Internal personnel report likely satisfies Privacy Act exceptions

Plain-English summary

Chief Counsel informally considered whether an IRS office could compile labor information into a new internal report. The advice explained that creating a new record from existing data can be a disclosure under the Privacy Act. Internal disclosure is permitted when employees need the records to perform assigned duties or when a published routine use covers the disclosure. Based on the limited facts, the need-to-know standard was likely satisfied, subject to the requesting office's assessment of necessity. Published Treasury and IRS system notices also appeared to cover use of personnel information for workforce administration and reporting, so the advice found no apparent Privacy Act barrier.

Ruling snapshot

• Question: Does the Privacy Act permit an IRS office to create and use the proposed internal personnel report?
• Outcome: advice given
• Key authorities: 5 U.S.C. § 552a; Treas. Reg. § 601.702

Full text (IRS public release)

ID:       CCA_2017092714383112
UILC:     9999.92-02

Number: 201742023
Release Date: 10/20/2017
From:
Sent: Wednesday, September 27, 2017 2:38:31 PM
To:
Cc:
Bcc:
Subject: RE: Tableau Project Question


Hi -----------

Thanks for the question. We did some preliminary research on the limited facts we
have, and our informal advice is as follows. Under the Privacy Act (5 U.S.C. § 552a), in
order to disclose records within the agency, the records must either be needed to do the
job or we must be able to show that there is a “routine use” for that information. §
552a(b)(1), (3). Note that compiling data into a new kind of records counts as
“disclosure” under the Privacy Act. Sullivan v. United States Postal Serv., 944 F. Supp.
191, 196 (W.D.N.Y. 1996) (“the imparting of information which in itself has meaning and
which was previously unknown to the person to whom it is imparted.”).

We “need to know” labor records when we are looking at them in connection with
performing duties assigned to us, and if the information disclosed is necessary to do
those duties. See, e.g. Doe v. U.S. Dep’t of Justice, 660 F.Supp.2d 31, 45 (D.D.C. Oct.
6, 2009) (citing Bigelow v. Dep’t of Defense, 217 F.3d 875, 877 (D.C. Cir. 2000);
Pippinger v. Rubin, 129 F.3d 519 (10th Cir. 1997). With the limited facts we have from
our conversations, the “need to know” standard is likely met, but your office would be in
the best position to say whether or not the new report is necessary.

“Routine use” means that the record is being used in a way that is “compatible with the
purpose for which it was collected. § 552a(a)(7). We show that compatibility by
publishing the use of that kind of information in a Systems of Record Notice (SORN) in
the Federal Register. Treas. Reg. § 601.702.

“Routine use” includes disclosing within the agency “information relevant or necessary
to hiring or retaining an employee” in order to “administer personnel and payroll
programs” and thus authorized under the Privacy Act. Treasury/IRS 36.003, 80 FR
54101 (Sept. 8, 2015).

“Routine use” also includes disclosing within the agency “information relevant or
necessary to the requesting agency’s hiring or retaining an employee” in order to
“preparing individual administrative transactions relating to education and training . . .

                                             2

[and] providing a data source for the production of reports, statistical surveys, rosters,
documentation, and studies required for the orderly personnel administration within
Treasury” and thus authorized under the Privacy Act. Treasury .001, 81 Fed. Reg.
78267 (Nov. 7, 2016).

Based on our understanding of the preliminary facts we have, it appears that the use
you described would be routine, so we don’t see Privacy Act barrier for this new report.
Please let me know if you have any further questions.