Under the Privacy Act, 5 U.S.C. § 552a, unless permitted under an exception, federal agencies are prohibited from disclosing records contained in a system of records pertaining to any person. Further, individuals may request their own records or request the federal agency amend their records under the Act.
Under the Privacy Act, apart from an individual’s request for or consent to release records, federal agencies can only disclose an individual’s personal records in the following situations:
- to those officers and employees of the agency who need those records to perform their duties,
- as required under the Freedom of Information Act,
- for “routine use,” meaning using the record for a purpose compatible with the purpose for which it was collected,
- to the Bureau of the Census for purposes of census, survey, or similar,
- to the National Archives and Records Administration,
- to a consumer reporting agency in accordance with 31 USC § 3711,
- to a recipient for use in statistical research or reporting, provided that the records are not individually identifiable,
- pursuant to court order or to another federal agency for a civil or criminal law enforcement activity,
- to either House of Congress or committee or subcommittee with jurisdiction,
- to a person who shows compelling circumstances affecting the health or safety of an individual,
- to the Comptroller General or his/her authorized representative in the course of performing duties of the Government Accountability Office
With some exceptions, federal agencies must keep an accurate accounting of disclosures of records, including the date, nature, and purpose of the disclosure, and the name and address of the person or agency receiving the records. The federal agency must maintain this accounting for at least five years or for the life of the record, whichever is longer.
Individuals may bring a claim in federal district court for violations of the Privacy Act. Individuals may bring a claim where a federal agency:
- Fails to produce a copy of those records upon request by the subject individual,
- Refuses to amend a record as requested or fails to review a request for compliance with the Privacy Act’s requirements,
- Fails to maintain any record concerning an individual with such accuracy, relevance, timeliness, and completeness to ensure fairness in any determination related to an individual’s qualifications, character, rights, opportunities, or benefits that may be made based on those records and the agency has consequently made a determination that has an adverse effect on an individual,
- Fails to comply with any other provision of the Privacy Act or its regulations in such a way as to have an adverse effect on an individual.
