The Privacy Act of 1974: An Assessment. APPENDIX 4 TO The Report of The Privacy Protection Study Commission.. The Agency Experience in General

01/07/1977

The 97 Federal agencies that maintain systems of records subject to the Privacy Act of 1974 have all taken different approaches to administra-tion, training, and compliance monitoring. No one approach by itself appears to have hindered good-faith efforts to comply. On the other hand, agencies or components of agencies that have carefully structured programs for administering the Act appear to be the ones in which the Act's objectives are being best achieved. The DOD and the IRS are good examples. Both are accustomed to dealing with sensitive information and with issues relating to its proper collection, maintenance, use, and dissemination. Information policy and information management are concepts with which they have had a great deal of practical experience, and this is reflected in their respective approaches to meeting the obligations the Privacy Act imposes on them.

In most of the other agencies, training and compliance monitoring have been weak. Nearly all agencies have revised their internal guidance manuals so that personnel responsible for records about individuals can find out what is required of them. Several agencies also have added a check for Privacy Act compliance to their existing audit and inspection procedures and others plan to do so in the future. None, however, appears to be checking on its contractors' compliance with the Act and most have relied on others to train their employees.

The Office of Management and Budget and the Civil Service Commission have established a program of one-day seminars for top agency management personnel in 11 major cities. The Civil Service Commission has also run a program of two-day workshops, followed by a one-day follow-up session, in which Privacy Act requirements have been examined in some detail. The CSC has made material available to all agencies for use in structuring their own training courses. The previously mentioned Depart-ment of Defense training program has also accepted trainees from other agencies. In nine regions, the National Archives and Record Service has conducted a one-day course for specialists in records management, and some agencies have sent their employees to seminars held by the District of Columbia Bar Association, the Federal Bar Association, and the American Civil Liberties Union. The Energy Research and Development Administration hired an outside firm, Auerbach Associates, to train its employees.56 Beyond these piecemeal efforts, however, agency employees have by and large been left to their own devices.