The Privacy Act of 1974: An Assessment. APPENDIX 4 TO The Report of The Privacy Protection Study Commission.. Exempt Systems of Records


Although all Federal agency record-keeping operations that fit the Privacy Act's definition of a system of records are subject to some of its requirements, the Act's scope of application is significantly narrowed by the opportunity it gives some agencies to exempt whole systems from many of the Act's more important requirements. This is particularly true of systems maintained for law enforcement and investigative purposes. Subsection 3(j) of the Act permits exemption from most requirements if the records in a system of records are records maintained by the Central Intelligence Agency j5 U.S.C. 552a0)(1)]; or identification files, investigative records, or reports compiled on individuals during the time between arrest and final release and maintained by an agency "or component thereof which performs as its principal function any activity pertaining to the enforcement of criminal laws." (5 U.S.C. 552a(j)(2)] The provisions of the Act from which records cannot be exempted under subsection 3(j) are primarily those that establish certain records management responsibilities. For example, an accounting of disclosures of information from an exempt system must be kept, and an agency that maintains an exempt law enforcement system must take steps to assure the accuracy and relevance of records it discloses to anyone other than another agency, but the basic oversight and enforcement vehicles otherwise available in the Act, i.e., individual access and correction rights and civil remedies, cannot be used to make sure the agency complies.

The exemption opportunities in subsection 3(k) [5 U.S.C. 552a(k)] are less sweeping than those in Subsection 30), but they also serve to insulate many systems from fundamental protections the Act elsewhere guarantees an individual. Subsection 3(k)(2) creates an exemption opportunity for investigatory records compiled for both criminal and civil law enforcement purposes that have not already qualified for an exemption under subsection 3(j)(2). An agency that takes a 3(k)(2) exemption for a system of records is excused from granting an individual access to records about himself; from revealing to the individual its accounting of the disclosures it makes of records about him; from publishing certain portions of the required annual notice on the system; and from promulgating regulations establishing procedures by which the individual can see, copy, and correct or amend a record about himself. Subsection 3(k), like subsection 30), also allows an exemption from the Act's requirement that the information in a system be "relevant and necessary" to accomplish a purpose mandated by law.

The President's report to the Congress on Privacy Act implementation for calendar year 1975 showed that exemptions had been claimed for 889, or 13 percent of the 6,723 systems whose existence was reported during the first three months after the Act took effect on September 27, 1975. For some systems, an agency claimed both 30) and 3(k) exemptions. Figure 1 shows the type of systems for which exemptions were taken.

While one can agree with the basic public-policy determination that some Federal agency records should not be subject to all of the Privacy Act's requirements, lest ongoing law enforcement investigations or legitimate national security interests be jeopardized, it nonetheless seems clear that the exemption provisions currently in the Act unnecessarily narrow its scope of application and thus unduly frustrate the achievement of its basic objectives. The Secret Service, for example, has had to exempt its entire "Criminal Investigation Information System" [41 F. R 45437 (October 14, 1976)] in order to exempt any part of it, even though many of the records in the system could be (and, under the Freedom of Information Act, often are) open to the individuals to whom they pertain; could be susceptible to correction and amendment without undue burden on the agency; and could be maintained with relatively strict procedures for assuring their accuracy and relevance when they are disclosed to third parties. In particular, one of the four categories of information in the system-records "consisting only of identifying data and notations of arrest, the nature and disposition of criminal charges, sentencing, confinement, release, and parole and proba-tion status"-could be brought within the full scope of the Act without unreasonable difficulty. Such records, largely derived from public records, are unlikely to jeopardize ongoing investigations if disclosed to the individuals to whom they pertain and if inaccurate, but used to make a decision about an individual, either by the Service itself or by another agency, could be the cause of substantial harm to the individual.

Agencies not ordinarily thought of as investigative or law enforcement agencies are often in the same position as the Secret Service. The Federal Trade Commission's "Investigational, Legal, and Public Records" system in many respects parallels the Secret Service's Criminal Investigation Information System, but it too has been exempted in its entirety. [41 FR 39719 (September 15,1976); 16 C FR. 4.13]

Exemption Provision


Figure 1
Exemptions Claimed Under the Act

Central Intelligence Agency Records (j)(1) 60
Criminal Law Enforcement Agency Records (j)(2) 210
Classified Records (k)(1) 236
Other Law Enforcement Records (k)(2) 545
Protective Services Records (k)(3)  72
Statistical Records (k)(4) 80
Federal Service Suitability Investigative Records (k)(5) 272
Testing or Examination Records (k)(6) 101
Military Service Promotional Potential Records (k) (7) 88
   Total Systems Exempted 889*
   Total Systems Not Exempted 5834
Total Systems 6,723
*NOTE: The total number of systems exempted is less than the sum of the numbers exempted under each exemption provision because one system may have been exempted under more than one provision.

Finally, the broad scope of subsections 3(j) and 3(k) has permitted some agencies to exempt records when their connection with investigative efforts is tenuous at best, and where the rationale for excusing the records from the full force of the Act (for not letting an individual see information about himself, for instance) is difficult to understand. One example is the Department of the Interior's "Endangered Species Licensee System," which contains the "name, address, date of birth, height, weight, color of hair and eyes, business telephone number, occupation and Social Security number" of each individual requesting a license. [41 F. R 41296 (September 21,1976); 43 CF. R. 2.79 (b)] In Chapter 13 of its final report, and in Chapter 3 of this volume, the Commission suggests some ways of resolving this admittedly difficult problem.