The Privacy Act of 1974: An Assessment. APPENDIX 4 TO The Report of The Privacy Protection Study Commission.. Privacy Act Statements


Subsection 3(e)(3) of the Act stipulates that an agency must:

. . . inform each individual whom it asks to supply information, on the form which it uses to collect information or on a separate form that can be retained by the individual-

(A) the authority (whether granted by statute or executive order of the President) which authorizes the solicitation of the infor-mation and whether disclosure of such information is manda-tory or voluntary;
(B) the principal purpose or purposes for which the information is intended to be used;
(C) the routine uses which may be made of the information, as published pursuant to [subparagraph (D) of subsection 3(e)(4)]; and
(D) the effects on him, if any, of not providing all or any part of the information . . . . (5 US. C. 552a(e)(3)]

There is much to be said for and against this so-called "Privacy Act Statement." On the one hand, it is the only one of the Act's public reporting requirements that specifically directs an agency to describe its internal uses of information about individuals. Because it is given to the individual at the time the agency has direct contact with him, and before he supplies any information, it helps to make the individual aware of his rights under the Act and partly compensates for his lack of familiarity with the system notices published in the Federal Register. On the other hand, anyone who has read the Privacy Act Statement on a Federal income tax return knows how little a statement that attempts to comply with the requirements of subsection 3(e)(3) can actually tell about agency record-keeping practices. For some agencies, moreover, subsection 3(e)(3) appears to be unduly burdensome. When a Federal employee has to sign daily or even weekly for the electronic office equipment he uses, for example, it seems burdensome and wasteful to make the agency give him a statement each time, explaining the authority for obtaining his signature, the principal purpose for which the information is intended to be used, its routine uses, and the effects on him of not providing it.

Several agencies have tackled such difficulties in imaginative ways. In some offices where a form requesting individually identifiable information must be completed as a matter of routine business, the Department of Defense puts the information required to be provided in the Privacy Act Statement on a conspicuously hung poster, which also advises that an individual copy of the statement can be had for the asking. Similarly, when an individual makes his initial visit to a DOD medical facility, the Department gives him a copy of the Privacy Act Statement that covers 222 medical forms the facilities use, and, in addition, places a copy of the Statement in his file. If the individual wants more copies, he need only ask for them.27 These methods of keeping the Privacy Act Statement requirement from being unduly burdensome or wasteful seem reasonable so long as the individual's attention is drawn to the Statement as frequently as the character of his relationship with the data-gathering agency and the spirit of the Act appear to warrant.