue
and can understand the “nature and purpose of the inves-
tigation.”  App. 89.  Authorized JPL employees also review 
each  completed  SF–85  to  verify  that  all  requested  infor-
mation has been provided.  Id., at 211.  These designated 
JPL  employees  may  not  “disclose  any  information  con-
tained  in  the  form  to  anyone  else,”  ibid.,  and  Cal  Tech  is 
not given access to adverse information uncovered during 
the Government’s background check, id., at 207–208.  The 
“remote  possibility”  of  public  disclosure  created  by  these 
narrow  “routine  use[s]”  does  not  undermine  the  Privacy 
Act’s  substantial  protections.  See  Whalen,  429  U. S.,  at 
601–602  (“remote  possibility”  that  statutory  security
provisions  will  “provide  inadequate  protection  against 
unwarranted disclosures” not a sufficient basis for striking
down statute).

Citing  past  violations  of  the  Privacy  Act,14  respondents 

—————— 

14 E.g., GAO, Personal Information: Data Breaches are Frequent, but 
Evidence  of  Resulting  Identity  Theft  is  Limited;  However,  the  Full 
Extent Is Unknown 5, 20 (GAO 07–737, 2007) (over 3-year period, 788
data breaches occurred at 17 federal agencies).