The Privacy Act appears to have caused a modest decline in the amount of information about individuals that agencies disclose to others. By and large, however, the impact has been at the margins of agency practice.
For example, prior to the Act the State Department regularly reported to the FBI, the CIA, and the IRS on Americans living overseas. This practice has now been curtailed and the release of such information is limited to published routine uses or law enforcement requests.87 The National Labor Relations Board has stopped releasing the forwarding addresses of former employees to their credit union,88 and the Civil Service Commission no longer discloses applicants' examination scores to their parents and spouses.89 The Civil Service Commission has limited the disclosures they will make of information in an individual's retirement records 90
Other agencies have altered their policies on disclosures to the press. The Postal Service no longer releases information on individuals currently under investigation,91 and the Customs Service has limited the amount of information it makes available about an arrest 92 The Secret Service, in some cases, requires the press to obtain an individual's written authorization before it will release information about him,93 and the USIA now requires an authorization before releasing photographs or biographic information on agency personnel.94 Many agencies have also stopped disclosing information to "Call for Action" organizations and to lawyers inquiring on behalf of clients unless they have a written authorization from the individual to whom the information pertains. "Call for Action" organizations, in particular, have complained that this unduly prolongs the process of obtaining information and seriously undermines their value to the public. Researchers are another category of nongovernmental users of agency records that have had trouble getting information from the agencies since the Act took effect 95
On balance, however, not much has changed. Agencies with law enforcement functions complain about other agencies' reluctance or outright refusal to disclose information to them. The Federal Aviation Administration, for example, has reported a slight impairment of its operations as a consequence of limits placed on the release of security and enforcement information by other agencies,96 and the Postal Service has reported that several Federal agencies have been willing to respond to law enforcement requests only when the requests were made through U. S. attomeys.97 NASA says that its law enforcement requests are no longer granted automatically; that it can take two-to-three-weeks to obtain information the agency used to be able to get by telephone.98 The FBI claims that its ability to obtain information from other agencies has been hampered by the Act, although it notes that it also gives out less information today than it used to.99
In their 1975 annual reports, the most frequently cited change in agency disclosure policy was the addition of a requirement that an individual's prior written authorization be obtained before information about him is disclosed in response to credit inquiries and employment verification requests.100 Some agencies, such as the Community Services Administration, also reported that the mere existence of individual authorization procedures has greatly reduced the number of attempts to gain unauthorized access to information pertinent to complaints about discrimination and unfair labor practices.101 Still others complained about the extra time involved in obtaining an individual's written authorization, suggesting that they are, in fact, doing so more frequently than in the past.
The one type of disclosure on which the Act appears to have had no impact at all is the ubiquitous internal agency disclosure; i.e., the disclosure of information by one agency component to another. Because the Act uses the Freedom of Information Act definition of "agency," such disclosures can be handled as subsection 3(b)(1) disclosures (i.e., to officers and employees of the agency who have a need for the record in the performance of their duties) rather than as routine uses that would have to meet the compatible-purpose test. The Social Security Administration disclosures to the DHEW Parent Locator Service mentioned earlier offer one example of how subsection 3(b)(1) can work within a large agency, and DHEW is not the only large Federal agency with many different components. It appears that the ease with which such "internal" disclosures can be made is not being abused, although the potential for abuse is certainly there. In addition, by failing to put constraints on internal disclosures the Act effectively deprives an individual of the ability to find out where information about him has gone and the uses to which it was put within the agency that maintains it, unless an agency voluntarily takes steps to inform him.