The Privacy Act of 1974: An Assessment. APPENDIX 4 TO The Report of The Privacy Protection Study Commission.. Access to Records

01/07/1977

As the suggested subsection [(b)] illustrates, the Commission believes that an individual ought to have the greatest possible access to information about himself without causing an undue burden on the agency. The Commission also believes, however, that the current law's intent that an individual's request for access identify the information sought as specifically as possible [5 U.S.C. 552a(d),(f)(1)] should be preserved so long as the agency has a corresponding responsibility to assist the individual in framing his request so that it "reasonably describes" the records he wants to see. Most agencies, as indicated earlier, do make an effort to assist the individual, but the Commission believes that requiring such assistance in the statute is important assurance that it will continue to be given. The Commission envisions a dialogue between the agency and the individual in which the agency might ask the individual to narrow his request by reference to systems named on a list that the agency would give him. The likelihood of a private citizen being aware of the name of a system of records published in the Federal Register is too remote to be relied on exclusively. Moreover, the reasonable-description standard [(b)(1)] is one with which the agencies have had considerable experience in the context of the Freedom of Information Act as amended.7

Suggested subsection (b)(6) would introduce a new provision establishing time limits within which an agency must respond to an individual's request for access to records about himself. The provision would require an agency, within 30 working days after receiving a request for access, to determine whether it will comply and to notify the individual of its determination. Thereafter, the agency would have to make the records available to the individual "within a reasonable period of time." Subsection (b)(6) takes to heart a lesson learned from experience with the Freedom of Information Act, which had to have time limits added to it in order to assure prompt agency response to access requests.8

The suggested revision expands upon the requirements of the current Act that "information be provided in a form comprehensible to the individual" [5 U.S.C 552a(d)(1)] by requiring that the form in which a record is disclosed to an individual reflect "as accurately as can be reasonably expected, the context or manner in which the agency maintains and uses" it. [(b)(1)(B)] This formulation seeks to help an individual determine how and in what manner he should, for example, exercise his right to correct, amend, or dispute a record to which he gains access.

The current access requirement would also be expanded to require an agency to supply information from "derivative" records to the extent that the agency "can be reasonably expected to be aware of substantially similar or derivative versions" that fall within the definition of an "accessible record." [(b)(1)(C)] An individual can be, and often is, unaware of such records, even though he could be as easily harmed by some of them as by the original. Two kinds of recorded information are clearly covered by this provision: (1) an exact duplicate of the original record maintained in another part of the agency; and (2) some portion of the original which has been copied and subsequently amended or merged with other records. In both cases, an agency should be obliged to take reasonable affirmative steps to describe and make the several versions available to the individual. While an individual may not wish to see every duplicate of the original record, he may wish to assure that some duplicates are amended if he amends the original. Moreover, the uses and disclosures of duplicates of a record, as well as of substantially similar or derivative versions of it, may well not be the same as the uses and disclosures of the original, and when that is the case, the individual should be so informed.

Finally, a portion of subsection (d)(1) of the current law has been eliminated. This is the subsection [5 U.S.C 552a(d)(1)] that requires an agency to grant an individual access to "any information pertaining to him which is contained in the system." The requirement is impossible for an agency to satisfy without a complete review of all its records and the development of elaborate indices or cross-referencing schemes. An agency is simply not aware of all the places in its records where an individual may be named and should not be required to be in the name of fair information practice.