Source: https://sourcebook.acus.gov/index.php?title=Privacy_Act&diff=1355&oldid=prev
Timestamp: 2020-08-12 12:15:36
Document Index: 696755079

Matched Legal Cases: ['§ 552', '§ 552', '§ 552', '§ 552', '§ 552', '§ 552', '§ 552', '§ 552', '§ 552', '§ 405']

* [https://www.govinfo.gov/content/pkg/FR-1996-02-20/pdf/96-3645.pdf Management of Federal Information Resources], 61 Fed. Reg. 6428, 6435-39 (1996) (“Federal Agency Responsibilities for Maintaining Records About Individuals”).
Revision as of 12:59, 4 December 2018
The Privacy Act covers records maintained by agencies as defined in FOIA. It applies to Cabinet level departments, independent regulatory agencies, military departments, and government corporations (5 U.S.C. § 552a(a)(1)). It does not apply to the legislative branch, national banks (United States v. Miller, 643 F.2d 713 (10th Cir. 1981)), or Amtrak (Ehm v. National R.R. Passenger Corp., 732 F.2d 1250 (5th Cir. 1984), cert. denied, 469 U.S. 982 (1984)). See Alexander v. FBI, 971 F. Supp. 603, 606-07 (D.D.C. 1997) (although recognizing that the definition of “agency” under Privacy Act is same as in FOIA and that courts have interpreted that definition under FOIA to exclude the President’s immediate personal staff and units within Executive Office of the President whose sole function is to advise and assist the President, nevertheless rejecting such limitation with regard to “agency” as used in Privacy Act due to different purposes that the two statutes serve); Shannon v. Gen. Elec. Co., 812 F. Supp. 308, 313, 315 n.5 (N.D.N.Y. 1993) (“no dispute” that GE falls within definition of “agency” subject to requirements of Privacy Act where pursuant to contract it operated Department of Energy-owned lab under supervision, control, and oversight of department and where by terms of contract GE agreed to comply with Privacy Act).
A record is a collection or grouping of information about an individual that, for example, may include educational, financial, or biographical information, together with personal identifiers such as names, photos, numbers, or fingerprints. (5 U.S.C. § 552a(a)(4)). It does not apply to all government records and documents that may contain an individual’s name or other private information. For example, it does not include private notes of a supervisor if such notes are not used by the agency to make decisions (Johnston v. Horne, 875 F.2d 1415 (9th Cir. 1989)), but such notes may become subject to the Privacy Act if they become part of an agency’s decision. (Chapman v. NASA, 682 F.2d 526 (5th Cir. 1982), cert. denied, 469 U.S. 1038 (1984)). It also does not apply to information in documents obtained from independent sources of information, even though identical information may be in an agency’s system of records (Thomas v. U.S. Dep’t of Energy, 719 F.2d 342 (10th Cir. 1983)).
The Privacy Act focuses on “systems of records” established, maintained, or controlled by an agency. A “system of records” is a group of any records where individual names or other individual identifiers can be used to retrieve the information (5 U.S.C. § 552a(a)(5)). Agencies may maintain records covered by the Privacy Act only when they are relevant and necessary to accomplish the agency’s purpose (5 U.S.C. § 552a(e)(1)). The Court of Appeals for the District of Columbia Circuit addressed the “system of records” definition in the context of computerized information in Henke v. U.S. Dep’t of Commerce, 83 F.3d 1453 (D.C. Cir. 1996), and noted that “the OMB guidelines make it clear that it is not sufficient that an agency has the capability to retrieve information indexed under a person’s name, but the agency must in fact retrieve records in this way in order for a system of records to exist.” Id. at 1460 n.12. The D.C. Circuit looked to Congress’ use of the words “is retrieved” in the statute’s definition of a system of records and focused on whether the agency “in practice” retrieved information. Id. at 1459-61.
use by “any governmental jurisdiction . . . for a civil or criminal law enforcement activity” as long as a written request (1) is made by the head of the agency seeking the record, (2) specifies the portion of the record sought, and (3) describes the relevant enforcement activity. (See Doe v. Naval Air Station, 768 F.2d 1229 (11th Cir. 1985))
“Routine use,” considered generally the most important exception, is defined as “the use of such record for a purpose that is compatible with the purpose for which it was collected” (§ 552a(a)(7)). Each routine use is identified in the Federal Register notice upon establishment or revision of each system of records (§ 552a(e)(4)(D)). This exception permits nonconsensual intra- or interagency transfer of what is generally described as “house-keeping” information. Because the language is broad, the potential for abuse is considered great, and the courts have strictly required that the use be clearly and specifically identified in the rule adopted by the agency identifying the system of records (Covert v. Harrington, 876 F.2d 751 (9th Cir. 1989); Doe v. Stephens, 851 F.2d 1457 (D.C. Cir. 1988); Zeller v. United States, 467 F. Supp. 487 (E.D.N.Y. 1979)). The Supreme Court has found that the Privacy Act’s provisions restricting disclosure, even while allowing disclosure for “routine uses,” are sufficient to protect persons’ constitutional right to informational privacy, if such a right exists (NASA v. Nelson, 562 U.S. 134, 153-55 (2011)).
The Privacy Act provides that each agency shall promulgate rules that establish, among other things, procedures of notice, disclosure, and review of requests (§ 552a(f)). In the event that the rules are not followed or that a dispute persists, there are four civil actions: (1) a challenge for failure to provide access; (2) a challenge for refusal to amend; (3) a damages action for improper maintenance of the content of records; and (4) a damages action for other breaches of the Privacy Act or regulations issued thereunder that adversely affect the individual (§ 552a(g)(1)). The latter two actions require proof of damages and are limited to actual damages. A cause of action for monetary damages requires a showing of an agency’s intentional or willful failure to maintain accurate records and that the violation of the Privacy Act caused the actual damages complained of (Molerio v. FBI, 749 F.2d 815, 826 (D.C. Cir. 1984)). Because waivers of sovereign immunity are to be strictly construed, the Supreme Court held that “actual damages” do not include nonpecuniary damages (Fed. Aviation Admin. v. Cooper, 566 U.S. 284 (2012)). Remedies for failure to grant access or refusal to amend are injunctive.
The Privacy Act was amended in 1988 by the Computer Matching and Privacy Protection Act of 1988 (Pub. L. No. 100-503). OMB issued final guidance implementing the amendment’s provisions on June 19, 1989 (54 Fed. Reg. 25,818 (June 19, 1989)). The amendments added sections 552a(o)-(q) to establish procedural safeguards affecting agencies’ use of Privacy Act records when performing computerized matching programs. The amendments require agencies to conclude written agreements specifying terms and safeguards under which matches are to be done. They provide procedures for individuals whose information is contained in the affected records to use to prevent agencies from taking adverse actions unless they have independently verified the results of matching and given the individual advance notice. Oversight is established by requiring Federal Register notice of matching agreements, by requiring reports to OMB and Congress, and by requiring the establishment of internal “data integrity boards” to oversee and coordinate the agency’s implementation of matching programs.
The Privacy Act restricts use of an individual’s Social Security account number (Section 7 of Pub. L. No. 93-579, 88 Stat. 1896) (not codified as part of 5 U.S.C. § 552a). This provision applies to state and local governments as well as the federal government and makes it unlawful to deny any right, benefit, or privilege based on an individual’s failure to disclose the Social Security account number, unless the disclosure was required by any federal, state, or local system of records in operation before January 1, 1975, or the disclosure is required by federal law. Since enactment, Congress has required disclosure in the Tax Reform Act of 1976 (Pub. L. No. 94-455), the Deficit Reduction Act of 1984 (Pub. L. No. 98-369), and the Debt Collection Act of 1982 (Pub. L. No. 97-365). In the Tax Reform Act of 1976, Congress declared it to be U.S. policy to use Social Security account numbers “in the administration of any tax, general public assistance, driver’s license, or motor vehicle registration law.” Pub. L. No. 94-455, amending 42 U.S.C. § 405(c)(2).
The vast majority of OMB’s Privacy Act guidelines are published at 40 Fed. Reg. 28,948-78 (1975). However, these original guidelines have been supplemented in particular subject areas over the years, including:
Guidelines on the Relationship of the Debt Collection of 1982 to the Privacy Act of 1974, 48 Fed. Reg. 15,556-60 (Apr. 11, 1983) (relationship to Debt Collection Act).
The bills were not reconciled by the usual conference committee because of the limited time available between the end of Thanksgiving recess and the end of the session. Instead, the respective staffs of the committees studied the differing bills, reported to the committees and, after informal meetings, reached an agreement. The description of the amendments that made the two bills identical (thus avoiding a conference committee) was inserted into the record of both sides, and both houses passed identical bills. Thus, many of the most important provisions of the bill are not explained by committee reports. The only record of the final negotiations leading to the bill actually adopted is a staff memorandum entitled Analysis of House and Senate Compromise Amendments to the Federal Privacy Act (see 120 Cong. Rec. 40,445, (Dec. 17, 1974); see also Legislative History of the Privacy Act of 1974, S.3418 (Pub. L. No. 93-579): Source Book on Privacy (1976)).
t instructed OMB to develop guidelines for the implementation of the Privacy Act throughout the executive branch; and
Retrieved from "https://sourcebook.acus.gov/index.php?title=Privacy_Act&oldid=1355"