When the Privacy Act of 1974 became law, it was hailed as an “American Bill of Rights on data.” More than fifty years on, it still stands as the main federal law controlling how government agencies collect and handle personal information — even though the world it was written for looks nothing like the one it now governs.
The statute took effect on September 27, 1975. Over time, critics say, it has turned into little more than a procedural checkpoint. No single agency is charged with enforcing it, and that gap has led observers to call the law the key to understanding why American data protection developed in such a fragmented way.
From Social Security Numbers to Senate Hearings
The story begins in the late 1950s. The Social Security number had gradually become a de facto identifier used across federal agencies, and computers were arriving in one department after another. Interest in building a centralized federal data center grew, and Congress funded studies to examine the possibility.
Anxiety among the public deepened amid the reach of McCarthyism, congressional wiretapping hearings held in the mid-1960s, and the lasting cultural shadow of George Orwell’s “Nineteen Eighty-Four.” Lawmakers opened hearings on a federal data bank in 1966.
At those hearings, author Vance Packard warned the assembled legislators that “Big Brother, if he ever comes to the United States, may turn out to be…a relentless bureaucrat obsessed with efficiency.” His words would be cited for decades afterward as the hearings hardened support for what came to be called an American Bill of Rights on data.
Momentum carried into 1971 and produced a 1973 report titled “Records, Computers, and Rights of Citizens.” The Watergate scandal and revelations about COINTELPRO — the FBI’s illegal surveillance of political groups and individuals it considered subversive — pushed the measure to the top of the agenda. President Richard Nixon, hoping to restore public confidence, voiced support for privacy rights in 1974. Senator Sam Ervin of North Carolina was the principal sponsor and combined the House and Senate versions into the bill that passed.
What the Law Requires — and What It Leaves Out
At its core, the Privacy Act lays out a Code of Fair Information Practice for how federal agencies collect, keep, use, and share personally identifiable information held in systems of records. Such a system is any group of records under an agency’s control from which information can be pulled using a person’s name or another identifier.
Agencies must publish notice of their record systems in the Federal Register. As a rule, information in a system of records cannot be disclosed without the written consent of the person it concerns, unless one of twelve statutory exceptions applies. People also have the right to see their own records, correct them, and find out who has looked at them.
The scope, however, is narrow. The act reaches only federal executive branch agencies and only record systems searchable by name or identifier. State governments, private businesses, and the newer technologies agencies now rely on fall outside it. Those limits, along with the lack of any dedicated oversight body, have kept the law functioning as a set of procedures rather than an active defense against government overreach.
A Framework That Outlasted Its Era
Even with its restricted reach, the fair information practices embedded in the Privacy Act went on to shape privacy laws around the globe. For the public, the law still matters on two counts: it remains the baseline safeguard against government intrusion, and it shows how far the data landscape has shifted since 1974.
The forces that produced it — creeping surveillance, the pull of bureaucratic efficiency, and the danger of unchecked government power — are still with us, in a time when personal data crosses industries and national borders faster than ever before.
