What Is 5 USC 552a? Access, Corrections, and Exemptions

5 U.S.C. 552a is the Privacy Act of 1974, the federal statute that controls how executive branch agencies collect, keep, use, and share personal information about you. It gives you four core rights: to see records the government holds about you, to ask that mistakes be corrected, to limit how those records are shared without your consent, and to sue in federal court when an agency mishandles your data and causes real harm. One thing to know up front — the law protects U.S. citizens and lawful permanent residents, not everyone whose information a federal agency happens to hold.¹

Who and What the Law Covers

The statute defines “individual” as a citizen of the United States or an alien lawfully admitted for permanent residence. If you don’t fall into one of those categories, you have no enforceable right under this law to access or amend records about you. Some agencies extend Privacy Act-style protections to others as a matter of policy, but that’s discretionary and can’t be enforced in court.¹

The Act reaches federal executive branch agencies — think the Department of Defense, the Department of Veterans Affairs, the Social Security Administration. It does not reach Congress, the federal courts, state or local government, or private companies. If a private contractor handles records on an agency’s behalf, the agency stays responsible for compliance, but the contractor can’t be sued directly under this statute.¹

Not every document with your name on it counts. The Act applies only to records kept in a “system of records,” meaning the agency actually retrieves them using a personal identifier like your name, Social Security number, fingerprint, or employee ID. If a document mentions you but the agency files it by subject matter or date, the Privacy Act likely doesn’t reach it. That distinction is what puts some government-held information outside the law entirely.¹

Covered records typically include employment files, medical records, financial data, investigative reports, and benefit determinations — personnel files at the Office of Personnel Management, medical files at the VA, and so on. Each agency has to publish a System of Records Notice (SORN) in the Federal Register for every covered system, listing what it contains, who it covers, how the agency uses it, and how to request access. These notices are public, and they’re the single best tool for figuring out which agency systems might hold records about you before you file anything.¹

Your Right to See Your Records

You can ask any federal agency to let you review records about yourself in any system of records it maintains. The agency must let you inspect the records, get copies, and bring someone along during the review, though it can require a written statement authorizing that person’s presence. The statute doesn’t set a hard access deadline, but most agencies aim to respond within 30 days under their own regulations.²

One important limit: you cannot access records compiled in reasonable anticipation of a civil lawsuit or proceeding, even if they’re about you.¹

Your Right to Correct Records

If something is wrong, you can request an amendment. The agency must acknowledge the request in writing within 10 business days. It then either makes the correction or gives you a written explanation of why it won’t, including how to appeal. Appeals go to a senior official within the agency, and the agency has 30 business days to complete its review, with extensions for good cause.¹

If the appeal is denied, you can file a statement of disagreement explaining why you believe the record is wrong. The agency must attach that statement to the disputed record and include it whenever the record is disclosed to anyone else going forward. That doesn’t fix the underlying record, but your objection follows the data. If inaccurate records are affecting something consequential like a security clearance or benefit eligibility, you also have the option of suing in federal court.¹

How to Submit a Request

Start by identifying which agency holds your records and which system of records they’re likely in. The SORNs in the Federal Register list each system by name and tell you where to direct your request. Many agencies also post this on their websites next to their Privacy Act procedures.

Your request should include enough detail for the agency to find the records without an unreasonable search. Give your full name, the time period the records cover, and any identifying number tied to the system (a case number, employee ID). The more specific you are, the faster it moves.

You have to verify your identity before the agency releases anything. If you mail your request, you’ll need either a notarized signature or a statement under penalty of perjury: “I declare under penalty of perjury that the foregoing is true and correct. Executed on [date].” If you go in person, bring two forms of government-issued photo ID.

Agencies generally charge only for duplicating records, not for searching or reviewing them. The exception is records under a law enforcement or classified exemption, where search and review fees may apply.³ Duplication rates are usually the same modest per-page fees the agency uses for Freedom of Information Act requests.

When Agencies Can Share Your Records Without Consent

The default rule is that no agency can disclose a record from a system of records without your written consent. The statute then carves out twelve exceptions. The ones most commonly used:⁴

Internal agency use by employees who need the record for their job.
Disclosures required by the Freedom of Information Act.
A “routine use” compatible with the original purpose for collecting the record, provided the agency has published that specific use in its SORN beforehand.
Census Bureau planning or surveys.
Statistical research where identities won’t be disclosed and the recipient gives written assurance.
Transfers to the National Archives for records with historical value.
Law enforcement requests from another agency, in writing, specifying the records and the authorized activity.
Health or safety emergencies affecting an individual.
Disclosures to either chamber of Congress or a committee within its jurisdiction.
The Government Accountability Office for audits and oversight.
Court orders from a court of competent jurisdiction.
Debt collection reports to consumer reporting agencies for debts owed to the government.

Routine use is the exception agencies rely on most heavily and the one worth understanding. A disclosure qualifies only if it serves a purpose compatible with why the agency collected the information originally, and only if the agency published that specific routine use in the Federal Register before making the disclosure. An agency can’t retroactively justify a disclosure by declaring a new routine use after the fact.⁴

Whenever an agency discloses your records under most of these exceptions, it has to keep an accounting: the date, the purpose, and the name and address of the recipient. The accounting must be kept for at least five years or the life of the record, whichever is longer, and you can request a copy to see who has received your information and why. Two disclosure categories don’t have to be shown to you: internal agency use, and disclosures made for law enforcement purposes.¹

Computer Matching Programs

When agencies cross-reference personal records across different systems — comparing benefit rolls against earnings data, for instance — the Computer Matching and Privacy Protection Act adds a layer of protection. The key one for you: an agency cannot cut off your benefits, deny payment, or take other adverse action based solely on a computer match. Results must be independently verified first, and you must receive notice and a chance to contest the findings before any adverse action takes effect.⁵

Exemptions That Can Block Access

Not every records system is fully subject to the Act. Agencies can claim exemptions for certain categories of records by publishing formal rules in the Federal Register with a justification for each.

General exemptions under subsection (j) are the broadest and are available only to two kinds of systems: those maintained by the CIA, and those maintained by agencies whose principal function is criminal law enforcement, like the FBI and DEA. These systems can be exempted from most Privacy Act obligations if disclosure would compromise investigations, reveal confidential sources, or endanger individuals. Even so, several core provisions still apply: the prohibition on unauthorized disclosure, the basic accounting rules, the SORN publication requirement, and the criminal penalties in the statute.⁶

Specific exemptions under subsection (k) are narrower and cover categories like classified national security material, federal employment suitability investigations, and records held by regulatory enforcement agencies such as the SEC. These typically remove your right to access or amend the records but leave most other Privacy Act obligations in place.

Social Security Number Protections

Section 7 of the Privacy Act, which sits outside the codified text at 5 U.S.C. 552a, addresses one specific practice: government agencies pressuring people into disclosing their Social Security numbers. It’s unlawful for any federal, state, or local government agency to deny you a right, benefit, or privilege because you refused to provide your SSN, unless a federal statute specifically requires it or the agency was already collecting SSNs under a statute or regulation in effect before January 1, 1975.⁷

Whenever a government agency asks for your SSN, it has to tell you three things: whether providing it is mandatory or voluntary, which law or regulation authorizes the request, and how the number will be used. If a government form asks for your SSN without that disclosure, the agency is violating the law. You’ll usually see the notice printed in small type near the SSN field.⁸

How 5 U.S.C. 552a Works With FOIA

The Privacy Act and the Freedom of Information Act overlap in ways that confuse even experienced requesters. FOIA gives anyone, regardless of citizenship, the right to request federal agency records. The Privacy Act gives only citizens and lawful permanent residents the right to access records about themselves. When you’re requesting your own records, agencies process the request under both laws at the same time and give you whichever result is more favorable.⁹

The practical effect: an agency can only withhold your own records when both a Privacy Act exemption and a FOIA exemption apply to the same material. If only one law blocks disclosure but the other requires it, you get the records. That’s why most experienced requesters cite both statutes in any first-party request.

When someone else requests records about you, the Privacy Act’s consent requirement applies. The agency processes that third-party request under FOIA only and uses FOIA’s privacy exemptions to decide what to release. Your written consent can authorize the disclosure, but without it, the agency will withhold information that would be a clearly unwarranted invasion of your privacy under FOIA standards.⁹

Suing Under the Privacy Act

When an agency violates the Act and harms you, you can sue in federal district court. The statute lists four grounds: the agency refused to amend your record after you followed the appeals process; it refused to let you access your records; it failed to maintain accurate records and that failure led to an adverse decision about you; or it violated any other provision of the Act in a way that adversely affected you.¹⁰

If you prove the agency acted intentionally or willfully, the government must pay your actual damages, with a floor of $1,000 even if your provable losses are smaller, plus reasonable attorney fees and litigation costs. That $1,000 minimum makes smaller cases viable where they otherwise wouldn’t cover the cost of filing.¹

“Actual damages” means proven financial harm, not emotional distress. The Supreme Court settled this in FAA v. Cooper, holding that the Privacy Act does not waive the government’s sovereign immunity from claims for mental or emotional suffering. Only tangible economic losses, such as lost wages from an erroneous employment record or benefits denied based on inaccurate data, qualify. Punitive damages are not available.¹¹

You can file where you live, where you work, where the agency records are located, or in the District of Columbia. The statute of limitations is two years from when the violation occurs. One exception: if the agency willfully misrepresented information it was required to disclose, the two-year clock starts when you discover the misrepresentation rather than when it happened. Before filing, consider working through the agency’s internal complaint and review process first. Courts don’t always require it, but it builds a paper trail that strengthens your case if the agency stonewalls you.¹⁰

1
Office of the Law Revision Counsel. 5 USC 552a – Records Maintained on Individuals
2
U.S. Small Business Administration. Privacy Act Request Guide
3
eCFR. 28 CFR 16.49 – Fees
4
Office of the Law Revision Counsel. 5 USC 552a – Records Maintained on Individuals
5
eCFR. 13 CFR 102.40 – Computer Matching
6
Office of the Law Revision Counsel. 5 USC 552a – Records Maintained on Individuals
7
Defense Privacy, Civil Liberties, and Transparency Division. The Privacy Act of 1974 (As Amended)
8
U.S. Department of Justice. Disclosure of Social Security Numbers
9
U.S. Department of Justice. OIP Guidance: The Interface Between the FOIA and Privacy Act
10
Office of the Law Revision Counsel. 5 USC 552a – Records Maintained on Individuals
11
U.S. Reports. FAA v. Cooper, 566 U.S. 284 (2012)