The Commission believes that the primary value of the accounting of disclosures requirement should be its utility for propagating corrections and that a reasonableness test should, therefore, be used in determining the period of time for which an accounting must be kept. [(b)(1)(B)] The existing provision [5 U.S. C.552a(c)(4)] is inadequate in that it does not require that corrections be propagated within an agency where inaccuracies can be every bit as harmful to the individual as inaccuracies in records disclosed to users outside the agency.
The proposed revision of the accounting of disclosures requirement stipulates that an accounting be kept of all disclosures to: (1) recipients to whom the agency could reasonably be expected to propagate a correction pursuant to the revised propagation of corrections requirement [(f)]; and (2) recipients of which the agency could reasonably be expected to be aware but to whom it could not be reasonably expected to propagate corrections. This means, of course, that an accounting would have to be made of internal as well as external disclosures, although not necessarily of all of them. For example, no accounting would be required of a disclosure to the individual himself, or of a disclosure to a member of the public (be it the individual or someone else) pursuant to a Freedom of Information Act request.
While the revised accounting of disclosures requirement has a broader reach than the corresponding provision in the current law, it is also narrowing in that an accounting need be given to the individual only upon his specific request, and only of those disclosures made "within a reasonable period of time prior to the request." The "reasonable period of time" should be commensurate with the period of time the agency needs to keep an accounting in order to propagate corrections; that is, so long as information in derivative records could affect determinations as to an individual's rights, opportunities, or benefits. In providing the accounting, the agency shall take reasonable affirmative steps to inform the individual, in a form comprehensible to him, of (a) the date, nature, and purpose of each disclosure; and (b) the name and address of the person or agency to whom the disclosure was made. [(b)(1)(B)(iii)] The revision preserves the current law's use of the word "accounting," as opposed to "record," of disclosures so as to allow for any scheme that enables the agency to reconstruct a list of past disclosures; that is, an explicit record or log entry need not be made for each disclosure if an accounting can otherwise be rendered. This is especially important in the case of frequent bulk transfers of data on large numbers of individuals. As with the current law, the Commission also does not intend that an accounting be considered a "record" as defined in revised subsection (a)(3).