§ 552a. Records maintained on individuals
(a) Definitions
For purposes of this section--
(1) the term "agency" means agency as defined in section 552(f) of
this title;
(2) the term "individual" means a citizen of the United States or an
alien lawfully admitted for permanent residence;
(3) the term "maintain" includes maintain, collect, use or disseminate;
(4) the term "record" means any item, collection, or grouping of information
about an individual that is maintained by an agency, including, but not
limited to, his education, financial transactions, medical history, and
criminal or employment history and that contains his name, or the identifying
number, symbol, or other identifying particular assigned to the individual,
such as a finger or voice print or a photograph;
(5) the term "system of records" means a group of any records under
the control of any agency from which information is retrieved by the name
of the individual or by some identifying number, symbol, or other identifying
particular assigned to the individual;
(6) the term "statistical record" means a record in a system of records
maintained for statistical research or reporting purposes only and not
used in whole or in part in making any determination about an identifiable
individual, except as provided by section 8 of Title 13;
(7) the term "routine use" means, with respect to the disclosure of
a record, the use of such record for a purpose which is compatible with
the purpose for which it was collected;
(8) the term "matching program"--
(A) means any computerized comparison of--
(i) two or more automated systems of
records or a system of records with non-Federal records for the purpose
of--
(I) establishing or verifying
the eligibility of, or continuing compliance with statutory and regulatory
requirements by, applicants for, recipients or beneficiaries of, participants
in, or providers of services with respect to, cash or in-kind assistance
or payments under Federal benefit programs, or
(II) recouping payments or
delinquent debts under such Federal benefit programs, or
(ii) two or more automated Federal personnel
or payroll systems of records or a system of Federal personnel or payroll
records with non-Federal records,
(B) but does not include--
(i) matches performed to produce aggregate
statistical data without any personal identifiers;
(ii) matches performed to support any
research or statistical project, the specific data of which may not be
used to make decisions concerning the rights, benefits, or privileges of
specific individuals;
(iii) matches performed, by an agency
(or component thereof) which performs as its principal function any activity
pertaining to the enforcement of criminal laws, subsequent to the initiation
of a specific criminal or civil law enforcement investigation of a named
person or persons for the purpose of gathering evidence against such person
or persons;
(iv) matches of tax information (I) pursuant
to section 6103(d) of the Internal Revenue Code of 1986, (II) for purposes
of tax administration as defined in section 6103(b)(4) of such Code, (III)
for the purpose of intercepting a tax refund due an individual under authority
granted by section 464 or 1137 of the Social Security Act; or (IV) for
the purpose of intercepting a tax refund due an individual under any other
tax refund intercept program authorized by statute which has been determined
by the Director of the Office of Management and Budget to contain verification,
notice, and hearing requirements that are substantially similar to the
procedures in section 1137 of the Social Security Act;
(v) matches--
(I) using records predominantly
relating to Federal personnel, that are performed for routine administrative
purposes (subject to guidance provided by the Director of the Office of
Management and Budget pursuant to subsection (v)); or
(II) conducted by an agency
using only records from systems of records maintained by that agency;
if the purpose of the match is not to take any adverse financial, personnel,
disciplinary, or other adverse action against Federal personnel; or
(vi) matches performed for foreign counterintelligence
purposes or to produce background checks for security clearances of Federal
personnel or Federal contractor personnel; or
(vii) Repealed. Pub.L. 104-226, § 1(b)(3)(C), Oct. 2, 1996, 110
Stat. 3033.
(9) the term "recipient agency" means any agency, or contractor thereof,
receiving records contained in a system of records from a source agency
for use in a matching program;
(10) the term "non-Federal agency" means any State or local government,
or agency thereof, which receives records contained in a system of records
from a source agency for use in a matching program;
(11) the term "source agency" means any agency which discloses records
contained in a system of records to be used in a matching program, or any
State or local government, or agency thereof, which discloses records to
be used in a matching program;
(12) the term "Federal benefit program" means any program administered
or funded by the Federal Government, or by any agent or State on behalf
of the Federal Government, providing cash or in-kind assistance in the
form of payments, grants, loans, or loan guarantees to individuals; and
(13) the term "Federal personnel" means officers and employees of the
Government of the United States, members of the uniformed services (including
members of the Reserve Components), individuals entitled to receive immediate
or deferred retirement benefits under any retirement program of the Government
of the United States (including survivor benefits).
(b) Conditions of disclosure
No agency shall disclose any record which is contained in a system
of records by any means of communication to any person, or to another agency,
except pursuant to a written request by, or with the prior written consent
of, the individual to whom the record pertains, unless disclosure of the
record would be--
(1) to those officers and employees of the agency which maintains the
record who have a need for the record in the performance of their duties;
(2) required under section 552 of this title;
(3) for a routine use as defined in subsection (a)(7) of this section
and de scribed under subsection (e)(4)(D) of this section;
(4) to the Bureau of the Census for purposes of planning or carrying
out a census or survey or related activity pursuant to the provisions of
Title 13;
(5) to a recipient who has provided the agency with advance adequate
written assurance that the record will be used solely as a statistical
research or reporting record, and the record is to be transferred in a
form that is not individually identifiable;
(6) to the National Archives and Records Administration as a record
which has sufficient historical or other value to warrant its continued
preservation by the United States Government, or for evaluation by the
Archivist of the United States or the designee of the Archivist to determine
whether the record has such value;
(7) to another agency or to an instrumentality of any governmental jurisdiction
within or under the control of the United States for a civil or criminal
law enforcement activity if the activity is authorized by law, and if the
head of the agency or instrumentality has made a written request to the
agency which maintains the record specifying the particular portion desired
and the law enforcement activity for which the record is sought;
(8) to a person pursuant to a showing of compelling circumstances affecting
the health or safety of an individual if upon such disclosure notification
is transmitted to the last known address of such individual;
(9) to either House of Congress, or, to the extent of matter within
its jurisdiction, any committee or subcommittee thereof, any joint committee
of Congress or subcommittee of any such joint committee;
(10) to the Comptroller General, or any of his authorized representatives,
in the course of the performance of the duties of the General Accounting
Office;
(11) pursuant to the order of a court of competent jurisdiction; or
(12) to a consumer reporting agency in accordance with section 3711(e)
of Title 31.
(c) Accounting of certain disclosures
Each agency, with respect to each system of records under its control,
shall--
(1) except for disclosures made under subsections (b)(1) or (b)(2) of
this section, keep an accurate accounting of--
(A) the date, nature, and purpose of each disclosure
of a record to any person or to another agency made under subsection (b)
of this section; and
(B) the name and address of the person or agency
to whom the disclosure is made;
(2) retain the accounting made under paragraph (1) of this subsection
for at least five years or the life of the record, whichever is longer,
after the disclosure for which the accounting is made;
(3) except for disclosures made under subsection (b)(7) of this section,
make the accounting made under paragraph (1) of this subsection available
to the individual named in the record at his request; and
(4) inform any person or other agency about any correction or notation
of dispute made by the agency in accordance with subsection (d) of this
section of any record that has been disclosed to the person or agency if
an accounting of the disclosure was made.
(d) Access to records
Each agency that maintains a system of records shall--
(1) upon request by any individual to gain access to his record or to
any information pertaining to him which is contained in the system, permit
him and upon his request, a person of his own choosing to accompany him,
to review the record and have a copy made of all or any portion thereof
in a form comprehensible to him, except that the agency may require the
individual to furnish a written statement authorizing discussion of that
individual's record in the accompanying person's presence;
(2) permit the individual to request amendment of a record pertaining
to him and--
(A) not later than 10 days (excluding Saturdays,
Sundays, and legal public holidays) after the date of receipt of such request,
acknowledge in writing such receipt; and
(B) promptly, either--
(i) make any correction of any portion
thereof which the individual believes is not accurate, relevant, timely,
or complete; or
(ii) inform the individual of its refusal
to amend the record in accordance with his request, the reason for the
refusal, the procedures established by the agency for the individual to
request a review of that refusal by the head of the agency or an officer
designated by the head of the agency, and the name and business address
of that official;
(3) permit the individual who disagrees with the refusal of the agency
to amend his record to request a review of such refusal, and not later
than 30 days (excluding Saturdays, Sundays, and legal public holidays)
from the date on which the individual requests such review, complete such
review and make a final determination unless, for good cause shown, the
head of the agency extends such 30-day period; and if, after his review,
the reviewing official also refuses to amend the record in accordance with
the request, permit the individual to file with the agency a concise statement
setting forth the reasons for his disagreement with the refusal of the
agency, and notify the individual of the provisions for judicial review
of the reviewing official's determination under subsection (g)(1)(A) of
this section;
(4) in any disclosure, containing information about which the individual
has filed a statement of disagreement, occurring after the filing of the
statement under paragraph (3) of this subsection, clearly note any portion
of the record which is disputed and provide copies of the statement and,
if the agency deems it appropriate, copies of a concise statement of the
reasons of the agency for not making the amendments requested, to persons
or other agencies to whom the disputed record has been disclosed; and
(5) nothing in this section shall allow an individual access to any
information compiled in reasonable anticipation of a civil action or proceeding.
(e) Agency requirements
Each agency that maintains a system of records shall--
(1) maintain in its records only such information about an individual
as is relevant and necessary to accomplish a purpose of the agency required
to be accomplished by statute or by Executive order of the President;
(2) collect information to the greatest extent practicable directly
from the subject individual when the information may result in adverse
determinations about an individual's rights, benefits, and privileges under
Federal programs;
(3) inform each individual whom it asks to supply information, on the
form which it uses to collect the information or on a separate form that
can be retained by the individual--
(A) the authority (whether granted by statute, or
by Executive order of the President) which authorizes the solicitation
of the information and whether disclosure of such information is mandatory
or voluntary;
(B) the principal purpose or purposes for which the
information is intended to be used;
(C) the routine uses which may be made of the information,
as published pursuant to paragraph (4)(D) of this subsection; and
(D) the effects on him, if any, of not providing
all or any part of the requested information;
(4) subject to the provisions of paragraph (11) of this subsection,
publish in the Federal Register upon establishment or revision a notice
of the existence and character of the system of records, which notice shall
include--
(A) the name and location of the system;
(B) the categories of individuals on whom records
are maintained in the system;
(C) the categories of records maintained in the system;
(D) each routine use of the records contained in
the system, including the categories of users and the purpose of such use;
(E) the policies and practices of the agency regarding
storage, retrievability, access controls, retention, and disposal of the
records;
(F) the title and business address of the agency
official who is responsible for the system of records;
(G) the agency procedures whereby an individual can
be notified at his request if the system of records contains a record pertaining
to him;
(H) the agency procedures whereby an individual can
be notified at his request how he can gain access to any record pertaining
to him contained in the system of records, and how he can contest its content;
and
(I) the categories of sources of records in the system;
(5) maintain all records which are used by the agency in making any
determination about any individual with such accuracy, relevance, timeliness,
and completeness as is reasonably necessary to assure fairness to the individual
in the determination;
(6) prior to disseminating any record about an individual to any person
other than an agency, unless the dissemination is made pursuant to subsection
(b)(2) of this section, make reasonable efforts to assure that such records
are accurate, complete, timely, and relevant for agency purposes;
(7) maintain no record describing how any individual exercises rights
guaranteed by the First Amendment unless expressly authorized by statute
or by the individual about whom the record is maintained or unless pertinent
to and within the scope of an authorized law enforcement activity;
(8) make reasonable efforts to serve notice on an individual when any
record on such individual is made available to any person under compulsory
legal process when such process becomes a matter of public record;
(9) establish rules of conduct for persons involved in the design, development,
operation, or maintenance of any system of records, or in maintaining any
record, and instruct each such person with respect to such rules and the
requirements of this section, including any other rules and procedures
adopted pursuant to this section and the penalties for noncompliance;
(10) establish appropriate administrative, technical and physical safeguards
to insure the security and confidentiality of records and to protect against
any anticipated threats or hazards to their security or integrity which
could result in substantial harm, embarrassment, inconvenience, or unfairness
to any individual on whom information is maintained;
(11) at least 30 days prior to publication of information under paragraph
(4)(D) of this subsection, publish in the Federal Register notice of any
new use or intended use of the information in the system, and provide an
opportunity for interested persons to submit written data, views, or arguments
to the agency; and
(12) if such agency is a recipient agency or a source agency in a matching
program with a non-Federal agency, with respect to any establishment or
revision of a matching program, at least 30 days prior to conducting such
program, publish in the Federal Register notice of such establishment or
revision.
(f) Agency rules
In order to carry out the provisions of this section, each agency that
maintains a system of records shall promulgate rules, in accordance with
the requirements (including general notice) of section 553 of this title,
which shall--
(1) establish procedures whereby an individual can be notified in response
to his request if any system of records named by the individual contains
a record pertaining to him;
(2) define reasonable times, places, and requirements for identifying
an individual who requests his record or information pertaining to him
before the agency shall make the record or information available to the
individual;
(3) establish procedures for the disclosure to an individual upon his
request of his record or information pertaining to him, including special
procedure, if deemed necessary, for the disclosure to an individual of
medical records, including psychological records, pertaining to him;
(4) establish procedures for reviewing a request from an individual
concerning the amendment of any record or information pertaining to the
individual, for making a determination on the request, for an appeal within
the agency of an initial adverse agency determination, and for whatever
additional means may be necessary for each individual to be able to exercise
fully his rights under this section; and
(5) establish fees to be charged, if any, to any individual for making
copies of his record, excluding the cost of any search for and review of
the record.
The Office of the Federal Register shall biennially compile and publish
the rules promulgated under this subsection and agency notices published
under subsection (e)(4) of this section in a form available to the public
at low cost.
(g)(1) Civil remedies
Whenever any agency
(A) makes a determination under subsection (d)(3)
of this section not to amend an individual's record in accordance with
his request, or fails to make such review in conformity with that subsection;
(B) refuses to comply with an individual request
under subsection (d)(1) of this section;
(C) fails to maintain any record concerning any individual
with such accuracy, relevance, timeliness, and completeness as is necessary
to assure fairness in any determination relating to the qualifications,
character, rights, or opportunities of, or benefits to the individual that
may be made on the basis of such record, and consequently a determination
is made which is adverse to the individual; or
(D) fails to comply with any other provision of this
section, or any rule promulgated thereunder, in such a way as to have an
adverse effect on an individual, the individual may bring a civil action
against the agency, and the district courts of the United States shall
have jurisdiction in the matters under the provisions of this subsection.
(2)(A) In any suit brought under the provisions of subsection (g)(1)(A)
of this section, the court may order the agency to amend the individual's
record in accordance with his request or in such other way as the court
may direct. In such a case the court shall determine the matter de novo.
(B) The court may assess against the United States
reasonable attorney fees and other litigation costs reasonably incurred
in any case under this paragraph in which the complainant has substantially
prevailed.
(3)(A) In any suit brought under the provisions of subsection (g)(1)(B)
of this section, the court may enjoin the agency from withholding the records
and order the production to the complainant of any agency records improperly
withheld from him. In such a case the court shall determine the matter
de novo, and may examine the contents of any agency records in camera to
determine whether the records or any portion thereof may be withheld under
any of the exemptions set forth in subsection (k) of this section, and
the burden is on the agency to sustain its action.
(B) The court may assess against the United States
reasonable attorney fees and other litigation costs reasonably incurred
in any case under this paragraph in which the complainant has substantially
prevailed.
(4) In any suit brought under the provisions of subsection (g)(1)(C)
or (D) of this section in which the court determines that the agency acted
in a manner which was intentional or willful, the United States shall be
liable to the individual in an amount equal to the sum of--
(A) actual damages sustained by the individual as
a result of the refusal or failure, but in no case shall a person entitled
to recovery receive less than the sum of $1,000; and
(B) the costs of the action together with reasonable
attorney fees as determined by the court.
(5) An action to enforce any liability created under this section may
be brought in the district court of the United States in the district in
which the complainant resides, or has his principal place of business,
or in which the agency records are situated, or in the District of Columbia,
without regard to the amount in controversy, within two years from the
date on which the cause of action a rises, except that where an agency
has materially and willfully misrepresented any information required under
this section to be disclosed to an individual and the information so misrepresented
is material to establishment of the liability of the agency to the individual
under this section, the action may be brought at any time within two years
after discovery by the individual of the misrepresentation. Nothing in
this section shall be construed to authorize any civil action by reason
of any injury sustained as the result of a disclosure of a record prior
to September 27, 1975.
(h) Rights of legal guardians
For the purposes of this section, the parent of any minor, or the legal
guardian of any individual who has been declared to be incompetent due
to physical or mental incapacity or age by a court of competent jurisdiction,
may act on behalf of the individual.
(i)(1) Criminal penalties
Any officer or employee of an agency, who by virtue of his employment
or official position, has possession of, or access to, agency records which
contain individually identifiable information the disclosure of which is
prohibited by this section or by rules or regulations established thereunder,
and who knowing that disclosure of the specific material is so prohibited,
willfully discloses the material in any manner to any person or agency
not entitled to receive it, shall be guilty of a misdemeanor and fined
not more than $5,000.
(2) Any officer or employee of any agency who willfully maintains a
system of records without meeting the notice requirements of subsection
(e)(4) of this section shall be guilty of a misdemeanor and fined not more
than $5,000.
(3) Any person who knowingly and willfully requests or obtains any record
concerning an individual from an agency under false pretenses shall be
guilty of a misdemeanor and fined not more than $5,000.
(j) General exemptions
The head of any agency may promulgate rules, in accordance with the
requirements (including general notice) of sections 553(b)(1), (2), and
(3), (c), and (e) of this title, to exempt any system of records within
the agency from any part of this section except subsections (b), (c)(1)
and (2), (e)(4)(A) through (F), ( e)(6), (7), (9), (10), and (11), and
(i) if the system of records is--
(1) maintained by the Central Intelligence Agency; or
(2) maintained by an agency or component thereof which performs as its
principal function any activity pertaining to the enforcement of criminal
laws, including police efforts to prevent, control, or reduce crime or
to apprehend criminals, and the activities of prosecutors, courts, correctional,
probation, pardon, or parole authorities, and which consists of (A) information
compiled for the purpose of identifying individual criminal offenders and
alleged offenders and consisting only of identifying data and notations
of arrests, the nature and disposition of criminal charges, sentencing,
confinement, release, and parole and probation status; (B) information
compiled for the purpose of a criminal investigation, including reports
of informants and investigators, and associated with an identifiable individual;
or (C) reports identifiable to an individual compiled at any stage of the
process of enforcement of the criminal laws from arrest or indictment through
release from supervision.
At the time rules are adopted under this subsection, the agency shall
include in the statement required under section 553(c) of this title, the
reasons why the system of records is to be exempted from a provision of
this section.
(k) Specific exemptions
The head of any agency may promulgate rules, in accordance with the
requirements (including general notice) of sections 553(b)(1), (2), and
(3), (c), and (e) of this title, to exempt any system of records within
the agency from subsections (c)(3), (d), (e)(1), (e)(4)(G), (H), and (I)
and (f) of this section if the system of records is--
(1) subject to the provisions of section 552(b)(1) of this title;
(2) investigatory material compiled for law enforcement purposes, other
than material within the scope of subsection (j)(2) of this section: Provided,
however,
That if any individual is denied any right, privilege, or benefit that
he would otherwise be entitled by Federal law, or for which he would otherwise
be eligible, as a result of the maintenance of such material, such material
shall be provided to such individual, except to the extent that the disclosure
of such material would reveal the identity of a source who furnished information
to the Government under an express promise that the identity of the source
would be held in confidence, or, prior to the effective date of this section,
under an implied promise that the identity of the source would be held
in confidence;
(3) maintained in connection with providing protective services to the
President of the United States or other individuals pursuant to section
3056 of Title 18;
(4) required by statute to be maintained and used solely as statistical
records;
(5) investigatory material compiled solely for the purpose of determining
suit ability, eligibility, or qualifications for Federal civilian employment,
military service, Federal contracts, or access to classified information,
but only to the extent that the disclosure of such material would reveal
the identity of a source who furnished information to the Government under
an express promise that the identity of the source would be held in confidence,
or, prior to the effective date of this section, under an implied promise
that the identity of the source would be held in confidence;
(6) testing or examination material used solely to determine individual
qualifications for appointment or promotion in the Federal service the
disclosure of which would compromise the objectivity or fairness of the
testing or examination process; or
(7) evaluation material used to determine potential for promotion in
the armed services, but only to the extent that the disclosure of such
material would reveal the identity of a source who furnished information
to the Government under an express promise that the identity of the source
would be held in confidence, or, prior to the effective date of this section,
under an implied promise that the identity of the source would be held
in confidence.
At the time rules are adopted under this subsection, the agency shall
include in the statement required under section 553(c) of this title, the
reasons why the system of records is to be exempted from a provision of
this section.
(1)(1) Archival records
Each agency record which is accepted by the Archivist of the United
States for storage, processing, and servicing in accordance with section
3103 of Title 44 shall, for the purposes of this section, be considered
to be maintained by the agency which deposited the record and shall be
subject to the provisions of this section. The Archivist of the United
States shall not disclose the record except to the agency which maintains
the record, or under rules established by that agency which are not inconsistent
with the provisions of this section.
(2) Each agency record pertaining to an identifiable individual which
was transferred to the National Archives of the United States as a record
which has sufficient historical or other value to warrant its continued
preservation by the United States Government, prior to the effective date
of this section, shall, for the purposes of this section, be considered
to be maintained by the National Archives and shall not be subject to the
provisions of this section, except that a statement generally describing
such records (modeled after the requirements relating to records subject
to subsections (e)(4)(A) through (G) of this section) shall be published
in the Federal Register.
(3) Each agency record pertaining to an identifiable individual which
is transferred to the National Archives of the United States as a record
which has sufficient historical or other value to warrant its continued
preservation by the United States Government, on or after the effective
date of this section, shall, for the purposes of this section, be considered
to be maintained by the National Archives and shall be exempt from the
requirements of this section except subsections ( e)(4)(A) through (G)
and (e)(9) of this section.
(m) Government contractors
(1) When an agency provides by a contract for the operation by or on
behalf of the agency of a system of records to accomplish an agency function,
the agency shall, consistent with its authority, cause the requirements
of this section to be applied to such system. For purposes of subsection
(i) of this section any such contractor and any employee of such contractor,
if such contract is agreed to on or after the effective date of this section,
shall be considered to be an employee of an agency.
(2) A consumer reporting agency to which a record is disclosed under
section 3711(e) of Title 31 shall not be considered a contractor for the
purposes of this section.
(n) Mailing lists
An individual's name and address may not be sold or rented by an agency
unless such action is specifically authorized by law. This provision shall
not be construed to require the withholding of names and addresses otherwise
permitted to be made public.
(o) Matching agreements--
(1) No record which is contained in a system of records may be disclosed
to a recipient agency or non-Federal agency for use in a computer matching
program except pursuant to a written agreement between the source agency
and the recipient agency or non-Federal agency specifying--
(A) the purpose and legal authority for conducting
the program;
(B) the justification for the program and the anticipated
results, including a specific estimate of any savings;
(C) a description of the records that will be matched,
including each data element that will be used, the approximate number of
records that will be matched, and the projected starting and completion
dates of the matching program;
(D) procedures for providing individualized notice
at the time of application, and notice periodically thereafter as directed
by the Data Integrity Board of such agency (subject to guidance provided
by the Director of the Office of Management and Budget pursuant to subsection
(v)), to--
(i) applicants for and recipients of
financial assistance or payments under Federal benefit programs, and
(ii) applicants for and holders of positions
as Federal personnel,
that any information provided by such applicants, recipients, holders,
and individuals may be subject to verification through matching programs;
(E) procedures for verifying information produced
in such matching program as required by subsection (p);
(F) procedures for the retention and timely destruction
of identifiable records created by a recipient agency or non-Federal agency
in such matching program;
(G) procedures for ensuring the administrative, technical,
and physical security of the records matched and the results of such programs;
(H) prohibitions on duplication and redisclosure
of records provided by the source agency within or outside the recipient
agency or the non-Federal agency, except where required by law or essential
to the conduct of the matching program;
(I) procedures governing the use by a recipient agency
or non-Federal agency of records provided in a matching program by a source
agency, including procedures governing return of the records to the source
agency or destruction of records used in such program;
(J) information on assessments that have been made
on the accuracy of the records that will be used in such matching program;
and
(K) that the Comptroller General may have access
to all records of a recipient agency or a non-Federal agency that the Comptroller
General deems necessary in order to monitor or verify compliance with the
agreement.
(2)(A) A copy of each agreement entered into pursuant to paragraph (1)
shall--
(i) be transmitted to the Committee on
Governmental Affairs of the Senate and the Committee on Government Operations
of the House of Representatives; and
(ii) be available upon request to the
public.
(B) No such agreement shall be effective until 30
days after the date on which such a copy is transmitted pursuant to subparagraph
(A)(i).
(C) Such an agreement shall remain in effect only
for such period, not to exceed 18 months, as the Data Integrity Board of
the agency determines is appropriate in light of the purposes, and length
of time necessary for the conduct, of the matching program.
(D) Within 3 months prior to the expiration of such
an agreement pursuant to subparagraph (C), the Data Integrity Board of
the agency may, without additional review, renew the matching agreement
for a current, ongoing matching program for not more than one additional
year if--
(i) such program will be conducted without
any change; and
(ii) each party to the agreement certifies
to the Board in writing that the program has been conducted in compliance
with the agreement.
(p) Verification and opportunity to contest findings
(1) In order to protect any individual whose records are used in a
matching program, no recipient agency, non-Federal agency, or source agency
may suspend, terminate, reduce, or make a final denial of any financial
assistance or payment under a Federal benefit program to such individual,
or take other adverse action against such individual, as a result of information
produced by such matching program, until--
(A)(i) the agency has independently verified the
information; or
(ii) the Data Integrity Board of the agency, or in
the case of a non-Federal agency the Data Integrity Board of the source
agency, determines in accordance with guidance issued by the Director of
the Office of Management and Budget that--
(I) the information is limited
to identification and amount of benefits paid by the source agency under
a Federal benefit program; and
(II) there is a high degree
of confidence that the information provided to the recipient agency is
accurate;
(B) the individual receives a notice from the agency
containing a statement of its findings and informing the individual of
the opportunity to contest such findings; and
(C)(i) the expiration of any time period established
for the program by statute or regulation for the individual to respond
to that notice; or
(ii) in the case of a program for which no such period
is established, the end of the 30-day period beginning on the date on which
notice under subparagraph (B) is mailed or otherwise provided to the individual.
(2) Independent verification referred to in paragraph (1) requires investigation
and confirmation of specific information relating to an individual that
is used as a basis for an adverse action against the individual, including
where applicable investigation and confirmation of--
(A) the amount of any asset or income involved;
(B) whether such individual actually has or had access
to such asset or income for such individual's own use; and
(C) the period or periods when the individual actually
had such asset or income.
(3) Notwithstanding paragraph (1), an agency may take any appropriate
action otherwise prohibited by such paragraph if the agency determines
that the public health or public safety may be adversely affected or significantly
threatened during any notice period required by such paragraph.
(q) Sanctions
(1) Notwithstanding any other provision of law, no source agency may
disclose any record which is contained in a system of records to a recipient
agency or non-Federal agency for a matching program if such source agency
has reason to believe that the requirements of subsection (p), or any matching
agreement entered into pursuant to subsection (o), or both, are not being
met by such recipient agency.
(2) No source agency may renew a matching agreement unless--
(A) the recipient agency or non-Federal agency has
certified that it has complied with the provisions of that agreement;
and
(B) the source agency has no reason to believe that
the certification is inaccurate.
(r) Report on new systems and matching programs
Each agency that proposes to establish or make a significant change
in a system of records or a matching program shall provide adequate advance
notice of any such proposal (in duplicate) to the Committee on Government
Operations of the House of Representatives, the Committee on Governmental
Affairs of the Senate, and the Office of Management and Budget in order
to permit an evaluation of the probable or potential effect of such proposal
on the privacy or other rights of individuals.
(s) Biennial report
The President shall biennially submit to the Speaker of the House of
Representatives and the President pro tempore of the Senate a report--
(1) describing the actions of the Director of the Office of Management
and Budget pursuant to section 6 of the Privacy Act of 1974 during the
preceding two years;
(2) describing the exercise of individual rights of access and amendment
under this section during such years;
(3) identifying changes in or additions to systems of records;
(4) containing such other information concerning administration of this
section as may be necessary or useful to the Congress in reviewing the
effectiveness of this section in carrying out the purposes of the Privacy
Act of 1974.
(t) Effect of other laws
(1) No agency shall rely on any exemption contained in section 552
of this title to withhold from an individual any record which is otherwise
accessible to such individual under the provisions of this section.
(2) No agency shall rely on any exemption in this section to withhold
from an individual any record which is otherwise accessible to such individual
under the provisions of section 552 of this title.
(u) Data Integrity Boards
(1) Every agency conducting or participating in a matching program
shall establish a Data Integrity Board to oversee and coordinate among
the various components of such agency the agency's implementation of this
section.
(2) Each Data Integrity Board shall consist of senior officials designated
by the head of the agency, and shall include any senior official designated
by the head of the agency as responsible for implementation of this section,
and the inspector general of the agency, if any. The inspector general
shall not serve as chairman of the Data Integrity Board.
(3) Each Data Integrity Board--
(A) shall review, approve, and maintain all written
agreements for receipt or disclosure of agency records for matching programs
to ensure compliance with subsection (o), and all relevant statutes, regulations,
and guidelines;
(B) shall review all matching programs in which the
agency has participated during the year, either as a source agency or recipient
agency, determine compliance with applicable laws, regulations, guidelines,
and agency agreements, and assess the costs and benefits of such programs;
(C) shall review all recurring matching programs
in which the agency has participated during the year, either as a source
agency or recipient agency, for continued justification for such disclosures;
(D) shall compile an annual report, which shall be
submitted to the head of the agency and the Office of Management and Budget
and made available to the public on request, describing the matching activities
of the agency, including--
(i) matching programs in which the agency
has participated as a source agency or recipient agency;
(ii) matching agreements proposed under
subsection (o) that were disapproved by the Board;
(iii) any changes in membership or structure
of the Board in the preceding year;
(iv) the reasons for any waiver of the
requirement in paragraph (4) of this section for completion and submission
of a cost-benefit analysis prior to the approval of a matching program;
(v) any violations of matching agreements
that have been alleged or identified and any corrective action taken; and
(vi) any other information required by
the Director of the Office of Management and Budget to be included in such
report;
(E) shall serve as a clearinghouse for receiving
and providing information on the accuracy, completeness, and reliability
of records used in matching programs;
(F) shall provide interpretation and guidance to
agency components and personnel on the requirements of this section for
matching programs;
(G) shall review agency recordkeeping and disposal
policies and practices for matching programs to assure compliance with
this section; and
(H) may review and report on any agency matching
activities that are not matching programs.
(4)(A) Except as provided in subparagraphs (B) and (C), a Data Integrity
Board shall not approve any written agreement for a matching program unless
the agency has completed and submitted to such Board a cost-benefit analysis
of the proposed program and such analysis demonstrates that the program
is likely to be cost effective.
(B) The Board may waive the requirements of subparagraph
(A) of this paragraph if it determines in writing, in accordance with guidelines
prescribed by the Director of the Office of Management and Budget, that
a cost-benefit analysis is not required.
(C) A cost-benefit analysis shall not be required
under subparagraph (A) prior to the initial approval of a written agreement
for a matching program that is specifically required by statute. Any subsequent
written agreement for such a program shall not be approved by the Data
Integrity Board unless the agency has submitted a cost-benefit analysis
of the program as conducted under the preceding approval of such agreement.
(5)(A) If a matching agreement is disapproved by a Data Integrity Board,
any party to such agreement may appeal the disapproval to the Director
of the Office of Management and Budget. Timely notice of the filing of
such an appeal shall be provided by the Director of the Office of Management
and Budget to the Committee on Governmental Affairs of the Senate and the
Committee on Government Operations of the House of Representatives.
(B) The Director of the Office of Management and
Budget may approve a matching agreement notwithstanding the disapproval
of a Data Integrity Board if the Director determines that--
(i) the matching program will be consistent
with all applicable legal, regulatory, and policy requirements;
(ii) there is adequate evidence that
the matching agreement will be cost-effective; and
(iii) the matching program is in the
public interest.
(C) The decision of the Director to approve a matching
agreement shall not take effect until 30 days after it is reported to committees
described in subparagraph (A).
(D) If the Data Integrity Board and the Director
of the Office of Management and Budget disapprove a matching program proposed
by the inspector general of an agency, the inspector general may report
the disapproval to the head of the agency and to the Congress.
(6) The Director of the Office of Management and Budget shall, annually
during the first 3 years after the date of enactment of this subsection
and biennially thereafter, consolidate in a report to the Congress the
information contained in the reports from the various Data Integrity Boards
under paragraph ( 3)(D). Such report shall include detailed information
about costs and benefits of matching programs that are conducted during
the period covered by such consolidated report, and shall identify each
waiver granted by a Data Integrity Board of the requirement for completion
and submission of a cost-benefit analysis and the reasons for granting
the waiver.
(7) In the reports required by paragraphs (3)(D) and (6), agency matching
activities that are not matching programs may be reported on an aggregate
basis, if and to the extent necessary to protect ongoing law enforcement
or counterintelligence investigations.
(v) Office of Management and Budget responsibilities
The Director of the Office of Management and Budget shall--
(1) develop and, after notice and opportunity for public comment, prescribe
guidelines and regulations for the use of agencies in implementing the
provisions of this section; and
(2) provide continuing assistance to and oversight of the implementation
of this section by agencies.
The following section was enacted as part of the Privacy Act, but
was not codified; it may be found at § 552a note).
Sec. 7 (a)(1) It shall be unlawful for any Federal, State or local
government
agency to deny to any individual any right, benefit, or privilege provided
by law because of such individual's refusal to disclose his social security
account number.
(2) the provisions of paragraph (1) of this subsection
shall not apply with respect to--
(A) any disclosure which is required
by Federal statute, or
(B) any disclosure of a social security
number to any Federal, State, or local agency maintaining a system of records
in existence and operating before January 1, 1975, if such disclosure was
required under statute or regulation adopted prior to such date to verify
the identity of an individual.
(b) Any Federal, State or local government agency which requests an
individual to disclose his social security account number shall inform
that individual whether that disclosure is mandatory or voluntary, by what
statutory or other authority such number is solicited, and what uses will
be made of it.
The following sections were enacted as part of Pub.L. 100-503, the
Computer Matching and Privacy Protection Act of 1988; they may be found
at § 552a (note).
Sec. 6 Functions of the Director of the Office of Management and Budget.
(b) Implementation Guidance for Amendments-- The
Director shall, pursuant to section 552a(v) of Title 5, United States Code,
develop guidelines and regulations for the use of agencies in implementing
the amendments made by this Act not later than 8 months after the date
of enactment of this Act.
Sec. 9 Rules of Construction.
Nothing in the amendments made by this Act shall be construed to authorize--
(1) the establishment or maintenance by any agency
of a national data bank that combines, merges, or links information on
individuals maintained in systems of records by other Federal agencies;
(2) the direct linking of computerized systems of
records maintained by Federal agencies;
(3) the computer matching of records not otherwise
authorized by law; or
(4) the disclosure of records for computer matching,
except to a Federal, State, or local agency.
Sec. 10 Effective Dates.
(a) In General-- Except as provided in subsection (b), the amendments
made by this Act shall take effect 9 months after the date of enactment
of this Act.
(b) Exceptions-- The amendment made by sections 3(b) [Notice of Matching
Programs - Report to Congress and the Office of Management and Budget],
6 [Functions of the Director of the Office of Management and Budget], 7
[Compilation of Rules and Notices] and 8 [Annual Report] of this Act shall
take effect upon enactment.
