It's a whole new world of complex rules that most businesses are not aware of, but must comply with, if they are contracting with the federal government. Federal government contractors with access to data protected by the Privacy Act are subject to a new set of complex and little-understood rules which, if violated, can have serious consequences. The federal government is increasingly turning to outsourcing of its functions, increasing contractor access to personal data of citizens maintained by the government in "Systems of Records" governed by the provisions of the Privacy Act, 5 U.S.C. § 552, and its regulations that preclude access to systems of records and the data except under specified circumstances. Unauthorized access or sharing of protected personal information subjects individuals and entities, both inside and outside the government, to civil actions by the citizens whose data has been improperly disclosed as well as possible criminal prosecution and penalties of $5,000 for each unauthorized disclosure.

Our privacy issues team has helped government contractors understand and comply with the laws and regulations of the Privacy Act. 

Representative Matters: 

• Devised compliance programs for government contractors who have access to systems of records and helped establish systems that detail the appropriate steps to be taken to prevent improper access to data protected under the Privacy Act
• Advised government contractors who have access to systems of records as to how they train their employees to understand their responsibilities under the Privacy Act and how they should discipline employees who have put the company at risk for violating provisions of the Act
• Worked with information systems security specialists to advise government contractor clients to assure appropriate interface between contractor personnel and systems of records to which the contractor has access in the course of performance of its contractual duties
• Conducted internal investigations on behalf of government contractors who have access to systems of records regarding potential inappropriate access to systems of records and resultant disclosures of information protected by the Privacy Act