Employment records are not public in the private sector, but they largely are for government workers. If you work for a private company, your personnel file belongs to your employer and is closed to outsiders except in narrow situations. If you work for a federal, state, or local government agency, basic details like your name, job title, salary, and duty station are generally available to anyone who asks under the federal Freedom of Information Act or a state public records law.
Private Sector Files Are Confidential
A private employer owns your personnel file, and access inside the company is typically limited to people with a direct business reason to see it, such as your manager or human resources staff. No federal law forces a private employer to open personnel files to the public, and the company has no obligation to confirm anything beyond the basics about a current or former employee.
There are a few situations where a private employer can release information from your file:
- A court-ordered subpoena compels production of specific records.
- A government agency investigating a complaint or conducting an audit demands relevant documents.
- You give written consent, for example so a mortgage lender can verify your income.
Outside those situations, a private employer that hands out sensitive personnel information risks legal liability, including claims for invasion of privacy.
How Your Employment Information Actually Reaches Outsiders
For most workers, the practical question isn’t whether a stranger can pull your file. It’s what a prospective employer, landlord, or lender can learn about your work history. That information usually moves through background checks and reference calls, each with its own rules.
Background Checks Under the FCRA
When a prospective employer wants to run a formal background check, the Fair Credit Reporting Act controls the process. The employer must give you a clear written disclosure that a consumer report may be obtained, and you have to authorize the check in writing before it happens. That disclosure has to be a standalone document, not buried in a job application.
If the report turns up something that might cost you the job, the FCRA requires a two-step notice process. The employer must first send a pre-adverse action notice that includes a copy of the report and a summary of your rights, giving you time to review it and dispute anything inaccurate. If the employer ultimately decides not to hire you, a second notice must follow, identifying the reporting company and explaining your right to a free copy of the report and to dispute errors.
Reference Calls and Verification
When a future employer calls your old company, no law requires your former employer to say anything at all. Many companies limit responses to job title, dates of employment, and sometimes whether you’re eligible for rehire. That caution is a risk-management choice, not a legal requirement.
Former employers are legally permitted to share truthful, documented information about your performance and the reason you left. A majority of states have enacted qualified-immunity statutes shielding employers from liability for good-faith job references, so long as the information is honest and not shared with malicious intent. The protection disappears if the employer knowingly provides false information or acts with reckless disregard for the truth.
Government Employee Records Are Largely Public
The rules flip when the employer is a government agency. The federal Freedom of Information Act requires federal agencies to make records available to the public on request, and every state has an equivalent public records law. The logic is straightforward: taxpayers fund government salaries, and the public has a legitimate interest in knowing who holds government positions and what they’re paid.
The Privacy Act of 1974 adds a layer of protection for federal workers. It prohibits federal agencies from disclosing records about an individual without written consent, subject to limited exceptions including disclosures required under FOIA, law enforcement requests backed by a written request from an agency head, and court orders.
In practice, FOIA and the Privacy Act pull in opposite directions. FOIA Exemption 6 shields “personnel and medical files” from disclosure when release would constitute a clearly unwarranted invasion of personal privacy. The word “clearly” tips the balance toward disclosure: an agency has to show that the privacy harm substantially outweighs the public benefit before withholding records.
What Gets Released, What Stays Confidential
For federal employees, the Office of Personnel Management’s data release policy identifies categories that agencies generally make available: name, job title, grade level, position description, duty station, and salary. The General Services Administration takes the same approach, releasing those basics and withholding information tied to an employee’s personal life and family status.
Information that stays confidential includes:
- Social Security numbers
- Home addresses and personal phone numbers
- Medical details
- Payroll deduction data such as union dues or retirement contributions
- Bank account information
Performance evaluations and disciplinary records receive stronger privacy protection but are not automatically off-limits. Agencies evaluate each request individually, weighing the public interest against the employee’s privacy.
Medical and Genetic Information Are Walled Off
Two federal laws protect health-related data regardless of whether your employer is public or private. The Americans with Disabilities Act requires any medical information an employer collects to be stored on separate forms, in separate medical files, treated as confidential. Merging medical records into a general personnel file violates the ADA. Access is limited to supervisors who need to know about work restrictions or accommodations, first-aid personnel responding to emergencies, and government officials investigating ADA compliance.
The Genetic Information Nondiscrimination Act works the same way. Genetic information must be kept in separate medical files and treated as confidential. Disclosure is limited to narrow exceptions: the employee’s own written request, a court order (with notice to the employee if the order was obtained without their knowledge), government compliance investigations, and certain public health emergencies involving contagious diseases.
Your Right to See Your Own File
No single federal law gives every private-sector employee the right to inspect their own personnel file. Roughly half the states have enacted statutes requiring employers to let employees review their records. The process is generally the same across those states: submit a written request, and the employer must make the file available for inspection within a set number of business days, typically between five and fourteen.
Some states also give you the right to obtain a copy, sometimes for a small per-page fee. If you find something you believe is inaccurate, many of these states allow you to submit a written rebuttal that the employer must keep in your file alongside the disputed entry. The usual first step is to ask the employer to correct or remove the item; if that fails, your written explanation becomes part of the record. These rights generally extend to former employees, not just current staff.
Federal employees have a separate path. The Privacy Act gives you the right to access records an agency maintains about you and to request amendments to records you believe are inaccurate.
When Records Are Wrongfully Disclosed
If a private employer releases sensitive information from your personnel file without authorization, you may have legal recourse. The most common theory is the tort of public disclosure of private facts, recognized in most states. A successful claim requires showing that the employer disclosed a genuinely private fact, that the disclosure reached enough people to be considered public, and that a reasonable person would find the disclosure offensive. Truth is not a defense the way it is in a defamation case: accurate information can still support a claim if the disclosure itself was unjustified. Damages can include compensation for emotional distress, lost income, and, in cases of reckless conduct, punitive damages.
Federal employees have a statutory remedy under the Privacy Act. An individual can sue a federal agency that willfully or intentionally violates the Act’s disclosure restrictions, and courts can award actual damages, attorney’s fees, and litigation costs.