Overview of the Privacy Act of 1974

1. Each agency, with respect to each system of records under its control, must keep a record of the date, nature, and purpose of each disclosure of a record to any person or to another agency under subsection (b) and the name and address of the person or agency to whom the disclosure is made.See5 U.S.C. § 552a(c)(1).An accounting need not be kept of intra-agency disclosures (5 U.S.C. § 552a(b)(1)) or FOIA disclosures (5 U.S.C. § 552a(b)(2)).See 5 U.S.C. § 552a(c)(1).

2. This accounting of disclosures must be kept for five years or the life of the record, whichever is longer, after the disclosure for which the accounting is made.See 5 U.S.C. § 552a(c)(2).

3. Except for disclosures made under subsection (b)(7), an individual is entitled, upon request, to get access to this accounting of disclosures of his record.See 5 U.S.C. § 552a(c)(3).

4. An agency must inform any person or other agency about any correction or notation of dispute made by the agency in accordance with subsection (d) of any record that has been disclosed to the person or agency if an accounting of the disclosure was made.See 5 U.S.C. § 552a(c)(4).

Comment:

The language of subsection (c)(1) explicitly excepts both intra-agency “need to know” disclosures and FOIA disclosures from its coverage.  See, e.g., Quinn v. Navy, No. 94-56067, 1995 WL 341513, at *1 (9th Cir. June 8, 1995) (finding that only disclosure of records was within Navy and thus was exempt from accounting requirements); Clarkson v. IRS, 811 F.2d 1396, 1397-98 (11th Cir. 1987) (per curiam) (finding IRS’s internal disclosure of records to its criminal investigation units does not require accounting).  It should be noted, however, that the OMB Guidelines specifically state that an accounting of disclosure is required “even when such disclosure is . . . with the written consent or at the request of the individual.”  OMB Guidelines, 40 Fed. Reg. 28,948, 28,955 (July 9, 1975), available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf.

Additionally, OMB has stated that “[w]hile an agency need not keep a running tabulation of every disclosure at the time it is made, the agency must be able to reconstruct an accurate and complete accounting of disclosures so as to be able to respond to requests in a timely fashion.”  OMB Memorandum for Heads of Departments and Agencies, Attachment B – Instructions for Complying with the President’s Memorandum of May 14, 1998, “Privacy and Personal Information in Federal Records” 4 (January 7, 1999), available at http://georgewbush-whitehouse.archives.gov/omb/memoranda/m99-05-b.html; see also OMB Guidelines, 40 Fed. Reg. at 28,956, available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf.

In one case, a district court noted that although an agency is required pursuant to 5 U.S.C. § 552a(c) to keep an accurate accounting of each disclosure, there is no requirement that the “disclosed records themselves contain ‘the date, nature and purpose’ of each disclosure.”  Sieverding v. DOJ, 693 F. Supp. 2d 93, 106 (D.D.C. 2010), summary affirmance granted, No. 10-5149, 2010 WL 4340348 (D.C. Cir. Oct. 19, 2010).  The district court also went on to state that the accounting requirement only “requires agencies to keep accurate accountings of their disclosures of records; they need not account for conversations or personal visits.”  Id.

It is important to recognize that subsection (c)(3) grants individuals a right of access similar to the access right provided by subsection (d)(1).  See Standley v. DOJ, 835 F.2d 216, 219 (9th Cir. 1987) (entitling plaintiff to gain access to list, compiled by U.S. Attorney, of persons in IRS to whom disclosures of grand jury materials about plaintiff were made); Ray v. DOJ, 558 F. Supp. 226, 228 (D.D.C. 1982) (requiring addresses of private persons who requested plaintiff’s records to be released to plaintiff notwithstanding that “concern about possible harrassment [sic] of these individuals may be legitimate”), aff’d, 720 F.2d 216 (D.C. Cir. 1983) (unpublished table decision); cf. Quinn, 1995 WL 341513, at *1 (finding no records to disclose in response to request for accounting because there were no disclosures that required accounting); Beaven v. DOJ, No. 03-84, 2007 WL 1032301, at *23 (E.D. Ky. Mar. 30, 2007) (finding accounting provisions not applicable for unauthorized disclosures because provisions only cover disclosures made under subsection (b)).  However, subsection (c)(3) makes an explicit exception “for disclosures made under subsection (b)(7).”  5 U.S.C. § 552a(c)(3); see also Lora v. INS, No. 2:02cv756, 2002 WL 32488472, at *2 (E.D. Va. Oct. 8, 2002) (holding that “to the extent plaintiff alleges that defendant’s failure to give him information about disclosures from his . . . file violated his rights under [the Privacy Act], plaintiff’s complaint fails to state a claim” (where the court found that the agency had disclosed information to an AUSA pursuant to subsection (b)(7) and plaintiff claimed that the agency failed to keep accounting records (given that plaintiff had requested information about disclosures from the agency and the agency had responded that plaintiff’s file contained no record of disclosure)), aff’d per curiam, 61 F. App’x 80 (4th Cir. 2003).

Of course, it should not be overlooked that certain Privacy Act exemptions – 5 U.S.C. § 552a(j) and (k) – are potentially available to shield an “accounting of disclosures” record from release to the subject thereof under subsection (c)(3).  See Vazquez v. DOJ, 764 F. Supp. 2d 117, 120 (D.D.C. 2011) (ruling that “DOJ properly denied plaintiff’s request under the Privacy Act on the basis that such records are” in a system “which the FBI has exempted” from the accounting provision pursuant to (j)(2)); Zahedi v. DOJ, No. 10-694, 2011 WL 1872206, at *4 (D. Or. May 16, 2011) (“Plaintiff seeks an accounting of information obtained pursuant to a search warrant in the context of a criminal investigation, which falls squarely within the exemptions [(j)(2) and (k)(2)] to the Privacy Act’s accounting provision.”); Standley, 835 F.2d at 219 (remanding case for consideration of whether exemptions are applicable); Hornes v. EOUSA, No. 04-2190, 2006 WL 2792680, at *4 (D.D.C. Sept. 27, 2006) (finding, pursuant to exemption (j)(2), that “EOUSA has specifically exempted its system of ‘Criminal Case Files’ from the disclosure requirements of subsection (c)(3)”); Maydak v. DOJ, 254 F. Supp. 2d 23, 34-35 (D.D.C. 2003) (asserting that although the agency’s “conten[tion] that it ‘is exempt from [the accounting provision] with respect to logs of disclosure’ . . . is incorrect,” and that “[e]xemption from the accounting requirement of § 552a(c) is not as expansive as seemingly being suggested by [the agency],” nevertheless finding that plaintiff had failed to state a claim and had no right of access where the system was exempt from the provisions of subsection (c)(3) pursuant to subsection (j)); Mittleman v. Treasury, 919 F. Supp. 461, 469 (D.D.C. 1995) (finding that “application of exemption (k)(2) . . . is valid” and that Department of the Treasury OIG’s “General Allegations and Investigative Records System” is exempt “because, inter alia, application of the accounting-of-disclosures provision . . . would alert the subject to the existence of an investigation, possibly resulting in hindrance of an investigation”), aff’d in part & remanded in part on other grounds, 104 F.3d 410 (D.C. Cir. 1997); Bagley v. FBI, No. 88-4075, slip op. at 2-4 (N.D. Iowa Aug. 28, 1989) (applying subsection (j)(2)); see also Hart v. FBI, No. 94 C 6010, 1995 U.S. Dist. LEXIS 4542, at *6 n.1 (N.D. Ill. Apr. 7, 1995) (noting exemption of FBI’s Criminal Justice Information Services Division Records System), aff’d, 91 F.3d 146 (7th Cir. 1996) (unpublished table decision).

For a further discussion of this provision, see OMB Guidelines, 40 Fed. Reg. 28,948, 28,955-56 (July 9, 1975), available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf.

Finally, a plaintiff may seek damages for an agency’s failure to maintain adequate accounting of disclosures.  See Sussman v. Marshals Serv., 734 F. Supp.2d 138, 149 (D.D.C. 2010) (stating that “[t]he core elements of the claim are (1) failure . . . to maintain an accurate accounting of disclosures, and (2) a resultant adverse effect.”  Sussman v. Marshals Serv., 494 F.3d 1106, 1124 (D.C. Cir. 2007).  Finally, it should be noted that the Privacy Act permits an individual to recover damages for accounting failures regarding disclosures “only to the extent those disclosures involved materials in his records.”  Id.