Report: From the Filing Cabinet to the Cloud: Updating the Privacy Act of 1974

Section 5 of Public Law 93-579 established the Privacy Protection Study Commission (PPSC) as a temporary study commission.^[18] The PPSC was a compromise between a Senate bill that proposed an independent Privacy Protection Commission covering all personal record keepers and a House bill that did not include a privacy agency. The need for a privacy agency in the United States remains an issue today, decades later, even after much of the rest of the world enacted privacy and data protection laws that provide for an independent privacy authority.

The Commission operated from 1975-77, publishing its final report in 1977.^[19] Appendix 4 to the main Commission report focused on the Privacy Act of 1974.^[20] This work represented the first significant review of the Act and its implementation. There have been no other comprehensive reviews of the Act in the intervening years.

The PPSC’s assessment is lengthy and cannot be summarized easily. It includes many detailed observations, and the details matter. The preface to the report offers a still-relevant comment on the tradeoff between flexibility of implementation and complying with the goals of the law. The Commission found that agencies took advantage of flexibility in unwelcome ways.

In many instances, the difficulty with the current law does not appear to arise from the flexibility of implementation it allows, but rather from the fact that agencies have taken advantage of that flexibility to contravene its spirit. Yet, making the law less flexible is not a desirable solution. Implementation costs would rise dramatically, and new developments in information technology could invite uncontrollable circumvention of rigidities in the statute. Hence, our approach has been to strengthen implementation flexibility while striving for clarity of interpretation and providing incentives for agencies to comply. This preserves the autonomy of each agency to decide how best to comply with each requirement.^[21]

The PPSC offered three broad conclusions about the Act:

•        The Act represents a large step forward but has not resulted in the general benefits to the public that “either its legislative history or the prevailing opinion” would lead one to expect.
•        Agency compliance is difficult to assess because of the ambiguity of some provisions. On the whole, the Commission found agency compliance to be neither deplorable nor exemplary.
•        The Act ignores or marginally addresses some data policy issues of major importance.^[22]

The PPSC suggested three more specific conclusions as directions to the Congress to fixing the problems;

•        The ambiguous language in the Act should be clarified to minimize variations in interpretation but not implementation.
•        Any clarification should incorporate reasonableness tests to allow flexibility to take into account diverse agency record keeping requirements and future technological developments.
•        Reliance on systems of records as the trigger for activating the Act’s requirements should be abandoned for an approach that activates specific requirements as warranted.^[23]

The report elaborated on the significance of the third point regarding the Act’s reliance on system of records as:

… central to the operation of the Act. From an examination of both the language of the Act and its legislative history, it seems clear that the intent of Congress was to include in the definition of the term “record” every one that contains any kind of individually identifiable information about an individual. However, because the Congress was mindful of the burden such a definition could impose on an agency, it limited the Act’s coverage to records retrieved from a “system of records” by “name . . . or identifying number, symbol, or other identifying particular . . ..” [5 U.S.C. 552a(a)(5)] Thus, unless an agency, in fact, retrieves recorded information by reference to a “name . . . identifying symbol, or other identifying particular . . .,” the system in which the information is maintained is not covered by the Act. Whereas the current record definition refers to information about an individual which contains his name or identifier, the system-of-records definition refers to information about an individual which is retrieved by name, identifier, or identifying particular. As indicated in Chapter 1 above, the crucial difference is obvious, and the effect has been wholesale exclusion from the Act’s scope of records that are not accessed by name, identifier, or assigned particular. None of the Act’s protections accrue to an individual whose record is so treated.

There are many examples of readily accessible individually identifiable agency records that are not retrieved by personal identifier, and current and emerging computer and telecommunications technology will create more. While the language of the Act speaks in terms of retrieval by discrete individual identifiers, most automated record systems facilitate identification of an individual’s record based on some combination of the individual’s attributes or characteristics, natural or assigned, as well as by reference to individual identifiers in the more conventional sense. Thus, it would be easy to program a computer to locate particular individuals through attribute searches (e.g., “list all blonde, female Executive Directors of Federal Commissions”). Retrieval of individually identifiable information by scanning (or searching) large volumes of computer records is not only possible but an ever-increasing agency practice. The Federal Trade Commission, for example, is transcribing all written material in its litigation files for computer retrieval, thereby making it possible to search for all occurrences of a particular name, or any other character pattern for that matter.

In summary, the system-of-records definition has two limitations. First, it undermines the Act’s objective of allowing an individual to have access to the records an agency maintains about him, and second, by serving as the activating, or “on/off switch” for the Act’s other provisions, it unnecessarily limits the Act’s scope. To solve this problem without placing an unreasonable burden on the agencies, the Commission believes the Act’s definition of a system of records should be abandoned and its definition of a record amended.^[24]

For present purposes, I took it as especially noteworthy that the earliest review of the Privacy Act of 1974 concluded that the system of records concept was a failure and undermined the Act’s objective. The PPSC also made numerous other recommendations for changes to the Act, including a recommendation for the creation of an independent privacy agency.^[25] However, Congress gave no serious consideration to the recommendations of the PPSC for amending the Privacy Act of 1974, and the PPSC report faded into the background as is often the case with reports of temporary study commissions. By contrast, the HEW Committee’s report was a significant exception to the transitory importance of study commissions, as its contribution of FIPs to international privacy policy remains front and center today. The PPSC report is rarely discussed today.

Who Cares About Privacy?: Oversight of the Privacy Act of 1974 by the Office of Management and Budget and by the Congress (H. Rept. 98-455, 98th Cong., 1st Sess. 1983).^[26]

In the 98^th Congress, the Committee on Government Operations of the House of Representatives was mostly an oversight committee, but it had legislative jurisdiction over the Privacy Act of 1974. Oversight of the Privacy Act by the Committee over the years ranged from fitful to non-existent. In 1983, however, the Committee (acting through its Subcommittee on Government Information, Justice, and Agriculture) conducted a hearing on the Act and produced an oversight report. At the first day of the hearing, Subcommittee Chairman Glenn English observed that no oversight hearings on the Act had been held since its enactment.^[27] At the hearings and in the report, one of the major topics was the role of the Office of Management and Budget (OMB). The original Public Law assigned OMB responsibility to (1) develop guidelines and regulations for the use of agencies in implementing the Act, and (2) provide continuing assistance to and oversight of the Act’s implementation by the agencies.^[28]

The Committee report’s findings centered on the role of OMB, concluding that interest in the Privacy Act by OMB “has diminished steadily since 1975.”^[29] The Committee recommended that OMB should be more aggressive in raising Privacy Act issues and in monitoring agency compliance with the OMB guidelines on the Act.^[30]

The report raised several other issues that later became important.^[31] First, the report discussed the growing use of computer matching.

Second, the report found that privacy interests frequently conflict with other important governmental interests such as economy and efficiency. The report found that “there is a constant risk that privacy concerns will not be fully or fairly considered by federal agencies.” In later legislation, Congress added a requirement that agencies prepare Privacy Impact Assessments before developing or procuring information technology that collects, maintains, or disseminates identifiable information or before initiating new collections of personally identifiable information.^[32]

Third, the report notes that the Privacy Act of 1974 only gave rights to U.S. citizens and resident aliens. At the time, the Reagan Administration proposed restricting the ability of foreign nationals to use the Freedom of Information Act, which provides a method of access to personal records for those denied use of the Privacy Act of 1974. The report recommended that the Reagan Administration “reconsider” its proposal to deny foreign nationals the ability to use the FOIA. The FOIA restriction never became law, but the limits of the Privacy Act became an issue later.

Fourth, the report also discussed the possible need for a privacy agency, suggesting that Congress should consider alternatives to OMB as a privacy oversight agency.

A second part of the Committee report summarized Privacy Act oversight activities of the Committee. The Privacy Act requires agencies to submit proposals for new systems of records and for new routine uses to the Congress. The report summarized subcommittee responses to these proposals during the period from 1977 through 1982.

The Government Accountability Office (formerly General Accounting Office) reviewed aspects of Privacy Act of 1974 implementation at various times over the years.^[33] It is difficult to generalize from GAO’s findings from so many reports. Some themes are 1) a variance of compliance efforts by agencies; 2) unclear or inadequate guidance; 3) technological changes presenting new risks; 4) varied supervision; and 5) shortcomings with the Act itself. Nothing in the GAO reports attempts to compare compliance with the Privacy Act of 1974 with the level of compliance of other laws imposing administrative requirements. It is well-known that compliance with the Freedom of Information Act^[34] – a law sometimes implemented by the same agency offices responsible for the Privacy Act of 1974 – has been highly variable over the years.^[35]

The incomplete picture suggested by these reports nevertheless supports the core conclusion here, namely that the Act is out-of-date and needs revision. A revised law can better protect the privacy interests of data subjects and reduce some of the implementation problems and uncertainties that characterize the existing law.

The key organizing concept for the Privacy Act of 1974 is the system of records. A record is:

any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph.^[36]

This is an expansive definition (“including but not limited to”) that encompasses virtually every type of information associated with an individual.

A system of records is:

a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.^[37]

The most noteworthy feature of a system of records is that information must be retrieved (not just retrievable) by individual identifier. Thus, the test for whether a collection of records is a system turns on whether the agency in fact retrieves records by individual identifier. It is a question of fact. Consider two files containing correspondence. One file organizes the letters by the name of the recipient. That file is likely to be a system of records because records are filed and, more importantly, retrieved by name. The other file organizes the letters by date. That file is not likely to be a system of records because the records would be retrieved by date rather than an individual identifier. By varying how or if records are retrieved from these files, either could be a system of records or not. It is not clear from the definition whether a single retrieval of a single record by name makes a collection of records a system of records or if retrieval must be a regular activity. In most cases, it will not matter.

The Privacy Protection Study Commission report observes that the definition comes from a manual model of information processing rather than a computer-based model.^[38] In suggesting revisions to the Privacy Act, the PPSC introduced some new concepts, but its suggested revision of the definition of system still relied on the notion of an established retrieval scheme or indexing structure.^[39] The PPSC recognized the potential ease of record retrieval from a computer file, but it still stuck to the idea of retrieval as part of the definition. Computers of the mid-1970s did not allow for easy or on-demand retrieval.

The system of records concept was important to the public notice element of the Act. The Act requires each agency to publish in the Federal Register a notice of the existence and character of each system of records that it maintains.^[40] A system of records notice or SORN – the acronym is commonly used to refer to either the notice or to the system of records itself – is extensive and must include these elements:

(A) the name and location of the system;

(B) the categories of individuals on whom records are maintained in the system;

(C) the categories of records maintained in the system;

(D) each routine use of the records contained in the system, including the categories of users and the purpose of such use;

(E) the policies and practices of the agency regarding storage, retrievability, access controls, retention, and disposal of the records;

(F) the title and business address of the agency official who is responsible for the system of records;

(G) the agency procedures whereby an individual can be notified at his request if the system of records contains a record pertaining to him;

(H) the agency procedures whereby an individual can be notified at his request how he can gain access to any record pertaining to him contained in the system of records, and how he can contest its content; and

(I) the categories of sources of records in the system.^[41]

The publication requirement fulfilled what the PPSC called a “prime objective” of the Act, which was to ensure that there are no secret agency record keeping systems.^[42] While many systems of records can be exempted from various requirements of the Privacy Act, no system is exempt from the requirement to publish a description. The USA FIPS Act continues the policy of no secret agency record keeping activities.

Many agency SORNs today are out-of-date, incomplete in some ways, or wrong in material and immaterial ways. Nevertheless, the requirement that agencies publish system notices was in some ways a significant success of the Privacy Act. Prior to 1975, many agencies had no idea what records they maintained. The public had even less knowledge about agency record keeping activities before the publication of Privacy Act notices.

In some cases, it took agencies a long time (and years beyond the original deadline) to find and describe all their systems of records. Preparation for the initial publication of system notices resulted in the elimination of many duplicative or unnecessary data systems.^[43] The Act forced agencies to do a better job of managing their personal records systems. That the agencies did not carry out the publication requirement well at the beginning and that there are still shortcomings in agency publications does not mean that publication of system notices is not worth doing. The publication of Privacy Act system notices provides a wealth of information to the public (and to the agencies themselves) that was largely unavailable before the Act.^[44] Notwithstanding all of the implementation shortcomings, publication of notices was one of the Act’s successes.

Given the simplicity of indexing and retrieving information on a modern computer system, defining a system of records using any type of retrievability test is pointless. Even an untrained computer user can retrieve unstructured data on a computer virtually at will. Under the current definition, any act of retrieval could, in theory, create a new system of records. This possibility has been long ignored by the government’s privacy establishment, but everyone is stuck with the definition in current law.

Agencies interpret the concept of a system of records in variable ways. For example, some agencies treat electronic mail systems as systems of records because email is indexed and retrieved by the name of the sender/recipient. Other agencies deem electronic mail to be a work-related activity that is not “about an individual” so they do not have systems of records notices for email systems. This diversity of interpretation should not exist.

Other noteworthy words in the definition of system of records are: “any item, collection, or grouping of information about an individual that is maintained by an agency.” When an agency uses records maintained by third parties as part of an agency function, those external records are not part of the agency’s systems of records. An example of a third-party record used by an agency is a credit record maintained and owned by a consumer reporting agency.^[45] If an agency consults an external database and copies information into its system of records, that information becomes subject to the Privacy Act and may be accessible to the data subject. Otherwise, however, that external data may not be covered by or even discussed in a system of records notice.

In its 1977 report, the Privacy Protection Study Commission proposed a revision of the Privacy Act. Its suggested definition of system or subsystem was:

any collection or grouping of individually identifiable records which is systematically filed, stored, or otherwise maintained according to some established retrieval scheme or indexing structure and which is, in practice, accessed by use of, or reference to, such retrieval scheme or indexing structure for the principal purpose of retrieving the record, or any portion thereof, on the basis of the identity of, or so as to identify, an individual or individuals.^[46]

The Commission also proposed a new term, accessible record to mean:

an individually identifiable record, except a research or statistical record, which is:

(A) systematically filed, stored, or otherwise maintained according to some established retrieval scheme or indexing structure and which is, in practice, accessed by use of, or reference to, such retrieval scheme or indexing structure for the principal purpose of retrieving the record, or any portion thereof, on the basis of the identity of, or so as to identify, an individual, or

(B) otherwise readily accessible because:

(i) the agency is able to access the record without an unreasonable expenditure of time, money, effort, or other resources, or

(ii) the individual to whom the record pertains is able to provide sufficiently specific locating information so as to render the record accessible by the agency without an unreasonable expenditure of time, money, effort, or other resources.^[47]

These terms seem rooted in the computer technology of the day that typically required programming to index and retrieve records. The terms do not seem useful today.

In the 111^th and 112^th Congress, Senator Daniel Akaka started what may have been the only serious congressional effort to revise the Privacy Act of 1974. His bill amending the Act saw no formal action during the 112^th Congress (2011). Its definition for system of records was:

a group of any records maintained by, or otherwise under the control of any agency that is used for any authorized purpose by or on behalf of the agency.^[48]

This approach was more attuned to a world of computerized records because it drops all references to the notion of retrievability. Instead, the focus is on groups of records, a more technologically neutral concept. The definition includes records maintained by an agency and adds the notion of records under the control of an agency. That may be a reference to contractor records, but it would not cover wholly third-party records that an agency does not control.

The European General Data Protection Directive, a 2016 law, takes a different approach. Article 2 of the GDPR defines the scope of the regulation:

This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.^[49]

A filing system is “any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis.”^[50] While it is clear that the regulation seeks to be technologically neutral, there is little in the regulation that explains either filing system or specific criteria or structured set. These three concepts imply retrievability and perhaps linkability as essential elements. The GDPR used the same language and concepts as the EU Data Protection Directive that the GDPR replaced.^[51] Given the GDPR’s applicability to a broad set of personal data controllers (i.e., virtually every data controller in the private, and non-profit sectors and most in the public sector), retaining a focus on retrievability may still make some sense.

An important difference between the EU approach and the Privacy Act of 1974 is that the notion of filing system in EU rules does not appear to be an important concept to privacy regulation in the same way that system of records is central to the Privacy Act. In both the Data Protection Directive and the GDPR, filing systems are discussed in the recitals^[52] and defined. But there is little about filing systems in the operative parts of the documents. It may be a remnant related to the increasingly insignificant distinction between paper and computer records.

Importantly, there is no general requirement in the GDPR to notify the public about filing systems maintained by a data controller. There was and continues to be an obligation to provide information about processing to the data subject.^[53] However, general public notice of processing activities is not required.

The earlier 1995 Data Protection Directive originally provided for a register of “processing operations.” This could have been a rough equivalent of the publication of system of records notices. The Data Protection Directive included a requirement for data controllers to notify their supervisory authority “before carrying out any wholly or partly automatic processing operation or set of such operations intended to serve a single purpose or several related purposes.”^[54] The Directive also specified the content of the notification, which bears rough similarity to the content of a Privacy Act system of records notice.

1. Member States shall specify the information to be given in the notification. It shall include at least:

(a) the name and address of the controller and of his representative, if any;

(b) the purpose or purposes of the processing;

(c) a description of the category or categories of data subject and of the data or categories of data relating to them;

(d) the recipients or categories of recipient to whom the data might be disclosed;

(e) proposed transfers of data to third countries;

(f) a general description allowing a preliminary assessment to be made of the appropriateness of the measures taken pursuant to Article 17 to ensure security of processing.^[55]

The Directive gave Member States authority to establish broader notification requirements or to allow for exemptions. The Directive also required Member States to provide a public register of processing operations.^[56]

However, in practice, notification turned out to be difficult, expensive, and not useful for monitoring. As the Article 29 Working Party wrote in a document on notification in 1997 (almost a year prior to the effective date of the Directive):

Some of these countries are currently simplifying the notification requirements or introducing exemptions from the obligation to notify. The general systems of notification have in some cases proven to be very resource consuming for the data protection authorities. Furthermore it turned out to be difficult to perform any substantive monitoring on the basis of notifications.^[57]

A 2002 comparative summary of national laws found widespread noncompliance with notification under earlier national data protection laws and little improvement under the Directive.

There is no evidence that this situation has significantly improved in the above-mentioned countries, or is any different in the other Member States: the percentage of registered controllers compared to the number of companies in a country (in my opinion, the best first indication of the level of compliance with notification) remains everywhere very low indeed. One reason why notification is not more strongly pursued is that the data protection authorities in fact largely agree that the notified particulars are a very poor indication of what goes on in practice (even if they faithfully reflect what goes on, which is doubtful in itself, as discussed in the next section); and that it adds little if anything to compliance with the more onerous requirements of the laws. According to the UK data protection authority, the system may even have a negative effect on compliance, in that it suggests that controllers who have notified their operations act in accordance with the law, although in practice there is no certainty that this is the case at all.

Many of the authorities would therefore prefer to spend their resources on other measures which could contribute more effectively to compliance by controllers and to the protection of the interests of the data subjects. However, others believe that notification does have an “educational” effect, in that it forces controllers to examine their operations in the light of the law.^[58]

Ultimately, the GDPR did not repeat the notification/registration that started with the Directive so there is no EU-wide requirement today. This is not to suggest that there is no accountability for data controllers, just that there is no mandated public register of filing systems like that required by the Privacy Act of 1974.^[59]

A different approach to organizing privacy rules – proposed here for the first time – focuses broadly on agency activities rather than narrowly on record systems. The term used in the proposal is agency activity affecting privacy (or A3P), which means:

agency function, program, or operation that involves the processing of a record about an individual.

The choice of the term here was difficult. Some other options created acronyms that already have established meanings in the privacy realm. The mildly awkward agency activity affecting privacy is offset in part by the breezier acronym A3P. I decided not to use a superscript (A³P) because typing a superscript is more cumbersome.

The A3P definition focuses on the purpose of processing rather than on the manner in which an agency files or retrieves personally identifiable information. The idea is that an A3P would provide the public with a more understandable view of an agency’s personal record keeping by allowing multiple filing systems to be included in the same notice if the systems relate to the same function, program, or operation. The internal details of records organization are of less public interest than the kind of records that an agency processes, the purposes of that processing, and the way in which an agency uses or discloses the records. More details about A3Ps will be found in the section-by-section analysis later in this report.

The Privacy Protection Study Commission (PPSC) summarized problems and concerns that arose during the first few years of the Privacy Act. In its 1977 report, the PPSC noted that some agencies promulgated routine uses that continued disclosures that the agency made prior to passage of the Privacy Act regardless of compatibility.^[60] Some routines uses were overbroad, allowing disclosure with few or no restrictions.^[61] Some routine uses ignored the procedures for specific disclosures included in the Act itself.^[62] Some agencies, at least initially, applied the compatibility test so strictly that previously standard disclosures could not occur and other agencies could not carry out their functions.^[63] Many of the problems of restrictive disclosure policies were eventually worked out one way or another.^[64] Other issues that the PPSC observed involved disclosures either required or authorized under other laws.^[65] These problems eventually disappeared, often without much regard for the compatibility standard in the Act.

The PPSC proposed to replace the original definition of a routine use with a revised definition and a new concept, the collateral use. Under the Commission’s proposal, a routine use would be:

the use or disclosure of an individually identifiable record for a purpose which is:

(A) compatible with the purpose for which the information in the record was collected or obtained, and

(B) consistent with the conditions or reasonable expectations of use and disclosure under which the information in the record was provided, collected, or obtained.^[66]

This proposed definition applies to both uses and disclosures. It keeps the original compatibility test but adds a further restriction tied to “reasonable expectations.” A problem with this standard is that it compounds the felony. It adds a new and vague concept (“reasonable expectation”) to the vague concept (“compatible with the purpose”) already in the law. To be fair, it is hard to avoid some degree of vagueness in the end. The difficulty remains writing a policy that provides clear and unambiguous direction for all personally identifiable information processing activities in the federal government.

The PPSC’s collateral use would be:

the use or disclosure of an individually identifiable record for a purpose which:

(A) would not be considered a routine use as defined by subsection (a)(9) of this section, and

(B) is specifically authorized by statute, provided, however, that such statute:

(i) was enacted after January 1, 1975, and

(ii) establishes specific criteria for the use or disclosure of specific types of information.^[67]

Collateral uses would address some of the problems that the PPSC uncovered as well as some of the unresolved legal questions about the scope of authorized disclosures and the relationship between the Privacy Act and other laws. The PPSC explained the goal:

Because the collateral-use concept presupposes direct, and probably increasing, Congressional involvement in information policy decisions, it should help to keep the relationship between the Privacy Act and other information policy legislation in clear focus. The current law and its legislative history are silent on whether the Act was intended to supersede preexisting statutes authorizing uses or disclosures of information that do not meet the compatible-purpose test. The OMB Guidelines take the position that preexisting statutes which permit less disclosure to third parties than the Privacy Act allows were not superseded, but there was no basis for concluding that the many sections of the U.S. Code that authorize or require the disclosure of information about individuals to third parties were. Adding the concept of collateral use will assure that in the future the Congress’ attention will be drawn to statutorily authorized uses and disclosures that do not meet the compatible-purpose test and also, by virtue of the January 1, 1975 cut-off date, will precipitate a reconsideration of sections of the U.S. Code that do not meet the test today.^[68]

One other requirement recommended by the PPSC for both routine uses and collateral uses was certification by the “designated official.” The PPSC proposed that each agency head designate an officer to oversee the agency’s implementation of the Act.^[69] The designated official would have to certify that a routine use or a collateral use met the terms of the statutory definition.^[70] Congress ignored the PPSC’s recommendations for changing the Privacy Act of 1974.

Rightly or wrongly, routine uses proliferated over time, in part because there was no direct way to challenge a routine use in court other than in a specific case where reliance on a routine use resulted in harm to an individual. In addition, administrative oversight by OMB was inconsistent over the years, and congressional review, inconsistent at best, largely disappeared after the 103^rd Congress. Today, some agencies systems of records have large numbers of routine uses. One example, the Department of Veterans Affairs Patient Medical Record System, has 60 routine uses. Three of these are useful for illustration.

5. Health care information may be disclosed by appropriate VA personnel to the extent necessary and on a need-to-know basis, consistent with good medical-ethical practices, to family members and/or the person(s) with whom the patient has a meaningful relationship.

44. VA may disclose information to telephone company operators acting in their capacity to facilitate phone calls for hearing impaired individuals, such as patients, patients’ family members, or non-VA providers, using telephone devices for the hearing impaired, including Telecommunications Device for the Deaf (TDD) or Text Telephones.

48. VA may disclose information to other Federal agencies in order to assist those agencies in preventing, detecting, and responding to possible fraud or abuse by individuals in their operations and programs.^[71]

A complete analysis of current routine uses across government would take hundreds of pages or more, but it is easy to critique these three routine uses as examples. The first is largely clear and reasonable. It is also actually mostly consistent with disclosure standards under the federal HIPAA health privacy rule.^[72]

The second quoted routine use serves a legitimate purpose, but it lacks any limit on the scope of information disclosable to telephone company operators. It would be better, for example, if the routine use specifically limited the disclosure to information that the operator needed to facilitate the call. As written, the facilitation language describes the function of the operator rather than limiting the information to be disclosed.

The last of these routine uses is, in my judgment, too ill-defined to satisfy the Act’s compatibility test and may well violate HIPAA standards. It is questionable for the breadth of the allowable disclosures, the lack of any apparent relationship between the purpose of collection and the use by any federal agency in any fraud and abuse program whether related to health care or otherwise, and the absence of an administrative process prior to disclosure or requirement for a determination by VA official of suitable rank prior to a disclosure.

Over time, agencies tended to view the routine use provision as a procedural requirement rather than a substantive limit. The procedure is to publish a notice in the Federal Register. To restate the obligation glibly but consistently with the view of many agencies, any disclosure is permissible as long as the agency publishes the proper notice.

Agencies may overlook in whole or in part the substantive requirement that routine uses be compatible with the purpose for which the record was collected. Agencies also sometimes ignore the public notice purpose of publishing by providing no specificity about what can be disclosed and to whom it can be disclosed. The Central Intelligence Agency offers an example from its list of “general routine uses” applicable to all agency systems of records. The Agency currently has 14 general routine uses, some mundane, and some broadly expansive. The last of these routine uses is:

14. In the event that none of the routine uses listed above is applicable, a record from a system of records maintained by the Central Intelligence Agency may be disclosed, as a routine use, to other appropriate recipients, if such dissemination is necessary to a lawful activity of the United States, and the General Counsel of the Central Intelligence Agency, in consultation with the Department of Justice, determines that such dissemination is lawful.^[73]

To restate this routine use, it allows the disclosure of anything in any Privacy Act system of records to anyone (“other appropriate recipients”) if the disclosure is necessary to a lawful activity of the United States and the Agency’s General Counsel determines that the disclosure is lawful. Even for an intelligence agency which admittedly has a need for secrecy in some of its activities, this routine use tells the public nothing about how Privacy Act records might be disclosed. The CIA effectively reserved the right to disclose anything to anybody, although it deserves some credit for requiring a determination by the agency’s general counsel. Whether a routine use so broad and so vague meets the existing statutory standard is unclear at best. However, under the Privacy Act, there is no apparent way for anyone to challenge the breadth of the routine use unless the CIA relied on the routine use, an individual learned of the disclosure, and the individual could prove harm.

Computer matching is the computerized comparison of records from two or more systems of records for the purpose of establishing or verifying eligibility for federal benefit programs. Matching also includes comparisons from a system of records with non-federal agency records.

Matching became a subject of controversy in the late 1970s, when federal agencies sought to use information technology in new ways as part of the routine management of federal benefit programs. The rise of computer matching presented privacy legislation with one of its earliest confrontations with new technological capabilities. Uses of personal data that were impractical prior to computers could now be carried out readily and at little marginal cost.

Computer matching placed pressure on one of the Act’s weakest points, the routine use. The battle here pitted privacy against politically popular methods for addressing fraud, waste, and abuse in federal programs. It is worth reviewing the history of the 1988 Computer Matching Amendments at some length because that history is instructive about the problem of controlling disclosures in a general privacy law.

The Privacy Act of 1974 allows agencies to define allowable external disclosures for each system of records. The term that the Act defined for this purpose was routine use. In modern privacy practice, a use with respect to a record means an activity (e.g., sharing, employment, examination, or transfer) within the entity that maintains the record. A disclosure means, with respect to a record, the release, transfer, provision of access to, or divulging in any other manner of the record outside the entity holding the information.^[74] However, the Privacy Act of 1974 established the term routine use to describe external disclosures. That choice of terms was a source of later confusion.

The Act defines a routine use to mean, with respect to the disclosure of a record, the use of the record for “a purpose which is compatible with the purpose for which it was collected.”^[75] The meaning of compatibility has been a thorny issue for implementation of the Privacy Act from the beginning. Indeed, what I call the compatibility problem plagues nearly all broadly focused privacy laws around the world.

Agencies establish routine uses for each system of records by publishing a Federal Register notice and allowing an opportunity for interested persons to submit “written data, views, or arguments.”^[76] The process is short of being a full notice-and-comment rulemaking. A system of records may have anywhere from a handful of routine uses to dozens.

The legislative history for the Privacy Act of 1974 discusses the notion of compatibility. The concern was that if the standard for regulating disclosure was too narrow, then essential government activities might be disrupted. If the standard was too broad, then there would be no effective control over disclosures. Because the Act was one of the first general purpose privacy laws anywhere in the world, the uncertainty here is understandable. The original OMB Privacy Act guidelines review the congressional intent with some care and offer further explanation of routine use.

One of the primary objectives of the Act is to restrict the use of information to the purposes for which it was collected. The term “routine use” was introduced to recognize the practical limitations of restricting use of information to explicit and expressed purposes for which it was collected. It recognizes that there are corollary purposes “compatible with the purpose for which [the information] was collected” that are appropriate and necessary for the efficient conduct of government and in the best interest of both the individual and the public.^[77]

What is noteworthy here is that OMB found it appropriate to add additional concepts to the idea of compatibility with the purpose of collection. OMB talked about purposes that are appropriate and necessary for the efficient conduct of government and that are in the best interests of both the individual and the public. This hints at one problem with the statutory definition. What if an appropriate activity in the best interest of the public is not related to or compatible with the purpose of data collection? The same question asked in a different way is how broadly should the purpose of data collection be defined? In essence, the question of how broadly to define routine uses became a major issue in computer matching.

In 1977, the Department of Health, Education and Welfare began Project Match, a program to compare computer records of individuals receiving benefits under Aid to Families with Dependent Children with computer records of federal employees.^[78] The premise was that anyone on both lists was doing something improper. The Privacy Act question was whether the disclosure of records about federal employees for an activity relating to fraud, abuse, or waste in another program was compatible with the purpose for which the records were collected. There were views on all sides of this question.

The general counsel of the Civil Service Commission did not approve of the disclosures on the grounds that information about federal employees was not collected with a view toward detecting welfare abuses.^[79] Given the political interest and pressure supporting matching programs, however, OMB intervened and issued guidance about conducting matching programs.^[80] The guidance did not really address whether matching programs met the compatibility standard in the law. Instead, it set out procedural requirements for the conduct of matching programs. The guidance seemed to quiet the controversy for a while, and computer matching continued and expanded as if all matching activities met the compatibility standard. Professor Priscilla Regan provided a useful summary of the situation following the 1979 OMB Guidance:

The purpose of the guidelines was “to aid agencies in balancing the government’s need to maintain the integrity of Federal programs with the individual’s right to personal privacy.” However, agencies did not follow the guidelines, the OMB did not monitor agencies’ activities, the public and interest groups did not respond to Federal Register notices, and there was little congressional reaction. The ideas of integrity and efficiency complemented federal agencies’ interests in matching records. But the idea of privacy did not complement the interests of any groups with a role in computer matching, except the individuals under investigation, who generally were not aware that their records were being matched. The balance that might have been achievable between the two ideas was offset by the support of interests on one side and the lack of knowledge on the other. In this policy setting, agency use of computer matching increased.^[81]

In his book, The Rise of the Computer State, David Burnham reviewed the history of computer matching. He concluded that the words of the 1979 OMB Guidance were “hollow,”^[82] citing the Civil Service Commission’s reversal of its ban on matching. Burnham’s broader conclusion was about “how technology influences the shape of the law and administrative practice of government programs.”^[83] Matching continued “despite provisions of law that would appear to prohibit it,”^[84] because of the difficulty of denying technology.

Computer matching remained mildly controversial, but there was limited congressional response. Opposition to matching was politically unattractive because of the focus on “welfare cheats” from the Reagan Administration and the constant touting of computer matching results (whether justified or not by the facts) by agency Inspectors General.^[85] In 1982, OMB revised its matching guidance^[86] without seeking public comment.^[87] The resulting guidance weakened the 1979 requirements, and one observer described the changes as essentially repealing the original lenient safeguards.^[88]

Despite the politics of the issue, Senator William Cohen, a Republican from Maine, picked up the matter a few years later in 1986. Cohen deserves much credit for his willingness to step into a controversial subject and look for a suitable response. Together with Senator Carl Levin, he introduced legislation to regulate computer matching.^[89] That began a process that resulted in the matching amendments to the Privacy Act of 1974. The initial effort came too late in the Congress for final action, but the Senators persisted in the following Congress.^[90] Cohen’s success in the Senate provided considerable political cover for House action. Following the Senate, the House eventually took up the issue, and the Computer Matching and Privacy Protection Act of 1988 became law.^[91] I was the House staffer responsible for the 1988 amendments. Quiet support for the effort from the Privacy Act staff at OMB helped to shape the amendments and to overcome internal administrative objections.

The computer matching amendments regulate matching activities in three main ways. First, the law requires that agencies conducting matching programs enter into formal matching agreements specifying the terms, justification, and details of the match. The law specifies eleven separate components of an agreement. Matching agreements must be sent to the Congress and made available to the public upon request.^[92] Second, the law requires agencies conducting or participating in matching to establish Data Integrity Boards to review and approve matching agreements.^[93] Third, the law provides due process procedures for individuals identified in matching activities. Each agency must independently verify information from a match, provide notice to the individual with a statement of findings, and afford an individual an opportunity to contest the findings.^[94] The due process requirements resulted because of significant evidence that government agencies used the unverified findings of matching activities to terminate people from assistance programs. In a significant number of cases, the terminations were unjustified.^[95] It was that evidence of unfairness that was the engine that drove the legislation through the Congress, essentially without controversy. The legislation achieved the support of the Reagan Administration largely because it was Senator Cohen’s bill (Cohen was a Republican) and because of support from OMB Privacy Act staff. Administration support came despite some agency opposition, largely from those who conducted computer matching.

The focus of the amendments was on administrative procedures and due process more than on the privacy consequences or legality of matching. It is difficult to assess the overall success of the matching amendments, but there are suggestions that the due process procedures worked reasonably well. Many problems that resulted from inaccurate records and from the use of outdated files slowly were resolved. The administrative controls are more of a mixed bag, with some agencies going through the required process mechanically but no real enthusiasm. Agencies and OMB consistently ignored the statutory requirement for showing that matching meet a cost-benefit test.

One reason the legislation was not especially controversial is that the original OMB guidance from 1979 included some features that the legislation adopted. OMB told agencies to prepare matching reports and publish notices in the Federal Register. It did not matter that agencies did not follow the guidance, something that Professor Regan suggested was the case. OMB was hard pressed to oppose ideas it promoted earlier. The due process requirements in the legislation went beyond OMB guidance, but both Senate and House justified the requirements by documenting a record of problems with the use of “raw hits” to deprive individuals of benefits to which they were legitimately entitled.^[96] The discrepancies were often the result of data errors, inconsistent time periods, and erroneous assumptions.

Another reason for the lack of controversy is that the legislation regulated matching procedurally but not substantively. The matching amendments did not raise or resolve any legal questions about whether or when matching programs could be justified as a routine use under the Privacy Act. Over time, other legislation authorized or expressly required agencies to conduct many computer matches, so the need to justify routine uses under a compatibility standard disappeared in large part. If a statute required a disclosure, then the disclosure was effectively compatible as a matter of law. For other matches, the adoption of routine uses continued without much question.

The closest the matching amendment came to addressing the routine use issue came in section 9 of the law, a section not codified in the Privacy Act of 1974. The “rules of construction” stated that nothing in the matching amendments could be construed to authorize computer matching not otherwise authorized by law.^[97] Congress was careful to say that the amendments did not authorize matching, but it left the legal question about routine uses otherwise unresolved. Computer matching continued on as it did before. The computer matching amendments succeeded politically because they were modest and procedural, avoiding attacking matching directly.

Even as debates about computer matching continued, technology and administrative practices moved on. Agencies started using front-end verification, which seeks to certify the accuracy and completeness of personally identifiable information at the time an individual applies for government benefits, employment, or services. The Office of Technology Assessment found that front-end verification created a de facto national database covering most Americans and led to the establishment of individual databases for verification purposes and to the connection of these databases through online telecommunication linkages.^[98] Front-end verification offered some similar and some different privacy challenges than computer matching, but congressional interest waned after passage of the matching amendments, and those challenges went unexplored. Arguably, the direct and permanent linkage of disparate databases is a worse outcome for privacy than the occasional exchange of information for matching. On the other hand, front-end verification reduced the sharing of less personally identifiable information between disparate programs because it shared only information about program applicants. This is arguably a more favorable outcome for privacy.

Professor Regan gets the last word here. She wrote: “Catching ‘welfare cheats’ was a more popular symbol than fear of Big Brother.”^[99] That remained true from the first matching program until and beyond passage of the computer matching amendments.

Senator Daniel Akaka’s bill, Privacy Act Modernization for the Information Age Act of 2011, proposed a new definition for routine use.

the term ‘routine use’ means, with respect to the disclosure of a record, the use of such record for a purpose which, as determined by the agency, is compatible with the purpose for which it was collected and is appropriate and reasonably necessary for the efficient and effective conduct of Government.^[100]

The core of the definition is the compatibility test in current law, but it adds several new ideas. First, it requires the agency to determine the purpose of the disclosure. It is not entirely clear what determining the purpose means in practice, although another part of Akaka’s bill required a system notice to include any purpose for which the information is intended to be used, including each routine use.^[101]

Second, Akaka’s routine use must be both appropriate and reasonably necessary for the efficient and effective conduct of Government. If a disclosure is not compatible with the purpose for which the record was collected but is otherwise appropriate and reasonably necessary for efficient and effective government, then presumably the disclosure would not be allowed. This raises the same issue that arose with computer matching, where disclosures for matching seemed unrelated to the original purpose but served other governmental interests and attracted significant political support. For computer matching, the disclosures proved impossible to resist. The Akaka standard does not clearly resolve this tension, a tension that is ultimately at the core of the compatibility problem.

The original 1995 European Union Data Protection Directive^[102] addresses the same problem about defining allowable disclosures that the Privacy Act of 1974 did twenty-one years earlier. The 2016 General Data Protection Regulation came along twenty-one years after the Directive and starts with the same basic solution as the Directive.^[103]

The Directive’s main provision addresses further processing, a concept that includes disclosures to third parties:

1. Member States shall provide that personal data must be: ***

(b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. Further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible provided that Member States provide appropriate safeguards.^[104]

The Directive uses a compatibility standard, but it reverses the standard the Privacy Act uses. Rather than allowing a disclosure (“further processed”) that is compatible with the purpose for which the record was collected as the Privacy Act does, the Directive allows disclosure as long as the disclosure is not incompatible with the original purpose for processing. This double negation makes a difficult standard harder to fathom. The Article 29 Working Party – the group of EU data protection authorities established under the Directive – concludes:

By providing that any further processing is authorised as long as it is not incompatible (and if the requirements of lawfulness are simultaneously also fulfilled), it would appear that the legislators intended to give some flexibility with regard to further use. Such further use may fit closely with the initial purpose or be different. The fact that the further processing is for a different purpose does not necessarily mean that it is automatically incompatible: this needs to be assessed on a case-by-case basis, as will be shown below.^[105]

The need for flexibility and a case-by-case determination is consistent with the history of the routine use in the Privacy Act of 1974. The need for both clear standards and flexibility is the core of the compatibility problem, and Europe does not have a word formula that solves the problem.

There is more history here. The Article 29 Working Party discussed the background from the European Convention on Human Rights, the Council of Europe’s Convention 108 for the Protection of Individuals with regard to automatic processing of personal data, and the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data.^[106] That history, which clearly informed the choices made by the EU, will not be reviewed here. High-level principles have their place, but devising a statutory standard for a diverse group of data controllers to apply in a wide variety of circumstances is different and more difficult. Operationalizing a high-level principle is a clear challenge for any privacy law.

In analyzing the EU policy in this context, it is important not just to focus on the compatibility standard but to pay attention to purpose specification as well. As the Article 29 Working Party observes: “Specification of purpose is an essential first step in applying data protection laws and

designing data protection safeguards for any processing operation.”^[107] Further, the Working Party states expressly that “purpose specification and compatible use are essential principles in the system of data protection.”^[108]

The focus on purpose specification is an important difference between the EU approach and the Privacy Act of 1974. The Privacy Act says plainly and flatly that a routine use must be compatible with the purpose for which a record was collected. There is no further explanation. The Act requires publication of a system of record notice describing details about the system, but the notice does not even require agencies to state the purpose of processing.^[109]

In contrast, the EU directive states that personal data must be collected for specified, explicit and legitimate purposes. These three adjectives narrow and refine the notion of purpose. The Article 29 Working Party document offers five pages explaining how to understand and apply these three adjectives.^[110] By contrast, under the Privacy Act, purpose attracts little attention, perhaps because there are no directions or standards for defining purpose.

To be sure, the Article 29 Working Party document also offers pages of discussion on how to assess compatibility.^[111] The argument here is not that the Directive’s focus on purpose fully solves the challenge of defining compatibility, only that it provides more express context for making compatibility determinations.

Those determinations are not necessarily easy to make or made consistently by EU member states. The Article 29 Working Party found divergent applications of the policy as implemented by the member states under the Directive.

The divergences touch upon several aspects of the concept. Member States apply different tests to analyse the notions of purpose specification and incompatible use. In some countries, specific rules may apply to the public sector. In others, purposes may sometimes be defined in very broad terms. The approaches in the different Member States also vary as to how the purposes are made explicit, for example, whether specification of purpose is required in the notification to the data protection authority or in the notice to the data subject. The rules concerning the change of purpose, including for research and statistical purposes, also vary considerably, as they do in terms of the requirement of safeguards for these specific uses.^[112]

There are further lessons from the 2016 European General Data Protection Regulation (GDPR), the data protection instrument that superseded the 1995 Directive. The GDPR starts with the same language – more or less – as the Directive. GDPR provides in relevant part:

1. Personal data shall be: ***

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’).^[113]

Both the Directive and the GDPR address the subject of processing for historical, statistical or scientific purposes by stating expressly that further processing for these purposes is not considered as incompatible with the original purpose. The GDPR also includes processing for archiving in the public interest. All of these disclosures might raise questions in many contexts about whether they meet – or need to meet – any compatibility test. The express provision in the GDPR (as well as the earlier Directive) cut off the need for debate with a broad, affirmative conclusion. In other words, these activities are generally favored in society’s interest as to be allowed without any compatibility testing at all.^[114]

Evidence that the Directive’s standard for further processing left something to be desired is found in new language added by the GDPR. Article 6 of the GDPR adds almost 200 words to guide the determination of what is legitimate processing for a purpose other than the purpose of collection:

4. Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject’s consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:

(a) any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;

(b) the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;

(c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;

(d) the possible consequences of the intended further processing for data subjects;

(e) the existence of appropriate safeguards, which may include encryption or pseudonymisation.^[117]

A few observations about this language may be useful here. First, the GDPR makes clear that further processing with data subject consent and processing in accordance with law are both allowable. Under the Privacy Act, disclosure with consent is always allowable,^[118] but the status of disclosures allowed or required by other legislation is unaddressed. Second, purpose and context are important in assessing further processing for the GDPR. Under the Privacy Act, purpose is the only factor. Third, the additional GDPR language helps in ascertaining whether further processing “is compatible with” the original purpose. The earlier language in Article 5 retains the double negation (“not to be considered to be incompatible with the initial purposes”) used in the Directive. It is not immediately apparent how to reconcile a not incompatible with a compatible or even if there is any real difference.

I suggest that this review shows why the compatibility problem is not easy to solve.^[119] Europe had two bites at the compatibility apple, and while it provided more words the second time around, it did not find a bright-line test. I doubt that such a test exists. Any assessment of compatibility applicable in a general-purpose privacy law will necessarily call for consideration of multiple factors that bear on the decision to allow or not allow further processing or further disclosure. While assessments can be channeled in certain directions and measured on various scales, a final decision in hard cases typically requires human judgment. Is a disclosure the right thing to do under all the circumstances? Judgments here are not always hard, and most people likely would reach the same result much of the time, but the details may matter a lot. Still, difficult or controversial choices will arise, and judgments may differ. We must recognize as well that the agencies making the judgments may have conflicting interests.

When substantive criteria are difficult to apply, it is sometimes useful to require a process to be followed. Recall, for example, that the Privacy Protection Study Commission proposed certification by a designated official. Many recent practices in the privacy realm rely as much on process and procedure as standards. Privacy officers, privacy impact assessments, and privacy by design are examples of responses to privacy that rely at least in part on process and procedure rather than substantive line-drawing. Legislation cannot cover all contingencies or establish standards to be applied ministerially. Legislation can, however, state the factors that decisionmakers must consider when writing and approving further disclosures. Legislation can require that allowable disclosures be more specifically and more narrowly defined. Legislation can require public input as well. Legislation can provide a method for challenging choices and for making decision makers accountable.

The USA FIPS Act does not use the term routine use but proposes a new term, agency designated disclosure. The bill also adjusts the standards and adds a series of requirements intended to make allowable disclosures easier to understand and potentially narrower in scope. The section-by-section discussion later in this report explains the specifics.

The Privacy Act of 1974 has two classes of labeled exemptions plus two unlabeled provisions that function as limited exemptions. The labeled exemptions (so-called (j) and (k) exemptions) are the general (j) exemptions,^[120] which come in two types, and the specific (k) exemptions^[121] with seven types. An agency seeking the use a (j) or (k) exemption must first go through a rulemaking before it can invoke the exemption in any given instance, but the two unlabeled exemptions do not require a rulemaking or any predicate.

The first provision that acts as a limited exemption allows an agency to withhold from individual access “any information compiled in reasonable anticipation of a civil action or proceeding.”^[122] The Department of Justice Guide to the Privacy Act describes it as “sometimes mistakenly overlooked” because it does not appear with the other exemptions.^[123] This (d)(5) exemption is often called the attorney work product exemption. It is comparable to, if not identical with, the attorney work product exemption that is part of Exemption 5 of the FOIA. The FOIA exemption protects “inter-agency or intra-agency memorandums or letters which would not be available by law to a party other than an agency in litigation with the agency.”^[124] There does not appear to be any particular controversy over the need to protect attorney work product information, although there may be questions in any given application of the principle whether a particular document qualifies as work product.

The second limited exemption covers records transferred to the National Archives, and there are two subtypes here.^[125] Records sent by an agency for storage in an Archives records center remain subject to the Privacy Act and are the responsibility of the agency that sent the records. This remains an unobjectionable result, but it may not need a statutory provision to achieve it. An agency is responsible for its own records no matter the storage facility.

The Archives subsection distinguishes records stored by the Archives from records accepted by the Archives for historic preservation.^[126] The latter records, the second type of records addressed by the Archives limited exemption, are mostly exempt from the Privacy Act. The Archives must still publish a notice about the records. The publication provision duplicates language in 44 U.S.C. § 2019 that requires the Archivist to prepare and publish “inventories, indexes, catalogs, and other finding aids or guides to facilitate” use of transferred records.^[127] The objectives of the historic preservation provision can be readily met with simpler language.

For both general and specific exemptions, an agency must go through a formal rulemaking to apply an exemption to a specific system of records. This contrasts with the exemptions in the Freedom of Information Act, which agencies may use when appropriate without any preconditions in responding to a request for agency records. The attorney work product exemption in the Privacy Act is available in the same way as other FOIA exemptions.^[128] If a record in a system of records is attorney work product, the record may be withheld without any prior rulemaking or other action by the agency, and the exemption is available for all systems of records.

In its 1977 review of the Privacy Act, the Privacy Protection Study Commission found that the exemptions narrow the scope of the law’s application and unduly frustrate achievement of the Act’s basic objectives.

While one can agree with the basic public-policy determination that some Federal agency records should not be subject to all of the Privacy Act’s requirements, lest ongoing law enforcement investigations or legitimate national security interests be jeopardized, it nonetheless seems clear that the exemption provisions currently in the Act unnecessarily narrow its scope of application and thus unduly frustrate the achievement of its basic objectives. The Secret Service, for example, has had to exempt its entire “Criminal Investigation Information System” [41 F. R 45437 (October 14, 1976)] in order to exempt any part of it, even though many of the records in the system could be (and, under the Freedom of Information Act, often are) open to the individuals to whom they pertain; could be susceptible to correction and amendment without undue burden on the agency; and could be maintained with relatively strict procedures for assuring their accuracy and relevance when they are disclosed to third parties. In particular, one of the four categories of information in the system – records “consisting only of identifying data and notations of arrest, the nature and disposition of criminal charges, sentencing, confinement, release, and parole and probation status” – could be brought within the full scope of the Act without unreasonable difficulty. Such records, largely derived from public records, are unlikely to jeopardize ongoing investigations if disclosed to the individuals to whom they pertain and if inaccurate, but used to make a decision about an individual, either by the Service itself or by another agency, could be the cause of substantial harm to the individual.

Agencies not ordinarily thought of as investigative or law enforcement agencies are often in the same position as the Secret Service. The Federal Trade Commission’s “Investigational, Legal, and Public Records” system in many respects parallels the Secret Service’s Criminal Investigation Information System, but it too has been exempted in its entirety. [41 FR 39719 (September 15,1976); 16 C FR. 4.13]^[129]

The PPSC proposed abandoning the systemic exemptions in the Privacy Act and using FOIA-like exemptions so that there would be “one set of standards for determining when access will not be granted.”^[130] The PPSC approach retained most of the (k) exemptions, “although in a form which permits them to be invoked only for the purpose of restricting individual access.”^[131]

For the (j) exemptions, applicable to all Central Intelligence Agency records or by any agency whose principal function is any activity pertaining to criminal law enforcement, the Commission’s approach would not allow complete exemptions from requirements such as sharing corrections of records with prior recipients, reporting on new systems of records, and assuring the necessity and relevance of the information they collect.

As a rule, it is safe to assume that any agency establishing an exemption for a system of records invoked all available exemptions for that system. There are some exceptions to this assumption, but they are rare. One noteworthy exception to the rule comes from the Central Intelligence Agency and is discussed below.

▶ a. The travelling exempt record problem

▶ b. Classified information

▶ c. Confidential Sources and the (e)(1) Requirement

▶ d. (j)(1) exemption

▶ e. (j)(2) exemption

(1) INDIVIDUAL. –The term “individual” means a living individual and includes an individual acting as a sole proprietor.

The definition of individual makes several changes from existing law. First, it clarifies existing law that only living individuals have rights under the bill. That has been the general practice under the Act.

Privacy rights after death is a more complex subject than it was decades ago, in part because of the existence of electronic information maintained by numerous third-party record keepers inside and outside of government. The health privacy rule issued under the authority of the Health Insurance Portability and Accountability Act (HIPAA) originally required a HIPAA covered entity to protect the privacy interests of deceased individuals forever. In 2013, the Department of Health and Human Services changed the rule so that privacy obligations end fifty years after death.^[169] The change is evidence that a forever rule has its shortcomings. So does the current policy, for that matter.^[170]

When privacy rights continue after death, complex issues arise about the rights of heirs. With government records, questions about openness obligations arise.^[171] If the bill changed current practice regarding privacy after death, these issues would have to be confronted. I do not believe that those issues are ripe for federal legislative attention at present, and any attempt to address them would likely require extended discussion and would be significantly controversial. These matters are best left for consideration at another time and in a broader context than just federal agency records. There has been some attention to and legislation proposed to address privacy rights after death, especially at the state level, but new laws remain rare.^[172] The stakeholders in any privacy-after-death legislation are considerably different than those who care about federal agency privacy.

A second, less complex issue, resolved by the definition is the status of individuals who are sole proprietors.^[173] The Privacy Act grants rights to individuals but not to legal persons. Sole proprietors fall in the middle. There is a split of authority on the question of sole proprietors, and agency practice varies.^[174] I see no reason not to resolve this question in the bill by establishing a clear, uniform policy for all agencies. The bill grants sole proprietors the same rights as individuals.

The third change made by the new definition grants privacy rights to all individuals. The Privacy Act of 1974 only grants rights to citizens and aliens lawfully admitted for permanent residence. Foreign nationals have no rights under the Privacy Act. During my years working on the House Subcommittee, I recall being told by those who worked on passage of the Act that the CIA insisted on excluding foreign nationals.

During informal discussions in 2011 between privacy advocates and Senate staff seeking to amend the Privacy Act of 1974, the issue of extending rights to foreign nationals arose. Senate staffers refused to consider it. The political problem was that it would allow Osama bin Laden to request his file, and the staffers did not want to confront that issue.

Several reasons justify granting privacy rights to foreign nationals. First, privacy is now a major international issue. It is common for national privacy laws in other countries to grant rights to all, regardless of citizenship. If U.S. law fails to grant rights to foreign nationals, then eventually other countries may deny rights to U.S. citizens. The issue then is as much about rights of U.S. citizens as it is about rights of foreign nationals.

Second, some other countries are already aware of the limits of the Privacy Act, and the U.S. was essentially forced to respond to the EU’s unhappiness about it. The unhappiness was over more than just the Privacy Act, but adjusting the Act was something readily doable without much controversy. The result was the passage in 2016 of the Judicial Redress Act of 2015.^[175] The Act created a convoluted way for the U.S. to grant rights under the Privacy Act of 1974 to citizens of designated foreign countries. The law resulted from negotiations between the U.S. and the European Union over general EU concerns about the limits of U.S. privacy law and the sweep of U.S. surveillance laws in the context of data sharing among nations for criminal and terrorism investigations. Support for the Judicial Redress Act came in part from the American business community, which feared that any new EU new privacy restrictions could interfere with international trade. Under the authority in the Judicial Redress Act, the Attorney General extended Privacy Act rights to citizens of EU member states.^[176] Providing rights to citizens of some countries and not others is a policy not likely to survive for long. The change in the definition of individual to include foreign nationals will treat all foreign nationals in the same way and will make the Judicial Redress Act essentially irrelevant.

Third, the failure of the Privacy Act to grant rights to foreign nationals is partially ameliorated by the Freedom of Information Act. The FOIA allows any person to request records from a federal agency. It is common practice for immigrants who need federal records to use the FOIA to obtain copies of records pertaining to themselves.^[177] The FOIA provides access to records, but it offers no mechanism that allows a data subject to seek an amendment of a record. The FOIA includes exemptions that protect national security, law enforcement, and other interests by allowing agencies to withhold records from requesters.

I note here that the FOIA has generally been held to deny use of the law to fugitives from justice.^[178] That same policy applied to a revised privacy law will also ameliorate concerns about the use of the law by high-profile international criminals.

Fourth, the Privacy Act and the proposed replacement bill both contain similar exemptions that also protect national security and law enforcement interests by allowing the withholding of some records from requesters. These exemptions apply to all individuals, and both the FOIA, the Privacy Act, and the bill include complete protection for all classified information.

Fifth, until recently, the concerns that resulted in the denial of rights to foreign nationals appear to have substantially dissipated over the years. For administrative and other reasons, some agencies as a matter of discretion typically grant Privacy Act rights to foreign nationals when no reason existed not to grant those rights. Agencies cannot always tell if an individual seeking to exercise a right under the Privacy Act is a citizen. In those cases where no countervailing interest exists, it can be easier to grant rights to a requester rather than the conduct a citizenship inquiry for all requesters. For requirements of the Act that do not involve access and amendment rights, an agency may have a system of records that includes both citizens and foreign nationals. The agency must maintain the system and comply fully with those requirements for all records. Even systems that mostly have records about foreign nationals may occasionally have records about U.S. citizens. Because of that possibility, an agency will typically maintain the entire system in accordance with general Privacy Act requirements. All of these administrative circumstances make broad compliance with the Privacy Act simpler and less expensive without much regard to the citizenship status of a data subject.

A noteworthy exception to support for granting foreign nationals rights under the Privacy Act comes from President Trump. A 2017 Executive Order included this provision:

Sec. 14. Privacy Act. Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information.^[179]

The extent to which agencies complied with this presidential order is uncertain.^[180] Regardless, the revised bill will grant rights to foreign nationals as a matter of statute, rights that would not be subject to change by Executive Order.^[181]

(2) DATA SUBJECT. –The term “data subject” means the individual who is the principal subject of a record.

Data subject is a new term. There is a subtle distinction between data subject and individual. An individual is someone who may or may not be a data subject. To put it another way, all data subjects are individuals, but not all individuals are data subjects. Some examples will clarify.

·       One of the purposes of the new bill is to permit individuals to know how agencies process personally identifiable information. Everyone is entitled to know about agency processing of PII whether or not they are actually data subjects in any given activity.

·       The existing Privacy Act provision that limits collection of information about the exercise of rights guaranteed by the First Amendment uses the term individual. The limitation protects individuals, whether or not they become data subjects.

·       An allowable disclosure for health or safety permits sharing of information if necessary to prevent or lessen a serious and imminent threat to the health or safety of any individual or the public. It does not matter whether the beneficiary of the disclosure is either the data subject of the record or any data subject at all. As with a comparable provision in HIPAA, disclosures for health or safety or allowed to assist with threats to anyone.

·       In computer matching activities, due process protections protect individuals. Many individuals will be data subjects, but some will be not because they are the subject of records maintained by state or local agencies. Only subjects of federal agency records fall under the definition of data subject.

Data subject is a term commonly used in national privacy laws.

(3) PERSONALLY IDENTIFIABLE INFORMATION. – The term “personally identifiable information” means information about an identified or identifiable individual, including information about location, housing, education, finances, health, employment, criminal history, military service, taxation, agency program participation, Internet usage history, or any other personal activity or characteristic, and that contains any of the following data:

(A) a name;

(B) a home address, post office box, private mail box, or other physical or postal address;

(C) an e-mail address;

(D) a telephone number or the letters and numbers of a vehicle license plate;

(E) a Social Security Number; passport number; credit or debit card number; account, license, or employee number; or other identifying number assigned to an individual;

(F) date of birth;

(G) an Internet Protocol address or any comparable successor address;

(H) any other data that permits the physical or online contacting of a specific individual;

(I) a photograph, fingerprint, genetic, or other biometric identifier;

(J) information that identifies an individual’s electronic device, including an international mobile equipment identity number, media access control address, contactless chip identifier, or any information that an agency Web site or online service collects online through a computer or from the individual, individual’s cell phone, or other electronic device; or

(K) other information concerning an individual processed in combination with an identifier described in subparagraphs (A) through (J).

The definition of PII has several elements. The first addresses information about an identified or identifiable individual, including information about location, housing, education, finances, health, employment, criminal history, military service, taxation, program participation (e.g., participation in a government program such as Medicare), Internet usage history, or any other personal activity or characteristic. The word including here (and elsewhere in the bill) means including but not limited to. The list of activities and personal characteristics is illustrative and not exhaustive.

An individual is identified when there is enough compiled information so that it is reasonably likely that a specific individual can be associated with the information. Reasonably likely means more than 50% likelihood, but 100% certainty is not required. A name identifies an individual, although there are times when just a name without further context is not specific enough to indicate who the individual is (e.g., John Smith). An individual can be identified without a name (e.g., the adult male living at 419 Main Street, Lima, Ohio). A collection of non-personal characteristics may be enough to identify an individual (e.g., the tallest female in the 12^th grade physics class at P.S. 106 in New York City).

An individual is identifiable when there is a reasonable prospect that a specific individual can be identified using the information in question. The degree of likelihood appropriate here may depend on context. An individual who lives in a small town and has an unusual surname is more likely to be identifiable than an individual who lives in New York City and has a common surname. If information can be linked to a small number of individuals but it is not certain which one, the information should be treated as identifiable if an agency uses it to make a decision about one or more of those individuals.

Whether an individual is identifiable from a set of data also can depend on who is doing the identifying. A fingerprint found at a specific location can be an identifier. To the FBI, there is a reasonable chance that a fingerprint will identify a specific individual because the FBI has biometric databases and the capability of matching a fingerprint to one of those databases. To an agency without the fingerprint-matching resources available to law enforcement, that same fingerprint may not be identifiable information. Whether a photograph is identifiable may depend on the resources used and effort made to learn whose photograph it is. A printed grocery receipt without any identifiers may be identifiable to the grocer who sold the items to a customer using a credit card or frequent shopper card.

With the much larger availability of Internet and other resources as well as the increasing capabilities of technology to connect biometric information and other data to specific individuals, the notion of identifiability is not a fixed concept. Information may become identified because an agency made an effort to connect it to a particular individual. That same information may not be PII if the agency makes no identification effort.

Another factor can be the stakes involved in identifiability. If the decision is whether to show a particular webpage to an individual, the concerns about identifiability are lower than if the decision affects an important interest or requires due process. In determining whether a collection of characteristics is identifiable, an agency should lean on the side the treating the data as identifiable. In general, facts and circumstances matter.

Fully anonymous information is not identifiable and is not PII. However, here too, the availability of other databases (whether governmental or private) and the use of technology may make it possible to reidentify data once thought to be anonymous or pseudonymous. Factors that will determine if anonymized or deidentified information is identifiable include resources and effort. Further, the capabilities of re-identifying anonymous data change over time, so anonymity cannot be treated as a designation fixed in time

Determinations about anonymity are not always simple. Consider an agency that has a database of fully anonymized information that it cannot re-identify. The agency may treat the database as anonymous and therefore not subject to the USA FIPS Act. Yet if the agency has reason to believe that a private company may have the capability to re-identify some or all of the individuals in the database, the agency cannot release the database publicly because that action would be tantamount to identifying the individuals. Withholding may also be appropriate if the agency has reason to think that the capability of re-identifying the database may arise in the near future.^[182]

A database may exist in a “quantum” state of identifiability, where it is neither wholly identifiable (and therefore subject to the USA FIPS Act) nor completely anonymous (and therefore outside the Act). Individuals in the database may not be able to exercise their rights under the USA FIPS Act because the agency cannot identify which record belongs to which individual. The proper response for the agency is to treat the database in a manner consistent with the requirements of the USA FIPS Act other than the access and amendment rights. This “quantum” status where a database at the same time is anonymous in the hands of some and identifiable in the hands of others results because different persons have different resources and capabilities. This is parallel in some ways to data being identifiable to one individual but not to another.^[183] By treating databases with uncertain status as identifiable, an agency will avoid facing the problem of a USA FIPS Act A3P springing into existence one day because of a new capability or new program that makes the records identifiable.

Another element of the definition provides examples of the type of identifiers that make information into PII. The list in the statute is not exhaustive, as the last part of the definition makes clear (“other information concerning an individual processed in combination with an identifier described” in the earlier subparagraphs of the definition). Not all listed elements are, by themselves, identifiable. A data of birth is not identifiable without additional information. An Internet Protocol address may or may not be identifiable at all times. Data of any sort that allows a specific individual to be identified or contacted consistently is identifiable, even if the name of the individual is not known to anyone. A browser cookie or browser fingerprint may allow for identification of an individual in a consistent manner even if nothing else is known about that individual. If so, that cookie or fingerprint must be treated as an identifier.

(4) AGENCY ACTIVITY AFFECTING PRIVACY. –The term “agency activity affecting privacy” means any agency function, program, or conduct that involves the processing of a record about an individual.

As discussed above, an agency activity affecting privacy (A3P) focuses broadly on the reasons that an agency processes information, rather than narrowly on the manner in which an agency files or retrieves personally identifiable information. As explained later in this report, section 5 of the bill provides additional standards and guidance about the scope of an A3P. Agencies will have considerable discretion to decide how to lump activities into A3Ps. What works at a large agency may not work for a small agency. An A3P can encompass a large number of records and functions or a small number.

The definition does not include any express notion of maintenance or ownership. Nor does the proposed definition of record. If the agency activity involves the processing of a record about an individual, the function is an A3P, regardless of who owns or maintains some or all of the personally identifiable information. It does not matter if a third party owns the record processed by the agency or if the data comes from a public source. An agency that regularly processes any PII regardless of source or ownership must describe that record in its A3P notice. Suppose, for example, that an agency verifies an occupational license in a public database maintained by a state. The agency record may only show verification of the license and, perhaps, the date of verification. The A3P would have to describe that the activity includes processing of occupational license data from named databases, even if the agency record was only a tick box showing the presence or absence of a license and included no details of the license (scope, expiration, etc.).

In another example, suppose that an agency obtains and relies on a consumer score such as a credit or other score.^[184] If the agency retains a copy of the score that it uses, that information will be a record in an A3P and subject to data subject access and amendment. If the agency looks up information about a data subject in a database held by a third party and does not copy the data in a record in an A3P, that information is not subject to access and amendment rights. As will be clear later, access and amendment rights apply only to “a record processed as part of an agency activity affecting privacy.” In the case of a credit score, an agency would likely and legitimately deny a request for amendment of an accurately recorded score because a score obtained from a third party is not an agency record in the hands of the third party. The data subject might pursue rights under other laws to question the credit score held by the credit bureau. If the score changed as a result, the data subject might ask the agency to reassess the data subject’s status. The data subject may seek access to information that the agency maintains about how the agency used the score.

Third party information held by an agency can still be the subject of an amendment request. In response to a request from the data subject for amendment, the agency might be asked to determine if the score is relevant to the agency decision, is accurately recorded, or is current. A requester who wants to amend an agency-held score that is accurate and current for agency purposes can still file a statement of disagreement objecting to the score in some manner (e.g., the score relies on old data or on data about another individual), to its use by the agency (e.g., the score is not relevant to the agency decision), or addressing some other element of the activity involving the score (e.g., the agency uses the score in any unfair or discriminatory manner). Other administrative remedies may also be available to a disgruntled data subject.

In these examples, it is noteworthy that other laws^[185] (and not the USA FIPS Act) determine what records an agency must maintain.^[186] The USA FIPS Act does not direct agencies to record information (other than disclosure history) that they do not need to record to fulfill their missions. In the occupational license example, if the agency has no programmatic reason to record an expiration data, the USA FIPS Act does not require the retention of that information just because the agency saw it. However, if that data had an effect on an agency decision, 44 U.S.C. §3101^[187] would presumably require recording and retention of the data as adequate and proper documentation. If a relevant agency record is not available under the access provision of the USA FIPS Act, a data subject can use the FOIA to see that record.

(5) RECORD. – The term “record” means any personally identifiable information processed by or for an agency as part of an agency activity affecting privacy.

The Privacy Act uses the term record. The proposed bill uses the same term with a somewhat different meaning. Much of the substance of the current term now appears in the bill as part of the definition of personally identifiable information. The new term means any PII processed by or for an agency as part of an agency activity affecting privacy. A record is PII processed for an A3P. Ownership is not part of the definition. An agency may use PII that it does not own in its activities. In fact, ownership is not an important attribute for PII anywhere in the bill, and it is rarely important in any discussion of privacy. Possession is not necessarily a required attribute either. A record is PII processed by an agency, but it also includes a record processed for an agency as part of an agency activity affecting privacy. A record may be processed for an agency by an agency contractor. PII maintained by a third party (e.g., a credit report or a public database maintained by a State) is not processed for an agency. That PII is maintained by someone else for their own purposes. The use of that third-party information by a federal agency does not make that third-party information in the hands of the third party subject to the USA FIPS Act. If an agency uses third party information and keeps a copy, that copy is a record as part of an A3P.

If an agency provides a record to a third party for that third party’s use (e.g., reporting on the status of a loan to a credit bureau, verifying a Social Security Number for a mortgage, etc.), the third party does not become subject to the USA FIPS Act unless the third party is accomplishing an agency mission and falls under Section 14. An agency remains responsible under the USA FIPS Act and other laws for any actions that it takes based on third party or other information and for appropriately documenting those actions.

(6) USE. –The term “use” means, with respect to a record, the employment, application, utilization, examination, sharing, or transfer of the record within the agency that processes the record.

(7) DISCLOSURE. –The term “disclosure” means, with respect to a record, the release, transfer, provision of access to, or divulging in any other manner of the record outside the agency that processes the record.

In modern privacy parlance, use of a record means processing that is internal to the organization that maintains the record. A disclosure occurs when a record is transferred outside the organization. The bill’s definitions reflect modern usage. Current terminology in the Privacy Act is inconsistent with modern understanding. Thus, a Privacy Act routine use is an external disclosure, not an internal use so the term routine use does not appear in the USA FIPS Act. Disclosures are either allowable disclosures or agency designated disclosures. In general, the Privacy Act lightly regulates internal uses and more heavily regulates external disclosures. The bill largely follows this pattern, but there are significant changes, mostly procedural, affecting disclosures.^[188]

(8) PROCESSING. –The term “processing” or “processed” means, an activity with respect to a record, including the creation, collection, use, disclosure, maintenance, storage, examination, analysis, encryption, decryption, deidentification, reidentification, erasure, or destruction of the record.

Processing is a term that does not appear in the Privacy Act. In the bill, processing means any activity with respect to a record from creation to erasure to deidentification. The Privacy Act generally uses the term maintain (defined as “includes maintain, collect, use, or disseminate”) for this activity. The new term is more specific, but the meaning of the two terms is essentially the same. The bill uses maintain in its ordinary meaning of continue or support.

An agency designated disclosure is the successor to the Privacy Act’s routine use. Part III of this report discusses the history and general difficulties of controlling disclosures. The first part of the response to those difficulties is a new definition that calls on agencies to provide a bit more specificity when defining external disclosures. Procedural requirements for the adoption of ADDs, which are explained later, are another part of the response.

(9) AGENCY DESIGNATED DISCLOSURE. – The term “agency designated disclosure” means a disclosure by an agency of a record from an agency activity affecting privacy that is –

(A) required or specifically authorized by Federal statute or treaty;

(B) appropriate to carry out the function of the agency activity affecting privacy from which the disclosure is made and for which the record was collected; or

(C) in support of another specified Federal activity or other specified activity

for which the agency can appropriately disclose a record and the disclosure is not inconsistent with the purpose for which the record was collected.

This definition establishes three categories of ADDs. All three categories have the same status and authorize an agency to disclose a record in the same way. The goal is to make each agency determine why it chose to establish an ADD and to share with the public the general reasons for the ADD. When establishing routine uses, an agency typically publishes a justification for the routine use in the original Federal Register notice. The goal here is to make agencies include the specific category of ADD as part of the description. This will assist the reader of the description of an A3P to understand the reasons for the disclosure.

The first type of ADD covers disclosures specifically authorized by Federal statute or treaty. Any disclosure required by statute or treaty can be and must be defined as an ADD. The goal is to continue the practice under the Privacy Act whereby disclosures mandated by other statutes still require a routine use in order to fulfill the notice provision of the Privacy Act. Notice also provides the public with an opportunity to comment on a proposed ADD, which could be overly broad or inconsistent with the authorizing statute or treaty.

A qualifying disclosure is one required or specifically authorized by a statute or treaty. This means that there must be some type of express language about the disclosure in the statute or treaty. For example, 42 U.S.C. § 652(k) provides:

(1) If the Secretary [of HHS] receives a certification by a State agency in accordance with the requirements of section 654(31) of this title that an individual owes arrearages of child support in an amount exceeding $2,500, the Secretary shall transmit such certification to the Secretary of State for action (with respect to denial, revocation, or limitation of passports) pursuant to paragraph (2).^[189]

Because this statute directs the Secretary of HHS to disclose specific information for a specific purpose, it qualifies as a required disclosure. Even if the statute made the disclosure discretionary, it would still meet the test for specifically authorized. A statute must make clear what information or at least what categories of information are disclosable to meet the first standard.

If a statute simply allowed the Secretary to cooperate generally with the State Department regarding passport issuance without specifically discussing record sharing, that statute would not be specific enough to meet the first standard for an agency designated disclosure. A vaguer statute requiring “cooperation” could still meet the third standard of the ADD definition, which allows disclosures in support of another specified Federal activity or other specified activity. The third standard does not require that there be any specificity in a statute regarding the elements of a disclosure or that there be any specific statutory direction at all. A statutory authorization for cooperation is enough to make the disclosure appropriate. The third standard might not be satisfied, however, if the terms of collection said that the information collected may not be used for any other purpose.

It can be challenging for an agency to identify all the potential statutory or treaty authorities that mandate disclosures. This has been an issue at times under the Privacy Act when agencies occasionally overlook disclosure obligations by not including a required routine use. Section (16)(h) of the bill provides that an agency’s failure to identify a statute or treaty requiring or specifically authorizing disclosure of a record in any notice or publication under this Act shall not overcome any requirement or specific authorization to disclose the record as provided in the statute or treaty. This language makes it clear that an agency can make the required disclosure notwithstanding the failure to list the disclosure as an agency designated disclosure. Once an agency discovers the failure to list a required or specifically authorized disclosure, the agency must promptly cure the defect.

The second type of ADD is a disclosure that is “appropriate to carry out the function of the agency activity affecting privacy from which the disclosure is made and for which the record was collected.” A disclosure is appropriate when it is reasonably necessary to achieve efficient and effective implementation of a required or authorized activity and does not create an undue privacy risk. This definition sidesteps the troublesome compatibility standard in existing law in two ways. The disclosure must be appropriate to carry out the function of the A3P and for which the record was collected. This goes a bit beyond the undefined notion of compatibility. A classic illustrative routine use allows an agency to disclose payroll information to the Treasury Department in order to allow Treasury to pay employees. This is a good example of a disclosure that is appropriate to carry out the function of a payroll A3P.

In some ways, this second type of ADD comes close to establishing a purpose test, but purpose is just as troublesome a concept as compatibility. Compatibility as a standard in the United States, at least, has a long history of use, misuse, and avoidance. I chose to leave out an express purpose test for the same reasons that I omitted a compatibility standard. Both terms come with baggage best left behind in the limited context of this class of disclosure, namely carrying out the function of the A3P. A new, albeit somewhat vague, standard (“appropriate”) – a weasel word if you will – is sufficient to provide the needed flexibility and to suggest how to make a judgment.

The notion of appropriateness is admittedly not much more specific than the Privacy Act’s existing compatibility standard. Whether a disclosure is appropriate calls for a judgment. As I concluded in the discussion in Part III of this report about the compatibility problem, there is no word formula that will produce the right result every time. Human judgment is essential, but the judgment should not be that difficult for most of the second class of ADDs. If a disclosure is necessary to carry out the function of an A3P, then it can clearly be defined as an ADD. If a disclosure is not absolutely necessary but would still allow an agency to carry out the function of the A3P in a more effective and efficient manner, then an ADD would still be proper. The notion of appropriateness cannot be stretched indefinitely. There will come a time when the administrative benefit of a non-consensual disclosure is so attenuated that it would not overcome the privacy interest of the data subject. Consider a disclosure to another agency provides only a minor or occasional efficiency to the disclosing agency but exposes the data subject to serious risk of loss of a right, benefit, privilege, or status that would not occur but for the disclosure or that would occur because of the ADD without proper due process procedures that would otherwise be appropriate. An ADD for that disclosure would fall on the wrong side of the appropriateness standard.

The third type of ADD is “in support of another specified Federal activity or other specified activity for which the agency can appropriately disclose a record and the disclosure is not inconsistent with the purpose for which the record was collected.” This class of disclosures requires more balancing of interests and more judgment about the propriety of a disclosure. In contrast, disclosures required by statute or treaty calls for no balancing by an agency because Congress made the balance by mandating the disclosure. Disclosures related to agency function call for an easier balancing because a disclosure related to the function that the agency defined in its A3P.

When can an agency disclose a record for a specified activity of another agency or to a third party for another purpose? A key word in the definition of the third type of ADD is specified. The disclosure must be for a specified federal or other specified activity. An ADD is deficient if it does not state the purpose of the disclosure or identify the activity that the disclosure supports. An ADD that allows a disclosure to another agency without more detail about the specific activity being supported is deficient. On the other hand, an ADD that allows disclosure of a health record to another agency treating the individual who is the data subject of the disclosed record is sufficiently descriptive. There is no obligation to provide more detail than health record. So is an ADD that allows disclosure of a health record to any health care provider treating any patient, a disclosure allowed by the HIPAA health privacy rule. In many cases, a proper description of the supported activity may be short and simple.

The third type of ADD also supports disclosures outside the federal government. The disclosures might be to state or local governments or to private sector organizations. An agency making loans to individuals might decide that reporting the loans and repayment history to a credit bureau is appropriate and not inconsistent with the purpose for which the record about the loan was collected. The propriety of a credit bureau disclosure might vary from loan program to loan program. An agency might choose not to report loans based on status (e.g., disaster loans), that are not related to the borrower’s ability to repay, or that may not require repayment at all under some circumstances.

An agency would, however, be unable to justify sharing PII with a data broker building profiles on consumers or households for use in online advertising or for consumer scoring purposes. It is not appropriate for a federal agency to support those private sector activities without specific statutory direction. Further, because online advertising and consumer scoring bear no relationship to any federal activity, an ADD for those purpose would be inconsistent with the purpose of collection. These limits on disclosure for private sector data activities remain in force even if federal agencies use some private sector data services for their own activities. Only if a private company took the disclosed data and used it exclusively for a federal agency would disclosure be possible. Even then, the activity could only be accomplished in compliance with Section 14 extending coverage of the USA FIPS Act to contractors and others.

The definition for third class of ADDs has a second part. It requires that “the disclosure is not inconsistent with the purpose for which the record was collected.” This brings back the troublesome concept of purpose and narrowly avoids the use of a compatibility test by substituting the notion of consistency. Admittedly, this is not entirely satisfactory. The goal is to establish a somewhat higher standard by which to assess disclosures that do not directly support the function of the agency that processes the PII. The problem, as already discussed, is that it is difficult, if not impossible, to define a standard to unambiguously distinguish between disclosures that should be allowed and those that should not in all the varied circumstances that arise in federal activities. Alternatives considered included a context standard or a reasonable expectation test, but neither provides any clearer direction.

As discussed in Part III of this report, the history of computer matching illustrates the problem. Should the records of one agency be used to find fraud in a wholly unrelated program, perhaps operated by a different level of government? What we learned from computer matching is that this type of disclosure had considerable policy and political support behind it. The Privacy Act of 1974, with its vague compatibility standard, was insufficient to resist the lure of computer matching for long. The USA FIPS Act will stand in a similar ambiguous position. It offers a better basis for arguing about what is appropriate, but it will not compel one result or the other all the time.

The new standard establishes a way for an agency to resist a disclosure for an unrelated activity that it does not want to make. The agency does not need to conclude that a disclosure is affirmatively consistent with the purpose of collection, only that the disclosure is not inconsistent with that purpose. This form of purpose test is intentionally vague. It has a bit more backbone in that it would prevent an ADD from allowing a disclosure that violates the terms of collection, but there is a deliberate degree of vagueness and a need for judgment. An agency that chooses to disclose for an unrelated activity can do so in many instances. It can also refuse to establish an ADD because a proposed disclosure is not in the public interest or in the interest of the agency, data subjects, or federal programs. An agency can determine that the risks of a disclosure (including the risks to privacy) outweigh the benefits of a proposed disclosure. A key factor here is the exercise of human judgment about what is and is not appropriate. Another factor comes from the Principle of Purpose Specification, which becomes especially relevant when an agency considers adding an ADD to an existing A3P. The notion that information should be processed only for the purposes specified at the time of collection is not absolute, but adding new disclosures to an existing A3P needs an especially robust justification.

The existence of an ADD does not mean that an agency must make any disclosure allowed by that ADD. Agencies need to exercise judgments at both the wholesale level (when establishing an ADD) and at the retail level (when actually disclosing a record). An agency can refuse to establish an ADD and it can refuse to make a disclosure allowed by an ADD. Section 6(h) of the proposed bill makes this explicitly clear by providing that, except as otherwise provided by law, nothing in the USA FIPS Act requires an agency to disclose a record to anyone other than the data subject or to a parent, guardian, or other person identified in section (16)(d).

Limits on disclosures via ADDs also come from a set of new procedural requirements. The bill requires that an agency go through full notice and comment rulemaking before adopting an ADD. In addition, section (6)(f) of the bill adds several noteworthy procedural requirements explained later in this report.

In some cases, a single disclosure will fall in more than one category. A disclosure may be required or specifically authorized by law and in support of an agency activity. When more than one category applies, an agency can identify the designated disclosure as meeting both criteria.

(10) AGENCY. –The term “agency” means an agency as defined in section 552(f) of title 5, United States Code, and the Government Accountability Office, the Library of Congress, the Administrative Office of the United States Courts, the Government Printing Office, and the Smithsonian Institution.

The definition of agency is the same as the definition in the Freedom of Information Act, with several additions. Decades ago, I advocated extending the FOIA and the Privacy Act to include the Government Accountability Office, the Library of Congress, the Administrative Office of the United States Courts, the Government Printing Office, and the Smithsonian Institution. This bill seeks to accomplish that objective. Note that federal funds make up a large part of the Smithsonian’s budget. For the most part, extending privacy law to these new agencies will primarily benefit their employees of those agencies.

Existing law apparently allows each agency to determine the scope of what constitutes the agency. OMB cited legislative history from the 1974 Act to suggest that an agency within an agency was not the intention of the Congress.^[190] In theory, however, offices, units, and subdivisions of an agency might be treated as separate agencies for purposes of the Privacy Act of 1974. The scope of an agency’s definition of agency matters because of the ease with which an agency can use information within its own borders. Section (6)(a) of the USA FIPS Act continues the policy from the Privacy Act that allows use of a record by officers and employees of the agency who have a need for the record in the performance of their duties.

The intent here is to allow each agency the discretion to determine if all agency components are part of the agency. The expectation is that agencies will likely follow current practice and apply a unitary definition that includes all agency components. However, the possibility remains that there may be a reason for an agency to treat some components as separate agencies, and nothing in the USA FIPS Act prevents an agency from exercising that choice.^[191]

(11) CLASSIFIED INFORMATION. – The term “classified information” means any information (1) specifically authorized under criteria established by an Executive order to be kept secret in the interest of national defense or foreign policy; and (2) in fact properly classified pursuant to the Executive order.

The definition of classified information is identical to the definition in the Freedom of Information Act.

(12) MATCHING PROGRAM. – The term “matching program” –

(A) means any automated comparison or other activity that involves the disclosure of –

(i) records processed in two or more two agency activities affecting privacy or from an agency activity affecting privacy with non-Federal agency records for the purpose of –

(I) establishing or verifying the eligibility of, or continuing compliance with statutory and regulatory requirements by, applicants for, recipients or beneficiaries of, participants in, or providers of services with respect to, cash or in-kind assistance or payments under Federal benefit programs, or

(II) recouping payments or delinquent debts under Federal benefit programs, or

(ii) Federal personnel or payroll records from two or more agency activities affecting privacy or from an agency activity affecting privacy with non-Federal agency records; but

(B) does not include –

(i) matches performed to support any research, statistical, or other activity, if the results of the matching are not intended to be used and are not used to make decisions concerning the rights, benefits, privileges, or status of specific individuals or to take any adverse financial, personnel, disciplinary, or other adverse action against Federal personnel;

(ii) matches performed, by an agency (or component thereof) which performs as its principal function any activity pertaining to the enforcement of criminal laws, subsequent to the initiation of a specific criminal or civil law enforcement investigation of a named person or persons for the purpose of gathering evidence against the person or persons;

(iii) matches of tax information pursuant to the Internal Revenue Code of 1986 or for the purpose of intercepting a tax refund due an individual under authority granted by statute;

(iv) matches performed for foreign counterintelligence purposes or to produce background checks for security clearances of Federal personnel or Federal contractor personnel; or

(v) matches performed pursuant to section 202(x)(3) or 1611(e)(1) of the Social Security Act (42 U.S.C. 402(x)(3), 1382(e)(1)).

(13) RECIPIENT AGENCY. – The term “recipient agency” means any agency, or contractor thereof, receiving records processed as part of an agency activity affecting privacy of a source agency for use in a matching program.

(14) NON-FEDERAL AGENCY. – The term “non-Federal agency” means any State or local government, or agency thereof, that receives records processed as part of an agency activity affecting privacy from a source agency for use in a matching program.

(15) SOURCE AGENCY. – The term “source agency” means any (A) agency that discloses records processed as part of an agency activity affecting privacy to be used in a matching program, or (B) State or local government, or agency thereof, that discloses records to be used in a matching program.

(16) FEDERAL BENEFIT PROGRAM. – The term “Federal benefit program” means any program administered or funded by the Federal Government, or by any agent or State on behalf of the Federal Government, providing cash, payments, grants, loans, loan guarantees, or other forms of in-kind assistance to individuals.

(17) FEDERAL PERSONNEL. – The term personnel” means officers and employees of the Government of the United States, members of the uniformed services (including members of the Reserve Components), and individuals entitled to receive immediate or deferred retirement benefits under any retirement program of the Government of the United States (including survivor benefits).

These terms all relevant to computer matching were added to the Privacy Act by the 1988 Computer Matching Amendments and remain largely unchanged. There are some changes to conform to the new term processing. The definition of matching program consolidates some exceptions. All IRS exceptions are now included in Paragraph (12)(b)(iii).^[192]

I omitted the existing exemption for matches performed by HHS or by the IG at HHS relating to fraud, waste, and abuse. It was matching activity by the IG at HHS that started the controversy over computer matching that ultimately resulted in the Computer Matching Amendments. There is no continuing reason for an exemption for matching activities at HHS.

(a) RELEVANT AND NECESSARY. – Each agency shall process only personally identifiable information that is relevant and necessary to accomplish a purpose of the agency required to be accomplished by law or executive order of the President.

This provision is substantially identical to paragraph (e)(1) of the Privacy Act of 1974, with only a few minor changes in wording.

(b) DIRECT COLLECTION. – Each agency shall collect personally identifiable information to the extent practicable directly from the data subject when the personally identifiable information may result in adverse determinations about the data subject’s rights, benefits, privileges, or status under Federal programs.

This provision is similar in wording and purpose to paragraph (e)(2) of the Privacy Act. It adds the word status to the Privacy Act’s standard phrase of “rights, benefits, and privileges.” Status clarifies and modestly broadens that standard phrase. It may include employment status, immigration status, health status, or other elements associated with a data subject or a data subject’s PII. For example, an individual’s health status may determine how a government program treats that individual, and that determination may not line up precisely with a right, benefit, or privilege.

While both existing law and the USA FIPS Act show a preference for direct collection of PII from data subjects, that preference can be overcome for reasonable cause. An individual may not be the best or most reliable source of the individual’s health information. It may be entirely appropriate to look to a health record to determine with assurance a patient’s diagnosis or test result. In the case of criminal investigations, the subject of the investigation may not be either a reliable or an appropriate source. Further, asking that subject for information may reveal the existence of the investigation prematurely. When considering a hiring decision or awarding a grant, an agency may properly choose to ask others to assist in the evaluation of an individual.^[193] In short, the preference for direct collection will be readily overcome for some government activities. Administrative convenience of the government alone is not likely to qualify as a reasonable basis for avoiding direct collection. In addition, when considering the use of records from commercial data providers, an agency should take into account the accuracy, currency, and reliability of those records for agency’s purpose.

(c) NOTICE. – Each agency shall, in writing or otherwise and in understandable language, inform each data subject whom it asks to supply personally identifiable information, at the time of collection and in a manner that allows the data subject to obtain or retain a copy, of the following:

(1) the authority for the collection;

(2) the principal purpose or purposes for which the personally identifiable information will be used;

(3) the agency designated disclosures that may be made of the personally identifiable information; and

(4) whether the data subject is required by law to supply the personally identifiable information and the consequences of not providing all or any part of the personally identifiable information.

This provision derives from paragraph (e)(3) of the Privacy Act. The USA FIPS Act proposes modest changes. It drops the requirement that the notice appear on a “form” used to collect information. Instead, the requirement is to inform a data subject at the time of collection and to allow the data subject to keep a copy of the notice. For online collection, providing the capability for the individual to read and then to print, email, or otherwise save the information will satisfy the requirement. Verbal collections raise difficulties with conveying the content of privacy notices, but verbal collection is unavoidable at times. Agencies can still find a way to provide effective notice. A summary of key information and either sending data subjects to a website for more details or offering to mail a notice should work in most or all cases. The new phrase – understandable language – emphasizes the goal that notices should be clear.^[194]

The requirement to identify the authority for the collection is the same as existing law, but the proposed bill uses fewer words. Existing law says in a parenthetical “whether granted by statute, or by executive order of the President.” I dropped this language as superfluous. An agency must still identify the statute, regulation, executive order, or other authority for collection just as it must now.

The principal purpose language is the same as existing law.

The requirement to identify agency-designated disclosures is comparable to the existing provision that requires disclosure of routine uses.

Finally, the existing provision requires disclosure of “the effects on him, if any, of not providing all or any part of the requested information.” Another part of the same existing paragraph says that the agency must state “whether disclosure of such information is mandatory or voluntary.” Together, these two requirements created much confusion, particularly over what mandatory and voluntary mean. Is disclosure mandatory if the consequence of not disclosing means that an individual will not qualify for a benefit or will go to prison? Rather than try to answer these questions, the new requirement says more clearly that the agency must tell the data subject if the disclosure is required by law and the consequences of not providing all or part of the PII requested. This language should clear up the confusion engendered by the current disclosure requirement. The words mandatory and voluntary do not appear.^[195]

(d) DETERMINATIONS. – Each agency shall process records used by the agency in making any determination about a data subject with sufficient accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the data subject in the determination.

This paragraph derives from paragraph (e)(5) of the Privacy Act. It is identical except for the substitution of process for maintain. The four identified elements (accuracy, relevance, timeliness, and completeness) still place appropriate boundaries on federal agency processing of records containing PII.

(e) DISCLOSURE. – Prior to disclosing any personally identifiable information to any person other than an agency, unless the dissemination is made pursuant to section 552, title 5, United States Code, each agency shall make reasonable efforts to assure that the personally identifiable information is accurate, complete, timely, and relevant for agency purposes.

This paragraph derives from paragraph (e)(6) of the Privacy Act. It is substantially identical, except for minor language changes.

The standard here that the information be accurate, complete, timely, and relevant for agency purposes, was the topic of some discussion. I proposed changing the standard so that the disclosure would be accurate, complete, timely, and relevant for the purpose of the disclosure. This proposal received substantial pushback. The difficulty here relates to the type of judgment an agency must make. The argument was that an agency can assess the quality of its information for its own purposes. However, requiring the agency to make judgments about the purpose of a disclosure calls for an entirely different type of evaluation. One agency may not be able to determine whether information meets the needs of the recipient. Trying to make that type of judgment could call for an extended inquiry and potential liability by the disclosing agency. Determining the relevance of PII for use by another person (e.g., a court or a physician) is both too hard and beyond the capability of an agency. As a result, I left the standard as it is in the Privacy Act.

(f) FIRST AMENDMENT. – No agency shall process a record describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute, or by the individual, or unless pertinent to and within the scope of an authorized law enforcement activity.

This paragraph derives from paragraph (e)(7) of the Privacy Act. It is substantially identical, except for the substitution of process for maintain. This restriction on agency activity remains one of the most important civil liberties protections in the Privacy Act and in the USA FIPS Act.

(g) Legal Process. – Each agency shall make reasonable efforts to serve notice on a data subject when any personally identifiable information about the data subject is made available to any person under compulsory legal process when the process becomes a matter of public record.

This paragraph derives from paragraph (e)(8) of the Privacy Act. It is substantially identical, except for minor language substitution.

(h) SAFEGUARDS. – Each agency shall, consistent with the requirements in subchapter II of chapter 35 of title 44, United States Code, establish appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity that could result in substantial harm, embarrassment, inconvenience, or unfairness to any data subject.

This paragraph derives from paragraph (e)(10) of the Privacy Act. The new language is substantially the same as the existing provision. It establishes the same requirement for appropriate administrative, technical, and physical safeguards, a phrase later used commonly elsewhere to describe the scope of security safeguards.^[196] The reference to Subchapter II of chapter 35 of title 44, United States Code makes it clear that the safeguards requirement in the USA FIPS Act is not a new or different information security standard than the one that exists in current law. Security remains an important element of fair information practices, but establishing security standards can and should be done in other legislation, regulation, and guidance.

(a) SCOPE. – Each agency shall determine the scope of each agency activity affecting privacy so as to reflect accurately its processing of records and to do so in a manner that supports public understanding of agency operations.

The bill gives agencies broad discretion to determine the scope of each A3P. The basic requirements are that records should be organized and described in a way that (1) accurately reflects the way that the agency processes the records, and (2) does so in a manner that supports public understanding of agency operations. Under these broad standards, agencies have considerable discretion to make choices. The old retrievability standard is irrelevant as it makes little sense for today’s digital records and diversity of storage mechanisms (including cloud storage).

A large agency may decide to establish multiple A3Ps for its human resources records. Records that reflect hiring may be in one A3P; payroll records may be in another A3P; health insurance and other benefit records may be in a third A3P. The choice might reflect the way that the agency organizes its HR functions, with an A3P for each office that manages an aspect of its overall HR operations. A small agency may choose to define all its HR functions in a single A3P. Even though the goals and the contents of both agency HR operations are the same, different approaches are permissible under the Act when they make sense for the agency.

(b) GUIDANCE. –The Director of the Office of Management and Budget shall issue guidance to agencies about determining the scope of an agency activity affecting privacy. The guidance shall advise agencies how to address these goals to the extent practicable:

(1) the goal of grouping activities with similar or related purposes within the same agency activity affecting privacy;

(2) the goal of grouping activities based on similar authority within the same agency activity affecting privacy;

(3) the goal of keeping records eligible for exemptions separate from non-exempt activities; and

(4) the goal of defining agency activities affecting privacy so that agency designated disclosures do not apply to records unnecessarily.

An early draft of the USA FIPS Act included goals for agencies when defining A3Ps. In the end, it seemed a better approach to define the goals but to leave it to OMB to provide guidance to agencies. The role of OMB is to provide general guidance and to try to keep the agencies properly focused, particularly with an eye on making A3Ps more understandable to the public. There are four general goals:

The first goal seeks to group together activities with similar or related purposes within the same agency activity affecting privacy. An agency program may have records organized in a variety of ways. Under the Privacy Act, some program records might be systems of record on their own and some not. Records maintained in different offices (perhaps field and headquarters) might be in different systems. The first goal suggests that agencies may treat all the records for the same program or function (“similar or related purposes”) in one A3P if that structure works for the agency. It is a goal, as are all the other goals, and not a requirement.

A second goal seeks to group together activities based on similar authority within the same agency activity affecting privacy. An agency may have different statutory authorities for different parts of the same function. For example, the IRS has authority for routine tax collection activities under one or more statutes. Tax enforcement authority may derive from different statutes and may be conducted by different offices within the IRS. IRS could choose to define separate A3Ps for collection and for enforcement even though both may relate to personal income taxes.

A third goal seeks to keep records eligible for exemptions separate from non-exempt activities. The objective here is to avoid the application of exemptions to records that are not eligible for the exemptions. For example, the draft bill provides exemptions from some parts of the Act for investigatory materials compiled for the purpose of determining eligibility for employment. It might be appropriate for an agency to keep those records in a separate A3P so that the application of exemptions is simpler and easier for the public to understand. For a large agency that has a separate office conducting employment eligibility review, a separate A3P might be workable. The same approach might more troublesome for a small agency with fewer personnel.

The fourth goal seeks to define agency activities affecting privacy so that agency designated disclosures do not apply to records unnecessarily. One of the consequences of large A3Ps that have large numbers of ADDs is that it may appear to both agency personnel and to the public that all ADDs apply to all records in the A3P. Narrowing the application of ADDs to circumstances where they are necessary and not applying ADDs to records where they are unnecessary makes sense and is an important objective. For example, an agency may have an A3P for managing its employee parking permits. This function would likely need only a few ADDs. By contrast, an A3P for all HR records would likely need many ADDs because general payroll and personnel functions require the disclosure of more records for different purposes. If parking and HR records are all in the same A3P, then there will be many ADDs that seemingly apply to records and functions for which disclosures are not actually necessary. Separate A3Ps would result in more precise and limited availability of ADDs.

As may be apparent from the examples, the goals here may not all be fully attainable at the same time. One goal may suggest that a single A3P is better, while the other goal suggests that multiple A3Ps will produce more precise applicable of privacy objectives. Addressing multiple conflicting and overlapping goals is not anything new for agencies.

In the case of the fourth goal’s objective in more precise application of ADDs, other methods may help just as well. An agency may define a large A3P with multiple functions managed by the same office but may provide expressly that an ADD allowing disclosure of the name of a parking permit holder to a tow truck operator applies only to records that identify the name, address, and phone number of a car owner and that other ADDs for other functions of that office apply to specific functions and records and do not apply to parking activities and records.

In resolving the different goals for the same records, one agency may reach one approach and another may choose a different approach. Agency discretion is intentionally broad, but it is not entirely unlimited. For example, it would almost certainly be inappropriate for an agency to define all of its functions in a single A3P.^[198]

The Privacy Act of 1974 sets out in (e)(4) the requirements for publishing a notice about a system of records. Subsection (c) of section 5 sets out similar obligations for notices about A3Ps with some changes from existing law. The discussion below highlights noteworthy differences.

(c) DESCRIPTION. – For each agency activity affecting privacy, an agency shall prepare and maintain a description that shall include –

(1) the name of the activity, the scope of the activity, each principal substantive purpose that the activity supports, and the authority for the activity, including any related information collection requests approved under the Paperwork Reduction Act;

(2) the name of the agency component primarily responsible for the activity, the principal postal, electronic mail, and website addresses of that component, and the name of other agency components that significantly participate in the activity;

(3) the categories of data subjects about whom records are processed as part of the activity;

(4) the categories of records processed in the activity;

(5) the principal information technologies employed, including any novel or innovative applications of technology; any automated decision making; any processing of records using artificial intelligence; any algorithmic development, analysis, or application; or any similar activities with the potential to affect the rights or interests of data subjects;

(6) each agency designated disclosure applicable to records processed as part of the activity, including a good faith effort to list agency designated disclosures in the approximate order in which they are likely to be used, with the most used disclosure listed first;

(7) the categories of sources of records in the activity, including any commercial, governmental, or other sources that the agency routinely reviews, consults, or otherwise uses to carry out the activity;

(8) the policies and practices of the agency regarding storage, retrievability, access controls, retention, and disposal of records in the activity, including the name and location of records disposal schedules covering any of the records;

(9) the location of the agency website and of the agency’s rules where an individual can learn how to exercise rights available under this Act;

(10) whether the activity is likely to include any records subject to an exemption in section 12 of this Act; describing the reasons exempt records may be included; and describing how the exemption affects any rights available under this Act;

(11) the date the description was most recently published or amended; and

(12) a reference where the agency publishes any personally identifiable information processing diagram for the activity and any publicly available privacy impact assessment conducted by the agency relevant to the activity.

Paragraph (1) of subsection (c) requires, among other things, that the description include each principal substantive purpose that the A3P supports. There is no existing requirement in the Privacy Act to include a purpose description in a system of record notice, but many agencies do so today. The practice developed over time, and it is a valuable addition to the description. The same is true for a description of the authority for the activity.^[199] Another new addition is any information collection requests approved under the Paperwork Reduction Act and that relate to the A3P. The objective with the PRA information is to link together for the convenience of the public some of the disparate information management requirements.

Paragraph (2) modernizes the required information that informs a member of the public how to contact the agency component responsible for the A3P. The new provision does not include the existing requirement to include the title and business address of the agency official responsible for the system of records. The notion that a single official will be responsible for an A3P may be obsolete, and in any event, it is too changeable to remain as a part of a Federal Register publication. An agency can provide additional details as it chooses on its privacy website.

Paragraphs (3) and (4) are the same as existing law with only changes in terminology.

Paragraph (5) is new. It calls for a description of information technologies employed. The purpose here is to make agencies inform the public if the agency processes records using artificial intelligence, algorithms, or similar types of information technology with the potential to affect the rights or interests of data subjects. OMB may choose to provide additional guidance here to keep current over time the types of information technology that agencies should describe here.

Paragraph (6) is comparable to the existing requirement to include each routine use. A new feature here is a good faith obligation to list each agency designated disclosure in the approximate order in which they are likely to be used, with the most used disclosure listed first. The goal is to make the A3P notice more useful to the reader. Many existing SORNs have large numbers of routine uses, some of which are rarely used. By directing agencies to list ADDs in the likely order or use, readers receive the most useful information first. Agencies need not audit or record how they employ ADDs for the purpose of ordering the list. Determining the proper order necessarily calls for a judgment by the agency. Ordinarily, an agency will not be expected to republish a notice solely to adjust the order of its ADDs, but when it has another reason to republish, it may reorder the ADDs based on more recent information. If an agency chooses to categorize ADDs in classes (e.g., one set of ADDs within the same A3P for function X and another set for function Y), the agency may order the ADDs separately as appropriate to each function. An agency may choose to have a category of rarely used ADDs at the end of its list.

The definition of ADD sets out three categories of ADD. The description of an ADD in the A3P notice must identify the category applicable to each ADD. This might be accomplished through a parenthetical that identifies the category. As previously discussed, more than one of the three categories may apply at the same time.

Paragraph (7) expands upon the existing requirement to describe the categories of sources of records in the system. New language makes it explicit that sources include commercial, governmental, and other sources that the agency routinely reviews, consults, or uses. It is especially important for agencies to inform the public when using commercial sources. For example, if an agency has a contract with a consumer reporting agency (“credit bureau”) to use credit records, it must so state. If there is a reasonable prospect that the particular source may change but not the category of sources, the agency may choose to identify the category (e.g., “credit bureau”) rather than identifying which specific credit bureau it uses. If an agency routinely uses Internet search engines to find information on individuals, it must so state. If an agency routinely seeks information from social media, the agency should identify at least the major social media used. All the information about sources will help individuals figure out how particular information about them ended up in agency records. This is especially important when the agency uses the information to make decisions about individuals. It is even more important if an agency consults but does not retain a copy of information held by a third party.

Paragraph (8) is comparable to an existing requirement, but it adds the requirement to include the name and location of relevant records disposal schedules. Agencies should have this information readily at hand, and including it in the A3P notice will be a convenience to the reader. This is another modest attempt to knit together for the public some of the information management requirements for federal agencies.

Paragraph (9) replaces the current obligation to explain agency rules for access and amendment. Rather than include substantially the same information in each notice, paragraph (9) requires that an agency provide a cite to the agency rules that explains an individual’s rights.

Paragraph (10) is entirely new. The USA FIPS Act takes a new approach to exemptions. Section 12 of the Act describes the exemptions, which are generally available to agencies that maintain qualifying information. Under the Privacy Act, an agency seeking to apply most of the Act’s exemptions must go through a rulemaking. The USA FIPS Act drops the separate rulemaking for exemptions. When an agency publishes a notice of an A3P, the notice itself must go through full public notice and comment. This provides the public with an opportunity to comment on the use and scope of exemptions. Paragraph (10) tells the agency to state whether the A3P is likely to include any exempt records, to describe the reasons for the exemption, and to describe how the exemption affects rights under the Act. The discussion of Section 12 below includes more about the exemptions.

Consider when an agency has a large A3P consolidating multiple functions belonging to a single office. If some of those functions may have exempt records, the description can identify those records and functions that may qualify for exempt status. Just as importantly, the description can identify those records and functions that are not likely to qualify for or need any exemption.

It would be inappropriate for an agency’s notice to “claim” all theoretical exemptions for every A3P just on the off chance that one might be appropriate someday under a remote contingency. In most cases, it should not be difficult to predict whether an agency activity will include any exempt records. For many A3Ps, it will likely be clear that the activity will never have exempt records at all. For cases in which an exempt record unexpectedly ends up as part of an agency activity affecting privacy, the failure to identify the possibility of an exemption in the description is not fatal. The agency can still claim the exemption. The agency can also cure the notice defect later if it decides that the issue is likely to recur and is not just a one-off matter.

Paragraph (11) is new. It requires that each A3P description include the date of the most recent publication or amendment. Under the Privacy Act of 1974, agencies sometimes waited years or decades before reviewing and updating systems of records. There was no simple way to find out how old a SORN was. With the new requirement, each description of an A3P will essentially tell the reader how old the description is. This may provide a clue about the currency of the description.

Paragraph (12) is also new. Section (9)(d) of the USA FIPS Act requires, to the extent practicable, the Chief Privacy Officer to maintain a personally identifiable information processing diagram or equivalent for each major A3P. Section 11 of the Act requires agencies to undertake privacy impact assessments for A3Ps. There is more discussion of the personally identifiable information processing diagram and privacy impact assessment requirements later in this document. Paragraph (12) requires that an A3P description provide a reference to any available personally identifiable information processing diagram and to any available privacy impact assessment. An agency may provide that reference at the time of publication of the A3P description. If the agency finalizes an A3P description before either document is available, it may publish a link to agency website where the documents will appear when available or when amended. An agency does not have to republish an A3P description solely to update a link to a personally identifiable information processing diagram or privacy impact assessment.

Section (e)(4) of the Privacy Act of 1974 requires agencies to publish notices in the Federal Register when establishing or revising a system of records. Section (e)(11) requires 30 days advance notice of routine uses. The original OMB guidelines state that these publication requirements are “designed to supplant the informal rule-making provisions of 5 U.S.C. 553” but that the accommodation of the public comments in the judicial review of the rule-making exercise was intended wherever practicable.”^[200]

(d) PUBLICATION. – An agency shall publish the following notices, including the description of each agency activity affecting privacy prepared as provided in subsection (c) –

(1) For the initial publication of a description of an agency activity affecting privacy, the agency shall publish a complete notice in the Federal Register as provided in section 553(b) and (c) of title 5, United States Code.

(2) For any material change in an agency activity affecting privacy, including a new or modified purpose or agency designated disclosure, the agency shall –

(A) publish a notice of the proposed change in the activity in the Federal Register as provided in section 553(b) and (c) of title 5, United States Code;

(B) provide, either as part of the Federal Register notice or on the agency’s website, the full text of the description of the activity clearly identifying the proposed change; and

(C) if the agency only provides the full text of the description on its website, make the full text available on or before the date when the public comment period begins.

(3) For a non-material change in an agency activity affecting privacy or in an agency designated disclosure, the agency shall publish a notice describing the change in the Federal Register and provide on its website the full text of the revised description of the agency activity affecting privacy that clearly identifies the proposed change.

The USA FIPS Act makes notice-and-comment rulemaking a requirement for initial publication of an A3P, for material changes, including new or modified purposes and ADDs. The purpose is to give the public a clearer opportunity to participate in agency decisions about A3Ps and ADDs, including the possibility of judicial review.

Paragraph (d)(2) includes a requirement that agencies publish the full text of an A3P description for any material change. For material changes, an agency has the option of publishing the full text in the Federal Register or of publishing a description of the change in the Federal Register with the full text on its website. Full notice-and-comment requirements still attach if an agency selects the website publication option.

For non-material changes, an agency must publish a summary Federal Register notice with the full text on its website. No notice-and-comment obligation attaches to non-material changes. Publication in part on an agency website may reduce the publication burden on agencies slightly.

(e) FULL TEXT REQUIRED. – In any published description or proposed modification of an agency activity affecting privacy or agency designated disclosure, an agency shall include the full text of each agency activity affecting privacy or each agency designated disclosure and not by reference to another document.

Under the Privacy Act, agencies sometimes only publish the changed words of an existing SORN with little context. In order to piece together multiple changes to a SORN, a researcher may find it necessary to look through a series of Federal Register publication over many years. The USA FIPS Act expressly prohibits this practice of cut-and-paste amendments. An agency must, for all material changes, republish the full text of an A3P notice and must indicate the proposed change. The full text must appear wherever (Federal Register or website) the agency chooses to publish the text of the description as allowed by this subsection. A provision in section 16(g)(2) requires an agency to maintain a full ten-year history of all changes to each A3P description. These new requirements will enable the public to trace the history of changes more easily.

Another consequence of the full text requirement is to ban the use of generally applicable or blanket ADDs applicable automatically to all agency A3Ps. Each ADD must be adopted for each relevant agency activity affecting privacy through the notice and comment process. Blanket routine uses create confusion for both the public and for agency personnel. Often, neither is aware that blanket routine uses exist or apply. The practice of blanket routine uses sometimes results in the application of inappropriate routine uses to new systems of records. By requiring agencies to list each ADD in the published description of an A3P, the relevance and necessity of each ADD should be reviewed and only those ADDs that are justified should be included.

(f) JOINT AGENCY ACTIVITIES AFFECTING PRIVACY. – The Director of the Office of Management and Budget shall issue guidance covering any agency activity affecting privacy operated by one agency on behalf of one or more other agencies or for which more than one agency has a responsibility. The guidelines shall prescribe how the requirements of this Act shall be allocated among the agencies involved and how the duties imposed by this Act shall be carried out.

The original Privacy Act did not expressly provide for systems of records that involve more than one agency. Government-wide SORNs evolved quickly because some government records do not fit into the Act’s model whereby one agency fully controls one system of records. For example, the Office of Personnel Management identifies three types of SORNs overall. The first type is internal, which are records owned and controlled entirely by OPM. The second type is government-wide, which are records for which OPM writes the policy and has some degree of control but does not have physical custody as a matter of necessity (e.g., general personnel records). The third type is central, which have records for which OPM writes the policy and actually has physical custody (e.g., retirement records). Federal agencies may maintain copies.^[201] The OPM categories are useful, and there may be other types of joint-agency SORNs.

The Federal Privacy Council defines a government-wide system of records as “a system of records where one agency has regulatory authority over records in the custody of multiple agencies, and the agency with regulatory authority publishes a SORN that applies to all of the records regardless of their custodial location.”^[202] The Council also maintains a list of government-wide SORNs, which the website notes may not be complete.^[203] The list shows that at least ten agencies have authority over one or more government-wide SORNs.

Joint agency activities affecting privacy create issues that are hard to address in legislation. Essentially, addressing them would take many words, and there is a reasonable chance that the legislation might fail to cover all current types as well as those that may develop in the future. Subsection (f) gives OMB authority to issue guidance for any A3P operated by one agency on behalf of one or more other agencies or for which more than one agency has a responsibility. Current practice may be adequate to meet the need, but OMB has the ability to issue any guidance for government-wide-SORNs or any other aspect of the USA FIPS Act that needs attention in this context. OMB guidance can address the allocation of responsibilities among all agencies involved in a government-wide A3P, including who handles publication of notices and descriptions, and who responds to requests for access and amendment. However, OMB cannot waive or change any requirement of the USA FIPS Act for jointly maintained A3Ps.

(a) USE. – An agency may allow those officers and employees of the agency who have a need for a record from an agency activity affecting privacy to use the record in the performance of their duties. Nothing in this paragraph expands or reduces the ability of an agency to –

(1) use or withhold from use a record as otherwise provided by statute; or

(2) withhold a record used for one agency function from another agency function.

As explained above, the USA FIPS Act defines use and disclosure to conform to current terminology in the privacy world generally. Uses are internal to an agency.

The new provision for uses is similar to existing law in that both allow access to records by officers and employees of the agency maintaining the A3P who have a need for the record in the performance of their duties. The authority for uses is broad, and it is hard to assess how agencies actually implement existing authority. The Privacy Act only requires a history of disclosures and not of uses. Further, the Act does not require agencies to define and publish internal uses in contrast to the requirement for specifically identifying external disclosures (routine uses). Whether agencies treat the need for the record in the performance of their duties standard as a serious standard is not known. There is evidence of abuse of the standard for external disclosures (compatible with the purpose for which [a record] was collected), and it is likely that there is little actual enforcement of the need for the record standard. The Privacy Act did not provide for any agency oversight of internal uses.

The Privacy Protection Study Commission discussed this problem and proposed routine uses for both internal and external uses and disclosures.^[204] That idea attracted little interest at the time or since. Defining external disclosures remains a challenging task, and adding any requirement that would oblige agencies to identify and define internal uses for all records would be even more challenging. I chose not to include that idea in the bill, despite support for it from some quarters. A requirement to define in advance all internal uses would be difficult to implement and would result in a huge list of uses. However, concerns remain that internal agency transfers of records may significantly intrude on privacy interests of data subjects.

In the end, the draft continues to leave it to agencies to control their own internal data sharing activities using their existing authority. The presence in each agency of a Chief Privacy Officer provides an opportunity for some oversight of uses. An office within an agency that does not want to share records with another office in that agency may take a dispute to the agency CPO for an independent review. This is another area where a process offers the prospect of controlling an activity for which no specific substantive standard is available. Internal rivalries may provide some unwitting privacy protections.

Paragraphs (1) and (2) are new and underscore that internal limits on data sharing are appropriate. The first paragraph clarifies that the authority to allow internal uses does not expand or reduce the ability of an agency to use or withhold from use a record as otherwise provided by statute. For example, a statute may allow an agency to use a record for one function but not for another. The second clarifies that an agency may withhold a record used for one function from another agency function. In both cases, the point is that the authority in the USA FIPS Act does not affect in any way how an agency may allow or limit uses of records as provided by statute or as the agency deems proper. Some uses of records technically allowable under the general authority of subsection (a) may still be inappropriate or may violate other policy objectives. Given that many large agencies have multiple disparate functions under one roof, this clarification about an agency’s ability to cabin use of some records is valuable.

Occasionally, an agency issued a routine use that authorizes an internal use, such as to the Inspector General of the agency. These routine uses are improper under the Privacy Act because they are not external disclosures. Access to records by an agency’s Inspector General of a record processed by the agency is a use, not a disclosure. No routine use is appropriate under the Privacy Act, nor is an ADD proper under the USA FIPS Act. Nothing in the USA FIPS Act changes the authority of an Inspector General to access records of the agency it serves.

(b) DISCLOSURE. – No agency shall disclose any record by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the data subject, unless disclosure of the record is otherwise allowed under this section.

This language is substantially the same as existing law. Any agency seeking to disclose a record to any person outside the agency must find the authority for the disclosure somewhere in the USA FIPS Act. Even when another statute requires or authorizes a disclosure, an agency must still comply with the procedural requirement in the Act in order to justify the disclosure.

(c) AGENCY DESIGNATED DISCLOSURE. – An agency may disclose a record if the disclosure is for an agency designated disclosure adopted by the agency pursuant to section 5.

The language is the approximate equivalent of the routine use disclosure provision in the Privacy Act in subsection (b)(3).

(d) ALLOWABLE DISCLOSURES. – An agency may disclose a record if the disclosure is the following:

Existing law sets out twelve conditions of disclosure that allow an agency to disclose a record from any system of records without the need to publish a routine use. One paragraph in subsection (b) of the Privacy Act covers internal uses, which the USA FIPS Act treats in a different subsection. One of the existing paragraphs covers routine uses, disclosures now covered by subparagraph (c) as agency designated disclosures. That leave ten disclosures applicable to all systems of record. Some describe these disclosures as statutory routine uses. The USA FIPS Act has thirteen equivalent types of disclosure authorized for all A3Ps.

It was a difficult decision to choose which disclosures to include in the statute as allowable disclosures for all A3Ps. The draft bill includes some existing disclosures as they are and modifies some others. A few are entirely new. The draft does not include some standard disclosures used in nearly all SORNs today. An example is disclosure to the Department of Justice for litigation involving agencies. In some cases, the decision to leave a disclosure off the list of allowable disclosures turned on small factors. A larger factor was the relative ease of adding ADDs to A3Ps as compared to amending the law.

(1) REQUIRED BY FOIA. – The disclosure is required under section 552 of title 5, United States Code.

Paragraph (1) of subsection (d) covers disclosures required under the Freedom of Information Act. This is existing law, and the result is to leave the relationship between the FOIA and the USA FIPS Act just as the relationship between the FOIA and the Privacy Act. If PII must be disclosed to a requestor (other than the data subject) under the FOIA, then disclosure under the USA FIPS Act is permissible. The public interest in balancing public and private interests in the disclosure of personally identifiable information remains unchanged.

(2) STATISTICAL AGENCY DISCLOSURE. – The disclosure is to a statistical agency or unit for statistical purposes, as those terms are defined in section 3561 of title 44, United States Code, and subject to the provisions, including the limits on use and disclosure, of section 3572 of title 44, United States Code.

Paragraph (2) replaces the existing provision allowing disclosure to the Bureau of the Census. The existing provision is too narrow because there are many other statistical agencies or components with functions comparable to the Census Bureau and that have similar privacy limitations on the use and disclosure of information they obtain for statistical purposes. The draft effectively acknowledges the changes made to statistical law and policy by the Foundations for Evidence-Based Policymaking Act of 2018.^[205] Existing statutory prohibitions^[206] against using data collected for statistical purposes for other purposes provide sufficient protections to individuals to warrant striking the balance here in favor of allowing statistical activities that provide broad public benefits.

(3) ARCHIVES DISCLOSURE. – The disclosure is to the National Archives and Records Administration –

(A) for a record that has sufficient historical or other value to warrant its continued preservation by the United States Government;

(B) for evaluation by the Archivist of the United States or the designee of the Archivist to determine whether the record has that value; or

(C) pursuant to a records management inspection as provided in chapter 29 of title 44, United States Code.

Paragraph (3) expands upon an existing provision that allows disclosure to the National Archives and Records Administration for assessment of historical value and for preservation. The new provision allows disclosure for the same functions. In addition, the new provision also covers disclosure for a records management inspection. The latter disclosure is a routine use found commonly in most SORNs.

(4) REQUEST FROM LAW ENFORCEMENT AGENCY. – The disclosure is to another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality made a written request to the agency that processes the record specifying the particular portion desired and the law enforcement activity for which the record is sought.

Paragraph (4) continues, almost verbatim, the existing provision that allows an agency to disclose a record to any agency of any governmental jurisdiction under the control of the United States for a civil or criminal law enforcement activity authorized by law if the head of the agency^[207] makes a written request specifying the portion of the record sought and the law enforcement activity involved. The danger of indiscriminate disclosures here is reduced because a federal agency can refuse a request made in accordance with this provision, because the request must specify the particular portion of the record desired, and because the requesting agency must indicate the specific reason for the request. The requirement for a specific reason for the request and for a particular portion means that blanket requests for all information about an individual are not within the scope of this authorized disclosure.^[208]

(5) CIVIL OR CRIMINAL LAW ENFORCEMENT. – The disclosure is to the appropriate Federal, State, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation, or order, if the record is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving agency.

Paragraph (5) provides for a different flavor of law enforcement disclosure. It allows a disclosure of a record to any federal, state, local, tribal, or foreign agency responsible for investigating, prosecuting, enforcing, or implementing a statute, rule, regulation or order if the record is relevant to a violation or potential violation of civil or criminal law or regulation within the jurisdiction of the receiving agency. This authority is new to the statute, but it reflects a routine use commonly adopted by agencies for most systems of records.

There are several major differences between the disclosure authority in paragraphs (4) and (5). Paragraph (4) requires a request from the agency that wants to use the record, and only requests from United States jurisdictions qualify. Paragraph (5) allow a disclosure with or without a request from the receiving agency, and it specifies that state, local, and foreign agencies can be recipients. I added paragraph (5) because agencies need the ability to refer matters to law enforcement on their own initiative and without waiting for a request. The breadth of the disclosure authority granted here is modestly troubling, but the need is real and a statutory solution is better than forcing agencies to adopt ADDs that might be even more open-ended.

(6) HEALTH OR SAFETY. – The disclosure is to a person if –

(A) the agency believes in good faith that –

(i) the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of any individual or the public and

(ii) the person is reasonably able to prevent or lessen the threat; and

(B) the agency making a disclosure under this paragraph sends a notice of the disclosure to the data subject’s last known physical or electronic mail address, unless the Chief Privacy Officer determines that sending a notice would be inappropriate and documents the reason for the determination in writing.

Paragraph (6) expands on an existing provision that allows disclosures pursuant to a showing of compelling circumstances affecting health or safety of an individual, with notice to the individual to follow. The revised disclosure authority accomplishes the same purpose by borrowing more focused language from the HIPAA health privacy rule.^[209] Paragraph (6) allows disclosures believed in good faith to be necessary to prevent serious and imminent threats to the health and safety of any individual or to the public. When making a disclosure under this authority, an agency should disclose only information necessary for addressing the threat as best as the agency can judge under what are likely to be emergency circumstances. As with the existing Privacy Act provision (and unlike the HIPAA provision), paragraph (6)(B) requires after-the-fact notice of the disclosure to the data subject of the disclosed record but allows the agency Chief Privacy Officer to forego notice if “inappropriate” and if documented in writing. Notice might be inappropriate, for example, when the data subject was the source of the threat and there is reason to believe that providing notice might place agency personnel at risk.

Each agency can decide on its own procedures for using the health or safety disclosure authority. It was tempting to assign the responsibility to the Chief Privacy Officer, but that choice might be too limiting in emergency circumstances. It might still be the right choice at some agencies, however. The CPO has a role to play after-the-fact if the agency does not want to send a notice of the disclosure to the data subject.

(7) CONGRESS. – The disclosure is to either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, or any joint committee of Congress or subcommittee of any the joint committee.

Paragraph (7) is, except for editorial changes, same as an existing provision. It authorizes disclosure to either House of Congress or any congressional committee or subcommittee.

(8) WRITTEN INQUIRY TO MEMBER OF CONGRESS. –The disclosure is to a Member of Congress in response to a written inquiry by the Member of Congress after the Member of Congress receives a written request from the data subject pertaining to or concerning a matter contained in the record.

Paragraph (8) addresses disclosures made at the request of an individual Member of Congress. Paragraph (8) is new. Many agencies use a routine use for these congressional disclosures, and there is some variation in the details. The purpose here is to standardize all disclosures to Members who receive requests for assistance from individuals. The provision here does not require that a data subject be a constituent of the inquiring Member. It is sufficient that a Member makes an inquiry on someone’s behalf and at their request. Both the request from the data subject and the request from the Member must be in writing, and an agency should take the Member’s word that there is a written request. Because a data subject’s request may cover other matters or include details that are none of the agency’s business, there is no requirement that the agency must see or have a copy of the written request.

(9) GOVERNMENT ACCOUNTABILITY OFFICE. – The disclosure is to the Comptroller General, or any authorized representative of the Comptroller General, in the course of the performance of the duties of the Government Accountability Office.

Paragraph (9) allows disclosure to the Government Accountability Office in the same manner as existing law.

(10) CONTRACTORS, GRANTEES, OTHERS. – The disclosure is to a contractor, grantee, consultant, or volunteer performing or working on a contract, grant, cooperative agreement, or otherwise for the agency and who has a need for the record in the performance of their duties for the agency. When required, the recipient shall comply with section 14.

Paragraph (10) is new and based on a routine use commonly used by most agencies for many systems of records. The new allowable disclosure permits agencies to disclose a record to contractors, grantees, consultants, or volunteers working in some fashion for the agency and who have a need for the record in the performance of their duties. The standard is the same as the one that governs use by agency officers and employees. Section 14 of the USA FIPS Act requires agencies to apply the terms of the Act to contractors and other recipients. However, section 14 will not apply to all authorized recipients under paragraph (11). For example, a volunteer who uses agency records will not be establishing or operating an A3P for an agency in a manner that requires the agency to apply section 14.

(11) COURTS AND LITIGATION. – The disclosure –

(A) is pursuant to the order of a court of competent jurisdiction;

(B) occurs in a filing made in a court of competent jurisdiction pursuant to the rules of that court;

(C) is to a party in litigation with the agency, is authorized by the rules or order of the court or adjudicative body conducting the proceeding before which the litigation is pending, and a rule, order, or a signed written agreement, limits use of the disclosed record to the purpose of conducting the litigation; or

(D)(i) is to a party, or potential party, to litigation with the agency, or to the party’s authorized representative, or to an independent mediator, in connection with settlement discussions; and

(ii) the disclosure of the record is limited to the purposes of the settlement negotiations by (I) a rule or order of the court or adjudicative body conducting the proceeding, or (II) a written agreement signed by the parties.

Paragraph (11) is partly new. It covers disclosures to the courts and in connection with litigation. There are four types. The provision allows 1) disclosure of a record ordered by a court of competent jurisdiction; 2) a disclosure made in a court filing under court rules; 3) disclosure of a record to a party in litigation with an agency as authorized by court rules or a court order, if subject to a rule, order, or signed written agreement limiting use of the record use of the record to the purpose of the litigation; and 4) disclosure to a party or potential party to litigation in connection with settlement discussions and if disclosure is limited to the purpose of the settlement negotiations by court order, rule, or signed written agreement.

The first of these disclosures is existing law.^[210] The current provision generated a considerable amount of litigation. Reenacting the existing provision is not intended to upset existing understandings, in particular, Doe v. Di Genova^[211] (requiring an order specifically approved by a judge and not a court clerk).

The other three classes of disclosure are new. They reflect routine activities that occur in litigation, and all appear in routine uses adopted by many agencies. Several of these litigation-related allowable disclosures mention limits on use and disclosure. The goal here is to allow orderly disclosures that are necessary to litigation or that will aid in resolving litigation.

The appropriate use of protective orders or other approaches to control agency records shared in litigation protects data subjects against a variety of privacy harms. Those protections are welcome and encouraged. The limited mention of restrictions in these allowable disclosures reflects a reluctance to interfere unduly with processes and procedures already well-established in court rules.

(12) DATA BREACH RESPONSE. – The disclosure is –

(A) for the purpose of responding to a suspected or confirmed data breach that involves a risk of harm to an individual or a data system;

(B) approved by –

(i) the head of the agency;

(ii) the Chief Privacy Officer of the agency;

(iii) a senior agency official designated under a written agency data breach response plan; or

(iv) the Federal Chief Privacy Officer;

(C) of records from an agency activity affecting privacy that an agency official supervising the data breach response determines are (i) likely to be relevant to the purpose of this paragraph; and (ii) made to an agency, entity, or other person for which the official approving the disclosure has reason to believe may be able to assist in identifying the existence or scope of a data breach or in responding to the data breach either by providing a remedy for an individual who may have been affected by the data breach or by assisting with protection of a data system; and

(D) pursuant to a contract or agreement limiting the use of all data disclosed to the purpose of the disclosure and requiring either the prompt return or destruction of all data disclosed when the agency determines that the purposes of the disclosure are fulfilled.

Paragraph (12) adds a new disclosure for data breach response. The inclusion of data breach as an allowable disclosure recognizes the reality that data breaches are a standard feature of modern information technology systems.

Some existing agency routine uses for data breach date back years. Following directions from OMB, agencies more recently added routine uses for data breach response.^[212] At least some agency data breach routine uses suffer from vagueness, overbreadth, or other flaws.^[213] Drafting a balanced standard for data breach disclosures is a challenge because of the many ways in which data breaches can arise and in which agencies respond. The proposed statute provides for data breach disclosures as an allowable disclosure in order to establish an appropriate standard and to prevent agencies from adopting inappropriate alternatives. The allowable disclosure provides significant flexibility and relies on judgments made by agency officials with the recognition that those officials make those judgments under time pressure and in the absence of all relevant information. Data breaches typically present themselves as emergencies calling for immediate action to prevent or lessen harm.

The data breach response provision has four required elements. First, the disclosure must be for the purpose of responding to a suspected or confirmed data breach that involves a risk of harm to an individual or a data system. Any risk of harm is sufficient to satisfy the standard. Any individual at risk, whether a data subject or otherwise, can qualify. The data system at risk need not be a federal agency system.

Second, a data breach disclosure must be approved by the head of the agency, or the CPO of the agency, or a senior official designated under a written agency data breach response plan, or the Federal Chief Privacy Officer. The flexibility here recognizes the need for immediate action when a breach occurs or is suspected. If a breach involves multiple agencies, the ability for the Federal CPO to authorize disclosures by more than one agency may be especially useful. The authority given to the head of the agency can be delegated to a senior agency official under the agency’s data breach response plan. The necessary approval need not be in writing initially, but agencies should document approval as soon as practicable. Some existing data breach routine uses are deficient in that they either do not specify who can approve a disclosure or because they allow any agency employee to approve.

Third, the disclosure can include records from an A3P that an agency official supervising the response determines are likely to be relevant to the data breach response, and the disclosure is made to an agency, entity, or person that the official approving the disclosure has reason to believe may be able to assist in identifying the existence or scope of a data breach or in responding to the data breach. Legitimate goals of data breach response include providing a remedy for individuals affected by the breach and assisting with the protection of data systems. The data systems at risk do not have to be A3Ps and do not have to be federal systems at all. A data system can include a state or local government system or a private system. This provision relies heavily on the judgment of the officials involved in supervising or responding to a breach, with the full understanding that choices may need to be made in the absence of complete information about the scope or nature of a breach and that emergency circumstances may warrant decisions to be made without adequate time for full exploration of limits and alternatives. The flexibility here does not mean that officials have a blank check to disclose anything to anyone, but under all of the circumstances, officials have the ability and the responsibility to exercise judgments.

Fourth, the last requirement is that data disclosed for breach remediation be accomplished through a contract or agreement limiting use of the data to breach response and calling for the prompt return or destruction of data disclosed when the purposes of the disclosure are fulfilled. The obligation for a contract or agreement does not mandate a written document signed in advance. When an emergency does not allow time for drafting documents, oral agreements can be sufficient, and these agreements should be documented by the authorizing agency official. The provision calls for data return or destruction, but in modern information systems, neither activity may be meaningful or simple. The inclusion of a standard for promptness recognizes that immediate return or destruction may not be practical. Data may remain in backups or elsewhere in complex systems while waiting to cycle out on regular time schedules. The requirement here does not envision any extraordinary destruction measures, provided that an agency requires recipients not to process inappropriately any record awaiting destruction.

(13) FEDERAL PERSONNEL AND OTHER DECISIONS. – The disclosure is to those officials and employees of a Federal agency or Federal entity that require personally identifiable information relevant to a decision about (i) the hiring, appointment, or retention of an employee; (ii) the issuance, renewal, suspension, or revocation of a security clearance; (iii) a security or suitability investigation; (iv) the awarding of a contract or grant; or (v) the issuance of a grant or benefit.

Paragraph (13) covers several types of inter-agency disclosures relevant to personnel matters, awarding of contracts, and the like. These disclosures are common enough to warrant authorizing them as an allowable disclosure and to do so in a manner that applies the same standard to all agencies. The covered disclosures are to officials and employees of a federal agency or entity that require PII relevant to a decision about (i) the hiring, appointment, or retention of an employee; (ii) the issuance, renewal, suspension, or revocation of a security clearance; (iii) a security or suitability investigation; (iv) the awarding of a contract or grant; or (v) the issuance of a grant or benefit. The authority to disclose allows agencies to share information in order to protect legitimate governmental interests in a variety of standard activities.

One existing provision allowing disclosure does not appear in the USA FIPS Act. Section (b)(12) of the Privacy Act allows disclosure to “a consumer reporting agency in accordance with section 3711(e) of title 31, United States Code.” The Debt Collection Act of 1982 added this provision to the Privacy Act of 1974.^[214] Consumer reporting agencies insisted on several changes to the Privacy Act when the law authorized agencies to report federal debts to consumer reporting agencies. The changes were unnecessary. The addition of specific authority to report debts was unnecessary because each agency reporting a debt could readily add the disclosure as a routine use to the appropriate system of records. However, the argument that amendments to the Privacy Act were unnecessary did not prevail at the time. Dropping the statutory disclosure provision will require the appropriate agencies to add ADDs covering the disclosures, but the disclosures will be limited to the few A3P that need them and not to all A3Ps across government.

Nothing in the draft bill gives agencies authority to vary the terms of the allowable disclosures by issuing ADDs. There has been occasional debate over the years about an agency’s authority to issue a routine use that would reduce the requirements in the statutory conditions of disclosure in subsection (b) of the Privacy Act. The intent here is that an agency may not change the provisions of any of the disclosures allowed in subsection (d) by issuing an ADD. Thus, for example, an agency cannot establish an ADD that only allows disclosure to a congressional committee when the committee affirmatively votes to ask for information. I gave consideration to adding language to expressly prohibit an agency from establishing an ADD that changes the conditions in the bill for allowable disclosures. However, in the end, the restrictive language created more problems than it solved.

(e) MINIMIZE ALLOWABLE DISCLOSURES. – When disclosing a record pursuant to an allowable disclosure in subsection (d), an agency shall make a good faith effort to disclose the minimum amount of personally identifiable information that will accomplish the purpose of the disclosure.

This provision is one of several focusing on minimizing disclosures, a goal fully consistent with the Principle of Disclosure Limitation. It directs an agency making an allowable disclosure to make a good faith effort to disclose the minimum amount of PII that will accomplish the purpose of the disclosure. The basic idea is similar to the HIPAA requirement that HIPAA covered entities must make reasonable efforts to use or disclose the minimum amount of protected health information necessary to accomplish the intended purpose of the disclosure.^[215] The HIPAA rule includes a number of significant exceptions that largely reflect the practicalities of health care operations.

Subsection (e) captures the flavor of the HIPAA rule with the requirement that an agency make a good faith effort to limit disclosures. It is impossible in a statute applicable to all federal agencies and programs to draw specific lines or to provide a list of exceptions. Each agency must assess the practicalities of each class of disclosure and act accordingly. For programmatic disclosures that occur routinely, an agency may determine once (perhaps with occasional reassessments) which data fields are appropriate for which disclosures. There is no need to make a choice for individual disclosures if similar disclosures can be fairly judged as a class. For one-off disclosures, however, a case-by-case assessment may be appropriate.

The HIPAA rule applies to both uses and disclosures, but subsection (e) applies only to disclosures. Subsection (4)(a) of the USA FIPS Act directs agencies to process only PII that is relevant and necessary to accomplish a legitimate purpose of the agency. That provision works to limit agency processing of PII generally. Imposing more specific limits on use – even under a good faith standard – would create unnecessary difficulties. The general limits in subsection (4)(a) serve that purpose adequately.

(f) PROCEDURAL REQUIREMENTS FOR AGENCY DESIGNATED DISCLOSURES.

Elsewhere, this report discusses the shortcomings of the routine use definition and its application by agencies. The discussion addresses the difficulties inherent in establishing a general standard for judging all agency defined disclosures. Subsection (6)(f) provides procedural requirements in order to make up for the inability to prescribe specific and clear substantive limitations in the definition of ADD.

(1) CPO APPROVAL. All agency designated disclosures must be approved by the agency’s Chief Privacy Officer pursuant to section 9(b)(6);

The first procedural requirement is that the agency’s chief privacy office must approve each ADD. This assures that all ADDs for an agency will receive review and approval in the same manner. The CPO can refuse to allow an inappropriate, unlawful, or overly broad ADD and may restrict the terms that apply to ADD disclosures. In any bureaucratic struggle, the power to say “No” offers the CPO leverage to achieve a proper result. In the end, how agencies resolve internal disputes over ADDs is unpredictable, but the requirement for CPO approval should ensure a standard internal review. Here, as with other USA FIPS Act provisions, reliance on agency personnel to carry out their functions responsibly is essential.

(2) DESCRIPTION. – When establishing an agency designated disclosure, the agency shall to the extent practicable identify as part of the description of the disclosure –

(A) why the disclosure qualifies under one or more of the categories in the definition of “agency designated disclosure”;

(B) the class of recipients of personally identifiable information;

(C) the types of personally identifiable information that may be disclosed;

(D) the purpose of and authority for the disclosure, including a good faith effort to specify each statute or treaty that requires or specifically authorizes disclosure of personally identifiable information;

(E) the position description or function of those agency officers and employees who may authorize a disclosure as an agency designated disclosure.

The second procedural requirement is the requirement to publish a full description of each ADD upon establishment. Ordinarily, this will happen when an agency establishes an A3P. The publication must explain to the extent practicable –

• Why the disclosure qualifies under one or more of the categories of ADD described in the definition of ADD. An ADD may qualify under more than one category.
• The class of recipients of PII. For example, recipients might be described as administrators of specific federal programs; health care providers treating the data subject; organizations carrying out research approved by institutional review boards; or state, local, or foreign public health departments assisting with agency public health activities and collaborative efforts. When an agency routinely shares credit information with a credit bureau, the agency may identify credit bureaus as the class of recipient so that the description need not change in the event that the agency uses a different credit bureau in the future.
• When an agency authorizes a disclosure to another agency, it would be appropriate to identify the part of the agency that receives the information. Thus, if would be preferable for an ADD that allows disclosure for a public health purpose to the Department of Health and Human Services to state that the recipient is the Public Health Service or the Centers for Disease Control. Still, there can be circumstances where a record has many uses within the recipient agency so that it is only practicable to identify the Department and not all the subcomponents. Similarly, when more specificity is not possible or practicable, another class of recipients might be law enforcement officials. Where description identifies a broad class of recipients, the rest of the description should provide context and place boundaries on the disclosure.
• The types of PII eligible for disclosure. There may be circumstances in which it is appropriate to disclose an entire record, but that should not be the default. A description will ideally include a list of specific categories of PII appropriate for a disclosure. If an ADD covers more than one type of disclosure, each type may have its own list of PII. For example, collaborations with public health departments may include disclosures for routine vaccinations, for contact tracing, and for pandemics. The types of PII disclosed in each case may be different, and an agency should to the extent practicable, be specific.
• The purpose of and authority for the disclosure. Some or all of the information describing purpose and authority may be covered by the description of why a disclosure qualifies under one of the categories of ADD. An agency must make a good faith effort to specify any statute or treaty that requires or authorizes a disclosure. Another provision in the bill expressly states that failure to specify a law or treaty in an ADD does not prevent the agency from making a disclosure under the law or treaty.
• The position description or function of officers and employees who may authorize a disclosure. Many existing routine uses fail to state who in an agency can authorize a disclosure. The lack of specificity leaves open the possibility that inappropriate individuals – whether high-level political appointees or low-level employees without substantive responsibilities – can make or approve disclosures. The goal here is to describe generally the class of agency personnel who have the authority to approve disclosures. For routine and regular disclosures, it should not be difficult to describe program managers who have that authority under existing agency rules or program operations. In some cases involving non-routine matters, it may be appropriate to require approval by a designated supervisory official. For disclosures in controversial circumstances, approval by the CPO could be part of an ADD. The introductory clause – to the extent practicable – give agencies considerable flexibility here.

If fully complying with the description requirements for an ADD produces 25 pages of text, it would be fair for an agency to conclude that a description of that length is not practicable. There is a need to strike a balance between the length and the specificity of an ADD. An important goal is to inform the public about an agency’s processing of PII. A notice that no one will read or understand fails the practicability test.

The requirements for specificity in an ADD seek to provide details that both inform the public and cabin agency choices when actually making disclosures. The use of appropriate as part of the statutory standard is a choice made because of the need for a degree of flexibility in giving general directions for agencies to apply in a wide variety of circumstances. However, when an agency defines an ADD, the use of appropriate as a descriptor is likely to be unacceptable. Thus, an ADD that allows disclosures to appropriate persons or in appropriate legal proceedings is too vague without further qualification.^[216] The vagueness needed for the statute is not a model for actual ADDs. It not acceptable for the agencies to rely on vagueness when defining specific types of allowable disclosure for specific agency functions in a particular A3P.

(3) MINIMIZING DISCLOSURE. –

(A) When establishing an agency designated disclosure, an agency shall as part of the description of the disclosure and to the extent practicable, limit each agency designated disclosure to those records and to those portions of records processed in an agency activity affecting privacy that fulfill the purpose for which the agency designated disclosure was established;

(B) When disclosing a record pursuant to an agency designated disclosure, an agency shall to the extent practicable disclose the minimum amount of personally identifiable information that will accomplish the purpose of the disclosure.

The third procedural requirement derives from language that seeks to minimize disclosures. One provision applies at the “wholesale level” when establishing an ADD. It directs an agency to the extent practicable when establishing an ADD to limit the scope of allowable disclosures to those records and to those portions of records that fulfill the purpose of the ADD. The second provision applies at the “retail” level when making a specific decision about the disclosure of a particular record. When actually disclosing a record under the authority of an ADD, an agency must to the extent practicable limit the disclosure of PII to the minimum amount that will accomplish the purpose.

For example, when an agency needs to disclose enough payroll information from a personnel record to allow another agency to pay an employee’s salary, the ADD should cover only those elements needed for payroll and not the entire personnel record. For example, an earlier discussion highlighted a VA routine use that allowed the disclosure of “information” from a health record to a telephone operator facilitating phone calls for hearing impaired individuals. An ADD for that purpose should allow for the disclosure to the operator of only the information needed to facilitate the call. There is no need for an ADD to authorize the disclosure of an entire health record to the operator. However, when there are circumstances that make it impracticable to narrow down the scope of allowable disclosures in an ADD, then limits on disclosure should be applied when actually using the ADD to authorize an actual disclosure. At the “retail” level, the amount of PII disclosed may vary from case to case because the minimum necessary may be different at times.

As an example of applying the policy for minimizing disclosures, here is a revision of that VA routine use for assistance with hearing impaired calls that meets the terms of an ADD under the USA FIPS Act:

A VA health care provider or VA administrative staff may disclose the name, phone number, and when relevant, hearing impairment of a data subject who uses telephone devices for the hearing impaired (including Telecommunications Device for the Deaf (TDD) or Text Telephones) together with the phone number and identification of the individual who will receive the phone call with the data subject, to a telephone operator or other person who facilitates phone calls for hearing impaired individuals.

In interpreting the practicability standard, an agency may be guided by established program rules or practices. If it is too difficult or cumbersome to separate out the elements of a record being disclosed, the practicability standard will allow for a broader disclosure in the ADD, leaving specific determinations to be made for each particular disclosure.

These limits on disclosure are important in part because the old notion of a system of records will be replaced by a potentially broader concept focused on functions and not records. An agency may process more PII within the same A3P so that broad disclosure authority could cover much more PII than is needed for any given disclosure. Still, the practicability standard is intended to give agencies discretion and to allow for consideration of efficiency and cost when relevant.

(4) PUBLIC DISCLOSURE. – If an agency designated disclosure authorizes the public disclosure of personally identifiable information, the agency shall establish a procedure that requires the approval of the Chief Privacy Officer prior to the disclosure. This paragraph does not apply to disclosures required by section 552 of title 5, United States Code, or to other public disclosures required by law.

The fourth procedural requirement provides that if an ADD authorizes public disclosure of a record or part of a record, the agency must establish a procedure that requires the approval of CPO prior to the disclosure. This limitation is a response to routine uses that allow virtually unrestricted and standardless public release of information.^[217] In some instances, officials with authority to disclose information are not specified in the routine use, and the scope of the allowable disclosure can be unlimited. This type of routine use reserves too much unqualified discretion to agency officials, arguably allowing a GS-1 employee to authorize a disclosure of a record or even an entire system of records. The procedural limit comes through approval by the agency CPO. A CPO should review public disclosures under ADDs to make sure that they meet all the requirements for disclosure and that the disclosure is justified under the circumstances.

A disclosure required by the Freedom of Information Act and a public disclosure required under another statute are exempt from the requirement for CPO approval. For example, if an ethics law requires publication of information from conflict-of-interest forms, that disclosure would not require CPO approval. An agency CPO could, at the CPO’s discretion, identify specific circumstances that routinely justify public disclosure of specific portions of a record and provide a specific written policy to guide public disclosures without the need for individual approval by the CPO. For example, a CPO might provide general authorization for disclosure of limited information about individuals newly appointed to senior agency positions, about arrests, or about civil or criminal court filings.

(g) OMB GUIDANCE. –

(1) ALTERNATIVE TO CONSENT. – The Director of the Office of Management and Budget shall issue guidance discouraging agencies from establishing agency designated disclosures principally as an alternative to obtaining consent of the data subject.

(2) MODEL NOTICES. – The Director of the Office of Management and Budget may prepare and publish for the use of agencies model notices of agency designated disclosures that are likely to be relevant to many agencies. Any agency that proposes to adopt an agency designated disclosure addressing disclosures covered by a model notice published in accordance with this paragraph that differs from the model notice by allowing for broader or additional disclosures shall explain its reasons when it publishes the agency designated disclosure for public comment.

Paragraph (g) calls on OMB to continue its traditional role under the Privacy Act of 1974 by providing guidance. The provision calls for two flavors of guidance with respect to ADDs, one required and one optional.

First, OMB must issue guidance to discourage an agency from using an ADD when it would be more appropriate to obtain consent. Relying on routine uses rather than consent is common under the Privacy Act. The practice grew up in part because agencies did not want to be bothered seeking and documenting consent. I gave consideration to banning using an ADD solely in place of consent. Instead, the bill directs OMB to issue guidance discouraging agencies from establishing agency designated disclosures principally as an alternative to obtaining consent of the data subject. This middle ground recognizes that consent may not always be practical or in the best interest of data subjects, but it seeks to establish some type of barrier to the casual adoption of an ADD in place of seeking data subject consent solely for the convenience of the agency and possibly to the detriment of data subjects.

Second, paragraph (g) allows OMB to publish model notices of ADDs likely to be relevant to many agencies. The goal is to have more uniformity when possible. OMB’s discretion here is wide. For some disclosures, many agencies may have the same need to provide for a disclosure in similar circumstances. The list of allowable disclosures in Section 5 of the bill covers some but not all common disclosures. For other commonly used ADDs, OMB may offer model notices that it believes would be helpful. The bill does not require an agency to use the OMB model ADD. Instead, it provides that an agency that proposes an ADD addressing disclosures covered by an OMB model notice must explain why that ADD differs from the model if it allows for broader or additional disclosures. This is another procedural barrier against unduly expansive ADDs.

Under current practice, OMB sometimes prevents agencies from establishing a routine use that differs from one recommended by OMB. In some cases, an agency’s ADD implementing an OMB model ADD may differ because it adds specificity absent from the model. That practice by itself will not trigger the need for an explanation. The concern arises if an ADD allows for broader or additional disclosures than the model OMB notice. OMB’s guidance may offer further distinctions that address when an explanation is appropriate.

(h) LIMITS. – Except as otherwise provided by law, nothing in this Act requires an agency to disclose a record to anyone other than the data subject or to a parent, guardian, or other person identified in section 16(d).

This language makes clear that the USA FIPS Act does not require agencies to make any disclosures other than to the data subject or other person identified in section (16)(d). As with the Privacy Act, the USA FIPS Act establishes standards and procedures that an agency must satisfy before disclosing a record. Any requirement to disclose a record must derive from elsewhere. Neither the USA FIPS Act’s allowable disclosures nor any ADDs adopted by an agency under its provisions mandates any disclosures on their own. Agencies may refuse disclosures permitted by an allowable disclosure or by an ADD unless otherwise mandated by law.

The access and amendment provisions of the Privacy Act appears to work largely as designed, and the USA FIPS Act continues the policies with several adjustments. Language that appears in section (d)(5) of the Privacy Act allowing an agency to withhold information compiled in reasonable anticipation of a civil action of proceeding no longer appears in the access section. Under the USA FIPS Act, the same authority to withhold exists, but the bill treats the authority as a formal exemption.

(a) ACCESS. – (1) An agency shall upon request by a data subject regarding a record processed as part of an agency activity affecting privacy permit the data subject and any person chosen by the data subject to review the record and to have a copy of any or all of the record in any form or format requested by the data subject if the record is readily reproducible by the agency in that form or format.

(2) An agency shall acknowledge in writing or by electronic mail receipt of a request under this subsection within ten days of receipt and shall provide the requested record within 30 days. If the request is denied in whole or in part, the agency shall inform the data subject of the denial, the reason for the denial, and the procedures established by the agency for appealing the denial to the head of the agency or designee.

(3) If after an appeal of a denial of a request for review or copy of a record, the agency refuses to provide the review or copy, the agency shall inform the data subject of the reasons for the denial and of the procedures for judicial review.

(4) For any request under this subsection and section 8(b)(2), an agency shall also provide to a data subject any requested information that would be available to the data subject under section 552 of title 5, United States Code.

Paragraph (1) of subsection (a) sets out the basic right to access of a record processed by an agency as part of an A3P. Following the lead of the Freedom of Information Act, new language directs agencies to provide a copy of a record in any form or format requested by the data subject if the record is readily reproducible by the agency in that form or format. An existing provision allowing a data subject to bring another person along to review a record remains, but language requiring a written statement authorizing discussion of the record in that person’s presence no long appears because it is unnecessary. An agency can seek consent, written or otherwise for the other person under its own rules.

Paragraph (2) establishes a policy for acknowledgement of a request, a policy absent from the Privacy Act. An agency has ten days to acknowledge a request and 30 days to comply with the request. One effect of this language is to establish clearly that a requester under the USA FIPS Act has a right to administratively appeal any adverse determination of a request for access or any constructive denial following the expiration of the statutory time limit for a response.

Paragraph (3) also adds language absent from the Privacy Act requiring an agency that denies a request for access or appeal to explain the reasons and the procedures for judicial review.

Paragraph (4) is new statutory language but not new policy. It requires that an agency receiving a request for access by an individual under the USA FIPS Act must provide to the requester any information that would also be available to that requester under the FOIA. This is a long-standing policy followed by many agencies.^[218] The two laws have exemptions that differ, so that information that can be withheld under one law may be disclosable under the other. The new requirement will give a data subject the most information available under either law.

Note that a provision in section 17(a)(6) addresses fees that an agency can charge for an access request.

A provision of existing law, section (f)(3), allows an agency to establish procedures for the disclosure of medical records in response to an access request. No comparable provision appears in the USA FIPS Act, with the effect that health records will be directly accessible to a requester without any limitation or procedure.^[219]

(b) AMENDMENT. – (1) An agency shall upon request by a data subject permit the data subject to request amendment of a record processed as part of an agency activity affecting privacy pertaining to the data subject that the data subject believes is not accurate, relevant, timely, or complete.

(2) An agency shall acknowledge in writing or by electronic mail receipt of a request under this subsection within ten days of receipt and shall within 30 days of the receipt of the request, either –

(A) make any amendment that the data subject requested, and promptly inform the data subject of the amendment; or

(B) inform the data subject of its refusal to make the requested amendment, the reason for the refusal, the procedures established by the agency for appealing the refusal to the head of the agency or designee.

(3) An agency shall within 30 days of the receipt of an appeal by the data subject of a denial of a request for amendment either –

(A) make any amendment that the data subject requested, and promptly inform the data subject of the amendment; or

(B) inform the data subject of –

(i) the right to file with the agency a concise statement setting forth the reasons for the data subject’s disagreement with the refusal of the agency; and

(ii) the right to judicial review of the denial.

(4) In any future disclosure of a record or portion of a record about which a data subject filed a statement of disagreement, the agency shall clearly identify any disputed information and, unless the data subject objects in writing, provide a copy of the data subject’s statement of disagreement and, if the agency chooses, a statement describing the agency’s reasons for not making the amendment requested.

The amendment provision largely tracks the Privacy Act. A data subject can ask for a review of any information that the data subject thinks is not accurate, relevant, timely, or complete. This is the existing standard. The deadline for a substantive response to an amendment request is 30 days rather than “promptly” as it is in the Privacy Act. A data subject’s right to file a statement of disagreement is largely the same as in the Privacy Act. An agency must mark any disputed information so that it will identify the dispute in any future use or disclosure. The statement of disagreement, together with the agency’s response, must be disseminated if the agency discloses the disputed record in the future. However, the data subject may object to the dissemination of a statement of disagreement to future recipients of a disputed record. A data subject may decide that highlighting a dispute by sharing the statement of disagreement with the agency’s response other will make things worse rather than better. A data subject who provides a statement of disagreement for distribution with a record cannot block dissemination of the agency’s response.

(c) EXTENSION. – The Chief Privacy Officer may extend the deadlines for responding to a request under this section for (1) review or a copy of a record, or (2) for an amendment, in each case by no more than 30 days, by notifying the data subject making a request in writing or by electronic mail.

A 30-day extension is available for both access and amendment requests. The agency CPO may grant either or both extensions as warranted.

(a) CHIEF PRIVACY OFFICER. – The head of each agency shall, promptly after the effective date of this Act, designate a Chief Privacy Officer to carry out the functions assigned under this Act and other related functions. If another statute established a privacy officer or similar officer for the agency, the head of the agency may designate that officer to carry out the functions assigned under this Act.

Subsection (a) requires the head of each agency to “promptly” designate a CPO to carry out the function assigned under the USA FIPS Act and “other related functions.” The other functions language is deliberately vague. Depending on the role of the agency, there may be other privacy activities that a CPO can undertake beyond the scope of the USA FIPS Act. Much will depend on the organization of the agency, the allocation of current responsibilities, and choices made by agency management. A CPO can have expanded privacy functions when appropriate to the duties of the agency.

At a few agencies, political appointees are CPOs. The Act does not require or prevent a CPO from being a political appointee. At most agencies, however, the position is likely to be filled with a civil servant.

Some debate surrounded the time for the initial appointment of the CPO. For agencies that face long and complicated transitions from the Privacy Act to the USA FIPS Act, delay in appointing a CPO will make it difficult to complete the work required despite the generous deadlines for compliance. I considered requiring appointment of the CPO within a fixed period after the date of enactment. However, statutory deadlines of that type are often not met, and without a significant penalty, that remains a possibility. In the end, it seemed better to ask for good management than to try to mandate it. Thus, the bill calls for the prompt appointment of the CPO.

For agencies that have CPOs or similar officials either under other laws or by management designation, the head of those agencies can designate those officials to serve as the CPO for USA FIPS Act purposes.

(b) DUTIES. – The Chief Privacy Officer for an agency shall –

(1) have agency-wide responsibility for privacy and for compliance with fair information practices;

(2) have agency-wide responsibility for overseeing agency compliance with Federal laws, regulations, and policies relating to privacy, including primary responsibility for implementation of this Act;

(3) participate in identifying and addressing privacy risks throughout the agency;

(4) have responsibility for agency privacy impact assessments as provided in section 11;

(5) have a central role in the agency’s development and evaluation of legislative, regulatory, and other policy proposals relating to or affecting the privacy of personally identifiable information; and

(6) approve the publication of the description of each agency activity affecting privacy, including each agency designated disclosure, prior to publication for comment and before the description and the agency designated disclosure becomes final.

Subsection (b) sets out a number of general duties for the CPO, and other parts of the Act give the CPO other specific functions. There should be no particular distinction between CPO functions identified here or elsewhere in the bill. The location of a function is a consequence of the drafting process and not a substantive judgment on the importance of the function.

The first of the general duties assigns the CPO agency-wide responsibility for privacy and compliance with fair information practices. Privacy management can come in many different flavors within an agency, and the other officials may have responsibilities in specific areas. It will be up to each agency to determine how to allocate privacy responsibilities among the agency’s officials and programs. The Act gives the CPO a voice and a central role in privacy matters throughout the agency. The CPO’s responsibility for compliance with FIPs underscores the importance of FIPs as a general goal for privacy.^[221] Implementing FIPs in agency programs requires judgment because the general policies reflected in FIPs do not dictate how to apply each practice.

The second general duty for a CPO is agency-wide responsibility for overseeing compliance with all laws, regulations, and policies relating to privacy, including primary responsibility for implementation of the USA FIPS Act. Again, this gives the CPO a role in all agency matters relating to privacy. Responsibility for some privacy activities may be elsewhere in the agency as provided in other laws and as each agency sees fit to assign those responsibilities. The CPO has a voice in all privacy matters, but the CPO is primarily responsible for implementation of the USA FIPS Act. That responsibility cannot be moved elsewhere.

The third general duty for a CPO is identifying and addressing privacy risks throughout the agency. Both agencies and data subjects face privacy risks when agencies process PII. The responsibility with respect to privacy risks gives the CPO broader authority to consider how agency components address those risks. Assessing risk is important because scarce resources will be best used to address riskier activities.

The fourth general duty for a CPO is responsibility for an agency’s privacy impact assessments. Section 11 of the bill provides more details about PIAs, but the point here is that the CPO manages the PIA process. Program officials also play a significant role in PIAs for their own operations, but they must work with the CPO to meet the requirements.

The fifth general duty gives the CPO a central role in the agency’s development and evaluation of legislative, regulatory, and other policy proposals about privacy. This gives the CPO a seat at the table when an agency develops or evaluates matters that affect privacy, including when Congress or OMB seeks an agency’s views on legislation.

The sixth general duty requires the CPO to approve the description of each A3P disclosure (and each ADD) prior to its publication for comment and before it becomes final. The emphasis on agency designated disclosures underscores the importance of controlling and limiting ADDs. A CPO will have considerable ability to stop activities that do not comply with the Act’s overall standards. When disputes arise between an agency’s CPO and program officials, it will be up to each agency to find a resolution. It is not anticipated that a CPO can singlehandedly stop an activity that an agency committed to undertake, but the CPO will have a voice if privacy matters are ignored or inadequately addressed.

(c) NOTICES. –The Chief Privacy Officer shall, to the extent practicable, standardize elements and terminology of notices of agency activities affecting privacy, including agency designated disclosures.

Subsection (c) directs the CPO to standardize the language of A3P notices and ADDs. For example, it is not uncommon to find modest or even significant differences in routine uses that seek to accomplish the same goal within the same agency. This subsection establishes standardization as a soft goal (“to the extent practicable”).

(d) Personally Identifiable Information Processing Diagram. – The Chief Privacy Officer shall, to the extent practicable, maintain on the agency privacy website for each major agency activity affecting privacy a current personally identifiable information processing diagram or equivalent document that visually depicts the collection, use, and disclosure of personally identifiable information and that shows the principal sources of information, the principal internal users of the personally identifiable information, the principal purposes for which the agency collects and discloses personally identifiable information, and the recipients of significant disclosures.

Subsection (d) establishes another soft goal (“to the extent practicable”) for a CPO. A personally identifiable information processing diagram or similar document can be useful in describing the processing of PII within agency operations. Agencies may already prepare diagrams as part of system designs or for other purposes, and the some of those diagrams can and should be made available to the public when possible. While diagrams may serve other purposes in other contexts, the goal here is to provide the public with a visual description of the processing (collection, use, disclosure, etc.) of PII in the context of an A3P. Some complex A3Ps with multiple functions and data flows may require multiple diagrams.

An earlier draft of the bill made a data map part of each A3P. I dropped the term data map because it has a technical meaning in some contexts that was inappropriate here. The term personally identifiable information processing diagram is new, and this allows agencies (with OMB guidance) to devise a visual depiction of PII processing suitable for their own A3Ps and their own circumstances.

Not every A3P requires a visual diagram, and there may not be sufficient resources to maintain a current one at all times for every A3P. The CPO has considerable authority within available resources to determine priorities. Rather than include diagrams in Federal Register notices, the bill directs a CPO to maintain the diagrams on the agency’s privacy website. This will make it easier to change the diagrams as needed. Nothing stops a CPO from publishing a diagram as part of a notice for an A3P if the CPO thinks that it would be useful to the public or to the agency.

The disclosures made of PII from an activity are an important part of any diagram. The bill calls for including significant disclosures because it may be impractical to include every possible disclosure. Significant disclosures are those that are a standard for an A3P’s basic functions. There may be no need, for example, to include the possibility of disclosures for historical archiving purposes. However, any disclosure that has more than a minimal potential to affect a data subject should be included.

(e) REPORT. –When the Chief Privacy Officer of an agency determines that a threat or vulnerability is creating or is likely to create a significant disruption to the privacy responsibilities of the agency, a serious unresolved privacy or security risk to the agency, or an inappropriate or avoidable serious privacy or security risk to data subjects, the Chief Privacy Officer may –

(1) consult with the Chief Information Officer of the agency; and

(2) report from time to time directly to the head of the agency.

Ideally, each agency will integrate privacy management with other information management functions. It is hard, however, to legislate good management, and information management structures vary considerably among agencies. Subsection (e) is a break the glass type of activity that a CPO can use when routine management reporting is not sufficient. When the CPO sees the possibility of a significant disruption to an agency’s privacy responsibilities, a serious unresolved privacy or security risk to the agency, or an inappropriate or avoidable serious risk to data subjects, the CPO can take an action outside of routine channels. The provision gives each CPO the ability to report on occasion directly to the head of an agency. The standards here are relatively high. Depending on the size and functions of an agency, a CPO may be located in many different places in an agency’s organization chart. The reporting option allows the CPO to bring a matter directly to the head of the agency regardless of the CPO’s location within the agency. The bill also allows a CPO to consult with the agency’s Chief Information Officer. This type of consultation is likely to be more routine, and a CPO may find that a visit to the CIO is a good idea prior to asking for access to the agency head.

(f) GUIDANCE. –The Director of the Office of Management and Budget may issue guidance on the activities and functions of a Chief Privacy Officer, including guidance on the preparation and format of personally identifiable information processing diagrams prepared under subsection (d).

Subsection (f) allows OMB to issue guidance on the activities and functions of a CPO. OMB may also offer guidance on the preparation and format of personally identifiable information processing diagrams, with a goal of standardizing the diagrams when appropriate.

(a) PURPOSE. – The purposes of the privacy impact assessment process are –

(1) to inform agency decisions for the life cycle of agency activities affecting privacy, including planning, design, implementation, and conduct, in a manner consistent with other Federal information resources management policies, principles, standards, and guidelines;

(2) to identify significant risks to the agency and significant consequences for the privacy of data subjects from the conduct of agency activities affecting privacy;

(3) to seek and implement ways to minimize significant risks and consequences prior to establishing or modifying an agency activity affecting privacy while providing for the efficient and effective conduct of agency responsibilities;

(4) to provide that agency processing of personally identifiable information minimizes the processing of personally identifiable information, maximizes fairness, includes appropriate due process protections, and generally complies with fair information practices;

(5) to provide to the extent practicable an opportunity for public comment in the planning and design of an agency activity affecting privacy;

(6) to complete the process, to the extent practicable, before the agency makes final decisions about the design of an agency activity affecting privacy; and

(7) to document the conduct of the process with a written report.

Subsection (a) identifies seven major purposes for the PIA process. The first paragraph highlights that the PIA process should inform agency decisions for the life cycle of each A3P. The PIA process is not intended as an academic exercise to be completed independently of the development of an A3P. Nor is it meant to be a compliance exercise that can be satisfied by an after-the-fact document merely justifying final programmatic and technological decisions. The PIA process should be part of the planning, design, implementation, and conduct of an A3P. The PIA process may result in appropriate change in that planning, design, implementation, and conduct, along with other factors that influence agency activities.

The second paragraph focuses on the importance of identifying significant risks to the agency and significant consequence to data subjects. These can be different risks that require different responses. For example, the collection of PII presents a risk to the agency in that it must secure the data, manage its use and disclosure, and be prepared to respond in case of data breach. The agency processing of PII can have consequences to the data subject that may include the intended use of the data, secondary uses and disclosures unrelated to the original purpose, and the effects of data breach.

The third paragraph emphasizes the importance of minimizing the risks and consequences of agency activities prior to starting or changing an A3P. One obvious way to accomplish both of these objectives is to collect and maintain less information. That is, of course, not always possible, and the provision recognizes the importance of efficient and effective conduct of agency responsibilities. There are always tradeoffs between major objectives. Privacy protection may rarely be the most important objective of any given program, but it will often be a relevant objective that deserves attention and weight. The need to find and minimize risks and consequences before an agency makes decisions underscores the first purpose.

The fourth paragraph identifies the goals of minimizing processing of PII, maximizing fairness, providing due process protections, and complying with FIPs.

The fifth paragraph emphasizes the importance of public comments in the planning and design of agency A3Ps. The Act provides a role for the public in the PIA process, but much will be within the discretion of agencies to decide how to bring the public into the process in a timely way.

The sixth paragraph tells agencies that they should, to the extent practicable, complete the PIA process before making final decisions about the design of an A3P. This emphasizes that the PIA process should not be a paper exercise completed after an activity starts functioning. The PIA process should influence agency design decisions and not just ratify them after the decisions are made.

The seventh paragraph makes it clear that a written report on the PIA process is another objective. The PIA report should, to the extent possible, be a document available for public review. If parts of a PIA report are classified or qualify for withholding for other reasons, then unrestricted parts of the report should still be made public.

(b) PROCESS. –

(1) Each agency shall conduct either a thorough or a limited privacy impact assessment process for new or significantly modified agency activities affecting privacy and for new or significantly revised matching programs.

(2) In determining whether to conduct a thorough or a limited privacy impact assessment process, an agency shall consider using a thorough assessment when agency activities affecting privacy are reasonably likely to have one or more of these characteristics:

(A) affect a large number of data subjects;

(B) involve determinations of eligibility for rights, benefits, privileges, or status;

(C) employ or propose to any novel or innovative applications of technology;

(D) present significant risks to the agency or significant consequences for the privacy of data subjects;

(E) involve the routine collection of a records from sources outside the Federal government or the disclosure of large number of records outside the agency; or

(F) result in significant new mergers of previously separate government databases.

(3) The Director of the Office of Management and Budget shall issue guidance to help agencies –

(A) decide whether to conduct either a thorough or a limited privacy impact assessment process;

(B) establish priorities for conducting privacy impact assessment processes;

(C) address privacy –

(i) as part of the information and information system life cycles;

(ii) in relation to other requirements pertaining to the collection of information; and

(iii) with regard to information system development, security, and the use of information technology resources;

(D) determine when and how to conduct public consultations;

(E) conduct a privacy impact assessment process for an agency activity affecting privacy that involves more than one agency; and

(F) conduct any other aspect of the privacy impact assessment process.

Subsection (b) describes the process for agencies to follow. For new or significantly modified A3Ps or computer matching programs, there are two types of PIA processes, thorough and limited. The bill lists six factors to consider when deciding if a thorough PIA process is appropriate. The factors are whether an A3P is reasonably likely to: (A) affect a large number of data subjects; (B) involve determinations of eligibility for rights, benefits, privileges, or status; (C) employ or propose to employ any novel or innovative applications of technology; (D) present significant risks to agencies or significant consequences for the privacy of data subjects; (E) involve the routine collection of records from sources outside the Federal government or the routine disclosure of records outside the Federal government; and (F) result in significant new mergers of previously separate government databases.

The choice about a thorough or limited PIA process is ultimately up to the CPO, as provided later in this section of the bill. The presence of any listed factor does not automatically mean that a through PIA process is appropriate. Not every PIA process can or should be thorough. The choice ultimately depends in part on resources and on the relative importance of the listed factors. The reference to any novel or innovative applications of technology includes hardware (i.e., cameras), software (i.e., artificial intelligence or algorithmic decision making), biometrics, and more. Several of the factors address the possibility of the creation of new information collections or the formation of new databases that merge records otherwise maintained separately in federal, state, or private hands.

The third paragraph provides that the Director of OMB must issue guidance on the PIA process. The guidance should help agencies (A) decide whether to conduct a thorough or limited PIA assessment process; (B) establish priorities for conducting PIA assessment processes; (C) address privacy as part of other information management functions, including information and information system life cycles; other requirements relating to the collection of information; and information system development, security, and use of technology resources; (D) determine when and how to conduct public consultations; (E) conduct a PIA process that involves more than one agency; and (F) conduct any other aspect of the PIA process.

This provision gives OMB a significant responsibility and considerable discretion. It recognizes that privacy management is part of information management activities and regulatory controls over agency information activities, which are not limited to personally identifiable information activities. Privacy management needs to fit into and be part of overall information management responsibilities and not a separate activity unrelated to other requirements. This supports the existing goal of better integration of privacy within information and technology management.^[228]

(c) MANAGING THE PRIVACY IMPACT ASSESSMENT PROCESS.

(1) The Chief Privacy Officer shall determine the scope of each privacy impact assessment process, including deciding whether a thorough or limited process is appropriate; which agency activities affecting privacy should be included in which privacy impact assessment process; identify the agency components that shall participate in the process; establish a timetable for the process; and manage any public notice and public participation.

(2) Each privacy impact assessment process shall result in a final written report.

(3) If an agency activity affecting privacy involves classified information or other information unsuitable for public disclosure under existing laws and Executive Orders, the agency shall disclose publicly as much about the privacy impact assessment process as practicable.

(4) If in the judgment of the Chief Privacy Officer, it is not practical to complete a privacy impact assessment process before an agency begins or significantly changes an activity that would otherwise require a privacy impact assessment process, the Chief Privacy Officer may delay or otherwise adjust the conduct of the process and the timing and form of public report in a suitable manner. The Chief Privacy Officer shall provide public notice of any delay or adjustment on the agency privacy website.

(5) The Chief Privacy Officer shall send to appropriate Committees of Congress a copy of each interim and final written report on each major privacy impact assessment.

Subsection (c) addresses management of the PIA process, placing the agency CPO in charge. The CPO determines the scope of each PIA process, including whether a thorough or limited PIA process is appropriate; which A3Ps fall within a PIA process; which agency components should participate in the process; the timetable for the process; and the public notice and public participation part of the effort. That is a lot of authority and responsibility, and it requires someone with a modest degree of independence from the activity being assessed. If the same people responsible for an activity also run the PIA process, there may be insufficient objectivity or willingness to make the process useful. When major disagreements break out among agency components with an interest in a PIA process, the ability of the CPO to take a major issue directly to the head of the agency may come into play. See section (9)(e)(1).

Paragraph (2) states that a final written report is a part of the process, and paragraph (3) makes clear that the report should be public unless parts are classified or unsuitable for public disclosure under existing laws and Executive Orders. An agency cannot make up a new reason for withholding the report that is not firmly rooted in an existing law or policy addressing confidentiality. Except in narrow circumstances – e.g., when an activity is classified in its entirety – some elements of a report should be available for public disclosure.

Paragraph (4) addresses the difficult problem of the timing of the PIA process. There may be circumstances requiring that an activity begin operations (or implement changes to an existing activity) before the agency can complete the PIA process. The agency CPO manages the timing of the process and public reporting on the process. The CPO can hold up an activity when appropriate in order to make public disclosure and seek public input. An agency component should not be rewarded if it delays elements of the PIA process, but at the same time, agency operations should continue in an appropriate and efficient manner. The tradeoffs here can be difficult, and the CPO must resolve them.

Paragraph (5) requires that the agency CPO send copies of each interim and final report on a PIA process to appropriate congressional committees. This means oversight committees, including the committees that originated the USA FIPS Act, authorizing committees that produced the legislation for the programs, and appropriations committees that approve funding. There may be other committees with an interest as well.^[229]

(d) ELEMENTS OF A PRIVACY IMPACT ASSESSMENT PROCESS.

(1) An agency conducting a thorough privacy impact assessment process shall, to the extent practicable, include –

(A) an identification of risks to the agency from the processing of records, including a description of ways to manage and to mitigate the risks and a justification for the final choices made by the agency;

(B) an identification of information technology available to support the processing of records, including a justification for the final choices made by the agency;

(C) an analysis of the risks and consequences of the activity for privacy of data subjects, including expected uses and disclosures; a description of possible ways to mitigate the consequences and risks; and a justification for the final choices made by the agency; and

(D) a description of efforts to seek public and stakeholder participation in the privacy impact assessment process and a response by the agency to public and stakeholder comments.

(2) An agency conducting a limited privacy impact assessment process shall, to the extent practicable, include –

(A) an explanation of the reasons that the agency decided to conduct a limited rather than a thorough privacy impact assessment process;

(B) a description of the risks and consequences of processing of records for the agency and for data subjects;

(C) a description of alternatives considered;

(D) a justification for the final choices made by the agency; and

(E) a summary of any public and stakeholder participation and comments.

Subsection (d) sets out the elements of a thorough and a limited PIA process. In both cases, the proposal says to the extent practicable. This intentionally gives some discretion to the agency CPO to adjust a PIA process to the nature of the activity, the needs of the agency, and the resources and time available for conducting a PIA process.

There are four elements to a thorough PIA process. First, the process should identity the risks to the agency from the processing of records. This includes describing ways to manage and to mitigate the risks and a justification for the final choices made by the agency. In other words, the process should not just be descriptive but should identify what alternatives the agency considered and how and why the agency made decisions between the choices identified. The process should be similar to an exam that asks a student to produce an answer and to show the way that the answer was achieved.

Second, the process should identify the information technology available to support the processing of records, including a justification for the final choices made by the agency. As with the first element, this one requires the agency to show the alternatives considered and to justify its final choice.

Third, a thorough process should analyze the risks and consequences of the activity for privacy of data subjects, including expected uses and disclosures and a description of possible ways to mitigate the risks and consequences and a justification for the final choices made by the agency. A focus here should be on looking for ways to limit uses and disclosures. In particular, this means making sure that each agency designated disclosure is both necessary and as narrow as possible.

Finally, the process should describe efforts to seek public and stakeholder participation in the assessment, including a response by the agency to public and stakeholder comments. This element emphasizes the importance of public and stakeholder participation. An agency has considerable discretion to determine how to involve the public and stakeholders in the assessment, and here too, the agency must explain and justify its choices. As with a formal notice and comment process, the agency should explain why it did or did not adopt suggestions that it received.

A limited PIA process has five elements that are less intensive than the elements required for a thorough assessment. First, the agency must explain why it chose a limited assessment. Second, the agency must describe the risks and consequences of the processing. Presumably, the stakes in an activity that qualifies for a limited assessment will be lower than for activities that receive a thorough assessment. Third, the agency must describe alternatives considered. Fourth, the agency must justify the final choices. Finally, the agency must summarize agency and stakeholder participation and comments.

A limited PIA process might be used when processing is narrow and where the stakes are limited. An A3P that collects parking permit data from agency employees would likely qualify for a limited process. Also, a modest change to an existing A3P – such as the addition of a new ADD because of a new statutory requirement – might also be addressed through a limited PIA process. Small substantive changes to an A3P might call for a limited PIA process with a report that might be a page or two. Descriptive or similar minor changes might not require any PIA.

(e) PUBLIC NOTICE AND PARTICIPATION. The Chief Privacy Officer of an agency shall, to the extent practicable, provide for public notice of each privacy impact assessment process and for public comment or other public participation in the process. The Chief Privacy Officer may provide public notice through the privacy website of the agency or through the Federal Register.

Subsection (e) provides that the CPO must provide for public notice of each PIA process, as well as for public comment or other public participation in the process. With a major A3P, especially one affecting many members of the public, the process might warrant public hearings of some type or public listening sessions with stakeholder and issue advocates, with industry, and perhaps with technology experts. The agency CPO has considerable discretion to design the role and timing of public and stakeholder participation. The timing of that participation is important. It will only be valuable if done as early in the decision-making process as possible. If the design of an activity changes in the course of planning, there could be a need for more than one round of public participation.

Major new systems and controversial uses of technology will most likely call for greater participation. Stakeholders can include the public, other agencies, and private companies that have an interest in the activity. The requirements for notice and participation are modified by the now familiar words to the extent practicable. This recognizes that one size will not fit every activity and that time and resources are limited. Hard choices may be necessary, but the discretion allowed should not be taken as an excuse for avoiding input from outside the agency.

The importance of public participation cannot be overemphasized. In one instance, an agency developed the use of a new technology and a new Privacy Act system of records that was expected to affect many members of the public on a routine basis. I observed and participated in an early and informal (and off-the-record) listening session between the agency planners and representatives from the privacy community. The result of the discussion was a significant change in design that made the program both more effective and less intrusive. At the end of the process, the agency representative thanked the privacy community for its input and expressly acknowledged the valuable assistance provided. The emphasis in the bill for consultations recognizes that agencies do not necessarily know everything that they should know or need to know when planning activities. Other perspectives can produce results that may be better for the agency and for data subjects.

Part of the discretion allowed to the CPO is how to engage the public. Federal Register notices are a traditional way of providing public notice, but an agency must choose to use the agency’s privacy website either instead of or in conjunction with a Federal Register notice. For example, a Federal Register notice might direct interested parties to the agency website where relevant documents and other materials will be found. A limited PIA process may call for only the most minimal public participation, perhaps through a website notice inviting public comment. Nothing prevents a CPO from reaching out in other ways to find and engage interested stakeholders.

(f) PUBLIC LAW 107-437. – An agency or component that completed the transition to this Act shall not comply with section 208 of Public Law 107-437, 44 United States Code § 3501 note.

Finally, as noted above, the existing PIA requirement in the Electronic Government Act of 2002 leaves much to be desired. The bill provides that an agency that completed the transition from the Privacy Act to the USA FIPS Act cannot comply with the existing requirement. The agency must use the new requirement and cannot choose to use the old one instead.

A provision in Section 20 of the USA FIPS Act addresses how an agency should conduct a PIA process during the period of transition from compliance with the Privacy Act to compliance with the USA FIPS Act.

(a) LIMITS ON ACCESS. – Nothing in this Act shall allow an individual a right of access to a record or a disclosure history record, or a right of amendment of (1) any information compiled in reasonable anticipation of a civil action or proceeding, (2) any classified information; (3) data or information acquired by an agency under a pledge of confidentiality and used or disclosed for exclusively statistical purposes pursuant to section 3572 of title 44, United States Code; (4) any information created as testing or examination material used solely to determine individual qualifications for appointment or promotion in the Federal service if disclosure would compromise the objectivity or fairness of the testing or examination process; or (5) information that was exempt from disclosure under section 552a of title 5, United States Code, as information collected prior to the effective date of section 3 of the Privacy Act of 1974 (Public Law No. 93-579) under an implied promise that the identity of the source would be held in confidence.

Subsection (a) of Section 12 includes the two unlabeled exemptions contained in the Privacy Act. One is for attorney work product information and the other is for classified information. In both instances, nothing in the USA FIPS Act requires an agency to provide an individual a right of access, amendment, or a disclosure history. Another existing and more “classical” specific exemption in the Privacy Act covers systems of records “required by statute to be maintained and used solely as statistical records.”^[230] Because an exemption for these records is only appropriate for the access and amendment provisions, that exemption fits well here. The same is true for testing or examination material used in the civil service if disclosure would compromise the process.^[231]

The provision also continues protections for information collected before the effective date of the Privacy Act (September 27, 1975) for information obtained at a time when there was no requirement for express promises of confidentiality. The need to continue this protection is marginal. At best, any of these sources provided information probably fifty or more years before the effective date of the USA FIPS Act. This exemption is here just in case there are still some sources that warrant protection.

(b) PERSONNEL INVESTIGATIONS AND EVALUATIONS. – An agency is exempt from the requirement in subsection (a) of section 4 to process only relevant and necessary information and from the requirements in section 7 and section 8 to provide an individual a right of access, a right of amendment, or a disclosure history record with respect to any information that would identify a confidential source who furnished information to the Government under an express promise that the identity of the source would be held in confidence if the information was created as –

(1) investigatory material solely for the purpose of determining suitability, eligibility, or qualifications for Federal civilian employment, military service, Federal contracts, or access to classified information.

(2) evaluation material to determine potential for promotion in the armed services.

Subsection (b) consolidates the federal personnel exemptions from subsection (k) of the Privacy Act for investigations and evaluations. As with existing law, the main purpose is to protect those who provided information under an express promise of confidentiality. These are precisely the same interests that the current exemptions protect. The exemptions are from the rights for access, amendment, and disclosure history. The provision also continues an exemption from the requirement to process only relevant and necessary information (now in subsection (a) of section 4. That exemption remains appropriate for investigations and evaluations because it is not always clear what information will be relevant or necessary to those processes.

(c) INVESTIGATORY MATERIAL FOR LAW ENFORCEMENT PURPOSES. –

(1) An agency is exempt from the requirement in subsection (a) of section 4 to process only relevant and necessary information, and from the requirements in section 7 and section 8 to provide an individual a right of access, a right of amendment, or a disclosure history record, for investigatory information compiled for law enforcement purposes unless the individual is denied any rights, benefits, privileges, or status that the individual would otherwise be entitled to by Federal law, or for which the individual would otherwise be eligible, as a result of the maintenance of the information.

(2) Any right of access, right of amendment, or a disclosure history record in section 7 and section 8 that an individual would have as a result of a denial of any rights, benefits, privileges, or status as described in paragraph (1) of this subsection shall not apply to –

(A) the extent that the disclosure of the material would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence;

(B) information exempt from disclosure pursuant to subsection (a)(5) of this section; or

(C) information that qualifies for exemption as criminal law enforcement information in subsection (f).

Subsection (c) is a replacement for the (k)(2) exemption in the Privacy Act. The provision exempts investigatory information compiled for law enforcement purposes from the requirement to process only relevant and necessary information. In addition, it includes an exemption from rights of access, amendment, and disclosure history but this exemption applies only if an individual was denied a right, benefit, privilege, or status as a result of the maintenance of the information. However, protections for sources who provided information under an express promise of confidentiality that exist in current law remain in place. The only modest substantive change is the addition of the word status to right, benefit, and privilege. The rights of access, amendment, and disclosure history granted under the limitation do not apply to information obtained prior to the effective date of the Privacy Act under an implied promise of confidentiality as to the identity of the source of the information, or to information subject to the exemption in subsection (f) for criminal law enforcement information.

As with the Privacy Act, the exemptions in subsection (c) cover material compiled for an investigative law enforcement purpose. That purpose can be civil or criminal. The criminal component here only applies to law enforcement agencies that are not principally criminal law enforcement agencies. Subsection (f) covers those agencies. The exemption here does not apply to material compiled solely for routine background investigations for security clearances. Subsection (b) covers employment related investigations, including for clearances. The discussion in this subsection does not change existing interpretations of the Privacy Act.

(d) PROTECTIVE SERVICES. –An agency activity affecting privacy operated by an agency in connection with providing protective services to the President of the United States or other individuals pursuant to section 3056 of title 18, United States Code, is exempt from the requirement in subsection (a) of section 4 to process only relevant and necessary information, and from the requirements in section 7 and section 8 to provide an individual a right of access, a right of amendment, or a disclosure history record to the extent that records in the agency activity affecting privacy relate to those protective services.

Subsection (d) covers protective services for the President and others. It continues the existing Privacy Act exemption from the requirement to process only relevant and necessary information and from rights of access, amendment, and disclosure history. As with current law, the limit on the exemption for denial of rights, benefits, and privileges does not apply here. Protective functions straddle the line between law enforcement and criminal law enforcement activities. Because the USA FIPS Act allows agencies broad discretion to decide what functions to include in an A3P, additional language here makes it clear that the exemption only applies to records that relate to protective services. An agency cannot add other functions to an A3P and then claim the exemption for functions unrelated to protective services.

(e) INTELLIGENCE AGENCIES. –

(1) An intelligence agency or component thereof defined as part of the Intelligence Community pursuant to section 3003, title 50, United States Code is exempt from –

(A) the requirements to comply with subsections (a), (b), (c), and (d) of section 4; and

(B) the requirements in section 7 and section 8 to provide an individual a right of access, right of amendment, or a disclosure history record.

Subsection (e) expands on the CIA exemption in (j)(1) of the Privacy Act by extending the same exemption to any intelligence agency or component identified pursuant to 50 U.S.C. § 3003. That provision is currently implemented through Executive Order 12333. The Privacy Act states the CIA exemption in a negative way, but subsection (e) states the exemption affirmatively. It only names those provisions of the Act for which the bill allows an exemption. The effect is to remove the possibility for exemptions from irrelevant provisions of the Act. The exemptions affirmatively provided cover the requirements for relevant and necessary processing; direct collection; notice at time of collection; and accuracy, relevance, timeliness, and completeness. These are in section (4)(a)-(d) of the USA FIPS Act. There is also an exemption from the right of access, amendment, and disclosure history. These exemptions cover the core needs of intelligence agencies. There is no exemption from requirements to publish descriptions of A3Ps or agency rules. The requirement for publishing descriptions of all A3Ps continues the core philosophy of the Privacy Act that no agency should maintain secret records systems hidden from the public. As with existing law, there is no intelligence agency exemption from the limit on collecting records about First Amendment activities.

(f) CRIMINAL LAW ENFORCEMENT AGENCIES. – A criminal law enforcement agency or component thereof that performs as its principal function any activity pertaining to the enforcement of criminal laws, including police efforts to prevent, control, or reduce crime or to apprehend criminals, and the activities of prosecutors, courts, correctional, probation, pardon, or parole authorities, is exempt from the requirement to comply with subsections (a), (b), (c), and (d) of section 4, and from the requirements in section 7 and section 8 to provide an individual a right of access, a right of amendment, or a disclosure history record with respect to any records that consist of –

(1) information compiled for the purpose of identifying individual criminal offenders and alleged offenders and consisting only of identifying data and notations of arrests, the nature and disposition of criminal charges, sentencing, confinement, release, and parole and probation status;

(2) information compiled for the purpose of a criminal investigation, including reports of informants and investigators, and associated with an identifiable individual; or

(3) reports identifiable to an individual compiled at any stage of the process of enforcement of the criminal laws from arrest or indictment through release from supervision.

Subsection (f) provides an exemption that is the equivalent of the Privacy Act’s (j)(2) exemption for criminal law enforcement activities. As with the existing provision, the proposed exemption is available only to a criminal law enforcement agency or component thereof that performs as its principal function any activity pertaining to the enforcement of criminal laws. The case law here reflects some confusion by the courts. For the criminal law enforcement exemption to apply, the enforcement of criminal law must the principal – meaning primary – function of the agency or component. An agency with two principal functions cannot use this exemption if only one of those functions is an activity pertaining to the enforcement of criminal laws. Many agencies meet the threshold requirement here, including the FBI and the DEA. The IRS is not principally a criminal law enforcement agency, but its Criminal Investigation Division qualifies as a component whose principal function is enforcement of criminal law. Similarly, Offices of Inspectors General have multiple functions that include enforcement of criminal laws as one of those functions, but criminal law enforcement is not the principal function of an IG.^[232] An A3P operated by a criminal investigation unit within an IG’s office can qualify, however.

Once the threshold requirement is met, a record is only exempt if it falls within one of three categories of information compiled for a specific purpose. The proposal repeats the language in the Privacy Act without change. Here too, there is case law that ignores the requirement that records fall within one of the three specified categories. The reenactment of the provision unchanged should not be read as supporting that line of cases. Given the potential breadth of an A3P under the USA FIPS Act, it is crucial that records meet all the requirements in order to qualify for an exemption. An agency may choose to include within a single A3P records that qualify along with records that do not qualify. However, only those records falling within one of the three categories qualify for exemption.

(g) NATIONAL ARCHIVES AND RECORDS ADMINISTRATION. – Any record subject to this Act accepted by the National Archives of the United States as a record with sufficient historical or other value to warrant its continued preservation by the United States Government pursuant to section 2107 of title 44, United States Code, and that the Archivist of the United States processes pursuant to section 2108 of title 44 United States Code, shall not be subject to any of the requirements of this Act.

Subsection (g) exempts from the USA FIPS Act records accepted by the National Archives for historical preservation or otherwise under 44 U.S.C. § 2107. As explained in the discussion of the exemptions in the Major Issues section of this report, the exemption is slightly modified from the Privacy Act. Current law still applies the publication requirement of the Privacy Act. However, other laws fulfill the purpose of the publication requirement so the requirement is unnecessary.

(h) GENERAL REQUIREMENTS. –

(1) When publishing a notice of an agency activity affecting privacy that includes a record exempt or potentially exempt under provisions of this section, an agency shall, to the extent practicable, describe the activities that qualify for the exemption and distinguish exempt and non-exempt records and activities. The agency shall include in the notice the reasons the agency expects to utilize the exemptions.

(2) In applying an exemption available under this section, an agency shall restrict application of the exemption to those records and activities that include information that the exemption seeks to protect.

(3) If an agency discloses a record exempt under this section from any provision to another agency, the record shall continue to be exempt in the same manner and to the same extent as if the disclosing agency continued to process the record. An agency transferring an exempt record shall identify for the recipient agency the part of the record that qualifies for exemption and the nature and scope of the exemption.

Subsection (h) seeks to limit the actual application of exemptions in practice. First, it provides that an agency must in its A3P notice describe its activities that qualify for an exemption and distinguish exempt from non-exempt records and activities. This notice obligation applies to the extent practicable. It may not be possible in a general notice to delineate all lines between exempt and non-exempt records when both types are part of the same A3P. Of course, it might be better to have exempt records in their own A3P. However, that may not always be possible or practical, especially when an A3P has only occasional exempt records. An A3P that has exempt records must include in the published notice the reasons the agency expects to use the exemptions. This will inform the public why records may be exempt and how to distinguish between exempt and non-exempt records.

Second, when invoking an exemption, an agency must restrict application of the exemption to those records and activities that include information that the exemption seeks to protect. This underscores that an agency must specifically justify its use of exemptions when actually applying the exemptions and not just when publishing an A3P notice. However, where records are exempt because of maintenance by an intelligence agency, criminal law enforcement agency, or protective services agency, the agencies are not obliged to review individual records or parts of records to determine the relevance of an exemption. When they apply, these exemptions are categorical, although as subsection (i) makes clear, an agency can waive exemptions.

Third, the USA FIPS Act expressly addresses the problem of the travelling exempt record by providing that an exempt record retains its exempt status when disclosed to another agency. The exemption in the hands of the recipient agency is precisely the same as if the disclosing agency still maintained the record. A different exemption may possibly apply to the records in the hands of the recipient agency, and a recipient agency may also apply that different exemption to that record when applicable. An agency providing an exempt record to another agency must identify the part of the record that qualifies for exemption as well as the nature and scope of the exemption. Failure to provide the proper identification does not cancel the exemption, however.

(i) WAIVERS. – An agency processing a record that qualifies for exemption in this section may take one or more of the following actions –

(1) waive application of an exemption, in whole or in part, by including the waiver in the description required in section 5(c) of an agency activity affecting privacy;

(2) issue a regulation defining when the agency may waive application of an exemption, in whole or in part; and

(3) waive application of an exemption in whole or in part or on a case-by-case basis.

Subsection (i) expressly authorizes an agency to waive an exemption either in the description of an A3P, by issuing a regulation, or through case-by-case decisions. This provides agencies with great flexibility to waive exemptions when records do not need the protections available. This provision resulted in part from a review of the CIA’s regulation formally waiving Privacy Act exemptions discussed above. Other agencies waive exemptions as well from time to time. However, it would be challenging to provide statutory standards for waiving exemptions and any attempt to do so would just create opportunities for additional litigation. The better alternative is to give agencies express authority to do so without a mandate to do so. Essentially, subsection (i) gives agencies a free hand to waive exemptions as they see fit. Of course, other laws and policies that prohibit discriminatory practices continue to apply. It would be improper to waive exemptions for men but not women, for example. Otherwise, the objective is to give agencies broad discretion as well as encouragement to waive the use of exemptions when the exemptions are not needed in fact.

****

In some instances, the Privacy Act allows agencies to exempt a system of records from the civil remedies provision of the Act. This is a particularly unusual type of exemption that appears to deny any possibility of a judicial remedy. The courts often avoid giving this provision the broad application that it appears to have. At least one agency (Housing and Urban Development) – and perhaps others – did not invoke this exemption even though it could have. The responsible official reportedly said at the time that the agency should be held accountable for compliance with the Privacy Act. That is the approach taken here. The USA FIPS Act allows no exemption from civil remedies.

(a) OFFENSES. –

(1) Any person who knowingly and in violation of this Act and under false pretenses obtains a record that contains personally identifiable information shall be punished as provided in subsection (b).

(2) Any officer, employee, contractor, grantee, or volunteer of an agency, or other person who by virtue of employment, official position, or contract has possession of, or access to, a record that contains personally identifiable information the disclosure of which is prohibited by this Act or by rules or regulations established thereunder, and who knowing that disclosure of the record is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be punished as provided in subsection (b).

Subsection (a) of section 13 defines two crimes similar to existing Privacy Act crimes but with stiffer penalties. The first is for seeking a record under false pretenses. An individual who improperly seeks a record about another individual might violate this provision. The second crime is for disclosing a record in violation of the Act. The new provision makes it clear that contractors, grantees, volunteers, and other persons who have legitimate access to a record can be found guilty of improper disclosure as can officers and employees already expressly covered by the existing provision.

(b) PENALTIES. – A person described in subsection (a) shall –

(1) be fined not more than $50,000, imprisoned not more than 1 year, or both;

(2) if the offense is committed with intent to sell, transfer, or use a record that contains personally identifiable information for commercial advantage, personal gain, or malicious harm, be fined not more than $250,000, imprisoned not more than 10 years, or both.

The penalties in subsection (b) are similar to penalties in HIPAA for wrongful disclosure of individually identifiable health information.^[233] The basic penalty is a fine up to $50,000, imprisonment up to a year, or both. Enhanced penalties apply if an offense is committed with intent to sell, transfer, or use a record for commercial advantage, personal gain, or malicious harm. Penalties can range up to $250,000, ten years in prison, or both. These are significant penalties when an individual improperly obtains or discloses PII.

(c) PUBLISHING. – Any officer or employee of any agency who willfully establishes or maintains an agency activity affecting privacy without meeting the requirements in section 3 to publish a description of the agency activity affecting privacy shall be guilty of a misdemeanor and fined not more than $5,000.

Subsection (c) continues the misdemeanor penalty in the Privacy Act for maintaining an agency activity affecting privacy without publishing the requisite notice. I proposed to eliminate this crime entirely. However, agency Privacy Act officers said that while this penalty may be largely unenforceable, it was effective in convincing program officials that they must comply with the requirement to publish a notice. That is the only reason this provision remains. Subsection (d) provides for adverse personnel action against a violator, and that provision overlaps with the crime in subsection (c). Adverse personnel actions may actually provide a better incentive than criminal law to encourage compliance.

(d) ADVERSE PERSONNEL ACTIONS. – An officer or employee of an agency who processes records in violation of this Act shall be subject to appropriate administrative discipline including, when circumstances warrant, suspension from duty without pay or removal from office.

Subsection (d) provides that an agency officer or employee who processes records in violation of the USA FIPS Act shall be subject to appropriate administrative discipline including, when circumstances warrant, suspension from duty without pay or removal from office. This language is modeled on two provisions in title 31. One provides for adverse personnel actions against those who authorize an expenditure or obligation in violation of law.^[234] The other provision similarly penalizes those who exceed limitations on expending and obligating amounts in excess of appropriations.^[235]

(a) MATCHING AGREEMENTS. –

(1) CONTENTS OF MATCHING AGREEMENTS. – A source agency shall not disclose a record processed as part of an agency activity affecting privacy for use in a matching program except pursuant to a written agreement between the source agency and the recipient agency or non-Federal agency receiving the records, specifying –

(A) the purpose and legal authority for conducting the program;

(B) the justification for the program and the anticipated results, including a specific estimate of any savings resulting from the operation of the program;

(C) a description of the records that will be matched, including each data element that will be used, the approximate number of records that will be matched, and the projected starting and completion dates of the matching program;

(D) procedures for providing individualized notice at the time of application, and notice periodically thereafter. to data subjects whose records are used in the activity that any information provided by the data subjects may be subject to verification through matching programs;

(E) procedures for verifying information produced in the matching program as required by this section;

(F) procedures for the retention and timely destruction of identifiable records created by a recipient agency or non-Federal agency in the matching program;

(G) procedures for ensuring the administrative, technical, and physical security of the records matched and the results of the programs;

(H) prohibitions on duplication and redisclosure of records imposed by the source agency on the recipient agency or the non-Federal agency, except where duplication or redisclosure is required by law or essential to the conduct of the matching program;

(I) procedures governing the use by the recipient agency or non-Federal agency of records provided in a matching program by a source agency, including procedures governing return or destruction of the records used in the program;

(J) information on assessments that have been made on the accuracy of the records that will be used in the matching program;

(K) that the Comptroller General may have access to all records of a recipient agency or non-Federal agency receiving the records as the Comptroller General deems necessary in order to monitor or verify compliance with the agreement;

(L) a provision requiring revision or termination of the agreement if the need for, circumstances relating to, or the law regarding any aspect of the matching agreement changes in a material way during course of the agreement; and

(M) the expiration date for the agreement, which can be no later than five years after the agreement took effect.

(2) CERTIFICATION OF MATCHING AGREEMENT. – No matching agreement shall take effect unless the Chief Privacy Officer of the source agency certifies in writing that –

(A) the agreement complies with all requirements of this Act;

(B) the Chief Privacy Officer of the source agency consulted with the agency Inspector General, Chief Information Officer, Chief Data Officer, and senior officials from the office providing or using records for the matching program activity about the justification for the matching program;

(C) any findings of the agency Inspector General or the Government Accountability Office relevant to the matching program were adequately taken into account in the agreement;

(D) any problems identified in previous matching programs between the same agencies were adequately addressed;

(E) except for matching programs mandated by statute, in the judgment of the Chief Privacy Officer of the source agency, the sharing of records pursuant to the matching agreement is financially justified based on any relevant results of current or past matching programs; and

(F) except for matching programs mandated by statute, in the judgment of the Chief Privacy Officer of the source agency, the matching program is in the public interest.

(3) PRIOR COMPLIANCE REQUIRED. – No source agency may enter into a second or subsequent matching agreement unless –

(A) the recipient agency or non-Federal agency receiving the records certifies that it complied with the provisions of previous agreements; and

(B) the source agency has no reason to believe that the certification is inaccurate.

(4) POSTING. – A copy of each matching agreement and a copy of the certification of the Chief Privacy Officer shall be posted on the website of the source agency and sent to the Director of the Office of Management and Budget.

(5) EFFECTIVE DATE OF AGREEMENT. – No matching agreement shall be effective until 30 days after the date on which a copy is posted on the agency website.

(6) SECTION NOT AUTHORITY TO CONDUCT PROGRAMS. – Nothing in this section may be construed to authorize –

(A) any matching programs not otherwise authorized by law; or

(B) disclosure of records for a matching program except to a Federal, State, or local agency.

Paragraph (a)(1) sets out the requirement content of a matching agreement between a source agency and a recipient agency or non-Federal agency. Most are the same as current law. Subparagraph (L) addresses the need for revision or termination language in an agreement in case of material change during the course of an agreement. The possibility of revision or termination is important because matching agreements can, as provided in subparagraph (M), last five years. This replaces the current period of 18 months with the possibility of a one-year extension. That relatively short period created unnecessary paperwork.

Paragraph (a)(2) imposes on the agency CPO a responsibility to certify in writing that a matching agreement compiles with all requirement of the USA FIPS Act. When the agency is a source agency, the CPO must also certify that the CPO consulted with the agency Inspector General, CIO, and Chief Data Officer, as well as with senior officials from the office providing or using records about the justification for the matching program. This is a partial substitute for the existing requirement, often ignored, that agencies assess the costs and benefits of matching activities. The CPO must also certify that any relevant findings about the matching program from the agency IG or from GAO were adequately taken into account. The CPO must also certify that the matching activity addressed any identified problem in previous matching programs.

Two additional required certifications place considerable responsibility on the agency CPO. Both apply except where a statute mandates that a matching program occur. First, the CPO must express a judgment that the matching activity is financially justified based on relevant results of current or past matching programs. This too is a substitute for the existing requirement that the agency assess costs and benefits of matching. Placing specific responsibility on an identified official rather than an unfocused and poorly defined requirement on an agency should produce a better result. The sharing of records always presents privacy concerns, and if the sharing is not financially justifiable, then the sharing should be reconsidered and ended when appropriate. The second certification calls on the CPO to express a judgment that the matching program is in the public interest. Record sharing through matching may have different purposes. While many of those purposes may relate to financial matters, there may be other reasons why sharing should not be allowed. The public interest standard here is broad and allows a CPO to weigh all relevant factors related to a matching program and express a judgment.

Paragraph (a)(3) imposes another administrative control on matching. It prevents a source agency from entering into a second or subsequent agreement unless the other agency involved certifies in writing that it complied with the provisions of previous agreements. In addition, the source agency must have no reason to believe that the certification is inaccurate. Each source agency can establish the content and form of a certification. These requirements are virtually identical to those found in subsection (q) of the Privacy Act.

Paragraph (a)(4) provides for the posting of a copy of each matching agreement together with the certification of the FPO on the source agency’s website. A copy of the agreement also must go to OMB. The bill does not continue the requirement for congressional notification.

Paragraph (a)(5) provides that a matching agreement cannot be effective until posted on the agency website for 30 days.

Paragraph (a)(6) continues existing language from the Computer Matching and Privacy Protection Act of 1988.^[238] One provision makes it clear that the USA FIPS Act does not authorize any matching program not otherwise authorized by law. The Act regulates matching, but it does not provide independent authority for matching. Another provision that was part of the 1988 Act makes it clear that the USA FIPS Act does not authorize disclosing records to anyone other than a government agency for a matching activity. Any authority for other disclosures must derive from another law.

(b) VERIFICATION AND OPPORTUNITY TO CONTEST FINDINGS. –

(1) TIME FOR NOTICE AND RESPONSE. – In order to protect an individual whose record is used in a matching program, no source agency or non-Federal agency using a record from a matching program may suspend, terminate, reduce, or make a final denial of any financial assistance or payment under a Federal benefit program to the individual, or take other adverse action against the individual, as a result of information produced by the matching program, until –

(A)(i) the source agency has independently verified the information; or

(ii) the Chief Privacy Officer of the source agency determines in accordance with guidance issued by the Director of the Office of Management and Budget that–

(I) the information is limited to identification and amount of benefits paid by the source agency under a Federal benefit program; and

(II) there is a high degree of confidence that the information provided to the recipient agency is accurate;

(B) the individual receives a notice from the agency containing a statement of its findings and informing the individual of the opportunity to contest the findings; and

(C) the expiration of –

(i) any time period established by statute or regulation for the individual to respond to that notice; or

(ii) in the case of a program for which no the period is established, the end of the 30-day period beginning on the date on which notice under subparagraph (B) is mailed or otherwise provided to the individual.

(2) BASIS FOR ADVERSE ACTION. – The independent verification referred to in paragraph (1)(A)(i) requires investigation and confirmation of specific information relating to an individual that is used as a basis for an adverse action against the individual, including where applicable investigation and confirmation of–

(A) the amount of any asset or income involved;

(B) whether the individual actually has or had access to the asset or income for the individual’s own use; and

(C) the period or periods when the individual actually had the asset or income.

(3) HEALTH AND SAFETY EXCEPTION. – Notwithstanding paragraph (1), an agency may take any appropriate action otherwise prohibited by the paragraph if the agency determines that the public health or public safety may be adversely affected or significantly threatened during any notice period required by the paragraph.

Subsection (b) contains the verification requirements for matching. These are largely unchanged, except that the responsibility that the Privacy Act assigns to Data Integrity Board is given to the agency CPO.

Paragraph (b)(3) is the same as current law. The reason for highlighting the health or safety exception here is the COVID-19 pandemic. An agency has broad authority to take appropriate action that might be otherwise prohibited in paragraph (b)(1) if public health or public safety may be adversely affected or significantly threatened by the notice period. That means that any matching activity that falls under the USA FIPS Act should not interfere with any appropriate public health activities responsive to the pandemic or any similar threat.

(a) WAIVER. – A waiver of the rights under provided under section 7 and section 8 of this Act is against public policy and is void and unenforceable.

Subsection (a) provides that an individual’s waiver of the rights under section 7 and section 8 of the Act is against public policy and is void and unenforceable.^[239] These are the rights of access, the right to request an amendment, and the right to request a disclosure history. No federal agency can ask for or honor a waiver of these rights. This restriction on waiver of rights has nothing to do with, and does not affect, an individual’s ability to waive their privacy rights in order to permit disclosure of that individual’s records to a third person under the FOIA or otherwise.

(b) SALE OF PERSONALLY IDENTIFIABLE INFORMAITON. – An individual’s name; postal and electronic addresses; telephone numbers; and other personally identifiable information may not be sold or rented by an agency unless specifically authorized by statute. This provision shall not be construed to require the withholding of personally identifiable information otherwise permitted to be made public.

Subsection (b) continues an existing provision of the Privacy Act that prohibits an agency from selling or renting of mailing lists unless specifically authorized by law. The revised provision makes it clear that the prohibition extends to all other PII, not just addresses. Any allowable sale or rental must be specifically authorized by statute. As with the current provision, the prohibition does not interfere with the disclosure of PII otherwise permitted to be made public. Thus, this prohibition would not affect a statute that makes public ethics filings by government officials.

(c) EFFECT OF OTHER LAWS. –

(1) FOIA EXEMPTIONS NOT APPLICABLE TO RIGHTS UNDER THIS ACT. – No agency shall rely on any exemption contained in section 552 of title 5, United States Code, to withhold from an individual any record that is otherwise accessible to the individual under the provisions of this Act.

(2) EXEMPTIONS UNDER THIS ACT NOT APPLICABLE TO FOIA. – No agency shall rely on any exemption in this Act to withhold from an individual any record that is otherwise accessible to the individual under the provisions of section 552 of title 5, United States Code.

Subsection (c) continues existing language in subsection (t) of the Privacy Act about the interplay between the FOIA and the USA FIPS Act. An agency cannot rely on a FOIA exemption to withhold a record that is otherwise accessible under the USA FIPS Act. Similarly, exemptions in the USA FIPS Act cannot be used to withhold from an individual any record that would otherwise be accessible to that individual under the FOIA. Both provisions came about when the Department of Justice began to argue in the early 1980s that the Privacy Act or the FOIA authorized withholding of records from individuals for which there was no justification.

(d) RIGHTS OF PARENTS AND GUARDIANS. – A parent, guardian, other person acting in loco parentis, or person with a valid power of attorney who under applicable law has authority to act on behalf of an individual may act on behalf of the individual under this Act.

Subsection (d) continues and expands upon an existing provision in subsection (h) of the Privacy Act regarding rights of legal guardians. First, the language is a bit more expansive in describing who can act on behalf of another individual, including now specifying that a person with a valid power of attorney may also act on behalf of the individual under the USA FIPS Act. The bill drops language in the Privacy Act requiring an individual to be first declared to be incompetent by a court. Instead, the bill borrows language from HIPAA about authority to act on behalf of an individual.^[240] Requiring formal proceedings before an individual can act on behalf of a spouse, adult child, or parent in cases involving dementia, impairment, or other circumstances is too restrictive. Agencies will have more leeway to act appropriately and compassionately here in accordance with any applicable law.

(e) REPORT TO CONGRESS. – Each agency that proposes to establish or make a change in an agency activity affecting privacy that significantly limits or otherwise alters the rights and opportunities available to individuals under this Act, or that adds or significantly modifies an agency designated disclosure shall provide adequate advance notice to appropriate Committees of Congress and to the Office of Management and Budget.

Subsection (e) is comparable to subsection (r) of the Privacy Act, providing for reports on new or changed A3Ps or ADDs to appropriate House and Senate committees and to OMB.

(f) WEBSITE. – Each agency shall maintain a privacy website, with appropriate search, indexing, and finding aids, that allows for the full search and downloading of text maintained on the website. The website shall include –

(1) the notice for each current agency activity affecting privacy and any personally identifiable information processing diagram prepared in accordance with section 9(d) of this Act;

(2) a complete history of all changes made in the past ten years to the notice of each agency activity affecting privacy, including the full text of each prior published notice, an identification of all changes, and the date on which each change took effect;

(3) a complete list of all Federal Register notices, including all amendments, for each agency activity affecting privacy, together with an electronic or digital link to each notice;

(4) the text of all system of records notices and amendments published under the Privacy Act of 1974 for the ten-year period before completion of the agency transition to compliance with this Act;

(5) information about, and to the extent practicable, a copy of each privacy impact assessment report completed in the past twenty-years or currently being conducted;

(6) other information determined by the head of the agency or by the Chief Privacy Officer to be helpful to the public in understanding agency privacy activities, the provisions of this Act, and the exercise of privacy rights granted by this Act to individuals; and

(7) information about the agency’s plans for transition from compliance with the Privacy Act of 1974 to compliance with this Act.

Subsection (f) directs each agency to establish a privacy website and describes required content. The website must allow for the full search and downloading of all text maintained on the privacy website. The search capability must be able to limit the search to the contents of the privacy website separately from material maintained by the agency on other websites.

The website must include the current notice for each A3P. It must include any personally identifiable information processing diagram prepared in accordance with section (9)(d) of the Act. The website must include a complete history of all changes made in the past ten years to each A3P, including the full text of each prior published notice, an identification of all changes, and the date on which the changes became effective. The goal is to establish a one-stop shop so that individuals can see how an agency organized its records in the past and which description applied at what time. Another element is a list of all Federal Register notices for each A3P. These requirements apply after the effective date of the USA FIPS Act.

Each agency must also provide the text of all system of records notices and amendments published under the Privacy Act for the ten-year period prior to its transition to the USA FIPS Act. An agency may, but is not required to, tie previous systems of record notices to new A3Ps. Finding and cross-reference aids would be useful to the agency and the public, but the bill does not direct their creation.

The website must include information about each past PIA and about each PIA currently being conducted. The website must provide a copy of each PIA to the extent practicable. The practicability standard here recognizes that there may be elements of a PIA not suitable for public disclosure.

The website must include other information determined by the head of the agency or by the Chief Privacy Officer to be helpful to the public in understanding agency privacy activities, the provisions of the USA FIPS Act, and the exercise of privacy rights granted by this Act to individuals. Under this authority, it would be appropriate for an agency to include a form or method for an individual to make a request under the Act for access to or amendment of records.

Finally, the agency must post information about its plans for the transition from compliance with the Privacy Act to compliance with the USA FIPS Act.

(g) STATUTE OR TREATY. – The failure of an agency to identify a statute or treaty requiring or specifically authorizing disclosure of a record in any notice or publication under this Act shall not overcome any requirement or authorization to disclose the record as provided in the statute or treaty.

Subsection (g) addresses the requirement in section (6)(f)(2)(D) that an agency make a good faith effort to specify as an agency designated disclosure each statute or treaty that requires or specifically authorizes disclosure of personally identifiable information. Subsection (g) makes it clear that an agency’s failure in a published notice to identify a statute or treaty requiring or specifically authorizing disclosure of a record does not overcome the requirement or authorization to disclose a record as provided in the statute or treaty. It is likely that agencies will not always be able to find all of these provisions or to keep notices up-to-date. Substantive authority to disclose in another law remains valid. An agency should, upon finding an omission, promptly update its publications. The authority here to disclose notwithstanding a notice failure applies only to disclosures required by or specifically authorized by treaty. It does not extend to a disclosure that an agency must otherwise authorize by publishing an ADD.

The new administrative remedy has similarities to the process under the Freedom of Information Act. Under the FOIA, any person can request records from an agency. If that requester is not satisfied with the response (whether substantive or procedural), the requester can appeal to federal court.

Under section 19, any person can file a complaint with the CPO of an agency alleging based on specific facts that an agency failed to comply in a material way with the Act. Paragraphs (1) (A) through (E) provide examples of the types of agency failures that may give rise to a complaint, with (E) providing a catch-all for any failure not expressly specified otherwise.

Noteworthy elements for a complaint are the requirements that the complaint provide specific facts about the agency failure and that the failure to comply be material. A CPO can reject a complaint that lacks sufficient specificity to adequately identify the problem, support the allegations in the complaint, or explain the materiality of the failure. Thus, a CPO may reject a complaint that alleges that the agency’s ADDs are out-of-date if the complaint does not identify the ADDs in question or explain in a brief way why they are deficient. However, the burden on a complainant is limited. No complainant is obliged to file a lengthy legal brief or to make extensive factual arguments. A valid complaint could simply allege, for example, that the agency did not revise its A3P description for an agency program that significantly altered the way the agency processes PII. The materiality of some failures, such as an improper description, may be apparent. CPOs should not rely on overly technical complaint standards or reject complaints too quickly if there is a problem that can be identified and addressed, even if the problem is minor.

This broad standard gives the CPO leeway to reject complaints that are too vague, significantly incomplete or repetitive. It is possible that complaints will identify small matters that the CPO can readily correct. Trivial complaints (e.g., typographical errors in a description that do not interfere with understanding) might be rejected.

Paragraph (a)(3) sets out the process. The agency CPO must acknowledge a complaint within ten days of receipt. The bill is silent on the form of the written response, and the CPO can use postal mail or electronic mail depending on the method used to file the complaint or a method requested by the complainant. The CPO has 90 days to make a substantive response. The CPO can reject a complaint for lack of sufficient specificity to identify or support the allegations or for lack of merit. If the complaint is found meritorious, the CPO must promptly notify the complainant and must undertake reasonable steps to correct any identified deficiencies. A complaint may, of course, be accepted in part and rejected in part.

The CPO must determine what constitutes reasonable steps as a response to each meritorious complaint. Republication of a corrected A3P notice might be a reasonable step. Correction of material failures in an agency PIA process might reasonably require revision of the process or the report. The timing of the CPO’s response to a meritorious complaint should be judged by a reasonableness standard as well. Some errors may be readily corrected, but some may take months to complete. If a PIA process overlooked material considerations, a CPO may need to redo part of the process and the report, but it may take considerable time and effort to do so. Other priorities and available resources may be relevant to the scheduling of an unplanned major activity identified in a complaint. However, an indefinite postponement of a substantive correction of a failure identified in a meritorious complaint would not be reasonable.

Nothing in the administrative remedy requires an agency that receives a meritorious complaint to stop program operations, sharing of PII, or other lawful activities pending correction of failures to comply with the USA FIPS Act. No damages are available under the section 19 administrative remedy. A data subject can only seek damages under the civil remedies in section18.

(b) JUDICIAL REVIEW. –

(1) ACTIONS AUTHORIZED. – A complainant whose complaint under this section –

(A) was denied in whole or in part by the agency;

(B) was determined to be meritorious, but on which the agency unreasonably delayed corrective actions; or

(C) did not receive a substantive response from the agency within three months after filing the complaint –

may bring a civil action against the agency to obtain judicial review pursuant to sections 701 through 705 of title 5, United States Code, and the district courts of the United States shall have jurisdiction in the matter.

(2) VENUE. – An action under this section may be brought in the district court of the United States in the district in which the complainant resides, or has a principal place of business, or in which the agency headquarters are located, or in the District of Columbia, without regard to the amount in controversy.

(3) ORDERS. – The court may order the agency to correct any material failure to comply with this Act.

(4) COSTS. –The court may assess against the United States the costs of the action together with reasonable attorney fees and other litigation costs as determined by the court

in any case under this section in which the complainant has substantially prevailed.

Subsection (b) provides for judicial review of the CPO’s treatment of a complaint. Judicial review is the same as for any other administrative matter under the terms of the Administrative Procedure Act. There are three specific grounds for judicial review: an agency denied a complaint in whole or in part by the agency; an agency unreasonably delayed corrective actions identified by a meritorious complaint; or the agency did not respond substantively to the complaint within 90 days.

If a court finds that the agency failed to correct any material failure to comply with the USA FIPS Act, it may order the agency to correct the failure. This open-ended direction gives the court wide latitude to fashion an appropriate order, taking into account the nature of the agency’s failure and the time needed to correct the failure.

(a). EFFECTIVE DATE. – This Act shall take effect ten days after the date of enactment. Agencies shall comply with this Act as provided in this section.

The law is effective ten days after the date of enactment. The date on which agency must comply with the USA FIPS Act is not the date of enactment, but the date specified in other parts of section 20. The effective date marks the starting point for the law’s timed requirements.

(b) TRANSITION. – Within one year after the effective date of this Act, each agency subject to the Privacy Act of 1974 shall prepare a transition plan for changing its privacy compliance activities from section 552a of title 5, United States Code, to this Act. Each agency shall send a copy of its plan to the Director of the Office of Management and Budget and shall post a copy of its plan on the agency’s privacy website.

Each agency must develop a formal plan for the transition from the Privacy Act to the USA FIPS Act and send the plan to OMB. For smaller agencies, the plan might be short and simple. For agency with dozens, hundreds, or thousands of systems of records, developing a plan will require significant effort. Each agency must post its plan on its privacy website, and the website will provide a useful way to keep the public informed about the progress of the agency’s transition.

(c) TRANSITION PLAN. – The transition plan –

(1) shall establish a date when all components of the agency will comply with this Act, not to exceed five years from the date of enactment;

(2) shall provide for the promulgation of agency rules required by this Act before any part of the agency completes the transition;

(3) shall provide for publication of a notice disclosing the date of transition in the Federal Register at least 30 days before the date when all or part of the agency completes the transition to this Act;

(4) shall, not less frequently than every six months until the transition for the entire agency is complete, provide for public notice of the progress of the agency’s transition on the agency’s privacy website;

(5) may provide different transition dates for different agency components.

Subsection (c) sets out the required content of the transition plan. Each plan must have a target date for completion, provide for the promulgation of required agency rules, and provide public notice in the Federal Register of the date of transition. An agency must keep the public notified of transition progress on its website not less than every six months. The requirement to publish agency rules should not present major difficulties because the rules will be substantially similar to existing Privacy Act rules. When reissuing those rules, agencies that have not revisited their Privacy Act rules can bring the rules up to date.

Finally, an important feature of the transition is that an agency can provide different transition dates for different agency components. This means that an agency’s transition does not have to occur at once. An agency like the Department of Defense with so many separate components will have the ability to transition over time. Other agencies may also welcome the ability to transition piecemeal and not to manage a single event for all components.

(d) PRIVACY IMPACT ASSESSMENT DURING TRANSITION. – (1) An agency may choose not conduct a privacy impact assessment process as provided in section 11 before it first establishes an agency activity affecting privacy during the transition to compliance with this Act if the agency determines that –

(A) a recent privacy impact assessment substantially accomplished the purposes set out in section (11)(a) for the agency activity affecting privacy; or

(B) the agency activity affecting privacy only requires a limited privacy impact assessment and the activity is comparable to an activity covered by a privacy impact assessment conducted during the five years before the initial establishment of the activity.

(2) In determining priorities and allocating resources for privacy impact assessment processes during the transition, the agency shall give priority to new agency activities affecting privacy, to activities that are likely involve greater risk to the agency or to data subjects, and to any novel or innovative applications of technology.

Subsection (d) provides a special rule for the PIA process during the transition. It is unlikely that an agency will be able to go through a PIA process – and certainly not a thorough process – for each A3P it establishes. Agencies are unlikely to have the time or the resources to conduct all possible PIA processes. An agency has discretion to not conduct a PIA process if it conducted a recent one (under the E-Government Act standard or otherwise) that substantially accomplished the purposes set out in section 11. An agency may also choose not to conduct a limited PIA process if conducted something comparable in the last five years. The standards here for determining whether a previous PIA process will serve the purpose are different. For a thorough PIA process, the previous PIA should be substantially similar. For a limited PIA process, the previous PIA need only be comparable, a weaker standard.

Paragraph (d)(2) recognizes that an agency may not be able to conduct all possible PIA processes. It directs agencies to give priority to new activities, to activities that involve greater risk to the agency or to data subjects, and to any novel or innovative applications of technology. Over time, agencies will eventually be able to conduct PIA processes for more A3Ps that require them.

(e) TERMINATION. – An agency or agency component that completes the transition from the section 552a of title 5, United States Code, to this Act shall terminate compliance with section 552a of title 5, United States Code, on the transition date for the agency or agency component.

Subsection (e) establishes a termination date for compliance with the Privacy Act of 1974. That date is the transition date established for the agency or component. Thus, until a government-wide transition occurs, some agencies and some parts of agencies will be subject to different privacy laws. Given that the laws have many similarities, this should not present any significant problems.

(f) OFFICE OF MANAGEMENT AND BUDGET. –

(1) The Director of the Office of Management and Budget shall issue guidance to agencies regarding the transition from section 552a of title 5, United States Code, to this Act.

(2) Upon the request of an agency, the Director of the Office of Management and Budget may allow the agency to amend its transition plan and to take additional time to complete the transition. No extension may be granted beyond seven years from the date of enactment of this Act.

(3) Until the transition is complete for all agencies, the Director of the Office of Management and Budget shall report annually to the Congress and to the public on the government’s progress in transitioning to compliance with this Act.

Subsection (f) sets out the role of OMB in the transition. First, OMB must issue transition guidance to agencies. This will help ensure that agencies meet all appropriate requirements. Second, OMB has the authority to allow agencies to amend their transitions plans, including the ability to give agencies up to an additional two years to complete the transition. Finally, OMB must report annually to the Congress and the public on transition progress.

(g) LITIGATION. – Any litigation initiated under the section 552a of title 5, United States Code, shall be unaffected by this Act and shall continue under the provisions of the section 552a of title 5, United States Code, notwithstanding whether the agency completed its transition to this Act.

Subsection (g) preserves the status of any Privacy Act litigation initiated before an agency completed its transition to the USA FIPS Act.

Subsection (w) of the Privacy Act provides:

Applicability to Bureau of Consumer Financial Protection. – Except as provided in the Consumer Financial Protection Act of 2010, this section shall apply with respect to the Bureau of Consumer Financial Protection.

I have been unable to find any explanation for this provision or any evidence that it has any actual effect on the operations of the Consumer Finance Protection Bureau. There is a reference to privacy in the CFPB’s statute that says:

(8) Privacy considerations

In collecting information from any person, publicly releasing information held by the Bureau, or requiring covered persons to publicly report information, the Bureau shall take steps to ensure that proprietary, personal, or confidential consumer information that is protected from public disclosure under section 552(b) or 552a of title 5 or any other provision of law, is not made public under this title.^[247]

This language essentially directs the Bureau to comply with the Privacy Act.

As a result, I did not include subsection (w) in the USA FIPS Act because it appears to be unnecessary.

As presently drafted, the USA FIPS Act is a freestanding law. It would be appropriate, however, for the Act to be codified in U.S. Code. There are two obvious choices. The Privacy Act of 1974 is part of title 5 in the Administrative Procedure chapter. Given the current numbering scheme there, there is no particularly convenient place there for a new subchapter. It is always possible to add something in between what is there by adding letters at the end of section numbers. The codification of the Privacy Act as title 5, U.S.C. § 552a is mostly a consequence of the law emerging from the same House committee that produced the Freedom of Information Act, which is 5 U.S.C. § 552.

A better alternative may be title 44, chapter 31, which covers records management by federal agencies. Privacy legislation is largely a records management matter, and other relevant records management provisions are in title 44 already. There is “room” in chapter 31 for adding a new law with 20 sections.

In the end, I did not address the codification issue in the bill itself. Codifying a law in an existing positive title makes the drafting procedurally more cumbersome. It is better to allow readers of the draft to focus on the content of the bill rather than the drafting details. A choice about codification can be made at a later date.

Section 7 of Public Law 93-579 provided that:

(a) (1) It shall be unlawful for any Federal, State or local government agency to deny to any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose his social security account number.

(2) the provisions of paragraph (1) of this subsection shall not apply with respect to –

(A) any disclosure which is required by Federal statute, or

(B) the disclosure of a social security number to any Federal, State, or local agency maintaining a system of records in existence and operating before January 1, 1975, if such disclosure was required under statute or regulation adopted prior to such date to verify the identity of an individual.

(b) Any Federal, State, or local government agency which requests an individual to disclose his social security account number shall inform that individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.^[248]

This limit on the use of Social Security Numbers is distinctive because it applies to state and local government agencies as well as federal agencies. In part because this provision was never codified, and in part because it applies to all levels of government, the limit has been ignored at times, especially at the state and local levels. Additionally, later legislation exempted some state agencies from compliance in the administration of tax, public assistance, drivers licenses, and motor vehicle registration.^[249] Still, the law applies elsewhere, and there has been litigation over use of SSN over the years. Judicial opinions reflect a wide range of views on the applicability and enforceability of Section 7.^[250]

In the end, I decided to leave section 7 alone. While it might be useful to include it in a codified law, the provision presents several problems. First, it would be the only provision of the USA FIPS Act to apply to state and local agencies. Second, the provision has no clear enforcement provision, and adding one might create new policy and political problems. Third, clarifying some of the language of section 7 might be appropriate, but it could upset some understandings of the provision and contribute to political problems. Fourth, while section 7 was innovative when passed, there are larger problems with the collection of identification numbers than can reasonably be addressed in the USA FIPS Act. I flag the issue here for anyone who cares to tackle it in the future.

*****