Each depositor insured to at least $250,000 per insured bank



Home > About FDIC > Privacy Program > Privacy Act Guidelines - Disclosure Procedures




Privacy Program

Privacy Act Guidelines - Disclosure Procedures

Purpose - These guidelines prescribe general procedures relating to the disclosure of information contained in a system of records subject to provisions of the Privacy Act.

Privacy Act Disclosure Restrictions - The Privacy Act provides that records to which it applies may not be disclosed to any third party (including other Federal agencies) without the advance written consent of the person to whom the records pertain. There are, however, twelve exceptions which permit disclosures without the consent of the individual of record. These exceptions are described below. Note that a record as prescribed in Disclosure Accounting Requirements must be maintained for all disclosures made except for those described in "Internal Disclosures" and "Disclosures Under the Freedom of Information Act" below.

    Internal Disclosures - The first exception to the basic disclosure restriction permits disclosures to officers and employees of the Corporation who have a need for the record in the performance of their duties.

    Disclosures Under the Freedom of Information Act - The second exception to the Privacy Act's basic disclosure restrictions is for those disclosures which are required by the Freedom of Information Act. When the Freedom of Information Act does not require disclosure, however, the Privacy Act disclosure restriction is applicable and provides a further safeguard for the privacy of individual citizens. A discussion of the relationship of the Freedom of Information Act to the Privacy Act is provided in "Relationship of the Freedom of Information Act to the Privacy Act" below.

    Routine Use - Disclosures may be made for a routine use as described and published in the notice describing the system of records. See FDIC Systems of Records for descriptions of routine uses.

    Bureau of the Census - Disclosures may be made to the Bureau of the Census for purposes of planning or carrying out a census, survey or related activity.

    Statistical Research/Reporting - Disclosures may be made to a recipient who has provided the agency with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable.

    Preservation of Records - Disclosures may be made to the National Archives and Records Administration of a record which has sufficient historical or other value to warrant its continued preservation by the United States Government, or for evaluation by the Archivist of the United States or the Archivist's designee to determine whether the record has such value.

    Civil or Criminal Law Enforcement - Disclosures may be made to another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the Corporation specifying the particular portion desired and the law enforcement activity for which the record is sought.

    Health or Safety - Disclosures may be made to a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if upon such disclosure notifications is transmitted to the last known address of such individual.

    Congressional Disclosure - Disclosures may be made to either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, and joint committee of Congress or subcommittee of any such joint committee. However, see below regarding requests from individual members of Congress.

    General Accounting Office - Disclosures may be made to the General Accounting Office for the purpose of carrying out the duties of that office.

    Court Order - Disclosures may be made pursuant to the order of a court of competent jurisdiction. However, a subpoena issued as part of the routine discovery in a court proceeding rather than by a judge as a specific order to produce is not a court order permitting disclosure under this exception.

    Debt Collection - Disclosures may be made to a consumer reporting agency in accordance with section 3(d) or the Federal Claims collections Act of 1966 (31 U.S.C. 3701 (a) (3)). See Disclosure of Debt/Claim Information below.

Relationship of the Freedom of Information Act to the Privacy Act - The Freedom of Information Act (FOIA) and the Privacy Act both deal with the disclosure of information held by the Federal Government. The FOIA generally gives the public the right to inspect their government's records, but has exemptions which permit the withholding of certain limited classes of records, including records which would cause a clearly unwarranted invasion of personal privacy if disclosed. As a general rule, the Privacy Act does not affect the public's right of access to records available under the FOIA. The following guidance is applicable to FOIA requests that pertain to records that are subject to the provisions of the Privacy Act.

    Handling of FOIA Requests - When a request is submitted under the FOIA, employees of the Corporation should process that request under the procedures spelled out in the Corporation's Freedom of Information Act regulations.

    Primacy of the FOIA - If the records requested under the FOIA do not fall within any of the exemptions to the FOIA disclosure requirements, the FOIA requires the disclosure of requested records, and the Privacy Act disclosure restriction is not applicable, a written FOIA request must be in hand before making a disclosure from a Privacy Act system of records.

    Applicability of the Privacy Act - If records in a FOIA request are determined to fall within an exemption from the FOIA disclosure requirements, then the Privacy Act comes into play. Unless another of the exceptions to the Privacy Act's disclosure restriction applies (see Privacy Act Disclosure Restrictions) or the subject of the records gives his or her consent, the records may not be disclosed. Note that only one or more of the nine exemptions under the FOIA may be used to withhold records in responding to a FOIA request. Since the Privacy Act is not a FOIA exemption statute, it cannot be used as authority for a denial in response to a FOIA request.

    Applicable FOIA Exemptions - Although several FOIA exemptions may apply to records in Privacy Act files, the exemptions most likely to be applicable are:

    5 U.S.C. 552 (b) (6) - For personal, medical files and similar files the disclosure of which would constitute clearly unwarranted invasion of personal privacy.

    5 U.S.C. 552(b) (7) - investigatory records compiled for law enforcement purposes, but only to the extent that the disclosure of such records would (A) interfere with enforcement proceedings, (B) deprive a person of a right to a fair trial or an impartial adjudication, (C) constitute an unwarranted invasion of personal privacy, (D) disclose the identity of a confidential source and, in the case of a record compiled by a criminal law enforcement authority in the course of a criminal investigation, or by an agency conducting a lawful national security intelligence investigation, confidential information furnished only by the confidential source, (E) disclose investigative techniques and procedures, or (F) endanger the life of physical safety of law enforcement personnel.

    Freedom of Information Act Guideline Determinations - To the extent practicable, system managers should determine which categories of records in the systems for which they are responsible are likely to be required to be disclosed under the FOIA and provide appropriate guidance to employees working with the records.

Disclosure to Members of Congress or Their Offices - The exception described in "Congressional Disclosure" above does not extend to requests made by individual members of Congress. It was not the intent of Congress, however, to deny individuals the benefit of congressional assistance which they request. If a system of records may encounter such requests, the systems manager should arrange for the following statement to be added to the routine use part of the systems notice: "Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of the individual." Such requests can also be responded to if the information would be required to be disclosed under the Freedom of Information Act; if the member of Congress requests that the response go directly to the individual to whom the record pertains; or in compelling circumstances affecting the health or safety of an individual. Furthermore, consent can be inferred for any congressional inquiry indicating that the request is being made on the basis of a written request from the individual to whom the records pertain even if the constituent's letter is not provided.

Disclosure of Debt/Claim Information - The Debt Collection Act of 1982 (P.L. 97-365) provides for disclosures of information regarding overdue debts from Privacy Act systems of records to consumer reporting agencies (i.e., credit bureaus, etc.) under certain conditions. As indicated in "Debt Collection" above, a disclosure of debt/claim information to a consumer reporting agency is permitted without the advance written consent of the affected individual.

A consumer reporting agency to which debt/claim information is disclosed is not considered a contractor under the Privacy Act. However, a bureau or office that contracts with a person or organization for debt collection services must include as a provision of the contract that the contractor shall be subject to the requirements of the Privacy Act. It is not necessary to publish in the system of records notice a routine use disclosure of debt/claim information from a system of records to a contractor performing debt collection services for the Corporation.

Procedures for Disclosures - Specific guidelines for each system of records shall be developed to cover the application of the exceptions and for situations that require the written permission of individuals.

Disclosure Accounting Requirements - The Privacy Act requires that records be kept on all disclosures made under the exceptions described in Privacy Act Disclosure Restrictions, except those made under "Internal Disclosures" and "Disclosures Under the Freedom of Information Act." The records must show the date, nature, purpose and exception under which the disclosure was made, and the name and address of the person or agency to whom the disclosure was made. The records must be retained for at least five years after the disclosure for which the accounting is made or the life of the records, whichever is longer. All disclosures except those made under the law enforcement exception are to be available for inspection by the individual. Corrections to records which significantly alter the nature of prior recorded disclosures are to be conveyed to any agency or individual to whom such disclosures were made.

Disclosure Accounting Procedures - Records on disclosures shall be maintained convenient to the individual's records, but not necessarily as part of the record unless so desired by the system manager. Since records systems are structured in a variety of ways (including manual, photocopy, and IT), each system manager will have to address the disclosure requirements in a way appropriate to the system. A separate general disclosure statement can be used in lieu of individual notations when personal data involving large numbers of people are disclosed. For instance, one standard statement on file can cover the routine transfer of payroll data to the National Finance Center. Similarly, one statement giving the date, nature, purpose, exception, categories of individuals, numbers of individuals, and the institution to which disclosed will serve for statistical or other one time transfers.

If 10 or fewer records are disclosed, or if the group was selected by individual rather than category, then a record of the disclosure must be prepared which identifies each individual.

General Guideline Procedures - Appendix 1 provides a set of guidelines dealing with disclosure situations for employees working with a system of records. The guidelines are to be supplemented with guidelines specific to each system of records.




Last Updated 11/13/2009 Privacy@fdic.gov