OVERVIEW OF THE PRIVACY ACT OF 1974

AGENCY REQUIREMENTS

Each agency that maintains a system of records shall--

D. 5 U.S.C. § 552a(e)(4)

"[subject to notice and comment], publish in the Federal Register upon establishment or revision a notice of the existence and character of the system of records, which notice shall include--(A) the name and location of the system; (B) the categories of individuals on whom records are maintained in the system; (C) the categories of records maintained in the system; (D) each routine use of the records contained in the system, including the categories of users and the purpose of such use; (E) the policies and practices of the agency regarding storage, retrievability, access controls, retention, and disposal of the records; (F) the title and business address of the agency official who is responsible for the system of records; (G) the agency procedures whereby an individual can be notified at his request if the system of records contains a record pertaining to him; (H) the agency procedures whereby an individual can be notified at his request how he can gain access to any record pertaining to him contained in the system of records, and how he can contest its contents; and (I) the categories of sources of records in the system."

comment --

For a discussion of this provision, see OMB Guidelines, 40 Fed. Reg. 28,948, 28,962-64 (1975). Although Privacy Act system notices are spread throughout the Federal Register, the Office of the Federal Register publishes a biennial compilation of all such system notices. See 5 U.S.C. § 552a(f). This "Privacy Act Compilation," is available on the Government Printing Office's World Wide Web site, which can be accessed at http://www.access.gpo.gov/su_docs.

Recently, the Court of Appeals for the Tenth Circuit, in Pippinger v. Rubin, addressed whether the Internal Revenue Service had complied with several of the requirements of subsection (e)(4) with regard to a computer database known as the "Automated Labor Employee Relations Tracking System" (ALERTS). 129 F.3d 519, 524-28 (10th Cir. 1997). The database was used by the IRS to record all disciplinary action proposed or taken against any IRS employee and contained a limited subset of information from two existing Privacy Act systems that the IRS had properly noticed in the Federal Register. Id. at 524-25. Of particular note, the Tenth Circuit found that ALERTS, being an "abstraction of certain individual records" from other systems of records, did not constitute a new system of records requiring Federal Register publication, because it could be accessed only by the same users and only for the same purposes as those published in the Federal Register for the original systems of records. Id. at 526-27.


Go to Table of Contents || Previous Section Agency Requirements: 5 U.S.C. § 552a(e)(3) || Next Section Agency Requirements: 5 U.S.C. § 552a(e)(5)