Privacy Act Modernization Act of 2025
Key claim: The Privacy Act Modernization Act of 2025 would expand Privacy Act protections to all natural persons in the US (not just citizens and permanent residents), impose stricter limits on government data use and disclosure, increase civil and criminal penalties including felony charges for willful commercial misuse, and apply immediately to DOGE and related entities upon enactment.
Abstract
(S1208 · 119th Congress) Privacy Act Modernization Act of 2025 This bill strengthens privacy protections that apply to personal data held or maintained by government agencies. These protections restrict the storage, access, use, and disclosure of personal data, such as an individual’s name or Social Security number. Currently, these protections apply to U.S. citizens and permanent residents. The bill expands this to include natural persons in the United States and certain associations and corporations. The bill places additional limits on the use and disclosure of such data, including by limiting the use of records to a legally authorized purpose and requiring disclosures to be minimal and consistent with a previously stated use. The bill also increases existing penalties and creates additional criminal penalties for violations. For example, under the bill, an agency employee who willfully discloses individually identifiable information with the intent to sell, transfer, use, or disclose such information for commercial advantage, personal gain, or malicious harm shall be guilty of a felony and fined not more than $250,000, imprisoned for not more than 10 years, or both. Courts may provide preliminary relief and, if the U.S. is found to have acted intentionally or willfully, the U.S. is liable for additional types of damages (e.g., punitive). The bill generally takes effect two years after the date of enactment. However, the bill takes effect immediately upon enactment with respect to certain actions taken by the Department of Government Efficiency (DOGE), certain special or temporary employees, and other related individuals and organizations. Latest action (2025-03-31): Read twice and referred to the Committee on Homeland Security and Governmental Affairs.
Why this matters
The Privacy Act of 1974 is the foundational U.S. statute governing federal agencies’ handling of personal records, and any modernization directly reshapes individuals’ rights against the government and agencies’ compliance obligations. Extending coverage to all natural persons in the U.S., adding felony penalties for commercial misuse, and singling out DOGE for immediate applicability would meaningfully broaden both who is protected and how enforcement operates. As introduced legislation, it establishes a marker for how Congress may respond to concerns about executive-branch data consolidation and reuse.