The Privacy Act of 1974: An Assessment. APPENDIX 4 TO The Report of The Privacy Protection Study Commission.. Collection and Maintenance of Information

01/07/1977

The suggested revision incorporates verbatim the current requirement [5 U.S.C. 552a(e)(1)] that an agency "collect or maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or by Executive Order of the President." [(e)(1)(C)] Although the Commission found that the requirement does not appear to have had a significant effect on agency practice, it believes that the fault is in the vehicle for implementing it. The implementation strategy and strengthened incentives for compliance that the Commission suggests should make the requirement more effective. Furthermore, the provision provides an individual with an invaluable tool in any effort to correct or amend a record about himself, and particularly in any legal action he brings to enforce agency compliance with the law.

The suggested revision also strengthens the current law by not permitting the Central Intelligence Agency and agencies whose principal function is any activity pertaining to criminal law enforcement to escape totally the requirement that the information they maintain be complete, relevant, timely, and accurate. They are permitted to maintain untimely, inaccurate, incomplete, or irrelevant information only if it is clearly identified as such to all users and recipients. [(e)(1)(D)]

The Commission would retain the current requirement that agencies collect information to the greatest extent practicable directly from the subject individual [5 U.S.C. 552(e)(2)], but broaden it by directing it both to circumstances in which an "adverse determination" may result and also to circumstances in which the information "may affect" determinations about an individual's rights, benefits, or privileges under Federal programs. [(e)(1)(A)] This revised formulation better fulfills the objective of giving an individual as extensive a role as possible in assuring the accuracy and completeness of information that may be employed to make decisions about him.

The question of whether a "Privacy Act Statement" [5 U.S.C. 552a(e)(3)] needs to be given to anyone other than the individual about whom information is being collected is resolved in the revision by designating as recipients of statements "individuals from whom [each agency] requests information about themselves or others." The Commission further suggests that the Act be revised to require that agencies take "reasonable affirmative steps" to enable an individual to decide, in "as informed and uncoerced a manner as is reasonably possible," whether to provide information about himself or others. [(e)(1)(B)] This formulation would relax the existing requirement that an individual be given a Privacy Act Statement every time he is asked to supply information, no matter how frequently, while retaining and strengthening the Act's restriction on agencies employing the notice as a coercive tool. In addition, instead of being informed in the statement of the routine uses of the information sought, an individual must be informed of "any routine or collateral uses of the information which could be reasonably expected to influence" his decision. [(e)(1)(B)(iv)] The "types of additional information, techniques, and sources that may be used to verify the information" the individual provides must also be described. [(e)(1)(B)(v)] This requirement, which the Commission recommended for the private-sector in its final report, fills an important gap in the current law. Because providing a concise description of all uses and third-party source verification procedures, however, may occasionally prove to be more confusing than enlightening, the title, business address, and telephone number of a responsible agency official who can assist the individual must be listed. [(e)(1)(B)(vi)] Finally, the revision also provides specifically for clear notice of possible redisclosures of information when it is collected for a research or statistical purpose. [(e)(1)(B)(vii)]

While the suggested revision retains the safeguarding of information provision in the current law, it substitutes a reasonableness standard for the current requirement that agencies establish "appropriate" safeguards against "any" anticipated threats or hazards. Instead, agencies would have to establish "reasonable" safeguards so as to "minimize the risk" of such hazards. [(e)(1)(E)] This language comports with prevailing practice under the Privacy Act and also reflects the Congress' original intent as expressed in the Act's legislative history .9

The Commission's draft retains the requirement that an agency notify an individual when a record about him is made available in response to compulsory legal process once that process becomes a matter of public record.[(e)(1)(F)] The Commission, however, would require an agency to take "reasonable affirmative steps" to provide notice.

The current prohibition on collecting First Amendment information would be tightened considerably. [(e)(2)] No longer would such collection be allowed simply because it was "within the scope of an authorized law enforcement activity." [5 U.S.C. 552a(e)(7)] Rather, the Commission's suggested language would tie it to certain specific kinds of situations. A description of "the content of any publication, speech, or other expression of belief or argument by an individual in the exercise of rights guaranteed by the First Amendment" would not be allowed to be collected or maintained unless it were compiled pursuant to an authorized investigation of the sedition or espionage laws of the United States, or unless it would be legally admissible evidence in a criminal prosecution compiled pursuant to an authorized investigation under the criminal laws of the United States. Similarly, a description of the forum in which an individual exercises his First Amendment rights of speech, association, or religion could not be collected or maintained unless it were compiled pursuant to an authorized investigation of a violation of the laws of the United States. Other descriptions of an individual's exercise of First Amendment rights would be limited to collecting and maintaining "the time, place, and observed associations of an individual which are compiled pursuant to, and in the course of, an authorized investigation of a violation of the laws of the United States." An agency, however, would not be prohibited from collecting or maintaining a specific item of information required to be collected by statute or authorized to be collected by the individual to whom it pertains. In addition, collection and maintenance of information for "a reasonable and proper library, bibliographic, abstracting, or similar reference function" would not be curtailed.