The Privacy Act of 1974, a United States federal law, establishes a Code of Fair
Information Practice that governs the collection, maintenance, use, and
dissemination of personally identifiable information about individuals that is
maintained in systems of records by federal agencies. A system of records is
a group of records under the control of an agency from which information is
retrieved by the name of the individual or by some identifier assigned to the
individual. The Privacy Act requires that agencies give the public notice of
their systems of records by publication in the Federal Register. The Privacy Act
prohibits the disclosure of information from a system of records absent the
written consent of the subject individual, unless the disclosure is
pursuant to one of twelve statutory exceptions. The Act also provides
individuals with a means by which to seek access to and amendment of their
records, and sets forth various agency record-keeping requirements.
Provisions of the Privacy Act = Conditions of disclosure =
The Privacy Act states in part: No agency shall disclose any record
which is contained in a system of records by any means of communication to
any person, or to another agency, except pursuant to a written request by, or
with the prior written consent of, the individual to whom the record
pertains... There are specific exceptions for the
record allowing the use of personal records:
For statistical purposes by the Census Bureau and the Bureau of Labor
Statistics For routine uses within a U.S.
government agency For archival purposes "as a record which
has sufficient historical or other value to warrant its continued preservation by
the United States Government" For law enforcement purposes
For congressional investigations Other administrative purposes
The Privacy Act mandates that each United States Government agency have in
place an administrative and physical security system to prevent the
unauthorized release of personal records.
To protect the privacy and liberty rights of individuals, federal agencies
must state "the authority which authorizes the solicitation of the
information and whether disclosure of such information is mandatory or
voluntary" when requesting information. This notice is common on almost all
federal government forms which seek to gather information from individuals,
many of which seek personal and confidential details.
= Department of Justice = Subsection u requires that each agency
have a Data Integrity Board. It is supposed to make an annual report to
OMB, available to the public, that includes all complaints that the Act was
violated, such as use of records for unauthorized reasons or the holding of
First Amendment Records and report on —…"(v) any violations of matching
agreements that have been alleged or identified and any corrective action
taken”. Former Attorney General Dick Thornburg appointed a Data Integrity
Board but since then USDOJ has not published any Privacy Act reports.
Computer Matching and Privacy Protection Act
The Computer Matching and Privacy Protection Act of 1988, P.L. 100–503,
amended the Privacy Act of 1974 by adding certain protections for the
subjects of Privacy Act records whose records are used in automated matching
programs. These protections have been mandated to ensure:
procedural uniformity in carrying out matching programs;
due process for subjects in order to protect their rights, and
oversight of matching programs through the establishment of Data Integrity
Boards at each agency engaging in matching to monitor the agency's
matching activity. The Computer Matching Act is codified as
part of the Privacy Act. = Access to records =
The Privacy Act also states: Each agency that maintains a system of
records shall— upon request by any individual ...
permit him ... to review the record and have a copy made of all or any portion
thereof in a form comprehensible to him ...
permit the individual to request amendment of a record pertaining to him
... = Issues of scope =
The Privacy Act does apply to the records of every "individual," but the
Privacy Act only applies to records held by an "agency". Therefore the records
held by courts, executive components, or non-agency government entities are not
subject to the provisions in the Privacy Act and there is no right to these
records. Exemptions
Following the controversial Passenger Name Record agreement signed with the
European Union in 2007, the Bush administration provided an exemption for
the Department of Homeland Security and the Arrival and Departure Information
System from the U.S. Privacy Act. ADIS is intended to authorize people to
travel only after PNR and API data has been checked and cleared through a US
agency watchlist. The Automated Targeting System is also to be exempted.
The Privacy Act does not protect non-US persons, which is problematic for the
exchange of Passenger Name Record information between the US and the
European Union. See also
Data privacy Digital identity
Privacy Civil liberties
Information privacy law Federal Records Act
References Source
This article uses material from the public domain source:
'"The Privacy Act of 1974". United States Department of Justice.
External links Privacy Act of 1974
Privacy Office at the Department of Homeland Security
OMB Guidance for Implementing the Privacy Provisions of the E-Government
Act of 2002 DOD CIO re Privacy Impact Assessments
US NSF re Privacy Impact Assessments