Privacy Act of 1974

The Privacy Act of 1974 (P.L. 93-579, 88 Stat. 1896) imposed an entirely new body of requirements on the federal government's handling of information concerning individuals. Although the statute incorporated a complex set of definitions and contained many exceptions, the Privacy Act reduced the unnecessary collection of private information by the federal government, prevented improper disclosure of such information, and gave individuals tools to determine what information the government held about them and how to correct errors in the records. The act also narrowed the range of circumstances under which any federal, state, or local government agency could deny an individual any right, benefit, or privilege for refusing to disclose his or her Social Security number.

Constitutional Basis

The Privacy Act principally imposes restrictions on the operation of the federal government itself, and there has not been extensive analysis of the constitutional basis for the legislation. Presumably, the ultimate authority for the act is in the powers underlying the federal activities to which the relevant information pertains. Congress may also be thought to have enacted a statute that is "necessary and proper" for carrying out those powers.

The agencies of the federal government collect, maintain, and use vast and varied quantities of information about individuals. This information is of critical importance to individuals seeking government benefits, licenses, or employment, yet often these records contain serious errors. Threats to personal privacy could further be exacerbated by the increasing sophistication of the computerized techniques available to collect and combine pieces of information. While there are many circumstances in which access to private information is essential to the efficient operation of the government, proponents have argued that there were too many situations in which the information was wrongly disclosed—either to persons with no proper need to receive it, or to others as retaliation against individuals who held unpopular or controversial views. Proponents argued that not only should information collection and retention by government agencies be narrowly confined to proper operational needs, but individuals should be given efficient means to determine this information and to force correction of inaccuracies.

As the legislation proceeded through the Senate and the House, two quite different approaches emerged. The Senate bill would have created a Federal Privacy Board with broad power to regulate the information practices of both public and private entities; the House bill provided access to records and a method of bringing about the correction of errors. Both the Senate and House bills were adopted by their respective bodies on November 21, 1974, but the substantial differences between the bills and the short time remaining in the session made it questionable whether there was time to follow the normal practice of appointing a Conference Committee to reconcile the conflicting versions of the legislation. Instead, the staffs of the relevant House and Senate committees worked with those members of Congress most directly involved to produce a compromise bill. The compromise package was then adopted by both houses of Congress.

Political Context

The Privacy Act was one of many statutes adopted in the immediate aftermath of Watergate, and the legislation (along with amendments to the Freedom of Information Act enacted the same year) responded to concerns about the potential for government misuse of private information and to calls for heightened government accountability to the public. The Ford Administration, however, raised a number of objections to the proposed legislation and in particular to the Senate bill. The compromise ultimately reached was much less sweeping than originally proposed, with the adopted legislation limited in applicability to the federal government, and a study commission on privacy replacing the proposed regulatory agency. A "routine use" exception to the restrictions on the transfer of information between agencies was added to the bill as well. Taken together, the compromises removed the administration's objections to passage of the bill and paved the way for President Ford to sign the bill, which he did on December 31, 1974.

There has not been a sweeping interpretation of the Privacy Act by the Supreme Court; rather, there have been numerous decisions by lower federal courts interpreting and applying the statute's provisions. Many issues have arisen involving the relationship of the Privacy Act to other statutes or the precise meaning of the detailed definitions in the legislation. Since most aspects of the Privacy Act apply only if a "record" is "contained in a system of records," many cases have explored that threshold question; others have turned on whether an agency's use or disclosure of particular information was proper, and on whether one of the general or specific exemptions to the disclosure requirements of the act justified an agency's refusal to disclose its records to an individual requesting records about him or herself.

The Computer Matching and Privacy Protection Act of 1988 amended the Privacy Act by imposing safeguards designed to guard against unfair use of computer matching programs. There have also been a number of narrow amendments to specific provisions of the Privacy Act.

Federal employees who improperly disclose information about individuals may be prosecuted under certain circumstances, but the enforcement of the Privacy Act has principally been pursued through civil lawsuits authorized by the statute. Individuals may sue in federal district courts to obtain disclosure of records to which they are entitled under the statute, to obtain corrections of records, and to challenge the information practices followed by agencies. Successful plaintiffs may recover attorney fees and costs, and damage awards are also available if certain types of agency violations are "intentional or willful."

The Privacy Act focused attention on the collection and possible misuse of information concerning individuals, and those issues have gained much greater prominence over the years since passage of the legislation. Congress considered taking a much broader approach, which would have regulated both private and governmental actors, but the final legislation was directed at federal agencies and hedged by many exceptions and limitations.

With the emergence of the Internet and the recognition that great quantities of information are readily available to private individuals, current debates about privacy rights and proposals for the protection of individual privacy tend not to be limited to information collection, handling, and dissemination conducted by federal agencies. Following the terrorist attacks of September 2001, there was considerable resistance to restricting information gathering, thought to make it more difficult to fight terrorism. Many aspects of the Privacy Act's application depend on other provisions of federal law, since under the terms of the act itself either release or disclosure records may ultimately be controlled by another statute. The Freedom of Information Act in particular deals with a number of closely related issues.