United States. Sectoral privacy. Act
Privacy ActPrivacy Act of 1974 (5 U.S.C. § 552a)
In force
§1Summary
- Synopsis
Governs how federal agencies collect, maintain, use and disclose records about individuals held in 'systems of records'. Requires public notice of record systems, limits disclosures without consent, and gives individuals access and amendment rights.
- Key themes
- Unique features
Applies only to federal agencies; rights originally limited to US citizens and permanent residents, partly extended to EU citizens by the Judicial Redress Act.
- SaaS relevance
Caught indirectly when a SaaS provider operates a system of records on behalf of a federal agency under contract (contractor clause, 5 U.S.C. 552a(m)).
§2Obligations
- Extraterritorial
- No
- Breach notification
- None in statute (OMB M-17-12 governs agency breaches)
- DPO
- Conditional
- Cross-border transfers
- None
- Maximum penalty
- Actual damages (min. $1,000) in civil suits; misdemeanour fines up to $5,000
§3Dates
- Key dates
- Adopted
- In force
- Computer Matching and Privacy Protection Act 1988 amendments; Judicial Redress Act 2015 extended certain remedies to citizens of designated countries (incl. EU).
§4Text and authority
- Text
- Authoritative text uscode.house.gov
- Authority
- Federal agencies; DOJ Office of Privacy and Civil Liberties (guidance); OMB
§5Where it applies
- Domestic law of
- United States
- Also applies in
- Alabama
- Alaska
- Arizona
- Arkansas
- California
- Colorado
- Connecticut
- Delaware
- District of Columbia
- Florida
- Georgia
- Guam
- Hawaii
- Idaho
- Illinois
- Indiana
- Iowa
- Kansas
- Kentucky
- Louisiana
- Maine
- Maryland
- Massachusetts
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nebraska
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- New York
- North Carolina
- North Dakota
- Ohio
- Oklahoma
- Oregon
- Pennsylvania
- Puerto Rico
- Rhode Island
- South Carolina
- South Dakota
- Tennessee
- Texas
- US Virgin Islands
- Utah
- Vermont
- Virginia
- Washington
- West Virginia
- Wisconsin
- Wyoming
§6Sources and verification
- Sources consulted
- Verification
High confidence.
dpo_required Conditional: agencies must designate Senior Agency Officials for Privacy under OMB policy, not the Act itself.