The Privacy Act and Government Records

Government holds more personal data than any company: tax returns, benefits files, immigration records, military service, security clearances, driver's licenses. The Privacy Act was Congress's 1974 answer to the fear that agencies would build files on citizens and pass them around. Fifty years later it is still the main federal law on government data, and 2025 put it back in the news when unions and retiree groups sued over access to Social Security records. This lesson covers the federal rules, the driver records law that binds the states, and Idaho's own public records exemptions.

What the Privacy Act covers

Start with four definitions in 5 U.S.C. 552a(a).

• Agency means a federal executive branch agency, including government corporations and independent regulatory agencies. Congress and the federal courts are not agencies. State and local governments are not covered.
• Individual means a U.S. citizen or an alien lawfully admitted for permanent residence. Visitors and others without permanent residence are outside the Act's protections.
• Record means any item of information about an individual that the agency maintains, such as education, financial, medical, criminal or employment history, that contains the person's name or an identifying number, symbol, fingerprint, voiceprint or photograph.
• System of records means a group of records under agency control "from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular."

The retrieval test is the gate. A pile of documents that mentions you is not a system of records unless the agency actually pulls information out by your name or number. It is a technical test, and a Privacy Act claim can fail on it. Modern databases blur the line, since almost anything can be searched by name, and the test was written in the era of filing cabinets.

The notice: SORNs

Every system of records must be described in a system of records notice (SORN) published in the Federal Register. Under 552a(e)(4), the notice lists the system's name and location; the categories of people in it; the categories of records; each routine use with its users and purpose; the policies on storage, retrieval, access controls, retention and disposal; the official responsible; how a person can find out whether the system holds a record about them, get access and contest its content; and the categories of sources. Under (e)(11), an agency must publish any new or changed routine use at least 30 days ahead and accept written comments. Under (r), it must give advance notice of a new or significantly changed system, or a new matching program, to OMB and to the House and Senate oversight committees.

SORNs are the public's map of what the government keeps. They are searchable on federalregister.gov by agency and the phrase "system of records." Reading one tells you what an agency collects about whom, and to whom it says it may give it.

Other duties on agencies

Section 552a(e) loads agencies with duties beyond the notice. They include collecting only information that is "relevant and necessary" to an authorized purpose; collecting directly from the person where practical when the information could lead to an adverse decision; telling people on the form itself the legal authority, whether answering is mandatory or voluntary, the purpose, the routine uses and the effect of not answering (e)(3); keeping records accurate, relevant, timely and complete enough for fairness; and setting up administrative, technical and physical safeguards against threats that could cause "substantial harm, embarrassment, inconvenience, or unfairness" (e)(10). Under (e)(7), an agency may not keep records describing how a person exercises First Amendment rights unless a statute or the person authorizes it, or the record is pertinent to an authorized law enforcement activity.

The no-disclosure rule and its 13 exceptions

The core rule is in 552a(b): no agency shall disclose a record from a system of records to any person or another agency without the individual's written request or prior written consent, unless an exception applies. The current text on Cornell's Legal Information Institute lists 13. The 2023 edition of the U.S. Code lists 12; a later amendment inserted a paragraph for the Director of the Congressional Budget Office as (b)(11) and renumbered the last two, so many summaries still say 12. The consumer reporting agency paragraph dates from Public Law 97-365 in 1982.

Exception	Who may receive the record	Limits in the text
(b)(1)	Officers and employees of the same agency	Who need the record to do their duties
(b)(2)	Anyone, when FOIA requires release	Only what FOIA actually requires; FOIA's privacy exemptions apply first
(b)(3)	Recipients under a published routine use	Must be compatible with the purpose of collection and listed in the SORN
(b)(4)	The Census Bureau	For census and survey work under Title 13
(b)(5)	Statistical researchers	With written assurance that records are used only for statistics and not in individually identifiable form
(b)(6)	The National Archives	Records of historical value
(b)(7)	Another government agency for civil or criminal law enforcement	On a written request from the head of that agency naming the record and the activity
(b)(8)	A person, in compelling circumstances affecting someone's health or safety	Notice must go to the individual's last known address
(b)(9)	Either house of Congress or its committees	On matters within their jurisdiction
(b)(10)	The Comptroller General (GAO)	For GAO's duties
(b)(11)	The Director of the Congressional Budget Office	Added after the 2023 edition of the Code
(b)(12)	A court	Under an order of a court of competent jurisdiction
(b)(13)	A consumer reporting agency	Under the federal debt collection rules in 31 U.S.C. 3711(e)

The routine use exception swallows the most. The Act defines it as use of a record "for a purpose which is compatible with the purpose for which it was collected," and each agency writes its own list. Many SORNs include standard routine uses for law enforcement referrals, for contractors working on agency systems, and for responding to a breach. OMB's breach memo M-17-12 directs agencies to include routine uses that let them share information needed to respond to a breach of their own or another agency's records.

Every disclosure except those to agency employees (b)(1) and under FOIA (b)(2) must be logged. Under 552a(c), the agency records the date, nature and purpose of each disclosure and the recipient's name and address, keeps that accounting for five years or the life of the record, whichever is longer, and makes it available to the person on request, except for law enforcement disclosures under (b)(7).

Your rights: access and amendment

Under 552a(d), a person may review their record in a system of records and get a copy in a form they can understand, and may bring someone along if they authorize the agency in writing to discuss the record in that person's presence. A person may also ask the agency to amend a record they believe is not accurate, relevant, timely or complete. The agency must acknowledge an amendment request in writing within 10 days, excluding weekends and legal holidays, then promptly make the correction or explain why not and how to seek review. A review of a refusal must finish within 30 working days unless the agency head extends it for good cause. If the refusal stands, the person may file a concise statement of disagreement, and every later disclosure must note the dispute and include the statement. Information compiled in reasonable anticipation of a civil action or proceeding is excluded from the access right.

Agencies may exempt some systems by rule. Under 552a(j), the CIA and criminal law enforcement components may exempt systems from most of the Act, though the disclosure rule, the accounting duty and the basic notice duties still apply. Under (k), any agency may exempt specific kinds of systems from the access and some notice provisions: classified material, investigatory material for law enforcement, Secret Service protective records, statistical records, background investigation material to protect confidential sources, testing material, and military promotion evaluations. An agency that claims an exemption must publish a rule and give its reasons.

Damages: what Doe v. Chao and FAA v. Cooper did

The civil remedies are in 552a(g). A person may sue when an agency refuses to amend a record, refuses access, fails to keep an accurate record and makes an adverse decision based on it, or fails to comply with any other provision in a way that has an adverse effect. For refusals of access and amendment, the court decides the matter fresh and may order the agency to act, with attorney fees for a plaintiff who substantially prevails. Money damages are narrower. Only for an intentional or willful violation is the United States liable for "actual damages sustained by the individual," with a floor of $1,000, plus costs and fees. The suit must be filed within two years, or two years from discovery if the agency materially and willfully misrepresented information it was required to disclose.

The Supreme Court has narrowed that money remedy twice.

• Doe v. Chao (February 24, 2004). The Department of Labor printed black lung benefit claimants' Social Security numbers on multi-party hearing notices sent to other claimants, employers and their lawyers. One claimant testified to distress and won $1,000 in the trial court. The Supreme Court, in an opinion by Justice Souter, held that the $1,000 floor is available only to a plaintiff who proves some actual damages; it is a minimum on proven damages, not an automatic award for any violation. Justice Ginsburg, joined by Justices Stevens and Breyer, dissented.
• FAA v. Cooper (March 28, 2012). In a joint investigation, the Social Security Administration gave the Department of Transportation records showing that a pilot had disclosed his HIV status to get disability benefits while not disclosing it to the FAA. He sued for emotional distress from the disclosure, alleging no economic loss. The Court, 5 to 3 in an opinion by Justice Alito, with Justice Kagan not participating, held that the Act does not clearly waive the government's sovereign immunity for mental or emotional distress, so "actual damages" means proven pecuniary loss. Justice Sotomayor, joined by Justices Ginsburg and Breyer, dissented.

Put together: a person whose federal records were willfully exposed can recover money only by proving out-of-pocket loss, such as credit monitoring they paid for or lost income. Distress alone gets nothing. The DOJ's overview of the remedies collects the cases applying the "intentional or willful" standard, which courts read to require more than negligence: conduct that is deliberate or in bad faith.

Criminal penalties sit in 552a(i): a misdemeanor with a fine of up to $5,000 for an employee who knowingly and willfully discloses records to someone not entitled to them, for willfully keeping a system of records without the required notice, and for anyone who knowingly and willfully obtains a record under false pretenses.

Computer matching, privacy impact assessments and Social Security numbers

The Computer Matching and Privacy Protection Act

Agencies compare databases to catch fraud and overpayments: benefits rolls against payroll records, death records against payment files. The Computer Matching and Privacy Protection Act of 1988 added rules for this to the Privacy Act, effective December 31, 1989, with a 1990 amendment to the due process rules, according to the DOJ overview. The current text (552a(o), (p) and (u)) works like this:

• A record may not be disclosed for a matching program without a written matching agreement between the agencies stating the purpose, legal authority, expected results including savings, the records and data elements used, notice procedures, verification, retention, security and limits on redisclosure. The agreement goes to the congressional committees, takes effect 30 days after it is sent, and lasts up to 18 months, renewable once for up to a year.
• No agency may cut off, reduce or deny a federal benefit based on a match until it independently verifies the information and gives the person notice of the findings and a chance to contest them, which is 30 days if no other law sets the period. A public health or safety emergency is the exception.
• Each agency that matches must have a Data Integrity Board of senior officials, including the inspector general, who may not chair it. The board approves agreements, reviews programs yearly and generally must find a program cost-effective before approving it.

Privacy impact assessments

Section 208 of the E-Government Act of 2002 requires an agency to do a privacy impact assessment before it develops or buys information technology that collects, maintains or disseminates identifiable information, or makes a substantial change to such a system. The DOJ's summary says the assessment analyzes how information is collected, stored, protected, shared and managed, and must be made public unless publication would raise security concerns or reveal classified or sensitive information. OMB's guidance memo for Section 208 is M-03-22. PIAs are often more specific than SORNs about what a system actually does, so they are useful reading for anyone tracking a new federal database.

Section 7: Social Security numbers

One part of the 1974 law reaches beyond federal agencies. Section 7 of Public Law 93-579, printed as a note to 552a, makes it "unlawful for any Federal, State or local government agency" to deny anyone a right, benefit or privilege provided by law because the person refused to disclose a Social Security number. The section has exceptions: disclosure required by a federal statute, and systems of records in place before January 1, 1975, under a statute or regulation adopted before then that required the number to verify identity. Section 7(b) adds that any federal, state or local agency asking for an SSN must say whether giving it is mandatory or voluntary, by what authority it is asked, and how it will be used.

The DOJ overview of Section 7 notes that the Social Security Act itself lets states use SSNs for tax, general public assistance, driver's license and motor vehicle registration purposes, which is why a DMV may require the number. It also reports that the federal appeals courts are split on whether Section 7 can be enforced against state and local governments: the Sixth and Ninth Circuits have said the Privacy Act reaches only federal agencies, while the Seventh and Eleventh Circuits have allowed enforcement through 42 U.S.C. 1983. Section 7 creates no claim against private companies, so a landlord or a gym that demands your SSN is not violating it.

FOIA's privacy exemptions: where access and privacy meet

The Freedom of Information Act, 5 U.S.C. 552, gives any person a right to federal agency records, subject to nine exemptions. Two protect personal privacy:

• Exemption 6, 552(b)(6): "personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy."
• Exemption 7(C), 552(b)(7)(C): records compiled for law enforcement purposes whose release "could reasonably be expected to constitute an unwarranted invasion of personal privacy."

Both call for balancing a privacy interest against the public interest in release, and the wording makes 7(C) easier for the agency to invoke: "could reasonably be expected" instead of "would," and "unwarranted" instead of "clearly unwarranted." The key case is DOJ v. Reporters Committee for Freedom of the Press (March 22, 1989). Requesters sought the FBI's compiled criminal history, the "rap sheet," of a private citizen. The Court, in an opinion by Justice Stevens, held that the rap sheet of a private citizen could be withheld under 7(C). Arrests and convictions scattered across courthouse files are public one by one, the Court said, but compiling them into a single file defeats their "practical obscurity" and creates a real privacy interest. And the only public interest that counts is what the record reveals about what the government is up to, not what it reveals about a private person.

The interaction with the Privacy Act runs through exception (b)(2): an agency may disclose a Privacy Act record when FOIA requires it, and FOIA does not require release of information protected by Exemption 6 or 7(C). For a reporter, the practical effect is that names and personal details of private people in federal files are usually redacted, while information about officials' public duties is usually released.

The 2025 and 2026 lawsuits over DOGE access to federal data

In early 2025, the administration's Department of Government Efficiency teams sought access to major federal data systems. Unions, retiree groups and others filed suits arguing the access violated the Privacy Act and the Administrative Procedure Act. A central question was whether team members fit the (b)(1) exception for agency employees who need the records in their duties. Several cases followed; the one that reached the Supreme Court concerned the Social Security Administration.

Date	Event in AFSCME v. SSA (D. Md., No. 1:25-cv-596)
February 2025	Unions and a retiree group sue SSA over DOGE team access to SSA systems
March 20, 2025	District court grants a temporary restraining order
April 17, 2025	District court grants a preliminary injunction; it still allowed access to anonymized data, and to identifiable data with a written justification. The full Fourth Circuit later denied a stay, 9 to 6
June 6, 2025	Supreme Court stays the injunction pending appeal (SSA v. AFSCME, No. 24A1063). The order says the stay factors favor the government "under the present circumstances." Justice Kagan would have denied it; Justice Jackson, joined by Justice Sotomayor, dissented
January 16, 2026	The Justice Department files a notice of correction to the record disclosing that DOGE personnel had improperly accessed SSA data while the injunction was in force, according to the plaintiffs' counsel's case page
April 10, 2026	Fourth Circuit vacates the preliminary injunction and sends the case back
April 14 to May 19, 2026	District court allows discovery; the government moves to dismiss and the plaintiffs respond

The timeline after June 2025 comes from the case page kept by the plaintiffs' counsel, which lists no events after May 19, 2026. As of October 2026, no final merits ruling in this case was found. The Supreme Court's order decided only that the injunction should be paused while the appeal went on; it did not decide whether the access violated the Privacy Act. The suits put the Privacy Act's oldest questions back in front of courts: who counts as an agency employee with a need to know, and whether a person can show the kind of harm that lets them sue when the remedy for distress alone was closed off in Cooper.

The Driver's Privacy Protection Act

State motor vehicle departments hold names, addresses, photos and Social Security numbers for nearly every adult. Congress passed the Driver's Privacy Protection Act in 1994, and it binds the states directly. Under 18 U.S.C. 2721(a), a state DMV and its officers, employees and contractors may not knowingly disclose personal information from motor vehicle records except as the Act permits.

The definitions in 2725 matter. A motor vehicle record is a record pertaining to a driver's permit, title, registration or ID card. Personal information identifies a person and includes the photograph, Social Security number, driver ID number, name, address (but not the five-digit ZIP), phone number and medical or disability information, but "does not include information on vehicular accidents, driving violations, and driver's status." Highly restricted personal information is the photo or image, Social Security number and medical or disability information, and it may be released only with express consent, except for government, court, insurance and commercial driver's license uses. Express consent means consent in writing, including electronic consent with an electronic signature.

Section 2721(b) lists 14 permissible uses, including government agencies and their contractors; motor vehicle safety, theft, emissions and recalls; verifying information a person gave a legitimate business; court and agency proceedings, including service of process; research that does not publish or contact people; insurers' claims and underwriting; towing notices; licensed private investigators for permitted purposes; employer verification of commercial driver's licenses; private toll facilities; individual requests with the person's express consent; bulk marketing with express consent; any requester with the person's written consent; and other state-authorized uses related to vehicle operation or public safety. Recipients may resell only for a permitted use and, with some exceptions, must keep records of each resale for five years.

The enforcement teeth: 2724 lets a person sue anyone who "knowingly obtains, discloses or uses personal information" from a motor vehicle record for an impermissible purpose, for actual damages of not less than $2,500 in liquidated damages, punitive damages for willful or reckless disregard, and attorney fees. Under 2723, a knowing violation is a federal crime, and a state DMV with a policy or practice of substantial noncompliance faces a civil penalty from the U.S. Attorney General of up to $5,000 a day.

The two Supreme Court cases

• Reno v. Condon (January 12, 2000). South Carolina argued that Congress could not tell states what to do with their own records. A unanimous Court, in an opinion by Chief Justice Rehnquist, upheld the DPPA as a valid regulation of interstate commerce, since driver information is sold in commerce, and held that it does not violate the Tenth Amendment because it regulates the states as owners of databases, not as regulators of their citizens.
• Maracich v. Spears (June 17, 2013). South Carolina lawyers used state open records requests to get car buyers' information from the DMV, citing the litigation exception, and sent more than 34,000 letters marked "ADVERTISING MATERIAL" inviting buyers to join a suit against dealers. The Court, 5 to 4 in an opinion by Justice Kennedy, held that soliciting clients is not a permissible use under the litigation exception in 2721(b)(4), and sent the case back to decide whether solicitation was the letters' predominant purpose. Justice Ginsburg, joined by Justices Scalia, Sotomayor and Kagan, dissented.

Idaho's motor vehicle records law

Idaho implements the same structure in Idaho Code 49-203. The Idaho Transportation Department and its officers, employees, agents and contractors may not knowingly disclose personal information from a motor vehicle or driver record except as the section allows. Disclosure is permitted for safety, theft, emissions, recalls and related federal programs; with the person's written consent; and, on proof of the requester's identity and a statement of the use, for twelve listed purposes that track the federal list (government agencies, safety and market research, business verification, legal proceedings, research, insurers, towing notices, licensed investigators, commercial driver's license checks by employers, bulk marketing with written consent, other uses authorized by Idaho law related to public safety or vehicle operation, and private toll facilities). Photographs, digitized images and signatures, Social Security numbers and medical or disability information get the extra protection, released only with written consent except for government and legal proceeding uses. Recipients may pass the information on only for the listed purposes.

Idaho's public records exemptions for personal information

The Privacy Act does not reach Idaho state and local agencies. Their records are governed by the Idaho Public Records Act, which presumes records are open and lists exemptions. The privacy exemptions sit mainly in Idaho Code 74-106. Among them:

74-106 subsection	What is exempt	What stays public
(1)	Most personnel records: sex, race, marital status, birth date, home address and phone, SSN, driver's license number, applications, test scores, grievances, evaluations	Employment history, classification, pay grade and step, longevity, gross salary and salary history including bonuses and severance, reimbursed expenses, employment status, workplace, employing agency, and the name of the sole finalist for a non-classified position
(4)	Personal debt and bank records, vital statistics, military records, Social Security numbers; some identifiers released only partly (birth year only, last four digits)	Redacted versions where the statute allows
(8)	Personal data submitted for a license or permit, such as parentage, religion, medical condition, financial worth, tax and SSNs	Names and business contact information
(13)	Hospital, medical, prescription, psychiatric and counseling records	Not applicable
(15)	Personal information in motor vehicle and driver records (tied to 49-203)	Uses permitted by 49-203
(25)	Voters' driver's license numbers, dates of birth and, in some cases, residence addresses	Other voter registration information
(27) and (30)	Address confidentiality program files; home addresses and phones of eligible law enforcement and judicial officers	Not applicable

The Idaho Public Records Requests course covers how to request records, deadlines and appeals; this lesson only flags where privacy limits apply.

Questions and answers

Does the Privacy Act apply to my county or city?

No. The Act's definition of agency covers federal executive agencies. Your county's records are governed by Idaho's Public Records Act and other state laws. The one federal rule that does reach local governments is Section 7's limit on denying a right or benefit because you would not give your Social Security number, and the courts are split on how it can be enforced against them.

Can a federal agency share my records with another agency without asking me?

Yes, if an exception in 552a(b) applies. The most common is a routine use published in the SORN. Others include a written law enforcement request from the head of another agency, a court order, and disclosures to Congress, GAO, the Census Bureau and the National Archives. Most disclosures must be logged, and you can ask for the log.

Can I sue if an agency loses my data in a hack?

You can try, but the bar is high. You need an intentional or willful failure, such as ignoring known security warnings, and proven pecuniary loss after FAA v. Cooper. Courts also ask whether you have standing, meaning a concrete injury, which can be hard to show before any misuse of the data.

What is the difference between a Privacy Act request and a FOIA request?

FOIA gives anyone access to agency records, subject to exemptions. The Privacy Act gives you access to records about yourself in a system of records, and a right to correct them. Agencies process first-party requests under both laws and release whatever either law requires, so naming both in your request costs nothing.

Can an agency refuse to show me my file?

Sometimes. Under (j) and (k), agencies may exempt certain systems, such as criminal law enforcement files and background investigation material that would reveal confidential sources, from the access right. Information compiled in reasonable anticipation of a civil action is also excluded. The agency must publish an exemption rule for the system.

Is my driving record public in Idaho?

Your personal information in it is not, except for the uses in Idaho Code 49-203 and the federal DPPA. Information about accidents, driving violations and driver status is outside the federal definition of personal information, so the DPPA does not bar its release, though Idaho law and department rules decide what the department will provide and to whom.

Why does the DMV need my Social Security number if Section 7 limits SSN demands?

Because a federal statute authorizes it. The Social Security Act lets states use SSNs for driver's license and motor vehicle registration purposes, which falls under Section 7's exception for disclosure required by federal statute. The agency must still tell you the authority and how the number will be used.

Do Privacy Act protections cover people who are not citizens?

Only lawful permanent residents. The Act's definition of individual is a U.S. citizen or an alien lawfully admitted for permanent residence. Other people may still use FOIA to request records, but they do not get the Privacy Act's access, amendment or damages rights.

Hard questions

Does the routine use exception make the consent rule meaningless?

Critics of current practice point out that agencies write their own routine uses, that many SORNs list a dozen or more, and that "compatible with the purpose" has been read loosely, so the rule in (b) often gives way to the exception in (b)(3). Defenders answer that routine uses must be published with 30 days for comment, which gives the public and Congress a chance to object, and that agencies need predictable authority to share for law enforcement, breach response and contractor work. The text supports both readings: it requires compatibility and notice, and it leaves the agency to draft the list.

Was FAA v. Cooper right to bar emotional distress damages?

The majority relied on the rule that waivers of sovereign immunity must be unambiguous, and found "actual damages" ambiguous enough that the government could not be made to pay for distress. The dissent argued that privacy harms are mostly dignitary and emotional, so a privacy statute that pays only for financial loss offers little to most victims, and that Congress meant "actual damages" to include general damages. Both sides agree that Congress, not the courts, can change the answer by amending 552a(g)(4).

Should DOGE-style access to agency data be treated as a disclosure at all?

The government defended the access as lawful internal use by agency personnel, the kind of use (b)(1) allows. The plaintiffs argued that the team was not doing SSA's work, had no need for full, identifiable records, and was given access without the safeguards and notice the Act requires. The district court found the plaintiffs likely to succeed; the Supreme Court paused that ruling without explaining; and the Fourth Circuit vacated it in April 2026. The legal question of who counts as an agency employee with a need to know, in a government that moves staff between agencies, remains open as of October 2026.

Is "practical obscurity" still a workable idea when everything is searchable?

The Reporters Committee Court reasoned that compiling scattered public facts creates a new privacy interest. Open government advocates argue that this lets agencies withhold compilations of information that is already public, and that the only public interest test is too narrow because it ignores what records reveal about crime and safety. Privacy advocates answer that the internet has made compilation easier and the harm larger, which is why the same logic now drives state data broker laws. Courts still apply the case, and the balancing it requires is fact-specific.

Should the DPPA's $2,500 liquidated damages apply to every misuse?

Plaintiffs and privacy groups say a fixed award is the only practical remedy when misuse causes no measurable loss, and that it deters bulk misuse such as the 34,000 letters in Maracich. Defendants and some judges worry that per-person liquidated damages can turn a technical violation in a large data set into an enormous award. The statute says the court "may award" actual damages "but not less than liquidated damages in the amount of $2,500," and defendants argue that "may" leaves the court room to award less or nothing.