The requirements of an act, although not always easy to interpret, derive from the words of legislation. Principles, on the other hand, are sometimes less readily apparent. The statement of principles in a law's preamble, the law's legislative history, and the conditions or problems that led to its passage must all be read along with the language of its specific provisions.

Although many issues in the 1960's and early 1970's were loosely grouped under the category of invasions of privacy, it is clear that many of the perceived problems had very little in common. Some of the actual or potential invasions of privacy involved physical surveillance or wiretapping; some involved mail openings or burglaries conducted by government agencies; others centered on harassment of individuals for political purposes; and still others concerned the unfair use of records about individuals.

The inquiry into these matters by a number of congressional committees did not share a common analytical framework, nor were the distinctions among different types of privacy invasions sharply drawn. Nonetheless, they succeeded in focusing public attention on privacy issues and in amassing useful information regarding particular aspects of the privacy protection problem.

In 1972, the Secretary's Advisory Committee on Automated Personal Data Systems was appointed by the then Secretary of Health, Education, and Welfare, Elliot L. Richardson, to explore, as its name suggested, the impact of computers on record keeping about individuals and, in addition, to inquire into, and make recommendations regarding, the use of the Social Security number. The Advisory Committee did not examine issues arising from the physical surveillance of individuals or the wiretapping of conversations. Nor did it study mail openings, harassment of political dissidents, or violations of Fourth or Fifth Amendments rights. Instead, the Committee limited its inquiry to the use of records about individuals by government agencies and private organizations, and it focused its recom-mendations on automated systems while also suggesting their possible applicability to manual systems.

After examining various definitions of privacy, the Secretary's Advisory Committee concluded that the most significant aspect of the way organizations keep and use records about individuals was the extent to which individuals to whom the records pertained were unable to control their use. Accordingly, to strike a better balance between institutional and individual prerogatives, the Committee recommended a "Code of Fair Information Practices" based on the following five principles:

• There must be no personal data record-keeping systems whose very existence is secret.
• There must be a way for an "individual to find out what information about him is in a record and how it is used.
• There must be a way for an individual to prevent information about him obtained, for one purpose from being used or made available for other purposes without his consent.
• There must be a way for an individual to correct or amend a record of identifiable information about him.
• Any organization creating, maintaining, using, or disseminat-ing records of identifiable personal data must assure the reliability of the data for their intended use and must take reasonable precautions to prevent misuse of the data.⁴

These five principles and the findings of the DHEW Committee, published in July 1973, are generally credited with supplying the intellectual framework for the Privacy Act of 1974, though in drafting the statute the Congress, influenced by its own inquiries, refined the five principles to eight⁵

1. There shall be no personal-data record-keeping system whose very existence is secret and there shall be a policy of openness about an organization's personal-data record-keeping poli-cies, practices, and systems. (The Openness Principle)
2. An individual about whom information is maintained by a record-keeping organization in individually identifiable form
3. shall have a right to see and copy that information. (The Individual Access Principle)
4. An individual about whom information is maintained by a record-keeping organization shall have a right to correct or amend the substance of that information. (The Individual Participation Principle)
5. There shall be limits on the types of information an organiza-tion may collect about an individual, as well as certain requirements with respect to the manner in which it collects such information. (The Collection Limitation Principle)
6. There shall be limits on the internal uses of information about an individual within a record-keeping organization. (The Use Limitation Principle)
7. There shall be limits on the external disclosures of informa-tion about an individual a record-keeping organization may make. (The Disclosure Limitation Principle)
8. A record-keeping organization shall bear an affirmative responsibility for establishing reasonable and proper information management policies and practices which assure that its collection, maintenance, use, and dissemination of information about an individual is necessary and lawful and the information itself is current and accurate. (The Information Management Principle)
9. A record-keeping organization shall be accountable for its personal-data record-keeping policies, practices, and systems. (The Accountability Principle)

Each of these principles is manifest in one or more of the Privacy Act's specific requirements, and in their application they all require a balancing of individual, organizational, and societal interests.