Which Law Regulates How Federal Agencies Collect Maintain Use and Disclose Personal Information: The Privacy Act of 1974 and Its System of Records

The Privacy Act of 1974, codified at 5 U.S.C. § 552a, is the primary statute governing how federal agencies collect, maintain, use, and disclose personal information. It applies to records the government keeps about individuals in systems of records retrievable by a personal identifier, such as a name or Social Security number. The Act imposes collection limits, publication duties, access and amendment rights, and disclosure restrictions, alongside a set of routine-use exceptions. Other laws layer on top for specific data types.

That direct answer is where most summaries stop. The mechanism matters more than the label. The Privacy Act is not a blanket ban on government data collection. It is a procedural and accountability statute that regulates the lifecycle of records after an agency decides to keep them. Understanding how it does that explains why it covers some databases and not others, and why “the Privacy Act” is rarely the whole story.

How the Privacy Act governs each stage of the record lifecycle

The statute regulates four activities: collection, maintenance, use, and disclosure. Each has its own rules, and they operate through agency obligations rather than individual consent.

Collection has two limits. Agencies must collect information “to the extent relevant and necessary” to accomplish a purpose required by statute or executive order (5 U.S.C. § 552a(e)(1)). When collecting directly from an individual, agencies must tell the person the authority for collection, whether disclosure is voluntary or mandatory, the principal uses, and the routine uses that may apply (§ 552a(e)(3)). There is no general consent requirement like the notice-and-choice model in commercial privacy law.

Maintenance imposes accuracy and security duties. Agencies must keep records “timely, accurate, relevant, and complete” for the purpose they were collected (§ 552a(e)(5)) and establish safeguards for security and confidentiality (§ 552a(e)(10)). The accuracy duty is the backbone of the access and amendment rights below.

Use is constrained by the purpose-limitation principle. A record collected for one purpose generally cannot be repurposed without either the subject’s written consent or a published routine use. That single rule is why agencies publish routine-use notices in the Federal Register: it is the legal machinery that lets information move between agencies for defined reasons.

Disclosure is governed by § 552a(b). No agency may disclose a record without prior written consent unless a specific exception applies. The major exceptions include disclosures to agency personnel with a need to know, disclosures required by the Freedom of Information Act, disclosures to Congress, and disclosures for a criminal or civil law enforcement activity. Each exception is narrow, and agencies must keep an accounting of certain disclosures under § 552a(c).

A plain-language way to hold it: the Privacy Act does not stop collection, but it forces agencies to justify, publish, and account for how records move.

What counts as a “system of records” and why the threshold decides coverage

Most Privacy Act duties attach only when information sits in a “system of records.” The statute defines this as a group of records under an agency’s control from which information is retrieved by an individual’s name or another personal identifier (§ 552a(a)(5)). That definition sounds technical, but it does real work.

If an agency holds a database keyed to names or identifiers, it is almost certainly a system of records. If an agency holds information that cannot be retrieved by a personal identifier, the stricter retrieval-based obligations may not apply. This retrieval threshold is the most litigated boundary in the statute.

Agencies must publish a System of Records Notice, or SORN, in the Federal Register before operating the system (§ 552a(e)(4)). The notice identifies the system, its purpose, the categories of individuals and records, the routine uses, and the retrieval practices. SORNs are the public face of federal recordkeeping and are a practical starting point for anyone trying to trace how a dataset is used. There is a matching duty to publish “routine use” notices and, for some systems, a Privacy Impact Assessment under the E-Government Act of 2002.

Here the numbers become useful. The statute was enacted in 1974 and took effect in 1975. It has been amended dozens of times, with the Computer Matching and Privacy Protection Act of 1988 adding matching-agreement requirements for computerized comparisons of records across systems. The Office of Management and Budget implements it through Circular A-130, which directs agencies to conduct privacy impact assessments and maintain inventories. The statute itself sets no dollar figure for violations; civil remedies under § 552a(g) include actual damages plus statutory minimums of USD 1,000 for willful or intentional violations.

Where the Privacy Act ends: the edge cases that decide real disputes

The most important edge case is the civil remedy. Courts have read § 552a(g)(1)(D) narrowly. To recover, a plaintiff generally must show an adverse effect from an agency’s failure to maintain accurate records, and the Supreme Court has required proof of actual damages flowing from that failure. In practice, many Privacy Act claims fail at the damages and causation stage rather than the liability stage. That is the counterintuitive detail most summaries omit: the statute that governs federal data handling is hard to enforce through private litigation.

The second edge case is the routine-use escape hatch. A routine use is any use compatible with the purpose for which the information was collected, and agencies publish them in advance. Broadly drafted routine uses can authorize transfers that surprise the record subject. The remedy is procedural notice, not individual consent.

The third edge case is the interaction with FOIA. The Privacy Act and the Freedom of Information Act are separate statutes with different exemptions and different requester rights. FOIA gives any person access to agency records subject to nine exemptions; the Privacy Act gives the record subject access and correction rights. Agencies apply both, and the interaction produces the Exemption 6 and Exemption 7(C) balancing tests for personal privacy in FOIA requests.

The fourth edge case is the matching and computer-matching regime. The 1988 amendments require written matching agreements, data integrity boards, and notice before agencies compare records across systems to verify eligibility. These procedural safeguards decide whether a cross-agency data match is lawful.

Common misconceptions about federal privacy law

The biggest misconception is that the Privacy Act is a comprehensive consumer privacy statute. It is not. It has no general consent right, no data-minimization mandate beyond relevance and necessity, and no private right of action independent of the accuracy and access provisions. It is a records-management and accountability law.

A second misconception is that the Privacy Act covers every federal database. It does not. Records not retrievable by a personal identifier fall outside the core system-of-records duties, and the statute expressly excludes certain categories, including records maintained by the Central Intelligence Agency and certain law enforcement records compiled for criminal investigations, subject to specific conditions.

A third misconception is that the Privacy Act is the only federal privacy law that matters to agencies. It is the general statute, but sector-specific laws override or supplement it. The Health Insurance Portability and Accountability Act governs health information held by covered entities. The Gramm-Leach-Bliley Act governs financial information. The Family Educational Rights and Privacy Act governs education records. The E-Government Act’s privacy assessment requirements apply to agency IT systems. For law enforcement, the Privacy Act works alongside the Wiretap Act and the Stored Communications Act.

A fourth misconception is that SORNs equal consent. A SORN is a public notice, not a permission slip. It tells you what uses are contemplated; it does not require your approval.

Do not assume a SORN grants consent: it discloses routine uses in advance. Do not assume all federal data is a “system of records”: retrieval by identifier is the trigger. Do not assume a Privacy Act violation yields damages: actual harm and causation are required. Do not assume one statute covers all federal data: sector laws impose separate duties. Do not assume access rights are unlimited: exemptions and law enforcement carve-outs apply.

Where the Privacy Act sits among federal privacy frameworks

Federal privacy law is layered, and knowing which statute applies requires matching the data type to the regime. The table below compares the main frameworks along the dimensions that matter for compliance.

Two thresholds need reconciling explicitly. The Privacy Act triggers on a system of records keyed to a personal identifier; the E-Government Act triggers on agency IT systems that collect, maintain, or disseminate personally identifiable information. A system can trigger both, which is why agencies publish SORNs and privacy impact assessments together. HIPAA triggers on covered entities, not federal agencies as such, though agencies that are covered entities face both regimes. Read the frameworks as cumulative, not alternative.

A timeline of how a federal record moves through the statute

The timeline shows why the statute is best understood as a process law. Each stage carries a documentation duty, and the documentation is what makes agency conduct reviewable.

Practical actions for tracing or challenging federal data handling

If you need to know which law governs a specific federal dataset, work through the following in order.

Identify the agency and the record system. Ask whether the information is retrieved by name or another personal identifier. If yes, a SORN likely exists. Search the Federal Register for the agency’s SORN. The notice states the purpose, categories of records, routine uses, and retrieval practices. This tells you the contemplated uses. Check for a Privacy Impact Assessment. If the system involves personally identifiable information, the E-Government Act requires one, and it often explains data flows the SORN summarizes. Match the data type to a sector statute. Health records implicate HIPAA; financial records implicate GLBA; education records implicate FERPA. These can add duties the Privacy Act does not impose. For access or correction, file a Privacy Act request under § 552a(d). Agencies must respond within the statutory timeframes, and denials are appealable. Keep the request specific to a system of records. For suspected unlawful disclosure, request the accounting of disclosures under § 552a(c). This record shows to whom and under which exception information was released. If litigation is contemplated, document concrete harm. The civil remedy requires an adverse effect tied to the violation, so contemporaneous records of the harm matter.

Threshold to watch: the retrieval test and the harm requirement are the two gates that most often decide whether the Privacy Act applies and whether it provides a remedy.

Limits of the statute and what it does not promise

The Privacy Act is a durable framework, but its limits are real and worth stating plainly. It does not create a general right to consent before collection. It does not guarantee deletion. It does not reach records outside systems of records. Its private remedy is narrow, and its exceptions are broad enough that agencies can move data across the government through published routine uses. The statute’s strength is transparency and procedural accountability, not comprehensive control.

For high-stakes questions about a specific agency action, a records dispute, or litigation strategy, this article is general educational information, not a legal opinion or a substitute for advice from a qualified attorney in your jurisdiction. It does not promise any outcome. If you face a legal deadline or an active dispute, consult a licensed local professional promptly.