Subsection 3(b)(2) of the Privacy Act stipulates that a record about an individual may not be disclosed to a member of the public unless its disclosure is required by the Freedom of Information Act. This provision was included to "preserve the status quo as interpreted by the courts regarding the disclosure of personal information" pursuant to the requirements of the FOIA.76 It does, however, make one important change. Prior to passage of the Privacy Act, an agency, if it so desired, could freely disclose a record about an individual to a member of the public who requested it under the Freedom of Information Act, whereas now the agency must first determine that such a disclosure is, in fact, required by the FOIA.
In particular, FOIA exemption (6) permits the withholding of "personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy." [5 U.S.C. 552(6)(6)] The courts have interpreted FOIA exemption (6) to mean that there are no defined categories of records that may be withheld; that each request from a member of the public must be considered on its own merits; and that the determination as to whether complying with it would constitute a clearly unwarranted invasion of personal privacy must rest on a balancing of the private and public interests involved. [Rose v. Department of the Air Force, 425 U.S. 352, 44 L W. 4503, 4509 (April 19, 1976)] If the agency determines that disclosure would not constitute a clearly unwarranted invasion of personal privacy, it may not withhold the record. A refusal to disclose the salary and grade level of a Federal civil servant, for example, could not be justified under exemption (6). If, however, the agency determines that disclosure of the record would constitute an unwarranted invasion of personal privacy, it must either refuse to disclose it or risk violating subsection 3(b)(2) of the Privacy Act.
There are some additional complexities, such as determining whether the record is, in fact, subject to the Privacy Act, i.e., whether it is maintained in a system of records as defined in the Act. If portions of a record could be disclosed without violating the subject individual's personal privacy, those portions must be disclosed. The net effect, however, is to make an agency more careful than it used to be about how it responds to FOIA requests for individually identifiable records, since it no longer has discretion to comply with them irrespective of their privacy protection implications.
It is this situation that has given rise to some concern about the interface between the sanctions in the two Acts. Subsection (a)(4)(F) of the Freedom of Information Act authorizes the Civil Service Commission to impose administrative sanctions on agency officials whom a court finds to have arbitrarily or capriciously denied an FOIA request for records, while subsection 3(i)(1) of the Privacy Act authorizes criminal sanctions for any Federal employee who knowingly and willfully violates any of the Act's disclosure prohibitions. Nonetheless, if an agency makes a good-faith determination that disclosing a record about an individual would constitute a clearly unwarranted invasion of his personal privacy, it is hard to believe that a court would find that its decision to withhold the record had been arbitrarily or capriciously made. Nor would one expect a good-faith determination that a record must be disclosed in response to an FOIA request to be treated as a knowing and willful violation of the Privacy Act's disclosure prohibitions.
A slightly more difficult question is presented by the possibility that an individual might sue an agency, under subsection 3(g)(1)(D) of the Privacy Act, alleging that the agency was wrong in determining that the disclosure of a record about him to a member of the public would not be a clearly unwarranted invasion of his personal privacy, and that he was harmed as a result. Such an action, however, would be brought against the United States rather than the official responsible for the determination, and the plaintiff would not be entitled to damages unless the court found that the agency had acted in a manner that was "intentional or willful" [5 U.S.C 552a(g)(4)], an unlikely event if the agency did indeed determine, in good faith, that the disclosure was required by the Freedom of Information Act.
On the whole, the agencies have adapted well to the Congress' attempt to make the two Acts compliment one another where disclosures to members of the public are concerned. Press requests for access to information about individuals have been the hardest to deal with, just as they were prior to passage of the Privacy Act, and there have also been some problems involving FOIA disclosures of individually identifiable records that are not maintained in a "system of records" and thus are not subject to the Privacy Act disclosure prohibitions.