from the business community based on an expressed fear that the data collected will be disclosed by the FTC in attributable or identifiable form. Almost 200 of the 440 companies in the LB reporting sample have filed suit against the FTC to halt compliance with such reporting requirements. The specific issues and controversy about LB and the other FTC inquiries are treated in detail in the Commission's report. The central problem exemplified by the LB experience is one that is apt to arise whenever a statistical office and a regulatory office are placed in the same agency, where discrete identifiable information held by the statistical office can contribute to the regulatory or enforcement functions of the agency. This problem also arises in interagency sharing arrangements when there is a possibility that information collected for one purpose may be used for another.

Administrative Records for Statistical Purposes. Administrative records are and should be widely used for statistical studies. When transfers occur, the basic principle is usually one in which the identity of individual reporting units is protected and their anonymity guaranteed in the publication of the results or in a public use file. This principle can also be in force even under conditions in which the original administrative records are accessible to the public, as, for example, when State vital statistics records are used by NCHS. Statistical Records for Administrative Purposes. The use of statistical records for subsequent regulatory, investigatory, or other administrative purposes is another matter altogether. Their subsequent use may violate confidentiality pledges taken at the time of collection. Even if no legal penalties are enforceable when the records are disclosed, the agency is placed in the cumbersome position of changing its alleged disclosure rules midstream. In the case of the FTC, however, records may be released if there is an overriding public interest to be served. This particular policy is contrary to that of many other Federal agencies, whose confidentiality statutes and regulations emphasize that identifiable statistical records may be disclosed only with the respondent's permission or when the safety or health of the respondent is at stake.

As a matter of policy this Commission holds that records collected for statistical purposes should not be disclosed in identifiable form if disclosure could cause harm to the reporting unit. Ordinarily, no public purpose - including the public's "right to know" — would require release in this form. If, on the other hand, there is an overriding public purpose, pursuant to law, served by the disclosure of commercial information like LB, such disclosures should be made from administrative files by program and regulatory staffs. In no case should a statistical or research bureau or office be placed in the role of releasing such data.

The Concept of Statistical "Enclaves". This line of argument ultimately leads to a recommendation for increased standardization of confidentiality rules among agencies sharing identifiable statistical information. As each agency may have a need to share the data, but may be affected by different confidentiality rules, inefficiencies, accidental disclosures, and other similar problems may ensue.

115

116

One approach to this problem is to enact legislation which would not only authorize the transfer of identifiable data from administrative records (some of which are now declared "confidential" by statute) but would also prescribe strict, uniform confidentiality standards for all information collected or maintained for statistical purposes. Such legislation would require careful drafting to avoid imposing identical rules on general purpose statistical agencies and on small statistical offices located in mission-oriented agencies. Otherwise, the oneway transfer of administrative records to offices performing research in support of regulatory activities would isolate these offices from program and policy concerns.

An alternative, and perhaps better, solution is to create "enclaves❞
of statistical activity, such as those pursued by the major, general
purpose statistical agencies. Data could be freely exchanged and
merged under an umbrella of general protection from disclosure.
Further, these enclaves could be encouraged by their parent
departments to inherit the statistical and research missions of
smaller statistical programs or contractors. Any movement toward
decentralizing statistical activities into small offices which might be
embroiled in disclosure conflicts would be discouraged.

The consolidation and coordination of all statistical/research
activities in one field—such as energy or health — into a single
umbrella agency with confidentiality protection to preclude the
disclosure of identifying particulars could satisfy the competing
interests previously discussed. Thus, the public policy of openness
would be served not only by the public dissemination of the fruits of
such research, but also by limiting the extension of further confiden-
tiality laws to those programs engaged exclusively in statistical
activities, where such laws do not operate to withhold information
"of public interest" from the public. Private interests would also be
served by the removal of identifying particulars prior to public
release. Of primary importance to this Commission would be the
reduced costs and paperwork burdens effected by eliminating
duplicative collection and maintenance of statistical data and the
opportunity presented for the more effective utilization of such data.
The Privacy Protection Study Commission: Report and
Recommendations on Statistical Data about Individuals
The PPSC report recommends, in its chapter on Research and
Statistical Studies, that Congress enact legislation to provide:

That no information collected or maintained in connection
with Federal or federally funded research or statistical
activities be used in individually identifiable form to make
any decision or take any action directly affecting the
individual except within the context of the research plan or
with the specific authorization of the individual. Exceptions
would be provided to accommodate special circumstances,
such as to forestall physical injury to a data subject, to audit
or evaluate research programs, for disclosure to the
National Archives and Records Section (NARS), or to
comply with a court order relating to an alleged violation of
law by a researcher or the institution or agency maintaining

the records. Individuals would be given a right of action
against any person, institution, or agency unlawfully disclos-
ing or seeking disclosure of individually identifiable informa-
tion about them.

That, in addition to the notice requirements in the Privacy
Act, unless prohibited by Federal statute, any Federal
agency collecting individually identifiable information for
research or statistical purposes be required to notify the
individual, at the time of collection, of the possible future use
or disclosure of such data, in identifiable form, for further
research or statistical purposes and of any required disclo-
sure in identifiable form for other purposes, in which event
he would be promptly notified.

That when individually identifiable information is collected
from an individual by a Federal agency or with Federal
funding for a nonresearch purpose, the individual be
informed that such information may be used or disclosed in
individually identifiable form for a research or statistical
purpose, with appropriate safeguards, and that he may be
recontacted as a result of such use or disclosure.

Other PPSC recommendations are also geared toward encouraging
research and statistical activities while providing stronger confiden-
tiality safeguards:

That individually identifiable information be maintained only
as long as necessary to fulfill the research purposes for
which it was collected, unless otherwise required by law or
regulation.

That the National Academy of Sciences, in conjunction with
the relevant Federal agencies and with other scientific and
professional organizations, be requested to develop and
promote the use of techniques to protect the anonymity of
individual data subjects in research or statistical programs.
That, unless prohibited by Federal statute, & Federal agency
be permitted to use or disclose in individually identifiable
form for research or statistical purposes any information it
collects or maintains without the authorization of the subject
individual provided that the agency determines that such
use or disclosure is necessary for valuable statistical or
research purposes and that both the agency and the
recipient agree, in writing, to limitations on further use or
disclosure in individually identifiable form and measures to
protect the information from unauthorized disclosure (in-
cluding a program for removal or destruction of identifiers).
That Federal agencies monitor and impose conditions upon
the record management practices of their contractors and
grantees to safeguard the confidentiality of individually
identifiable information used for research or statistical
activities by: requiring contractors or grantees to establish
and maintain reasonable procedures to protect such infor-
mation from unauthorized disclosure (including provision for
removal or destruction of identifiers), specifying rules for the 117

118

disposition of such information upon the termination of contracts or grants, and making contractors or grantees subject to the most stringent applicable statutory requirements.

That contractors and grantees collecting or maintaining statistical or research data be prohibited from disclosing individually identifiable information for further research or statistical purposes except pursuant to a written agreement containing the above limitations and restrictions.

That if any information collected or maintained for statistical or research purposes were disclosed in individually identifiable form without an assurance that it would not be used to make a decision or take action against the subject individual or without a prohibition on further use or disclosure, as, for example, under one of the recommended statutory exceptions, the individual be notified of the disclosure and of his right of access to the record and to any accounting of its disclosure.

The PPSC has suggested that these principles can best be established by amending the Privacy Act and by the passage of "a new Federal statute to provide a common line of minimum protection for the confidentiality of Federal or federally assisted research and statistical records."70

Insofar as these proposals address issues and problems previously discussed such as the need to permit greater use and disclosure of administrative records for statistical purposes, the need to extend confidentiality controls to Federal contractors and grantees, and the need to prohibit the use of statistical records for administrative purposes this Commission strongly endorses the PPSC recommendations. Other PPSC proposals are troublesome:

Time Limitations on Retention. Such limitations would compel agencies to review their requirements for longitudinal studies of panels or cohort groups. This may well be a salutary measure. Unfortunately, however, this proposal, by limiting retention to the purpose for which information was collected, could require agencies to eliminate identifiers from many records, thereby precluding their use for follow-up research. Removing the identifiers from a study could result in increased costs and added burdens on individual respondents by requiring further contacts with participants in a previous survey. As long as proper legal, administrative, and physical safeguards are in force — such as those recommended by this Commission there seems little to be lost and much to be gained by retaining at least one copy of identifiable statistical records in agency archives when follow-up analyses are contemplated. Moreover, removal of identifiers from the records of participants in environmental, medical, or behavioral experiments could endanger the safety of such individuals. In those studies where any

70 N. 16, supra, p. 600. Although the PPSC Report suggests that several of these recommendations be embodied in amendments to the Privacy Act, that report does not specify the amendments or even the subsections of the Act that would be amended.

psychological or physical risk is present, the researcher has an obligation to retain identifiable records, not to dispose of them. Disclosure or Use of Individually Identifiable Records for Research or Statistical Purposes. In view of the proscription that would be imposed, by statute, on the use of such information for decision-making purposes, these conditions seem unduly restrictive. With adequate security and confidentiality safeguards, such as those recommended by the PPSC, there should be no need to impose any conditions, other than a need for the information, on the transfer of records for statistical purposes.

Conditions Imposed on the Use of Administrative Records for Research or Statistical Purposes; Notifying Data Subjects. As mentioned earlier, in discussing the "routine use" provision, even when collecting information for statistical purposes, it may be difficult to predict all the uses that may be made of such data. When agencies collect information for administrative or regulatory purposes-with no thought of future research use they would be required, in order to comply with the proposed legislation, to give a pro forma notification to all respondents that the data may someday be used for statistical purposes. Such automatic, uniform notification fails to satisfy even the vague concept of "informed consent". Certainly, if the information were being collected on a mandatory basis, there would be no voluntary consent resulting from such notification. In view of the controls to be placed, by statute, on the use of such data for other than research or statistical purposes, the notification requirements seem ineffective and unnecessary.

As mentioned above, subsection (b)(5) of the Privacy Act, by limiting the form in which data may be transferred for statistical purposes, has precluded or vitiated many worthwhile research programs. This report suggested earlier that that statutory limitation on the disclosure of identifiable information be removed. This, in effect, is what the PPSC has now recommended by proposing that agencies be permitted to use or disclose individually identifiable data for research or statistical purposes. This Commission would place only two conditions on such disclosures: (1) that the information is needed for and will be used solely for research and statistical purposes, and (2) that security and confidentiality safeguards will be provided to protect the records and the anonymity of subject individuals.

Intergovernmental Relations

The confidentiality of information collected and maintained by the Federal Government relates not only to individual and business data but also to information collected from State and local governments. Similarly, information relating to State or locally administered Federal programs may be transferred from the Federal to the State or local level. Confidentiality rules may vary at each level, from State to State, and from program to program.

In an effort to reduce the paperwork burdens on the States, this Commission has made far-reaching recommendations in its reports on Health, Welfare, and Equal Employment Opportunity suggesting increased consolidation and centralization of informa

119