FTC Amends Privacy Act System of Records Notices

The Federal Trade Commission (FTC) has adopted final amendments to its system of records notices under the Privacy Act of 1974 to ensure the Commission can disclose records to other agencies in the event of a data breach.

The Privacy Act of 1974 authorizes federal agencies to adopt routine uses of agency records subject to the Act as long as they are compatible with the purpose for which the information was collected. Acting on a recommendation from the President’s Identity Theft Task Force, the FTC in 2007 published a new routine use based on model language recommended from the Justice Department that allowed for disclosure of records to appropriate persons and entities in order to respond to a data breach. Since then, the Office of Management and Budget (OMB) determined that the model language was too narrow and that agencies needed authority to make disclosures that go beyond those contemplated by the original routine use.

Based on additional guidance provided last year by OMB, the final amendments approved by the Commission will be published in the Federal Register shortly. The final amendments more specifically address that harm to individuals may justify a routine use disclosure, and add a second routine use to allow the FTC to disclose information to another federal agency when it is reasonably needed to respond to a breach.

After receiving three comments on the proposed routine use amendments, the Commission vote to approve publication of the final amendments in the Federal Register was 5-0.

The Federal Trade Commission works to promote competition, and protect and educate consumers. You can learn more about consumer topics and file a consumer complaint online or by calling 1-877-FTC-HELP (382-4357). Like the FTC on Facebook, follow us on Twitter, read our blogs, and subscribe to press releases for the latest FTC news and resources.