The Privacy Act of 1974: An Assessment. APPENDIX 4 TO The Report of The Privacy Protection Study Commission.. Subsection 3(E)(5)


Alone, subsection 3(e)(5) seems to have had little effect on agency information management practices, but coupled with the requirements to publish annual systems notices, to provide Privacy Act Statements, to establish individual access procedures, and to collect information to the greatest extent practicable from the subject individual himself, it appears to have made some contribution to reducing the amount of information agencies maintain about individuals.

For the President's 1975 annual report on the Act, OMB asked each agency to report on all systems of records it had eliminated from its inventory as a consequence of the Act's passage, as well as any cases in which the amount of information in a system of records had been reduced.35 As noted in Chapter l, many agencies could not give any figures because they had not kept track. Others frankly stated that, even if their destruction of records had been better monitored, some of it would still never have been accounted for, since the existence of the records had never been acknowledged.36 Nevertheless, some, such as the Export-Import Bank,37 reported that the Privacy Act requirement that a system of records be publicly acknowledged had prompted them to eliminate some systems. Others, including the Interior Department38 and the Department of Transportation,39 said that they had disposed of records so as not to have to be responsible for managing them. Cross-index files and other methods of associating records with individuals were also destroyed by the Department of the Interior in order to reduce the number of agency systems subject to the Aet.40

The Foreign Service said that it had reduced the amount of material in its personnel records by 50 to 60 percent,41 and the Drug Enforcement Administration reported that it had destroyed some records after it discovered that they were being maintained without statutory authority.42

The U.S. Information Agency (USIA) eliminated records on 9,300 individuals from its Personnel Security and Integrity Records File.43 The Department of Housing and Urban Development explained that, in conducting research, personal identifiers are no longer retained for the life of a study;44 and the National Center for Health Statistics reported that it too had begun a stepped up system of removing personal identifiers from its records.45 In addition, some of the larger agencies predicted that systems would be eliminated in calendar year 1976 as the justification for maintaining them was reviewed and as small systems were consolidated into larger ones46

Another widespread effect of the Act was the destruction of (uncounted) duplicate records and unofficial or convenience files.47 NASA changed its policy so that supervisors may now maintain uncirculated notes and duplicates of official personnel files but not create their own personnel files 48 The Community Services Administration reported that the Act had prompted the routine shredding of outdated employment history reports on employees.49 The National Transportation Safety Board has stopped preparing its Christmas mailing list that once contained the names, home addresses, and home telephone numbers of its employees, and also removed employees' home addresses and home telephone numbers from its personnel locator.50 The International Trade Commission (ITC) ceased publishing a list of employees' home telephone numbers and addresses, and removed the Social Security number, home address, and telephone number from its carpool application forms.51

Indeed, the review of government forms sparked by the Privacy Act appears to have been one of the most important contributors to reducing the amount of information agencies maintain about individuals.52 The Civil Service Commission revised Standard Form 171 (the application for Federal employment) and also eliminated 20 subsystems. By abandoning just one subsystem, the Security Research Index which contained information on private citizens, only a small portion of whom had ever been applicants for Federal jobs, it eliminated records on 1.3 million individuals.53 Similarly, by ceasing to collect the Social Security numbers of approximately two million people per year, the Department of Labor, as noted earlier, turned a system on "Characteristics of Insured Unemployed" into one that no longer contains records on identifiable individuals.54

In its 1975 annual report, the Defense Department reported that it had reviewed approximately 371,000 forms for compatibility with the Act, destroying 58,560, and simplifying another 22,866.55 Among the materials eliminated were 300 of the 6,700 data elements in the Air Force personnel system 56 The obvious result was to reduce the amount of information the Department collects, as compared to the amount it collected prior to the passage of the Privacy Act, but not the number of records it already maintained on individuals.

Other small changes have been noted. For example, the Veterans Administration reported that since the enactment of the Privacy Act its professional staff is less apt to put unsubstantiated comments in an individual's record,57 and the International Trade Commission's position and personnel roster no longer lists age, marital status, or an indication of Civil Service retention group.58

On the other hand, subsection 3(e)(5) does not appear to have induced the agencies to make any significant changes in their day-to-day procedures for assuring accuracy, timeliness, and completeness. Agencies contend that they have always striven for accuracy, and that "relevant, timely, and complete" are terms that mean different things in different contexts. The latter, of course, is true, but it still seems remarkable that so few agencies have made any attempt to give the terms specific meaning within the recordkeeping operations for which they are respectively responsible. Noteworthy among the efforts to improve accuracy is the Department of Transportation's campaign to impress upon State motor vehicle registries the importance of submitting accurate information to the National Driver Register.59 The Register now receives an average of nine hundred correc tions and updates a day from the States, whereas the previous rate was around one hundred.60

Some agencies have also taken steps to keep their personnel records accurate and up-to-date. ACTION arranges for its employees to verify their personnel files once a year, as does the Pennsylvania Avenue Development Corporation.61 The Committee for the Purchase of Products from the Blind and Other Severely Handicapped does not allow any information to be placed in an employee's personnel file unless he has verified it in writing,62 nor does the Federal Reserve Board (FRB), whose practice in that regard antedates the Privacy Act. The FRB notifies an employee every time a correction is made in his file and annually submits certain parts of the file to him for reverification.63

Most agencies, however, have addressed the timeliness issue mainly by ridding themselves of records for which they have no current or continuing need. Some Departments have applied for and received foreshortened purging schedules from the National Archives. ACTION credits the Privacy Act with reducing the retention period for its volunteer service files from 75 years to seven.64 The Federal Bureau of Investigation is currently destroying some misdemeanor information after 10 years and some felony convictions after 20. Previously, it had maintained both indefinitely, and while the change cannot be attributed exclusively or even directly to the Privacy Act, it reflects a generally heightened sensitivity to the importance of keeping records about individuals up-to-date 65

The Act has affected some agencies' retention of unsolicited information. When the Pennsylvania Avenue Development Corporation receives an unsolicited resume from a prospective applicant, it either returns it or sends

a "Privacy Act Statement" to the applicant who is asked to sign and return it, thereby acknowledging that he has read it. No resume the Corporation retains is kept on file for more than a year.66 The Veterans Administration does not keep information on an unsuccessful applicant more than two years,67 and the Federal Trade Commission destroys the letters it receives from consumers after one year.68

Perhaps the most important observation to be made is that the changes that have occurred have by no means been uniform throughout the government. The retention period for information in an employee's official personnel folder is a case in point. The right-hand side of the folder is reserved for Civil Service Commission documents whose retention periods are set by the CSC, while the documents on the left-hand side, which vary from agency to agency and are apt to include performance ratings, letters of recommendation and records concerning disciplinary actions, have varying or no set retention periods. The IRS, the Veterans Administration, and the Postal Service purge them every two years. DHEW and GSA purge them annually. The VA purges them when an employee leaves the Administration. The Postal Service purges its supervisor's personnel records when an employee is transferred to another USPS division.69