NFFE and other federal sector labor unions play an important role in in protecting employees’ privacy rights on the job. The Privacy Act prohibits agencies from releasing information contained in records unless permitted by an enumerated exception.
What is the Privacy Act?
The Privacy Act prohibits federal agencies from disclosing any record to any person, or to another agency. Of course, federal workers may request their own records and receive private information held by the agency about themselves. There are also several exceptions that federal workers should know about that sometimes allow agencies to share private information with other agencies, or third parties.
The purpose of the Privacy Act is to balance the government’s need to maintain information about individuals with the rights of individuals to be protected against unwarranted invasions of their privacy stemming from federal agencies’ collection, maintenance, use, and disclosure of personal information about them.
The Privacy Act pertains to “records.” For the purposes of this law, the term "record" includes any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history that contains the person's name or identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph.
Your medical information should be regarded as private even if you are pursuing an accommodation under the Rehabilitation Act. Disability laws require federal agencies to maintain information regarding the medical condition and history of individuals with disabilities in separate medical files and to treat such information as confidential except in specified situations. This includes genetic information which may be held by the agency.
The Dr. Chris Kirkpatrick Whistleblower Protection Act of 2017 provides that accessing the medical record of another employee or an applicant for employment as a part of, or otherwise in furtherance of, any discipline is a prohibited personnel practice.
Agencies may disclose such records to the following:
- To those officers and employees, of the agency maintaining the record, who need the record to perform their duties. 5 USC Section 552ab)(1);
- As required under the Freedom of Information Act at 5 USC 552. 5 USC Section 552a(b)(2);
- For a "routine use" -- defined as using the record for a purpose that is compatible with the purpose for which it was collected. 5 USC Section 552a(b)(3);
- To the Bureau of the Census for purposes of a census, survey, or related activity; to the National Archives and Records Administration; or to a consumer reporting agency in accordance with 31 USC 3711 (e) mandates for collecting government claims. 5 USC Section 552a(b)(4), (5), (12);
- In a form that is not individually identifiable to a recipient who has provided the agency with written assurance that the record will be used solely as a statistical research or reporting record. 5 USC Section 552a(b)(6);
- Pursuant to a court order; to another U.S. government agency or instrumentality for a civil or criminal law enforcement activity; or to either House of Congress, or any committee or subcommittee with jurisdiction. 5 USC Section 552a(b)(7), (9), (12);
- To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual. 5 USC Section 552a(b)(8); or
- To the comptroller general, or any of his authorized representatives, in the course of the performance of the duties of the Government Accountability Office. 5 USC Section 552a(b)(10).
What Happens if You Believe the Agency has Violated Your Privacy?
First, contact your local union officers or shop steward. Your collectively bargained agreement (“CBA” or “contract”) may provide for even more protections than the law itself, and may grant you recourse where you do not have to pay for an outside attorney to take the case to federal court for you. The grievance arbitration process can be utilized to remedy a violation of the Privacy Act. Violations of the Privacy Act include, but may not be limited to, instances when an agency:
- Fails to safeguard private information from fellow employees and managers who should not have access to that information (including accessing and photocopying private files);
- Determines not to amend an individual's record as requested, or fails to review the request in compliance with the Privacy Act's requirements;
- Refuses to comply with an individual's request to review and obtain a copy of their own records;
- Fails to maintain any record concerning any individual with such accuracy, relevance, timeliness, and completeness as is necessary to assure fairness in any determination relating to the qualifications, character, rights, opportunities, or benefits to the individual that may be made based on the record, and consequently makes a determination that is adverse to the individual; or
- Fails to comply with any other Privacy Act provision or its regulations in such a way as to have an adverse effect on an individual.
Your local union should evaluate your case and consider filing a grievance on your behalf. An individual may be fined up to $5,000 for knowingly and willfully requesting or gaining access to a record about an individual under false pretenses. Criminal sanctions may also be available in some instances where an agency or another employee has violated The Privacy Act.
