(5) An action to enforce any liability created under this
section may be b rought in the district court of the United States
in the district in which the complainant resides, or has his principal
place of business, or in which the agency records are situated,
or in the District of Columbia, without regard to the amount in
controversy, within two years from the date on which the cause
of action a rises, except that where an agency has materially
and willfully misrepresented any information required under this
section to be disclosed to an individual and the information so
misrepresented is material to establishment of the liability of
the agency to the individual under this section, the action may
be brought at any time within two years after discovery by the
individual of the misrepresentation. Nothing in this section
shall be construed to authorize any civil action by reason of
any injury sustained as the result of a disclosure of a record
prior to September 27, 1975.
(h) Rights of legal guardians
For the purposes of this section, the parent of any minor,
or the legal guardian of any individual who has been declared
to be incompetent due to physical or mental incapacity or age
by a court of competent jurisdiction, may act on behalf of the
individual.
(i)(1) Criminal penalties
Any officer or employee of an agency, who by virtue of his
employment or official position, has possession of, or access
to, agency records which contain individually identifiable information
the disclosure of which is prohibited by this section or by rules
or regulations established thereunder, and who knowing that disclosure
of the specific material is so prohibited, willfully discloses
the material in any manner to any person or agency not entitled
to receive it, shall be guilty of a misdemeanor and fined not
more than $5,000.
(2) Any officer or employee of any agency who willfully
maintains a system of records without meeting the notice requirements
of subsection (e)(4) of this section shall be guilty of a misdemeanor
and fined not more than $5,000.
(3) Any person who knowingly and willfully requests or obtains
any record concerning an individual from an agency under false
pretenses shall be guilty of a misdemeanor and fined not more
than $5,000.
(j) General exemptions
The head of any agency may promulgate rules, in accordance
with the re quirements (including general notice) of sections
553(b)(1), (2), and (3), (c), and (e) of this title, to exempt
any system of records within the agency from any part of this
section except subsections (b), (c)(1) and (2), (e)(4)(A) through
(F), ( e)(6), (7), (9), (10), and (11), and (i) if the system
of records is--
(1) maintained by the Central Intelligence Agency; or
(2) maintained by an agency or component thereof which performs
as its prin cipal function any activity pertaining to the enforcement
of criminal laws, including police efforts to prevent, control,
or reduce crime or to apprehend criminals, and the activities
of prosecutors, courts, correctional, probation, pardon, or parole
authorities, and which consists of (A) information compiled for
the purpose of identifying individual criminal offenders and alleged
offenders and consisting only of identifying data and notations
of arrests, the nature and disposition of crim inal charges, sentencing,
confinement, release, and parole and probation status; (B) information
compiled for the purpose of a criminal investigation, including
reports of informants and investigators, and associated with an
identifiable individual; or (C) reports identifiable to an individual
compiled at any stage of the process of enforcement of the criminal
laws from arrest or indictment through release from supervision.
At the time rules are adopted under this subsection, the agency
shall include in the statement required under section 553(c) of
this title, the reasons why the system of records is to be exempted
from a provision of this section.
(k) Specific exemptions
The head of any agency may promulgate rules, in accordance
with the requirements (including general notice) of sections 553(b)(1),
(2), and (3), (c), and (e) of this title, to exempt any system
of records within the agency from subsections (c)(3), (d), (e)(1),
(e)(4)(G), (H), and (I) and (f) of this section if the system
of records is--
(1) subject to the provisions of section 552(b)(1) of this
title;
(2) investigatory material compiled for law enforcement
purposes, other than material within the scope of subsection (j)(2)
of this section: Provided, however, That if any
individual is denied any right, privilege, or benefit that he
would otherwise be entitled by Federal law, or for which he would
otherwise be eligible, as a result of the maintenance of such
material, such material shall be provided to such individual,
except to the extent that the disclosure of such material would
reveal the identity of a source who furnished information to the
Government under an express promise that the identity of the source
would be held in con fidence, or, prior to the effective date
of this section, under an implied promise that the identity of
the source would be held in confidence;
(3) maintained in connection with providing protective services
to the President of the United States or other individuals pursuant
to section 3056 of Title 18;
(4) required by statute to be maintained and used solely
as statistical records;
(5) investigatory material compiled solely for the purpose
of determining suit ability, eligibility, or qualifications for
Federal civilian employment, military service, Federal contracts,
or access to classified information, but only to the extent that
the disclosure of such material would reveal the identity of a
source who furnished information to the Government under an express
promise that the identity of the source would be held in confidence,
or, prior to the effective date of this section, under an implied
promise that the identity of the source would be held in confidence;
(6) testing or examination material used solely to determine
individual qualifications for appointment or promotion in the
Federal service the disclosure of which would compromise the objectivity
or fairness of the testing or examination process; or
(7) evaluation material used to determine potential for
promotion in the armed services, but only to the extent that the
disclosure of such material would reveal the identity of a source
who furnished information to the Government under an express promise
that the identity of the source would be held in con fidence,
or, prior to the effective date of this section, under an implied
promise that the identity of the source would be held in confidence.
At the time rules are adopted under this subsection, the agency
shall include in the statement required under section 553(c) of
this title, the reasons why the system of records is to be exempted
from a provision of this section.
(1)(1) Archival records
Each agency record which is accepted by the Archivist of
the United States for storage, processing, and servicing in accordance
with section 3103 of Title 44 shall, for the purposes of this
section, be considered to be maintained by the a gency which deposited
the record and shall be subject to the provisions of this section.
The Archivist of the United States shall not disclose the record
except to the agency which maintains the record, or under rules
established by that agency which are not inconsistent with the
provisions of this section.
(2) Each agency record pertaining to an identifiable individual
which was transferred to the National Archives of the United States
as a record which has sufficient historical or other value to
warrant its continued preservation by the United States Government,
prior to the effective date of this section, shall, for the purposes
of this section, be considered to be maintained by the National
Archives and shall not be subject to the provisions of this section,
except that a statement generally describing such records (modeled
after the requirements relating to records subject to subsections
(e)(4)(A) through (G) of this section) shall be published in the
Federal Register.
(3) Each agency record pertaining to an identifiable individual
which is transferred to the National Archives of the United States
as a record which has sufficient historical or other value to
warrant its continued preservation by the United States Government,
on or after the effective date of this section, shall, for the
purposes of this section, be considered to be maintained by the
National Archives and shall be exempt from the requirements of
this section except subsections ( e)(4)(A) through (G) and (e)(9)
of this section.
(m) Government contractors
(1) When an agency provides by a contract for the operation
by or on behalf of the agency of a system of records to accomplish
an agency function, the a gency shall, consistent with its authority,
cause the requirements of this section to be applied to such system.
For purposes of subsection (i) of this section any such contractor
and any employee of such contractor, if such contract is agreed
to on or after the effective date of this section, shall be considered
to be an employee of an agency.
(2) A consumer reporting agency to which a record is disclosed
under section 3711(e) of Title 31 shall not be considered a contractor
for the purposes of this section.
(n) Mailing lists
An individual's name and address may not be sold or rented
by an agency unless such action is specifically authorized by
law. This provision shall not be construed to require the withholding
of names and addresses otherwise permitted to be made public.
(o) Matching agreements--
(1) No record which is contained in
a system of records may be disclosed to a recipient agency or
non-Federal agency for use in a computer matching program except
pursuant to a written agreement between the source agency and
the recipient agency or non-Federal agency specifying--
(A) the purpose and legal authority for conducting
the program;
(B) the justification for the program and the anticipated
results, including a specific estimate of any savings;
(C) a description of the records that will be matched,
including each data element that will be used, the approximate
number of records that will be matched, and the projected starting
and completion dates of the matching program;
(D) procedures for providing individualized notice
at the time of application, and notice periodically thereafter
as directed by the Data Integrity Board of such agency (subject
to guidance provided by the Director of the Office of Management
and Budget pursuant to subsection (v)), to--
(i) applicants for and recipients of financial
assistance or payments under Federal benefit programs, and
(ii) applicants for and holders of positions as
Federal personnel,
that any information provided by such applicants, recipients,
holders, and individuals may be subject to verification through
matching programs;
(E) procedures for verifying information produced in
such matching program as required by subsection (p);
(F) procedures for the retention and timely destruction
of identifiable records created by a recipient agency or non-Federal
agency in such matching program;
(G) procedures for ensuring the administrative, technical,
and physical security of the records matched and the results of
such programs;
(H) prohibitions on duplication and redisclosure of
records provided by the source agency within or outside the recipient
agency or the non-Federal agency, except where required by law
or essential to the conduct of the matching program;
(I) procedures governing the use by a recipient agency
or non-Federal agency of records provided in a matching program
by a source agency, including procedures governing return of the
records to the source agency or destruction of records used in
such program;
(J) information on assessments that have been made
on the accuracy of the records that will be used in such matching
program; and
(K) that the Comptroller General may have access to
all records of a recipient agency or a non-Federal agency that
the Comptroller General deems necessary in order
to monitor or verify compliance with the agreement.
(2)(A) A copy of each agreement entered into pursuant to
paragraph (1) shall--
(i) be transmitted to the Committee on Governmental
Affairs of the Senate and the Committee on Government Operations
of the House of Representatives; and
(ii) be available upon request to the public.
(B) No such agreement shall be effective until 30 days
after the date on which such a copy is transmitted pursuant to
subparagraph (A)(i).
(C) Such an agreement shall remain in effect only for
such period, not to exceed 18 months, as the Data Integrity Board
of the agency determines is appropriate in light of the purposes,
and length of time necessary for the conduct, of the matching
program.
(D) Within 3 months prior to the expiration of such
an agreement pursuant to subparagraph (C), the Data
Integrity Board of the agency may, without additional review,
renew the matching agreement for a current, ongoing
matching program for not more than one additional year if--
(i) such program will be conducted without any
change; and
(ii) each party to the agreement certifies to
the Board in writing that the program has been
conducted in compliance with the agreement.
(p) Verification and opportunity to contest findings
(1) In order to protect any individual whose records are
used in a matching program, no recipient agency, non-Federal agency,
or source agency may suspend, terminate, reduce, or make a final
denial of any financial assistance or payment under a Federal
benefit program to such individual, or take other adverse action
against such individual, as a result of information produced by
such matching program, until--
(A)(i) the agency has independently verified the information;
or
(ii) the Data Integrity Board of the agency, or
in the case of a non-Federal agency the Data Integrity Board of
the source agency, determines in accordance with
guidance issued by the Director of the Office of Management
and Budget that--
(I) the information is limited to identification
and amount of benefits paid by the source agency under a Federal benefit
program; and
(II) there is a high degree of confidence that
the information provided to the recipient
agency is accurate;
(B) the individual receives a notice from the agency
containing a statement of its findings and informing the individual
of the opportunity to contest such findings; and
(C)(i) the expiration of any time period established
for the program by statute or regulation for the individual to
respond to that notice; or
(ii) in the case of a program for which no such
period is established, the end of the 30-day period beginning
on the date on which notice under subparagraph
(B) is mailed or otherwise provided to the individual.
(2) Independent verification referred to in paragraph (1)
requires investigation and confirmation of specific information
relating to an individual that is used as a basis for an adverse
action against the individual, including where applicable investigation
and confirmation of--
(A) the amount of any asset or income involved;
(B) whether such individual actually has or had access
to such asset or income for such individual's own use; and
(C) the period or periods when the individual actually
had such asset or income.
(3) Notwithstanding paragraph (1), an agency may take any
appropriate action otherwise prohibited by such paragraph if the
agency determines that the pub lic health or public safety may
be adversely affected or significantly threatened during any notice
period required by such paragraph.
(q) Sanctions
(1) Notwithstanding any other provision of law, no source
agency may disclose any record which is contained in a system
of records to a recipient agency or non-Federal agency for a matching
program if such source agency has reason to believe that the requirements
of subsection (p), or any matching agreement entered into pursuant
to subsection (o), or both, are not being met by such recipient
agency.
(2) No source agency may renew a matching agreement unless--
(A) the recipient agency or non-Federal agency has
certified that it has complied with the provisions of that agreement;
and
(B) the source agency has no reason to believe that
the certification is inaccurate.
(r) Report on new systems and matching programs
Each agency that proposes to establish or make a significant
change in a system of records or a matching program shall provide
adequate advance notice of any such proposal (in duplicate) to
the Committee on Government Operations of the House of Representatives,
the Committee on Governmental Affairs of the Senate, and the Office
of Management and Budget in order to permit an evaluation of the
probable or potential effect of such proposal on the privacy or
other rights of individuals.
(s) Biennial report
The President shall biennially submit to the Speaker of the
House of Representatives and the President pro tempore of the
Senate a report--
(1) describing the actions of the Director of the Office
of Management and Budget pursuant to section 6 of the Privacy
Act of 1974 during the preceding two years;
(2) describing the exercise of individual rights of access
and amendment under this section during such years;
(3) identifying changes in or additions to systems of records;
(4) containing such other information concerning administration
of this section as may be necessary or useful to the Congress
in reviewing the effectiveness of this section in carrying out
the purposes of the Privacy Act of 1974.
(t) Effect of other laws
(1) No agency shall rely on any exemption contained in section
552 of this title to withhold from an individual any record which
is otherwise accessible to such individual under the provisions
of this section.
(2) No agency shall rely on any exemption in this section
to withhold from an individual any record which is otherwise accessible
to such individual under the provisions of section 552 of this
title.
(u) Data Integrity Boards
(1) Every agency conducting or participating in a matching
program shall establish a Data Integrity Board to oversee and
coordinate among the various com ponents of such agency the agency's
implementation of this section.
(2) Each Data Integrity Board shall consist of senior officials
designated by the head of the agency, and shall include any senior
official designated by the head of the agency as responsible for
implementation of this section, and the inspector general of the
agency, if any. The inspector general shall not serve as chairman
of the Data Integrity Board.
(3) Each Data Integrity Board--
(A) shall review, approve, and maintain all written
agreements for receipt or disclosure of agency records
for matching programs to ensure compliance with subsection
(o), and all relevant statutes, regulations, and guidelines;
(B) shall review all matching programs in which the
agency has participated during the year, either as a source agency
or recipient agency, determine compliance with applicable
laws, regulations, guidelines, and agency agreements,
and assess the costs and benefits of such programs;
(C) shall review all recurring matching programs in
which the agency has participated during the year, either as a
source agency or recipient agency, for continued justification
for such disclosures;
(D) shall compile an annual report, which shall be
submitted to the head of the agency and the Office
of Management and Budget and made available to the
public on request, describing the matching activities of the
agency, including--
(i) matching programs in which the agency has
participated as a source agency or recipient agency;
(ii) matching agreements proposed under subsection
(o) that were disapproved by the Board;
(iii) any changes in membership or structure of
the Board in the preceding year;
(iv) the reasons for any waiver of the requirement
in paragraph (4) of this section for completion and submission
of a cost-benefit analysis prior to the approval
of a matching program;
(v) any violations of matching agreements that
have been alleged or identified and any corrective action taken;
and
(vi) any other information required by the Director
of the Office of Management and Budget to be included in such
report;
(E) shall serve as a clearinghouse for receiving and
providing information on the accuracy, completeness, and reliability
of records used in matching programs;
(F) shall provide interpretation and guidance to agency
components and personnel on the requirements of this section for
matching programs;
(G) shall review agency recordkeeping and disposal
policies and practices for matching programs to assure compliance
with this section; and
(H) may review and report on any agency matching activities
that are not matching programs.
(4)(A) Except as provided in subparagraphs (B) and (C),
a Data Integrity Board shall not approve any written agreement
for a matching program unless the agency has completed and submitted
to such Board a cost-benefit analysis of the proposed program
and such analysis demonstrates that the program is likely to be
cost effective.
(B) The Board may waive the requirements of subparagraph
(A) of this paragraph if it determines in writing, in accordance
with guidelines prescribed by the Director of the Office of Management
and Budget, that a cost-benefit analysis is not required.
(C) A cost-benefit analysis shall not be required under
subparagraph (A) prior to the initial approval of a written agreement
for a matching program that is specifically required by statute.
Any subsequent written agreement for such a program shall not
be approved by the Data Integrity Board unless the agency has
submitted a cost-benefit analysis of the program as conducted
under the preceding approval of such agreement.
(5)(A) If a matching agreement is disapproved by a Data
Integrity Board, any party to such agreement may appeal the disapproval
to the Director of the Office of Management and Budget. Timely
notice of the filing of such an appeal shall be provided by the
Director of the Office of Management and Budget to the Committee
on Governmental Affairs of the Senate and the Committee on Government
Operations of the House of Representatives.
(B) The Director of the Office of Management and Budget
may approve a matching agreement notwithstanding the disapproval
of a Data Integrity Board if the Director determines
that--
(i) the matching program will be consistent with
all applicable legal, regulatory, and policy
requirements;
(ii) there is adequate evidence that the matching
agreement will be cost-effective; and
(iii) the matching program is in the public interest.
(C) The decision of the Director to approve a matching
agreement shall not take effect until 30 days after
it is reported to committees described in subparagraph (A).
(D) If the Data Integrity Board and the Director of
the Office of Management and Budget disapprove a matching program
proposed by the inspector general of an agency, the inspector
general may report the disapproval to the head of the agency and
to the Congress.
(6) The Director of the Office of Management and Budget
shall, annually during the first 3 years after the date of enactment
of this subsection and biennially thereafter, consolidate in a
report to the Congress the information contained in the reports
from the various Data Integrity Boards under paragraph ( 3)(D).
Such report shall include detailed information about costs and
benefits of matching programs that are conducted during the period
covered by such consolidated report, and shall identify each waiver
granted by a Data Integrity Board of the requirement for completion
and submission of a cost-benefit analysis and the reasons for
granting the waiver.
(7) In the reports required by paragraphs (3)(D) and (6),
agency matching activities that are not matching programs may
be reported on an aggregate basis, if and to the extent necessary
to protect ongoing law enforcement or counterintelligence investigations.
(v) Office of Management and Budget responsibilities
The Director of the Office of Management and Budget shall--
(1) develop and, after notice and opportunity for public
comment, prescribe guidelines and regulations for the use of agencies
in implementing the provisions of this section; and
(2) provide continuing assistance to and oversight of the
implementation of this section by agencies.
The following section was enacted as part of the Privacy Act,
but was not codified; it may be found at § 552a (note).
Sec. 7 (a)(1) It shall be unlawful for any Federal, State
or local government agency to deny to any individual any right,
benefit, or privilege provided by law because of such individual's
refusal to disclose his social security account number.
(2) the provisions of paragraph (1) of this subsection
shall not apply with respect to--
(A) any disclosure which is required by Federal
statute, or
(B) any disclosure of a social security number
to any Federal, State, or local agency maintaining
a system of records in existence and operating before
January 1, 1975, if such disclosure was required under
statute or regulation adopted prior to such date to verify
the identity of an individual.
(b) Any Federal, State or local government agency which
requests an individual to disclose his social security account
number shall inform that individual whether that disclosure is
mandatory or voluntary, by what statutory or other authority such
number is solicited, and what uses will be made of it.
The following sections were enacted as part of Pub.L. 100-503,
the Com puter Matching and Privacy Protection Act of 1988; they
may be found at § 552a (note).
Sec. 6 Functions of the Director of the Office of Management
and Budget.
(b) Implementation Guidance for Amendments-- The Director
shall, pursuant to section 552a(v) of Title 5, United States Code,
develop guidelines and regulations for the use of agencies in
implementing the amendments made by this Act not later than 8
months after the date of enactment of this Act.
Sec. 9 Rules of Construction.
Nothing in the amendments made by this Act shall be construed
to authorize--
(1) the establishment or maintenance by any agency
of a national data bank that combines, merges, or links information
on individuals maintained in systems of records by other Federal
agencies;
(2) the direct linking of computerized systems of records
maintained by Federal agencies;
(3) the computer matching of records not otherwise
authorized by law; or
(4) the disclosure of records for computer matching,
except to a Federal, State, or local agency.
Sec. 10 Effective Dates.
(a) In General-- Except as provided in subsection (b), the
amendments made by this Act shall take effect 9 months after the
date of enactment of this Act.
(b) Exceptions-- The amendment made by sections 3(b) [Notice
of Matching Programs - Report to Congress and the Office of Management
and Budget], 6 [Functions of the Director of the Office of Management
and Budget], 7 [Compilation of Rules and Notices] and 8 [Annual
Report] of this Act shall take effect upon enactment.