Will privacy be protected?

Since the events of Sept. 11, some commentators and a few government officials have begun calling for the collection, analysis and use of ever more information on American citizens and others who are legally in the country. At first blush, this may seem reasonable. However, these efforts could represent a severe threat to individual privacy interests, depending on how they are implemented.

The chief protection for personal information collected by the U.S. government is the Privacy Act of 1974. Under this law, government agencies in general are prohibited from disclosing any "record" on any individual that is "contained in a system of records," including computerized information and databases, without that person's consent.

The law includes numerous procedural safeguards to ensure compliance and stipulates that any government employee who knowingly discloses private information in violation of the law is subject to criminal penalties.

Because the law is designed to protect individual privacy interests, agencies are allowed to release information they collect if they first delete from the records all identifying features that would enable the information to be associated with particular individuals.

The Privacy Act applies to many government contractors "when an agency provides by contract for the operation by or on behalf of the agency a system of records to accomplish an agency function." Moreover, the law explicitly states that the contractor's employees are subject to the same criminal penalties for improper disclosure of private information as are government personnel.

All of this sounds like a lot of protection for the personal information collected by the government and its agents. However, there are a number of exceptions, some of which are big enough to drive a truck through.

Most important is an exception that allows agencies to disclose personal information to anyone at any time for any "routine purpose." A "routine purpose" in this context is any purpose that is compatible with the one for which the information was collected in the first place, as long as the agency has previously published in the Federal Register a notice that information of that sort might be disclosed.

For example, a court recently found that the exception allowed an agent of the Bureau of Alcohol, Tobacco and Firearms to inform a condominium association that one of its members was requesting a gun dealer's license, because the disclosure was compatible with the bureau's need to verify information on the member's application.

Allowing federal agencies to collect and keep the kinds of extensive information on Americans that some people are advocating is not necessarily a clear solution. One thing is clear, however. If Congress is going to allow this, it should first strengthen the Privacy Act in order to ensure that the information is not used to the detriment of innocent Americans. n

Peckinpaugh is corporate counsel for DynCorp in Reston, Va. This column represents his personal views.