What is the government's obligation to protect my personal data it collects?

What the Law Says

The Privacy Act of 1974 establishes binding rules for how federal agencies collect, maintain, use, and disseminate personally identifiable information (PII) about individuals.

The Act applies to federal agencies that maintain systems of records—collections of records from which information is retrieved by an individual's name or other personal identifier. It gives individuals rights to access and amend their records, and imposes duties on agencies to ensure data integrity and confidentiality.

Agencies must publish notices in the Federal Register describing each system of records, obtain consent before disclosing records to third parties (with limited exceptions), maintain records only if relevant and necessary, and protect records from unauthorized access or disclosure.

The law also requires agencies to establish appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of records.

Statutory Text

No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains.

— Privacy Act of 1974, 5 U.S.C. § 552a(b) — Conditions of disclosure

Statutory Text

Each agency that maintains a system of records shall… (1) maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or by executive order…

— Privacy Act of 1974, 5 U.S.C. § 552a(e)(1) — Authority and purpose

Sources