Privacy Act of 1974

The Privacy Act codifies the Fair Information Practice Principles (FIPPs) for federal agencies. It requires agencies to maintain only records that are relevant and necessary to accomplish a lawful purpose, to collect information directly from the individual whenever practicable, and to ensure that records are accurate, relevant, timely, and complete before dissemination. Individuals are granted the right to access records about themselves, to request amendment of inaccurate records, and to sue the agency for noncompliance. Agencies must also publish in the Federal Register a notice of the existence and character of each system of records, including the categories of records and routine uses.

The Act contains specific exemptions. General exemptions allow agencies to exempt certain systems of records (e.g., those used for law enforcement or national security) from most requirements. Specific exemptions permit limited exceptions to access and amendment rights for records maintained by the CIA and certain law enforcement agencies.² Enforcement is primarily through civil remedies: individuals may bring civil actions against agencies for violations, and criminal penalties apply to officers or employees who willfully disclose protected records without authorization. The Office of Management and Budget (OMB) issues guidance and oversees agency implementation.

The Privacy Act was enacted in the same year as the Freedom of Information Act (FOIA) amendments, and the two laws are often considered together, but they have distinct purposes: FOIA promotes disclosure, while the Privacy Act protects personal privacy. A notable edge case is the 'routine use' exception, which allows agencies to share records without consent for purposes compatible with the original collection—this has been interpreted broadly, enabling data sharing for law enforcement and public health.³ Another lesser-known provision is the requirement for agencies to keep an accounting of disclosures, which individuals can request. The Act also established the Privacy Protection Study Commission, which issued influential recommendations in 1977, many of which were never enacted. The Act applies only to federal agencies, not to private companies, and it does not cover records held by state or local governments.⁴

The Privacy Act has been called the 'cornerstone' of U.S. privacy law, but its limitations have become apparent in the digital age. It does not apply to the private sector, and its definition of 'record' is tied to a person's name or identifier, which can be problematic with big data analytics. Courts have held that the Act does not create a constitutional right to privacy, and its remedies are limited to actual damages. Despite these limits, it remains a model for privacy legislation worldwide, and its principles are echoed in the EU's General Data Protection Regulation (GDPR).⁵ In recent years, agencies have struggled with the Act's requirements in the context of data breaches and the use of artificial intelligence, prompting calls for reform.

System of records

A group of records under the control of an agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifier.

Routine use

A disclosure of a record outside the agency for a purpose compatible with the purpose for which it was collected, as published in the Federal Register.

Fair Information Practice Principles (FIPPs)

A set of principles for the fair handling of personal information, including notice, choice, access, and security.