Numerous representatives of private organizations and of business and industry opposed the total coverage of the bill, citing the lack of hearing record, the existing requirements of the Fair Credit Reporting Act, and prohibitive costs of implementing S. 3418 in the private sector without passing on the costs in consumer services. Most indicated support for or lack of opposition to, a commission study of privacy invasions by the private sector.

RIGHT OF ACCESS AND CHALLENGE

The Committee believes that the size of the Federal Government, the sheer number of personal records it must handle, and the growing complexities of information technology require that the full protections against abuses of the power of government to affect the privacy of the individual and the confidentiality of personal information must depend in part upon the participation of the individual in monitoring the maintenance and disclosure of his own file.

To this end, we agree with the members of numerous respected study bodies that an individual should have the right to discover if he is the subject of a government file, to be granted access to it, to be able to assure the accuracy of it, and to determine whether the file has been abused by improper disclosure.

The Committee agrees with the conclusion of one government study that "In the majority of cases, the citizen's right of access to information kept on him by the Federal Government will not interfere with the ongoing program of the agency. In addition, giving the individual a right of access often will be a desirable adjunct to any other system designed to insure file accuracy."

Furthermore, the Committee adopts the timely observation of one scholar from the Council on Science of Technology study that "giving the individual maximum ability to examine what the Government knows on the person should help promote citizen confidence in activities of the Federal Government and is essential to assure that notions of due process are employed when decisions are made on the basis of personal information."

So important does the Committee consider procedures required by the bill on this matter that it is determined that any exemptions from such provisions sought under the rule-making scheme of the bill must be kept to an absolute minimum and must not be made on the basis of parochial agency concerns. It finds support for this stand in the conclusion of the report of the HEW Secretary's Advisory Committee on Automated Personal Data Systems that:

No exemption from or qualification of the right of data
subjects to have full access to their records should be granted
unless there is a clearly paramount and strongly justified
societal interest in such exemption or qualification.
The instances in which it can be convincingly demonstrated
that there is a paramount society interest in depriving an
individual of access to data about himself would seem to be
rare. (p. 61, Report.);

The exemptions allowed from observance of these standards are for three purposes only, national defense and foreign policy and

certain law enforcement investigative and intelligence matters where access and challenge rights are found to damage the purpose for which the information was collected.

The Committee recognizes that while many agencies afford such rights, many agencies deny them with respect to certain files. Allowing only these narrow areas for exemption may well promote the reassessment of existing practices whereby individuals are deprived of full access to records about themselves, and some agencies, in the year before the Act takes effect, may well see fit to seek special legislation permitting special treatment of certain files they hold. Meanwhile, the Committee is persuaded by the language of the HEW report:

Many organizations are likely to argue that it is not in the interest of their data subjects to have full access. Others may oppose full access on the grounds that it would disclose the content of confidential third-party recommendations or reveal the identity of their sources. Still others may argue that full access should not be provided because the records are the property of the organization maintaining the data system. Such objections, however, are inconsistent with the principle of mutuality necessary for fair information practice.

The relevance of the rights of access and challenge to the principle of accountability in government, to efficient achievement of management goals and to a public sense of social justice is recognized in a 1970 report made by the Project SEARCH group to the Justice Department. That report called for a citizen's right to access and challenge to certain law enforcement records, but it stated the following reasons for its conclusions which the committee finds worthy of general application:

First, an important cause of fear and distrust of computerized data systems has been the feelings of powerlessness they provoke in many citizens. The computer has come to symbolize the unresponsiveness and insensitivity of modern life. Whatever may be thought of these reactions, it is at least clear that genuine rights of access and challenge would do much to disarm this hostility.

Second, such rights promise to be the most viable of all the possible methods to guarantee the accuracy of data systems. Unlike more complex internal mechanisms, they are triggered by the most powerful and consistent of motives, individual self-interest.

Finally, it should now be plain that if any future system is to win public acceptance, it must offer persuasive evidence that it is quite seriously concerned with the rights and interests of those whose lives it will record. The committee can imagine no more effective evidence than authentic rights of access and challenge.1

1 Project SEARCH, Committee on Security and Privacy, Technical Report No. 2, July 1970, p. 28.

LAW ENFORCEMENT FILES

Title II of S. 3418 sets general standards of fair records keeping which apply to practically all government files, including those maintained by law enforcement agencies. Although various committees of the Congress have been considering legislation which specifically addresses confidentiality of law enforcement files, the Committee is of the view that prospects for that legislation is sufficiently unclear so that S. 3418 should apply in its general terms to such files until such time as the law enforcement privacy legislation is enacted.

Therefore the Committee decided that, to the extent feasible, S. 3418 should apply to law enforcement files but that such application should not be inconsistent with the two major criminal justice privacy bills, introduced early this year, S. 2963 by Senator Ervin and S. 2964 by Senator Hruska on behalf of the administration. S. 3418 as amended by the Committee would apply the general standards of title II, including the general updating and accuracy requirements and provisions affording right of access to most law enforcement files.

The Committee recognizes, however, that there are two general classes of files maintained by agencies with law enforcement functions, criminal history or record files on the one hand and intelligence and investigative files on the other. The first class of information, defined for the purposes of S. 3418 as "criminal history information" includes routine records of arrests and court dispositions sometimes called rap sheets. As a general principle these records are subject to all the requirements of title II including the right of access provision. This is entirely consistent with both the Ervin and administration criminal justice privacy legislation. Indeed, Director Kelly of the FBI, in testimony before the Subcommittee on Constitutional Rights, expressed support for the general access and challenge provisions contained in the two criminal justice privacy bills and replicated in

S. 3418:

These bills provide for an individual to obtain access to
his own criminal offender record, and also provide pro-
cedures for him to challenge that record. I support these
provisions. Currently, the FBI provides copies of offender
record information . .

As for the other general provisions of title II, none of these provisions are inconsistent with the criminal justice privacy legislation in particular as they apply to criminal history information. Furthermore, S. 3418 permits each agency to promulgate its own regulations implementing the Act and this should provide sufficient flexibility so that the Attorney General will not undermine good law enforcement practices in promulgating regulations. Indeed, since early this year the Justice Department has been drafting regulations which address most of the basic issues raised by S. 3418. Those regulations set certain standards for the operation of any routine exchange of criminal history information by the FBI and for the funding of criminal history record systems on the State and local level by the Law Enforcement Assistance Administration. Although the Justice Department might have to

The Senate Subcommittee on Constitutional Rights and House Subcommittee on Civil Rights and Constitutional Rights.

carefully review these regulations, if this legislation is passed, their scope and thrust are essentially what would be required of the Department of Justice by this legislation.

The second class of information generally maintained by law enforcement agencies are intelligence, or investigative files. These files contain highly sensitive and usually confidential information collected by law enforcement officers in anticipation of criminal activity, such as by organized crime figures, or in the course of investigating criminal activity which has already occurred. It was the Committee's judgment, shared by most criminal justice privacy experts and reflected in the pending criminal justice privacy legislation, that all of the provisions of title II of S. 3418 could not be applied to such sensitive information. In particular, it would not be appropriate to allow individuals to see their own intelligence or investigative files. Therefore, the bill exempts such information from access and challenge requirements of title II. However, most of the other general accuracy and updating provisions would apply, subject, of course, to the rules and regulations issued by the agency head in the course of implementing such provisions.

Obviously, these general provisions on law enforcement records are not entirely adequate. The two criminal justice privacy bills address this subject in considerable detail and are the result of at least two years of careful study and revision by the Subcommittee on Constitutional Rights and the Justice Department. However, the Committee feels that general privacy legislation must assure subjects of law enforcement files at least these minimal rights until such time as the more comprehensive criminal justice legislation is passed.

PRIVACY PROTECTION COMMISSION

It is clear that many of the information abuses over the last decade could have been avoided with the help of an independent body of experts charged with protecting individual privacy as a value in government and society.

Commentators on privacy for years have also cited the need for such an agency to help deal in a systematic fashion with the great range of administrative and technological problems throughout the many agencies of the Federal Government.

Title I of S. 3418, as amended, establishes a Privacy Protection Commission composed of five experts in law, social science, computer technology, and civil liberties, business, and State and local government and supported by a professional staff. The Commission would be empowered to:

Monitor and inspect Federal systems and data banks containing information about individuals;

Compile and publish an annual U.S. Information Directory so that citizens and Members of Congress will have an accurate source of up-to-date information about the personal datahandling practices of Federal agencies and the rights, if any, of citizens to challenge their contents;

Develop model guidelines for implementation of this act and assist agencies and industries in the voluntary development of fair information practices;

Investigate and hold hearings on violations of the Act, and recommend corrective action to the agencies, Congress, the President, the General Accounting Office, and the Office of Management and Budget;

Investigate and hold hearings on proposals by Federal agencies to create new personal information systems or modify existing systems for the purpose of assisting the agencies, Congress, and the President in their effort to assure that the values of privacy, confidentiality, and due process are adequately safeguarded; and

Make a study of the state of the law governing privacyinvading practices in private data banks and in State and local and multistate data systems.

NEED FOR A PRIVACY PROTECTION UNIT

There is an urgent need for a permanent staff of experts within the Federal Government to inform Congress and the public of the datahandling practices of major governmental and private personal information systems. As a recent study by the Judiciary Subcommittee on Constitutional Rights graphically demonstrates, there has been a proliferation of Federal information systems and data banks which, if misused, can do irreparable harm to the privacy and economic wellbeing of millions of persons. "Data Banks and a Free Society," the study done for the National Academy of Sciences by Professors Alan F. Westin and Michael A. Baker, similarly demonstrates such harm inherent in large personal information systems maintained at all levels of government and by private industry.

Although recent attempts to turn Federal tax records into weapons of political and personal revenge have come to light, along with many other record abuses, the major threat to most Americans lies in the inadvertent, careless, and unthinking collection, distribution, and storage of records which may be inaccurate, incomplete, or irrelevant to legitimate governmental needs. This threat has grown tremendously as developments in telecommunications, photocopying, and computer technology have accelerated and with expanded dataswapping among government agencies and throughout private industry.

It is now clear that Congress, with its limited technical staff and multitude of functions, cannot keep track of these developments in every Federal agency and for every data bank with the depth of detail required for consistently constructive policy analysis. The Constitutional Rights Subcommittee data bank study and other agency-byagency studies have each taken years to complete, and have documented the frustrations of agency delays, withholding of data, and camouflage of governmental activities. Citizens also have no place to turn to find out which agencies or companies maintain, distribute, and use personal information about them. Agencies and businesses would similarly benefit from the existence of an authoritative source of information about their record-keeping practices which would protect them from misinformed and inflamatory criticism.

In addition, there is an urgent need for a staff of experts somewhere in government which is sensitive both to the privacy interests of citizens and the informational needs of government and which can furnish expert assistance to both the legislative and executive branches.