This list of Federal statutes is generally organized in descending order of approximate relative importance of these laws to the work in the ISE. Staff at State, local and tribal fusion centers will find these Federal authorities useful in understanding the constraints upon Federal colleagues and Federal information systems. This list does not contain all possibly relevant Federal statutes. State laws are not covered.
 

• Privacy Act of 1974
  • Computer Matching and Privacy Act of 1988 (Amended the Privacy Act)
• The National Security Act of 1947
• Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act)
• Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA)
• Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 Commission Act)
• Title III of the Omnibus Crime Control and Safe Streets Act of 1968 (Wiretap Act)
• Electronic Communications Privacy Act (ECPA)
• The Foreign Intelligence Surveillance Act of 1978 (FISA)
• E-Government Act of 2002
  • Federal Information Security Management Act (FISMA) 
• The Communications Act of 1934
• Paperwork Reduction Act
  • Information Quality Act 

Privacy Act of 1974, 5 U.S.C. § 552a

Background. “The historical context of the Act is important to an understanding of its remedial purposes: In 1974, Congress was concerned with curbing the illegal surveillance and investigation of individuals by federal agencies that had been exposed during the Watergate scandal; it was also concerned with potential abuses presented by the government’s increasing use of computers to store and retrieve personal data by means of a universal identifier — such as an individual’s social security number.” Dept. of Justice, Overview of the Privacy Act of 1974, 2010 Edition. Also see GAO reports on Federal Agency Efforts to Encrypt Sensitive Information, Protecting Personally Identifiable Information (PII), Alternatives for Enhancing Protection of PII, and Key Privacy Challenges Facing Federal Agencies.
 

General Provisions. “Broadly stated, the purpose of the Privacy Act is to balance the government’s need to maintain information about individuals with the rights of individuals to be protected against unwarranted invasions of their privacy stemming from federal agencies’ collection, maintenance, use, and disclosure of personal information about them…. The Act focuses on four basic policy objectives:

1. To restrict disclosure of personally identifiable records maintained by agencies.
2. To grant individuals increased rights of access to agency records maintained on them.
3. To grant individuals the right to seek amendment of agency records maintained on themselves upon a showing that the records are not accurate, relevant, timely, or complete.
4. To establish a code of 'fair information practices' which requires agencies to comply with statutory norms for collection, maintenance, and dissemination of records.” Dept. of Justice, Overview of the Privacy Act of 1974, 2010 Edition.

Amendments. The Privacy Act was amended by the Computer Matching and Privacy Act of 1988. Congress later enacted the Computer Matching and Privacy Protection Amendments of 1990 (Pub. L. No. 101-508), which further clarified the due process provisions found in subsection (p). Dept. of Justice, Overview of the Privacy Act of 1974, 2010 Edition.

Privacy and Other Civil Liberties Implications. The Privacy Act “protects certain federal government records pertaining to individuals. In particular, the Act covers systems of records that an agency maintains and retrieves by an individual’s name or other personal identifier (e.g., social security number)…. In general, the Privacy Act prohibits unauthorized disclosures of the records it protects. It also gives individuals the right to review records about themselves, to find out if these records have been disclosed, and to request corrections or amendments of these records, unless the records are legally exempt.” Federal Trade Commission summary of the Privacy Act. The agency has ten days to either make the correction or to notify the requestor that the correction will not be made. 5 U.S.C. § 552a(d).

Exemptions to the Privacy Act protections are allowed for:

• the Census Bureau,
• the Bureau of Labor Statistics,
• routine uses (referring to external sharing of information outside the agency)
• archival purposes if the record has sufficient historical value,
• law enforcement purposes,
• congressional investigations, and
• other administrative purposes. 5 U.S.C. § 552a(b).

The Act requires agencies to “keep an accurate accounting” of information disclosures, except when the disclosure is made within the agency for routine administrative uses or made under the Freedom of Information Act (FOIA). The Act requires “each agency that maintains a system of records” to restrict the collection of information to only the information relevant to the purpose, to ensure the information remains accurate, to collect information directly from the subject whenever possible, and to tell the subject the purpose for which the information is being collected and the authority under which it is being collected. 5 U.S.C. § 552a(e).