Overview of the Privacy Act: 2020 Edition

Accounting of Certain Disclosures

“Each agency, with respect to each system of records under its control, shall--

(1) except for disclosures made under subsections (b)(1) or (b)(2) of this section, keep an accurate accounting of--

(A) the date, nature, and purpose of each disclosure of a record to any person or to another agency made under subsection (b) of this section; and

(B) the name and address of the person or agency to whom the disclosure is made;

(2) retain the accounting made under paragraph (1) of this subsection for at least five years or the life of the record, whichever is longer, after the disclosure for which the accounting is made;

(3) except for disclosures made under subsection (b)(7) of this section, make the accounting made under paragraph (1) of this subsection available to the individual named in the record at his request; and

(4) inform any person or other agency about any correction or notation of dispute made by the agency in accordance with subsection (d) of this section of any record that has been disclosed to the person or agency if an accounting of the disclosure was made.”  5 U.S.C. § 552a(c)(1)-(4).

Comment:

With the exception of the need to know disclosure and the required FOIA disclosure exceptions, agencies are required to keep accurate accountings of their record disclosures.

Section 552a(c) of the Privacy Act establishes requirements for agencies to follow when accounting for disclosures of records.  Subsection (c)(1) explicitly excepts both intra-agency “need to know” disclosures and FOIA disclosures from its coverage.  See, e.g., Clarkson v. IRS, 811 F.2d 1396, 1397-98 (11th Cir. 1987) (per curiam) (finding IRS’s internal disclosure of records to its criminal investigation units does not require accounting).

While agencies do not need to account for disclosures made within the agency, the agency must account for all disclosures made outside of the agency, including disclosures pursuant to routine uses and law enforcement agencies (even though the law enforcement agency may be exempt from disclosures to the subject individual).  OMB Memorandum for Heads of Departments and Agencies, Attachment B – Instructions for Complying with the President’s Memorandum of May 14, 1998, “Privacy and Personal Information in Federal Records” B.2.d. (Jan. 7, 1999) [hereinafter OMB Memo 99-05], https://www.justice.gov/paoverview_omb-99-05; see Quinn v. Navy, No. 94-56067, 1995 WL 341513, at *1 (9th Cir. June 8, 1995) (finding that disclosure of records within the Navy was exempt from accounting requirements).

OMB guidelines state that an agency must be able to maintain an accurate and complete accounting of disclosures so as to be able to respond to an individual’s request for access to that accounting of disclosures.

Additionally, OMB stated that “[w]hile an agency need not keep a running tabulation of every disclosure at the time it is made, the agency must be able to reconstruct an accurate and complete accounting of disclosures so as to be able to respond to requests in a timely fashion.”  OMB Memo 99-05, B.2.d., https://www.justice.gov/paoverview_omb-99-05; see also OMB 1975 Guidelines, 40 Fed. Reg. at 28,956, https://www.justice.gov/paoverview_omb-75.  Accounting of disclosures made outside of the agency is required “even when such disclosure is . . . with the written consent or at the request of the individual.”  OMB 1975 Guidelines, 40 Fed. Reg. at 28,955, https://www.justice.gov/paoverview_omb-75.

In at least one district court case, the court noted that the records themselves do not need to contain the required accounting information.

In one case, a district court noted that although an agency is required pursuant to 5 U.S.C. § 552a(c) to keep an accurate accounting of each disclosure, there is no requirement that the “disclosed records themselves contain ‘the date, nature and purpose’ of each disclosure.”  Sieverding v. DOJ, 693 F. Supp. 2d 93, 105-06 (D.D.C. 2010), summary affirmance granted, No. 13-5060, 2013 WL 6801184 (D.C. Cir. Dec. 11, 2013) (per curiam).  The district court also stated that the accounting requirement only “requires agencies to keep accurate accountings of their disclosures of records; they need not account for conversations or personal visits.”  Id. at 106.

Individuals have a right of access to an accounting of disclosures similar to the access right provided by subsection (d)(1), but are exempt from accessing such an accounting: (1) documenting law enforcement request disclosures under subsection (b)(7); and (2) subject to the Privacy Act exemption provisions, pursuant to subsection (j) or subsection (k).

It is important to recognize that subsection (c)(3) grants individuals a right of access to the accounting of disclosures similar to the access right provided by subsection (d)(1).  See Standley v. DOJ, 835 F.2d 216, 219 (9th Cir. 1987) (entitling plaintiff to gain access to list, compiled by U.S. Attorney, of persons in IRS to whom disclosures of grand jury materials about plaintiff were made); Ray v. DOJ, 558 F. Supp. 226, 228 (D.D.C. 1982) (requiring addresses of private persons who requested plaintiff’s records to be released to plaintiff notwithstanding that “concern about possible harassment [sic] of these individuals may be legitimate”), aff’d, 720 F.2d 216 (D.C. Cir. 1983) (unpublished table decision); cf. Quinn, 1995 WL 341513, at *1 (finding no records to disclose in response to request for accounting because there were no disclosures that required accounting); Beaven v. DOJ, No. 03-84, 2007 WL 1032301, at *23 (E.D. Ky. Mar. 30, 2007) (finding accounting provisions not applicable for unauthorized disclosures because provisions only cover disclosures made under subsection (b)), aff’d in part & remanded in part on other grounds, 622 F.3d 540 (6th Cir. 2010). 

However, subsection (c)(3) makes an explicit exception “for disclosures made under subsection (b)(7).”  5 U.S.C. § 552a(c)(3); see also Lora v. INS, No. 2:02cv756, 2002 WL 32488472, at *2 (E.D. Va. Oct. 8, 2002) (holding that plaintiff could not know whether AUSA had properly requested disclosed document from legacy INS because he was “not entitled to any accounting of disclosures” made under subsection (b)(7)) aff’d per curiam, 61 F. App’x 80 (4th Cir. 2003).

Of course, it should not be overlooked that certain Privacy Act exemptions – 5 U.S.C. § 552a(j) and (k) – are potentially available to shield an “accounting of disclosures” record from release to the subject thereof under subsection (c)(3).  See Vazquez v. DOJ, 764 F. Supp. 2d 117, 120 (D.D.C. 2011) (ruling that “DOJ properly denied plaintiff’s request under the Privacy Act on the basis that such records are” in a system “which the FBI has exempted” from the accounting provision pursuant to exemption (j)(2)); Zahedi v. DOJ, No. 10-694, 2011 WL 1872206, at *3 (D. Or. May 16, 2011) (“Plaintiff seeks an accounting of information obtained pursuant to a search warrant in the context of a criminal investigation, which falls squarely within the exemptions [(j)(2) and (k)(2)] to the Privacy Act’s accounting provision.”); Standley, 835 F.2d at 219 (remanding case for consideration of whether exemptions under 5 U.S.C. § 552a(j) and (k) are applicable); Hornes v. EOUSA, No. 04-2190, 2006 WL 792680, at *4 (D.D.C. Sept. 27, 2006) (finding, pursuant to exemption (j)(2), that “EOUSA has specifically exempted its system of ‘Criminal Case Files’ from the disclosure requirements of subsection (c)(3)”); Maydak v. DOJ, 254 F. Supp. 2d 23, 34-35 (D.D.C. 2003) (asserting that although agency’s “conten[tion] that it ‘is exempt from [the accounting provision] with respect to logs of disclosure’ . . . is incorrect,” and that “[e]xemption from the accounting requirement of § 552a(c) is not as expansive as seemingly being suggested by [the agency],” nevertheless finding that plaintiff failed to state claim and had no right of access where system was exempt from provisions of subsection (c)(3) pursuant to subsection (j)); Mittleman v. Treasury, 919 F. Supp. 461, 469 (D.D.C. 1995) (finding that “application of exemption (k)(2) . . . is valid” and that Department of the Treasury OIG’s General Allegations and Investigative Records System is exempt “because, inter alia, application of the accounting-of-disclosures provision . . . would alert the subject to the existence of an investigation, possibly resulting in hindrance of an investigation”), aff’d in part & remanded in part on other grounds, 104 F.3d 410 (D.C. Cir. 1997); Bagley v. FBI, No. 88-4075, slip op. at 2-4 (N.D. Iowa Aug. 28, 1989) (applying subsection (j)(2)); see also Hart v. FBI, No. 94 C 6010, 1995 WL 170001, at *2 n.1 (N.D. Ill. Apr. 7, 1995) (noting exemption of FBI’s Criminal Justice Information Services Division Records System), aff’d, 91 F.3d 146 (7th Cir. 1996) (unpublished table decision).

For a further discussion of general accounting procedures and practices, see OMB 1975 Guidelines, 40 Fed. Reg. at 28,955-56, https://www.justice.gov/paoverview_omb-75.

A plaintiff may seek damages for an agency’s failure to maintain an accurate accounting of disclosures.

Finally, a plaintiff may seek damages for an agency’s failure to maintain adequate accounting of disclosures.  See Sussman v. Marshals Serv., 734 F. Supp.2d 138, 149 (D.D.C. 2010) (stating that “[t]he core elements of the claim are (1) failure . . . to maintain an accurate accounting of disclosures, and (2) a resultant adverse effect.” (quoting Sussman v. Marshals Serv., 494 F.3d 1106, 1124 (D.C. Cir. 2007))).  An individual can recover damages for accounting failures regarding disclosures “only to the extent those disclosures involved materials in his records.”  494 F.3d at 1124.

Next Section: Indviudal's Right of Access