Privacy Act of 1974: The 12 Disclosure Exceptions

A federal agency can share a record about you without your written consent only when one of thirteen specific situations listed in the Privacy Act applies. These Privacy Act disclosure exceptions are set out in 5 U.S.C. § 552a(b), and everything outside them requires your permission.¹ The exceptions cover internal agency work, FOIA releases, routine uses tied to the purpose of collection, statistical and archival transfers, emergencies, oversight by Congress and its auditors, law enforcement, court orders, and reporting delinquent debts to credit bureaus. Each one is narrower than it first sounds.

Internal Agency Use

Subsection (b)(1) lets employees of the agency that holds the record see it if they need it to perform their duties.¹ A benefits processor reviewing your eligibility qualifies. A payroll clerk verifying your salary qualifies. A curious employee from an unrelated division does not. The statute ties access to job need, not general access to the system.

FOIA-Required Releases

Subsection (b)(2) permits disclosure when the Freedom of Information Act requires the agency to release the record.¹ FOIA has its own privacy exemptions, so this exception only reaches records that survive that screening. If a FOIA exemption protects the material, the Privacy Act’s consent rule still holds.

Routine Use

Subsection (b)(3) is the exception agencies use most often. It allows disclosure for any “routine use” — meaning a purpose compatible with the reason the information was collected in the first place.² Payroll data flowing from an employing agency to the Treasury so checks can be issued is a textbook example.

The statute does not define “compatible,” and agencies read it generously. The Office of Management and Budget covers both functionally equivalent uses and other uses that are “necessary and proper.” The D.C. Circuit has said a disclosure is compatible so long as it would not “actually frustrate the purposes for which the information was gathered,” while other courts have required a “concrete relationship” between the original purpose and the new use.²

Before an agency can use a new routine use, it must publish notice in the Federal Register at least 30 days in advance and accept public comment.¹ Every active routine use appears in the agency’s System of Records Notice, which lists the categories of records kept, the people covered, and the specific third parties authorized to receive data along with the reason for each transfer.³ OMB requires agencies to keep current SORN links online, so if you want to know how a particular agency handles your data, the SORN is the place to check.

Census Bureau Transfers

Subsection (b)(4) allows any agency to share records with the Bureau of the Census for censuses, surveys, and related activities under Title 13.¹ Data moves in one direction: to the Census Bureau, which is then bound by Title 13’s confidentiality rules.

Statistical Research

Subsection (b)(5) covers statistical use by any recipient, not only the Census Bureau. Two conditions apply. The recipient must give written assurance that the record will be used solely for statistical research or reporting, and the agency must transfer the data in a form that is not individually identifiable.² Names, Social Security numbers, and other identifiers come out before the file goes over.

National Archives

Subsection (b)(6) authorizes transfers to the National Archives and Records Administration when a record has enough historical or other value to warrant permanent preservation. The Archivist of the United States decides whether the record meets that threshold.¹ Once transferred, the records fall under archival access rules.

Law Enforcement Requests

Subsection (b)(7) permits disclosure to another federal, state, or local agency for a civil or criminal law enforcement activity. The safeguard is procedural: the head of the requesting agency must submit a written request identifying the specific records sought and the authorized law enforcement activity involved.¹ A phone call or informal data-sharing arrangement does not satisfy the statute.

One consequence to know: when your records go out under (b)(7), you have no right to find out. Agencies must log the disclosure, but the statute specifically exempts law enforcement disclosures from the requirement that the accounting be made available to the individual on request.¹

Emergencies Affecting Health or Safety

Subsection (b)(8) allows disclosure when the requester shows “compelling circumstances” affecting an individual’s health or safety. After the release, the agency must send notification to the individual’s last known address.¹ The statute does not fix a deadline, but implementing regulations at agencies such as the Department of Labor require notification within 10 working days and require the notice to describe what was disclosed, to whom, on what date, and why the circumstances were compelling.⁴

Congress

Subsection (b)(9) authorizes disclosure to either chamber of Congress and to any committee or subcommittee whose jurisdiction covers the matter.¹ Individual members acting on their own do not fall inside this exception.

GAO Audits

Subsection (b)(10) permits disclosure to the Comptroller General and authorized representatives of the Government Accountability Office for auditing and evaluating federal programs.¹

Court Orders

Subsection (b)(12) — commonly cited as the court-order exception, though it appears as (11) in the statutory sequence — allows disclosure under an order from a court of competent jurisdiction. A subpoena signed by an attorney is not enough on its own; the Privacy Act does not list subpoenas as a standalone exception. A court order involves a judge who has evaluated whether the disclosure is justified. When records are released through compulsory legal process that becomes part of the public record, the agency must make reasonable efforts to notify the affected individual.¹

Congressional Budget Office

The CBO exception gives the Director of the Congressional Budget Office access on the same terms as GAO for the office’s statutory work.¹ Together with (b)(9) and (b)(10), it lets the legislative branch and its support agencies do oversight without individual consent blocking their work.

Consumer Reporting Agencies

Subsection (b)(13), added by the Debt Collection Act of 1982, allows agencies to report delinquent debts to consumer reporting agencies in accordance with 31 U.S.C. § 3711(e).¹ Before the agency can send your name to a credit bureau, it must validate that the debt is owed and give you the chance to repay or dispute it.⁵ Missing one payment does not put you on a credit report the next day.

Finding Out Who Received Your Records

Every time an agency discloses your records under one of these exceptions, it has to log the disclosure. Under 5 U.S.C. § 552a(c), the agency records the date, nature, and purpose of the disclosure and the name and address of the recipient.¹ Two categories are exempt from logging: internal agency use under (b)(1) and FOIA releases under (b)(2). Everything else gets recorded.

Agencies must keep the accounting for at least five years or the life of the record, whichever is longer. You can ask to see your disclosure accounting, but the agency does not have to show you disclosures made for law enforcement purposes under (b)(7).¹ Agencies can also exempt whole record systems from the accounting-access requirement when the system involves classified information, law enforcement investigations, Presidential protective services, or certain other sensitive categories.

What to Do If an Agency Violated the Rules

If an agency shared your records outside these exceptions, you can sue in federal district court. Under 5 U.S.C. § 552a(g), you have a civil cause of action when an agency refuses to let you access or amend your records, when it fails to maintain your records accurately enough that an adverse decision results, or when it violates any other provision of the Act in a way that harms you.¹ When the court finds the agency acted intentionally or willfully, you can recover actual damages with a guaranteed floor of $1,000, plus attorney fees and litigation costs.⁶

You have two years from the date the violation occurs to file, or two years from when you discover it if the agency materially misrepresented the facts. A federal employee who knowingly discloses a protected record to someone not authorized to receive it also commits a misdemeanor punishable by a fine of up to $5,000.¹

1
Office of the Law Revision Counsel. 5 USC 552a – Records Maintained on Individuals
2
U.S. Department of Justice. Overview of the Privacy Act of 1974 2020 Edition – Conditions of Disclosure to Third Parties
3
U.S. Department of Justice. Overview of the Privacy Act of 1974 2020 Edition – Agency Requirements
4
eCFR. 29 CFR 71.11 – Emergency Disclosures
5
U.S. Department of Justice. Overview of the Privacy Act of 1974 – Conditions of Disclosure to Third Parties
6
U.S. Department of Justice. Overview of the Privacy Act of 1974 2020 Edition – Remedies