Privacy Law Library

Privacy Act of 1974

Privacy Act

Government records

The Privacy Act governs how federal agencies collect, maintain, use, and disclose records about individuals kept in systems of records. It requires consent for most disclosures, public notice of record systems, access and amendment rights, and accuracy and security safeguards. A 2024 amendment (Pub. L. 118-104) added a disclosure exception for the Congressional Budget Office.

Where
Federal
Citation
5 U.S.C. 552a
Status
In force
In force since
1975-09-27
Last amended
2024-10-02
Enforced by
Federal courts (civil actions); OMB guidance; DOJ for criminal misdemeanors
People can sue
Yes
Penalties
Civil actions for amendment and access, and for intentional or willful violations actual damages with a $1,000 minimum plus fees; willful disclosure by an agency officer or employee (and, through subsection (m), contractor employees) is a misdemeanor with a fine up to $5,000 (5 U.S.C. 552a(i)(1)).
Applies to
  • Federal executive branch agencies
  • Government contractors operating a system of records on behalf of an agency (treated as agency employees for criminal provisions, 5 U.S.C. 552a(m))

What a privacy notice must say

  • Publish a system of records notice in the Federal Register and give a Privacy Act statement when collecting information.5 U.S.C. 552a(e)(3)-(4)

Rights it gives people

  • Let individuals access their records and request amendment.5 U.S.C. 552a(d)

Practices it requires

  • Do not disclose records from a system of records without the individual's written consent, except under listed exceptions such as routine uses.5 U.S.C. 552a(b)

Security duties

  • Establish appropriate administrative, technical, and physical safeguards for records.5 U.S.C. 552a(e)(10)

Other duties

  • Keep an accounting of disclosures.5 U.S.C. 552a(c)
  • Agencies contracting out operation of a system of records must make the Act's requirements apply to the contractor.5 U.S.C. 552a(m)(1)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: effective_date computed as 270 days after enactment on Dec. 31, 1974 from the statutory note | 552a(e)(3)-(4) and (e)(10) wording was not re-read

Research reference, not legal advice.