Just Security Blueprint Argues the Dormant Privacy Act of 1974 Is the Strongest Available Tool Against the Surveillance State

Just Security published “Reinvention Blueprint No. 3” on September 17, 2026, arguing that the Privacy Act of 1974 — largely unenforced under administrations of both parties — is the most powerful legal instrument currently available for dismantling the domestic surveillance architecture built since 2025. The piece contends that the administration has eroded the inter-agency data-silo distinctions the Act was written to enforce, and that rigorous enforcement by Democratic-led state attorneys general and private litigants could impose meaningful constraints without new legislation. The Blueprint series is explicitly aimed at post-2026 reform governance planning.

This is an argument rather than an occurrence, and it earns a timeline slot as a legal-strategy marker — the point at which a specific statutory theory enters the reform conversation with an institutional author behind it. The claim it rests on is one the corpus has documented independently: the 1974 Act’s operative premise is that agencies hold data in separate systems of records and may not freely merge them, and the 2025 data-centralization order (2025-08-01–trump-state-data-centralization-surveillance-order) together with the DOGE cross-agency access NPR reported (2026-01-23–npr-reveals-doge-privacy-act-violations) describe exactly the merger the statute contemplates as the harm. The “no new legislation” framing is the load-bearing part: every other reform vehicle on this beat — the Government Surveillance Reform Act (2026-03-12–wyden-lee-introduce-government-surveillance-reform-act-warrant-for-data-broker-purchases), the SAFE Act — requires a Congress willing to pass it, while the Privacy Act requires only a plaintiff and a court. Whether state AGs take it up is the testable prediction this entry exists to be checked against.