At the federal level, the United States has adopted a fairly comprehensive approach to protecting government held personal data from unauthorized or inappropriate disclosure. The approach combines limits on (1) the amount and type of data collected by an agency in the first instance, (2) the use of such information within an agency, and (3) the disclosure of that information outside an agency. In most cases, citizens are entitled to access and request amendment of personal information maintained in government files. Violators of the federal privacy statutes face both civil and criminal penalties.
The federal system of data protection, though comprehensive, is criticized, however, as a "paper tiger" with significant enforcement and remedial deficiencies.