individuals who maintain a system of records without publishing the required public notice

Individuals who maintain a system of records about people without publishing the required public notice in the Federal Register can be subject to criminal (misdemeanor) penalties, including a fine of up to $5,000 under the U.S. Privacy Act of 1974.

What the law is about

The U.S. Privacy Act of 1974 regulates how federal agencies handle systems of records that are retrieved by personal identifiers (like name or ID number). It requires agencies to give public notice of each such system in the Federal Register so there are no “secret” databases about individuals. This notice describes what data are collected, how they are used, and how people can access or correct their records.

The specific violation

The key violation in your phrase is maintaining a system of records without publishing the required notice. The statute explicitly targets any officer or employee of a federal agency who “willfully maintains a system of records without meeting the notice requirements” in the Privacy Act. This focuses on intentional or knowing failure to provide the legally required public notice, not on accidental or trivial errors.

Penalties for failing to publish notice

Under the Privacy Act’s penalty section:

• Any officer or employee who willfully maintains such a secret system of records is guilty of a misdemeanor.

• The person can be fined not more than $5,000 for this violation.

Some secondary study resources incorrectly describe this as leading to only civil penalties, but the statute itself clearly provides a criminal misdemeanor and fine.

Why this matters now

Even in recent guidance and commentary on privacy and records management, secret or undisclosed systems of records are treated as a major risk to transparency and civil liberties. Public notice requirements and systems of records notices (SORNs) remain central tools for open government and for giving individuals a way to find, access, and challenge data held about them.

TL;DR: Under the U.S. Privacy Act, individuals (officers or employees of federal agencies) who maintain a system of records without publishing the required Federal Register notice face criminal misdemeanor liability and up to a $5,000 fine.