From the U.S. Code Online via GPO Access
[www.gpoaccess.gov]
[Laws in effect as of January 3, 2007]
[CITE: 5USC552a]

 
             TITLE 5--GOVERNMENT ORGANIZATION AND EMPLOYEES
 
                     PART I--THE AGENCIES GENERALLY
 
                   CHAPTER 5--ADMINISTRATIVE PROCEDURE
 
                 SUBCHAPTER II--ADMINISTRATIVE PROCEDURE

 
Sec. 552a. Records maintained on individuals

    (a) Definitions.--For purposes of this section--
        (1) the term ``agency'' means agency as defined in section 
    552(e) \1\ of this title;
---------------------------------------------------------------------------
    \1\ See References in Text note below.
---------------------------------------------------------------------------
        (2) the term ``individual'' means a citizen of the United States 
    or an alien lawfully admitted for permanent residence;
        (3) the term ``maintain'' includes maintain, collect, use, or 
    disseminate;
        (4) the term ``record'' means any item, collection, or grouping 
    of information about an individual that is maintained by an agency, 
    including, but not limited to, his education, financial 
    transactions, medical history, and criminal or employment history 
    and that contains his name, or the identifying number, symbol, or 
    other identifying particular assigned to the individual, such as a 
    finger or voice print or a photograph;
        (5) the term ``system of records'' means a group of any records 
    under the control of any agency from which information is retrieved 
    by the name of the individual or by some identifying number, symbol, 
    or other identifying particular assigned to the individual;
        (6) the term ``statistical record'' means a record in a system 
    of records maintained for statistical research or reporting purposes 
    only and not used in whole or in part in making any determination 
    about an identifiable individual, except as provided by section 8 of 
    title 13;
        (7) the term ``routine use'' means, with respect to the 
    disclosure of a record, the use of such record for a purpose which 
    is compatible with the purpose for which it was collected;
        (8) the term ``matching program''--
            (A) means any computerized comparison of--
                (i) two or more automated systems of records or a system 
            of records with non-Federal records for the purpose of--
                    (I) establishing or verifying the eligibility of, or 
                continuing compliance with statutory and regulatory 
                requirements by, applicants for, recipients or 
                beneficiaries of, participants in, or providers of 
                services with respect to, cash or in-kind assistance or 
                payments under Federal benefit programs, or
                    (II) recouping payments or delinquent debts under 
                such Federal benefit programs, or

                (ii) two or more automated Federal personnel or payroll 
            systems of records or a system of Federal personnel or 
            payroll records with non-Federal records,

            (B) but does not include--
                (i) matches performed to produce aggregate statistical 
            data without any personal identifiers;
                (ii) matches performed to support any research or 
            statistical project, the specific data of which may not be 
            used to make decisions concerning the rights, benefits, or 
            privileges of specific individuals;
                (iii) matches performed, by an agency (or component 
            thereof) which performs as its principal function any 
            activity pertaining to the enforcement of criminal laws, 
            subsequent to the initiation of a specific criminal or civil 
            law enforcement investigation of a named person or persons 
            for the purpose of gathering evidence against such person or 
            persons;
                (iv) matches of tax information (I) pursuant to section 
            6103(d) of the Internal Revenue Code of 1986, (II) for 
            purposes of tax administration as defined in section 
            6103(b)(4) of such Code, (III) for the purpose of 
            intercepting a tax refund due an individual under authority 
            granted by section 404(e), 464, or 1137 of the Social 
            Security Act; or (IV) for the purpose of intercepting a tax 
            refund due an individual under any other tax refund 
            intercept program authorized by statute which has been 
            determined by the Director of the Office of Management and 
            Budget to contain verification, notice, and hearing 
            requirements that are substantially similar to the 
            procedures in section 1137 of the Social Security Act;
                (v) matches--
                    (I) using records predominantly relating to Federal 
                personnel, that are performed for routine administrative 
                purposes (subject to guidance provided by the Director 
                of the Office of Management and Budget pursuant to 
                subsection (v)); or
                    (II) conducted by an agency using only records from 
                systems of records maintained by that agency;

          if the purpose of the match is not to take any adverse 
            financial, personnel, disciplinary, or other adverse action 
            against Federal personnel;
                (vi) matches performed for foreign counterintelligence 
            purposes or to produce background checks for security 
            clearances of Federal personnel or Federal contractor 
            personnel;
                (vii) matches performed incident to a levy described in 
            section 6103(k)(8) of the Internal Revenue Code of 1986; or
                (viii) matches performed pursuant to section 202(x)(3) 
            or 1611(e)(1) of the Social Security Act (42 U.S.C. 
            402(x)(3), 1382(e)(1));

        (9) the term ``recipient agency'' means any agency, or 
    contractor thereof, receiving records contained in a system of 
    records from a source agency for use in a matching program;
        (10) the term ``non-Federal agency'' means any State or local 
    government, or agency thereof, which receives records contained in a 
    system of records from a source agency for use in a matching 
    program;
        (11) the term ``source agency'' means any agency which discloses 
    records contained in a system of records to be used in a matching 
    program, or any State or local government, or agency thereof, which 
    discloses records to be used in a matching program;
        (12) the term ``Federal benefit program'' means any program 
    administered or funded by the Federal Government, or by any agent or 
    State on behalf of the Federal Government, providing cash or in-kind 
    assistance in the form of payments, grants, loans, or loan 
    guarantees to individuals; and
        (13) the term ``Federal personnel'' means officers and employees 
    of the Government of the United States, members of the uniformed 
    services (including members of the Reserve Components), individuals 
    entitled to receive immediate or deferred retirement benefits under 
    any retirement program of the Government of the United States 
    (including survivor benefits).

    (b) Conditions of Disclosure.--No agency shall disclose any record 
which is contained in a system of records by any means of communication 
to any person, or to another agency, except pursuant to a written 
request by, or with the prior written consent of, the individual to whom 
the record pertains, unless disclosure of the record would be--
        (1) to those officers and employees of the agency which 
    maintains the record who have a need for the record in the 
    performance of their duties;
        (2) required under section 552 of this title;
        (3) for a routine use as defined in subsection (a)(7) of this 
    section and described under subsection (e)(4)(D) of this section;
        (4) to the Bureau of the Census for purposes of planning or 
    carrying out a census or survey or related activity pursuant to the 
    provisions of title 13;
        (5) to a recipient who has provided the agency with advance 
    adequate written assurance that the record will be used solely as a 
    statistical research or reporting record, and the record is to be 
    transferred in a form that is not individually identifiable;
        (6) to the National Archives and Records Administration as a 
    record which has sufficient historical or other value to warrant its 
    continued preservation by the United States Government, or for 
    evaluation by the Archivist of the United States or the designee of 
    the Archivist to determine whether the record has such value;
        (7) to another agency or to an instrumentality of any 
    governmental jurisdiction within or under the control of the United 
    States for a civil or criminal law enforcement activity if the 
    activity is authorized by law, and if the head of the agency or 
    instrumentality has made a written request to the agency which 
    maintains the record specifying the particular portion desired and 
    the law enforcement activity for which the record is sought;
        (8) to a person pursuant to a showing of compelling 
    circumstances affecting the health or safety of an individual if 
    upon such disclosure notification is transmitted to the last known 
    address of such individual;
        (9) to either House of Congress, or, to the extent of matter 
    within its jurisdiction, any committee or subcommittee thereof, any 
    joint committee of Congress or subcommittee of any such joint 
    committee;
        (10) to the Comptroller General, or any of his authorized 
    representatives, in the course of the performance of the duties of 
    the Government Accountability Office;
        (11) pursuant to the order of a court of competent jurisdiction; 
    or
        (12) to a consumer reporting agency in accordance with section 
    3711(e) of title 31.

    (c) Accounting of Certain Disclosures.--Each agency, with respect to 
each system of records under its control, shall--
        (1) except for disclosures made under subsections (b)(1) or 
    (b)(2) of this section, keep an accurate accounting of--
            (A) the date, nature, and purpose of each disclosure of a 
        record to any person or to another agency made under subsection 
        (b) of this section; and
            (B) the name and address of the person or agency to whom the 
        disclosure is made;

        (2) retain the accounting made under paragraph (1) of this 
    subsection for at least five years or the life of the record, 
    whichever is longer, after the disclosure for which the accounting 
    is made;
        (3) except for disclosures made under subsection (b)(7) of this 
    section, make the accounting made under paragraph (1) of this 
    subsection available to the individual named in the record at his 
    request; and
        (4) inform any person or other agency about any correction or 
    notation of dispute made by the agency in accordance with subsection 
    (d) of this section of any record that has been disclosed to the 
    person or agency if an accounting of the disclosure was made.

    (d) Access to Records.--Each agency that maintains a system of 
records shall--
        (1) upon request by any individual to gain access to his record 
    or to any information pertaining to him which is contained in the 
    system, permit him and upon his request, a person of his own 
    choosing to accompany him, to review the record and have a copy made 
    of all or any portion thereof in a form comprehensible to him, 
    except that the agency may require the individual to furnish a 
    written statement authorizing discussion of that individual's record 
    in the accompanying person's presence;
        (2) permit the individual to request amendment of a record 
    pertaining to him and--
            (A) not later than 10 days (excluding Saturdays, Sundays, 
        and legal public holidays) after the date of receipt of such 
        request, acknowledge in writing such receipt; and
            (B) promptly, either--
                (i) make any correction of any portion thereof which the 
            individual believes is not accurate, relevant, timely, or 
            complete; or
                (ii) inform the individual of its refusal to amend the 
            record in accordance with his request, the reason for the 
            refusal, the procedures established by the agency for the 
            individual to request a review of that refusal by the head 
            of the agency or an officer designated by the head of the 
            agency, and the name and business address of that official;

        (3) permit the individual who disagrees with the refusal of the 
    agency to amend his record to request a review of such refusal, and 
    not later than 30 days (excluding Saturdays, Sundays, and legal 
    public holidays) from the date on which the individual requests such 
    review, complete such review and make a final determination unless, 
    for good cause shown, the head of the agency extends such 30-day 
    period; and if, after his review, the reviewing official also 
    refuses to amend the record in accordance with the request, permit 
    the individual to file with the agency a concise statement setting 
    forth the reasons for his disagreement with the refusal of the 
    agency, and notify the individual of the provisions for judicial 
    review of the reviewing official's determination under subsection 
    (g)(1)(A) of this section;
        (4) in any disclosure, containing information about which the 
    individual has filed a statement of disagreement, occurring after 
    the filing of the statement under paragraph (3) of this subsection, 
    clearly note any portion of the record which is disputed and provide 
    copies of the statement and, if the agency deems it appropriate, 
    copies of a concise statement of the reasons of the agency for not 
    making the amendments requested, to persons or other agencies to 
    whom the disputed record has been disclosed; and
        (5) nothing in this section shall allow an individual access to 
    any information compiled in reasonable anticipation of a civil 
    action or proceeding.

    (e) Agency Requirements.--Each agency that maintains a system of 
records shall--
        (1) maintain in its records only such information about an 
    individual as is relevant and necessary to accomplish a purpose of 
    the agency required to be accomplished by statute or by executive 
    order of the President;
        (2) collect information to the greatest extent practicable 
    directly from the subject individual when the information may result 
    in adverse determinations about an individual's rights, benefits, 
    and privileges under Federal programs;
        (3) inform each individual whom it asks to supply information, 
    on the form which it uses to collect the information or on a 
    separate form that can be retained by the individual--
            (A) the authority (whether granted by statute, or by 
        executive order of the President) which authorizes the 
        solicitation of the information and whether disclosure of such 
        information is mandatory or voluntary;
            (B) the principal purpose or purposes for which the 
        information is intended to be used;
            (C) the routine uses which may be made of the information, 
        as published pursuant to paragraph (4)(D) of this subsection; 
        and
            (D) the effects on him, if any, of not providing all or any 
        part of the requested information;

        (4) subject to the provisions of paragraph (11) of this 
    subsection, publish in the Federal Register upon establishment or 
    revision a notice of the existence and character of the system of 
    records, which notice shall include--
            (A) the name and location of the system;
            (B) the categories of individuals on whom records are 
        maintained in the system;
            (C) the categories of records maintained in the system;
            (D) each routine use of the records contained in the system, 
        including the categories of users and the purpose of such use;
            (E) the policies and practices of the agency regarding 
        storage, retrievability, access controls, retention, and 
        disposal of the records;
            (F) the title and business address of the agency official 
        who is responsible for the system of records;
            (G) the agency procedures whereby an individual can be 
        notified at his request if the system of records contains a 
        record pertaining to him;
            (H) the agency procedures whereby an individual can be 
        notified at his request how he can gain access to any record 
        pertaining to him contained in the system of records, and how he 
        can contest its content; and
            (I) the categories of sources of records in the system;

        (5) maintain all records which are used by the agency in making 
    any determination about any individual with such accuracy, 
    relevance, timeliness, and completeness as is reasonably necessary 
    to assure fairness to the individual in the determination;
        (6) prior to disseminating any record about an individual to any 
    person other than an agency, unless the dissemination is made 
    pursuant to subsection (b)(2) of this section, make reasonable 
    efforts to assure that such records are accurate, complete, timely, 
    and relevant for agency purposes;
        (7) maintain no record describing how any individual exercises 
    rights guaranteed by the First Amendment unless expressly authorized 
    by statute or by the individual about whom the record is maintained 
    or unless pertinent to and within the scope of an authorized law 
    enforcement activity;
        (8) make reasonable efforts to serve notice on an individual 
    when any record on such individual is made available to any person 
    under compulsory legal process when such process becomes a matter of 
    public record;
        (9) establish rules of conduct for persons involved in the 
    design, development, operation, or maintenance of any system of 
    records, or in maintaining any record, and instruct each such person 
    with respect to such rules and the requirements of this section, 
    including any other rules and procedures adopted pursuant to this 
    section and the penalties for noncompliance;
        (10) establish appropriate administrative, technical, and 
    physical safeguards to insure the security and confidentiality of 
    records and to protect against any anticipated threats or hazards to 
    their security or integrity which could result in substantial harm, 
    embarrassment, inconvenience, or unfairness to any individual on 
    whom information is maintained;
        (11) at least 30 days prior to publication of information under 
    paragraph (4)(D) of this subsection, publish in the Federal Register 
    notice of any new use or intended use of the information in the 
    system, and provide an opportunity for interested persons to submit 
    written data, views, or arguments to the agency; and
        (12) if such agency is a recipient agency or a source agency in 
    a matching program with a non-Federal agency, with respect to any 
    establishment or revision of a matching program, at least 30 days 
    prior to conducting such program, publish in the Federal Register 
    notice of such establishment or revision.

    (f) Agency Rules.--In order to carry out the provisions of this 
section, each agency that maintains a system of records shall promulgate 
rules, in accordance with the requirements (including general notice) of 
section 553 of this title, which shall--
        (1) establish procedures whereby an individual can be notified 
    in response to his request if any system of records named by the 
    individual contains a record pertaining to him;
        (2) define reasonable times, places, and requirements for 
    identifying an individual who requests his record or information 
    pertaining to him before the agency shall make the record or 
    information available to the individual;
        (3) establish procedures for the disclosure to an individual 
    upon his request of his record or information pertaining to him, 
    including special procedure, if deemed necessary, for the disclosure 
    to an individual of medical records, including psychological 
    records, pertaining to him;
        (4) establish procedures for reviewing a request from an 
    individual concerning the amendment of any record or information 
    pertaining to the individual, for making a determination on the 
    request, for an appeal within the agency of an initial adverse 
    agency determination, and for whatever additional means may be 
    necessary for each individual to be able to exercise fully his 
    rights under this section; and
        (5) establish fees to be charged, if any, to any individual for 
    making copies of his record, excluding the cost of any search for 
    and review of the record.

The Office of the Federal Register shall biennially compile and publish 
the rules promulgated under this subsection and agency notices published 
under subsection (e)(4) of this section in a form available to the 
public at low cost.
    (g)(1) Civil Remedies.--Whenever any agency
        (A) makes a determination under subsection (d)(3) of this 
    section not to amend an individual's record in accordance with his 
    request, or fails to make such review in conformity with that 
    subsection;
        (B) refuses to comply with an individual request under 
    subsection (d)(1) of this section;
        (C) fails to maintain any record concerning any individual with 
    such accuracy, relevance, timeliness, and completeness as is 
    necessary to assure fairness in any determination relating to the 
    qualifications, character, rights, or opportunities of, or benefits 
    to the individual that may be made on the basis of such record, and 
    consequently a determination is made which is adverse to the 
    individual; or
        (D) fails to comply with any other provision of this section, or 
    any rule promulgated thereunder, in such a way as to have an adverse 
    effect on an individual,

the individual may bring a civil action against the agency, and the 
district courts of the United States shall have jurisdiction in the 
matters under the provisions of this subsection.
    (2)(A) In any suit brought under the provisions of subsection 
(g)(1)(A) of this section, the court may order the agency to amend the 
individual's record in accordance with his request or in such other way 
as the court may direct. In such a case the court shall determine the 
matter de novo.
    (B) The court may assess against the United States reasonable 
attorney fees and other litigation costs reasonably incurred in any case 
under this paragraph in which the complainant has substantially 
prevailed.
    (3)(A) In any suit brought under the provisions of subsection 
(g)(1)(B) of this section, the court may enjoin the agency from 
withholding the records and order the production to the complainant of 
any agency records improperly withheld from him. In such a case the 
court shall determine the matter de novo, and may examine the contents 
of any agency records in camera to determine whether the records or any 
portion thereof may be withheld under any of the exemptions set forth in 
subsection (k) of this section, and the burden is on the agency to 
sustain its action.
    (B) The court may assess against the United States reasonable 
attorney fees and other litigation costs reasonably incurred in any case 
under this paragraph in which the complainant has substantially 
prevailed.
    (4) In any suit brought under the provisions of subsection (g)(1)(C) 
or (D) of this section in which the court determines that the agency 
acted in a manner which was intentional or willful, the United States 
shall be liable to the individual in an amount equal to the sum of--
        (A) actual damages sustained by the individual as a result of 
    the refusal or failure, but in no case shall a person entitled to 
    recovery receive less than the sum of $1,000; and
        (B) the costs of the action together with reasonable attorney 
    fees as determined by the court.

    (5) An action to enforce any liability created under this section 
may be brought in the district court of the United States in the 
district in which the complainant resides, or has his principal place of 
business, or in which the agency records are situated, or in the 
District of Columbia, without regard to the amount in controversy, 
within two years from the date on which the cause of action arises, 
except that where an agency has materially and willfully misrepresented 
any information required under this section to be disclosed to an 
individual and the information so misrepresented is material to 
establishment of the liability of the agency to the individual under 
this section, the action may be brought at any time within two years 
after discovery by the individual of the misrepresentation. Nothing in 
this section shall be construed to authorize any civil action by reason 
of any injury sustained as the result of a disclosure of a record prior 
to September 27, 1975.
    (h) Rights of Legal Guardians.--For the purposes of this section, 
the parent of any minor, or the legal guardian of any individual who has 
been declared to be incompetent due to physical or mental incapacity or 
age by a court of competent jurisdiction, may act on behalf of the 
individual.
    (i)(1) Criminal Penalties.--Any officer or employee of an agency, 
who by virtue of his employment or official position, has possession of, 
or access to, agency records which contain individually identifiable 
information the disclosure of which is prohibited by this section or by 
rules or regulations established thereunder, and who knowing that 
disclosure of the specific material is so prohibited, willfully 
discloses the material in any manner to any person or agency not 
entitled to receive it, shall be guilty of a misdemeanor and fined not 
more than $5,000.
    (2) Any officer or employee of any agency who willfully maintains a 
system of records without meeting the notice requirements of subsection 
(e)(4) of this section shall be guilty of a misdemeanor and fined not 
more than $5,000.
    (3) Any person who knowingly and willfully requests or obtains any 
record concerning an individual from an agency under false pretenses 
shall be guilty of a misdemeanor and fined not more than $5,000.
    (j) General Exemptions.--The head of any agency may promulgate 
rules, in accordance with the requirements (including general notice) of 
sections 553(b)(1), (2), and (3), (c), and (e) of this title, to exempt 
any system of records within the agency from any part of this section 
except subsections (b), (c)(1) and (2), (e)(4)(A) through (F), (e)(6), 
(7), (9), (10), and (11), and (i) if the system of records is--
        (1) maintained by the Central Intelligence Agency; or
        (2) maintained by an agency or component thereof which performs 
    as its principal function any activity pertaining to the enforcement 
    of criminal laws, including police efforts to prevent, control, or 
    reduce crime or to apprehend criminals, and the activities of 
    prosecutors, courts, correctional, probation, pardon, or parole 
    authorities, and which consists of (A) information compiled for the 
    purpose of identifying individual criminal offenders and alleged 
    offenders and consisting only of identifying data and notations of 
    arrests, the nature and disposition of criminal charges, sentencing, 
    confinement, release, and parole and probation status; (B) 
    information compiled for the purpose of a criminal investigation, 
    including reports of informants and investigators, and associated 
    with an identifiable individual; or (C) reports identifiable to an 
    individual compiled at any stage of the process of enforcement of 
    the criminal laws from arrest or indictment through release from 
    supervision.

At the time rules are adopted under this subsection, the agency shall 
include in the statement required under section 553(c) of this title, 
the reasons why the system of records is to be exempted from a provision 
of this section.
    (k) Specific Exemptions.--The head of any agency may promulgate 
rules, in accordance with the requirements (including general notice) of 
sections 553(b)(1), (2), and (3), (c), and (e) of this title, to exempt 
any system of records within the agency from subsections (c)(3), (d), 
(e)(1), (e)(4)(G), (H), and (I) and (f) of this section if the system of 
records is--
        (1) subject to the provisions of section 552(b)(1) of this 
    title;
        (2) investigatory material compiled for law enforcement 
    purposes, other than material within the scope of subsection (j)(2) 
    of this section: Provided, however, That if any individual is denied 
    any right, privilege, or benefit that he would otherwise be entitled 
    by Federal law, or for which he would otherwise be eligible, as a 
    result of the maintenance of such material, such material shall be 
    provided to such individual, except to the extent that the 
    disclosure of such material would reveal the identity of a source 
    who furnished information to the Government under an express promise 
    that the identity of the source would be held in confidence, or, 
    prior to the effective date of this section, under an implied 
    promise that the identity of the source would be held in confidence;
        (3) maintained in connection with providing protective services 
    to the President of the United States or other individuals pursuant 
    to section 3056 of title 18;
        (4) required by statute to be maintained and used solely as 
    statistical records;
        (5) investigatory material compiled solely for the purpose of 
    determining suitability, eligibility, or qualifications for Federal 
    civilian employment, military service, Federal contracts, or access 
    to classified information, but only to the extent that the 
    disclosure of such material would reveal the identity of a source 
    who furnished information to the Government under an express promise 
    that the identity of the source would be held in confidence, or, 
    prior to the effective date of this section, under an implied 
    promise that the identity of the source would be held in confidence;
        (6) testing or examination material used solely to determine 
    individual qualifications for appointment or promotion in the 
    Federal service the disclosure of which would compromise the 
    objectivity or fairness of the testing or examination process; or
        (7) evaluation material used to determine potential for 
    promotion in the armed services, but only to the extent that the 
    disclosure of such material would reveal the identity of a source 
    who furnished information to the Government under an express promise 
    that the identity of the source would be held in confidence, or, 
    prior to the effective date of this section, under an implied 
    promise that the identity of the source would be held in confidence.

At the time rules are adopted under this subsection, the agency shall 
include in the statement required under section 553(c) of this title, 
the reasons why the system of records is to be exempted from a provision 
of this section.
    (l)(1) Archival Records.--Each agency record which is accepted by 
the Archivist of the United States for storage, processing, and 
servicing in accordance with section 3103 of title 44 shall, for the 
purposes of this section, be considered to be maintained by the agency 
which deposited the record and shall be subject to the provisions of 
this section. The Archivist of the United States shall not disclose the 
record except to the agency which maintains the record, or under rules 
established by that agency which are not inconsistent with the 
provisions of this section.
    (2) Each agency record pertaining to an identifiable individual 
which was transferred to the National Archives of the United States as a 
record which has sufficient historical or other value to warrant its 
continued preservation by the United States Government, prior to the 
effective date of this section, shall, for the purposes of this section, 
be considered to be maintained by the National Archives and shall not be 
subject to the provisions of this section, except that a statement 
generally describing such records (modeled after the requirements 
relating to records subject to subsections (e)(4)(A) through (G) of this 
section) shall be published in the Federal Register.
    (3) Each agency record pertaining to an identifiable individual 
which is transferred to the National Archives of the United States as a 
record which has sufficient historical or other value to warrant its 
continued preservation by the United States Government, on or after the 
effective date of this section, shall, for the purposes of this section, 
be considered to be maintained by the National Archives and shall be 
exempt from the requirements of this section except subsections 
(e)(4)(A) through (G) and (e)(9) of this section.
    (m)(1) Government Contractors.--When an agency provides by a 
contract for the operation by or on behalf of the agency of a system of 
records to accomplish an agency function, the agency shall, consistent 
with its authority, cause the requirements of this section to be applied 
to such system. For purposes of subsection (i) of this section any such 
contractor and any employee of such contractor, if such contract is 
agreed to on or after the effective date of this section, shall be 
considered to be an employee of an agency.
    (2) A consumer reporting agency to which a record is disclosed under 
section 3711(e) of title 31 shall not be considered a contractor for the 
purposes of this section.
    (n) Mailing Lists.--An individual's name and address may not be sold 
or rented by an agency unless such action is specifically authorized by 
law. This provision shall not be construed to require the withholding of 
names and addresses otherwise permitted to be made public.
    (o) Matching Agreements.--(1) No record which is contained in a 
system of records may be disclosed to a recipient agency or non-Federal 
agency for use in a computer matching program except pursuant to a 
written agreement between the source agency and the recipient agency or 
non-Federal agency specifying--
        (A) the purpose and legal authority for conducting the program;
        (B) the justification for the program and the anticipated 
    results, including a specific estimate of any savings;
        (C) a description of the records that will be matched, including 
    each data element that will be used, the approximate number of 
    records that will be matched, and the projected starting and 
    completion dates of the matching program;
        (D) procedures for providing individualized notice at the time 
    of application, and notice periodically thereafter as directed by 
    the Data Integrity Board of such agency (subject to guidance 
    provided by the Director of the Office of Management and Budget 
    pursuant to subsection (v)), to--
            (i) applicants for and recipients of financial assistance or 
        payments under Federal benefit programs, and
            (ii) applicants for and holders of positions as Federal 
        personnel,

    that any information provided by such applicants, recipients, 
    holders, and individuals may be subject to verification through 
    matching programs;
        (E) procedures for verifying information produced in such 
    matching program as required by subsection (p);
        (F) procedures for the retention and timely destruction of 
    identifiable records created by a recipient agency or non-Federal 
    agency in such matching program;
        (G) procedures for ensuring the administrative, technical, and 
    physical security of the records matched and the results of such 
    programs;
        (H) prohibitions on duplication and redisclosure of records 
    provided by the source agency within or outside the recipient agency 
    or the non-Federal agency, except where required by law or essential 
    to the conduct of the matching program;
        (I) procedures governing the use by a recipient agency or non-
    Federal agency of records provided in a matching program by a source 
    agency, including procedures governing return of the records to the 
    source agency or destruction of records used in such program;
        (J) information on assessments that have been made on the 
    accuracy of the records that will be used in such matching program; 
    and
        (K) that the Comptroller General may have access to all records 
    of a recipient agency or a non-Federal agency that the Comptroller 
    General deems necessary in order to monitor or verify compliance 
    with the agreement.

    (2)(A) A copy of each agreement entered into pursuant to paragraph 
(1) shall--
        (i) be transmitted to the Committee on Governmental Affairs of 
    the Senate and the Committee on Government Operations of the House 
    of Representatives; and
        (ii) be available upon request to the public.

    (B) No such agreement shall be effective until 30 days after the 
date on which such a copy is transmitted pursuant to subparagraph 
(A)(i).
    (C) Such an agreement shall remain in effect only for such period, 
not to exceed 18 months, as the Data Integrity Board of the agency 
determines is appropriate in light of the purposes, and length of time 
necessary for the conduct, of the matching program.
    (D) Within 3 months prior to the expiration of such an agreement 
pursuant to subparagraph (C), the Data Integrity Board of the agency 
may, without additional review, renew the matching agreement for a 
current, ongoing matching program for not more than one additional year 
if--
        (i) such program will be conducted without any change; and
        (ii) each party to the agreement certifies to the Board in 
    writing that the program has been conducted in compliance with the 
    agreement.

    (p) Verification and Opportunity to Contest Findings.--(1) In order 
to protect any individual whose records are used in a matching program, 
no recipient agency, non-Federal agency, or source agency may suspend, 
terminate, reduce, or make a final denial of any financial assistance or 
payment under a Federal benefit program to such individual, or take 
other adverse action against such individual, as a result of information 
produced by such matching program, until--
        (A)(i) the agency has independently verified the information; or
        (ii) the Data Integrity Board of the agency, or in the case of a 
    non-Federal agency the Data Integrity Board of the source agency, 
    determines in accordance with guidance issued by the Director of the 
    Office of Management and Budget that--
            (I) the information is limited to identification and amount 
        of benefits paid by the source agency under a Federal benefit 
        program; and
            (II) there is a high degree of confidence that the 
        information provided to the recipient agency is accurate;

        (B) the individual receives a notice from the agency containing 
    a statement of its findings and informing the individual of the 
    opportunity to contest such findings; and
        (C)(i) the expiration of any time period established for the 
    program by statute or regulation for the individual to respond to 
    that notice; or
        (ii) in the case of a program for which no such period is 
    established, the end of the 30-day period beginning on the date on 
    which notice under subparagraph (B) is mailed or otherwise provided 
    to the individual.

    (2) Independent verification referred to in paragraph (1) requires 
investigation and confirmation of specific information relating to an 
individual that is used as a basis for an adverse action against the 
individual, including where applicable investigation and confirmation 
of--
        (A) the amount of any asset or income involved;
        (B) whether such individual actually has or had access to such 
    asset or income for such individual's own use; and
        (C) the period or periods when the individual actually had such 
    asset or income.

    (3) Notwithstanding paragraph (1), an agency may take any 
appropriate action otherwise prohibited by such paragraph if the agency 
determines that the public health or public safety may be adversely 
affected or significantly threatened during any notice period required 
by such paragraph.
    (q) Sanctions.--(1) Notwithstanding any other provision of law, no 
source agency may disclose any record which is contained in a system of 
records to a recipient agency or non-Federal agency for a matching 
program if such source agency has reason to believe that the 
requirements of subsection (p), or any matching agreement entered into 
pursuant to subsection (o), or both, are not being met by such recipient 
agency.
    (2) No source agency may renew a matching agreement unless--
        (A) the recipient agency or non-Federal agency has certified 
    that it has complied with the provisions of that agreement; and
        (B) the source agency has no reason to believe that the 
    certification is inaccurate.

    (r) Report on New Systems and Matching Programs.--Each agency that 
proposes to establish or make a significant change in a system of 
records or a matching program shall provide adequate advance notice of 
any such proposal (in duplicate) to the Committee on Government 
Operations of the House of Representatives, the Committee on 
Governmental Affairs of the Senate, and the Office of Management and 
Budget in order to permit an evaluation of the probable or potential 
effect of such proposal on the privacy or other rights of individuals.
    (s) Biennial Report.--The President shall biennially submit to the 
Speaker of the House of Representatives and the President pro tempore of 
the Senate a report--
        (1) describing the actions of the Director of the Office of 
    Management and Budget pursuant to section 6 of the Privacy Act of 
    1974 during the preceding 2 years;
        (2) describing the exercise of individual rights of access and 
    amendment under this section during such years;
        (3) identifying changes in or additions to systems of records;
        (4) containing such other information concerning administration 
    of this section as may be necessary or useful to the Congress in 
    reviewing the effectiveness of this section in carrying out the 
    purposes of the Privacy Act of 1974.

    (t)(1) Effect of Other Laws.--No agency shall rely on any exemption 
contained in section 552 of this title to withhold from an individual 
any record which is otherwise accessible to such individual under the 
provisions of this section.
    (2) No agency shall rely on any exemption in this section to 
withhold from an individual any record which is otherwise accessible to 
such individual under the provisions of section 552 of this title.
    (u) Data Integrity Boards.--(1) Every agency conducting or 
participating in a matching program shall establish a Data Integrity 
Board to oversee and coordinate among the various components of such 
agency the agency's implementation of this section.
    (2) Each Data Integrity Board shall consist of senior officials 
designated by the head of the agency, and shall include any senior 
official designated by the head of the agency as responsible for 
implementation of this section, and the inspector general of the agency, 
if any. The inspector general shall not serve as chairman of the Data 
Integrity Board.
    (3) Each Data Integrity Board--
        (A) shall review, approve, and maintain all written agreements 
    for receipt or disclosure of agency records for matching programs to 
    ensure compliance with subsection (o), and all relevant statutes, 
    regulations, and guidelines;
        (B) shall review all matching programs in which the agency has 
    participated during the year, either as a source agency or recipient 
    agency, determine compliance with applicable laws, regulations, 
    guidelines, and agency agreements, and assess the costs and benefits 
    of such programs;
        (C) shall review all recurring matching programs in which the 
    agency has participated during the year, either as a source agency 
    or recipient agency, for continued justification for such 
    disclosures;
        (D) shall compile an annual report, which shall be submitted to 
    the head of the agency and the Office of Management and Budget and 
    made available to the public on request, describing the matching 
    activities of the agency, including--
            (i) matching programs in which the agency has participated 
        as a source agency or recipient agency;
            (ii) matching agreements proposed under subsection (o) that 
        were disapproved by the Board;
            (iii) any changes in membership or structure of the Board in 
        the preceding year;
            (iv) the reasons for any waiver of the requirement in 
        paragraph (4) of this section for completion and submission of a 
        cost-benefit analysis prior to the approval of a matching 
        program;
            (v) any violations of matching agreements that have been 
        alleged or identified and any corrective action taken; and
            (vi) any other information required by the Director of the 
        Office of Management and Budget to be included in such report;

        (E) shall serve as a clearinghouse for receiving and providing 
    information on the accuracy, completeness, and reliability of 
    records used in matching programs;
        (F) shall provide interpretation and guidance to agency 
    components and personnel on the requirements of this section for 
    matching programs;
        (G) shall review agency recordkeeping and disposal policies and 
    practices for matching programs to assure compliance with this 
    section; and
        (H) may review and report on any agency matching activities that 
    are not matching programs.

    (4)(A) Except as provided in subparagraphs (B) and (C), a Data 
Integrity Board shall not approve any written agreement for a matching 
program unless the agency has completed and submitted to such Board a 
cost-benefit analysis of the proposed program and such analysis 
demonstrates that the program is likely to be cost effective.\2\
---------------------------------------------------------------------------
    \2\ So in original. Probably should be ``cost-effective.''
---------------------------------------------------------------------------
    (B) The Board may waive the requirements of subparagraph (A) of this 
paragraph if it determines in writing, in accordance with guidelines 
prescribed by the Director of the Office of Management and Budget, that 
a cost-benefit analysis is not required.
    (C) A cost-benefit analysis shall not be required under subparagraph 
(A) prior to the initial approval of a written agreement for a matching 
program that is specifically required by statute. Any subsequent written 
agreement for such a program shall not be approved by the Data Integrity 
Board unless the agency has submitted a cost-benefit analysis of the 
program as conducted under the preceding approval of such agreement.
    (5)(A) If a matching agreement is disapproved by a Data Integrity 
Board, any party to such agreement may appeal the disapproval to the 
Director of the Office of Management and Budget. Timely notice of the 
filing of such an appeal shall be provided by the Director of the Office 
of Management and Budget to the Committee on Governmental Affairs of the 
Senate and the Committee on Government Operations of the House of 
Representatives.
    (B) The Director of the Office of Management and Budget may approve 
a matching agreement notwithstanding the disapproval of a Data Integrity 
Board if the Director determines that--
        (i) the matching program will be consistent with all applicable 
    legal, regulatory, and policy requirements;
        (ii) there is adequate evidence that the matching agreement will 
    be cost-effective; and
        (iii) the matching program is in the public interest.

    (C) The decision of the Director to approve a matching agreement 
shall not take effect until 30 days after it is reported to committees 
described in subparagraph (A).
    (D) If the Data Integrity Board and the Director of the Office of 
Management and Budget disapprove a matching program proposed by the 
inspector general of an agency, the inspector general may report the 
disapproval to the head of the agency and to the Congress.
    (6) In the reports required by paragraph (3)(D), agency matching 
activities that are not matching programs may be reported on an 
aggregate basis, if and to the extent necessary to protect ongoing law 
enforcement or counterintelligence investigations.
    (v) Office of Management and Budget Responsibilities.--The Director 
of the Office of Management and Budget shall--
        (1) develop and, after notice and opportunity for public 
    comment, prescribe guidelines and regulations for the use of 
    agencies in implementing the provisions of this section; and
        (2) provide continuing assistance to and oversight of the 
    implementation of this section by agencies.

(Added Pub. L. 93-579, Sec. 3, Dec. 31, 1974, 88 Stat. 1897; amended 
Pub. L. 94-183, Sec. 2(2), Dec. 31, 1975, 89 Stat. 1057; Pub. L. 97-365, 
Sec. 2, Oct. 25, 1982, 96 Stat. 1749; Pub. L. 97-375, title II, 
Sec. 201(a), (b), Dec. 21, 1982, 96 Stat. 1821; Pub. L. 97-452, 
Sec. 2(a)(1), Jan. 12, 1983, 96 Stat. 2478; Pub. L. 98-477, Sec. 2(c), 
Oct. 15, 1984, 98 Stat. 2211; Pub. L. 98-497, title I, Sec. 107(g), Oct. 
19, 1984, 98 Stat. 2292; Pub. L. 100-503, Secs. 2-6(a), 7, 8, Oct. 18, 
1988, 102 Stat. 2507-2514; Pub. L. 101-508, title VII, Sec. 7201(b)(1), 
Nov. 5, 1990, 104 Stat. 1388-334; Pub. L. 103-66, title XIII, 
Sec. 13581(c), Aug. 10, 1993, 107 Stat. 611; Pub. L. 104-193, title I, 
Sec. 110(w), Aug. 22, 1996, 110 Stat. 2175; Pub. L. 104-226, 
Sec. 1(b)(3), Oct. 2, 1996, 110 Stat. 3033; Pub. L. 104-316, title I, 
Sec. 115(g)(2)(B), Oct. 19, 1996, 110 Stat. 3835; Pub. L. 105-34, title 
X, Sec. 1026(b)(2), Aug. 5, 1997, 111 Stat. 925; Pub. L. 105-362, title 
XIII, Sec. 1301(d), Nov. 10, 1998, 112 Stat. 3293; Pub. L. 106-170, 
title IV, Sec. 402(a)(2), Dec. 17, 1999, 113 Stat. 1908; Pub. L. 108-
271, Sec. 8(b), July 7, 2004, 118 Stat. 814.)

                       References in Text

    Section 552(e) of this title, referred to in subsec. (a)(1), was 
redesignated section 552(f) of this title by section 1802(b) of Pub. L. 
99-570.
    Section 6103 of the Internal Revenue Code of 1986, referred to in 
subsec. (a)(8)(B)(iv), (vii), is classified to section 6103 of Title 26, 
Internal Revenue Code.
    Sections 404, 464, and 1137 of the Social Security Act, referred to 
in subsec. (a)(8)(B)(iv), are classified to sections 604, 664, and 
1320b-7, respectively, of Title 42, The Public Health and Welfare.
    For effective date of this section, referred to in subsecs. (k)(2), 
(5), (7), (l)(2), (3), and (m), see Effective Date note below.
    Section 6 of the Privacy Act of 1974, referred to in subsec. (s)(1), 
is section 6 of Pub. L. 93-579, which was set out below and was repealed 
by section 6(c) of Pub. L. 100-503.
    For classification of the Privacy Act of 1974, referred to in 
subsec. (s)(4), see Short Title note below.

                          Codification

    Section 552a of former Title 5, Executive Departments and Government 
Officers and Employees, was transferred to section 2244 of Title 7, 
Agriculture.


                               Amendments

    2004--Subsec. (b)(10). Pub. L. 108-271 substituted ``Government 
Accountability Office'' for ``General Accounting Office''.
    1999--Subsec. (a)(8)(B)(viii). Pub. L. 106-170 added cl. (viii).
    1998--Subsec. (u)(6), (7). Pub. L. 105-362 redesignated par. (7) as 
(6), substituted ``paragraph (3)(D)'' for ``paragraphs (3)(D) and (6)'', 
and struck out former par. (6) which read as follows: ``The Director of 
the Office of Management and Budget shall, annually during the first 3 
years after the date of enactment of this subsection and biennially 
thereafter, consolidate in a report to the Congress the information 
contained in the reports from the various Data Integrity Boards under 
paragraph (3)(D). Such report shall include detailed information about 
costs and benefits of matching programs that are conducted during the 
period covered by such consolidated report, and shall identify each 
waiver granted by a Data Integrity Board of the requirement for 
completion and submission of a cost-benefit analysis and the reasons for 
granting the waiver.''
    1997--Subsec. (a)(8)(B)(vii). Pub. L. 105-34 added cl. (vii).
    1996--Subsec. (a)(8)(B)(iv)(III). Pub. L. 104-193 substituted 
``section 404(e), 464,'' for ``section 464''.
    Subsec. (a)(8)(B)(v) to (vii). Pub. L. 104-226 inserted ``or'' at 
end of cl. (v), struck out ``or'' at end of cl. (vi), and struck out cl. 
(vii) which read as follows: ``matches performed pursuant to section 
6103(l)(12) of the Internal Revenue Code of 1986 and section 1144 of the 
Social Security Act;''.
    Subsecs. (b)(12), (m)(2). Pub. L. 104-316 substituted ``3711(e)'' 
for ``3711(f)''.
    1993--Subsec. (a)(8)(B)(vii). Pub. L. 103-66 added cl. (vii).
    1990--Subsec. (p). Pub. L. 101-508 amended subsec. (p) generally, 
restating former pars. (1) and (3) as par. (1), adding provisions 
relating to Data Integrity Boards, and restating former pars. (2) and 
(4) as (2) and (3), respectively.
    1988--Subsec. (a)(8) to (13). Pub. L. 100-503, Sec. 5, added pars. 
(8) to (13).
    Subsec. (e)(12). Pub. L. 100-503, Sec. 3(a), added par. (12).
    Subsec. (f). Pub. L. 100-503, Sec. 7, substituted ``biennially'' for 
``annually'' in last sentence.
    Subsecs. (o) to (q). Pub. L. 100-503, Sec. 2(2), added subsecs. (o) 
to (q). Former subsecs. (o) to (q) redesignated (r) to (t), 
respectively.
    Subsec. (r). Pub. L. 100-503, Sec. 3(b), inserted ``and matching 
programs'' in heading and amended text generally. Prior to amendment, 
text read as follows: ``Each agency shall provide adequate advance 
notice to Congress and the Office of Management and Budget of any 
proposal to establish or alter any system of records in order to permit 
an evaluation of the probable or potential effect of such proposal on 
the privacy and other personal or property rights of individuals or the 
disclosure of information relating to such individuals, and its effect 
on the preservation of the constitutional principles of federalism and 
separation of powers.''
    Pub. L. 100-503, Sec. 2(1), redesignated former subsec. (o) as (r).
    Subsec. (s). Pub. L. 100-503, Sec. 8, substituted ``Biennial'' for 
``Annual'' in heading, ``biennially submit'' for ``annually submit'' in 
introductory provisions, ``preceding 2 years'' for ``preceding year'' in 
par. (1), and ``such years'' for ``such year'' in par. (2).
    Pub. L. 100-503, Sec. 2(1), redesignated former subsec. (p) as (s).
    Subsec. (t). Pub. L. 100-503, Sec. 2(1), redesignated former subsec. 
(q) as (t).
    Subsec. (u). Pub. L. 100-503, Sec. 4, added subsec. (u).
    Subsec. (v). Pub. L. 100-503, Sec. 6(a), added subsec. (v).
    1984--Subsec. (b)(6). Pub. L. 98-497, Sec. 107(g)(1), substituted 
``National Archives and Records Administration'' for ``National Archives 
of the United States'', and ``Archivist of the United States or the 
designee of the Archivist'' for ``Administrator of General Services or 
his designee''.
    Subsec. (l)(1). Pub. L. 98-497, Sec. 107(g)(2), substituted 
``Archivist of the United States'' for ``Administrator of General 
Services'' in two places.
    Subsec. (q). Pub. L. 98-477 designated existing provisions as par. 
(1) and added par. (2).
    1983--Subsec. (b)(12). Pub. L. 97-452 substituted ``section 3711(f) 
of title 31'' for ``section 3(d) of the Federal Claims Collection Act of 
1966 (31 U.S.C. 952(d))''.
    Subsec. (m)(2). Pub. L. 97-452 substituted ``section 3711(f) of 
title 31'' for ``section 3(d) of the Federal Claims Collection Act of 
1966 (31 U.S.C. 952(d))''.
    1982--Subsec. (b)(12). Pub. L. 97-365, Sec. 2(a), added par. (12).
    Subsec. (e)(4). Pub. L. 97-375, Sec. 201(a), substituted ``upon 
establishment or revision'' for ``at least annually'' after ``Federal 
Register''.
    Subsec. (m). Pub. L. 97-365, Sec. 2(b), designated existing 
provisions as par. (1) and added par. (2).
    Subsec. (p). Pub. L. 97-375, Sec. 201(b), substituted provisions 
requiring annual submission of a report by the President to the Speaker 
of the House and President pro tempore of the Senate relating to the 
Director of the Office of Management and Budget, individual rights of 
access, changes or additions to systems of records, and other necessary 
or useful information, for provisions which had directed the President 
to submit to the Speaker of the House and the President of the Senate, 
by June 30 of each calendar year, a consolidated report, separately 
listing for each Federal agency the number of records contained in any 
system of records which were exempted from the application of this 
section under the provisions of subsections (j) and (k) of this section 
during the preceding calendar year, and the reasons for the exemptions, 
and such other information as indicate efforts to administer fully this 
section.
    1975--Subsec. (g)(5). Pub. L. 94-183 substituted ``to September 27, 
1975'' for ``to the effective date of this section''.

                         Change of Name

    Committee on Governmental Affairs of Senate changed to Committee on 
Homeland Security and Governmental Affairs of Senate, effective Jan. 4, 
2005, by Senate Resolution No. 445, One Hundred Eighth Congress, Oct. 9, 
2004.
    Committee on Government Operations of House of Representatives 
treated as referring to Committee on Government Reform and Oversight of 
House of Representatives by section 1(a) of Pub. L. 104-14, set out as a 
note under section 21 of Title 2, The Congress. Committee on Government 
Reform and Oversight of House of Representatives changed to Committee on 
Government Reform of House of Representatives by House Resolution No. 5, 
One Hundred Sixth Congress, Jan. 6, 1999.


                    Effective Date of 1999 Amendment

    Amendment by Pub. L. 106-170 applicable to individuals whose period 
of confinement in an institution commences on or after the first day of 
the fourth month beginning after December 1999, see section 402(a)(4) of 
Pub. L. 106-170, set out as a note under section 402 of Title 42, The 
Public Health and Welfare.


                    Effective Date of 1997 Amendment

    Amendment by Pub. L. 105-34 applicable to levies issued after Aug. 
5, 1997, see section 1026(c) of Pub. L. 105-34, set out as a note under 
section 6103 of Title 26, Internal Revenue Code.


                    Effective Date of 1996 Amendment

    Amendment by Pub. L. 104-193 effective July 1, 1997, with transition 
rules relating to State options to accelerate such date, rules relating 
to claims, actions, and proceedings commenced before such date, rules 
relating to closing out of accounts for terminated or substantially 
modified programs and continuance in office of Assistant Secretary for 
Family Support, and provisions relating to termination of entitlement 
under AFDC program, see section 116 of Pub. L. 104-193, as amended, set 
out as an Effective Date note under section 601 of Title 42, The Public 
Health and Welfare.


                    Effective Date of 1993 Amendment

    Amendment by Pub. L. 103-66 effective Jan. 1, 1994, see section 
13581(d) of Pub. L. 103-66, set out as a note under section 1395y of 
Title 42, The Public Health and Welfare.


                    Effective Date of 1988 Amendment

    Section 10 of Pub. L. 100-503, as amended by Pub. L. 101-56, Sec. 2, 
July 19, 1989, 103 Stat. 149, provided that:
    ``(a) In General.--Except as provided in subsections (b) and (c), 
the amendments made by this Act [amending this section and repealing 
provisions set out as a note below] shall take effect 9 months after the 
date of enactment of this Act [Oct. 18, 1988].
    ``(b) Exceptions.--The amendment made by sections 3(b), 6, 7, and 8 
of this Act [amending this section and repealing provisions set out as a 
note below] shall take effect upon enactment.
    ``(c) Effective Date Delayed for Existing Programs.--In the case of 
any matching program (as defined in section 552a(a)(8) of title 5, 
United States Code, as added by section 5 of this Act) in operation 
before June 1, 1989, the amendments made by this Act (other than the 
amendments described in subsection (b)) shall take effect January 1, 
1990, if--
        ``(1) such matching program is identified by an agency as being 
    in operation before June 1, 1989; and
        ``(2) such identification is--
            ``(A) submitted by the agency to the Committee on 
        Governmental Affairs of the Senate, the Committee on Government 
        Operations of the House of Representatives, and the Office of 
        Management and Budget before August 1, 1989, in a report which 
        contains a schedule showing the dates on which the agency 
        expects to have such matching program in compliance with the 
        amendments made by this Act, and
            ``(B) published by the Office of Management and Budget in 
        the Federal Register, before September 15, 1989.''


                    Effective Date of 1984 Amendment

    Amendment by Pub. L. 98-497 effective Apr. 1, 1985, see section 301 
of Pub. L. 98-497, set out as a note under section 2102 of Title 44, 
Public Printing and Documents.


                             Effective Date

    Section 8 of Pub. L. 93-579 provided that: ``The provisions of this 
Act [enacting this section and provisions set out as notes under this 
section] shall be effective on and after the date of enactment [Dec. 31, 
1974], except that the amendments made by sections 3 and 4 [enacting 
this section and amending analysis preceding section 500 of this title] 
shall become effective 270 days following the day on which this Act is 
enacted.''


                      Short Title of 1990 Amendment

    Section 7201(a) of Pub. L. 101-508 provided that: ``This section 
[amending this section and enacting provisions set out as notes below] 
may be cited as the `Computer Matching and Privacy Protection Amendments 
of 1990'.''


                      Short Title of 1989 Amendment

    Pub. L. 101-56, Sec. 1, July 19, 1989, 103 Stat. 149, provided that: 
``This Act [amending section 10 of Pub. L. 100-503, set out as a note 
above] may be cited as the `Computer Matching and Privacy Protection Act 
Amendments of 1989'.''


                      Short Title of 1988 Amendment

    Section 1 of Pub. L. 100-503 provided that: ``This Act [amending 
this section, enacting provisions set out as notes above and below, and 
repealing provisions set out as a note below] may be cited as the 
`Computer Matching and Privacy Protection Act of 1988'.''


                      Short Title of 1974 Amendment

    Section 1 of Pub. L. 93-579 provided: ``That this Act [enacting this 
section and provisions set out as notes under this section] may be cited 
as the `Privacy Act of 1974'.''


                               Short Title

    This section is popularly known as the ``Privacy Act''.


                  Termination of Reporting Requirements

    For termination, effective May 15, 2000, of reporting provisions in 
subsec. (s) of this section, see section 3003 of Pub. L. 104-66, as 
amended, set out as a note under section 1113 of Title 31, Money and 
Finance, and page 31 of House Document No. 103-7.

                         Delegation of Functions

    Functions of Director of Office of Management and Budget under this 
section delegated to Administrator for Office of Information and 
Regulatory Affairs by section 3 of Pub. L. 96-511, Dec. 11, 1980, 94 
Stat. 2825, set out as a note under section 3503 of Title 44, Public 
Printing and Documents.


           Privacy and Data Protection Policies and Procedures

    Pub. L. 108-447, div. H, title V, Sec. 522, Dec. 8, 2004, 118 Stat. 
3268, provided that:
    ``(a) Privacy Officer.--Each agency shall have a Chief Privacy 
Officer to assume primary responsibility for privacy and data protection 
policy, including--
        ``(1) assuring that the use of technologies sustain, and do not 
    erode, privacy protections relating to the use, collection, and 
    disclosure of information in an identifiable form;
        ``(2) assuring that technologies used to collect, use, store, 
    and disclose information in identifiable form allow for continuous 
    auditing of compliance with stated privacy policies and practices 
    governing the collection, use and distribution of information in the 
    operation of the program;
        ``(3) assuring that personal information contained in Privacy 
    Act systems of records is handled in full compliance with fair 
    information practices as defined in the Privacy Act of 1974 [see 
    Short Title of 1974 Amendment note, set out above];
        ``(4) evaluating legislative and regulatory proposals involving 
    collection, use, and disclosure of personal information by the 
    Federal Government;
        ``(5) conducting a privacy impact assessment of proposed rules 
    of the Department on the privacy of information in an identifiable 
    form, including the type of personally identifiable information 
    collected and the number of people affected;
        ``(6) preparing a report to Congress on an annual basis on 
    activities of the Department that affect privacy, including 
    complaints of privacy violations, implementation of section 552a of 
    title 5, 11 [sic] United States Code, internal controls, and other 
    relevant matters;
        ``(7) ensuring that the Department protects information in an 
    identifiable form and information systems from unauthorized access, 
    use, disclosure, disruption, modification, or destruction;
        ``(8) training and educating employees on privacy and data 
    protection policies to promote awareness of and compliance with 
    established privacy and data protection policies; and
        ``(9) ensuring compliance with the Departments established 
    privacy and data protection policies.
    ``(b) Establishing Privacy and Data Protection Procedures and 
Policies.--
        ``(1) [sic] In general.--Within 12 months of enactment of this 
    Act [Dec. 8, 2004], each agency shall establish and implement 
    comprehensive privacy and data protection procedures governing the 
    agency's collection, use, sharing, disclosure, transfer, storage and 
    security of information in an identifiable form relating to the 
    agency employees and the public. Such procedures shall be consistent 
    with legal and regulatory guidance, including OMB regulations, the 
    Privacy Act of 1974, and section 208 of the E-Government Act of 2002 
    [section 208 of Pub. L. 107-347, set out in a note under section 
    3501 of Title 44, Public Printing and Documents].
    ``(c) Recording.--Each agency shall prepare a written report of its 
use of information in an identifiable form, along with its privacy and 
data protection policies and procedures and record it with the Inspector 
General of the agency to serve as a benchmark for the agency. Each 
report shall be signed by the agency privacy officer to verify that the 
agency intends to comply with the procedures in the report. By signing 
the report the privacy officer also verifies that the agency is only 
using information in identifiable form as detailed in the report.
    ``(d) Independent, Third-Party Review.--
        ``(1) In general.--At least every 2 years, each agency shall 
    have performed an independent, third party review of the use of 
    information in identifiable form as the privacy and data protection 
    procedures of the agency to--
            ``(A) determine the accuracy of the description of the use 
        of information in identifiable form;
            ``(B) determine the effectiveness of the privacy and data 
        protection procedures;
            ``(C) ensure compliance with the stated privacy and data 
        protection policies of the agency and applicable laws and 
        regulations; and
            ``(D) ensure that all technologies used to collect, use, 
        store, and disclose information in identifiable form allow for 
        continuous auditing of compliance with stated privacy policies 
        and practices governing the collection, use and distribution of 
        information in the operation of the program.
        ``(2) Purposes.--The purposes of reviews under this subsection 
    are to--
            ``(A) ensure the agency's description of the use of 
        information in an identifiable form is accurate and accounts for 
        the agency's current technology and its processing of 
        information in an identifiable form;
            ``(B) measure actual privacy and data protection practices 
        against the agency's recorded privacy and data protection 
        procedures;
            ``(C) ensure compliance and consistency with both online and 
        offline stated privacy and data protection policies; and
            ``(D) provide agencies with ongoing awareness and 
        recommendations regarding privacy and data protection 
        procedures.
        ``(3) Requirements of review.--The Inspector General of each 
    agency shall contract with an independent, third party that is a 
    recognized leader in privacy consulting, privacy technology, data 
    collection and data use management, and global privacy issues, to--
            ``(A) evaluate the agency's use of information in 
        identifiable form;
            ``(B) evaluate the privacy and data protection procedures of 
        the agency; and
            ``(C) recommend strategies and specific steps to improve 
        privacy and data protection management.
        ``(4) Content.--Each review under this subsection shall 
    include--
            ``(A) a review of the agency's technology, practices and 
        procedures with regard to the collection, use, sharing, 
        disclosure, transfer and storage of information in identifiable 
        form;
            ``(B) a review of the agency's stated privacy and data 
        protection procedures with regard to the collection, use, 
        sharing, disclosure, transfer, and security of personal 
        information in identifiable form relating to agency employees 
        and the public;
            ``(C) a detailed analysis of agency intranet, network and 
        Websites for privacy vulnerabilities, including--
                ``(i) noncompliance with stated practices, procedures 
            and policies; and
                ``(ii) risks for inadvertent release of information in 
            an identifiable form from the website of the agency; and
            ``(D) a review of agency compliance with this Act [div. H of 
        Pub. L. 108-447, see Tables for classification].
    ``(e) Report.--
        ``(1) In general.--Upon completion of a review, the Inspector 
    General of an agency shall submit to the head of that agency a 
    detailed report on the review, including recommendations for 
    improvements or enhancements to management of information in 
    identifiable form, and the privacy and data protection procedures of 
    the agency.
        ``(2) Internet availability.--Each agency shall make each 
    independent third party review, and each report of the Inspector 
    General relating to that review available to the public.
    ``(f) Definition.--In this section, the definition of `identifiable 
form' is consistent with Public Law 107-347, the E-Government Act of 
2002 [see Tables for classification], and means any representation of 
information that permits the identity of an individual to whom the 
information applies to be reasonably inferred by either direct or 
indirect means.''


         Publication of Guidance Under Subsection (p)(1)(A)(ii)

    Section 7201(b)(2) of Pub. L. 101-508 provided that: ``Not later 
than 90 days after the date of the enactment of this Act [Nov. 5, 1990], 
the Director of the Office of Management and Budget shall publish 
guidance under subsection (p)(1)(A)(ii) of section 552a of title 5, 
United States Code, as amended by this Act.''


          Limitation on Application of Verification Requirement

    Section 7201(c) of Pub. L. 101-508 provided that: ``Section 
552a(p)(1)(A)(ii)(II) of title 5, United States Code, as amended by 
section 2 [probably means section 7201(b)(1) of Pub. L. 101-508], shall 
not apply to a program referred to in paragraph (1), (2), or (4) of 
section 1137(b) of the Social Security Act (42 U.S.C. 1320b-7), until 
the earlier of--
        ``(1) the date on which the Data Integrity Board of the Federal 
    agency which administers that program determines that there is not a 
    high degree of confidence that information provided by that agency 
    under Federal matching programs is accurate; or
        ``(2) 30 days after the date of publication of guidance under 
    section 2(b) [probably means section 7201(b)(2) of Pub. L. 101-508, 
    set out as a note above].''


Effective Date Delayed for Certain Education Benefits Computer Matching 
                                Programs

    Pub. L. 101-366, title II, Sec. 206(d), Aug. 15, 1990, 104 Stat. 
442, provided that:
    ``(1) In the case of computer matching programs between the 
Department of Veterans Affairs and the Department of Defense in the 
administration of education benefits programs under chapters 30 and 32 
of title 38 and chapter 106 of title 10, United States Code, the 
amendments made to section 552a of title 5, United States Code, by the 
Computer Matching and Privacy Protection Act of 1988 [Pub. L. 100-503] 
(other than the amendments made by section 10(b) of that Act) [see 
Effective Date of 1988 Amendment note above] shall take effect on 
October 1, 1990.
    ``(2) For purposes of this subsection, the term `matching program' 
has the same meaning provided in section 552a(a)(8) of title 5, United 
States Code.''


               Implementation Guidance for 1988 Amendments

    Section 6(b) of Pub. L. 100-503 provided that: ``The Director shall, 
pursuant to section 552a(v) of title 5, United States Code, develop 
guidelines and regulations for the use of agencies in implementing the 
amendments made by this Act [amending this section and repealing 
provisions set out as a note below] not later than 8 months after the 
date of enactment of this Act [Oct. 18, 1988].''


                     Construction of 1988 Amendments

    Section 9 of Pub. L. 100-503 provided that: ``Nothing in the 
amendments made by this Act [amending this section and repealing 
provisions set out as a note below] shall be construed to authorize--
        ``(1) the establishment or maintenance by any agency of a 
    national data bank that combines, merges, or links information on 
    individuals maintained in systems of records by other Federal 
    agencies;
        ``(2) the direct linking of computerized systems of records 
    maintained by Federal agencies;
        ``(3) the computer matching of records not otherwise authorized 
    by law; or
        ``(4) the disclosure of records for computer matching except to 
    a Federal, State, or local agency.''


             Congressional Findings and Statement of Purpose

    Section 2 of Pub. L. 93-579 provided that:
    ``(a) The Congress finds that--
        ``(1) the privacy of an individual is directly affected by the 
    collection, maintenance, use, and dissemination of personal 
    information by Federal agencies;
        ``(2) the increasing use of computers and sophisticated 
    information technology, while essential to the efficient operations 
    of the Government, has greatly magnified the harm to individual 
    privacy that can occur from any collection, maintenance, use, or 
    dissemination of personal information;
        ``(3) the opportunities for an individual to secure employment, 
    insurance, and credit, and his right to due process, and other legal 
    protections are endangered by the misuse of certain information 
    systems;
        ``(4) the right to privacy is a personal and fundamental right 
    protected by the Constitution of the United States; and
        ``(5) in order to protect the privacy of individuals identified 
    in information systems maintained by Federal agencies, it is 
    necessary and proper for the Congress to regulate the collection, 
    maintenance, use, and dissemination of information by such agencies.
    ``(b) The purpose of this Act [enacting this section and provisions 
set out as notes under this section] is to provide certain safeguards 
for an individual against an invasion of personal privacy by requiring 
Federal agencies, except as otherwise provided by law, to--
        ``(1) permit an individual to determine what records pertaining 
    to him are collected, maintained, used, or disseminated by such 
    agencies;
        ``(2) permit an individual to prevent records pertaining to him 
    obtained by such agencies for a particular purpose from being used 
    or made available for another purpose without his consent;
        ``(3) permit an individual to gain access to information 
    pertaining to him in Federal agency records, to have a copy made of 
    all or any portion thereof, and to correct or amend such records;
        ``(4) collect, maintain, use, or disseminate any record of 
    identifiable personal information in a manner that assures that such 
    action is for a necessary and lawful purpose, that the information 
    is current and accurate for its intended use, and that adequate 
    safeguards are provided to prevent misuse of such information;
        ``(5) permit exemptions from the requirements with respect to 
    records provided in this Act only in those cases where there is an 
    important public policy need for such exemption as has been 
    determined by specific statutory authority; and
        ``(6) be subject to civil suit for any damages which occur as a 
    result of willful or intentional action which violates any 
    individual's rights under this Act.''


                   Privacy Protection Study Commission

    Section 5 of Pub. L. 93-579, as amended by Pub. L. 95-38, June 1, 
1977, 91 Stat. 179, which established the Privacy Protection Study 
Commission and provided that the Commission study data banks, automated 
data processing programs and information systems of governmental, 
regional and private organizations to determine standards and procedures 
in force for protection of personal information, that the Commission 
report to the President and Congress the extent to which requirements 
and principles of section 552a of title 5 should be applied to the 
information practices of those organizations, and that it make other 
legislative recommendations to protect the privacy of individuals while 
meeting the legitimate informational needs of government and society, 
ceased to exist on September 30, 1977, pursuant to section 5(g) of Pub. 
L. 93-579.


Guidelines and Regulations for Maintenance of Privacy and Protection of 
                         Records of Individuals

    Section 6 of Pub. L. 93-579, which provided that the Office of 
Management and Budget shall develop guidelines and regulations for use 
of agencies in implementing provisions of this section and provide 
continuing assistance to and oversight of the implementation of the 
provisions of such section by agencies, was repealed by Pub. L. 100-503, 
Sec. 6(c), Oct. 18, 1988, 102 Stat. 2513.


                  Disclosure of Social Security Number

    Section 7 of Pub. L. 93-579 provided that:
    ``(a)(1) It shall be unlawful for any Federal, State or local 
government agency to deny to any individual any right, benefit, or 
privilege provided by law because of such individual's refusal to 
disclose his social security account number.
    ``(2) the [The] provisions of paragraph (1) of this subsection shall 
not apply with respect to--
        ``(A) any disclosure which is required by Federal statute, or
        ``(B) the disclosure of a social security number to any Federal, 
    State, or local agency maintaining a system of records in existence 
    and operating before January 1, 1975, if such disclosure was 
    required under statute or regulation adopted prior to such date to 
    verify the identity of an individual.
    ``(b) Any Federal, State, or local government agency which requests 
an individual to disclose his social security account number shall 
inform that individual whether that disclosure is mandatory or 
voluntary, by what statutory or other authority such number is 
solicited, and what uses will be made of it.''


 Authorization of Appropriations to Privacy Protection Study Commission

    Section 9 of Pub. L. 93-579, as amended by Pub. L. 94-394, Sept. 3, 
1976, 90 Stat. 1198, authorized appropriations for the period beginning 
July 1, 1975, and ending on September 30, 1977.

                Classified National Security Information

    For provisions relating to a response to a request for information 
under this section when the fact of its existence or nonexistence is 
itself classified or when it was originally classified by another 
agency, see Ex. Ord. No. 12958, Sec. 3.7, Apr. 17, 1995, 60 F.R. 19835, 
set out as a note under section 435 of Title 50, War and National 
Defense.