Skip to main content

Overview of the Privacy Act of 1974


Social Security Number Usage

Section 7 of the Privacy Act (found at 5 U.S.C. § 552a note (Disclosure of Social Security Number)) provides that:

“It shall be unlawful for any Federal, State or local government agency to deny to any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose his social security account number.”  Sec. 7(a)(1).

Comment:

Note that although this provision applies beyond federal agencies, it does not apply to:  (1) any disclosure which is required by federal statute; or (2) any disclosure of a social security number to any federal, state, or local agency maintaining a system of records in existence and operating before January 1, 1975, if such disclosure was required under statute or regulation adopted prior to such date to verify the identity of an individual.  See Sec. 7(a)(2)(A)-(B).

Note also that the Tax Reform Act of 1976, 42 U.S.C. § 405(c)(2)(C)(i), (iv) (2006), expressly exempts state agencies from this restriction to the extent that social security numbers are used “in the administration of any tax, general public assistance, driver’s license, or motor vehicle registration law within its jurisdiction.”  See, e.g., Peterson v. City of Detroit, 76 F. App’x 601, 602 (6th Cir. 2003) (asserting that 42 U.S.C. § 405(c)(2)(C)(i) “permits states to require disclosure of social security numbers in the administration of its driver’s license law[,] . . . § 7 of the Privacy Act, insofar as it relates to the ‘privilege’ at issue in this case [(denial of plaintiff’s application for taxicab license)], has been superseded”); Stoianoff v. Comm’r of the DMV, 12 F. App’x 33, 35 (2d Cir. 2001) (finding that plaintiff’s Privacy Act claim would fail because § 405(c)(2)(C)(i) “expressly authorizes states to require the disclosure of social security numbers in the administration of driver’s license programs” and further provides that “any federal law that conflicts with this section is ‘null, void, and of no effect’”); Peterson v. Michigan, No. 11-12153, slip op. at 4 (E.D. Mich. May 27, 2011) (citing Peterson v. City of Detroit and stating that 42 U.S.C. § 405(c)(2)(C)(i) “supersedes § 7 of the Privacy Act”); Claugus v. Roosevelt Island Hous. Mgmt. Corp., No. 96CIV8155, 1999 WL 258275, at *4 (S.D.N.Y. Apr. 29, 1999) (considering housing management corporation to be state actor for Privacy Act purposes but finding that Privacy Act does not apply to income verification process for public housing program because of exception created by 42 U.S.C. § 405(c)(2)(C)(i)).  Exemption from the social security number provisions of the Privacy Act is also provided for certain other government uses.  See, e.g., 42 U.S.C. § 405(c)(2)(C)(ii) (authorizing state use of social security numbers in issuance of birth certificates and for purposes of enforcement of child support orders); 42 U.S.C. § 405(c)(2)(C)(iii) (authorizing use of social security numbers by Secretary of Agriculture in administration of Food Stamp Act of 1977 and by Federal Crop Insurance Corporation in administration of Federal Crop Insurance Act).

“Any Federal, State or local government agency which requests an individual to disclose his social security account number shall inform that individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.”  Sec. 7(b).

Comment:

Jurisdiction to enforce the social security number provision might appear questionable inasmuch as the Privacy Act does not expressly provide for a civil remedy against a nonfederal agency, or for injunctive relief outside of the access and amendment contexts.  In fact, two courts of appeals have held that section 7 of the Privacy Act applies exclusively to federal agencies and does not provide for causes of action against state and local entities.  See Schmitt v. City of Detroit, 395 F.3d 327, 329-30 (6th Cir. 2005) (noting Privacy Act’s “inherently inconsistent” treatment of “agencies” as only federal agencies in subsection (a)(1) and as including “Federal, State, or local government” bodies in section 7 and, after looking to legislative history, ultimately holding that Privacy Act applies only to federal agencies); Dittman v. Cal., 191 F.3d 1020, 1026 (9th Cir. 1999) (holding that Privacy Act provides no cause of action against a state licensing entity inasmuch as the private right of civil action created by subsection (g) “is specifically limited to actions against agencies of the United States Government”); see also Peterson v. Michigan, No. 11-12153, slip op. at 3-4; Dionicio v. Allison, No. 3:09-cv-00575, 2010 WL 3893816, at *18 (M.D. Tenn. Sept. 30, 2010); Treesh v. Cardaris, No. 2:10-CV-437, 2010 WL 3603553, at *3 (S.D. Ohio Sept. 9, 2010).                                                              

However, the Courts of Appeals for the Eleventh Circuit and the Seventh Circuit, when faced with this issue, have both held that the remedial scheme of section 3 of the Privacy Act, which applies strictly to federal agencies, does not apply to section 7, which governs social security number usage.  See Gonzalez v. Vill. of W. Milwaukee, 671 F.3d 649, 661-63 (7th Cir. 2012); Schwier v. Cox, 340 F.3d 1284, 1292 (11th Cir. 2003).  In Schwier, the Eleventh Circuit concluded that “Congress created an ‘unambiguously conferred right’ in section 7 of the Privacy Act,” and it reasoned that section 7 may be enforced under 42 U.S.C. § 1983, which “provides a private right of action whenever an individual has been deprived of any constitutional or statutory federal right under color of state law” as “the remedial scheme of section 3 provides no basis for concluding that Congress intended to preclude private remedies under § 1983 for violations of section 7.”  Schwier, 340 F.3d at 1289-90, 1292.  Following the Eleventh Circuit’s reasoning in Schwier, the Seventh Circuit in Gonzalez found “no conflict between §§ 3 and 7 [of the Privacy Act]” as “it seems clear that when § 3(a)(1) defines agencies as federal agencies ‘for purposes of this section,’ it refers only to § 3 . . . .  Accordingly, there is no need to look beyond the unambiguous text of § 7 to determine its applicability.  By its express terms, § 7 applies to federal, state, and local agencies.”  Gonzalez, 671 F.3d at 662.  See also Lanzetta v. Woodmansee, No. 2:13-cv-276, 2013 WL 1610508, at *2 (M.D. Fla. Apr. 15, 2013) (following Schwier and stating “[a]n individual may also pursue enforcement of his privacy rights under Section 7 of the Privacy Act pursuant to [42 U.S.C. § 1983]; cf. Lawson v. Shelby Cnty., Tenn., 211 F.3d 311, 335 (6th Cir. 2000) (holding that “Congress never expressly abrogated state sovereign immunity under the Privacy Act”; however, permitting plaintiffs’ request for prospective injunctive relief [to enforce section 7 of the Privacy Act] against [state] officials” under Ex Parte Young, 209 U.S. 123 (1908)); Warner v. Twp. of S. Harrison, Civ. No. 09-6095, 2010 WL 3001969, at *4 (D.N.J. July 26, 2010) (dismissing plaintiff’s section 7(b) claim against Township because “Plaintiff’s real complaint is Defendant’s widespread, and apparently unjustifiable, dissemination of his social security number to the public . . . [which is] not covered by Section 7(b), but instead by Section 3.  Section 3, however, does not apply to state and local agencies.”); Ingerman v. Del. River Port Auth., 630 F. Supp. 2d 426, 445 (D.N.J. 2009) (ruling that Port Authority’s requirement that social security number had to be submitted to receive a senior citizen “E-Z Pass” violated section 7, which was enforceable under Ex Parte Young); Szymecki v. Norfolk, No. 2:08cv142, 2008 WL 4223620, at *9 (E.D. Va. Sept. 11, 2008) (concluding that “because Section 7 confers a legal right on individuals and because Congress did not specifically foreclose a remedy under [42 U.S.C.] § 1983 for violations of Section 7 . . . violations of Section 7 are enforceable under § 1983”); Stollenwerk v. Miller, No. 04-5510, 2006 WL 463393, at *3-7 (E.D. Pa. Feb. 24, 2006) (concluding that state statute requiring submission of social security number to purchase a handgun was invalid, as section 7 is enforceable under 42 U.S.C. § 1983).  But cf. Treesh, 2010 WL 3603553, at *3 (“[E]ven if disclosure of plaintiff’s medical information somehow violated the Privacy Act, [plaintiff] still fails to state a federal claim” because “section 1983 cannot be used to redress violations of the Privacy Act.”); Bush v. Lancaster Bureau of Police, No. 07-3172, 2008 WL 3930290, at *7-8 (E.D. Pa. Aug. 28, 2008) (concluding that “Plaintiff cannot state a claim under [42 U.S.C. § 1983] for a violation of subsection (b) of section 7 of the Privacy Act” because “[u]pon review of the th[e] statutory language, the court cannot conclude that Congress created an ‘unambiguously conferred right’” for individuals).

Other courts also have recognized implied remedies for violations of this provision’s requirements.  See Ky. Rest. Concepts, Inc. v. City of Louisville, Jefferson Cnty. Ky., 209 F. Supp. 2d 672, 687 (W.D. Ky. 2002); McKay v. Altobello, No. 96-3458, 1997 WL 266717, at *1-3, 5 (E.D. La. May 16, 1997); Yeager v. Hackensack Water Co., 615 F. Supp. 1087, 1090-92 (D.N.J. 1985); Wolman v. United States, 501 F. Supp. 310, 311 (D.D.C. 1980), remanded, 675 F.2d 1341 (D.C. Cir. 1982) (unpublished table decision), on remand, 542 F. Supp. 84, 85-86 (D.D.C. 1982); Greater Cleveland Welfare Rights Org. v. Bauer, 462 F. Supp. 1313, 1319-21 (N.D. Ohio 1978). 

For other discussions of this provision, see Schwier v. Cox, 439 F.3d 1285, 1285-86 (11th Cir. 2006) (holding that section 7(a)(2)(B) grandfather exception did not apply to Georgia voter registration procedures), aff’g 412 F. Supp. 2d 1266 (N.D. Ga. 2005), remanded by 340 F.3d at 1288-89 (explaining that although section 7 is uncodified, it is still present in the Statutes at Large and therefore is not “a dead letter”); McKay v. Thompson, 226 F.3d 752, 755 (6th Cir. 2000) (finding that Tennessee law requiring disclosure of social security number for voter registration fell within section 7(a)(2)’s exception for systems of records in existence prior to January 1, 1975, where disclosure was required under statute or regulation); Crawford v. U.S. Trustee, 194 F.3d 954, 961-62 (9th Cir. 1999) (rejecting government’s argument that because disclosure of plaintiff’s social security number was expressly required by federal statute, section 7 was wholly inapplicable, stating that “§ 7(a)(2)(A)’s exclusion for federal statutes only pertains to the limitation recited in § 7(a)(1)”; holding that section 7(b) had “no bearing on the public disclosure of [plaintiff’s] social security number[] by the government,” which was the only issue in dispute); Alcaraz v. Block, 746 F.2d 593, 608-09 (9th Cir. 1984) (finding section 7(b)’s notice provision satisfied where agency informed “participants of the voluntariness of the disclosure, the source of authority for it and the possible uses to which the disclosed numbers may be put”); Brookens v. United States, 627 F.2d 494, 496-99 (D.C. Cir. 1980) (holding agency did not violate Privacy Act because it maintained system of records “before January 1, 1975 and disclosure of a social security number to identify individuals was required under [executive order]”); McElrath v. Califano, 615 F.2d 434, 440 (7th Cir. 1980) (finding disclosure of social security number required by Aid to Families with Dependent Children program under 42 U.S.C. § 602(a)(25) (2006), regulations that give effect to that requirement are not violative of Privacy Act); Green v. Philbrook, 576 F.2d 440, 445-46 (2d Cir. 1978); Lanzetta v. Woodmansee, 2013 WL 6498403 at *3 (dismissing claim that state tax collector’s office violated Section 7(a)(1) by requiring plaintiff to furnish his social security number in order to renew his motorcycle license on ground that such disclosure was mandated by Real ID Act of 2005); Dejeu v. Wash. State Dep’t of Labor and Indus., No. C13-5401RBL, 2013 WL 5437649, at *1-2 (W.D. Wash. Sept. 27, 2013) (finding that the “State’s requirement that [p]laintiff disclose his Social Security Number in order to register [with State as a contractor] does not violate the Privacy Act” as “[social security] information is statutorily required”); Rodriguez v. Lambert, No. 12-60844, 2012 WL 4838957, at *3 (S.D. Fla. Oct. 11, 2012) (discussing “Florida statute requiring workers to list their social security number” in relation to Section 7); Peterson v. Michigan, No. 11-12153, slip op. at 4 (dismissing claim that “the State of Michigan unlawfully denied [plaintiff’s] application for renewal of his chauffeur license . . . because he refused to provide his social security number” on ground that REAL ID Act of 2005 “requires disclosure of social security numbers when obtaining drivers licenses, thereby exempting such request for disclosure from § 7(a)(1)”) (alternative holding); White v. Cain, No. 2:10-cv-01182, 2011 WL 1087489, at *6-7 (S.D. W. Va. Mar. 21, 2011) (dismissing claim brought against police officer alleging that officer violated section 7 by “requesting the plaintiff’s Social Security Number without providing the plaintiff with adequate information” on ground that “the Privacy Act is not applicable to individuals”); El-Bey v. N.C. Bd. of Nursing, No. 1:09CV753, 2009 WL 5220166, at *2 (M.D.N.C. Dec. 31, 2009) (dismissing plaintiff’s “Privacy Act/Social Security Act claim” because “Plaintiff alleges only that Defendants requested his number, not that they denied him a legal right based on its non-disclosure so as to potentially violate the Privacy Act”); GeorgiaCarry.org, Inc. v. Metro. Atlanta Rapid Transit Auth., No. 1:09-CV-594, 2009 WL 5033444, at*9-10 (N.D. Ga. Dec. 14, 2009) (finding “one or both of the [transit authority police] officer Defendants violated section 7(b)” when officers “asked [plaintiff] for his identification, firearms license, and social security number . . . .  But neither officer told [plaintiff] whether he had to provide his social security number, what authority they relied on in asking for the number, or what the number would be used for.”); Ingerman, 630 F. Supp. 2d at 439-41 (ruling that because Port Authority was publicly created and sufficiently under the joint control and guidance of governments of New Jersey and Pennsylvania, it qualified as an “agency” under section 7); Szymecki, 2008 WL 4223620, at *9 (concluding that plaintiff stated claim under section 7 where he alleged that city threatened to arrest and incarcerate him if he did not provide his social security number and that city did not inform him why it needed number or how it would be used); Lynn v. Comm’r, 80 T.C.M. (CCH) 31 (2000) (holding that agency did not violate Privacy Act, because section 151(e) of the IRS code “is a Federal statute that requires the disclosure of a dependent’s Social Security number”); Russell v. Bd. of Plumbing Exam’rs, 74 F. Supp. 2d 339, 347 (S.D.N.Y. 1999) (finding violation of section 7 and ordering injunctive relief where defendants neither informed applicants that providing social security number was optional nor provided statutory authority by which number was solicited, and no statutory authority existed); Johnson v. Fleming, No. 95 Civ. 1891, 1996 WL 502410, at *1, 3-4 (S.D.N.Y. Sept. 4, 1996) (finding no violation of either section 7(a)(1) or section 7(b) where, during course of seizure of property from plaintiff, an unlicensed street vendor, plaintiff refused to provide police officer with his social security number and officer “seized all of Plaintiff’s records rather than only ‘a bagful’ as other officers allegedly had done” on previous occasions); In re Rausch, 197 B.R. 109, 120 (Bankr. D. Nev. 1996) (holding that the Privacy Act “inapplicable” because 11 U.S.C. § 110 “requires placing the SSN upon ‘documents for filing’”); In re Floyd, 193 B.R. 548, 552-53 (Bankr. N.D. Cal. 1996) (holding that the Bankruptcy Code, 11 U.S.C. § 110(c) (2006), required disclosure of social security number, thus section 7(a) inapplicable; further stating that section 7(b) also inapplicable “even assuming the [U.S. Trustee] or the clerk of the bankruptcy court were agencies” because no “request” had been made; rather, because disclosure of social security number is required by statute, “the [U.S. Trustee] is enforcing a Congressional directive, not ‘requesting’ anyone’s SSN” and “[t]he clerk receives documents for filing but does not police their content or form or request that certain information be included”); Krebs v. Rutgers, 797 F. Supp. 1246, 1256 (D.N.J. 1992) (finding Rutgers is not a state agency or government-controlled corporation subject to Privacy Act); Greidinger v. Davis, 782 F. Supp. 1106, 1108-09 (E.D. Va. 1992) (finding a violation of the Privacy Act where state did not provide timely notice in accordance with section 7(b) when collecting social security number for voter registration), rev’d & remanded on other grounds, 988 F.2d 1344 (4th Cir. 1993); Libertarian Party v. Bremer Ehrler, Etc., 776 F. Supp. 1200, 1209 (E.D. Ky. 1991) (requiring that voter include social security number on signature petition violates Privacy Act); Ingerman v. IRS, No. 89-5396, slip op. at 3-5 (D.N.J. Apr. 3, 1991) (finding section 7(b) not applicable to IRS request that taxpayers affix printed mailing label containing social security number on tax returns; no new disclosure occurs because IRS already was in possession of taxpayers’ social security numbers), aff’d, 953 F.2d 1380 (3d Cir. 1992) (unpublished table decision); Oakes v. IRS, No. 86-2804, slip op. at 2-3 (D.D.C. Apr. 16, 1987) (finding section 7(b) does not require agency requesting individual to disclose his social security number to publish any notice in Federal Register); Doyle v. Wilson, 529 F. Supp. 1343, 1348-50 (D. Del. 1982) (finding section 7(b)’s requirements are not fulfilled when no affirmative effort is made to disclose information required under 7(b) “at or before the time the number is requested”); Doe v. Sharp, 491 F. Supp. 346, 347-50 (D. Mass. 1980) (folding Green and McElrath regarding section 7(a); finding section 7(b) creates affirmative duty for agencies to inform applicant of uses to be made of social security numbers – “after-the-fact explanations” not sufficient); and Chambers v. Klein, 419 F. Supp. 569, 580 (D.N.J. 1976) (following as Green, McElrath, and Doe regarding section 7(a); finding section 7(b) not violated where agency failed to notify applicants of use to be made of social security numbers as state had not begun using them pending full implementation of statute requiring their disclosure), aff’d, 564 F.2d 89 (3d Cir. 1977) (unpublished table decision).  Cf. Gonzalez, 671 F.3d at 663-64 (concluding that qualified immunity shielded police officers from liability where officers had “asked [plaintiff] for his social security number” but “did not give him the information listed in § 7(b),” as “the officers’ obligation to make the disclosures specified in § 7(b) was not clearly established” at time of plaintiff’s arrest); Doe v. Herman, No. 297CV00043, 1999 WL 1000212, at *9 (W.D. Va. Oct. 29, 1999) (magistrate’s recommendation) (citing Doe v. Sharp and subsection (e)(3) for proposition that “when agency solicits a social security number it shall inform the individual of what use will be made of it”), adopted in pertinent part & rev’d in other part, (W.D. Va. July 24, 2000), aff’d in part, rev’d in part, & remanded, on other grounds sub nom. Doe v. Chao, 306 F.3d 170 (4th Cir. 2002), aff’d, 540 U.S. 615 (2004).


Previous Section Ten Exemptions || Next Section Government Contractors

Updated February 24, 2021