Federal Statutory Privacy

This document is an (incomplete) survey of federal statutes which affect informational privacy.

It is not intended as legal advice; the research behind it was current as of approximately January 1996. Corrections, clarifications, and additions are welcome via E-mail to gbroiles@netbox.com.

Right to Financial Privacy Act

The Financial Privacy Act, 12 U.S.C. 3401-3422, was enacted by Congress in 1978 in response to what was seen as intrusive behavior on the part of the Federal Government with respect to consumer's financial records. In 1976, the Supreme Court issued its decision in United States v. Miller, where it ruled that banking records kept by banks pursuant to the Banking Secrecy Act of 1970 were the property of the banks. Because the records belonged to the banks and not to the customers, the customers did not have a protected privacy in those records. Congress responded to the Miller decision with the RFPA, which "seeks to strike a balance between customers' right of privacy and the need of law enforcement agencies to obtain financial records pursuant to legitimate investigations."⁽¹⁾ The RFPA requires that federal law enforcement agencies who seek to gain access to an individual's banking records must first give the individual notice that they intend to request disclosure, and they must provide proof of that notice to the financial institution. The RFPA also provides that the consumer must have an opportunity to challenge the requested disclosure. Financial records protected by the Act include bank statements, loan applications, financial statements, mortgages, and cancelled checks⁽²⁾. A bank's conclusion that a customer's records may relate to illegal acts is itself a financial record if it a summary of or based on an analysis of the customer's financial records⁽³⁾. The Act immunizes financial institutions from liability where they act to notify law enforcement agencies that they have information which may relate to illegal activity, describing that activity, and provide the name of the customer suspected of the illegal activity⁽⁴⁾. However, if a financial institution discloses customer records in addition to notifying law enforcement of suspicious activity, it may be liable to the customer whose records were disclosed⁽⁵⁾. The Act only applies to financial records of individuals or small partnerships (less than 5 partners); it is not interpreted to bar disclosure of information about ERISA-based retirement plans administrated or maintained by banks⁽⁶⁾, and does not protect corporations from disclosure of their financial records⁽⁷⁾.

Electronic Communications Privacy Act

The Electronic Communications Privacy Act of 1986 was enacted to provide comprehensive regulation of wiretapping, bugging, and other interceptions of communications. The Act applies to three different kinds of communications: wire communications, oral communications, and electronic communications. A "wire communication" is an aural transfer made in whole or in part through the use of facilities for the transmission of communications by the aid of wire or cable. A "wire communication" includes electronically stored wire communications. An "oral communication" is an oral communication uttered by a person with a subjective expectation of privacy which is objectively reasonable, but does not include electronic communications. An "electronic communication" is a transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic, or photooptical system that affects interstate or foreign commerce, but does not include oral or wire communications.

The Act prohibits intercepting wire, oral, and electronic communications, using a mechanical or electronic device to intercept such communications, attempting to intercept or use a device to intercept communications, disclosing the content of an intercepted communication, or using the content of an intercepted communication. The Act provides exceptions for communications service providers to intercept communications as necessary to provide service or to protect their rights, and for interceptions performed pursuant to a court order. The Act provides that persons acting under color of law may intercept wire, oral, or electronic communications where they have permission from a party to the communication or where they are a party; and that any person may intercept a wire or oral communication which they are a party or have permission from a party so long as the interception is not done for a tortious or criminal purpose⁽⁸⁾.

As originally drafted, the ECPA did not protect transmissions between a cordless telephone's handset and base⁽⁹⁾. Those conversations were expressly excluded from the definitions of "wire communication" and "electronic communication"; and courts refused to consider their transmissions "oral communications" because early cordless telephones broadcast using frequencies which could be easily monitored using scanners and even some consumer televisions and radios. Thus, cordless telephones were unprotected by the Act. Recent rulings have suggested that newer cordless telephones, which utilize more obscure frequencies, encryption, and other means of avoiding interception or interference may be entitled to a reasonable expectation of privacy and thus come within the protection of the Act and the Fourth Amendment⁽¹⁰⁾. Congress amended the ECPA in 1994 to bring cordless telephones within the ECPA's protection.

Other devices and circumstances related to "oral communications" have lacked sufficient expectations of privacy to bring a communication within the protection of the Act. Voice pager broadcasts are "oral communications" and their users have no reasonable expectation of privacy in those broadcasts⁽¹¹⁾. Where a police officer clandestinely taped (by standing three feet away with a hidden tape recorder) one side of a telephone conversation, that tape was not an interception of a wire communication. The defendant's speech (as captured on the recorder) was considered an oral conversation, and defendant had no expectation of privacy, even where defendant spoke in Thai and assumed police officer could not understand Thai⁽¹²⁾. A commodity trader's statements on the floor of a mercantile exchange were without reasonable expectation of privacy and thus were not oral communications, so an undercover agent's taping of those statements was not an interception⁽¹³⁾.

Another loophole courts have found in the Act is the "extension telephone" exception; ordinary telephone conversations may only be intercepted with the aid of a telephone or some other device which would convert the electrical signals into sound waves perceptible by humans. The Act, at 18 U.S.C. 2510(5)(a), exempts from the definition of "device" ordinary telephones provided to consumers by service providers. Courts have interpreted this to mean that eavesdropping within the same location as a party to the communication, where the eavesdropper uses another phone to listen to the conversation, is not prohibited by the Act⁽¹⁴⁾. Court using this exception seem to be reluctant to regulate employee-employer or family relationships. One court, however, has ruled that the spousal or family exception does not apply where the parties have separated and one spouse taped telephone calls between the other spouse and the couple's four year old daughter⁽¹⁵⁾.

Courts have also ruled that where an interception takes place outside the boundaries of the United States, the Act does not apply, even if one party is within the United States and the interception is later used against that party in court⁽¹⁶⁾.

The Fifth Circuit has adopted a view of "interception" such that it must happen contemporaneous with transmission. In Steve Jackson Games, Inc., v. United States Secret Service, the Secret Service seized a computer containing electronic mail sent between some 365 users of a computer bulletin board. The court held that the messages were electronic communications, but that their seizure (as the messages waited on the computer for the recipients to read them) was not an interception. The Court drew an analogy to an earlier case⁽¹⁷⁾ where federal agents seized a tape of a conversation from a suspect; in that case, the court had held that the seizure of the tape was not an intercept of the conversation because it did not occur at the time of the conversation.

Family Educational Right to Privacy Act

The Family Educational and Right to Privacy Act, passed in 1974, is designed to ensure access to educational records for students and parents and to protect the privacy of such records from the public at large⁽¹⁸⁾. It gives students at postsecondary institutions or who are over 18, and parents of students under 18, certain rights with respect to educational records. Students (or their parents, if they are under 18) have the right to review their educational records, and to request a hearing if their records are inaccurate. Students may not, however, use the hearing to correct an educational record to dispute a professor's grading policy⁽¹⁹⁾.

Educational institutions may not disclose educational records without written consent to third parties, beyond "directory information". They must, however, disclose information to students and their parents when that information is used to determine or review the placement or advancement of students within the educational setting⁽²⁰⁾. FERPA did not act as a bar to the introduction in a hearing to determine appropriate placement of a handicapped child, a videotape of that child's behavior up to the point on the tape where the child objected to the taping, and the video was only shown to school officials⁽²¹⁾.

FERPA in some instances will not act as a bar to the use of educational records where they are relevant to the defense in a criminal proceeding. School district records relating to placement in classroom for emotionally disturbed children, and of child's behavior, were discoverable in criminal action for sexual abuse against student's grandfather. FERPA did not bar disclosure where defendant called into question child's tendency towards false reporting of crime, need to attract attention, or ability to perceive and remember events. Access by defendant's attorney to those records, after review by the court to remove entirely irrelevant records, was appropriate⁽²²⁾.

FERPA also does not bar the release of information relating to the investigation of crime, "incident reports", or other documentation relating to public safety⁽²³⁾. Records which documented or alleged violations of university rules by fraternities and sororities were not "education records" within the FERPA because they did not relate to individual student academic performance, financial aid, or scholastic probation and were similar to records maintained for law enforcement purposes⁽²⁴⁾.

FERPA may be used by noncustodial parents to receive access to their children's school records, schedules, report cards, and other information. Parents have a right to receive that information even where the other parent requests in writing that it not be provided; schools must provide, at their expense, that information to both parties if it is requested⁽²⁵⁾.

FERPA itself does not provide a remedy for unauthorized disclosures or other violations. While courts were initially reluctant to read FERPA as granting a private right of action, a consensus has emerged that 42 U.S.C. 1983 may be used to create an individual cause of action for a violation of FERPA⁽²⁶⁾.

Fair Credit Reporting Act

The Fair Credit Reporting Act⁽²⁷⁾, enacted in 1971, regulates the activities of credit reporting agencies⁽²⁸⁾ and the users of credit reports⁽²⁹⁾. The FCRA is intended to "requiree that consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information."⁽³⁰⁾ Towards that end, the Act creates a compromise between credit reporting agencies' liability to consumers for defamation or invasion of privacy in credit reports and the credit reporting agencies' First Amendment rights to maintain and publish their databases as they choose. In exchange for limiting the agencies' liability to consumers, the Act limits the business practices of the agencies when collecting and transmitting credit reports.

1. H.R.Rep. No. 1383, 95th Cong., 2nd Sess. 33-34, as cited in Neece v. Internal Revenue Service 922 F.2d 572 (10th Cir., 1990).

2. Neece v. Internal Revenue Service 922 F.2d 573 (10th Cir., 1990).

3. 3 U.S. Op. Off. Legal Counsel 217 (1979).

4. 12 U.S.C. 3403(c); Waye v. Commonwealth Bank 846 F.Supp. 321 (1994).

5. Suburban Trust Co. v. Waller 44 Md.App. 335, 408 A.2d 758 (1979).

6. Donovan v. National Bank of Alaska 696 F.2d 678 (1983)

7. Spa Flying Service v. United States 724 F.2d 95 (8th Cir., 1984)

8. 18 U.S.C. 2511

9. United States v. Carr 805 F.Supp. 1266 (E.D.N.C., Raleigh Div., 1992); United States v. Smith 978 F.2d 171 (5th Cir., 1992); United States v. Sullivan 38 M.J. 746 (1993).

10. United States v. Sullivan 38 M.J. 746, 750 (ACMR, 1993); United States v. Smith 978 F.2d 171, 179-80 (5th Cir., 1992).

11. People v. Medina 189 Cal.App.3d 39, 234 Cal.Rptr. 256 (1987).

12. Siripongs v. Calderon 35 F.3d 1308 (9th Cir., 1994)

13. In re John Doe Trader Number One 894 F.2d 240 (7th Cir., 1990)

14. Simpson v. Simpson 490 F.2d 803 (5th Cir., 1974); Briggs v. American Air Filter 630 F.2d 414 (1980)

15. Platt v. Platt 951 F.2d 159 (8th Cir., 1989)

16. United States v. Cotroni 527 F.2d 708 (1975); State v. Nieuwenhuis 146 Ariz. 477, 706 P.2d 1244 (1985)

17. United States v. Turk 526 F.2d 654 (5th Cir., 1976)

18. Student Press Law Center v. Alexander 778 F.Supp. 1227 (D.C. Dist. Colum., 1991)

19. Tarka v. Cunningham 917 F.2d 890 (5th Cir., 1990)

20. Belanger v. Nashua, New Hampshire, School District 856 F.Supp 40 (D.NH, 1994)

21. MR v. Lincolnwood Board of Education, District 74 843 F.Supp. 1236 (N.D.Ill., E.D. 1994)

22. Zaal v. State 326 Md. 54, 602 A.2d 1247 (1991)

23. Bauer v. Kincaid 759 F.Supp. 575 (W.D. Missouri, S.D. 1991); Student Press Law Center v. Alexander 778 F.Supp. 1227 (D.C. Dist. Colum., 1991)

24. Red & Black Publishing Co. v. Board of Regents 262 Ga. 848, 427 S.E.2d 257 (1993)

25. Fay v. South Colonie Central School District 802 F.2d 21 (2nd Cir., 1986); Page v. Rotterdam-Mohonasen Central School Dist. 441 N.Y.S.2d 323 (1981)

26. Maynard v. Greater Hoyt School Dist., 876 F.Supp 1104, 1107 (D.S.D., So. Div., 1995);Belanger v. Nashua, New Hampshire School Dist. 856 F.Supp 40, 48 (D.N.H., 1994); Tarka v. Cunningham 917 F.2d 890 (5th Cir., 1990); Fay v. South Colonie Central School Dist., 802 F.2d 21, 33 (2nd Cir., 1986). The Supreme Court's ruling in Suter v. Artist M. 503 U.S. 347, 112 S.Ct. 1360, 118 L.Ed.2d 1 (1992) about the use of 1983 to enforce federal statutes suggests that pre-Suter cases applying 1983 to FERPA violations should be re-examined.

27. 15 U.S.C. 1681-1681t

28. A"credit reporting agency" is a person or business which, for monetary dues, fees, or on a cooperative nonprofit basis, regularly assembles or evaluates consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses a means or facility of interstate commerce to prepare or furnish those reports. 15 U.S.C. 1681a(f).

29. A "consumer report" is information provided from a credit reporting agency's "consumer file" to a third party, which bears on a consumer's creditworthiness, credit standing or capacity, character, reputation, personal characteristics, or mode of living, where the information was used, expected to be used, or collected for a "permissible purpose". 15 U.S.C. 1681a(d). The "permissible purposes" are establishing the consumer's eligibility for credit or insurance to be used for personal, family, or household purposes, or for employment purposes, to establish eligibility for government licenses or benefits, and to respond to a legitimate business need in connection with a business transaction involving the consumer.

30. 15 U.S.C. 1681(b)