General Laws

General Rule on Disclosure of Confidential Information Applicable to All Agencies.-One law (18 U.S.C. 1905) imposes penalties on, and removal from office of, any Federal official or employee who "publishes, divulges, discloses or makes known in any manner or to any extent not authorized by law... confidential statistical data." It provides insufficient protection for statistical or research information, however. For example, many disclosures to others. within an agency performing regulatory, investigative, or substantive program administration functions are authorized by law. In addition, information which is discoverable in civil suits under Federal Rules of Civil Procedures may not be withheld under this provision. It does not prevent disclosure required or permitted under the Freedom of Information Act. This law does, however, apply to unauthorized disclosures of information, and forms a basic minimum standard to be met. The specific wording of the law is as follows:

Whoever, being an officer or employee of the United States or of any department or agency thereof, publishes, divulges, discloses, or makes known in any manner or to any extent not authorized by law any information coming to him in the course of his employment or official duties or by reason of any examination or investigation made by, or return, report or record made to or filed with, such department or agency or officer or employee thereof, which information concerns or relates to the trade secrets, processes, operations, style of work, or apparatus, or to the identity, confidential statistical data, amount or source of any income, profits, losses, or expenditures of any person, firm, partnership, corporation, or association; or permits any income return or copy thereof or any book containing any abstract or particulars thereof to be seen or examined by any person except as provided by law; shall be fined not more than $1,000, or imprisoned not more than one year, or both; and shall be removed from office or employment.

Federal Reports Act.-The Federal Statistical System has long been sensitive to the importance of confidential treatment of statistical information. For example, the Federal Reports Act of 1942 (44 U.S.C. 3501-12) specifically addresses the importance of confidentiality in data sharing for statistical purposes.

The purpose of the Federal Reports Act is to reduce the Federal reporting burden on the public by the elimination of unnecessary duplication of Federal requests for information from the public and by encouraging the coordination of Federal data collection

efforts wherever possible. In this connection, the sharing of data between Federal agencies has been viewed as a way to reduce the need for agencies to collect the same information more than once.

The circumstances specified in the act for sharing of data between agencies are limited, however, since information can only be released to another agency if (a) the information is released in nonidentifiable summary or tabular form; (b) the information has not, at the time of collection, been declared by the collecting agency or a superior authority as being confidential; (c) the respondent has consented to the release; or (d) the recipient agency has a mandatory authority, with criminal penalties for nonresponse, to collect the same data. Under the act the Director of the Office of Management and Budget is authorized to require any Federal agency, except the IRS or bank supervisory agencies, to transfer any data which it collects to another agency under these conditions. Some such transfers take place without OMB intervention. While the extent of interagency data sharing under this act is not known, it is probably minimal.

Freedom of Information Act (FOIA) and the Government in the Sunshine Act (Sunshine Act).— Statistical agencies concerned with the protection of data must also consider the impact of the Freedom of Information Act (FOIA) (5 U.S.C. 552) and the Sunshine Act (5 U.S.C. 552b).

The purpose of the FOIA is basically to permit the public access to information upon request as a check on the process of Government. Even within this environment, however, Congress recognized the wisdom of maintaining some information confidentially. For our purposes, the relevant passages, which appear in subsection (b) as amended by the Sunshine Act, permit agencies to withhold matters which are

(3)

specifically exempted from disclosure by statute (other than section 552b of this title) provided that such statute (A) requires that the matters be withheld from the public in such a manner as to leave no discretion on the issue, or (B) establishes particular criteria for withholding or refers to particular types of matters to be withheld:

(4) trade secrets and commercial or financial information obtained from a person and privileged or confidential;...

(6) personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.

Exemption (3) recognizes that certain information (e.g., Census information collected under title 13) has received specific congressional exemption because it is especially sensitive or because confidentiality is required in order to obtain public cooperation. This information may not be released by an agency under FOIA. The revision of this exemption by the two added criteria will affect some agencies, notably the Social Security Administration, which has relied on applying a broad secretarial discretion to identify matters which should be "specifically exempted from disclosure by statute."

Exemption (4) deals primarily with business records. Case law was developed to bring under this exemption that information which would result in significant competitive injury to a company or the disclosure of which would impair the Government's ability to obtain the necessary information in the future.

Exemption (6) deals with information about individuals. Recent interpretations differ as to whether, on balance, a significant public use of the information would warrant a significant invasion of personal privacy under the act.

The Privacy Act of 1974.-Recent attention on the protection of records was broadly codified in the Privacy Act of 1974 (5 U.S.C. 552a).

The Privacy Act requires agencies to: (a) collect only that information necessary to perform agency functions; (b) publish descriptions of existing data. systems so that the public can learn what records are maintained by the agency; (c) inform individuals at the time of data collection whether the request is mandatory or voluntary, the consequences, if any, of nonresponse, and the uses of the data; (d) permit individuals in most cases to examine records maintained on them and to challenge the accuracy thereof; (e) to insure that the records are sufficiently accurate for agency purposes; and (f) to observe certain minimal standards of disclosure of the records."1

The general rule on disclosure of identifiable rec

"A good summary of the Privacy Act of 1974 is presented by Carole W. Parsons in "The Privacy Act of 1974: New Challenges for Public Administration," prepared for the Annual Meeting of the American Society for Public Administration, April 2, 1975. Ms. Parsons was Executive Director of the Privacy Protection Study Commission. The Office of Management and Budget has established the "Privacy Act Implementation Guidelines and Responsibilities," Federal Register, Vol. 40 No. 132, Part III, (July 9, 1975) which provides an interpretation of most of the Act's provisions.

ords about individuals is that the agency must obtain informed consent from the data subject for each such disclosure. However, eleven exemptions to this rule permit disclosure without informed consent. The exemptions include disclosures: (a) to officers of the agency to perform their proper functions; (b) when required by the Freedom of Information Act; (c) as a "routine use" described as a use which is compatible with the purpose for which the information was collected; (d) to law enforcement agencies; (e) to the GAO and to committees of Congress; (f) pursuant to a court order (subpoena); and (g) to the Census Bureau for statistical purposes. These disclosures without consent are permissible and do not override more restrictive laws forbidding such disclosures.

It is clear that the Privacy Act's provisions with these exemptions do not agree with the principles of confidentiality for statistical and research information. It is not clear, however, whether one effect of the act will be to stifle those beneficial disclosures which should be permitted. Early indications are that sufficient latitude exists under the act to permit necessary disclosures.

Agency Specific Laws

Bureau of the Census.-Nearly all observers of statistical systems use the U. S. Bureau of the Census as the outstanding example of confidential treatment of statistical data.

The Census law (13 U.S.C. 9) includes one of the tightest and best known confidentiality provisions in existence. It provides for penalties for inappropriate disclosure of information or for use other than statistical purposes. Following the St. Regis Paper Company case in 1961, in which the Federal Trade Commission succeeded in getting file copies of Census reports directly from the Company by subpoena, Congress amended the law to protect copies of the documents in company or personal files from subpoena. The law states:

Sec. 9. Information as confidential; exception (a) Neither the Secretary, nor any other officer or employee of the Department of Commerce or bureau or agency thereof, may, except as provided in section 812 of this title

(1) use the information furnished under the provisions of this title for any purpose other than the statistical purposes for which it is supplied; or

12See footnote 9 above.

(2) make any publication whereby the data furnished by any particular establishment or individual under this title can be identified; or

(3) permit anyone other than the sworn officers and employees of the Department or bureau or agency thereof to examine the individual reports.

No department, bureau, agency, officer, or employee of the Government, except the Secretary, in carrying out the purposes of this title, shall require, for any reason, copies of census reports which have been retained by any such establishment or individual. Copies of census reports which have been so retained shall be immune from legal process, and shall not, without the consent of the individual or establishment concerned, be admitted as evidence or used for any purpose in any action, suit, or other judicial or administrative proceeding.

(b) The provisions of subsection (a) of this section relating to the confidential treatment of data for particular individuals and establishments, shall not apply to the censuses of governments provided for by subchapter III of chapter 5 of this title, nor to interim current data provided for by subchapter IV of chapter 5 of this title as to the subjects covered by censuses of governments, with respect to any information obtained therefor that is compiled from or customarily provided in, public records.

Today there is general public acceptance of the Bureau of Census as a truly confidential repository of statistical information. However, some individuals have charged that the Census statute is too narrow, citing other agencies' inability to have access to the Standard Statistical Establishment List (SSEL) for statistical sampling purposes and an excessive application of disclosure avoidance relating to tabulations and public use microdata tapes.

Law Enforcement Assistance Administration.-The Crime Control Act of 1973, (section 524(a) of P.L. 93-83), has a provision that statistical and research information collected by the Law Enforcement Assistance Administration (LEAA) or under any interagency agreement, grant, contract or subgrant awarded under the Act may not be used or revealed in identifiable form, even pursuant to subpoena. Such information, as well as file copies, is immune from subpoena. The specific language is:

Sec. 524. (a) Except as provided by Federal law other than this title, no officer or employee of the

Federal Government, nor any recipient of assistance under the provisions of this title shall use or reveal any research or statistical information furnished under this title for any purpose other than the purpose for which it was obtained in accordance with this title. Copies of such information shall be immune from legal process, and shall not, without the consent of the person furnishing such information, be admitted as evidence or used for any purpose in any action, suit, or other judicial or administrative proceedings.

The published regulations of the LEAA, "Confidentiality of Identifiable Research and Statistical Information" (Federal Register, Vol. 41, No. 242, Part II, December 15, 1976) provide that identifiable information may be used only for research or statistical purposes, which are “to develop, measure, evaluate, or otherwise advance the state of knowledge in a particular area." The regulations do not apply to "intelligence or other information gathering activities in which information pertaining to specific individuals is obtained for purposes directly related to the enforcement of the criminal laws." They also provide that "copies of research and statistical information identifiable to a private person shall be immune from legal process,” although they permit courts to require testimony of researchers from their own memory. The protection extends to information which is directly collected or obtained from any agency or individual.

Research and statistical information may be transferred to any researcher or statistician in identifiable form provided that the recipient signs a transfer agreement with the original data collector that he will use the data only for research or statistical purposes; that further revelation will occur only on a need to know basis for research or statistical purposes where the information has already been included in research findings and such transfer is approved by the person providing information under the agreement; that the physical data will be adequately protected; that the final disposition of the data is known and agreed to by the data collector; and that "the conduct of the recipient's project will not, either directly or indirectly, cause legal, economic, physical or social harm to individuals whose identification is revealed in the transfer of information." It should be noted that such transfers of identifiable data are not restricted to researchers funded by the Government or to projects related to the original purposes of the data collection, and that they are not reviewed by LEAA.

Under the LEAA regulations, data subjects are to be informed of the nature of the project, the data will

only be utilized or revealed for statistical or research purposes, and their participation is voluntary. Such notification need not be given "where information is obtained through field observation of individual activity or performance and in the judgment of the researcher such notification is impractical or may seriously impede the progress of the research."

Research of the kind funded by LEAA is frequently concerned with illegal or antisocial behavior and, as such, requires data which may be of an extremely sensitive nature. The LEAA regulations represent an attempt at a balance between protecting the individual from harm while not being unduly restrictive of necessary research. Like other similar documents, these regulations have undergone extensive scrutiny both within the Government and by members of the public.

National Center for Health Statistics.-The Health Services Research, Health Statistics and Medical Libraries Act of 1974 (Section 308 (d) of P.L. 93-353), specifically addressed the confidentiality protection of National Center for Health Statistics (NCHS) data. The confidentiality of the information collected or obtained by NCHS is protected by this act from use other than that for which it was supplied "unless authorized under regulations of the Secretary" of HEW. The law is interpreted as providing identifying data with immunity from subpoena or from any other disclosure without consent of the data subject. The specific wording is:

(d) No information obtained in the course of activities undertaken or supported under section 304, 305, 306, or 307 may be used for any purpose other than the purpose for which it was supplied unless authorized under regulations of the Secretary; and (1) in the case of information obtained in the course of health statistical activities under section 304 or 306, such information may not be published or released in other form if the particular establishment or person supplying the information or described in it is identifiable unless such establishment or person has consented (as determined under regulations of the Secretary) to its publication or release in other form, and (2) in the case of information obtained in the course of health services research, evaluations, or demonstrations under section 304 or 305, such information may not be published or released in other form if the person who supplied the information or who is described in it is identifiable unless such person has consented (as determined under regulations of the Secretary) to its publication or release in other form.

There are as yet no proposed regulations relating to NCHS activities under this law.

Bureau of Economic Analysis.-Statistical data collected by the Bureau of Economic Analysis (BEA) in the Department of Commerce is protected by two provisions of the United States Code (U.S.C.), Section 176a of Title 15 and Section 286F(c) of Title 22.

The former, which is very broad, pertains to "any statistical information furnished in confidence to the Bureau," and provides that it "shall be held to be confidential, and shall be used only for the statistical purposes for which it is supplied." It is interpreted as protecting the individual company data collected by BEA from subpoena. The specific language is:

Any statistical information furnished in confidence to the Bureau of Foreign and Domestic Commerce by individuals, corporations, and firms shall be held to be confidential, and shall be used only for the statistical purposes for which it is supplied. The Director of the Bureau of Foreign and Domestic Commerce shall not permit anyone other than the sworn employees of the Bureau to examine such individual reports, nor shall he permit any statistics of domestic commerce to be published in such manner as to reveal the identity of the individual, corporation, or firm furnishing such data.

Internal Revenue Service.-While the Internal Revenue Code does not deal expressly with statistics or research, it impinges on statistical activities in an important way and has been the subject of extensive public debate. Section 6103 of the Code, entitled "Publicity of Return and Disclosure of Information as to Persons Filing Income Tax Returns" begins with the statement:

Returns made with respect to taxes imposed by chapters 1, 2, 3, and 6 upon which the Secretary (of Treasury) or his delegate shall constitute public records; but, except as hereinafter provided in this section, they shall be open only upon order of the President and under rules and regulations prescribed by the Secretary or his delegate and approved by the President.

In the past, several Executive orders have been issued by the President to permit statistical activities to be performed using tax returns. The Census Bureau and the Bureau of Economic Analysis use such data extensively." The Federal Trade Commission (FTC) has received statistical samples of

"The use by BEA and Census of identifiable tax information on individuals and legal entities are described in the Commerce Department paper entitled "Structuring the Government's Basic Economic Tools," April 1975.

corporations for its important Quarterly Financial Report. In 1973, Executive Order No. 11709 was promulgated to permit the Statistical Reporting Service (now part of the Economics, Statistics, and Cooperatives Service) of the Department of Agriculture to have access to tax returns to develop a master list of farms to serve as a sampling frame for various current agriculture surveys. After a congressional outcry, largely because of the fear that the information would be misused for the Agriculture Department's administrative programs and because of the feeling that tax returns of farmers were privileged, the Executive order was rescinded.14 USDA is presently authorized to spend $3.1 million to develop a master list from other sources. A significant amount of that money could be saved if the Department had access to tax or census information, specifically the Standard Statistical Establishment List (SSEL).

The recent Tax Reform Act of 1976 has amended previously applicable law to prohibit statistical access. to tax information by Executive order. The act provides, upon request, information on business returns to Census, BEA and FTC and on individual returns to Census, and specifies that such data be used only for authorized statistical purposes and not be disclosed in identifiable form. It has, for example, raised a question as to whether the Social Security Administration will be able to continue the use of IRS address information to assign residence codes in the Continuous Work History Sample. Other agencies not specified here were either denied access in the past or had discontinued their need for access under Executive orders prior to the act's passage. The potential inhibiting effects of the Tax Reform Act of 1976 on statistical and research activities, however, may be much greater than was initially realized. The act has defined tax return information broadly, so that its disclosure provisions apply to information on earnings collected by IRS for use by SSA in administering social security programs. While this information, under the new disclosure provisions, can be released by IRS to SSA for program administration purposes and to a few agencies, notably Census, for statistical purposes, there is no provision for redisclosure. Thus, release of employer and earnings information to other agencies for

For the congressional discussion of this episode see "Executive Orders 11697 and 11709 Permitting Inspection by the Department of Agriculture of Farmers' Income Tax Returns," Hearings before a Subcommittee on Government Operations, House of Representatives, 93rd Congress, First Session, (May 9 and August 3, 1973); and "Information from Farmers' Income Tax Returns and Invasion of Privacy." Sixth Report by the Committee on Government Operations, 93rd Congress, 1st Session, House Report 93-598 (October 18, 1973).

statistical purposes has been effectively eliminated. The provisions of the Tax Act may also affect current and proposed releases of employer and establishment data to agencies needing sampling frames for important statistical programs, whether from SSA or from the Census Bureau's Standard Statistical Establishment List.

It is ironic that statistical uses of tax returns should attract such critical attention. There are no known cases of abuse of these data by statisticians. The principle abuses which have been discovered have originated through the political process.

Some statistical agencies, however, are not in a strong legal position to defend their potential uses of tax returns since they do not have, as do Census and BEA, strong confidentiality laws of their own to insulate them from other programs of their Departments. Hence, it is difficult to demonstrate to Congress that tax information would be treated according to the principles of confidentiality as set forth in this chapter. Even years of operating confidential statistical programs under the strictist sets of guidelines with no known abuses is insufficient for this purpose (the Privacy Act of 1974 includes a specific provision for disclosure to Census without consent, but no other agencies are so favored). The first step these agencies should take is to request Congress to upgrade their statutory confidentiality protection. Perhaps then Congress would be willing to permit access to tax returns for demonstrably beneficial statistical programs.

Social Security Administration.-Another pattern of confidentiality protection is found in section. 1106(a) of the Social Security Act, (42 U.S.C. 1306(a)). The section does not deal explicitly with research, but covers any information received by the Department of Health, Education, and Welfare in the course of discharging duties under the Social Security Act. The section provides that no disclosure shall be made "except as the Secretary may by regulations prescribe." Thus, an administrative official is authorized to designate classes of information that may be disclosed and those that may not be disclosed, and to determine when and to whom data may be disclosed. In effect, an administrative official has discretion (which must be exercised in advance in published regulations) to respond to legal process or not. Regulations promulgated by DHEW, commonly referred to as "Regulation No. 1" (20 CFR, part 401), specify, for different classes of data, the conditions of disclosure. The Social Security Administration is reviewing its situation in light of the amendment contained in the Sunshine Act which narrows the scope of administrative discretion which