Source: https://sourcebook.acus.gov/index.php?title=Privacy_Act&oldid=1208
Timestamp: 2020-08-07 15:45:36
Document Index: 3259485

Matched Legal Cases: ['§ 552', '§ 552', '§ 552', '§ 552', '§ 552', '§ 552', '§ 552', '§ 405']

Revision as of 11:34, 16 November 2018 by Frank (talk | contribs)
The Privacy Act of 1974 represents the Congressional response to concerns about government uses of information collected about private individuals. The Privacy Act gives individuals greater control over gathering, dissemination, and ensuring accuracy of information collected about themselves by agencies. (Miller v. United States, 630 F. Supp. 347 (E.D.N.Y. 1986)). The main purpose of the Privacy Act is to forbid disclosure unless it is required by the Freedom of Information Act. (Lovell v. Alderete, 630 F.2d 428 (5th Cir. 1980)). To protect individual privacy, the Privacy Act constrains executive branch recordkeeping, defines the individual’s right to access certain records, limits agency disclosure of records containing an individual’s private information, establishes safeguards to protect records concerning individuals, and provides remedies for agency violation of the Privacy Act’s provisions.
Agencies are prohibited from maintaining records describing how an individual exercises First Amendment rights, unless such records are authorized by statute or are pertinent to and within the scope of authorized law enforcement activity (§ 552a(e)(7)). Such records are subject to the Privacy Act even if not kept in “a system of records.” Clarkson v. IRS, 678 F.2d 1368 at 1373-77 (11th Cir. 1982), cert. denied, 481 U.S. 1031. Cf. Pototsky v. U.S. Dep’t of Navy, 717 F. Supp. 20 (D. Mass. 1989). OMB guidelines call for the broadest reasonable interpretation of the prohibition.
The Privacy Act provides general (§ 552a(j)) and specific (§ 552a(k)) exemptions. These are exemptions allowing an agency to deny access to the record by the individual to whom the record pertains. The two types of exemptions are different in nature and consequences and are discretionary on the agency’s part. To be effective, the agency must first determine that a record or system of records meets the criteria for exemption under the Privacy Act and then publish the exemption as a rule under the APA’s notice and comment provisions. Failure to set out reasons demonstrating that the exemption meets the requirements of the Privacy Act may leave the records subject to the Privacy Act. Exner v. FBI, 612 F.2d 1202 (9th Cir. 1980). The exemptions do not authorize the agency to use the record in a manner other than the manner originally set out in the Federal Register establishing the system of records. Doe v. Naval Air Station, 768 F.2d 1229 (11th Cir. 1985).
The Privacy Act prohibits disclosure of any record covered by the Privacy Act without the written request or prior written consent of the person whom the record concerns (§ 552a(b)). The restriction on disclosure applies to any person or agency and includes any means of communication—written, oral, electronic, or mechanical (OMB Privacy Act Guidelines, 40 Fed. Reg. 28,948, 28,953 (July 9, 1975)). Information obtained (or released) through sources independent of agency records is not “disclosure” under the Privacy Act.
“Routine use,” considered generally the most important exception, is defined as “the use of such record for a purpose that is compatible with the purpose for which it was collected” (§ 552a(a)(7)). Each routine use is identified in the Federal Register notice upon establishment or revision of each system of records (§ 552a(e)(4)(D)). This exception permits nonconsensual intra- or interagency transfer of what is generally described as “house-keeping” information. Because the language is broad, the potential for abuse is considered great, and the courts have strictly required that the use be clearly and specifically identified in the rule adopted by the agency identifying the system of records (Covert v. Harrington, 876 F.2d 751 (9th Cir. 1989); Doe v. Stephens, 851 F.2d 1457 (D.C. Cir. 1988); Zeller v. United States, above). The Supreme Court has found that the Privacy Act’s provisions restricting disclosure, even while allowing disclosure for “routine uses,” are sufficient to protect persons’ constitutional right to informational privacy, if such a right exists (NASA v. Nelson, 562 U.S. 134, 153-55 (2011)).
The Privacy Act was amended in 1988 by Pub. L. No. 100-503, the Computer Matching and Privacy Protection Act of 1988. The Office of Management and Budget issued final guidance implementing the amendment’s provisions on June 19, 1989 (54 Fed. Reg. 25,818 (June 19, 1989)). The amendments added sections 552a(o)-(q) to establish procedural safeguards affecting agencies’ use of Privacy Act records when performing computerized matching programs. The amendments require agencies to conclude written agreements specifying terms and safeguards under which matches are to be done. They provide procedures for individuals whose information is contained in the affected records to use to prevent agencies from taking adverse actions unless they have independently verified the results of matching and given the individual advance notice. Oversight is established by requiring Federal Register notice of matching agreements, by requiring reports to OMB and Congress, and by requiring the establishment of internal “data integrity boards” to oversee and coordinate the agency’s implementation of matching programs.
The Privacy Act restricts use of an individual’s Social Security account number (Section 7 of Pub. L. No. 93-579, 88 Stat. 1896) (not codified as part of 5 U.S.C. § 552a). This provision applies to state and local governments as well as the federal government and makes it unlawful to deny any right, benefit, or privilege based on an individual’s failure to disclose the Social Security account number, unless the disclosure was required by any federal, state, or local system of records in operation before January 1, 1975, or the disclosure is required by federal law. Since enactment, Congress has required disclosure in the Tax Reform Act of 1976, the Deficit Reduction Act of 1984, and the Debt Collection Act of 1982. In the Tax Reform Act of 1976, Congress declared it to be U.S. policy to use Social Security account numbers “in the administration of any tax, general public assistance, driver’s license, or motor vehicle registration law . . . .” Pub. L. No. 94-55, 90 Stat. 1520, 1711, July 9, 1976, amending 42 U.S.C. § 405(c)(2)).
The Office of Management and Budget is required by the Privacy Act to develop guidelines and regulations for its implementation and to provide continuing assistance and oversight. The OMB guidelines are entitled to the usual deference accorded the interpretations of the agency charged with administration of a statute. (Albright v. United States, 631 F.2d 915, 919 n.5 (D.C. Cir. 1980); Quinn v. Stone, 978 F.2d 126, 133 (3d Cir. 1992)). However, a few courts have rejected particular aspects of the OMB Guidelines as inconsistent with the statute. See, e.g., Kassel v. U.S. Dep’t of Veterans Affairs, No. 87-217-S, slip op. at 24-25 (D.N.H. Mar. 30, 1992) (subsection (e)(3)); Doe v. Chao, 540 U.S. 614, 627 n.11 (2004) (disagreeing with dissent’s reliance on OMB interpretation of damages provision since the Court does “not find its unelaborated conclusion persuasive”).
In 1998, President Clinton called upon all federal agencies to take further privacy-protection steps within the next year. Memorandum on Privacy and Personal Information in Federal Records (May 14, 1998). Specifically, the President directed each agency to designate a senior official with responsibility for privacy policy to apply the Principles for Providing and Using Personal Information that were developed through the Information Infrastructure Task Force under the auspices of the Department of Commerce in 1995, and to conduct a series of reviews of agency record systems in order to ensure compliance with Privacy Act requirements. The Privacy Act related reviews, conducted in accordance with instructions issued by OMB, reported results to OMB. The memorandum also provided that OMB issue further guidance on the making of “routine use” disclosures under the Privacy Act.
Section 208 of the E-Government Act of 2002 (Pub. L. No. 107-347, 44 U.S.C. ch. 36) requires that OMB issue guidance to agencies on implementing the privacy provisions of the E-Government Act. Under this guidance, agencies are required to conduct privacy impact assessments for electronic information systems and collections; make them publicly available; post privacy policies on agency websites used by the public; translate privacy policies into a standardized machine-readable format; and report annually to OMB on compliance with the E-Government Act.
In 2002 GAO conducted an extensive review of agency Privacy Act practices, and reported on its findings in June 2003. GAO-03-304, Privacy Act: OMB Leadership Needed to Improve Agency Compliance (2003).
While most questions concerning the Privacy Act should first be directed to agency Privacy Act officers, important policy or litigation questions, or questions concerning the OMB Guidelines, may be directed to the Office of Information and Regulatory Affairs, OMB.
Retrieved from "https://sourcebook.acus.gov/index.php?title=Privacy_Act&oldid=1208"