DoD 5400.11-R Privacy Program: Access, Amendment, and Exemptions

DoD 5400.11-R is the Department of Defense regulation that carries the Privacy Act of 1974 into every corner of the military, telling DoD components how they may collect, store, share, and protect personal information about service members, civilian employees, contractors, and anyone else whose records sit in a defense database.¹ It translates the federal Privacy Act at 5 U.S.C. 552a into procedures that run from the Pentagon down to installation-level offices, and it gives you enforceable rights to see your records, correct them, and challenge misuse.²

Is the 2007 Regulation Still in Force

Partly. The version dated May 14, 2007 remains the base text, but the Department has begun replacing pieces of it. DoD Manual 5400.11, Volume 2 now handles breach preparedness and response and formally cancels Chapter 10 and Appendix 2 of the original regulation.³ DoD Instruction 5400.11 has been updated separately and now carries the overarching policy framework for the privacy and civil liberties program.⁴ If you are relying on a specific chapter, confirm it against the newer manual and instruction before assuming it still controls.

Who Is Bound by the Rule

Every organizational entity in the Department. That means the Office of the Secretary of Defense, the Army, Navy, and Air Force, the Joint Chiefs of Staff, the Combatant Commands, the DoD Inspector General, the Defense Agencies, and the DoD Field Activities.¹ The parallel federal codification at 32 CFR Part 310 sets out the procedures you use to access, amend, or account for disclosures of your records.⁵

Contractors are not a loophole. When a DoD contract requires a company to design, develop, or operate a system of records on individuals, that contractor is treated as an agency employee for Privacy Act purposes. FAR clause 52.224-2 must be written into the contract and flowed down to subcontractors.⁶

What Counts as a Record and a System of Records

A “record” is any item or grouping of information about an individual that the agency maintains and that carries a name, Social Security number, fingerprint, photograph, or other identifier.² The subject matter can be anything from education and medical history to finances and employment.

A “system of records” is a group of those records from which the agency actually retrieves information by a person’s name or unique identifier.² The distinction is not academic. Privacy Act access and amendment rights attach to systems of records. If a database is not organized so records can be pulled up by your name or identifier, those rights do not reach it.

Each system of records must be described in a System of Records Notice published in the Federal Register, identifying the categories of individuals covered, the types of information kept, and the “routine uses” that permit disclosure without your consent.² Maintaining a system without publishing the notice is a criminal offense. For anyone trying to exercise their rights, the notice is the starting map: it identifies which component holds the file.

Limits on What DoD Can Collect and Keep

The Department may keep only information that is relevant and necessary to accomplish a purpose required by statute or executive order.² Collecting data speculatively is not permitted. When the information could lead to an adverse decision about your rights or benefits, the agency must collect it directly from you whenever practicable rather than pulling it from third parties.

Records also have to be accurate, relevant, timely, and complete enough to be fair when the agency uses them to make a decision about you. And the Department must put administrative, technical, and physical safeguards in place to protect them.²

First Amendment Records

DoD cannot maintain records describing how you exercise First Amendment rights: speech, religious practice, political association, peaceful assembly. The narrow exceptions are express statutory authorization, your consent, or direct relevance to an authorized law enforcement activity.²

The Privacy Act Statement You Should Receive

When the DoD asks you for personal information, it must hand you a Privacy Act Statement, either on the form itself or on a separate page you keep. That statement tells you the legal authority for the collection, whether your response is mandatory or voluntary, the intended uses, and the consequences of declining.² A form that arrives without one is worth flagging to the component’s privacy office.

When Your Records Can Be Shared Without Your Consent

The default is no disclosure without your written consent. The Privacy Act then lists thirteen exceptions. The ones that come up in practice for DoD records include:

Need-to-know within the agency, so officers and employees can do their jobs.
Routine uses compatible with the original purpose, as spelled out in the published System of Records Notice.
Civil or criminal law enforcement, when another agency’s head makes a written request identifying the records needed and the legal basis.
Compelling health or safety circumstances, with notification to you afterward.
Court orders from a court of competent jurisdiction.
Congressional access, when the records fall within a chamber’s, committee’s, or subcommittee’s jurisdiction.

Other exceptions reach the Census Bureau, the National Archives, the Government Accountability Office, and consumer reporting agencies for debt collection. Whenever a disclosure happens outside routine agency use or FOIA, the Department must keep an accounting of the date, purpose, and recipient, and you can request that accounting to see who has been looking at your file.²

How to Request Your Records

Start with the System of Records Notice that matches the information you want. It names the responsible component and explains how to submit a request. You will need your full name, current mailing address, and enough detail for the agency to locate the file. Include a Social Security number only where the form specifically calls for it.

You have to prove you are who you say you are. That can be done through a notarized signature or through an unsworn declaration under penalty of perjury under 28 U.S.C. 1746, which lets a signed written statement stand in for notarization.⁷

Send the request to the privacy office of the component that maintains the records. The Defense Privacy, Civil Liberties, and Transparency Office runs online portals for DoD personnel with a Common Access Card and for outside requesters.⁸ Individual services also accept requests by mail or fax. DoD processes access requests under both the Privacy Act and FOIA, giving you whichever statute gives you more.⁵ Access to your own records is free; fees can apply only for duplication, and small requests are typically waived.

A response will come back as full release, partial release with redactions, or denial. Withheld material must be tied to a specific legal exemption. A denial is appealable administratively and, after that, in federal court.

Amending Records That Are Wrong

If you read your file and find something inaccurate, irrelevant, outdated, or incomplete, you can request an amendment. The steps are to obtain a copy of the record, identify the specific errors, and send a written amendment request to the component’s privacy or FOIA office.⁹

The agency must acknowledge the request in writing within 10 business days. It then either makes the correction or explains in writing why it refuses, and tells you how to seek a higher-level review.² On review, the agency has 30 business days to issue a final determination, with a possible good-cause extension.

A final refusal is not the end. You can file a statement of disagreement setting out your position, and the agency must attach it to the disputed record and pass it along whenever the record is disclosed.² You can also sue in federal district court.

Exemptions That Can Block Access

Not every DoD record is open for review. Agency heads can exempt certain systems from the access and amendment provisions, and the exemptions fall into two tiers.

The general exemptions under subsection (j) are the broadest. They cover CIA systems and systems whose primary function is criminal law enforcement, including criminal investigations, arrests, and correctional or parole information.² For service members, this most often surfaces with files held by criminal investigative organizations such as Army CID or NCIS.

The specific exemptions under subsection (k) are narrower and get invoked more often:

Properly classified national defense or foreign policy material.
Non-criminal law enforcement investigatory material, though if the investigation cost you a federal benefit, the records generally must be released.
Records tied to protection of the President or other officials.
Data maintained solely for statistical purposes.
Suitability and security clearance investigations, where release would identify a confidential source.
Testing material used for federal employment or promotion.
Military promotion evaluation material, where release would identify a confidential source.

An exemption is not something the agency can invent on the spot. It has to have published a rule adopting the exemption for the specific system of records before it can rely on it to deny you.²

When the System Fails: Suing and Criminal Penalties

You have four grounds for a civil suit in federal district court: the agency refuses access, refuses amendment, fails to keep records accurately and that failure produces an adverse decision about you, or otherwise violates the Act to your detriment.² The court reviews the matter afresh rather than deferring to the agency.

Where the court finds the agency acted intentionally or willfully, the government is liable for actual damages with a $1,000 floor, plus reasonable attorney fees and litigation costs.² The fee-shifting provision is what makes small-dollar cases viable.

Criminal liability reaches three acts. A DoD employee who knowingly discloses protected records to someone not entitled to receive them commits a misdemeanor punishable by up to a $5,000 fine. The same penalty applies to any employee who maintains a system of records without publishing the required Federal Register notice, and to anyone who obtains records from an agency under false pretenses.²

1
Department of Defense. DoD 5400.11-R – Department of Defense Privacy Program
2
Office of the Law Revision Counsel. 5 USC 552a – Records Maintained on Individuals
3
Department of Defense. DoD Manual 5400.11 Volume 2 – DoD Privacy and Civil Liberties Programs: Breach Preparedness and Response Plan
4
Department of Defense. DoD Instruction 5400.11 – DoD Privacy and Civil Liberties Programs
5
eCFR. 32 CFR Part 310 – Protection of Privacy and Access to and Amendement of Individual Records
6
Acquisition.GOV. FAR 52.224-2 – Privacy Act
7
Office of the Law Revision Counsel. 28 USC 1746 – Unsworn Declarations Under Penalty of Perjury
8
PCLT. Request Records – Privacy and Civil Liberties Directorate
9
Department of Defense Office of Inspector General. Individuals Right of Amendment Under the Privacy Act