AILSA CHANG, HOST:
Across federal agencies, the government stores a lot of data on all of us. We're talking about addresses and Social Security numbers, for sure, but also information that could be even more sensitive, like medical diagnoses or whether you've ever filed for bankruptcy. Now Elon Musk's Department of Government Efficiency - also known as DOGE - has access to the databases storing all of that data, and it's raising alarm. At least a dozen lawsuits are attempting to stop DOGE from tapping into this personal information. And these lawsuits have focused on one particular legal avenue, a 50-year-old law called the Privacy Act of 1974. With us to talk about that law is Danielle Citron. She's a law professor at the University of Virginia. Welcome.
DANIELLE CITRON: Thank you for having me.
CHANG: So before we talk about these lawsuits, can you just take us back to the mid-1970s? How did the Privacy Act of 1974 even come about? Like, what was it designed originally to do?
CITRON: So it was amidst a time in the late '60s where Congress sort of got wind of the fact that agencies had about 7,000 systems of records, so databases. And they got really interested in it because the National Crime Information Center - so the FBI now we think of as the database that shares criminal information between the states, locals and the feds - had an incredible amount of sensitive information, including arrests that never went anywhere. And that information was being freely shared with employers, with colleges. So people were losing life opportunities. And, you know, all of this is happening in the backdrop of Watergate, in the backdrop of Hoover's blacklist, which contained files on every single senator and congressman. They were gathering personal data on each and every one of us that were being shared across agencies without any safeguards. And there was heated agreement across the aisle that we worried that it gave government a lot of power, excessive power, that could control us.
CHANG: And I'm sure there are a lot of people out there today who never even knew the Privacy Act of 1974 existed. How relevant has this law been over the last 50 years? Like, how much has it been invoked when there are concerns with how the federal government is handling people's private information?
CITRON: The Privacy Act was once a quite sleepy law in my privacy classes. It's gotten increasing prominence in part because there's been so much compliance with the Privacy Act. You know, every agency now has to put out, you know, notices about having new collections of information in databases. And there's chief privacy officers at every agency. You have to pay attention to it and adhere to its commitments, which are to ensure that you don't collect information you shouldn't be collecting for a proper purpose, and that you're not sharing it unless you meet the conditions of the Privacy Act.
CHANG: OK, well, then let's talk about these dozen or so lawsuits now that concern access DOGE has had to personal data. Who exactly is filing these lawsuits? Like, what's the argument that the plaintiffs are making here?
CITRON: Privacy groups and attorneys are representing employees of the government and individuals whose data is collected in these systems of records that are protected by the Privacy Act. And they're arguing that there's real harm here. They're losing their jobs. They're being fired. Presumably - we need to figure out in discovery if the loss of those jobs have to do with being in the databases, but we're pretty sure that's probably true. You need to figure out who the employees are so you can fire them. And asserting that the Privacy Act is sacred, and that we honor, when you turned over your data and you directly gave it to an agency, that it would only be accessed and used and disclosed pursuant to that reason you gave it to them...
CHANG: Right.
CITRON: ...And you trusted the government with that information.
CHANG: OK, but what is the argument that the Trump administration is making for why they are allowed, members of DOGE are allowed, to access this information?
CITRON: The Trump administration is arguing that the DOGE employees - let's say they're working at the Department of Education - that they have every right to go into these systems of records to check for fraud, waste and abuse.
CHANG: Simply because they are now employees of the Department of Education?
CITRON: That's right. And it's a fundamental misunderstanding of the Privacy Act - that if they worked at the Department of Education, they couldn't get into records that include, you know, personal data unless it was part of their job, right? And part of the Privacy Act is really specific about conditions on when, for law enforcement purposes, you can disclose information that's protected by the Privacy Act. And it's only when the head of a law enforcement agency makes a written request and it's really particularized about what records it wants.
CHANG: Even if a judge does rule that federal agencies should not be sharing this sensitive data with DOGE, isn't there still the possibility that the Trump administration won't be deterred and will continue to give DOGE access anyway? I'm sorry to even to be asking this question right now, but who's to say the Trump administration will care what a judge rules?
CITRON: Right. I mean, that's the fundamental question on the minds of every law professor, lawyer and law student, that even if, you know, a court so orders that DOGE employees shouldn't have access to these records, and that they should destroy any data that they collected in violation of the Privacy Act, that they may just say, sorry, I'm not going to comply with the court order. And I think at that moment, when that happens, you know, it's really testing our confidence in democracy and the rule of law.
CHANG: Danielle Citron is a law professor at the University of Virginia. Thank you very much for speaking with us.
CITRON: Thank you so much. Transcript provided by NPR, Copyright NPR.
NPR transcripts are created on a rush deadline by an NPR contractor. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.
