Glossary
Privacy Act Acronyms and Definitions
Executive department, military department, or other executive branch or independent regulatory agency, or contractors operating a system of records (if provided for by the contract). Published by the Office of the Federal Register, National Archives and Records Administration (NARA), the Federal Register is the official daily publication for rules, proposed rules, and notices of Federal agencies and organizations, as well as executive orders and other presidential documents. U.S. citizen or legal alien. Any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual's identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual. Privacy Impact Assessment. The PIA is an analysis tool designed to identify any privacy risks associated with information that is collected, processed, stored, and transmitted by an IT system. Privacy Act of 1974, as amended (5 U.S.C. 552a). The purpose of the Privacy Act is to balance the government's need to maintain information about individuals with the rights of individuals to be protected against unwarranted invasions of their privacy stemming from federal agencies' collection, maintenance, use, and disclosure of personal information about them. Any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph. 5 U.S.C. § 552a (a)(4). with respect to the disclosure of a record, the use of such record for a purpose which is compatible with the purpose for which it was collected." Required publication in the Federal Register of "each routine use of the records contained in the system, including the categories of users and the purpose of such use." System of Records Notice. The Privacy Act requires agencies to publish notices or rules in the Federal Register in the following circumstances: when adopting a new or altered system of records, when adopting a routine use, when adopting an exemption for a system of records. Privacy Act System of Records. A set or subset of records under the control of HHS containing personal information (including, but not limited to, education, financial transactions, medical history, and criminal or employment history which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual." 5 U.S.C. § 552a(a)(5). “Any information the loss, misuse, or unauthorized access to or modification of which could adversely affect that national interest of the conduct of Federal programs or the privacy to which individuals are entitled under the Privacy Act, but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy.” (Computer Security Act of 1987) Information in an IT system or online collection: (i) that directly identifies an individual (e.g., name, address, social security number or other identifying number or code, telephone number, email address, etc.) or (ii) by which an agency intends to identify specific individuals in conjunction with other data elements, i.e., indirect identification. (These data elements may include a combination of gender, race, birth date, geographic indicator, and other descriptors. The agency official who is responsible for the system of records. The responsibility includes the policies and practices governing the system described, including the title and business address of the agency official where individuals must deal directly in order to exercise their rights under the Act, e.g., make inquiries, access, or seek correction of records. (instances in which information may be disclosed without consent of the subject individual or the application of a Routine Use) - 5 U.S.C. § 552a(b)(1) ("need to know" within agency)
 - 5 U.S.C. § 552a(b)(2) (required FOIA disclosure)
- 5 U.S.C. § 552a(b)(3) (routine uses)
- 5 U.S.C. § 552a(b)(4) (Bureau of the Census)
- 5 U.S.C. § 552a(b)(5) (statistical research)
- 5 U.S.C. § 552a(b)(6) (National Archives)
- 5 U.S.C. § 552a(b)(7) (law enforcement request)
- 5 U.S.C. § 552a(b)(8) (health or safety of an individual)
- 5 U.S.C. § 552a(b)(9) (Congress)
- 5 U.S.C. § 552a(b)(10) (General Accounting Office)
- 5 U.S.C. § 552a(b)(11) (court order)
- 5 U.S.C. § 552a(b)(12) (Debt Collection Act)
Note that with the exception of disclosures under subsection (b)(2) (required under FOIA), disclosures under the remaining exceptions are permissive, not mandatory. |
Print 
Download Reader 
Contact Us