The Privacy Act, 5 U.S.C. § 552a, affords rights and protections regarding individuals’ information that is maintained by the government. It is important to federal employees because it allows them to see and challenge job-related information held by their employer.
In some ways, the Privacy Act is a protection against defamation of a federal employee’s good name. The government — or a supervisory official acting within the scope of his employment — cannot be directly sued for libel or slander. But, under the Privacy Act, a federal employee can seek to have a materially erroneous record corrected and can seek damages if the erroneous information has harmed the employee.
One of the most significant elements of the Privacy Act is the protection it affords by strictly limiting the manner in which information identifying individuals is disclosed. Specifically, and subject to 12 exceptions, the Privacy Act precludes a government agency from releasing a record pertaining to an individual without his consent.
The three exceptions most applicable to federal employees allow disclosure when: the information is disclosed to an agency employee who maintains the record or who has a need to know in the performance of his duties; the disclosure is required by the Freedom of Information Act; or the record is disclosed as a “routine use.” Essentially, this means that disclosures will occur, but they should be reasonable, limited and related to the agency’s mission.
Another significant Privacy Act right is the ability, upon request, to gain access to, review and have copies made of records pertaining to the individual. If, upon an inspection, an individual discovers that the records are inaccurate or incomplete, he may request that the records be amended. The agency must respond in writing with its determination. If an agency declines the request, the individual may pursue a civil remedy by filing suit in federal court.
A federal employee may also file a civil suit in federal court to enforce some sections of the Privacy Act, such as the improper disclosure of a record without his consent. In addition, a civil suit may be brought for maintaining an inaccurate or incomplete record when a determination is made in reliance on those records that is adverse to the individual. Another basis for a lawsuit is to challenge an agency’s refusal to turn over records covered by the Privacy Act.
Any civil action under the Privacy Act generally must be filed within two years of any alleged violation. Relief includes: the release of improperly withheld documents or the correction of erroneous documents; damages, with a $1,000 minimum, if an employee is harmed because of an improper disclosure or an adverse determination resulting from an erroneous record; and attorneys’ fees.
Certain records are exempt from coverage by the Privacy Act; specifically, records maintained by the CIA and records created for law enforcement purposes and maintained by law enforcement agencies are excluded.
Likewise, investigatory materials compiled for law enforcement purposes, materials maintained for national security purposes, and records required by statute to be maintained for statistical purposes are excluded from coverage.
If you think your agency has created a false document about you and uses it to harm you, has told others private information about you or has refused to give you information it has compiled about you, you may have a claim.
But, the Privacy Act is complicated and has many exceptions and technicalities. A specific review of your situation is in order before rushing to the courthouse. Look at the statute and consult with a lawyer. The agency may have authority for the release of the document, or your damages may be too speculative to have them recognized by a court.
If you are a manager, make sure you safeguard private information on your subordinates. The Privacy Act does have criminal penalties for willful violations. Even if a crime has not been committed, the violation of the Privacy Act by a manager can be the basis for disciplinary action.
