Trahan Report Calls for Overhaul of Decades-Old Privacy Act

Democratic Rep. Lori Trahan this week released a sweeping report arguing that the Privacy Act of 1974, once a landmark safeguard against government overreach, is now structurally incapable of protecting Americans in an era defined by cloud computing, data brokers, and artificial intelligence.

Concerns Over Data Handling Spur Reform Push

The 68-page report warns that “privacy pessimism, cynicism, and fatalism predominate” after decades of limited updates to the foundational federal privacy law. It was developed after Trahan issued a Request for Information (RFI) in March 2025, seeking public input on how to update the law.

Trahan frames the report as deliberately bipartisan and bicameral in scope, with recommendations designed “to make responsible data processing easier and irresponsible data processing impossible.” The report draws on responses from civil organizations, former federal officials, industry stakeholders, and privacy advocates to outline a legislative roadmap for overhauling how the federal government collects, processes, shares, and oversees personal data.

Historical Context and Recent Incidents

Enacted in the aftermath of Watergate and revelations of illegal domestic surveillance by the Federal Bureau of Investigation, the Privacy Act of 1974 established rules governing federal agencies’ collection, maintenance, use, and disclosure of personal information. However, the report argues the law has not kept pace with technological advancements.

“The Privacy Act was written for a world of file cabinets and mainframe computers, not one defined by cloud storage, data brokers, and AI,” Trahan said in a statement. “Americans should be able to trust that their personal information is handled responsibly by their government.”

Recent incidents, including alleged unauthorized data exfiltration at the Department of Treasury and Social Security Administration by the Department of Government Efficiency (DOGE), and expanded surveillance activities by the Department of Homeland Security, have exposed “deep vulnerabilities” in the statute’s structure. Trahan stated she “was horrified by the brazen violations to our privacy perpetrated in the name of combatting waste, fraud, abuse and modernizing information technology systems.”

Shifting to a Purpose-Centric Model

At the heart of the blueprint is a conceptual shift away from a “system-centric” privacy model toward one that is “purpose-centric.” Currently, the Privacy Act’s requirements hinge on whether information is contained in a “system of records,” defined by how data is retrieved rather than how it is used. The report argues this retrieval-based model is ill-suited to modern data flows.

Key recommendations include modernizing key definitions – including “individual,” “record,” “system of records,” and “matching program” – to broaden coverage and support a new regulatory model. The report proposes redefining “individual” to cover all natural persons whose data is processed by the federal government, and redefining “record” to encompass any personally identifiable information processed by a federal agency.

Strengthening Data Minimization and Consent

The report also calls for strengthening data minimization standards, replacing the current requirement to maintain only information that is “relevant and necessary” with a requirement that processing be “necessary, proportionate, and limited.” It also recommends eliminating the President’s ability to authorize new processing purposes via executive order.

Regarding consent, the report argues current requirements have become a “procedural checkbox” that is easily skirted. The blueprint recommends narrowing and standardizing exceptions, eliminating broad “require to know” and “routine use” carve-outs, and reserving heightened consent requirements for high-risk processing.

Enhanced Oversight and Enforcement

The report proposes a significant restructuring of oversight and enforcement, including enhancing enforcement by recognizing nonpecuniary privacy harms and authorizing equitable relief; consolidating transparency measures into a machine-readable public inventory; and adopting privacy enhancing technologies. It suggests collocating privacy oversight in the legislative branch, potentially through a new investigative entity or expanding the role of the Government Accountability Office.

the report calls for establishing a Chief Privacy Officer (CPO) at every agency, reporting directly to the head of the agency and possessing a background in law, and technology.

Path Forward and Political Challenges

Whether such sweeping reform can advance in a divided Congress remains uncertain. However, the report positions Privacy Act modernization as both a defensive measure against abuse and an affirmative strategy for restoring trust in government. As the executive summary argues, “Governmental privacy … demands as much – if not more – attention than commercial privacy.”