PROTECTING INDIVIDUAL PRIVACY IN FEDERAL GATHERING, USE AND DISCLOSURE OF INFORMATION

SEPTEMBER 26, 1974.-Ordered to be printed

Mr. ERVIN, from the Committee on Government Operations,
submitted the following

REPORT

[To accompany S. 3418]

The Committee on Government Operations, to which was referred the bill (S. 3418) to establish a Federal Privacy Board to oversee the gathering and disclosure of information concerning individuals, to provide management systems in Federal agencies, State and local governments, and other organizations regarding such information, and for other purposes, having considered the same, reports favorably thereon with an amendment in the nature of a substitute and an amended title and recommends that the bill as amended do pass.

PURPOSE

The purpose of S. 3418, as amended, is to promote governmental respect for the privacy of citizens by requiring all departments and agencies of the executive branch and their employees to observe certain constitutional rules in the computerization, collection, management, use, and disclosure of personal information about individuals.

It is to promote accountability, responsibility, legislative oversight, and open government with respect to the use of computer technology in the personal information systems and data banks of the Federal Government and with respect to all of its other manual or mechanized files.

It is designed to prevent the kind of illegal, unwise, overbroad, investigation and record surveillance of law-abiding citizens produced in recent years from actions of some over-zealous investigators, and the curiosity of some government administrators, or the wrongful disclosure and use, in some cases, of personal files held by Federal agencies.

It is to prevent the secret gathering of information on people or the creation of secret information systems or data banks on Americans by employees of the departments and agencies of the executive branch. It is designed to set in motion for long-overdue evaluation of the needs of the Federal Government to acquire and retain personal information on Americans, by requiring stricter review within agencies of criteria for collection and retention.

It is also to promote observance of valued principles of fairness and individual privacy by those who develop, operate, and administer other major institutional and organizational data banks of government and society.

S. 3418 ACCOMPLISHES THESE PURPOSES IN FIVE MAJOR WAYS

First, it requires agencies to give detailed notice of the nature and uses of their personal data banks and information systems and their computer resources. It requires a new Privacy Commission to maintain and publish an information directory for the public, to examine executive branch proposals for new personal data banks and systems, and to report to Congress and the President if they adversely affect privacy and individual rights. It penalizes those who keep secret such a personal information system or data bank.

Second, the bill establishes certain minimum information-gathering standards for all agencies to protect the privacy and due process rights of the individual and to assure that surrender of personal information is made with informed consent or with some guarantees of the uses and confidentiality of the information. To this end, it charges agencies:

To collect, solicit and maintain only personal information that is relevant and necessary for a statutory purpose of the agency; To prevent hearsay and inaccuracies by collecting information directly from the person involved as far as practicable;

To inform people requested or required to reveal information about themselves whether their disclosure is mandatory or voluntary, what uses and penalties are involved, and what confidentiality guarantees surround the data once government acquires it; and

To establish no program for collecting or maintaining information on how people exercise First Amendment rights without a strict reviewing process.

Third, the bill establishes certain minimum standards for handling and processing personal information maintained in the data banks and systems of the executive branch, for preserving the security of the computerized or manual system, and for safeguarding the confidentiality of the information. To this end, it requires every department and agency to insure, by whatever steps they deem necessary:

That the information they keep, disclose, or circulate about citizens is as accurate, complete, timely, and relevant to the agency's needs as possible;

That they refrain from disclosing it unless necessary for employee duties, or from making it available outside the agency

without the consent of the individual and proper guarantees, unless pursuant to open records laws, or unless it is for certain law enforcement or other purposes;

That they take certain administrative actions to keep account of the employees and people and organizations who have access to the system or file, and to keep account of the disclosures and uses made of the information;

That they establish rules of conduct with regard to the ethical and legal obligations in developing and operating a computerized or other data system and in handling personal data, and take action to instruct all employees of such duties;

That they not sell or rent the names and addresses of people whose files they hold; and

That they issue appropriate administrative orders, provide personnel sanctions, and establish appropriate technical and physical safeguards to insure the security of the information system and the confidentiality of the data.

Fourth, to aid in the enforcement of these legislative restraints, the bill provides administrative and judicial machinery for oversight and for civil remedy of violations: To this end, the bill:

Gives the individual the right, with certain exceptions, to be told upon request whether or not there is a government record on him or her, to have access to it, and to challenge it with a hearing upon request, and with judicial review in Federal Court;

Establishes an independent Privacy Protection Commission with subpoena power and authority to receive and investigate charges of violations of the Act and report them to the proper officials; to develop model guidelines and assist agencies in implementing the Act; and to alert the President and Congress to proposed Federal information programs and data banks which deviate from the standards and requirements of the Act; and

Judicial remedies allow the enforcement of the act through the courts by individuals and organizations in civil actions challenging denial of access to personal information or through suits by the Attorney General or any aggrieved person to enjoin violations or threatened violations of the Act.

Fifth, the bill requires the Commission to make a study of the major data banks and computerized information systems of other governmental agencies and of private organizations and to recommend any needed changes in the law governing their practices or the application of all or part of this legislation in order to protect the privacy of the individual.

BACKGROUND

The Committee on Government Operations' ad hoc Subcommittee on Privacy and Information Systems conducted hearings on June 18, 19, and 20, 1974, to consider S. 3418, cosponsored by Senators Ervin, Percy, Muskie, and Ribicoff. The hearings were held jointly with the

Judiciary Committee's Subcommittee on Constitutional Rights which was considering the following legislation on related issues:

S. 2810, introduced by Senator Goldwater, to protect the constitutional right of privacy of individuals concerning whom identifying numbers or identifiable information is recorded by enacting principles of information practice in furtherance of amendments I, III, IV, X, and XIV of the U.S. Constitution;

S. 2542, introduced by Senator Bayh to protect the constitutional right of privacy of those individuals concerning whom records are maintained; and

S. 3116, introduced by Senator Hatfield, to protect the individual's right to privacy by prohibiting the sale or distribution of certain information.

COMMITTEE OVERSIGHT

These hearings continued the oversight by the Government Operations Committee of the development and proper management of automated data processing in the Federal Government and its concern for the effect on Federal-State relations of national and intergovernmental data systems involving electronic and manual transmission, sharing, and distribution of personal information about citizens.

Senator Ervin announced the joint hearings as Chairman of both subcommittees, in a Senate speech on June 11 in which he summarized the issues and described some of the complaints from citizens which have been received by Members of Congress, as follows:

It is a rare person who has escaped the quest of modern government for information. Complaints which have come to the Constitutional Rights Subcommittee and to Congress over the course of several administrations show that this is a bipartisan issue which effects people in all walks of life. The complaints have shown that despite our reverence for the constitutional principles of limited Government and freedom of the individual, Government is in danger of tilting the scales against those concepts by means of its informationgathering tactics and its technical capacity to store and distribute information. When this quite natural tendency of Government to acquire and keep and share information about citizens is enhanced by computer technology and when it is subjected to the unrestrained motives of countless political administrators, the resulting threat to individual privacy make it necessary for Congress to reaffirm the principle of limited, responsive Government on behalf of freedom.

The complaints show that many Americans are more concerned than ever before about what might be in their records because Government has abused, and may abuse, its power to investigate and store information.

They are concerned about the transfer of information from data bank to data bank and black list to black list because they have seen instances of it.

They are concerned about intrusive statistical questionnaires backed by the sanctions of criminal law or the threat of it because they have been subject to these practices over a number of years.