This is archived content from the U.S. Department of Justice website. The information here may be outdated and links may no longer function. Please contact if you have any questions about the archive site.

Overview of the Privacy Act of 1974

Criminal Penalties

“Any officer or employee of an agency, who by virtue of his employment or official position, has possession of, or access to, agency records which contain individually identifiable information the disclosure of which is prohibited by this section or by rules or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.”  5 U.S.C. § 552a(i)(1).

“Any officer or employee of any agency who willfully maintains a system of records without meeting the notice requirements of subsection (e)(4) of this section shall be guilty of a misdemeanor and fined not more than $5,000.”  5 U.S.C. § 552a(i)(2).

“Any person who knowingly and willfully requests or obtains any record concerning an individual from an agency under false pretenses shall be guilty of a misdemeanor and fined not more than $5,000.”  5 U.S.C. § 552a(i)(3). 


These provisions are solely penal and create no private right of action.  See Jones v. Farm Credit Admin., No. 86-2243, slip op. at 3 (8th Cir. Apr. 13, 1987); Unt v. Aerospace Corp., 765 F.2d 1440, 1448 (9th Cir. 1985); Singh v. DHS, No. 1:12cv00498, 2013 WL 1704296, at * 24 (E.D. Cal. Apr. 19, 2013); McNeill v. IRS, No. 93-2204, 1995 U.S. Dist. LEXIS 2372, at *9-10 (D.D.C. Feb. 7, 1995); Lapin v. Taylor, 475 F. Supp. 446, 448 (D. Haw. 1979); see also FLRA v. DOD, 977 F.2d 545, 549 n.6 (11th Cir. 1992) (dictum); Beckette v. USPS, No. 88-802, slip op. at 14 n.14 (E.D. Va. July 3, 1989); Kassel v. VA, 682 F. Supp. 646, 657 (D.N.H. 1988); Bernson v. ICC, 625 F. Supp. 10, 13 (D. Mass. 1984); cf. Thomas v. Reno, No. 97-1155, 1998 WL 33923, at *2 (10th Cir. Jan. 29, 1998) (finding that plaintiff’s request for criminal sanctions did “not allege sufficient facts to raise the issue of whether there exists a private right of action to enforce the Privacy Act’s provision for criminal penalties,” and citing Unt and FLRA v. DOD); Grant v. United States, No. 2:11-cv-00360, 2012 WL 5289309, at *8 n.12 (E.D. Cal. Oct. 23, 2012) (stating that plaintiff’s request that defendant be referred for criminal prosecution is not cognizable, because this court has no authority to refer individuals for criminal prosecution under the Privacy Act”); Study v. United States, No. 3:08cv493, 2009 WL 2340649, at *4 (N.D. Fla. July 24, 2009) (granting plaintiff’s motion to amend his complaint but directing him to “delete his request [made pursuant to subsection (i)] that criminal charges be initiated against any Defendant” because “a private citizen has no authority to initiate a criminal prosecution”).

There have been at least two criminal prosecutions for unlawful disclosure of Privacy Act-protected records.  See United States v. Trabert, 978 F. Supp. 1368 (D. Colo. 1997) (finding defendant not guilty because prosecution did not prove “beyond a reasonable doubt that defendant ‘willfully disclosed’ protected material”; evidence presented constituted, “at best, gross negligence” and thus was “insufficient for purposes of prosecution under § 552a(i)(1)”); United States v. Gonzales, No. 76-132 (M.D. La. Dec. 21, 1976) (entering guilty plea).  See generally In re Mullins (Tamposi Fee Application), 84 F.3d 1439, 1441 (D.C. Cir. 1996) (per curiam) (concerning application for reimbursement of attorney fees where Independent Counsel found that no prosecution was warranted under Privacy Act because there was no conclusive evidence of improper disclosure of information).

Previous Section Civil Remedies || Next Section Ten Exemptions

Updated February 24, 2021