Privacy Act of 1974: Access, Corrections, and Lawsuits

The Privacy Act of 1974 gives U.S. citizens and lawful permanent residents the right to see, correct, and control the personal records that federal agencies keep about them. Codified at 5 U.S.C. § 552a, the law restricts how executive-branch agencies collect, store, share, and use personally identifiable information, and it backs those restrictions with civil lawsuits, a minimum $1,000 damages award for willful violations, and misdemeanor charges against employees who abuse their access.¹

Who and What the Law Covers

The Privacy Act reaches executive-branch agencies, including cabinet departments, independent regulatory bodies, and government-controlled corporations.¹ It does not apply to Congress, the federal courts, private companies, or state and local governments. The one exception involves Social Security numbers, addressed below.

Two definitions decide whether a particular piece of data is protected. A “record” is any item or collection of information an agency maintains about an individual, tied to a name, Social Security number, or other personal identifier. A “system of records” exists only when the agency actually retrieves records by that name or identifier. If an agency stores information about you but doesn’t look it up under your name or identifier, the Privacy Act’s protections generally don’t apply to that data.¹

Your Right to See Your Records

Any U.S. citizen or lawful permanent resident can ask a federal agency to produce the records it keeps about them. You can review the file yourself, bring someone along for the review, and receive copies of all or part of it. There is one hard limit built into the access right: you cannot obtain information the agency compiled in reasonable anticipation of a civil lawsuit against you.²

Fees are limited to the cost of copying. Some agencies provide the first 100 pages free.

A related right worth using: agencies must keep a log of every disclosure they make from a system of records, showing the date, purpose, and recipient. You can ask to see that accounting. Two categories are excluded from what you can review: internal disclosures to employees with a need to know, and disclosures required under FOIA. Records shared under a law enforcement request are also kept off the accounting you can access.³

Your Right to Correct Your Records

If you find something wrong in your file, you can ask the agency to amend it. The agency must acknowledge that amendment request in writing within 10 business days.² It must then either make the correction or explain in writing why it refuses and tell you how to appeal. The 10-business-day clock applies to amendment requests specifically, not to your initial request for access, which has no statutory deadline.

If the agency denies your amendment, you can appeal to the head of the agency or a designated official. The agency then has 30 business days to complete its review, though it can extend the period for good cause. If you lose on appeal, you have the right to file a “statement of disagreement” explaining why you believe the record is wrong. The agency must attach that statement to the disputed record and include it any time the record is shared going forward.² Even when the agency won’t change the underlying record, your written objection travels with the data.

How to File a Privacy Act Request

Each federal agency publishes its own Privacy Act regulations, but the basic steps are consistent across the government. Your written request should:

State that it is made under the Privacy Act, 5 U.S.C. § 552a.
Identify the system of records you are asking about.
Give enough detail for the agency to locate your file.
Confirm that you are a U.S. citizen or lawful permanent resident.
State whether you want to inspect the records in person or receive copies.⁴

Agencies verify identity before searching their files. For written requests, that usually means either a notarized signature or a statement signed in front of two witnesses who can attest to your identity. For in-person requests, a valid driver’s license, passport, or similar photo ID is enough.⁵ Agencies may ask for more verification if the records are particularly sensitive. Notarization costs vary by state, typically between $2 and $25 per signature.

One practical note: agencies review first-party requests under both the Privacy Act and FOIA to give you the broadest possible access. If a Privacy Act exemption blocks a record, the agency still has to check whether FOIA requires release, and vice versa. If you are denied, ask the agency to name the specific statute and exemption it relied on.⁶

What Agencies Must Tell You When They Collect Information

Whenever a federal agency asks you for personal information, it must give you a Privacy Act Statement, either on the form itself or on a separate sheet. The statement must disclose the legal authority for the collection, the main purposes for which the data will be used, the routine uses the agency has published for sharing it, and what happens if you refuse to provide the information.² The block of small print at the bottom of a federal form is that statement.

When personal data could lead to a negative decision about you, the agency must collect it directly from you whenever practicable rather than pulling it from third-party sources.¹ Agencies are also limited to collecting only information that is relevant and necessary to a purpose authorized by statute or executive order.

The First Amendment Restriction

Federal agencies may not maintain records describing how you exercise your First Amendment rights, including your religious beliefs, political activities, speech, and associations. The exceptions are consent, specific statutory authorization, and records that fall within the scope of an authorized law enforcement investigation.¹

Social Security Number Protections

Section 7 of the Privacy Act reaches beyond federal agencies. It applies to state and local governments too. No government agency at any level can deny you a right, benefit, or privilege because you refuse to disclose your Social Security number, unless a federal statute requires the disclosure or the agency was already using the number in a system that existed before January 1, 1975.⁷

Any time a government agency asks for your Social Security number, it must tell you three things at or before the request: whether providing it is mandatory or voluntary, which law authorizes the request, and how the number will be used.⁷ A form that skips this notice is out of compliance.

When Agencies Can Share Your Records Without Your Consent

The default is that no agency may disclose a record from a system of records without your written consent. The statute then carves out thirteen exceptions.¹ The ones you are most likely to encounter:

Employees within the agency who need the record to do their jobs.
Records that must be released under the Freedom of Information Act.
Routine uses — sharing for purposes compatible with why the information was originally collected, provided those uses were published in the agency’s System of Records Notice.
Law enforcement requests from another agency, where the head of the requesting agency puts the request in writing, specifies the records, and identifies the legal authority.
Health or safety emergencies affecting an individual, with notice sent to your last known address.
Congressional committees acting within their jurisdiction.
Court orders from a court of competent jurisdiction.

Other exceptions cover the Census Bureau, the Government Accountability Office, the Congressional Budget Office, the National Archives, statistical research with individually identifiable information removed, and consumer reporting agencies for debt collection purposes.

When You Can Sue for a Violation

If an agency violates your Privacy Act rights, you can sue in federal district court. The statute creates four causes of action: two for injunctive relief (forcing the agency to grant access or make an amendment) and two for monetary damages (when an inaccurate record or another Privacy Act violation causes you harm).⁸

You can file in the district where you live, where you work, where the records are located, or in the District of Columbia. The deadline is two years from the date the cause of action arises. If the agency materially and willfully misrepresented information it was required to disclose to you, and that misrepresentation is material to its liability, the two-year clock instead starts when you discover the misrepresentation.¹

The Willful Standard

Damages are available only if a court finds the agency acted intentionally or willfully. Ordinary negligence is not enough. Clear that bar and the government owes your actual damages, with a guaranteed minimum of $1,000, plus reasonable attorney fees and litigation costs.⁸ This is where most damage claims fall apart in practice; proving deliberate misconduct rather than sloppiness is a steep burden.

What Counts as Actual Damages

In FAA v. Cooper (2012), the Supreme Court held that “actual damages” under the Privacy Act means only proven economic harm — lost wages, out-of-pocket costs, and similar pecuniary losses. Emotional distress, embarrassment, and reputational harm do not qualify, even when they are real and documented.⁹ The Court reasoned that because the Privacy Act waives the government’s sovereign immunity, ambiguity in that waiver has to be read in the government’s favor. The practical effect: if a willful violation causes you serious emotional harm but no financial loss, your recovery is capped at $1,000 plus attorney fees.

Criminal Penalties

The Privacy Act also creates three misdemeanor offenses, each punishable by a fine of up to $5,000:

A federal officer or employee who willfully discloses records to someone not entitled to receive them, knowing the disclosure is prohibited.²
A federal officer or employee who willfully maintains a system of records without publishing the required System of Records Notice.²
Any person, not just a federal employee, who knowingly and willfully obtains records about someone under false pretenses.¹⁰

Prosecutions are rare, and the $5,000 fine has not been adjusted since 1974.

Why Some Records Stay Out of Reach

Not every federal records system is subject to every Privacy Act requirement. Agency heads can exempt certain systems through formal rulemaking. The broadest exemptions, under subsection (j), apply to CIA records and to records maintained by agencies whose primary function is criminal law enforcement. Narrower exemptions under subsection (k) cover seven categories, including classified national security information, law enforcement investigatory material, Secret Service protective intelligence, statistical data, background investigation files for federal employment or military service, employment testing material, and military promotion evaluation material.¹¹ Even under a general exemption, the accounting-of-disclosures rules, the SORN publication requirement, and the criminal penalty provisions still apply.

Extra Protection Against Computer Matches

When federal agencies run automated comparisons of records across systems or with other agencies — common in benefits administration — the Computer Matching and Privacy Protection Act of 1988 layers on extra safeguards. The most important one for you: an agency cannot cut your benefits, deny your application, or take any other adverse action based solely on a computer match. The results have to be independently verified first, and before acting the agency must notify you of its findings and give you a chance to contest them. No adverse action can occur until the notice period expires, which is at least 30 days.² If a federal agency moves against you citing a data match, ask what independent verification was done and whether you received the required notice.

1
Office of the Law Revision Counsel. 5 USC 552a – Records Maintained on Individuals
2
Office of the Law Revision Counsel. 5 US Code 552a – Records Maintained on Individuals
3
U.S. Department of Justice. Overview of the Privacy Act – Accounting of Certain Disclosures
4
U.S. Department of the Treasury. How to Write a Privacy Act Request
5
eCFR. Implementation of the Privacy Act of 1974
6
U.S. Department of Justice. OIP Guidance – The Interface Between the FOIA and Privacy Act
7
U.S. Department of Justice. Overview of The Privacy Act of 1974 – Disclosure of Social Security Numbers
8
U.S. Department of Justice. Privacy Act of 1974 – Civil Remedies
9
Justia. FAA v Cooper, 566 US 284 (2012)
10
U.S. Department of Justice. Overview of the Privacy Act of 1974 – Criminal Penalties
11
U.S. Department of Justice. Overview of the Privacy Act of 1974 – Exemptions