5 U.S.C. § 552a - Privacy Act of 1974

Scope

5 U.S.C. § 552a is the Privacy Act of 1974. The statute restricts the collection, maintenance, use, and dissemination of personally identifiable information (PII) by federal agencies. The Act grants individuals the right to access records about themselves, requires agencies to maintain only necessary and accurate records, limits disclosure to authorized recipients, and provides civil remedies for violations. Every federal agency - including all DoD components and the Marine Corps - must comply with the Act in administering personnel records, pay records, medical records, and any other system of records containing PII.

Audience

S-1 admin specialists, records managers, command investigators, and any Marine Corps official who collects, maintains, or discloses personally identifiable information about individuals in a federal system of records. The Act applies whenever a Marine Corps unit handles Social Security Numbers, medical information, financial data, disciplinary records, or other PII covered by a Privacy Act System of Records Notice (SORN).

Operative content

• Subsection (b) Conditions of disclosure. Agencies must not disclose records without the individual's written consent, except under 12 enumerated routine use exceptions. Unauthorized disclosure exposes the agency and individual officials to civil and criminal liability.
• Subsection (c) Accounting for disclosures. Agencies must maintain an accounting of each disclosure of records from a system of records, except for intra-agency use or disclosures under the Freedom of Information Act.
• Subsection (d) Access to records. Individuals have the right to request access to their own records and to request amendment of inaccurate records. The agency must provide access or explain the denial within 10 working days.
• Subsection (e) Agency requirements. Agencies must publish System of Records Notices (SORNs) in the Federal Register, collect only information relevant and necessary to the agency purpose, maintain records with accuracy and completeness, and establish appropriate administrative, technical, and physical safeguards.
• Subsection (g) Civil remedies. Individuals harmed by an agency's willful or intentional failure to comply with the Act are entitled to civil remedies in federal district court, including actual damages, attorney fees, and costs.

Application to Marine Corps Administration

• Personnel records (OMPF, service record, MCTFS data). Covered by DoD Privacy Act SORNs. Access and disclosure rules apply at every transaction.
• Privacy Act Statement requirement. When collecting PII from individuals on a form or in an interview, a Privacy Act Statement citing the statutory authority, purpose, routine uses, and consequences of non-disclosure is required per subsection (e)(3).
• PII in command investigations. Investigators attach the Privacy Act Statement per JAGMAN Appendix A-2-i when collecting PII from witnesses.
• Congressional inquiry responses. Responses about an identifiable Marine require a Privacy Act release from the Marine or a routine-use exception. Without a release, the response is limited to non-PII-protected information.
• FOIA and Privacy Act intersection. FOIA Exemption (b)(6) and the Privacy Act run together for personal privacy records. The Privacy Act balancing test applies when a FOIA request seeks records about an identifiable individual.
• Records held in systems of record. MCTFS, MOL, DEERS, DTS, and other Marine Corps personnel systems are covered by published SORNs. Access to these systems requires need-to-know and role-based authorization.

Connection to higher policy

The Privacy Act is statute, the top of the privacy authority chain. No regulation outranks it. The Freedom of Information Act at 5 U.S.C. 552 sits beside it in title 5, and the two statutes run together whenever a records request touches personal privacy, as the FOIA intersection above describes.

Connection to Marine Corps doctrine and lower policy

• DoD 5400.11-R Department of Defense Privacy Program. DoD-level implementation regulation.
• SECNAVINST 5211.5F Department of the Navy Privacy Program. SECNAV-level implementation for the Marine Corps.
• MCO 5239.2B Marine Corps Cybersecurity Program. Encryption and access controls for PII in Marine Corps systems.
• MCO P1070.12K Individual Records Administration Manual. OMPF records handling and access rules.
• JAGMAN Appendix A-2-i. Privacy Act Statement format for command investigation interviews.

Status

Public law enacted 31 December 1974, codified at 5 U.S.C. § 552a. Amended multiple times, most significantly by the Computer Matching and Privacy Protection Act of 1988 and subsequent amendments. Current text maintained by the Office of the Law Revision Counsel, U.S. House of Representatives.