The Privacy Act of 1974 (Privacy Act) applies to a system of records (SOR). A SOR is generally created when records:

• Are controlled by a Federal agency;
• Include personally identifiable information (PII); and
• Are actually retrieved by a unique identifier such as a full name.

Federal agencies should publish a notice about each SOR in the Federal Register. This notice, called a system of records notice (SORN), informs the public about the SOR. For example, a SORN generally describes how records in the SOR are used and how to find out if your records are stored in the SOR. The DHA Privacy and Civil Liberties Office provides a list of all DHA SORNs to cite.

Individuals should generally receive a Privacy Act Statement if a Federal agency asks individuals to collect their PII and incorporates the individual’s PII in a SOR. The Privacy Act Statement describes:

1. the authority to collect;
2. if disclosure of such information is mandatory or voluntary;
3. the principal purpose(s) for which the information is intended to be used;
4. the applicable routine uses;
5. the effects, if any, on the individual if not providing all or part of the requested information; and
6. an appropriate citation and, if practicable, a link to the relevant SORN(s).

You will receive a Privacy Act Statement (PAS) if a Federal agency asks you for your PII and places that PII in a SOR. That PAS describes the system collecting your PII. It also explains what will happen to your PII and what will happen if you choose not to provide your PII. An example of a PAS.

The DHA Privacy and Civil Liberties Office will help determine when DHA systems require a SORN or PAS and will help system managers write those notices.