Section 552 (e) of this title, referred to in subsec. (a)(1), was redesignated section 552 (f) of this title by section 1802(b) of Pub. L. 99–570.

Section 6103 of the Internal Revenue Code of 1986, referred to in subsec. (a)(8)(B)(iv), (vii), is classified to section 6103 of Title 26, Internal Revenue Code.

Sections 404, 464, and 1137 of the Social Security Act, referred to in subsec. (a)(8)(B)(iv), are classified to sections 604, 664, and 1320b–7, respectively, of Title 42, The Public Health and Welfare.

For effective date of this section, referred to in subsecs. (k)(2), (5), (7), (l)(2), (3), and (m), see Effective Date note below.

Section 6 of the Privacy Act of 1974, referred to in subsec. (s)(1), is section 6 of Pub. L. 93–579, which was set out below and was repealed by section 6(c) of Pub. L. 100–503.

For classification of the Privacy Act of 1974, referred to in subsec. (s)(4), see Short Title note below.

Section 552a of former Title 5, Executive Departments and Government Officers and Employees, was transferred to section 2244 of Title 7, Agriculture.

2004—Subsec. (b)(10). Pub. L. 108–271 substituted “Government Accountability Office” for “General Accounting Office”.

1999—Subsec. (a)(8)(B)(viii). Pub. L. 106–170 added cl. (viii).

1998—Subsec. (u)(6), (7). Pub. L. 105–362 redesignated par. (7) as (6), substituted “paragraph (3)(D)” for “paragraphs (3)(D) and (6)”, and struck out former par. (6) which read as follows: “The Director of the Office of Management and Budget shall, annually during the first 3 years after the date of enactment of this subsection and biennially thereafter, consolidate in a report to the Congress the information contained in the reports from the various Data Integrity Boards under paragraph (3)(D). Such report shall include detailed information about costs and benefits of matching programs that are conducted during the period covered by such consolidated report, and shall identify each waiver granted by a Data Integrity Board of the requirement for completion and submission of a cost-benefit analysis and the reasons for granting the waiver.”

1997—Subsec. (a)(8)(B)(vii). Pub. L. 105–34 added cl. (vii).

1996—Subsec. (a)(8)(B)(iv)(III). Pub. L. 104–193 substituted “section 404 (e), 464,” for “section 464”.

Subsec. (a)(8)(B)(v) to (vii). Pub. L. 104–226 inserted “or” at end of cl. (v), struck out “or” at end of cl. (vi), and struck out cl. (vii) which read as follows: “matches performed pursuant to section 6103(l)(12) of the Internal Revenue Code of 1986 and section 1144 of the Social Security Act;”.

Subsecs. (b)(12), (m)(2). Pub. L. 104–316 substituted “3711(e)” for “3711(f)”.

1993—Subsec. (a)(8)(B)(vii). Pub. L. 103–66 added cl. (vii).

1990—Subsec. (p). Pub. L. 101–508 amended subsec. (p) generally, restating former pars. (1) and (3) as par. (1), adding provisions relating to Data Integrity Boards, and restating former pars. (2) and (4) as (2) and (3), respectively.

1988—Subsec. (a)(8) to (13). Pub. L. 100–503, § 5, added pars. (8) to (13).

Subsec. (e)(12). Pub. L. 100–503, § 3(a), added par. (12).

Subsec. (f). Pub. L. 100–503, § 7, substituted “biennially” for “annually” in last sentence.

Subsecs. (o) to (q). Pub. L. 100–503, § 2(2), added subsecs. (o) to (q). Former subsecs. (o) to (q) redesignated (r) to (t), respectively.

Subsec. (r). Pub. L. 100–503, § 3(b), inserted “and matching programs” in heading and amended text generally. Prior to amendment, text read as follows: “Each agency shall provide adequate advance notice to Congress and the Office of Management and Budget of any proposal to establish or alter any system of records in order to permit an evaluation of the probable or potential effect of such proposal on the privacy and other personal or property rights of individuals or the disclosure of information relating to such individuals, and its effect on the preservation of the constitutional principles of federalism and separation of powers.”

Pub. L. 100–503, § 2(1), redesignated former subsec. (o) as (r).

Subsec. (s). Pub. L. 100–503, § 8, substituted “Biennial” for “Annual” in heading, “biennially submit” for “annually submit” in introductory provisions, “preceding 2 years” for “preceding year” in par. (1), and “such years” for “such year” in par. (2).

Pub. L. 100–503, § 2(1), redesignated former subsec. (p) as (s).

Subsec. (t). Pub. L. 100–503, § 2(1), redesignated former subsec. (q) as (t).

Subsec. (u). Pub. L. 100–503, § 4, added subsec. (u).

Subsec. (v). Pub. L. 100–503, § 6(a), added subsec. (v).

1984—Subsec. (b)(6). Pub. L. 98–497, § 107(g)(1), substituted “National Archives and Records Administration” for “National Archives of the United States”, and “Archivist of the United States or the designee of the Archivist” for “Administrator of General Services or his designee”.

Subsec. (l)(1). Pub. L. 98–497, § 107(g)(2), substituted “Archivist of the United States” for “Administrator of General Services” in two places.

Subsec. (q). Pub. L. 98–477 designated existing provisions as par. (1) and added par. (2).

1983—Subsec. (b)(12). Pub. L. 97–452 substituted “section 3711 (f) of title 31” for “section 3(d) of the Federal Claims Collection Act of 1966 (31 U.S.C. 952 (d))”.

Subsec. (m)(2). Pub. L. 97–452 substituted “section 3711 (f) of title 31” for “section 3(d) of the Federal Claims Collection Act of 1966 (31 U.S.C. 952 (d))”.

1982—Subsec. (b)(12). Pub. L. 97–365, § 2(a), added par. (12).

Subsec. (e)(4). Pub. L. 97–375, § 201(a), substituted “upon establishment or revision” for “at least annually” after “Federal Register”.

Subsec. (m). Pub. L. 97–365, § 2(b), designated existing provisions as par. (1) and added par. (2).

Subsec. (p). Pub. L. 97–375, § 201(b), substituted provisions requiring annual submission of a report by the President to the Speaker of the House and President pro tempore of the Senate relating to the Director of the Office of Management and Budget, individual rights of access, changes or additions to systems of records, and other necessary or useful information, for provisions which had directed the President to submit to the Speaker of the House and the President of the Senate, by June 30 of each calendar year, a consolidated report, separately listing for each Federal agency the number of records contained in any system of records which were exempted from the application of this section under the provisions of subsections (j) and (k) of this section during the preceding calendar year, and the reasons for the exemptions, and such other information as indicate efforts to administer fully this section.

1975—Subsec. (g)(5). Pub. L. 94–183 substituted “to September 27, 1975” for “to the effective date of this section”.

Committee on Governmental Affairs of Senate changed to Committee on Homeland Security and Governmental Affairs of Senate, effective Jan. 4, 2005, by Senate Resolution No. 445, One Hundred Eighth Congress, Oct. 9, 2004.

Committee on Government Operations of House of Representatives treated as referring to Committee on Government Reform and Oversight of House of Representatives by section 1(a) of Pub. L. 104–14, set out as a note under section 21 of Title 2, The Congress. Committee on Government Reform and Oversight of House of Representatives changed to Committee on Government Reform of House of Representatives by House Resolution No. 5, One Hundred Sixth Congress, Jan. 6, 1999.

Amendment by Pub. L. 106–170 applicable to individuals whose period of confinement in an institution commences on or after the first day of the fourth month beginning after December 1999, see section 402(a)(4) of Pub. L. 106–170, set out as a note under section 402 of Title 42, The Public Health and Welfare.

Amendment by Pub. L. 105–34 applicable to levies issued after Aug. 5, 1997, see section 1026(c) of Pub. L. 105–34, set out as a note under section 6103 of Title 26, Internal Revenue Code.

Amendment by Pub. L. 104–193 effective July 1, 1997, with transition rules relating to State options to accelerate such date, rules relating to claims, actions, and proceedings commenced before such date, rules relating to closing out of accounts for terminated or substantially modified programs and continuance in office of Assistant Secretary for Family Support, and provisions relating to termination of entitlement under AFDC program, see section 116 of Pub. L. 104–193, as amended, set out as an Effective Date note under section 601 of Title 42, The Public Health and Welfare.

Amendment by Pub. L. 103–66 effective Jan. 1, 1994, see section 13581(d) of Pub. L. 103–66, set out as a note under section 1395y of Title 42, The Public Health and Welfare.

Section 10 of Pub. L. 100–503, as amended by Pub. L. 101–56, § 2, July 19, 1989, 103 Stat. 149, provided that:

“(a) In General.—Except as provided in subsections (b) and (c), the amendments made by this Act [amending this section and repealing provisions set out as a note below] shall take effect 9 months after the date of enactment of this Act [Oct. 18, 1988].

“(b) Exceptions.—The amendment made by sections 3(b), 6, 7, and 8 of this Act [amending this section and repealing provisions set out as a note below] shall take effect upon enactment.

“(c) Effective Date Delayed for Existing Programs.—In the case of any matching program (as defined in section 552a (a)(8) of title 5, United States Code, as added by section 5 of this Act) in operation before June 1, 1989, the amendments made by this Act (other than the amendments described in subsection (b)) shall take effect January 1, 1990, if—

“(1) such matching program is identified by an agency as being in operation before June 1, 1989; and

“(2) such identification is—

“(A) submitted by the agency to the Committee on Governmental Affairs of the Senate, the Committee on Government Operations of the House of Representatives, and the Office of Management and Budget before August 1, 1989, in a report which contains a schedule showing the dates on which the agency expects to have such matching program in compliance with the amendments made by this Act, and

“(B) published by the Office of Management and Budget in the Federal Register, before September 15, 1989.”

Amendment by Pub. L. 98–497 effective Apr. 1, 1985, see section 301 of Pub. L. 98–497, set out as a note under section 2102 of Title 44, Public Printing and Documents.

Section 8 of Pub. L. 93–579 provided that: “The provisions of this Act [enacting this section and provisions set out as notes under this section] shall be effective on and after the date of enactment [Dec. 31, 1974], except that the amendments made by sections 3 and 4 [enacting this section and amending analysis preceding section 500 of this title] shall become effective 270 days following the day on which this Act is enacted.”

Section 7201(a) of Pub. L. 101–508 provided that: “This section [amending this section and enacting provisions set out as notes below] may be cited as the ‘Computer Matching and Privacy Protection Amendments of 1990’.”

Pub. L. 101–56, § 1, July 19, 1989, 103 Stat. 149, provided that: “This Act [amending section 10 of Pub. L. 100–503, set out as a note above] may be cited as the ‘Computer Matching and Privacy Protection Act Amendments of 1989’.”

Section 1 of Pub. L. 100–503 provided that: “This Act [amending this section, enacting provisions set out as notes above and below, and repealing provisions set out as a note below] may be cited as the ‘Computer Matching and Privacy Protection Act of 1988’.”

Section 1 of Pub. L. 93–579 provided: “That this Act [enacting this section and provisions set out as notes under this section] may be cited as the ‘Privacy Act of 1974’.”

This section is popularly known as the “Privacy Act”.

For termination, effective May 15, 2000, of reporting provisions in subsec. (s) of this section, see section 3003 of Pub. L. 104–66, as amended, set out as a note under section 1113 of Title 31, Money and Finance, and page 31 of House Document No. 103–7.

Functions of Director of Office of Management and Budget under this section delegated to Administrator for Office of Information and Regulatory Affairs by section 3 of Pub. L. 96–511, Dec. 11, 1980, 94 Stat. 2825, set out as a note under section 3503 of Title 44, Public Printing and Documents.

Pub. L. 108–447, div. H, title V, § 522, Dec. 8, 2004, 118 Stat. 3268, provided that:

“(a) Privacy Officer.—Each agency shall have a Chief Privacy Officer to assume primary responsibility for privacy and data protection policy, including—

“(1) assuring that the use of technologies sustain, and do not erode, privacy protections relating to the use, collection, and disclosure of information in an identifiable form;

“(2) assuring that technologies used to collect, use, store, and disclose information in identifiable form allow for continuous auditing of compliance with stated privacy policies and practices governing the collection, use and distribution of information in the operation of the program;

“(3) assuring that personal information contained in Privacy Act systems of records is handled in full compliance with fair information practices as defined in the Privacy Act of 1974 [see Short Title of 1974 Amendment note, set out above];

“(4) evaluating legislative and regulatory proposals involving collection, use, and disclosure of personal information by the Federal Government;

“(5) conducting a privacy impact assessment of proposed rules of the Department on the privacy of information in an identifiable form, including the type of personally identifiable information collected and the number of people affected;

“(6) preparing a report to Congress on an annual basis on activities of the Department that affect privacy, including complaints of privacy violations, implementation of section 552a of title 5, 11 [sic] United States Code, internal controls, and other relevant matters;

“(7) ensuring that the Department protects information in an identifiable form and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction;

“(8) training and educating employees on privacy and data protection policies to promote awareness of and compliance with established privacy and data protection policies; and

“(9) ensuring compliance with the Departments established privacy and data protection policies.

“(b) Establishing Privacy and Data Protection Procedures and Policies.—

“(1) [sic] In general.—Within 12 months of enactment of this Act [Dec. 8, 2004], each agency shall establish and implement comprehensive privacy and data protection procedures governing the agency’s collection, use, sharing, disclosure, transfer, storage and security of information in an identifiable form relating to the agency employees and the public. Such procedures shall be consistent with legal and regulatory guidance, including OMB regulations, the Privacy Act of 1974, and section 208 of the E-Government Act of 2002 [section 208 of Pub. L. 107–347, set out in a note under section 3501 of Title 44, Public Printing and Documents].

“(c) Recording.—Each agency shall prepare a written report of its use of information in an identifiable form, along with its privacy and data protection policies and procedures and record it with the Inspector General of the agency to serve as a benchmark for the agency. Each report shall be signed by the agency privacy officer to verify that the agency intends to comply with the procedures in the report. By signing the report the privacy officer also verifies that the agency is only using information in identifiable form as detailed in the report.

“(d) Independent, Third-Party Review.—

“(1) In general.—At least every 2 years, each agency shall have performed an independent, third party review of the use of information in identifiable form as the privacy and data protection procedures of the agency to—

“(A) determine the accuracy of the description of the use of information in identifiable form;

“(B) determine the effectiveness of the privacy and data protection procedures;

“(C) ensure compliance with the stated privacy and data protection policies of the agency and applicable laws and regulations; and

“(D) ensure that all technologies used to collect, use, store, and disclose information in identifiable form allow for continuous auditing of compliance with stated privacy policies and practices governing the collection, use and distribution of information in the operation of the program.

“(2) Purposes.—The purposes of reviews under this subsection are to—

“(A) ensure the agency’s description of the use of information in an identifiable form is accurate and accounts for the agency’s current technology and its processing of information in an identifiable form;

“(B) measure actual privacy and data protection practices against the agency’s recorded privacy and data protection procedures;

“(C) ensure compliance and consistency with both online and offline stated privacy and data protection policies; and

“(D) provide agencies with ongoing awareness and recommendations regarding privacy and data protection procedures.

“(3) Requirements of review.—The Inspector General of each agency shall contract with an independent, third party that is a recognized leader in privacy consulting, privacy technology, data collection and data use management, and global privacy issues, to—

“(A) evaluate the agency’s use of information in identifiable form;

“(B) evaluate the privacy and data protection procedures of the agency; and

“(C) recommend strategies and specific steps to improve privacy and data protection management.

“(4) Content.—Each review under this subsection shall include—

“(A) a review of the agency’s technology, practices and procedures with regard to the collection, use, sharing, disclosure, transfer and storage of information in identifiable form;

“(B) a review of the agency’s stated privacy and data protection procedures with regard to the collection, use, sharing, disclosure, transfer, and security of personal information in identifiable form relating to agency employees and the public;

“(C) a detailed analysis of agency intranet, network and Websites for privacy vulnerabilities, including—

“(i) noncompliance with stated practices, procedures and policies; and

“(ii) risks for inadvertent release of information in an identifiable form from the website of the agency; and

“(D) a review of agency compliance with this Act [div. H of Pub. L. 108–447, see Tables for classification].

“(e) Report.—

“(1) In general.—Upon completion of a review, the Inspector General of an agency shall submit to the head of that agency a detailed report on the review, including recommendations for improvements or enhancements to management of information in identifiable form, and the privacy and data protection procedures of the agency.

“(2) Internet availability.—Each agency shall make each independent third party review, and each report of the Inspector General relating to that review available to the public.

“(f) Definition.—In this section, the definition of ‘identifiable form’ is consistent with Public Law 107–347, the E-Government Act of 2002 [see Tables for classification], and means any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means.”

Section 7201(b)(2) of Pub. L. 101–508 provided that: “Not later than 90 days after the date of the enactment of this Act [Nov. 5, 1990], the Director of the Office of Management and Budget shall publish guidance under subsection (p)(1)(A)(ii) of section 552a of title 5, United States Code, as amended by this Act.”

Section 7201(c) of Pub. L. 101–508 provided that: “Section 552a (p)(1)(A)(ii)(II) of title 5, United States Code, as amended by section 2 [probably means section 7201(b)(1) of Pub. L. 101–508], shall not apply to a program referred to in paragraph (1), (2), or (4) of section 1137(b) of the Social Security Act (42 U.S.C. 1320b–7), until the earlier of—

“(1) the date on which the Data Integrity Board of the Federal agency which administers that program determines that there is not a high degree of confidence that information provided by that agency under Federal matching programs is accurate; or

“(2) 30 days after the date of publication of guidance under section 2 (b) [probably means section 7201(b)(2) of Pub. L. 101–508, set out as a note above].”

Pub. L. 101–366, title II, § 206(d), Aug. 15, 1990, 104 Stat. 442, provided that:

“(1) In the case of computer matching programs between the Department of Veterans Affairs and the Department of Defense in the administration of education benefits programs under chapters 30 and 32 of title 38 and chapter 106 of title 10, United States Code, the amendments made to section 552a of title 5, United States Code, by the Computer Matching and Privacy Protection Act of 1988 [Pub. L. 100–503] (other than the amendments made by section 10(b) of that Act) [see Effective Date of 1988 Amendment note above] shall take effect on October 1, 1990.

“(2) For purposes of this subsection, the term ‘matching program’ has the same meaning provided in section 552a (a)(8) of title 5, United States Code.”

Section 6(b) of Pub. L. 100–503 provided that: “The Director shall, pursuant to section 552a (v) of title 5, United States Code, develop guidelines and regulations for the use of agencies in implementing the amendments made by this Act [amending this section and repealing provisions set out as a note below] not later than 8 months after the date of enactment of this Act [Oct. 18, 1988].”

Section 9 of Pub. L. 100–503 provided that: “Nothing in the amendments made by this Act [amending this section and repealing provisions set out as a note below] shall be construed to authorize—

“(1) the establishment or maintenance by any agency of a national data bank that combines, merges, or links information on individuals maintained in systems of records by other Federal agencies;

“(2) the direct linking of computerized systems of records maintained by Federal agencies;

“(3) the computer matching of records not otherwise authorized by law; or

“(4) the disclosure of records for computer matching except to a Federal, State, or local agency.”

Section 2 of Pub. L. 93–579 provided that:

“(a) The Congress finds that—

“(1) the privacy of an individual is directly affected by the collection, maintenance, use, and dissemination of personal information by Federal agencies;

“(2) the increasing use of computers and sophisticated information technology, while essential to the efficient operations of the Government, has greatly magnified the harm to individual privacy that can occur from any collection, maintenance, use, or dissemination of personal information;

“(3) the opportunities for an individual to secure employment, insurance, and credit, and his right to due process, and other legal protections are endangered by the misuse of certain information systems;

“(4) the right to privacy is a personal and fundamental right protected by the Constitution of the United States; and

“(5) in order to protect the privacy of individuals identified in information systems maintained by Federal agencies, it is necessary and proper for the Congress to regulate the collection, maintenance, use, and dissemination of information by such agencies.

“(b) The purpose of this Act [enacting this section and provisions set out as notes under this section] is to provide certain safeguards for an individual against an invasion of personal privacy by requiring Federal agencies, except as otherwise provided by law, to—

“(1) permit an individual to determine what rec­ords pertaining to him are collected, maintained, used, or disseminated by such agencies;

“(2) permit an individual to prevent records pertaining to him obtained by such agencies for a particular purpose from being used or made available for another purpose without his consent;

“(3) permit an individual to gain access to information pertaining to him in Federal agency records, to have a copy made of all or any portion thereof, and to correct or amend such records;

“(4) collect, maintain, use, or disseminate any record of identifiable personal information in a manner that assures that such action is for a necessary and lawful purpose, that the information is current and accurate for its intended use, and that adequate safeguards are provided to prevent misuse of such information;

“(5) permit exemptions from the requirements with respect to records provided in this Act only in those cases where there is an important public policy need for such exemption as has been determined by specific statutory authority; and

“(6) be subject to civil suit for any damages which occur as a result of willful or intentional action which violates any individual’s rights under this Act.”

Section 5 of Pub. L. 93–579, as amended by Pub. L. 95–38, June 1, 1977, 91 Stat. 179, which established the Privacy Protection Study Commission and provided that the Commission study data banks, automated data processing programs and information systems of governmental, regional and private organizations to determine standards and procedures in force for protection of personal information, that the Commission report to the President and Congress the extent to which requirements and principles of section 552a of title 5 should be applied to the information practices of those organizations, and that it make other legislative recommendations to protect the privacy of individuals while meeting the legitimate informational needs of government and society, ceased to exist on September 30, 1977, pursuant to section 5(g) of Pub. L. 93–579.

Section 6 of Pub. L. 93–579, which provided that the Office of Management and Budget shall develop guidelines and regulations for use of agencies in implementing provisions of this section and provide continuing assistance to and oversight of the implementation of the provisions of such section by agencies, was repealed by Pub. L. 100–503, § 6(c), Oct. 18, 1988, 102 Stat. 2513.

Section 7 of Pub. L. 93–579 provided that:

“(a)(1) It shall be unlawful for any Federal, State or local government agency to deny to any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose his social security account number.

“(2) the [The] provisions of paragraph (1) of this subsection shall not apply with respect to—

“(A) any disclosure which is required by Federal statute, or

“(B) the disclosure of a social security number to any Federal, State, or local agency maintaining a system of records in existence and operating before January 1, 1975, if such disclosure was required under statute or regulation adopted prior to such date to verify the identity of an individual.

“(b) Any Federal, State, or local government agency which requests an individual to disclose his social security account number shall inform that individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.”

Section 9 of Pub. L. 93–579, as amended by Pub. L. 94–394, Sept. 3, 1976, 90 Stat. 1198, authorized appropriations for the period beginning July 1, 1975, and ending on September 30, 1977.

For provisions relating to a response to a request for information under this section when the fact of its existence or nonexistence is itself classified or when it was originally classified by another agency, see Ex. Ord. No. 12958, § 3.7, Apr. 17, 1995, 60 F.R. 19835, set out as a note under section 435 of Title 50, War and National Defense.