Document from the CPSR Privacy/Information Archive
FTP/Gopher/WAIS: cpsr.org    email: listserv@cpsr.org  "help"

Privacy Act of 1974 (as of Jan 1993)

¤ 552a. Records maintained on individuals

(a) Definitions.--For purposes of this section-- (1) the term "agency"
means agency as defined in section 552(e) of this title; (2) the term
"individual" means a citizen of the United States or an alien lawfully
admitted for permanent residence; (3) the term "maintain" includes
maintain, collect, use, or disseminate; (4) the term "record" means any
item, collection, or grouping of information about an individual that is
maintained by an agency, including, but not limited to, his education,
financial transactions, medical history, and criminal or employment
history and that contains his name, or the identifying number, symbol, or
other identifying particular assigned to the individual, such as a finger
or voice print or a photograph; (5) the term "system of records" means a
group of any records under the control of any agency from which
information is retrieved by the name of the individual or by some
identifying number, symbol, or other identifying particular assigned to
the individual; (6) the term "statistical record" means a record in a
system of records maintained for statistical research or reporting
purposes only and not used in whole or in part in making any
determination about an identifiable individual, except as provided by
section 8 of title 13; (7) the term "routine use" means, with respect to
the disclosure of a record, the use of such record for a purpose which is
compatible with the purpose for which it was collected; (8) the term
"matching program"-- (A) means any computerized comparison of-- (i) two
or more automated systems of records or a system of records with
non-Federal records for the purpose of-- (I) establishing or verifying
the eligibility of, or continuing compliance with statutory and
regulatory requirements by, applicants for, recipients or beneficiaries
of, participants in, or providers of services with respect to, cash or
in-kind assistance or payments under Federal benefit programs, or (II)
recouping payments or delinquent debts under such Federal benefit
programs, or (ii) two or more automated Federal personnel or payroll
systems of records or a system of Federal personnel or payroll records
with non-Federal records, (B) but does not include-- (i) matches
performed to produce aggregate statistical data without any personal
identifiers; (ii) matches performed to support any research or
statistical project, the specific data of which may not be used to make
decisions concerning the rights, benefits, or privileges of specific
individuals; (iii) matches performed, by an agency (or component thereof)
which performs as its principal function any activity pertaining to the
enforcement of criminal laws, subsequent to the initiation of a specific
criminal or civil law enforcement investigation of a named person or
persons for the purpose of gathering evidence against such person or
persons; (iv) matches of tax information (I) pursuant to section 6103(d)
of the Internal Revenue Code of 1986, (II) for purposes of tax
administration as defined in section 6103(b)(4) of such Code, (III) for
the purpose of intercepting a tax refund due an individual under
authority granted by section 464 or 1137 of the Social Security Act;  or
(IV) for the purpose of intercepting a tax refund due an individual under
any other tax refund intercept program authorized by statute which has
been determined by the Director of the Office of Management and Budget to
contain verification, notice, and hearing requirements that are
substantially similar to the procedures in section 1137 of the Social
Security Act; (v) matches-- (I) using records predominantly relating to
Federal personnel, that are performed for routine administrative purposes
(subject to guidance provided by the Director of the Office of Management
and Budget pursuant to subsection (v));  or (II) conducted by an agency
using only records from systems of records maintained by that agency; if
the purpose of the match is not to take any adverse financial, personnel,
disciplinary, or other adverse action against Federal personnel;  or (vi)
matches performed for foreign counterintelligence purposes or to produce
background checks for security clearances of Federal personnel or Federal
contractor personnel; (9) the term "recipient agency" means any agency,
or contractor thereof, receiving records contained in a system of records
from a source agency for use in a matching program; (10) the term
"non-Federal agency" means any State or local government, or agency
thereof, which receives records contained in a system of records from a
source agency for use in a matching program; (11) the term "source
agency" means any agency which discloses records contained in a system of
records to be used in a matching program, or any State or local
government, or agency thereof, which discloses records to be used in a
matching program; (12) the term "Federal benefit program" means any
program administered or funded by the Federal Government, or by any agent
or State on behalf of the Federal Government, providing cash or in-kind
assistance in the form of payments, grants, loans, or loan guarantees to
individuals;  and (13) the term "Federal personnel" means officers and
employees of the Government of the United States, members of the
uniformed services (including members of the Reserve Components),
individuals [FN1PP] entitled to receive immediate or deferred retirement
benefits under any retirement program of the Government of the United
States (including survivor benefits).

(b) Conditions of disclosure.--No agency shall disclose any record which
is contained in a system of records by any means of communication to any
person, or to another agency, except pursuant to a written request by, or
with the prior written consent of, the individual to whom the record
pertains, unless disclosure of the record would be-- (1) to those
officers and employees of the agency which maintains the record who have
a need for the record in the performance of their duties; (2) required
under section 552 of this title; (3) for a routine use as defined in
subsection (a)(7) of this section and described under subsection
(e)(4)(D) of this section; (4) to the Bureau of the Census for purposes
of planning or carrying out a census or survey or related activity
pursuant to the provisions of title 13; (5) to a recipient who has
provided the agency with advance adequate written assurance that the
record will be used solely as a statistical research or reporting record,
and the record is to be transferred in a form that is not individually
identifiable; (6) to the National Archives and Records Administration as
a record which has sufficient historical or other value to warrant its
continued preservation by the United States Government, or for evaluation
by the Archivist of the United States or the designee of the Archivist to
determine whether the record has such value; (7) to another agency or to
an instrumentality of any governmental jurisdiction within or under the
control of the United States for a civil or criminal law enforcement
activity if the activity is authorized by law, and if the head of the
agency or instrumentality has made a written request to the agency which
maintains the record specifying the particular portion desired and the
law enforcement activity for which the record is sought; (8) to a person
pursuant to a showing of compelling circumstances affecting the health or
safety of an individual if upon such disclosure notification is
transmitted to the last known address of such individual; (9) to either
House of Congress, or, to the extent of matter within its jurisdiction,
any committee or subcommittee thereof, any joint committee of Congress or
subcommittee of any such joint committee; (10) to the Comptroller
General, or any of his authorized representatives, in the course of the
performance of the duties of the General Accounting Office; (11) pursuant
to the order of a court of competent jurisdiction;  or (12) to a consumer
reporting agency in accordance with section 3711(f) of title 31.

(c) Accounting of Certain Disclosures.--Each agency, with respect to each
system of records under its control, shall-- (1) except for disclosures
made under subsections (b)(1) or (b)(2) of this section, keep an accurate
accounting of-- (A) the date, nature, and purpose of each disclosure of a
record to any person or to another agency made under subsection (b) of
this section;  and (B) the name and address of the person or agency to
whom the disclosure is made; (2) retain the accounting made under
paragraph (1) of this subsection for at least five years or the life of
the record, whichever is longer, after the disclosure for which the
accounting is made; (3) except for disclosures made under subsection
(b)(7) of this section, make the accounting made under paragraph (1) of
this subsection available to the individual named in the record at his
request;  and (4) inform any person or other agency about any correction
or notation of dispute made by the agency in accordance with subsection
(d) of this section of any record that has been disclosed to the person
or agency if an accounting of the disclosure was made.

(d) Access to records.--Each agency that maintains a system of records
shall-- (1) upon request by any individual to gain access to his record
or to any information pertaining to him which is contained in the system,
permit him and upon his request, a person of his own choosing to
accompany him, to review the record and have a copy made of all or any
portion thereof in a form comprehensible to him, except that the agency
may require the individual to furnish a written statement authorizing
discussion of that individual's record in the accompanying person's
presence; (2) permit the individual to request amendment of a record
pertaining to him and-- (A) not later than 10 days (excluding Saturdays,
Sundays, and legal public holidays) after the date of receipt of such
request, acknowledge in writing such receipt;  and (B) promptly, either--
(i) make any correction of any portion thereof which the individual
believes is not accurate, relevant, timely, or complete;  or (ii) inform
the individual of its refusal to amend the record in accordance with his
request, the reason for the refusal, the procedures established by the
agency for the individual to request a review of that refusal by the head
of the agency or an officer designated by the head of the agency, and the
name and business address of that official; (3) permit the individual who
disagrees with the refusal of the agency to amend his record to request a
review of such refusal, and not later than 30 days (excluding Saturdays,
Sundays, and legal public holidays) from the date on which the individual
requests such review, complete such review and make a final determination
unless, for good cause shown, the head of the agency extends such 30-day
period;  and if, after his review, the reviewing official also refuses to
amend the record in accordance with the request, permit the individual to
file with the agency a concise statement setting forth the reasons for
his disagreement with the refusal of the agency, and notify the
individual of the provisions for judicial review of the reviewing
official's determination under subsection (g)(1)(A) of this section; (4)
in any disclosure, containing information about which the individual has
filed a statement of disagreement, occurring after the filing of the
statement under paragraph (3) of this subsection, clearly note any
portion of the record which is disputed and provide copies of the
statement and, if the agency deems it appropriate, copies of a concise
statement of the reasons of the agency for not making the amendments
requested, to persons or other agencies to whom the disputed record has
been disclosed;  and (5) nothing in this section shall allow an
individual access to any information compiled in reasonable anticipation
of a civil action or proceeding.

(e) Agency requirements.--Each agency that maintains a system of records
shall-- (1) maintain in its records only such information about an
individual as is relevant and necessary to accomplish a purpose of the
agency required to be accomplished by statute or by executive order of
the President; (2) collect information to the greatest extent practicable
directly from the subject individual when the information may result in
adverse determinations about an individual's rights, benefits, and
privileges under Federal programs; (3) inform each individual whom it
asks to supply information, on the form which it uses to collect the
information or on a separate form that can be retained by the
individual-- (A) the authority (whether granted by statute, or by
executive order of the President) which authorizes the solicitation of
the information and whether disclosure of such information is mandatory
or voluntary; (B) the principal purpose or purposes for which the
information is intended to be used; (C) the routine uses which may be
made of the information, as published pursuant to paragraph (4)(D) of
this subsection;  and (D) the effects on him, if any, of not providing
all or any part of the requested information; (4) subject to the
provisions of paragraph (11) of this subsection, publish in the Federal
Register upon establishment or revision a notice of the existence and
character of the system of records, which notice shall include-- (A) the
name and location of the system; (B) the categories of individuals on
whom records are maintained in the system; (C) the categories of records
maintained in the system; (D) each routine use of the records contained
in the system, including the categories of users and the purpose of such
use; (E) the policies and practices of the agency regarding storage,
retrievability, access controls, retention, and disposal of the records;
(F) the title and business address of the agency official who is
responsible for the system of records; (G) the agency procedures whereby
an individual can be notified at his request if the system of records
contains a record pertaining to him; (H) the agency procedures whereby an
individual can be notified at his request how he can gain access to any
record pertaining to him contained in the system of records, and how he
can contest its content;  and (I) the categories of sources of records in
the system; (5) maintain all records which are used by the agency in
making any determination about any individual with such accuracy,
relevance, timeliness, and completeness as is reasonably necessary to
assure fairness to the individual in the determination; (6) prior to
disseminating any record about an individual to any person other than an
agency, unless the dissemination is made pursuant to subsection (b)(2) of
this section, make reasonable efforts to assure that such records are
accurate, complete, timely, and relevant for agency purposes; (7)
maintain no record describing how any individual exercises rights
guaranteed by the First Amendment unless expressly authorized by statute
or by the individual about whom the record is maintained or unless
pertinent to and within the scope of an authorized law enforcement
activity; (8) make reasonable efforts to serve notice on an individual
when any record on such individual is made available to any person under
compulsory legal process when such process becomes a matter of public
record; (9) establish rules of conduct for persons involved in the
design, development, operation, or maintenance of any system of records,
or in maintaining any record, and instruct each such person with respect
to such rules and the requirements of this section, including any other
rules and procedures adopted pursuant to this section and the penalties
for noncompliance; (10) establish appropriate administrative, technical,
and physical safeguards to insure the security and confidentiality of
records and to protect against any anticipated threats or hazards to
their security or integrity which could result in substantial harm,
embarrassment, inconvenience, or unfairness to any individual on whom
information is maintained; (11) at least 30 days prior to publication of
information under paragraph (4)(D) of this subsection, publish in the
Federal Register notice of any new use or intended use of the information
in the system, and provide an opportunity for interested persons to
submit written data, views, or arguments to the agency;  and (12) if such
agency is a recipient agency or a source agency in a matching program
with a non-Federal agency, with respect to any establishment or revision
of a matching program, at least 30 days prior to conducting such program,
publish in the Federal Register notice of such establishment or revision.

(f) Agency rules.--In order to carry out the provisions of this section,
each agency that maintains a system of records shall promulgate rules, in
accordance with the requirements (including general notice) of section
553 of this title, which shall-- (1) establish procedures whereby an
individual can be notified in response to his request if any system of
records named by the individual contains a record pertaining to him; (2)
define reasonable times, places, and requirements for identifying an
individual who requests his record or information pertaining to him
before the agency shall make the record or information available to the
individual; (3) establish procedures for the disclosure to an individual
upon his request of his record or information pertaining to him,
including special procedure, if deemed necessary, for the disclosure to
an individual of medical records, including psychological records,
pertaining to him; (4) establish procedures for reviewing a request from
an individual concerning the amendment of any record or information
pertaining to the individual, for making a determination on the request,
for an appeal within the agency of an initial adverse agency
determination, and for whatever additional means may be necessary for
each individual to be able to exercise fully his rights under this
section;  and (5) establish fees to be charged, if any, to any individual
for making copies of his record, excluding the cost of any search for and
review of the record.  The Office of the Federal Register shall
biennially compile and publish the rules promulgated under this
subsection and agency notices published under subsection (e)(4) of this
section in a form available to the public at low cost.

(g)(1) Civil remedies.--Whenever any agency (A) makes a determination
under subsection (d)(3) of this section not to amend an individual's
record in accordance with his request, or fails to make such review in
conformity with that subsection; (B) refuses to comply with an individual
request under subsection (d)(1) of this section; (C) fails to maintain
any record concerning any individual with such accuracy, relevance,
timeliness, and completeness as is necessary to assure fairness in any
determination relating to the qualifications, character, rights, or
opportunities of, or benefits to the individual that may be made on the
basis of such record, and consequently a determination is made which is
adverse to the individual;  or (D) fails to comply with any other
provision of this section, or any rule promulgated thereunder, in such a
way as to have an adverse effect on an individual, the individual may
bring a civil action against the agency, and the district courts of the
United States shall have jurisdiction in the matters under the provisions
of this subsection. (2)(A) In any suit brought under the provisions of
subsection (g)(1)(A) of this section, the court may order the agency to
amend the individual's record in accordance with his request or in such
other way as the court may direct. In such a case the court shall
determine the matter de novo. (B) The court may assess against the United
States reasonable attorney fees and other litigation costs reasonably
incurred in any case under this paragraph in which the complainant has
substantially prevailed. (3)(A) In any suit brought under the provisions
of subsection (g)(1)(B) of this section, the court may enjoin the agency
from withholding the records and order the production to the complainant
of any agency records improperly withheld from him.  In such a case the
court shall determine the matter de novo, and may examine the contents of
any agency records in camera to determine whether the records or any
portion thereof may be withheld under any of the exemptions set forth in
subsection (k) of this section, and the burden is on the agency to
sustain its action. (B) The court may assess against the United States
reasonable attorney fees and other litigation costs reasonably incurred
in any case under this paragraph in which the complainant has
substantially prevailed. (4) In any suit brought under the provisions of
subsection (g)(1)(C) or (D) of this section in which the court determines
that the agency acted in a manner which was intentional or willful, the
United States shall be liable to the individual in an amount equal to the
sum of-- (A) actual damages sustained by the individual as a result of
the refusal or failure, but in no case shall a person entitled to
recovery receive less than the sum of $1,000;  and (B) the costs of the
action together with reasonable attorney fees as determined by the court.
(5) An action to enforce any liability created under this section may be
brought in the district court of the United States in the district in
which the complainant resides, or has his principal place of business, or
in which the agency records are situated, or in the District of Columbia,
without regard to the amount in controversy, within two years from the
date on which the cause of action arises, except that where an agency has
materially and willfully misrepresented any information required under
this section to be disclosed to an individual and the information so
misrepresented is material to establishment of the liability of the
agency to the individual under this section, the action may be brought at
any time within two years after discovery by the individual of the
misrepresentation.  Nothing in this section shall be construed to
authorize any civil action by reason of any injury sustained as the
result of a disclosure of a record prior to September 27, 1975.

(h) Rights of legal guardians.--For the purposes of this section, the
parent of any minor, or the legal guardian of any individual who has been
declared to be incompetent due to physical or mental incapacity or age by
a court of competent jurisdiction, may act on behalf of the individual.

(i)(1) Criminal penalties.--Any officer or employee of an agency, who by
virtue of his employment or official position, has possession of, or
access to, agency records which contain individually identifiable
information the disclosure of which is prohibited by this section or by
rules or regulations established thereunder, and who knowing that
disclosure of the specific material is so prohibited, willfully discloses
the material in any manner to any person or agency not entitled to
receive it, shall be guilty of a misdemeanor and fined not more than
$5,000. (2) Any officer or employee of any agency who willfully maintains
a system of records without meeting the notice requirements of subsection
(e)(4) of this section shall be guilty of a misdemeanor and fined not
more than $5,000. (3) Any person who knowingly and willfully requests or
obtains any record concerning an individual from an agency under false
pretenses shall be guilty of a misdemeanor and fined not more than
$5,000.

(j) General exemptions.--The head of any agency may promulgate rules, in
accordance with the requirements (including general notice) of sections
553(b)(1), (2), and (3), (c), and (e) of this title, to exempt any system
of records within the agency from any part of this section except
subsections (b), (c)(1) and (2), (e)(4)(A) through (F), (e)(6), (7), (9),
(10), and (11), and (i) if the system of records is-- (1) maintained by
the Central Intelligence Agency;  or (2) maintained by an agency or
component thereof which performs as its principal function any activity
pertaining to the enforcement of criminal laws, including police efforts
to prevent, control, or reduce crime or to apprehend criminals, and the
activities of prosecutors, courts, correctional, probation, pardon, or
parole authorities, and which consists of (A) information compiled for
the purpose of identifying individual criminal offenders and alleged
offenders and consisting only of identifying data and notations of
arrests, the nature and disposition of criminal charges, sentencing,
confinement, release, and parole and probation status;  (B) information
compiled for the purpose of a criminal investigation, including reports
of informants and investigators, and associated with an identifiable
individual;  or (C) reports identifiable to an individual compiled at any
stage of the process of enforcement of the criminal laws from arrest or
indictment through release from supervision.  At the time rules are
adopted under this subsection, the agency shall include in the statement
required under section 553(c) of this title, the reasons why the system
of records is to be exempted from a provision of this section.

(k) Specific exemptions.--The head of any agency may promulgate rules, in
accordance with the requirements (including general notice) of sections
553(b)(1), (2), and (3), (c), and (e) of this title, to exempt any system
of records within the agency from subsections (c)(3), (d), (e)(1),
(e)(4)(G), (H), and (I) and (f) of this section if the system of records
is-- (1) subject to the provisions of section 552(b)(1) of this title;
(2) investigatory material compiled for law enforcement purposes, other
than material within the scope of subsection (j)(2) of this section:
Provided, however, That if any individual is denied any right, privilege,
or benefit that he would otherwise be entitled by Federal law, or for
which he would otherwise be eligible, as a result of the maintenance of
such material, such material shall be provided to such individual, except
to the extent that the disclosure of such material would reveal the
identity of a source who furnished information to the Government under an
express promise that the identity of the source would be held in
confidence, or, prior to the effective date of this section, under an
implied promise that the identity of the source would be held in
confidence; (3) maintained in connection with providing protective
services to the President of the United States or other individuals
pursuant to section 3056 of title 18; (4) required by statute to be
maintained and used solely as statistical records; (5) investigatory
material compiled solely for the purpose of determining suitability,
eligibility, or qualifications for Federal civilian employment, military
service, Federal contracts, or access to classified information, but only
to the extent that the disclosure of such material would reveal the
identity of a source who furnished information to the Government under an
express promise that the identity of the source would be held in
confidence, or, prior to the effective date of this section, under an
implied promise that the identity of the source would be held in
confidence; (6) testing or examination material used solely to determine
individual qualifications for appointment or promotion in the Federal
service the disclosure of which would compromise the objectivity or
fairness of the testing or examination process;  or (7) evaluation
material used to determine potential for promotion in the armed services,
but only to the extent that the disclosure of such material would reveal
the identity of a source who furnished information to the Government
under an express promise that the identity of the source would be held in
confidence, or, prior to the effective date of this section, under an
implied promise that the identity of the source would be held in
confidence. At the time rules are adopted under this subsection, the
agency shall include in the statement required under section 553(c) of
this title, the reasons why the system of records is to be exempted from
a provision of this section.

(l)(1) Archival records.--Each agency record which is accepted by the
Archivist of the United States for storage, processing, and servicing in
accordance with section 3103 of title 44 shall, for the purposes of this
section, be considered to be maintained by the agency which deposited the
record and shall be subject to the provisions of this section.  The
Archivist of the United States shall not disclose the record except to
the agency which maintains the record, or under rules established by that
agency which are not inconsistent with the provisions of this section.
(2) Each agency record pertaining to an identifiable individual which was
transferred to the National Archives of the United States as a record
which has sufficient historical or other value to warrant its continued
preservation by the United States Government, prior to the effective date
of this section, shall, for the purposes of this section, be considered
to be maintained by the National Archives and shall not be subject to the
provisions of this section, except that a statement generally describing
such records (modeled after the requirements relating to records subject
to subsections (e)(4)(A) through (G) of this section) shall be published
in the Federal Register. (3) Each agency record pertaining to an
identifiable individual which is transferred to the National Archives of
the United States as a record which has sufficient historical or other
value to warrant its continued preservation by the United States
Government, on or after the effective date of this section, shall, for
the purposes of this section, be considered to be maintained by the
National Archives and shall be exempt from the requirements of this
section except subsections (e)(4)(A) through (G) and (e)(9) of this
section.

(m)(1) Government contractors.--When an agency provides by a contract for
the operation by or on behalf of the agency of a system of records to
accomplish an agency function, the agency shall, consistent with its
authority, cause the requirements of this section to be applied to such
system.  For purposes of subsection (i) of this section any such
contractor and any employee of such contractor, if such contract is
agreed to on or after the effective date of this section, shall be
considered to be an employee of an agency. (2) A consumer reporting
agency to which a record is disclosed under section 3711(f) of title 31
shall not be considered a contractor for the purposes of this section.

(n) Mailing lists.--An individual's name and address may not be sold or
rented by an agency unless such action is specifically authorized by law.
This provision shall not be construed to require the withholding of names
and addresses otherwise permitted to be made public.

(o) Matching agreements.--(1) No record which is contained in a system of
records may be disclosed to a recipient agency or non-Federal agency for
use in a computer matching program except pursuant to a written agreement
between the source agency and the recipient agency or non-Federal agency
specifying-- (A) the purpose and legal authority for conducting the
program; (B) the justification for the program and the anticipated
results, including a specific estimate of any savings; (C) a description
of the records that will be matched, including each data element that
will be used, the approximate number of records that will be matched, and
the projected starting and completion dates of the matching program; (D)
procedures for providing individualized notice at the time of
application, and notice periodically thereafter as directed by the Data
Integrity Board of such agency (subject to guidance provided by the
Director of the Office of Management and Budget pursuant to subsection
(v)), to-- (i) applicants for and recipients of financial assistance or
payments under Federal benefit programs, and (ii) applicants for and
holders of positions as Federal personnel, that any information provided
by such applicants, recipients, holders, and individuals may be subject
to verification through matching programs; (E) procedures for verifying
information produced in such matching program as required by subsection
(p); (F) procedures for the retention and timely destruction of
identifiable records created by a recipient agency or non-Federal agency
in such matching program; (G) procedures for ensuring the administrative,
technical, and physical security of the records matched and the results
of such programs; (H) prohibitions on duplication and redisclosure of
records provided by the source agency within or outside the recipient
agency or the non-Federal agency, except where required by law or
essential to the conduct of the matching program; (I) procedures
governing the use by a recipient agency or non-Federal agency of records
provided in a matching program by a source agency, including procedures
governing return of the records to the source agency or destruction of
records used in such program; (J) information on assessments that have
been made on the accuracy of the records that will be used in such
matching program;  and (K) that the Comptroller General may have access
to all records of a recipient agency or a non-Federal agency that the
Comptroller General deems necessary in order to monitor or verify
compliance with the agreement. (2)(A) A copy of each agreement entered
into pursuant to paragraph (1) shall-- (i) be transmitted to the
Committee on Governmental Affairs of the Senate and the Committee on
Government Operations of the House of Representatives;  and (ii) be
available upon request to the public. (B) No such agreement shall be
effective until 30 days after the date on which such a copy is
transmitted pursuant to subparagraph (A)(i). (C) Such an agreement shall
remain in effect only for such period, not to exceed 18 months, as the
Data Integrity Board of the agency determines is appropriate in light of
the purposes, and length of time necessary for the conduct, of the
matching program. (D) Within 3 months prior to the expiration of such an
agreement pursuant to subparagraph (C), the Data Integrity Board of the
agency may, without additional review, renew the matching agreement for a
current, ongoing matching program for not more than one additional year
if-- (i) such program will be conducted without any change;  and (ii)
each party to the agreement certifies to the Board in writing that the
program has been conducted in compliance with the agreement.

(p) Verification and opportunity to contest findings.--(1) In order to
protect any individual whose records are used in a matching program, no
recipient agency, non-Federal agency, or source agency may suspend,
terminate, reduce, or make a final denial of any financial assistance or
payment under Federal benefit program to such individual, or take other
adverse action against such individual, as a result of information
produced by such matching program, until-- (A)(i) the agency has
independently verified the information;  or (ii) the Data Integrity Board
of the agency, or in the case of a non-Federal agency the Data Integrity
Board of the source agency determines in accordance with guidance issued
by the Director of the Office of Management and Budget that-- (I) the
information is limited to identification and amount of benefits paid by
the source agency under a Federal benefit program;  and (II) there is a
high degree of confidence that the information provided to the recipient
agency is accurate; (B) the individual receives a notice from the agency
containing a statement of its findings and informing the individual of
the opportunity to contest such findings;  and (C)(i) the expiration of
any time period established for the program by statute or regulation for
the individual to respond to that notice;  or (ii) in the case of a
program for which no such period is established, the end of the 30-day
period beginning on the date on which notice under subparagraph (B) is
mailed or otherwise provided to the individual. (2) Independent
verification referred to in paragraph (1) requires investigation and
confirmation of specific information relating to an individual that is
used as a basis for an adverse action against the individual, including
where applicable investigation and confirmation of-- (A) the amount of
any asset or income involved; (B) whether such individual actually has or
had access to such asset or income for such individual's own use;  and
(C) the period or periods when the individual actually had such asset or
income. (3) Notwithstanding paragraph (1), an agency may take any
appropriate action otherwise prohibited by such paragraph if the agency
determines that the public health or public safety may be adversely
affected or significantly threatened during any notice period required by
such paragraph.

(q) Sanctions.--(1) Notwithstanding any other provision of law, no source
agency may disclose any record which is contained in a system of records
to a recipient agency or non-Federal agency for a matching program if
such source agency has reason to believe that the requirements of
subsection (p), or any matching agreement entered into pursuant to
subsection (o), or both, are not being met by such recipient agency. (2)
No source agency may renew a matching agreement unless-- (A) the
recipient agency or non-Federal agency has certified that it has complied
with the provisions of that agreement;  and (B) the source agency has no
reason to believe that the certification is inaccurate.

(r) Report on new systems and matching programs.--Each agency that
proposes to establish or make a significant change in a system of records
or a matching program shall provide adequate advance notice of any such
proposal (in duplicate) to the Committee on Government Operations of the
House of Representatives, the Committee on Governmental Affairs of the
Senate, and the Office of Management and Budget in order to permit an
evaluation of the probable or potential effect of such proposal on the
privacy or other rights of individuals.

(s) Biennial report.--The President shall biennially submit to the
Speaker of the House of Representatives and the President pro tempore of
the Senate a report-- (1) describing the actions of the Director of the
Office of Management and Budget pursuant to section 6 of the Privacy Act
of 1974 during the preceding 2 years; (2) describing the exercise of
individual rights of access and amendment under this section during such
years; (3) identifying changes in or additions to systems of records; (4)
containing such other information concerning administration of this
section as may be necessary or useful to the Congress in reviewing the
effectiveness of this section in carrying out the purposes of the Privacy
Act of 1974.

(t) Effect of other laws.--(1) No agency shall rely on any exemption
contained in section 552 of this title to withhold from an individual any
record which is otherwise accessible to such individual under the
provisions of this section. (2) No agency shall rely on any exemption in
this section to withhold from an individual any record which is otherwise
accessible to such individual under the provisions of section 552 of this
title.

(u) Data Integrity Boards.--(1) Every agency conducting or participating
in a matching program shall establish a Data Integrity Board to oversee
and coordinate among the various components of such agency the agency's
implementation of this section. (2) Each Data Integrity Board shall
consist of senior officials designated by the head of the agency, and
shall include any senior official designated by the head of the agency as
responsible for implementation of this section, and the inspector general
of the agency, if any.  The inspector general shall not serve as chairman
of the Data Integrity Board. (3) Each Data Integrity Board-- (A) shall
review, approve, and maintain all written agreements for receipt or
disclosure of agency records for matching programs to ensure compliance
with subsection (o), and all relevant statutes, regulations, and
guidelines; (B) shall review all matching programs in which the agency
has participated during the year, either as a source agency or recipient
agency, determine compliance with applicable laws, regulations,
guidelines, and agency agreements, and assess the costs and benefits of
such programs; (C) shall review all recurring matching programs in which
the agency has participated during the year, either as a source agency or
recipient agency, for continued justification for such disclosures; (D)
shall compile an annual report, which shall be submitted to the head of
the agency and the Office of Management and Budget and made available to
the public on request, describing the matching activities of the agency,
including-- (i) matching programs in which the agency has participated as
a source agency or recipient agency; (ii) matching agreements proposed
under subsection (o) that were disapproved by the Board; (iii) any
changes in membership or structure of the Board in the preceding year;
(iv) the reasons for any waiver of the requirement in paragraph (4) of
this section for completion and submission of a cost-benefit analysis
prior to the approval of a matching program; (v) any violations of
matching agreements that have been alleged or identified and any
corrective action taken;  and (vi) any other information required by the
Director of the Office of Management and Budget to be included in such
report; (E) shall serve as a clearinghouse for receiving and providing
information on the accuracy, completeness, and reliability of records
used in matching programs; (F) shall provide interpretation and guidance
to agency components and personnel on the requirements of this section
for matching programs; (G) shall review agency recordkeeping and disposal
policies and practices for matching programs to assure compliance with
this section;  and (H) may review and report on any agency matching
activities that are not matching programs. (4)(A) Except as provided in
subparagraphs (B) and (C), a Data Integrity Board shall not approve any
written agreement for a matching program unless the agency has completed
and submitted to such Board a cost- benefit analysis of the proposed
program and such analysis demonstrates that the program is likely to be
cost effective. (B) The Board may waive the requirements of subparagraph
(A) of this paragraph if it determines in writing, in accordance with
guidelines prescribed by the Director of the Office of Management and
Budget, that a cost-benefit analysis is not required. (C) A cost-benefit
analysis shall not be required under subparagraph (A) prior to the
initial approval of a written agreement for a matching program that is
specifically required by statute.  Any subsequent written agreement for
such a program shall not be approved by the Data Integrity Board unless
the agency has submitted a cost-benefit analysis of the program as
conducted under the preceding approval of such agreement. (5)(A) If a
matching agreement is disapproved by a Data Integrity Board, any party to
such agreement may appeal the disapproval to the Director of the Office
of Management and Budget.  Timely notice of the filing of such an appeal
shall be provided by the Director of the Office of Management and Budget
to the Committee on Governmental Affairs of the Senate and the Committee
on Government Operations of the House of Representatives. (B) The
Director of the Office of Management and Budget may approve a matching
agreement notwithstanding the disapproval of a Data Integrity Board if
the Director determines that-- (i) the matching program will be
consistent with all applicable legal, regulatory, and policy
requirements; (ii) there is adequate evidence that the matching agreement
will be cost- effective;  and (iii) the matching program is in the public
interest. (C) The decision of the Director to approve a matching
agreement shall not take effect until 30 days after it is reported to
committees described in subparagraph (A). (D) If the Data Integrity Board
and the Director of the Office of Management and Budget disapprove a
matching program proposed by the inspector general of an agency, the
inspector general may report the disapproval to the head of the agency
and to the Congress. (6) The Director of the Office of Management and
Budget shall, annually during the first 3 years after the date of
enactment of this subsection and biennially thereafter, consolidate in a
report to the Congress the information contained in the reports from the
various Data Integrity Boards under paragraph (3)(D). Such report shall
include detailed information about costs and benefits of matching
programs that are conducted during the period covered by such
consolidated report, and shall identify each waiver granted by a Data
Integrity Board of the requirement for completion and submission of a
cost-benefit analysis and the reasons for granting the waiver. (7) In the
reports required by paragraphs (3)(D) and (6), agency matching activities
that are not matching programs may be reported on an aggregate basis, if
and to the extent necessary to protect ongoing law enforcement or
counterintelligence investigations.

(v) Office of Management and Budget responsibilities.--The Director of
the Office of Management and Budget shall-- (1) develop and, after notice
and opportunity for public comment, prescribe guidelines and regulations
for the use of agencies in implementing the provisions of this section;
and (2) provide continuing assistance to and oversight of the
implementation of this section by agencies.


Congressional Findings and Statement of Purpose

Section 2 of Pub.L. 93-579 provided that:

"(a) The Congress finds that-- "(1) the privacy of an individual is
directly affected by the collection, maintenance, use, and dissemination
of personal information by Federal agencies; "(2) the increasing use of
computers and sophisticated information technology, while essential to
the efficient operations of the Government, has greatly magnified the
harm to individual privacy that can occur from any collection,
maintenance, use or dissemination of personal information; "(3) the
opportunities for an individual to secure employment, insurance, and
credit, and his right to due process, and other legal protections are
endangered by the misuse of certain information systems; "(4) the right
to privacy is a personal and fundamental right protected by the
Constitution of the United States;  and "(5) in order to protect the
privacy of individuals identified in information systems maintained by
Federal agencies, it is necessary and proper for the Congress to regulate
the collection, maintenance, use, and dissemination of information by
such agencies.

"(b) The purpose of this Act [enacting this section and notes set out
under this section] is to provide certain safeguards for an individual
against an invasion of personal privacy by requiring Federal agencies,
except as otherwise provided by law, to-- "(1) permit an individual to
determine what records pertaining to him are collected, maintained, used,
or disseminated by such agencies; "(2) permit an individual to prevent
records pertaining to him obtained by such agencies for a particular
purpose from being used or made available for another purpose without his
consent; "(3) permit an individual to gain access to information
pertaining to him in Federal agency records, to have a copy made of all
or any portion thereof, and to correct or amend such records; "(4)
collect, maintain, use, or disseminate any record of identifiable
personal information in a manner that assures that such action is for a
necessary and lawful purpose, that the information is current and
accurate for its intended use, and that adequate safeguards are provided
to prevent misuse of such information: "(5) permit examptions from the
requirements with respect to records provided in this Act only in those
cases where there is an important public policy need for such exemption
as has been determined by specific statutory authority; and "(6) be
subject to civil suit for any damages which occur as a result of willful
or intentional action which violates any individual's rights under this
Act."

Privacy Protection Study Commission

Section 5 of Pub.L. 93-579 provided that:

"(a)(1) There is established a Privacy Protection Study Commission
(hereinafter referred to as the 'Commission') which shall be composed of
seven members as follows:
	* * * *

"(b) The Commission shall-- "(1) make a study of the data banks,
automated data processing programs, and information systems of
governmental, regional, and private organizations, in order to determine
the standards and procedures in force for the protection of personal
information;  and "(2) recommend to the President and the Congress the
extent, if any, to which the requirements and principles of section 552a
of title 5, United States Code [this section], should be applied to the
information practices of those organizations by legislation,
administrative action, or voluntary adoption of such requirements and
principles, and report on such other legislative recommendations as it
may determine to be necessary to protect the privacy of individuals while
meeting the legitimate needs of government and society for information.

"(c)(1) In the course of conducting the study required under subsection
(b)(1) of this section, and in its reports hereon, the Commission may
research, examine, and analyze-- "(A) interstate transfer of information
about individuals that is undertaken through manual files or by computer
or other electronic or telecommunications means; "(B) data banks and
information programs and systems the operation of which significantly or
substantially affect the enjoyment of the privacy and other personal and
property rights of individuals; "(C) the use of social security numbers,
license plate numbers, universal identifiers, and other symbols to
identify individuals in data banks and to gain access to, integrate, or
centralize information systems and files;  and "(D) the matching and
analysis of statistical data, such as Federal census data, with other
sources of personal data, such as automobile registries and telephone
directories, in order to reconstruct individual responses to statistical
questionnaires for commercial or other purposes, in a way which results
in a violation of the implied or explicitly recognized confidentiality of
such information. "(2)(A) The Commission may include in its examination
personal information activities in the following areas:  medical;
insurance;  education; employment and personnel;  credit, banking and
financial institutions;  credit bureaus;  the commercial reporting
industry;  cable television and other telecommunications media;  travel,
hotel and entertainment reservations;  and electronic check processing.
"(B) The Commission shall include in its examination a study of-- "(i)
whether a person engaged in interstate commerce who maintains a mailing
list should be required to remove an individual's name and address from
such list upon request of that individual; "(ii) whether the Internal
Revenue Service should be prohibited from transfering individually
indentifiable [sic] data to other agencies and to agencies of State
governments; "(iii) whether the Federal Government should be liable for
general damages incurred by an individual as the result of a willful or
intentional violation of the provisions of sections 552a(g)(1)(C) or (D)
of title 5, United States Code [subsec. (g)(1)(C) or (D) of this
section];  and "(iv) whether and how the standards for security and
confidentiality of records required under section 552a(e)(10) of such
title [subsec. (e)(10) of this section] should be applied when a record
is disclosed to a person other than an agency. "(C) The Commission may
study such other personal information activities necessary to carry out
the congressional policy embodied in this Act [this section and notes
hereunder], except that the Commission shall not investigate information
systems maintained by religious organizations. "(3) In conducting such
study, the Commission shall-- "(A) determine what laws, Executive orders,
regulations, directives, and judicial decisions govern the activities
under study and the extent to which they are consistent with the rights
of privacy, due process of law, and other guarantees in the Constitution;
"(B) determine to what extent governmental and private information
systems affect Federal-State relations or the principle of separation of
powers; "(C) examine the standards and criteria governing programs,
policies, and practices relating to the collection, soliciting,
processing, use, access, integration, dissemination, and transmission of
personal information;  and "(D) to the maximum extent practicable,
collect and utilize findings, reports, studies, hearing transcripts, and
recommendations of governmental, legislative and private bodies,
institutions, organizations, and individuals which pertain to the
problems under study by the Commission.

"(d) In addition to its other functions the Commission may-- "(1) request
assistance of the heads of appropriate departments, agencies, and
instrumentalities of the Federal Government, of State and local
governments, and other persons in carrying out its functions under this
Act; "(2) upon request, assist Federal agencies in complying with the
requirements of section 552a of title 5, United States Code [this
section]; "(3) determine what specific categories of information, the
collection of which would violate an individual's right of privacy,
should be prohibited by statute from collection by Federal agencies;  and
"(4) upon request, prepare model legislation for use by State and local
governments in establishing procedures for handling, maintaining, and
disseminating personal information at the State and local level and
provide such technical assistance to State and local governments as they
may require in the preparation and implementation of such legislation.

"(e)(1) The Commission may, in carrying out its functions under this
section, conduct such inspections, sit and act at such times and places,
hold such hearings, take such testimony, require by subpena the
attendance of such witnesses and the production of such books, records,
papers, correspondence, and documents, administer such oaths, have such
printing and binding done, and make such expenditures as the Commission
deems advisable.  A subpena shall be issued only upon an affirmative vote
of a majority of all members of the Commission.  Subpenas shall be issued
under the signature of the Chairman or any member of the Commission
designated by the Chairman and shall be served by any person designated
by the Chairman or any such member.  Any member of the Commission may
administer oaths or affirmations to witnesses appearing before the
Commission. * * * *

	* * * *

Guidelines and Regulations for Maintenance of Privacy and Protection of
Records on Individuals

Section 6 of Pub.L. 93-579 provided that:

"The Office of Management and Budget shall--

"(1) develop guidelines and regulations for the use of agencies in
implementing the provisions of section 552a of title 5, United States
Code [this section], as added by section 3 of this Act;  and "(2) provide
continuing assistance to and oversight of the implementation of the
provisions of such section by agencies."

Disclosure of Social Security Number

Section 7 of Pub.L. 93-579 provided that:

"(a)(1) It shall be unlawful for any Federal, State or local government
agency to deny to any individual any right, benefit, or privilege
provided by law because of such individual's refusal to disclose his
social security account number. "(2) the provisions of paragraph (1) of
this subsection shall not apply with respect to-- "(A) any disclosure
which is required by Federal statute, or "(B) the disclosure of a social
security number to any Federal, State, or local agency maintaining a
system of records in existence and operating before January 1, 1975, if
such disclosure was required under statute or regulation adopted prior to
such date to verify the identity of an individual.

"(b) Any Federal, State, or local government agency which requests an
individual to disclose his social security account number shall inform
that individual whether that disclosure is mandatory or voluntary, by
what statutory or other authority such number is solicited, and what uses
will be made of it."