The Privacy Act of 1974: An Assessment. APPENDIX 4 TO The Report of The Privacy Protection Study Commission.. Keeping Track of Disclosures

01/07/1977

Section 3(c)(1) of the Privacy Act requires each agency to keep an accurate accounting of

(A)   the date, nature, and purpose of each disclosure of a record to any person or to another agency made under subsection (3)(b) . . .; and

(B)   the name and address of the person or agency to whom the disclosure is made . . . . [5 U.S.C. 552a(c)(1)(A), (B)]

There are only two exceptions to this requirement. No accounting need be made of disclosures "to those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties" (as provided in subsection 3(b)(1)), or of disclosures that are required by the Freedom of Information Act (as provided in subsection 3(b)(2)).

The Act's accounting of disclosures requirement has three objectives: (l) to provide an individual with a listing of the uses and disclosures of a record about him; (2) to facilitate the propagation of corrections; and (3) to promote internal agency auditing and compliance monitoring. Currently the emphasis is on the first objective and the agencies have used several different methods to achieve it.

The Act calls for an "accounting" rather than a "record" of each disclosure, thereby indicating that an agency may use any method of accounting it chooses, so long as it has the capacity to respond to an individual's request for a list of the disclosures it has made of a record about him.102 Thus, it is not surprising that the agencies have handled the accounting requirement in a variety of ways.

For example, the Civil Service Commission and the Social Security Administration, will, in some cases, make a copy of whatever has been disclosed and note on it the accounting information the Act requires them to keep. The copy is filed with the individual's record so he has access to it at the same time that he has access to the record itself. Other agencies merely keep a description of each disclosure on file, either with the individual's record or as an appendage to the system of records. The latter method is commonly used in accounting for mass disclosures, such as disclosures of payroll information to the Treasury Department.

The Act requires an agency to maintain its disclosure accountings for five years or the life of the record, whichever is longer. [5 U.S. C 552a(c)(2)] It is too soon to assess the impact of this retention requirement, but the Community Services Administration claims that it has already postponed retiring some records so that the accounting of disclosures can be kept with them for the mandatory five years.103

Of all the requirements in the Privacy Act, the accounting of disclosures is the one the agencies have criticized most. OMB reported in March 1977 that, as of the previous September, complying with the accounting requirement has cost the agencies more than $10 million. Some agencies have even looked for ways around the requirement. As described earlier, the DHEW Guaranteed Student Loan Program tried, unsuccessfully, to get applicants to authorize it not to keep an accounting of the disclosures it makes about them in the course of processing loan applications. The Social Security Administration contends that to fulfill the accounting requirement effectively its computer systems would have to be totally redesigned and that only a handful of individuals have ever asked to see the accountings SSA keeps.104

The Department of Defense reports that some of its components have had a hard time implementing the accounting of disclosures requirement, but that the Department of the Air Force has developed an efficient, wholly computerized method for keeping track of its disclosures of military personnel records. Called the Privacy Act Tracking System, it not only logs all disclosures, all amendments, and all statements of dispute, but also prints out a list of all prior recipients of a record who need to be informed of any change made in it.105

A frequently heard complaint is that an accounting must be made in situations where the need to propagate corrections does not arise-for example, when payroll records are being audited, or when disclosures are made for statistical purposes only. There is also some question as to whether subsection 3(c) requires an accounting every time an individual is given access to a record about himself. Many agencies keep an accounting only if an individual specifically cites the Privacy Act when asking to see a record. For example, many agencies that permitted an employee to have access to his personnel records before the Privacy Act required them to do so, continue to use their pre-Privacy Act procedures.106 Finally, there is uncertainty about whether an accounting need be kept of a disclosure to a Congressional office that asks for a record on behalf of the individual to whom it pertains. The IRS considers a Congressman to be the designated representative of an individual, and thus, someone to whom a record may be disclosed without an accounting, so long as he has in hand a letter from the individual requesting the Congressman's assistance.107 Of the other agencies the Commission staff contacted, however, all require that an accounting be kept of such disclosures.

Although the accounting of disclosures requirement could be modified without diminishing its utility as a check on agency practice,108 it clearly should not be abandoned altogether, as some agencies have argued. The individual's interest in reviewing the accountings agencies keep of their disclosures of records about him should not be the sole measure of the requirement's value. Many individuals do not know that the accountings exist or that they have a right to review them. Moreover, the accountings can be of great help in propagating corrections and in conducting the audits of agency compliance with the Act that will become increasingly important as more and more records and record systems are automated.