Privacy act access expanded for electronic records

Privacy act access expanded for electronic records

07/17/95

WASHINGTON, D.C.–A federal District Court in Washington D.C. extended Privacy Act rights to cover federal records containing information about individuals if the records can be located by searching electronic databases for personal names or identifiers.

In late May, Judge Thomas Flannery said the Privacy Act kicks in whenever records about an individual can be located through a computerized search.

Judge Flannery rejected interpretations of the Privacy Act regarding paper records that have said the Act covers only records within systems of records that can be retrieved and are retrieved by a name or personal identifier. He said as long as an agency is capable of retrieving a record by name or personal identifier in a computerized search, the Privacy Act applies.

The decision came as the result of a Privacy Act lawsuit brought by Wanda Henke, a contact for Dynamic In Situ Geotechnical Testing, Inc. Dynamic had applied unsuccessfully for a Department of Commerce grant to help fund high-risk but powerful new technologies. Henke wanted the agency to conduct a computerized search for her name, and allow her access to records that would appear. Those records would give Henke a reference to the file regarding Dynamic’s failed application.

The court said that, under the Privacy Act, Henke may have access to the company’s file, including peer review records, because it is referenced under her name in the database.

If regarded as a precedent, the ruling would expand the Privacy Act rights of individuals to discover and correct information about themselves in government files. The Privacy Act also confers a right of individuals that is not addressed in this case, a right to challenge improper government disclosures of information regarding them.

In the past the Privacy Act, enacted in 1974 when information was generally located only through searches of paper records, applied only to records within a system of records retrievable and retrieved by name or personal identifier.

Information about an individual that could be located in another file, such as a subject matter file or a file of another person, was not previously covered by the Act. As one court noted, if an agency could only locate a record because someone remembered where it was, or by rummaging through the files, the Privacy Act did not apply.

Although previous rulings on the Privacy Act generally have applied to paper records, the judge noted Congress’ concern at passage of the Act that the use of computers and sophisticated technology “had greatly magnified the harm to individual privacy.” (Wanda Henke v. Department of Commerce)