§ 552a. Records maintained on individuals

Pub. L. 114–126, Feb. 24, 2016, 130 Stat. 282, provided that: “SECTION 1. SHORT TITLE.“This Act may be cited as the ‘Judicial Redress Act of 2015’. “SEC. 2. EXTENSION OF PRIVACY ACT REMEDIES TO CITIZENS OF DESIGNATED COUNTRIES.“(a) Civil Action; Civil Remedies.—With respect to covered records, a covered person may bring a civil action against an agency and obtain civil remedies, in the same manner, to the same extent, and subject to the same limitations, including exemptions and exceptions, as an individual may bring and obtain with respect to records under—“(1) section 552a(g)(1)(D) of title 5, United States Code, but only with respect to disclosures intentionally or willfully made in violation of section 552a(b) of such title; and “(2) subparagraphs (A) and (B) of section 552a(g)(1) of title 5, United States Code, but such an action may only be brought against a designated Federal agency or component. “(b) Exclusive Remedies.—The remedies set forth in subsection (a) are the exclusive remedies available to a covered person under this section. “(c) Application of the Privacy Act With Respect to a Covered Person.—For purposes of a civil action described in subsection (a), a covered person shall have the same rights, and be subject to the same limitations, including exemptions and exceptions, as an individual has and is subject to under section 552a of title 5, United States Code, when pursuing the civil remedies described in paragraphs (1) and (2) of subsection (a). “(d) Designation of Covered Country.—“(1) In general.—The Attorney General may, with the concurrence of the Secretary of State, the Secretary of the Treasury, and the Secretary of Homeland Security, designate a foreign country or regional economic integration organization, or member country of such organization, as a ‘covered country’ for purposes of this section if—“(A)(i) the country or regional economic integration organization, or member country of such organization, has entered into an agreement with the United States that provides for appropriate privacy protections for information shared for the purpose of preventing, investigating, detecting, or prosecuting criminal offenses; or “(ii) the Attorney General has determined that the country or regional economic integration organization, or member country of such organization, has effectively shared information with the United States for the purpose of preventing, investigating, detecting, or prosecuting criminal offenses and has appropriate privacy protections for such shared information; “(B) the country or regional economic integration organization, or member country of such organization, permits the transfer of personal data for commercial purposes between the territory of that country or regional economic organization and the territory of the United States, through an agreement with the United States or otherwise; and “(C) the Attorney General has certified that the policies regarding the transfer of personal data for commercial purposes and related actions of the country or regional economic integration organization, or member country of such organization, do not materially impede the national security interests of the United States. “(2) Removal of designation.—The Attorney General may, with the concurrence of the Secretary of State, the Secretary of the Treasury, and the Secretary of Homeland Security, revoke the designation of a foreign country or regional economic integration organization, or member country of such organization, as a ‘covered country’ if the Attorney General determines that such designated ‘covered country’—“(A) is not complying with the agreement described under paragraph (1)(A)(i); “(B) no longer meets the requirements for designation under paragraph (1)(A)(ii); “(C) fails to meet the requirements under paragraph (1)(B); “(D) no longer meets the requirements for certification under paragraph (1)(C); or “(E) impedes the transfer of information (for purposes of reporting or preventing unlawful activity) to the United States by a private entity or person. “(e) Designation of Designated Federal Agency or Component.—“(1) In general.—The Attorney General shall determine whether an agency or component thereof is a ‘designated Federal agency or component’ for purposes of this section. The Attorney General shall not designate any agency or component thereof other than the Department of Justice or a component of the Department of Justice without the concurrence of the head of the relevant agency, or of the agency to which the component belongs. “(2) Requirements for designation.—The Attorney General may determine that an agency or component of an agency is a ‘designated Federal agency or component’ for purposes of this section, if—“(A) the Attorney General determines that information exchanged by such agency with a covered country is within the scope of an agreement referred to in subsection (d)(1)(A); or “(B) with respect to a country or regional economic integration organization, or member country of such organization, that has been designated as a ‘covered country’ under subsection (d)(1)(B), the Attorney General determines that designating such agency or component thereof is in the law enforcement interests of the United States. “(f) Federal Register Requirement; Nonreviewable Determination.—The Attorney General shall publish each determination made under subsections (d) and (e). Such determination shall not be subject to judicial or administrative review. “(g) Jurisdiction.—The United States District Court for the District of Columbia shall have exclusive jurisdiction over any claim arising under this section. “(h) Definitions.—In this Act:“(1) Agency.—The term ‘agency’ has the meaning given that term in section 552(f) of title 5, United States Code. “(2) Covered country.—The term ‘covered country’ means a country or regional economic integration organization, or member country of such organization, designated in accordance with subsection (d). “(3) Covered person.—The term ‘covered person’ means a natural person (other than an individual) who is a citizen of a covered country. “(4) Covered record.—The term ‘covered record’ has the same meaning for a covered person as a record has for an individual under section 552a of title 5, United States Code, once the covered record is transferred—“(A) by a public authority of, or private entity within, a country or regional economic organization, or member country of such organization, which at the time the record is transferred is a covered country; and “(B) to a designated Federal agency or component for purposes of preventing, investigating, detecting, or prosecuting criminal offenses. “(5) Designated federal agency or component.—The term ‘designated Federal agency or component’ means a Federal agency or component of an agency designated in accordance with subsection (e). “(6) Individual.—The term ‘individual’ has the meaning given that term in section 552a(a)(2) of title 5, United States Code. “(i) Preservation of Privileges.—Nothing in this section shall be construed to waive any applicable privilege or require the disclosure of classified information. Upon an agency’s request, the district court shall review in camera and ex parte any submission by the agency in connection with this subsection. “(j) Effective Date.—This Act shall take effect 90 days after the date of the enactment of this Act [Feb. 24, 2016].”

Publication of Guidance Under Subsection (p)(1)(A)(ii)

Pub. L. 101–508, title VII, § 7201(b)(2), Nov. 5, 1990, 104 Stat. 1388–334, provided that: “Not later than 90 days after the date of the enactment of this Act [Nov. 5, 1990], the Director of the Office of Management and Budget shall publish guidance under subsection (p)(1)(A)(ii) of section 552a of title 5, United States Code, as amended by this Act.”

Limitation on Application of Verification Requirement

Pub. L. 101–508, title VII, § 7201(c), Nov. 5, 1990, 104 Stat. 1388–335, provided that: “Section 552a(p)(1)(A)(ii)(II) of title 5, United States Code, as amended by section 2 [probably means section 7201(b)(1) of Pub. L. 101–508], shall not apply to a program referred to in paragraph (1), (2), or (4) of section 1137(b) of the Social Security Act (42 U.S.C. 1320b–7), until the earlier of— “(1) the date on which the Data Integrity Board of the Federal agency which administers that program determines that there is not a high degree of confidence that information provided by that agency under Federal matching programs is accurate; or “(2) 30 days after the date of publication of guidance under section 2(b) [probably means section 7201(b)(2) of Pub. L. 101–508, set out as a note above].”

Effective Date Delayed for Certain Education Benefits Computer Matching Programs

Pub. L. 101–366, title II, § 206(d), Aug. 15, 1990, 104 Stat. 442, provided that: “(1) In the case of computer matching programs between the Department of Veterans Affairs and the Department of Defense in the administration of education benefits programs under chapters 30 and 32 of title 38 and chapter 106 of title 10, United States Code, the amendments made to section 552a of title 5, United States Code, by the Computer Matching and Privacy Protection Act of 1988 [Pub. L. 100–503] (other than the amendments made by section 10(b) of that Act) [see Effective Date of 1988 Amendment note above] shall take effect on October 1, 1990. “(2) For purposes of this subsection, the term ‘matching program’ has the same meaning provided in section 552a(a)(8) of title 5, United States Code.”

Implementation Guidance for 1988 Amendments

Pub. L. 100–503, § 6(b), Oct. 18, 1988, 102 Stat. 2513, required the Director, pursuant to section 552a(v) of this title, to develop guidelines and regulations for the use of agencies in implementing amendments made by Pub. L. 100–503 not later than 8 months after Oct. 18, 1988.

Construction of 1988 Amendments

Pub. L. 100–503, § 9, Oct. 18, 1988, 102 Stat. 2514, provided that: “Nothing in the amendments made by this Act [amending this section and repealing provisions set out as a note below] shall be construed to authorize— “(1) the establishment or maintenance by any agency of a national data bank that combines, merges, or links information on individuals maintained in systems of records by other Federal agencies; “(2) the direct linking of computerized systems of records maintained by Federal agencies; “(3) the computer matching of records not otherwise authorized by law; or “(4) the disclosure of records for computer matching except to a Federal, State, or local agency.”

Congressional Findings and Statement of Purpose

Pub. L. 93–579, § 2, Dec. 31, 1974, 88 Stat. 1896, provided that: “(a) The Congress finds that—“(1) the privacy of an individual is directly affected by the collection, maintenance, use, and dissemination of personal information by Federal agencies; “(2) the increasing use of computers and sophisticated information technology, while essential to the efficient operations of the Government, has greatly magnified the harm to individual privacy that can occur from any collection, maintenance, use, or dissemination of personal information; “(3) the opportunities for an individual to secure employment, insurance, and credit, and his right to due process, and other legal protections are endangered by the misuse of certain information systems; “(4) the right to privacy is a personal and fundamental right protected by the Constitution of the United States; and “(5) in order to protect the privacy of individuals identified in information systems maintained by Federal agencies, it is necessary and proper for the Congress to regulate the collection, maintenance, use, and dissemination of information by such agencies. “(b) The purpose of this Act [enacting this section and provisions set out as notes under this section] is to provide certain safeguards for an individual against an invasion of personal privacy by requiring Federal agencies, except as otherwise provided by law, to—“(1) permit an individual to determine what rec­ords pertaining to him are collected, maintained, used, or disseminated by such agencies; “(2) permit an individual to prevent records pertaining to him obtained by such agencies for a particular purpose from being used or made available for another purpose without his consent; “(3) permit an individual to gain access to information pertaining to him in Federal agency records, to have a copy made of all or any portion thereof, and to correct or amend such records; “(4) collect, maintain, use, or disseminate any record of identifiable personal information in a manner that assures that such action is for a necessary and lawful purpose, that the information is current and accurate for its intended use, and that adequate safeguards are provided to prevent misuse of such information; “(5) permit exemptions from the requirements with respect to records provided in this Act only in those cases where there is an important public policy need for such exemption as has been determined by specific statutory authority; and “(6) be subject to civil suit for any damages which occur as a result of willful or intentional action which violates any individual’s rights under this Act.”

Privacy Protection Study Commission

Pub. L. 93–579, § 5, Dec. 31, 1974, 88 Stat. 1905, as amended by Pub. L. 95–38, June 1, 1977, 91 Stat. 179, which established the Privacy Protection Study Commission and provided that the Commission study data banks, automated data processing programs and information systems of governmental, regional and private organizations to determine standards and procedures in force for protection of personal information, that the Commission report to the President and Congress the extent to which requirements and principles of section 552a of title 5 should be applied to the information practices of those organizations, and that it make other legislative recommendations to protect the privacy of individuals while meeting the legitimate informational needs of government and society, ceased to exist on September 30, 1977, pursuant to section 5(g) of Pub. L. 93–579.

Guidelines and Regulations for Maintenance of Privacy and Protection of Records of Individuals

Pub. L. 93–579, § 6, Dec. 31, 1974, 88 Stat. 1909, which provided that the Office of Management and Budget shall develop guidelines and regulations for use of agencies in implementing provisions of this section and provide continuing assistance to and oversight of the implementation of the provisions of such section by agencies, was repealed by Pub. L. 100–503, § 6(c), Oct. 18, 1988, 102 Stat. 2513.

Disclosure of Social Security Number

Pub. L. 93–579, § 7, Dec. 31, 1974, 88 Stat. 1909, provided that: “(a)(1) It shall be unlawful for any Federal, State or local government agency to deny to any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose his social security account number. “(2) the [The] provisions of paragraph (1) of this subsection shall not apply with respect to—“(A) any disclosure which is required by Federal statute, or “(B) the disclosure of a social security number to any Federal, State, or local agency maintaining a system of records in existence and operating before January 1, 1975, if such disclosure was required under statute or regulation adopted prior to such date to verify the identity of an individual. “(b) Any Federal, State, or local government agency which requests an individual to disclose his social security account number shall inform that individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.”

Authorization of Appropriations to Privacy Protection Study Commission

Pub. L. 93–579, § 9, Dec. 31, 1974, 88 Stat. 1910, as amended by Pub. L. 94–394, Sept. 3, 1976, 90 Stat. 1198, authorized appropriations for the period beginning July 1, 1975, and ending on September 30, 1977.

Executive Documents

Ex. Ord. No. 9397. Numbering System for Federal Accounts Relating to Individual Persons

Ex. Ord. No. 9397, Nov. 22, 1943, 8 F.R. 16095, as amended by Ex. Ord. No. 13478, § 2, Nov. 18, 2008, 73 F.R. 70239, provided:

WHEREAS certain Federal agencies from time to time require in the administration of their activities a system of numerical identification of accounts of individual persons; and

WHEREAS some seventy million persons have heretofore been assigned account numbers pursuant to the Social Security Act; and

WHEREAS a large percentage of Federal employees have already been assigned account numbers pursuant to the Social Security Act; and

WHEREAS it is desirable in the interest of economy and orderly administration that the Federal Government move towards the use of a single, unduplicated numerical identification system of accounts and avoid the unnecessary establishment of additional systems:

NOW, THEREFORE, by virtue of the authority vested in me as President of the United States, it is hereby ordered as follows:

Classified National Security Information

For provisions relating to a response to a request for information under this section when the fact of its existence or nonexistence is itself classified or when it was originally classified by another agency, see Ex. Ord. No. 13526, § 3.6, Dec. 29, 2009, 75 F.R. 718, set out as a note under section 3161 of Title 50, War and National Defense.