Privacy Act Modernization Act of 2025

This bill modernizes the 1974 Privacy Act by updating definitions of key terms like "personally identifiable information" and "system of records" to better reflect current data practices. It strengthens protections by requiring agencies to use only the minimum necessary personal data for disclosures, disclose legal authorities for data uses, and prohibit adverse actions based on automated matching. The bill adds civil remedies including minimum $1,000 damages for violations and increases criminal penalties for misuse (e.g., up to $250,000 fines or 10 years imprisonment for commercial misuse). These changes directly affect federal agencies handling personal data and apply to all data collection, use, and disclosure activities governed by the Privacy Act.