Skip to main content

Overview of the Privacy Act: 2020 Edition

Criminal Penalties

“Any officer or employee of an agency, who by virtue of his employment or official position, has possession of, or access to, agency records which contain individually identifiable information the disclosure of which is prohibited by this section or by rules or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.”  5 U.S.C. § 552a(i)(1).

“Any officer or employee of any agency who willfully maintains a system of records without meeting the notice requirements of subsection (e)(4) of this section shall be guilty of a misdemeanor and fined not more than $5,000.”  5 U.S.C. § 552a(i)(2).

“Any person who knowingly and willfully requests or obtains any record concerning an individual from an agency under false pretenses shall be guilty of a misdemeanor and fined not more than $5,000.”  5 U.S.C. § 552a(i)(3). 


The Privacy Act allows for criminal penalties in limited circumstances.

An agency official who improperly discloses records with individually identifiable information or who maintains records without proper notice, is guilty of a misdemeanor and subject to a fine of up to $5,000, if the official acts willfully.  Similarly, any individual who knowingly and willfully obtains a record under false pretenses is guilty of a misdemeanor and subject to a fine up to $5,000. 

These provisions are solely penal and create no private right of action.  See Palmieri v. United States, 896 F.3d 579, 586 (D.C. Cir. 2018) (concluding that plaintiff’s complaint “erroneously mixes and matches criminal and civil portions of the Privacy Act” by seeking redress under 5 U.S.C. § 552a(g)(1) for an alleged violation of 5 U.S.C. § 552a(i)(3)); Jones v. Farm Credit Admin., No. 86-2243, slip op. at 3 (8th Cir. Apr. 13, 1987); Unt v. Aerospace Corp., 765 F.2d 1440, 1448 (9th Cir. 1985) finding claim against private corporation under § 552a(i) was futile, as it provides for criminal penalties only and because information obtained was about that corporation and not individual); Pennsylvania Higher Educ. Assistance Agency v. Perez, 416 F. Supp. 3d 75, 88 (D. Conn. 2019) (concluding that “while [student loan servicer] and its employees could be subject to criminal liability for violations of the Privacy Act, [U.S, Dep’t of Education] has no authority to bring criminal prosecutions, and no relief the Court could issue against Education would forestall such a prosecution”); Ashbourne v. Hansberry, 302 F. Supp. 3d 338, 346 (D.D.C. 2018) (finding that “[a]lthough section 552a(i) of the Privacy Act does provide criminal penalties for federal government employees who willfully violate certain aspects of the statute, [plaintiff] cannot initiate criminal proceedings against [individual agency employees] by filing a civil suit”); Singh v. DHS, No. 1:12cv00498, 2013 WL 1704296, at *24 (E.D. Cal. Apr. 19, 2013) (holding that plaintiff could not maintain civil action seeking imposition of criminal penalties); McNeill v. IRS, No. 93-2204, 1995 U.S. Dist. LEXIS 2372, at *9-10 (D.D.C. Feb. 7, 1995); Lapin v. Taylor, 475 F. Supp. 446, 448 (D. Haw. 1979) (dismissing action against attorney alleged to have removed documents from plaintiff’s medical files under false pretenses on grounds that § 552a(i) was solely penal provision and created no private right of action); see also FLRA v. DOD, 977 F.2d 545, 549 n.6 (11th Cir. 1992) (dictum) (noting that question of what powers or remedies individual may have for disclosure without consent was not before court, but noting that section 552a(i) was penal in nature and “seems to provide no private right of action”) (citing St. Michael’s Convalescent Hosp. v. Cal., 643 F.2d 1369 (9th Cir. 1981);  cf. Grant v. United States, No. 2:11-cv-00360, 2012 WL 5289309, at *8 n.12 (E.D. Cal. ct. 23, 2012) (stating that plaintiff’s request that defendant be referred for criminal prosecution “is not cognizable, because this court has no authority to refer individuals for criminal prosecution under the Privacy Act”); Study v. United States, No. 3:08cv493, 2009 WL 2340649, at *4 (N.D. Fla. July 24, 2009) (granting plaintiff’s motion to amend his complaint but directing him to “delete his request [made pursuant to subsection (i)] that criminal charges be initiated against any Defendant” because “a private citizen has no authority to initiate a criminal prosecution”); Thomas v. Reno, No. 97-1155, 1998 WL 33923, at *2 (10th Cir. Jan. 29, 1998) (finding that plaintiff’s request for criminal sanctions did “not allege sufficient facts to raise the issue of whether there exists a private right of action to enforce the Privacy Act’s provision for criminal penalties,” and citing Unt and FLRA v. DOD); Kassel v. VA, 682 F. Supp. 646, 657 (D.N.H. 1988) (finding genuine issue of material fact as to whether agency released plaintiff’s confidential personnel files, which “if done in violation of [Privacy] Act, subjects defendant’s employees to criminal penalties” (citing 5 U.S.C. § 552a(i)(1)); Bernson v. ICC, 625 F. Supp. 10, 12-13 (D. Mass. 1984) (rejecting plaintiff’s request for criminal action under Privacy Act because “only the United States Attorney can enforce federal criminal statutes”).

There have been at least two criminal prosecutions for unlawful disclosure of Privacy Act-protected records.  See United States v. Trabert, 978 F. Supp. 1368 (D. Colo. 1997) (finding defendant not guilty because prosecution did not prove “beyond a reasonable doubt that defendant ‘willfully disclosed’ protected material”; “gross negligence” was “insufficient for purposes of prosecution under § 552a(i)(1)”); United States v. Gonzales, No. 76-132 (M.D. La. Dec. 21, 1976) (entering guilty plea).  See also In re Mullins (Tamposi Fee Application), 84 F.3d 1439, 1441 (D.C. Cir. 1996) (per curiam) (concerning application for reimbursement of attorney fees where Independent Counsel found that no prosecution was warranted under Privacy Act because there was no conclusive evidence of improper disclosure of information).


Next Section: Ten Exemptions

Updated October 11, 2022