The Privacy Act Is a Records Law

A government that collects information about people needs rules about what it may keep and who may see it. That is not controversial and the difficulty is entirely in the drafting.

The statute that governs it approaches the problem through a specific concept: the system of records, meaning a set of files retrievable by a person's name or identifier.

Everything else follows from that definition. Rights of access and correction, limits on disclosure, and the obligation to publish what systems exist all attach to it.

It was a sound choice in 1974, when records genuinely were held in identifiable systems, and it is the weakest part of the statute now.

Data that is not organised for retrieval by name falls outside the definition, and a great deal of modern government data is not organised that way.

The exemption structure is the part most people discover only when they try to use the statute.

Logs, telemetry, sensor output and derived analytics all describe people without being filed under them, and a system that can answer a question about a person is not the same thing as a system indexed by one.

Law enforcement and intelligence systems can be exempted from access and amendment rights by regulation, which is necessary and very broadly drawn.

The register carries the notices agencies must publish describing their systems, and reading a run of them is the best available map of what government holds.

A person cannot correct a record they are not allowed to see, so for exactly the systems where an error costs most, the correction right does not operate.

It is also an incomplete map, because an agency that concludes a collection is not a system of records publishes nothing at all.

That is a considered trade rather than an oversight, and it deserves to be argued as one rather than buried in a table of exemptions.

That judgement is made internally, first, by the party whose obligations depend on the answer, which is the recurring structure this publication keeps finding.

The routine use exception does the rest of the work and is the provision most often criticised, usually unfairly.

An agency may disclose a record for a purpose compatible with why it was collected, provided the purpose has been published in advance.

That is a real constraint. The published notice has to exist, and a disclosure outside it is unlawful, which is more discipline than most information sharing operates under.

The implementing regulations set out the access and amendment procedures, and those procedures work well for the records the statute was written about.

A person can ask what a named file holds, receive it, and demand correction of an error, and agencies mostly comply without a fight.

What a person cannot do is ask what an inference system concluded about them, because there is no record retrievable by their name to ask about.

The enforcement position is narrower than the rights suggest. Damages require proof of actual harm and of intentional or wilful conduct, which is a high bar for an information injury.

Most people harmed by a records error suffer a consequence they cannot trace to the error, which means the harm is real and the proof is unavailable.

The records authority governs retention, and retention is where the practical exposure sits: a record kept for thirty years has thirty years in which to be disclosed.

Shortening retention would do more for privacy than any access right, and it is decided administratively, on schedules almost nobody outside the agencies reads.

The reform that would matter is not a new statute but a change of hinge: attach the obligations to information about a person rather than to a system indexed by their name.

That would be a substantial expansion and would need care to avoid absurdity. It would also restore the law to covering what it was plainly written to cover.