PRIVACY Act
- Sponsor
- Rep. Self, Keith [R-TX-3]
- Committees
- Oversight and Government Reform Committee (primary)
- Last action
- Jul 15, 2026
Bottom line
The PRIVACY Act aims to enhance Fourth Amendment protections by requiring federal warrants for access to state and local surveillance data and limiting federal funding for certain surveillance technologies.
What it actually does
This bill establishes a "Jurisdictional Wall List" of state and local surveillance technologies, such as automated license plate readers and continuous cameras. It prohibits federal law enforcement agencies from accessing data collected by these listed technologies without a federal warrant, with narrow exceptions for emergencies or explicit consent. The bill also restricts federal funding for the purchase of these technologies and sets strict rules for data retention, minimization, and reporting to Congress.
Proponents argue
Proponents argue that the bill is crucial for safeguarding individual privacy and Fourth Amendment rights by closing a perceived loophole that allows federal agencies to access extensive surveillance data collected by state and local entities without judicial oversight. They contend it ensures due process, prevents dragnet surveillance, and promotes transparency in government data collection practices.
Opponents contend
Opponents might argue that the bill could unduly hinder legitimate law enforcement efforts by imposing overly strict warrant requirements and data retention limits, potentially delaying critical investigations, especially in rapidly evolving situations or those involving national security threats. They may also contend it creates unnecessary bureaucratic hurdles for inter-agency cooperation.
The bill is relatively short and clearly structured, making it accessible for an informed reader to understand its core provisions within a reasonable timeframe.
Section 2(a)
Establishment of Jurisdictional Wall List
This provision mandates the Attorney General to create and maintain a list of surveillance devices and technologies operated by state or local law enforcement agencies, known as the "Jurisdictional Wall List." The list must include, at a minimum, automated license plate readers, cameras capturing vehicle occupants, continuous coverage cameras, long-range microphones, and electronic fingerprint detection technology. The Attorney General must review and update this list every 90 days, publishing any additions in the Federal Register 30 days prior to their effective date.
Supporters argue
Supporters argue this list provides transparency and a clear framework for identifying technologies whose data requires federal judicial oversight, preventing arbitrary application of the warrant requirement and ensuring consistent privacy protections.
Critics contend
Critics might argue that the list could be overly broad or too narrow, potentially including technologies that do not pose significant privacy risks or omitting emerging technologies that do. The periodic review process could also create uncertainty for law enforcement planning.
Tradeoffs
This provision balances the need for clear guidelines on surveillance technologies with the flexibility to adapt to new technologies and evolving privacy concerns, while also defining the scope of federal intervention in state/local data practices.
Section 2(b)
Federal Warrant Requirement for Covered Surveillance Data
This section prohibits federal law enforcement agencies from accessing, receiving, querying, directing, tasking, or otherwise obtaining "covered surveillance data" (data from devices on the Jurisdictional Wall List) without a warrant issued by a federal judge. This establishes a direct legal barrier to federal agencies circumventing Fourth Amendment protections by accessing data already collected by state or local entities.
Section 2(c)
Data Retention and Evidentiary Rules
This section imposes strict limits on the retention of lawfully obtained covered surveillance data, generally capping it at 30 days, with a possible court-authorized extension of an additional 90 days for good cause, or for ongoing prosecutions. Crucially, data obtained without a warrant in violation of the Act, or retained longer than permitted, is inadmissible as evidence in federal court. However, such data must still be disclosed to the defense under Rule 16 of the Federal Rules of Criminal Procedure and Brady obligations. Data incidentally collected beyond the warrant's scope must be minimized and disposed of.
Section 2(e)
Emergency and Consent Exceptions to Warrant Requirement
This section outlines two exceptions to the federal warrant requirement. First, federal law enforcement can acquire covered surveillance data without a warrant in emergencies involving an imminent danger of death or serious physical injury, provided obtaining a warrant is impracticable and the data acquired is the minimum necessary. Such emergency data must be documented within 24 hours and disposed of within 30 days unless a warrant is subsequently obtained. Second, the warrant requirement does not apply if the person to whom the data pertains provides voluntary, informed, written consent for the agency to access the data.
Section 3
Limitations on Federal Funding for Surveillance Devices
This section prohibits the use of any federal funds to purchase, acquire, or install surveillance devices or technologies that are listed on the Jurisdictional Wall List. However, it includes several exceptions, such as for systems used solely for highway toll collection, school violence prevention programs (with specific limits), certain grants under the Omnibus Crime Control and Safe Streets Act (with limits), and portable systems operated for specific, case-bounded law enforcement purposes pursuant to a warrant and subject to minimization.
Section 4
Semiannual Reporting to Congressional Committees
This section requires the Attorney General to submit semiannual reports to the House and Senate Judiciary Committees. These reports must detail the number of incidents where federal law enforcement agencies accessed covered surveillance data, the number and nature of warrants obtained (including issuing courts and offense categories), the number of emergency exception uses (with justifications and outcomes), and any instances of non-compliance with warrant or retention rules, along with corrective actions taken. An unclassified summary of each report must be made publicly available.
Section 5
Minimization Standards
This section directs the Attorney General to promulgate regulations establishing minimization procedures for the acquisition of covered surveillance data. These procedures must include prompt deletion of non-pertinent data, strict segregation of data to prevent its use outside the scope of the warrant, and a specific prohibition on using covered surveillance data to identify individuals engaged in protected First Amendment activity without probable cause and a warrant. The regulations must also provide for auditing of federal law enforcement agencies to ensure compliance and for comprehensive training for their employees.
Section 8
Enforcement Mechanisms
This section establishes robust enforcement mechanisms for the Act. Any person whose covered surveillance data is obtained in violation of the Act may bring a civil action against the United States or a federal law enforcement agency for declaratory and injunctive relief, actual damages, and attorney's fees, with sovereign immunity waived. Federal employees who knowingly or recklessly violate the Act are subject to administrative sanctions, including suspension, termination, and referral to the Office of Professional Responsibility. Additionally, the Inspector General of each federal law enforcement agency is mandated to conduct periodic compliance audits and report findings to the Attorney General and Congress.
Defines "covered surveillance data" as surveillance data collected by a State or local law enforcement agency using any device or technology that is on the Jurisdictional Wall List as of the date of the collection of such data.
Section 10(2)
Why it matters:While placing definitions at the end is standard legislative practice, the specific wording of this definition is crucial as it directly determines the scope of the bill's primary warrant requirement and funding prohibitions.
Case for: Supporters argue that a precise definition is necessary to clearly delineate what data falls under the new warrant requirements, providing clarity for both law enforcement and the public and avoiding ambiguity in application.
Case against: No specific opposition is typically raised against the definition itself, but critics of the bill's overall scope might argue that the definition, by linking to the Jurisdictional Wall List, could be too broad or too narrow depending on how that list is maintained and updated.
Estimated impact: This definition is foundational; it dictates the entire scope of federal warrant requirements, data retention rules, and funding prohibitions established by the Act, directly impacting federal law enforcement operations and individual privacy protections.
Clarifies that the Act does not limit requirements under chapters 119 and 121 of title 18, United States Code (commonly referred to as the "Electronic Communications Privacy Act"), or section 552a of title 5, United States Code (the Privacy Act).
Section 9(c)
Why it matters:It is standard legislative practice to include such clauses to clarify how a new law interacts with existing statutes, ensuring legal consistency and preventing unintended repeal or diminution of prior protections.
Case for: Supporters argue this ensures the Act functions as an enhancement to, rather than a replacement for, existing privacy protections, providing a clear legal framework that builds upon established federal privacy laws.
Case against: No specific opposition is typically raised against this clarifying provision, as it serves to strengthen the bill's legal foundation by confirming its additive nature to existing privacy safeguards.
Estimated impact: This clause ensures that the PRIVACY Act functions as an additional layer of privacy protection, rather than superseding or weakening existing federal privacy statutes like ECPA and the Privacy Act, thereby maintaining a comprehensive privacy landscape.