The rights of individuals on whom Federal agencies collect and keep information (we will call them the "subject individuals) can be classified into the following eight categories:
- Prior Notice
- Statement of Disagreement
- Restricted Disclosure
- Accounting of Disclosures
When a potential subject individual is requested to furnish personal information to a federal agency, he or she has the right to be informed of the following: the federal agency's legal authority for requesting the information, the purpose for collecting it, the related uses that might be made of it, whether furnishing the information is mandatory or voluntary, and the consequences of refusing to furnish the information. This notice is often called the Privacy Act Notice. It may be found on the form on which the individual is asked to furnish the information, or on a separate form.
An individual has a right to be informed, in response to his or her request, whether a Federal agency maintains any record on him or her. If it does, the individual has a right to see the record and to have a copy made of it in a form that is understandable to him or her. However, agencies are permitted to publish special rules governing access to medical records. Usually, these rules permit an agency to furnish the records to the subject individual's personal physician rather than directly to the subject individual if it believes that direct disclosure could be harmful to the subject individual. In such cases, it is up to the individual's physician to review the medical records and discuss them with the individual.
An individual has a right to request amendment of his or her record if he or she believes it to be inaccurate or incomplete.
If the agency denies his or her amendment request, he or she has the right to appeal to the head of the agency or an officer assigned by the head of the agency.
Statement of Disagreement:
If the appeal is denied, the individual has the right to file a concise statement of disagreement, which the agency then is obliged to disclose each time it later discloses the information in dispute.
The subject individual has the right to bring a civil action in Federal Court against an agency if it denies him or her access to his or her record or if it denies his or her appeal to have his or her record amended. The individual can also sue the agency for failing to properly maintain his or her records, or otherwise comply with the provisions of the Privacy Act, in such a way as to have an adverse effect on him or her.
The individual has the right to expect that the agency will not disclose his or her records, without his or her consent, except according to the specific conditions permitted in the Privacy Act. There are 12 specific conditions of permitted disclosures. The most pertinent are the following:
- to the employees of the agency who have a need for the record in the performance of their duties;
- when required under the Freedom of Information Act;
- for a "routine use." A routine use is defined as a use for a purpose which is compatible with the purpose for which the record was collected. Routine use disclosures are mainly to other government agencies to enable them to fulfill their mission.
Disclosures are also permitted to the Bureau of the Census, the National Archives, the Comptroller General and either House of Congress, for certain specified purposes. Also, disclosures can be made if the record will be used for statistical purposes and will not be individually identified; for a law enforcement activity under certain restricted conditions; to a consumer credit bureau also under very specific and narrow conditions; and under compelling circumstances affecting the health or safety of the subject individual.
Accounting of Disclosures:
The subject individual has a right to receive an accounting of the disclosures that have been made of his records, with three exceptions: disclosures within the agency, disclosures required under the Freedom of Information Act, and disclosures made for lawful civil or criminal law enforcement activities under certain specified conditions. The accounting consists of the name and address of the person or organization to whom the record was disclosed, the date of the disclosure, and the identity of the record that was disclosed. Agencies must keep accounting records for at least 5 years or the life of the record that was disclosed, whichever is longer.