Source: https://sourcebook.acus.gov/index.php?title=Privacy_Act&diff=1484&oldid=1355
Timestamp: 2020-08-15 13:32:41
Document Index: 686386895

Matched Legal Cases: ['§ 552', '§ 552', '§ 552', '§ 552', '§ 552', '§ 552', '§ 552', '§ 552', '§ 552', '§ 552', '§ 3501']

Revision as of 12:59, 4 December 2018 (view source)
(→‎Oversight)
The Privacy Act covers records maintained by agencies as defined in FOIA. It applies to Cabinet level departments, independent regulatory agencies, military departments, and government corporations (5 U.S.C. § [http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim 552a(a)(1)]). It does not apply to the legislative branch, national banks (''United States v. Miller'', 643 F.2d 713 (10th Cir. 1981)), or Amtrak (''Ehm v. National R.R.'' ''Passenger Corp.'', 732 F.2d 1250 (5th Cir. 1984), ''cert. denied'', 469 U.S. 982 (1984)). ''See Alexander v. FBI'', 971 F. Supp. 603, 606-07 (D.D.C. 1997) (although recognizing that the definition of “agency” under Privacy Act is same as in FOIA and that courts have interpreted that definition under FOIA to exclude the President’s immediate personal staff and units within Executive Office of the President whose sole function is to advise and assist the President, nevertheless rejecting such limitation with regard to “agency” as used in Privacy Act due to different purposes that the two statutes serve); ''Shannon v. Gen. Elec. Co.'', 812 F. Supp. 308, 313, 315 n.5 (N.D.N.Y. 1993) (“no dispute” that GE falls within definition of “agency” subject to requirements of Privacy Act where pursuant to contract it operated Department of Energy-owned lab under supervision, control, and oversight of department and where by terms of contract GE agreed to comply with Privacy Act).
A record is a collection or grouping of information about an individual that, for example, may include educational, financial, or biographical information, together with personal identifiers such as names, photos, numbers, or fingerprints. (5 U.S.C. § [http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim 552a(a)(4)]). It does not apply to all government records and documents that may contain an individual’s name or other private information. For example, it does not include private notes of a supervisor if such notes are not used by the agency to make decisions (''Johnston v. Horne'', 875 F.2d 1415 (9th Cir. 1989)), but such notes may become subject to the Privacy Act if they become part of an agency’s decision. (''Chapman v. NASA'', 682 F.2d 526 (5th Cir. 1982), ''cert. denied'', 469 U.S. 1038 (1984)). It also does not apply to information in documents obtained from independent sources of information, even though identical information may be in an agency’s system of records (''Thomas v. U.S. Dep’t of Energy'', 719 F.2d 342 (10th Cir. 1983)).
The Privacy Act focuses on “systems of records” established, maintained, or controlled by an agency. A “system of records” is a group of any records where individual names or other individual identifiers can be used to retrieve the information (5 U.S.C. § [http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim 552a(a)(5)]). Agencies may maintain records covered by the Privacy Act only when they are relevant and necessary to accomplish the agency’s purpose (5 U.S.C. § [http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim 552a(e)(1)]). The Court of Appeals for the District of Columbia Circuit addressed the “system of records” definition in the context of computerized information in ''Henke v. U.S. Dep’t of Commerce'', 83 F.3d 1453 (D.C. Cir. 1996), and noted that “the OMB guidelines make it clear that it is not sufficient that an agency has the capability to retrieve information indexed under a person’s name, but the agency must in fact retrieve records in this way in order for a system of records to exist.” ''Id.'' at 1460 n.12. The D.C. Circuit looked to Congress’ use of the words “is retrieved” in the statute’s definition of a system of records and focused on whether the agency “in practice” retrieved information. ''Id.'' at 1459-61.
When the agency collects information that “may result in adverse determinations about an individual’s rights, benefits, and privileges under Federal programs,” the Privacy Act requires the information to be collected, to the “greatest extent practicable,” directly from the affected individual (§ [http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim 552a(e)(2)]). When requesting such information from individuals, the agency must disclose: (1) the authority under which collection is authorized; (2) the principal purposes for which the information is needed; (3) the routine use of the information; and (4) consequences, if any, of not providing the information (§ 552a(e)(3)).
Agencies are prohibited from maintaining records describing how an individual exercises First Amendment rights, unless such records are authorized by statute or are pertinent to and within the scope of authorized law enforcement activity (§ [http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim 552a(e)(7)]). Such records are subject to the Privacy Act even if not kept in “a system of records.” ''Clarkson v. IRS'', 678 F.2d 1368 at 1373-77 (11th Cir. 1982), ''cert. denied'', 481 U.S. 1031. ''Cf. Pototsky v. U.S. Dep’t of Navy'', 717 F. Supp. 20 (D. Mass. 1989). Guidelines from the Office of Management and Budget (OMB) call for the broadest reasonable interpretation of the prohibition.
The Privacy Act provides general (§ [http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim 552a(j)]) and specific (§ 552a(k)) exemptions. These are exemptions allowing an agency to deny access to the record by the individual to whom the record pertains. The two types of exemptions are different in nature and consequences and are discretionary on the agency’s part. To be effective, the agency must first determine that a record or system of records meets the criteria for exemption under the Privacy Act and then publish the exemption as a rule under the [[Administrative Procedure Act]]’s (APA) notice-and-comment provisions. Failure to set out reasons demonstrating that the exemption meets the requirements of the Privacy Act may leave the records subject to the Privacy Act. ''Exner v. FBI'', 612 F.2d 1202 (9th Cir. 1980). The exemptions do not authorize the agency to use the record in a manner other than the manner originally set out in the ''Federal Register'' establishing the system of records. ''Doe v. Naval Air Station'', 768 F.2d 1229 (11th Cir. 1985).
The specific exemptions (§ [http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim 552a(k)(1)(7)]) are available to any agency if the head of the agency promulgates rules pursuant to the notice-and-comment provisions of the [[Administrative Procedure Act|APA]] (5 U.S.C. § [http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section553&num=0&edition=prelim 553]). The specific exemption is from a particular provision of the Privacy Act. The seven exemptions allowed are:
The Privacy Act prohibits disclosure of any record covered by the Privacy Act without the written request or prior written consent of the person whom the record concerns (§ [http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim 552a(b)]). The restriction on disclosure applies to any person or agency and includes any means of communication—written, oral, electronic, or mechanical [https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/assets/OMB/inforeg/implementation_guidelines.pdf Responsibilities for the Maintenance of Records About Individuals by Federal Agencies], 40 Fed. Reg. 28,948, 28,953 (July 9, 1975). Information obtained (or released) through sources independent of agency records is not “disclosure” under the Privacy Act.
*use by “any governmental jurisdiction . . . for a civil or criminal law enforcement activity” as long as a written request (1) is made by the head of the agency seeking the record, (2) specifies the portion of the record sought, and (3) describes the relevant enforcement activity. (''See Doe v. Naval Air Station'', 768 F.2d 1229 (11th Cir. 1985))
“Routine use,” considered generally the most important exception, is defined as “the use of such record for a purpose that is compatible with the purpose for which it was collected” (§ [http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim 552a(a)(7)]). Each routine use is identified in the ''Federal Register'' notice upon establishment or revision of each system of records (§ 552a(e)(4)(D)). This exception permits nonconsensual intra- or interagency transfer of what is generally described as “house-keeping” information. Because the language is broad, the potential for abuse is considered great, and the courts have strictly required that the use be clearly and specifically identified in the rule adopted by the agency identifying the system of records (''Covert v. Harrington'', 876 F.2d 751 (9th Cir. 1989); ''Doe v. Stephens'', 851 F.2d 1457 (D.C. Cir. 1988); ''Zeller v. United States'', 467 F. Supp. 487 (E.D.N.Y. 1979)). The Supreme Court has found that the Privacy Act’s provisions restricting disclosure, even while allowing disclosure for “routine uses,” are sufficient to protect persons’ constitutional right to informational privacy, if such a right exists (''NASA v. Nelson'', 562 U.S. 134, 153-55 (2011)).
The Privacy Act provides that each agency shall promulgate rules that establish, among other things, procedures of notice, disclosure, and review of requests (§ [http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim 552a(f)]). In the event that the rules are not followed or that a dispute persists, there are four civil actions: (1) a challenge for failure to provide access; (2) a challenge for refusal to amend; (3) a damages action for improper maintenance of the content of records; and (4) a damages action for other breaches of the Privacy Act or regulations issued thereunder that adversely affect the individual (§ 552a(g)(1)). The latter two actions require proof of damages and are limited to actual damages. A cause of action for monetary damages requires a showing of an agency’s intentional or willful failure to maintain accurate records and that the violation of the Privacy Act caused the actual damages complained of (''Molerio v. FBI'', 749 F.2d 815, 826 (D.C. Cir. 1984)). Because waivers of sovereign immunity are to be strictly construed, the Supreme Court held that “actual damages” do not include nonpecuniary damages ([https://www.supremecourt.gov/opinions/11pdf/10-1024.pdf Fed. Aviation Admin. v. Cooper], 566 U.S. 284 (2012)). Remedies for failure to grant access or refusal to amend are injunctive.
Criminal penalties are established for willful disclosure of records by those who know such disclosure is prohibited, willful maintenance of a system of records without meeting the appropriate notice requirements, and knowing and willful requests for records under false pretenses (§ [http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim 552a(i)]). Each violation is classified as a misdemeanor, and the violator may be fined not more than $5,000. There have been at least two criminal prosecutions for unlawful disclosure of Privacy Act-protected records. ''See United States v. Trabert'', 978 F. Supp. 1368 (D. Colo. 1997) (defendant found not guilty; prosecution did not prove “beyond a reasonable doubt that defendant ‘willfully disclosed’ protected material”; evidence presented constituted, “at best, gross negligence,” and thus was “insufficient for purposes of prosecution under § 552a(i)(1)”); ''United States v. Gonzalez'', No. 76-132 (M.D. La. Dec. 21, 1976) (guilty plea entered). ''See generally In re Mullins (Tamposi Fee Application)'', 84 F.3d 1439, 1441 (D.C. Cir. 1996) (''per curiam'') (case concerning application for reimbursement of attorney fees where independent counsel found no prosecution was warranted under Privacy Act because there was no conclusive evidence of improper disclosure of information). In a case involving the destruction of records, [https://www.cadc.uscourts.gov/internet/opinions.nsf/1E0F642CD84E034985257B3D004E4186/$file/09-5354-1427961.pdf Gerlich v. DOJ], 711 F.3d 161 (D.C. Cir. 2013), the D.C. Circuit allowed a Privacy Act claim to proceed against senior officials at the Department of Justice on the ground that they created records about appellants in the form of annotations to their applications and internet printouts concerning their political affiliations. The court relied in part on a permissive spoliation inference in light of the destruction of appellants’ records, because the senior department officials had a duty to preserve the annotated applications and internet printouts given that department investigation and future litigation were reasonably foreseeable.
The Privacy Act provides a two-year statute of limitations (§ [http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim 552a(g)(5)]). The time begins to run when a reasonable person should have known of the alleged violation. ''Rose v. United States'', 905 F.2d 1257, 1259 (9th Cir. 1990); ''Diliberti v. United States'', 817 F.2d 1259, 1262 (7th Cir. 1987).
The Privacy Act was amended in 1988 by the Computer Matching and Privacy Protection Act of 1988 ([https://www.govinfo.gov/content/pkg/STATUTE-102/pdf/STATUTE-102-Pg2507.pdf Pub. L. No. 100-503]). OMB issued [https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/inforeg/inforeg/final_guidance_pl100-503.pdf final guidance] implementing the amendment’s provisions on June 19, 1989 (54 Fed. Reg. 25,818 (June 19, 1989)). The amendments added [http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim sections 552a(o)-(q)] to establish procedural safeguards affecting agencies’ use of Privacy Act records when performing computerized matching programs. The amendments require agencies to conclude written agreements specifying terms and safeguards under which matches are to be done. They provide procedures for individuals whose information is contained in the affected records to use to prevent agencies from taking adverse actions unless they have independently verified the results of matching and given the individual advance notice. Oversight is established by requiring ''Federal Register'' notice of matching agreements, by requiring reports to OMB and Congress, and by requiring the establishment of internal “data integrity boards” to oversee and coordinate the agency’s implementation of matching programs.
Two provisions relate to FOIA (5 U.S.C. § [http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552&num=0&edition=prelim 552]). [http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim Section 552a(b)(2)] exempts agencies from the requirement of obtaining an individual’s consent to release of information subject to disclosure under FOIA. In 1984, Congress added provisions delineating an individual’s access rights to records exempt from disclosure under FOIA or the Privacy Act. An agency must give an individual access to a record if it is accessible under either act irrespective of whether it might be withheld under the other (§ 552a(t)). This gives maximum access to records by an individual whose personal information is contained therein. An accounting of the number of FOIA releases of Privacy Act information is not required (§ 552a(c)(1)). If released under FOIA, the agency is relieved from ensuring the accuracy, completeness, timeliness, and relevance of the record (§ 552a(e)(6)). If the system of records is made necessary by FOIA, the agency may exempt the system from the Privacy Act (§ 552a(k)(1)).
The Privacy Act restricts use of an individual’s Social Security account number (Section 7 of [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf Pub. L. No. 93-579], 88 Stat. 1896) (not codified as part of 5 U.S.C. § 552a). This provision applies to state and local governments as well as the federal government and makes it unlawful to deny any right, benefit, or privilege based on an individual’s failure to disclose the Social Security account number, unless the disclosure was required by any federal, state, or local system of records in operation before January 1, 1975, or the disclosure is required by federal law. Since enactment, Congress has required disclosure in the Tax Reform Act of 1976 (Pub. L. No. 94-455), the Deficit Reduction Act of 1984 ([http://uscode.house.gov/statutes/pl/109/171.pdf Pub. L. No. 98-369]), and the Debt Collection Act of 1982 ([https://www.gpo.gov/fdsys/pkg/STATUTE-96/pdf/STATUTE-96-Pg1749.pdf Pub. L. No. 97-365]). In the Tax Reform Act of 1976, Congress declared it to be U.S. policy to use Social Security account numbers “in the administration of any tax, general public assistance, driver’s license, or motor vehicle registration law.” Pub. L. No. 94-455, amending 42 U.S.C. § [http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section405&num=0&edition=prelim 405(c)(2)].
The vast majority of OMB’s Privacy Act guidelines are published at [https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/assets/OMB/inforeg/implementation_guidelines.pdf 40 Fed. Reg. 28,948-78] (1975). However, these original guidelines have been supplemented in particular subject areas over the years, including:
* [https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdf Appendix I to OMB Circular No. A-130], most recently revised at [https://www.govinfo.gov/content/pkg/FR-2016-07-28/pdf/2016-17874.pdf#page=1 81 Fed. Reg. 49,689] (July 28, 2016)).
* [https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/assets/OMB/inforeg/implementation1974.pdf Implementation of the Privacy Act Supplemental Guidance], 40 Fed. Reg. 56,741 (Dec. 4,1975) (system of records definition, routine use and intra-agency disclosures, consent and congressional inquiries, accounting of disclosures, amendment appeals, rights of parents and legal guardians, relationship to FOIA).
* [https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/assets/OMB/inforeg/guidance1983.pdf Guidelines on the Relationship of the Debt Collection of 1982 to the Privacy Act of 1974], 48 Fed. Reg. 15,556-60 (Apr. 11, 1983) (relationship to Debt Collection Act).
* [https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/assets/OMB/inforeg/guidance_privacy_act.pdf Guidance on the Privacy Act Implications of “Call Detail” Programs to Manage Employees’ Use of the Government’s Telecommunications Systems], [https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/assets/OMB/inforeg/guidance_privacy_act.pdf 52 Fed. Reg. 12,990-93] (Apr. 20, 1987) (“call detail” programs).
* [https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/inforeg/inforeg/final_guidance_pl100-503.pdf Final Guidance Interpreting the Provisions of Public Law 100-503, the Computer Matching and Privacy Protection Act of 1988], [https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/inforeg/inforeg/final_guidance_pl100-503.pdf 54 Fed. Reg. 25,818] (June 19, 1989) (computer matching).
* [https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/assets/OMB/inforeg/computer_amendments1991.pdf The Computer Matching and Privacy Protection Amendments of 1990 and the Privacy Act of 1974], [https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/assets/OMB/inforeg/computer_amendments1991.pdf 56 Fed. Reg. 18,599] (proposed Apr. 23, 1991) (computer matching);
* [https://www.govinfo.gov/content/pkg/FR-1996-02-20/pdf/96-3645.pdf Management of Federal Information Resources], 61 Fed. Reg. 6428 (1996) (“Federal Agency Responsibilities for Maintaining Records About Individuals”).
* Thus, when researching in this area, it may be important to check subsequent supplements.
[http://uscode.house.gov/view.xhtml?req=(title:44%20section:3501%20edition:prelim)%20OR%20(granuleid:USC-prelim-title44-section3501)&f=treesort&edition=prelim&num=0&jumpTo=true Section 208] (44 U.S.C. § 3501 note) of the [[E-Government Act of 2002]] requires that OMB issue guidance to agencies on implementing the privacy provisions of the E-Government Act. Under this guidance, agencies are required to conduct privacy impact assessments for electronic information systems and collections, make them publicly available, post privacy policies on agency websites used by the public, translate privacy policies into a standardized machine-readable format, and report annually to OMB on compliance with the E-Government Act.
The Privacy Act reflects the merger of seemingly disparate bills from the Senate and the House: S. 3418, introduced by Senator Sam Ervin (D-NC), and H.R. 16373, supported by the Administration. The Senate bill would have granted sweeping powers to a Federal Privacy Board for the oversight of collection, maintenance, and dissemination of individually identifiable information by both the public and private sectors, while the House bill focused on access to and correction of records, as well as data collection and maintenance standards. The Senate approved its bill on November 21, 1974, after consideration and, on the same day, the House bill was passed by a 353 to 1 vote, after two days of floor debate.
The bills were not reconciled by the usual conference committee because of the limited time available between the end of Thanksgiving recess and the end of the session. Instead, the respective staffs of the committees studied the differing bills, reported to the committees and, after informal meetings, reached an agreement. The description of the amendments that made the two bills identical (thus avoiding a conference committee) was inserted into the record of both sides, and both houses passed identical bills. Thus, many of the most important provisions of the bill are not explained by committee reports. The only record of the final negotiations leading to the bill actually adopted is a staff memorandum entitled ''Analysis of House and Senate Compromise Amendments to the Federal Privacy Act'' (''see'' 120 Cong. Rec. 40,445, (Dec. 17, 1974); ''see also'' [http://www.loc.gov/rr/frd/Military_Law/pdf/LH_privacy_act-1974.pdf Legislative History of the Privacy Act of 1974, S.3418 (Pub. L. No. 93-579): Source Book on Privacy] (1976)).
*t instructed OMB to develop guidelines for the implementation of the Privacy Act throughout the executive branch; and