Which rule did the Privacy Act of 1974 establish regarding the disclosure of personal information held by federal agencies?

• A. It requires agencies to publish all system-of-record notices publicly annually.
• B. It allows agencies to disclose information about an individual from a system of record to contractors without consent.
• C. It prohibits Federal agencies from disclosing information about an individual from a system of record without that person's prior written consent.
• D. It imposes no restrictions on disclosure.

Answer: (C)

The rule being tested is that personal information held by federal agencies is protected from disclosure unless the individual provides written permission. The Privacy Act sets a default of restricting disclosures, so an agency generally cannot share records about someone from a system of records without that person's prior written consent. This emphasizes the individual's control over their own data and ensures that sharing outside the agency is carefully limited.

There are narrow exceptions to that rule, such as disclosures that fall under specified routine uses described in the system’s notice or disclosures required by law, but those are not blanket permissions. That makes the statement about needing written consent the best description of the Act’s primary requirement.