Overview of the Privacy Act: 2020 Edition

Agency Requirements

The Privacy Act requires agencies maintain systems of records according to certain standards.  The Act includes 11 such requirements which are discussed in turn below.

 

A. 5 U.S.C. § 552a(e)(1) - Maintain Only Relevant and Necessary Information

“Each agency that maintains a system of records shall –

(1) maintain in its records only such information about an individual as is relevant and necessary to accomplish a  purpose of the agency required to be accomplished by statute or by executive order of the President.” 5 U.S.C. § 552a(e)(1).

Comment:

Agencies can only keep records that are “relevant and necessary” for a purpose “required to be accomplished” by law.

This subsection “authorizes the Government to keep records pertaining to an individual only when they are ‘relevant and necessary’ to an end ‘required to be accomplished’ by law.  NASA v. Nelson, 562 U.S. 134, 142 (2011); Reuber v. United States, 829 F.2d 133, 139-40 (D.C. Cir. 1987); Azmat v. Shalala, 186 F. Supp. 2d 744, 751 (W.D. Ky. 2001), aff’d per curiam sub nom. Azmat v. Thompson, No. 01-5282 (6th Cir. Oct. 15, 2002); Nat’l Fed’n of Fed. Emps. v. Greenberg, 789 F. Supp. 430, 433-34 (D.D.C. 1992), vacated & remanded on other grounds, 983 F.2d 286 (D.C. Cir. 1993); NTEU v. IRS, 601 F. Supp. 1268, 1271 (D.D.C. 1985); Chocallo v. Bureau of Hearings & Appeals, 548 F. Supp. 1349, 1368 (E.D. Pa. 1982), aff’d, 716 F.2d 889 (3d Cir. 1983) (unpublished table decision); see also AFGE v. HUD, 118 F.3d 786, 794 (D.C. Cir. 1997) (finding constitutional agency use of release form on employment suitability questionnaire in light of Privacy Act’s subsection (e)(1) requirement and “relying on the limitation that the release form authorizes the government to obtain only relevant information used to verify representations made by the employee”); Barlow v. VA, No. 92-16744, 1993 WL 355099, at *1 (9th Cir. Sept. 13, 1993) (holding that VA’s request for appellant’s medical records did not violate Privacy Act because VA is authorized to request such information and it is “relevant and necessary” to appellant’s claim for benefits; citing subsection (e)(1)); Press v. United States, No. JKB-17-1667, 2018 WL 3239495, at *2 (D. Md. Jul. 7, 2018) (finding subsection (e)(1) was improper vehicle for claim where plaintiff was not challenging legality of collecting information related to his security clearance); Kelley v. FBI, 67 F. Supp. 3d 240, 260-262 (D.D.C. 2014) (finding plaintiff alleged insufficient facts to support plausible inference of intentional and willful conduct because it was relevant and legal for FBI and DOD to seek to understand nature of potentially inappropriate relationship involving military officer revealed by e-mails in record); Crummey v. SSA, 794 F. Supp. 2d 46, 56-57 (D.D.C. 2011) (ruling that SSA need not amend records because doing so “would require the SSA to maintain information about [plaintiff] that is neither relevant nor necessary to accomplishing any purpose of the SSA” where plaintiff – who believed that SSA created trust when it assigned him social security number and social security card and who had “drafted an agreement designed to reflect the alleged creation of the Trust” – requested amendment of his records “to include a copy of the Trust Agreement, or to reflect its contents”), summary affirmance granted, No. 11-5231, 2012 WL 556317 (D.C. Cir. Feb. 6, 2012); Thompson v. State, 400 F. Supp. 2d 1, 18 (D.D.C. 2005) (“While an agency normally would have no reason to maintain information on an employee’s personal relationships, in these circumstances plaintiff’s relationship was inextricably linked with allegations of favoritism by her supervisor.”); Felsen v. HHS, No. 95-975, slip op. at 59-61 (D. Md. Sept. 30, 1998) (discussing how subsection (e)(1) “refers to the types of information maintained and whether they are germane to the agency’s statutory mission,” and “does not incorporate [an] accuracy standard”); Jones v. Treasury, No. 82-2420, slip op. at 2 (D.D.C. Oct. 18, 1983) (ruling that maintenance of record concerning unsubstantiated allegation that ATF Special Agent committed crime was “relevant and necessary”), aff’d, 744 F.2d 878 (D.C. Cir. 1984) (unpublished table decision); Conyers v. VA, No. 16-CV-00013, 2018 WL 1867106, at *9 (E.D.N.Y Jan. 29, 2018) (magistrate’s recommendation) (finding no subject matter jurisdiction over plaintiff’s claim that agency violated statute because plaintiff did not challenge counseling report as “relevant and necessary;” rather, plaintiff claimed agency “failed to utilize the information documented” in its benefit determination which was merely attack on determination and “rhetorical cover” for plaintiff’s challenge to his benefits determination), adopted, 2018 WL 1089736 (E.D.N.Y. Feb 26, 2018); Kalderon v. Finkelstein, No. 1:08 Civ. 09440, 2010 WL 9488933, at *28 (S.D.N.Y. Mar. 10, 2010) (magistrate’s recommendation), adopted in pertinent part, 2010 WL 3359473 (S.D.N.Y. Aug. 25, 2010), aff’d, 495 F. App’x 103 (2d Cir. 2012); see also OMB 1975 Guidelines, 40 Fed. Reg.at 28,960-61, https://www.justice.gov/paover​view_omb-75; 120 Cong. Rec. at 40,407, reprinted in Source Book at 863.

 

B. 5 U.S.C. § 552a(e)(2) - Collect Information, to the Greatest Extent Practicable, Directly from the Individual

“Each agency that maintains a system of records shall –

. . .

(2) collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual’s rights, benefits, and privileges under Federal programs.”  5 U.S.C. § 552a(e)(2).

Comment:

In order to obtain relief under subsection (e)(2) of the Privacy Act, a plaintiff must establish that: (1) the agency failed to elicit information directly from the plaintiff to the greatest extent practicable; (2) the violation of the Act was intentional or willful; and (3) this action had an adverse effect on the plaintiff.  Waters v. Thornburgh, 888 F.2d 870, 872 (D.C. Cir. 1989).  Waters involved a Justice Department employee whose supervisor became aware of information that raised suspicions concerning the employee’s unauthorized use of administrative leave.  888 F.2d at 871-72.  Without first approaching the employee for clarification, the supervisor sought and received from a state board of law examiners verification of the employee’s attendance at a bar examination.  Id. at 872.  In finding a violation of subsection (e)(2) on these facts, the D.C. Circuit ruled that “[i]n the context of an investigation that is seeking objective, unalterable information, reasonable questions about a subject’s credibility cannot relieve an agency from its responsibility to collect that information first from the subject.”  Id. at 873 (emphasis added); accord Dong v. Smithsonian Inst., 943 F. Supp. 69, 72-73 (D.D.C. 1996) (“concern over Plaintiff’s possible reaction to an unpleasant rumor” did not warrant Smithsonian Institution’s “fail[ure] to elicit information regarding her alleged unauthorized courier trip directly from her”), rev’d on grounds of statutory inapplicability, 125 F.3d 877 (D.C. Cir. 1997) (ruling that “Smithsonian is not an agency for Privacy Act purposes”).

The OMB 1975 Guidelines suggest several factors to be evaluated in determining whether it is impractical to contact the subject first.  40 Fed. Reg. at 28,961, https://www.justice.gov/paoverview_omb-75; see also 120 Cong. Rec. 40,407, reprinted in Source Book at 863, https://www.justice.gov/opcl/paoverview_​sourcebook.

Courts generally have not required agencies to obtain information directly from the subject individual where the individual could interfere with evidence or is accused of misconduct.

The D.C. Circuit in Waters distinguished its earlier decision in Brune v. IRS, 861 F.2d 1284 (D.C. Cir. 1988), which had permitted an IRS supervisor to contact taxpayers to check on an agent’s visits to them without first interviewing the agent, based upon the “special nature of the investigation in that case – possible false statements by an IRS agent” and the concomitant risk that the agent, if contacted first, could coerce the taxpayers to falsify or secret evidence.  Waters, 888 F.2d at 874; see also Velikonja v. Mueller, 362 F. Supp. 2d 1, 19-20 (D.D.C. 2004) (“seeking records from an electronic door log is very different from asking [plaintiff’s] colleagues, rather than her, about her schedule” as “[t]he door log provided the most objective source of information about her actual entry times to the building, and unlike the proof of bar exam attendance in Waters, the records could not be obtained from plaintiff”), aff’d in pertinent part & rev’d in part sub nom.  Velikonja v. Gonzales, 466 F.3d 122 (D.C. Cir. 2006) (per curiam).

Consistent with Brune, two other decisions have upheld the IRS’s practice of contacting taxpayers prior to confronting agents who were under internal investigations.  See Alexander v. IRS, No. 86-0414, 1987 WL 13958, at *6-7 (D.D.C. June 30, 1987); Merola v. Treasury, No. 83-3323, slip op. at 5-9 (D.D.C. Oct. 24, 1986). 

In addition, the courts have often followed Brune rather than Waters where there was an indication that the subject of the records previously harassed or threatened other potential witnesses or where it would not have made a difference had the subject been contacted first.  For example, the Court of Appeals for the Sixth Circuit relied on Brune and the OMB guidelines and regulations to hold that subsection (e)(2) had not been violated by an investigator looking into charges of misconduct by an Assistant U.S. Attorney who had interviewed others before interviewing her.  Hudson v. Reno, 130 F.3d 1193, 1205 (6th Cir. 1997).  Given that the district court had found that the AUSA “was suspected of making false statements and she was allegedly intimidating and threatening people and otherwise dividing the U.S. Attorney’s office,” the Sixth Circuit held that “[a]ll of these practical considerations demonstrate that [the investigator] did not violate the Privacy Act when he interviewed others before interviewing [her].”  130 F.3d at 1205. 

Moreover, in a case involving a misconduct investigation into whether an agency employee had been intoxicated on the job, the Court of Appeals for the Fourth Circuit went so far as to observe that “[s]o long as the agency inevitably will need to interview both [the employee] and others, the Act takes no position on the order in which they [a]re approached.”  Hogan v. England, 159 F. App’x 534, 537 (4th Cir. 2005).  See also Carton v. Reno, 310 F.3d 108, 112-13 (2d Cir. 2002) (permitting “a preference to interview [plaintiff] last” when investigating misconduct complaint against him because of plaintiff’s “authority as an INS agent” and existing “specific allegations that [plaintiff] had already terrorized and intimidated the complainants”); Cardamone v. Cohen, 241 F.3d 520, 527-28 (6th Cir. 2001) (finding it “impracticable to think that charges of employee mistreatment and harassment could be resolved by interviewing [the plaintiff] before others” because plaintiff “could not have verified any conclusions” as to “subjective allegations of employee mistreatment”); Carlson v. GSA, No. 04-C-7937, 2006 WL 3409150, at *6 (N.D. Ill. Nov. 21, 2006) (ruling that agency did not violate subsection (e)(2) “by not interviewing [an agency employee] first” since “[t]he issues under investigation [regarding the employee’s undisclosed arrest] could not have been resolved by objective evidence within [the employee’s] possession”; and concluding that “[t]he Act does not require the agency to undertake a piecemeal investigation by obtaining objective evidence first and then interviewing third party witnesses as to the more subjective claims”); Thompson v. State, 400 F. Supp. 2d 1, 10-11 (D.D.C. 2005) (finding that agency “sought information directly from plaintiff ‘to the extent practicable’” where agency interviewed plaintiff’s coworkers before interviewing her in the context of an investigation into allegations made by coworkers that plaintiff helped create a hostile work environment; and further stating that “[t]he order of interviews therefore would not have altered the investigation’s impact on plaintiff’s reputation”); Mumme v. Labor, 150 F. Supp. 2d 162, 173 (D. Me. 2001) (observing that “[w]hen conducting a criminal investigation of an individual . . . however, it may not be practicable for the investigating officers to collect information via direct questioning of the individual”), aff’d, No. 01-2256 (1st Cir. June 12, 2002); Jacobs v. Reno, No. 3:97-CV-2698-D, 1999 U.S. Dist. LEXIS 3104, at *19-22, 29-35 (N.D. Tex. Mar. 11, 1999) (finding no subsection (e)(2) violation in agency’s “extensive, multifaceted investigation of an entire district office” where plaintiff was “both a charging party in several complaints and an accused in several others,” as it “was not always practical” for agency to interview plaintiff first, given nature of allegations against him), subsequent decision, 1999 WL 493056, at *1 (N.D. Tex. July 9, 1999) (denying motion for relief from March 11, 1999, order because “newly-discovered evidence” would not have produced different result), aff’d, 208 F.3d 1006 (5th Cir. 2000) (unpublished table decision); Jones v. Runyon, 32 F. Supp. 2d 873, 876 (N.D. W. Va. 1998) (routine check for fraud falls within exception to requirement to contact plaintiff first and permits obtaining information from third parties), aff’d, 173 F.3d 850 (4th Cir. 1999) (unpublished table decision); but see Lasseigne v. White, No. 1:14-CV-3156-TWT-CMS, 2015 WL 10015298 (N.D. Ga. Dec. 21, 2015) (finding plaintiff sufficiently stated claim by alleging that SEC conducted questioning when plaintiff was not in office, that purpose of investigation was to retaliate against him, and that his supervisor provided false information to investigators); Brunotte v. Johnson, 892 F. Supp. 2d 199, 208-09 (D.D.C. 2012) (finding issue of fact under subsection (e)(2) despite defendant’s contention that it could not have practicably procured information from plaintiff rather than from previous government agency employer because of suspicions that plaintiff had falsified aspects of her job application with that employer; this fact does not excuse [agency] from seeking information from her directly); Doe v. Goss, No. 04-2122, 2007 WL 106523, at *12-14 (D.D.C. Jan 12, 2007); (finding factual disputes precluded motion to dismiss where plaintiff was not timely interviewed in investigation despite agency’s claim plaintiff was in position to intimidate third parties or encourage collusion).

The Eighth and D.C. Circuits have suggested that an agency does not “collect” information within the meaning of subsection (e)(2) when it already exists in its own files.

The Court of Appeals for the Eighth Circuit has examined the issue of whether a “collection” subject to the requirements of subsection (e)(2) occurs when an agency reviews its own files to obtain information.  Darst v. SSA, 172 F.3d 1065 (8th Cir. 1999).  The Eighth Circuit held that because the “situation merely involved a review of the agency’s file,” the agency “did not contact third party sources to gather information,” and because “the indications of impropriety were apparent from the face of the documents and from the sequence of events” reflected in the file, there was “no need to interview Darst about the sequence of events,” and thus no violation of subsection (e)(2).  Id. at 1068.  The Eighth Circuit further stated that “[a]s the district court noted, the Privacy Act does not require that the information be collected directly from the individual in all circumstances,” and that “[h]ere the information in the [agency] file obviated the need to interview Darst or third persons.”  Id.; see also Brune v. IRS, 861 F.2d at 1287 (stating that “investigations of false statement charges, by their nature, involve a suspect who has already given the government his version of the facts”); Velikonja, 362 F. Supp. 2d at 20 (holding that agency was not required to interview plaintiff before examining “electronic door logs” to compare them with her sworn attendance sheets because objective proof – “electronic door logs” – could not be obtained from plaintiff).

Several courts have held that agencies generally meet the subsection (e)(2) requirement where they give individuals the opportunity to provide information.

In several cases, the courts have found that an agency satisfied its section (e)(2) obligations by giving an individual an opportunity to provide information, even if the individual did not actually provide it.  See Olivares v. NASA, No. 95-2343, 1996 WL 690065, at *2-3 (4th Cir. Dec. 3, 1996) (finding that defendant had contacted plaintiff directly before contacting universities to verify academic credentials where plaintiff was given opportunity to provide information in his employment application and personal interview), aff’g per curiam 882 F. Supp. 1545 (D. Md. 1995); Hubbard v. EPA, 809 F.2d 1, 6 n.8 (D.C. Cir. 1986) (defendant was not forbidden from using relevant information from third parties in hiring decision and made “practicable” effort to collect information from plaintiff when asked whether plaintiff knew source of leaks in previous investigation plaintiff had worked on), vacated in nonpertinent part & reh’g en banc granted (due to conflict within circuit), 809 F.2d 1 (D.C. Cir. 1986), resolved on reh’g en banc sub nom.; Ramey v. Marshals Serv., 755 F. Supp. 2d 88, 97 (D.D.C. 2010) (no issue of fact where voluminous record of plaintiff’s statements in investigation showed defendant provided plaintiff “a fair shake at telling her side of the story”); McCready v. Principi, 297 F. Supp. 2d 178, 199-200 (D.D.C. 2003) (dismissing claim where defendant first attempted to obtain information from plaintiff about her leave history and her responsive memos did not clear up questions), aff’d in pertinent part & rev’d in part sub nom.  McCready v. Nicholson, 465 F.3d 1 (D.C. Cir. 2006) (remanding for reasonable opportunity to complete discovery on count brought pursuant to subsection (e)(2) which did not require administrative exhaustion of remedies); Felsen v. HHS, No. CCB-95-975, slip op. at 62-65 (D. Md. Sept. 30, 1998) (granting defendants’ summary judgment on alternative ground on subsection (e)(2) claim due to “lack of a ‘practicable’ need to collect information directly from the plaintiffs”); Magee v. USPS, 903 F. Supp. 1022, 1028-29 (W.D. La. 1995) (granting summary judgement where plaintiff refused to hand over medical report in face-to-face meeting and postmaster eventually obtained report by subpoena), aff’d, 79 F.3d 1145 (5th Cir. 1996) (unpublished table decision); Kassel v. VA, 709 F. Supp. 1194, 1203 (D.N.H. 1989) (granting summary judgement where board of inquiry did speak with plaintiff before completing its report); Beckette v. USPS, No. 88-802, slip op. at 10 (E.D. Va. July 3, 1989) (finding subsection (e)(2) requirements satisfied where information contained in records was derived from other records containing information collected directly from individual); cf. Conyers v. VA, No. 16-CV-00013, 2018 WL 1867106 (E.D.N.Y Jan. 29, 2018) (magistrate’s recommendation) (finding plaintiff’s claim that department intentionally and willfully failed to collect information directly from him to be attack on defendant’s decision-making rather than on recordkeeping requirements and, therefore, outside Court’s purview) adopted, 2018 WL 1089736 (E.D.N.Y. Feb 26, 2018).

In a few cases, the courts have concluded that the subsection (e)(2) requirement was not triggered.

Agencies are not obligated to obtain information from the subject individual directly if those records are exempt from section (e)(2), the individual has not made a sufficiently detailed allegation, or the agency was authorized to obtain the information from another source.  See Gadson v. John Doe, No. 3:15-CV-00040-KRG, 2016 WL 3469383 (W.D. Pa. May 24, 2016) (magistrate’s recommendation) (because prison records were exempted from 552(e)(2), plaintiff prisoner could not state claim) adopted, 2016 WL 3546056 (W.D. Pa. Jun 21, 2016); Augustus v. McHugh, 825 F. Supp. 2d 245, 257-58 (D.D.C. 2011) (finding plaintiff’s bare allegation that she did not receive new job assignment as result of collection of third party information did not trigger agency’s obligation to collect information from her); Kalderon v. Finkelstein, No. 08 Civ. 9440, slip op. at 73-77, 2010 WL 9488933 (S.D.N.Y. Mar. 10, 2010) (magistrate’s recommendation) (finding plaintiff failed to state claim where defendant was authorized to obtain information directly from recipient of grant, grantee institution), adopted in pertinent part, 2010 WL 3359473 (S.D.N.Y. Aug. 25, 2010), aff’d, 495 F. App’x 103 (2d Cir. 2012).

 

C. 5 U.S. § 552a(e)(3) - Inform Individuals when Asking to Collect Information

“Each agency that maintains a system of records shall –

. . .

(3) inform each individual whom it asks to supply information, on the form which it uses to collect the information or on a separate form that can be retained by the individual – (A) the authority (whether granted by statute, or by executive order of the President) which authorizes the solicitation of the information and whether disclosure of such information is mandatory or voluntary; (B) the principal purpose or purposes for which the information is intended to be used; (C) the routine uses which may be made of the information, as published pursuant to paragraph (4)(D) of this subsection; and (D) the effects on him, if any, of not providing all or any part of the requested information.” 5 U.S.C. § 552a(e)(3).

Comment:

OMB guidelines state that the subsection (e)(3) notice requirement is intended to give individuals sufficient information to enable them to decide whether to supply information.

The OMB 1975 Guidelines explain that “[i]mplicit in this subsection is the notion of informed consent since an individual should be provided with sufficient information about the request for information to make an informed decision on whether or not to respond.”  40 Fed. Reg. at 28,961, https://www.justice.gov/​paoverview_omb-75.  The OMB 1975 Guidelines also note that subsection (e)(3) is applicable to both written and oral (i.e., interview) solicitations of personal information.  Id. 

Most courts have afforded agencies broad latitude in determining the content of their subsection (e)(3) notices.

Generally, an agency does not need to explain “all of [its] rules and regulations” on “one small form” to meet the substantive requirements of subsection (e)(3).  Glasgold v. Sec’y of HHS, 558 F. Supp. 129, 150 (E.D.N.Y. 1982); see also Field v. Brown, 610 F.2d 981, 987 (D.C. Cir. 1979) (holding that the agency’s form “contained all the elements required by 5 U.S.C. § 552a(e)(3)”). 

In evaluating the requirements of subsection (e)(3)(A), “[n]othing in the Privacy Act requires agencies to employ the exact language of the statute to give effective notice.”  United States v. Wilber, 696 F.2d 79, 80 (8th Cir. 1982) (per curiam) (finding that an IRS notice was in compliance with subsection (e)(3)(A) even though it did not use the word “mandatory”); see also Bartoli v. Richmond, No. 00-1043, 2000 WL 687155, at *3 (7th Cir. May 23, 2000) (finding that the IRS sufficiently gave notice pursuant to subsection (e)(3)(A) by citing section 6001 of the Internal Revenue Code as authority for its field examination); United States v. Bressler, 772 F.2d 287, 292-93 (7th Cir. 1985) (following Wilber); cf. Thompson v. State, 400 F. Supp. 2d 1, 17 (D.D.C. 2005) (finding that “[t]he very uses of the information to which plaintiff specifically objects (i.e., giving it to [other offices within the agency] and placing it in her security file) . . . can be reasonably inferred from the warning given,” which stated that the information was being collected for an “administrative inquiry regarding misconduct or improper performance”; further stating that plaintiff could infer from this warning that “if she provided information revealing misconduct by her, the agency might use it to make a determination adverse to her”).

The Court of Appeals for the Fifth Circuit has gone so far as to rule in favor of an agency even though the agency “clearly did not follow the Act’s requirements because the [form] did not indicate whether filling out the form was voluntary or mandatory or, alternatively, because [plaintiff’s] supervisors ordered him to fill out the form even though filling it out was voluntary.”  Sweeney v. Chertoff, 178 F. App’x 354, 357 (5th Cir. 2006).  The court held that the appellant’s injury was “sufficiently attenuated from any violation of the Act’s requirements to preclude a finding of causation.”  Id.  The court reasoned that the Privacy Act did not provide the remedy for the plaintiff’s damages – which arose from his punishment for insubordination based on his refusal to fill out the form – because “the Privacy Act is not the proper channel by which to challenge internal agency disciplinary actions with which one disagrees.”  Id. at 358 & n.3.

One court has held that a notice that informed witnesses of an investigation into allegations of misconduct but did not warn of the investigation subject’s possible termination as an outcome, met the requirements of subsection (e)(3)(B) because the “text of the statute clearly requires” that the witnesses be notified of the “purpose” of the interview “not [its] possible results.”  Cardamone v. Cohen, No. 3:97CV540H, slip op. at 4-5 (W.D. Ky. Sept. 30, 1999), aff’d, 241 F.3d 520, 529-30 (6th Cir. 2001); cf. Beller v. Middendorf, 632 F.2d 788, 798 n.6 (9th Cir. 1980) (noting that when plaintiff provided information to agency “albeit originally in connection with a check for a top secret security clearance,” he “must have known that information which disclosed grounds for being discharged could be used in discharge proceedings”), overruled on other grounds by Witt v. Depart. of Air Force, 527 F.3d 806, 820-821 (9th Cir. 2008); Thompson, 400 F. Supp. 2d at 16 (ruling that agency need not “tell an individual that she is the subject of an investigation” in order to provide her with “informed consent” where agency notified employee that purpose of collection was to assess her “suitability for continued employment”).

In addition, several courts have found in criminal cases that subsection (e)(3)(D) does not require an agency to provide notice of the specific criminal penalty that may be imposed for failure to provide information.  See, e.g., United States v. Bishop, 946 F.2d 896, at *4 (6th Cir. Oct. 23, 1991) (unpublished table decision) (per curiam); Bressler, 772 F.2d  at 292-93; United States v. Bell, 734 F.2d 1315, 1318 (8th Cir. 1984) (per curiam); Wilber, 696 F.2d 79, at 80; United States v. Annunziato, 643 F.2d 676, 678 (9th Cir. 1981); United States v. Rickman, 638 F.2d 182, 183 (10th Cir. 1980); United States v. Gillotti, 822 F. Supp. 984, 988 (W.D.N.Y. 1993).

Some courts have determined that an agency’s failure to provide notice of the routine uses which may be made of the information consistent with the subsection (e)(3) notice requirement precluded later reliance on that routine use to disclose the information in compliance with the Privacy Act’s disclosure provisions.

In Covert v. Harrington, a divided panel of the Court of Appeals for the Ninth Circuit held that an agency component’s failure to provide actual notice of a routine use under subsection (e)(3)(C), at the time at which information was submitted, precluded a separate component of the agency, the Inspector General, from later invoking that routine use as a basis for disclosing such information.  876 F.2d 751, 755-56 (9th Cir. 1989); see also Puerta v. HHS, No. 99-55497, 2000 WL 863974, at *1-2 (9th Cir. June 28, 2000) (following Covert, but finding that agency had provided notice of routine use on form used to collect information), aff’g No. EDCV 94-0148, slip op. at 7 (C.D. Cal. Jan. 5, 1999); USPS v. Nat’l Ass’n of Letter Carriers, 9 F.3d 138, 146 (D.C. Cir. 1993) (citing Covert with approval and remanding case for factual determination as to whether subsection (e)(3)(C) notice was given); McKinley v. United States, No. 3:14–cv–01931–HZ, 2015 WL 4663206, at *8 (interpreting Covert to require agency invoking routine use exception to first “inform[] the individual on the form used to collect information or on a separate form that can be retained by the individual about the routine uses that may be made of the information”); Cooper v. FAA, 816 F. Supp. 2d 778, 788-790  (N.D. Cal. 2008) (holding that disclosure of social security records to Transportation Department by SSA was improper because “the notice provided on the form [plaintiff] used to submit his information to SSA was insufficient” to notify plaintiff of reason for disclosure), rev’d on other grounds, 622 F.3d 1016 (9th Cir. 2010), rev’d, 566 U.S. 284 (2012), aff’d, 696 F.3d 1265 (9th Cir. 2012); Pontecorvo v. FBI, No. 00-1511, slip op. at 12 (D.D.C. Sept. 30, 2001) (stating that agency must comply with subsection (e)(3)(C) “to substantiate an exception for ‘routine use’”).  But see OMB 1975 Guidelines, 40 Fed. Reg. at 28,961-62, https://www.justice.gov/paoverview_omb-75 (“It was not the intent of [subsection (e)(3)] to create a right the nonobservance of which would preclude the use of the information or void an action taken on the basis of that information.”).

The courts have split on whether the subsection (e)(3) notice requirement applies when the agency solicits information from a third party.

Some authorities have concluded that subsection (e)(3) is inapplicable when an agency solicits information about an individual from a third party.  See Gardner v. United States, No. 96-1467, 1999 U.S. Dist. LEXIS 2195, at *19 (D.D.C. Jan. 29, 1999) (noting that although it is correct that the Privacy Act mandates actual notice of routine uses, “information in the instant case was not gathered from Plaintiff, but from third parties”), summary affirmance granted on other grounds, No. 99-5089, 1999 WL 728359 (D.C. Cir. Aug. 4, 1999) (per curiam); McTaggart v. United States, 570 F. Supp. 547, 550 (E.D. Mich. 1983) (finding individual lacks standing to complain of insufficient Privacy Act notice to third party); Truxal v. Casey, 2 Gov’t Disclosure Serv. (P-H) ¶ 81,391, at 82,043 (S.D. Ohio Apr. 3, 1981); cf. United States v. The Inst. for Coll. Access & Success, 956 F. Supp. 2d 190, 198 (D.D.C. 2013) (finding that “Privacy Act Notification is vague as to what the [agency] may demand from independent third parties unrelated to the federal government”), rev’d on other grounds, 27 F. Supp. 3d 106 (D.D.C. 2014).  The OMB 1975 Guidelines support this view, but suggest that “agencies should, where feasible, inform third-party sources of the purposes for which information which they are asked to provide will be used.”  40 Fed. Reg. at 28,961, https://www.justice.gov/paoverview_omb-75. 

On the other hand, the practice of not providing notice to third parties was condemned by the Privacy Protection Study Commission.  See Privacy Commission Report at 514, https://www.justice.gov/paoverview_ppsc.  In the same vein, several courts have followed the Commission’s views on this issue.  See Usher v. Sec’y of HHS, 721 F.2d 854, 856 (1st Cir. 1983) (costs awarded to plaintiff due to agency “intransigence” in refusing to provide information specified in subsection (e)(3) to third party); Kassel v. VA, No. 87-217-S, slip op. at 24-25 (D.N.H. Mar. 30, 1992) (in light of “the express language of § (e)(3) and the Privacy Act’s overall purposes . . . § (e)(3) applies to information supplied by third-parties”); Saunders v. Schweiker, 508 F. Supp. 305, 309 (W.D.N.Y. 1981) (plain language of subsection (e)(3) “does not in any way distinguish between first-party and third-party contacts”).

 

D. 5 U.S.C. § 552a(e)(4) - Publish System of Records Notice

“Each agency that maintains a system of records shall –

. . .

(4) [subject to notice and comment], publish in the Federal Register upon establishment or revision a notice of the existence and character of the system of records, which notice shall include –

(A) the name and location of the system;

(B) the categories of individuals on whom records are maintained in the system;

(C) the categories of records maintained in the system;

(D) each routine use of the records contained in the system, including the categories of users and the purpose of such use;

(E) the policies and practices of the agency regarding storage, retrievability, access controls, retention, and disposal of the records;

(F) the title and business address of the agency official who is responsible for the system of records;

(G) the agency procedures whereby an individual can be notified at his request if the system of records contains a record pertaining to him;

(H) the agency procedures whereby an individual can be notified at his request how he can gain access to any record pertaining to him contained in the system of records, and how he can contest its contents; and

(I) the categories of sources of records in the system.”  5 U.S.C. § 552a(e)(4).

Comment:

An agency that is establishing or revising a system of records is required to publish a system of records notice (SORN) in the Federal Register.  The OMB 1975 Guidelines published just after the Privacy Act was enacted discuss this provision in detail, including the nine categories of information that must be included.  See 40 Fed. Reg. at 28,962-64, https://www.justice.​gov/paoverview_omb-75. 

System of records notices (SORNs) are available on agency websites and are compiled by the Government Printing Office.

Privacy Act system notices are published in the Federal Register, and the National Archives’ Office of the Federal Register also publishes a biennial compilation of all such system notices.  See 5 U.S.C. § 552a(f).  Those Privacy Act Compilation Issuances contain descriptions of federal agency systems of records maintained on individuals and procedures that federal agencies follow to assist individuals who request information about their records.  Each issuance contains individual Privacy Act system descriptions and their governing regulations.  Privacy Act Compilation Issuances beginning in 1995 are available on the Government Printing Office’s (GPO) Federal Digital System (FDsys) website.  See https://www.govinfo.gov/app/​collection/PAI/.  Bulk XML download of Privacy Act Issuances can be accessed at:  https://catalog.data.gov/dataset/​privacy-act-issuances-bulk-xml.

In order to provide more current and convenient access to system notices, OMB requires each agency to “list and provide links to complete, up-to-date versions of all agency SORNs,” including citations and links to all Federal Register notices that comprise the SORN for each system of records.  OMB Circular A-108, at 29-30, https://www.justice.gov/paoverview_omb-a-108.  For an example, see the Department of Justice’s publication of its systems of records.  See DOJ Privacy Act Systems of Records, https://www.justice.gov/​opcl/doj-systems-records. 

The Tenth Circuit concluded that an agency was not required to publish a new SORN where the new system was composed of abstracts of two other systems of records that had published SORNs.

The only case to discuss the subsection (e)(4) SORN requirements in any depth is Pippinger v. Rubin, 129 F.3d 519 (10th Cir. 1997).  In that case, the Court of Appeals for the Tenth Circuit addressed whether the Internal Revenue Service had complied with several of the requirements of subsection (e)(4) with regard to a computer database known as the “Automated Labor Employee Relations Tracking System [(ALERTS)].”  Id. at 524-28.  The database was used by the IRS to record all disciplinary action proposed or taken against any IRS employee and contained a limited subset of information from two existing Privacy Act systems that the IRS had properly noticed in the Federal Register.  See id. at 524-25.  Of particular note is that the Tenth Circuit found that ALERTS, being an “abstraction of certain individual records” from other systems of records, did not constitute a new system of records requiring Federal Register publication, because it could be accessed only by the same users and only for the same purposes as those published in the Federal Register for the original systems of records.  Id. at 526-27. Cf. Corr v. Bureau of the Pub. Debt, 987 F. Supp. 2d 711, 718 (S.D. W.Va. 2013) (finding that “SORN applies only to employee grievances filed under the Administrative Grievance Procedure” and plaintiff cannot obtain access to records and claim “benefit of this system after failing to comply with the requirements that would have brought his complaints within the scope of the SORN”).

 

E. 5 U.S.C. § 552a(e)(5) - Maintain Accurate, Relevant, Timely, and Complete Records

“Each agency that maintains a system of records shall –

. . .

(5) maintain all records which are used by the agency in making any determination about any individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the determination.”  5 U.S.C. § 552a(e)(5).

Comment:

The subsection (e)(5) requirement establishes a standard against which the accuracy of a record is measured in other Privacy Act provisions, including agency dissemination and amendment requirements, and certain causes of action.

This provision (along with subsections (e)(1) and (e)(7)) sets forth the standard to which records must conform in the context of an amendment lawsuit, as well as in the context of a lawsuit brought under subsection (g)(1)(C) for damages.  See 5 U.S.C. § 552a(g)(1)(A); 5 U.S.C. § 552a(g)(1)(C).  The “accuracy, relevance, timeliness, and completeness” standard in subsection (e)(5) is also used in subsections (e)(6), relating to dissemination of information and (g)(1)(C).  Subsection (e)(6) states that, prior to disseminating any record about an individual to any person other than an agency, the agency must reasonably ensure the records in question are accurate, complete, timely, and relevant for agency purposes.  The one exception to this provision is records that are released in accordance with and as required under the Freedom of Information Act.  Specifically, subsection (g)(1)(C) provides for civil remedies for a record that does not meet the “accuracy, relevance, timeliness, and completeness” standard.  As the D.C. Circuit has held, “whether the nature of the relief sought is injunctive or monetary, the standard against which the accuracy of the record is measured remains constant [and] that standard is found in 5 U.S.C. § 552a(e)(5) and reiterated in 5 U.S.C. § 552a(g)(1)(C).”  Doe v. United States, 821 F.2d 694, 697 n.8 (D.C. Cir. 1987) (en banc).

In theory, a violation of this provision (or any other part of the Act) could also give rise to a damages action under 5 U.S.C. § 552a(g)(1)(D).  Cf. Perry v. FBI, 759 F.2d 1271, 1275 (7th Cir. 1985), rev’d en banc on other grounds, 781 F.2d 1294 (7th Cir. 1986).  However, the Court of Appeals for the District of Columbia Circuit has held that “a plaintiff seeking damages for noncompliance with the standard set out in subsection (e)(5) must sue under subsection (g)(1)(C) and not subsection (g)(1)(D).”  Deters v. Parole Comm’n, 85 F.3d 655, 660-61 & n.5 (D.C. Cir. 1996) (noting that although court had suggested in Dickson v. OPM, 828 F.2d 32, 39 (D.C. Cir. 1987), that subsection (g)(1)(D) could cover violation of subsection (e)(5), “the holding in that case is limited to the scope of subsection (g)(1)(C)”).

Agencies that do not maintain records consistent with the standards set by subsection (e)(5) are not subject to damages claims if the records are maintained in a system of records that is properly exempted from this requirement.

Records systems that an agency has exempted from the Privacy Act in a Federal Register notice are not subject to civil damages actions for inaccurate or substandard recordkeeping of those records.  See e.g., Dick v. Holder, 67 F. Supp. 3d 167, 184 (D.D.C. 2014) (concluding that records were exempt from the maintenance requirement of § 552a(e)(5) where Attorney General had “established regulations pursuant to this subsection that exempt materials in the FBI’s Central Records System from various provisions of the Privacy Act”); Barnett v. United States, 195 F. Supp. 3d 4, 8 (D.D.C. 2016) (holding that because BOP exempted certain inmate records from Privacy Act, it “follows that there remains no remedy under the Privacy Act for harm resulting from inaccuracies in the inmate records”); Ali v. ICE, No. 1:16-CV-037-BL, 2017 WL 4325785, at *6 (N.D. Tx. Aug. 29, 2017), report and recommendation adopted, No. 1:16-CV-037-C, 2017 WL 4296756 (N.D. Tex. Sept. 26, 2017).  An agency’s exemption from certain Privacy Act provisions does not foreclose a plaintiff’s opportunity to allege violations of the Constitution, however.  Cf. Abdelfattah v. U.S. Dept. of Homeland Sec., 787 F.3d 524, 534-538 (D.C. Cir. 2015) (“We have repeatedly recognized a plaintiff may request expungement of agency records for both violations of the Privacy Act and the Constitution.”).

The Federal Bureau of Prisons, a defendant in many amendment suits, exempted a number of its systems of records from the subsection (e)(5) requirement in 2002.

Among the most frequently litigated subsection (e)(5)/(g)(1)(C) claims are those brought by federal inmates against the Federal Bureau of Prisons (BOP).  The discussion of subsection (e)(5), below, includes citations to numerous cases involving such claims.  Note, however, that it was not until 2002 that the BOP exempted many of its systems of records in a published SORN – among them, notably, the Inmate Central Records System – from subsection (e)(5) pursuant to subsection (j)(2).  See 28 C.F.R. § 16.97(j) (codifying 67 Fed. Reg. 51,754 (Aug. 9, 2002)).  This came about as a result of Sellers v. BOP, 959 F.2d 307, 309-312 (D.C. Cir. 1992), in which the D.C. Circuit noted that “regulations governing the BOP . . . do not exempt [the agency’s] records from section (e)(5) of the Act” and, accordingly, remanded the case for a determination of “whether the [agency] met the requirements of sections (e)(5) and (g)(1)(C)” with regard to the items of information at issue. 

While the subsection (e)(5) analyses contained in cases decided prior to the promulgation of that exemption regulation remain useful resources in interpreting subsection (e)(5), that inmates’ subsection (e)(5)/(g)(1)(C) claims arising subsequent to August 9, 2002, should not succeed.  See, e.g., Blackshear v. Lockett, 411 F. App’x 906, 907-08 (7th Cir. 2011) (“[A]fter Sellers the [BOP] availed itself of a Privacy Act exemption that frees it from an obligation to keep accurate inmate files.  . . .  Accordingly, the damages remedy available to the plaintiff in Sellers is no longer applicable.”); Lane v. BOP, No. 09-5228, 2010 WL 288816, at *1 (D.C. Cir. Jan. 7, 2010) (“Sellers v. Bureau of Prisons . . . does not control here, as it was decided before the Bureau of Prisons exempted the relevant system of records from the accuracy provision.”), aff’d per curiam No. 08-1269, 2009 WL 1636422 (D.D.C. June 9, 2009); Fisher v. BOP, No. 06-5088, 2007 U.S. App. LEXIS 5140, at *1 (D.C. Cir. Mar. 1, 2007) (“[T]he statement in Sellers v. Bureau of Prisons . . .  that the ‘regulations governing the Bureau of Prisons . . . do not exempt those agenc[y’s] records from section (e)(5) of the Act’ is no longer accurate.”), reh’g denied, 2006 U.S. App. LEXIS 28532 (D.C. Cir. Nov. 16, 2006), aff’d per curiam No. 05-0851, 2006 U.S. Dist. LEXIS 9738 (D.D.C. Feb. 21, 2006); Earle v. Holder, 815 F. Supp. 2d 176, 182-83 (D.D.C. 2011), aff’d per curiam, No. 11-5280, 2012 WL 1450574 (D.C. Cir. Apr. 20, 2012); Kates v. King, No. 3:11-CV-00951, 2011 WL 6937553, at *3 & n.1 (M.D. Pa. June 3, 2011), adopted, 2012 WL 10667 (M.D. Pa. Jan. 3, 2012); Davis v. United States, No. CIV-10-1136, 2011 WL 704894, at *5 (W.D. Okla. Jan. 4, 2011) (magistrate’s recommendation), adopted, 2011 WL 693639 (W.D. Okla. Feb. 18, 2011), appeal dismissed, 426 F. App’x 648 (10th Cir. June 14, 2011). 

Courts have disagreed, however, on whether to permit claims to go forward that arose before August 9, 2002, but were filed after that date.  Compare Patel v. United States, No. 08-1168, 2009 WL 1377530, at *1-2 (W.D. Okla. May 14, 2009) (declining to dismiss claim on ground that record was exempt from subsection (e)(5) because “the exemption . . . post-dates the allegedly false record”), aff’d, 399 F. App’x 355, 360 (10th Cir. 2010), with Truesdale v. DOJ, 731 F. Supp. 2d 3, 9 (D.D.C. 2010) (rejecting argument that “[b]ecause [plaintiff] had been allowed to contest the accuracy of sentencing-related information before 28 C.F.R. § 16.97(j) and (k) became effective . . . he should be allowed to pursue his Privacy Act claims”; “Plaintiff cites no authority for the proposition that he need not be subjected to a duly promulgated and published administrative regulation simply because he demands amendment of records in existence before the effective date of that regulation.”).  See also Skinner v. BOP, 584 F.3d 1093, 1097 (D.C. Cir. 2009) (declining to decide whether “it would be impermissibly retroactive to apply [the exemption] to [prisoner’s] lawsuit” where claim arose before date of exemption but was filed after that date).  This issue is discussed further under “Ten Exemptions, 5 U.S.C. § 552a(j)(2) - Two General Exemptions for Central Intelligence Agency and Criminal Law Enforcement,” below.

Agencies must take “reasonable” steps to meet the “accuracy, relevance, timeliness, and completeness” standard, including but not limited to, correcting erroneous facts.

An agency “need not keep perfect records, but must act reasonably” to assure accuracy, relevance, timeliness, and completeness.  See Colley v. James, 254 F. Supp. 3d 45, 67-68 (D.D.C. 2017) (quoting Dickson v. OPM, 1991 WL 423968, at *15 (D.D.C. Aug. 27, 1991)).  See Johnston v. Horne, 875 F.2d 1415, 1421 (9th Cir. 1989), overruled on other grounds, Irwin v. VA, 498 U.S. 89 (1990); DeBold v. Stimson, 735 F.2d 1037, 1041 (7th Cir. 1984); Edison v. Army, 672 F.2d 840, 843 (11th Cir. 1982) (“The use of ‘reasonableness’ language requires the balancing of competing interests: army resources and the ability to assure accurate and complete records versus the likelihood that inaccurate and incomplete records will cause injury to the individual.”); Vymetalik v. FBI, No. 82-3495, slip op. at 3-5 (D.D.C. Jan. 30, 1987); Marcotte v. Sec’y of Def., 618 F. Supp. 756, 762 (D. Kan. 1985); Smiertka v. Treasury, 447 F. Supp. 221, 225-26 & n.35 (D.D.C. 1978), remanded on other grounds, 604 F.2d 698 (D.C. Cir. 1979); see also, e.g., Akl v. Sebelius, No. 1:08-cv-00461, slip op. at 13 (D.D.C. Sept. 7, 2012) (rejecting subsection (g)(1)(C) claim where “HHS made reasonable efforts to verify the accuracy and completeness of the information by requesting more detailed accounts, which resulted in the submission of the two amended reports, and by requesting additional information from the Hospital Center when the plaintiff raised additional arguments” (citation omitted)), summary affirmance granted per curiam, No. 12-5315, 2013 U.S. App. LEXIS 4857 (D.C. Cir. Mar. 11, 2013); Kvech v. Holder, No. 10-cv-545, 2011 WL 4369452, at *5-6 (D.D.C. Sept. 19, 2011) (concluding that plaintiff “has not asserted any facts to support a claim that the FBI failed to maintain accurate or complete records with reasonable fairness” where plaintiff “admit[ted] that she defended herself against the charges by submitting the very evidence she claims would have ‘corrected’ the records”); Crummey v. SSA, 794 F. Supp. 2d 46, 56-57 (D.D.C. 2011) (finding that “there can be no genuine dispute that the SSA has maintained its records ‘with the accuracy necessary to assure fairness’” where plaintiff had “failed to present even a scintilla of competent evidence suggesting that the SSA’s records are, in actuality, materially inaccurate or incomplet”), summary affirmance granted, No. 11-5231, 2012 WL 556317 (D.C. Cir. Feb. 6, 2012); Wilson v. CIA, No. 01-1758, slip op. at 6 (D.D.C. Aug. 29, 2002) (“No reasonable fact finder could accept plaintiff’s denial of a meeting having occurred twenty-five years ago over an official record prepared ‘less than two weeks’ after the meeting which memorialized the event.”), summary affirmance granted, No. 02-5282, 2003 U.S. App. LEXIS 1290 (D.C. Cir. Jan. 24, 2003); Halus v. Army, No. 87-4133, 1990 WL 121507, at *11 (E.D. Pa. Aug. 15, 1990) (holding erroneous information is not subject to amendment if it is merely a “picayune” and immaterial error); Jones v. Treasury, No. 82-2420, slip op. at 2-3 (D.D.C. Oct. 18, 1983) (ruling it reasonable for agency – without conducting its own investigation – to maintain record concerning unsubstantiated allegation of sexual misconduct by ATF agent conveyed to it by state and local authorities), aff’d, 744 F.2d 878 (D.C. Cir. 1984) (unpublished table decision); cf. Ramey v. Marshals Serv., 755 F. Supp. 2d 88, 97 (D.D.C. 2010) (finding that plaintiff who claimed that “the U.S. Marshals’s records which concluded that she [abandoned her post] are not accurate” had “not set forth specific facts showing a genuine issue for trial on the question of whether the U.S. Marshals relied on inaccurate information”); Powers v. Williams, No. CV 06-0665 (PLF), 2006 WL 8448057, at *3 (D.D.C. Nov. 17, 2006) (“As long as the Parole Commission complies with its procedures for conducting a parole hearing, it complies with the fairness standard set forth in 5 U.S.C. § 552a(e)(5).)”; Griffin v. Ashcroft, No. 02-5399, 2003 WL 22097940, at *1 (D.C. Cir. Sept. 3, 2003) (per curiam) (finding that appellant had made no showing that facts regarding information in his presentence investigation report were inaccurate and “even if the information were inaccurate, appellant [had] not shown the BOP either had no grounds to believe maintaining the information was lawful or that it flagrantly disregarded his rights under the Privacy Act”); Sullivan v. BOP, No. 94-5218, 1995 WL 66711, at *1 (D.C. Cir. Jan. 17, 1995) (finding that “Parole Commission met the requirements of the Act by providing [plaintiff] with a parole revocation hearing at which he was represented by counsel and given the opportunity to refute the validity of his continued confinement”); Kirkland v. Gess-Valagobar, No. 1:08-CV-0239, 2008 WL 504394, at *4 (N.D. Ga. Feb. 21, 2008) (explaining that BOP properly included juvenile record in presentence report because Sentencing Guidelines permit consideration of juvenile adjudications in some cases); Holz v. Westphal, 217 F. Supp. 2d 50, 56-57 (D.D.C. 2002) (finding that report of investigation was not “accurate or complete as to ensure its fairness to [individual],” and requiring removal of individual’s name from report of  investigation when report contained notations of “Fatal Traffic Accident” and “Negligent Homicide” without further explanation, which thus suggested commission of crime even though individual was never found guilty of offense); Pons v. Treasury, No. 94-2250, 1998 U.S. Dist. LEXIS 5809, at *11-15 (D.D.C. Apr. 21, 1998) (entering judgment in favor of agency where agency presented “substantial evidence to suggest that [it] acted in the reasonable belief that there were no grounds to amend plaintiff’s records”; plaintiff failed to identify any records that contained alleged false statements and even if file did contain those statements, plaintiff never presented any evidence from which to conclude that statements were false); Smith v. BOP, No. 94-1798, 1996 WL 43556, at *3-4 (D.D.C. Jan. 31, 1996) (finding that plaintiff’s record was not inaccurate with respect to his pre-commitment status in light of BOP’s “full authority to promulgate rules governing the treatment and classification of prisoners” and “broad discretionary power,” and because there was “no evidence that the BOP’s interpretation of its own regulations was an abuse of discretion or discriminatorily administered,” “BOP officials reconsidered their decision at least once,” and “the determination of which plaintiff complains ha[d] been resolved in his favor”); Hampton v. FBI, No. 93-0816, slip op. at 3-6, 13-17 (D.D.C. June 30, 1995) (finding that FBI “acted lawfully under the Privacy Act in the maintenance of the plaintiff’s arrest record” when FBI refused to expunge challenged entries of arrests that did not result in conviction absent authorization by local law enforcement agencies that had originally submitted the information); Buxton v. Parole Comm’n, 844 F. Supp. 642, 644 (D. Or. 1994) (finding subsection (e)(5) fairness standard satisfied where Parole Commission complied with statutory procedures regarding parole hearings even though it did not investigate or correct alleged inaccuracies in presentence report).

Erroneous facts – as well as opinions, evaluations, and subjective judgments based entirely on erroneous facts – can be amended.  See, e.g., Hewitt v. Grabicki, 794 F.2d 1373, 1378 (9th Cir. 1986); Westcott v. McHugh, 39 F. Supp. 3d 21, 27-33 (D.D.C. 2014); Rodgers v. Army, 676 F. Supp. 858, 860-61 (N.D. Ill. 1988); Ertell v. Army, 626 F. Supp. 903, 910-12 (C.D. Ill. 1986); R.R. v. Army, 482 F. Supp. 770, 773-74 (D.D.C. 1980); Murphy v. NSA, 2 Gov’t Disclosure Serv. (P-H) ¶ 81,389, at 82,036 (D.D.C. Sept. 29, 1981); Trinidad v. U.S. Civil Serv. Comm’n, 2 Gov’t Disclosure Serv. (P-H) ¶ 81,322, at 81,870-71 (N.D. Ill. Apr. 7, 1980); Turner v. Army, 447 F. Supp. 1207, 1213 (D.D.C. 1978), aff’d, 593 F.2d 1372 (D.C. Cir. 1979).  As the Court of Appeals for the Seventh Circuit has noted, “[t]he Privacy Act merely requires an agency to attempt to keep accurate records, and provides a remedy to a claimant who demonstrates that facts underlying judgments contained in his records have been discredited.”  DeBold, 735 F.2d at 1040-41.

In addition, one court has held that where records contain disputed hearsay and reports from informants and unnamed parties, “the records are maintained with adequate fairness if they accurately reflect the nature of the evidence,” i.e., indicate that the information is a hearsay report from an unnamed informant.  Graham v. Hawk, 857 F. Supp. 38, 40 (W.D. Tenn. 1994), aff’d, 59 F.3d 170 (6th Cir. 1995) (unpublished table decision); cf. Hass v. Air Force, 848 F. Supp. 926, 931 (D. Kan. 1994) (acknowledging possibility that agency relied upon incorrect information in making determination about plaintiff, finding still no Privacy Act violation because no evidence was suggested that information was recorded inaccurately).

Where agency records document judgements or evaluations based on a number of factors or a diverse set of facts, courts generally are reluctant to question the accuracy, relevance, timeliness, or completeness of those records.

As a general rule, courts are reluctant to disturb judgmental matters in an individual’s record when such judgments are based on a number of factors or when the factual predicates for a judgment or evaluation are diverse.  As the D.C. Circuit has ruled, where a subjective evaluation is “based on a multitude of factors” and “there are various ways of characterizing some of the underlying [factual] events,” it is proper to retain and rely on the record.  White v. OPM, 787 F.2d 660, 662 (D.C. Cir. 1986); see also Mueller v. Winter, 485 F.3d 1191, 1197 (D.C. Cir. 2007) (holding amendment claim to be “doom[ed]” where “subjective evaluation [was] based on a multitude of factors” and where “there [were] various ways of characterizing some of the underlying events”); Westcott, 39 F. Supp. 3d at 32 (“Even if the Court were to conclude that the plaintiff had established that the objectively verifiable facts contained in the Reprimand were false, several of the considerations cited by [the general] as factors influencing his decision” ‒ such as the general’s perception of plaintiff’s attitude toward his duties ‒ “are simply unassailable.”); Bernson v. ICC, 625 F. Supp. 10, 13 (D. Mass. 1984) (finding court cannot order amendment of opinions “to reflect the plaintiffs’ version of the facts”); cf. Phillips v. Widnall, No. 96-2099, 1997 WL 176394, at *2-3 (10th Cir. Apr. 14, 1997) (holding that appellant was not entitled to court-ordered amendment, nor award of damages, concerning record in her medical files that contained “physician’s notation to the effect that [appellant] was probably dependent upon a prescription medication,” as such notation “reflected the physician’s medical conclusion, which he based upon a number of objective factors and [appellant’s] own complaints of neck and low back pain,” and “Privacy Act does not permit a court to alter documents that accurately reflect an agency decision, no matter how contestable the conclusion may be”).

Courts have consistently determined that pure opinions and judgments do not require amendment to satisfy the subsection (e)(5) requirement.

Many courts have held that pure opinions and judgments are not subject to amendment.  See, e.g., Barnett v. U.S., No. 15-1614 (BAH), 2016 WL 3350989 D.D.C. June 15, 2016) (The Privacy Act is not “a vehicle for amending the judgments of federal officials . . . as those judgments are reflected in records maintained by federal agencies.” (quoting Kleiman v. Energy, 956 F.2d 335, 337-38 (D.C. Cir. 1992))); see also Akl v. Sebelius, No. 12-5315, 2013 WL 1164488, at *1 (D.C. Cir. Mar. 11, 2013) (per curiam);  Baker v. Winter, 210 F. App’x 16, 18 (D.C. Cir. 2006); Reinbold v. Evers, 187 F.3d 348, 361 (4th Cir. 1999); Hewitt, 794 F.2d at 1378-79; Blevins v. Plummer, 613 F.2d 767, 768 (9th Cir. 1980) (per curiam); Elhelbawy v. Pritzker, No. 14-cv-01707-CBS, 2015 WL 5535246 (D. Colo. Sept. 21, 2015); Hutton v. VA, No. 1:12CV190, 2013 WL 1331191, at *2 (M.D.N.C. Mar. 29, 2013); Middlebrooks v. Mabus, No. 1:11cv46, 2011 WL 4478686, at *5 (E.D. Va. Sept. 23, 2011); Feldman v. CIA, 797 F. Supp. 2d 29, 46-47 (D.D.C. 2011); Washington v. Donley, 802 F. Supp. 2d 539, 553-54 (D. Del. 2011); Kursar, 751 F. Supp. 2d at 170-71, aff’d per curiam, 442 F. App’x 565; Hardy v. McHugh, 692 F. Supp. 2d 76, 80 (D.D.C. 2010); Patel v. United States, No. CIV-08-1168, slip op. at 14-17 (W.D. Okla. Oct. 9, 2009) (magistrate’s recommendation), adopted, 2009 WL 5168306 (W.D. Okla. Dec. 18, 2009), aff’d, 399 F. App’x 355, 360 (10th Cir. 2010); Register v. Lappin, No. 07-CV-136, 2007 WL 2020243, at *3 (E.D. Ky. July 6, 2007); Toolasprashad v. BOP, No. 04-3219, 2006 WL 2627931, at *4 (D.N.J. Sept. 13, 2006); Doyon v. DOJ, 304 F. Supp. 2d 32, 35 (D.D.C. 2004); Gowan v. Air Force, No. 90-94, slip op. at 28-30 (D.N.M. Sept. 1, 1995), aff’d, 148 F.3d 1182 (10th Cir. 1998); Webb, 880 F. Supp. at 25; Nolan v. DOJ, No. 89-A-2035, 1991 WL 134803, at *3 (D. Colo. July 17, 1991), appeal dismissed in pertinent part on procedural grounds, 973 F.2d 843 (10th Cir. 1992); Frobish v. Army, 766 F. Supp. 919, 926-27 (D. Kan. 1991); Daigneau v. United States, No. 88-54-D, slip op. at 3-4 (D.N.H. July 8, 1988); Brumley v. Labor, No. LR-C-87-437, slip op. at 4 (E.D. Ark. June 15, 1988), aff’d, 881 F.2d 1081 (8th Cir. 1989) (unpublished table decision); Rogers v. Labor, 607 F. Supp. 697, 699-700 (N.D. Cal. 1985); Fagot v. FDIC, 584 F. Supp. 1168, 1176 (D.P.R. 1984), aff’d in part & rev’d in part, 760 F.2d 252 (1st Cir. 1985) (unpublished table decision); cf. Strong v. OPM, 92 F. App’x 285, 289 (6th Cir. 2004) (finding that OPM did not violate Privacy Act by refusing to remove reference’s statement as plaintiff failed to offer any evidence that reference’s statement was inaccurate or irrelevant); Brim v. Copenhaver, No. 13:-cv-00433, 2013 WL 5817990, at *7 (E.D. Cal. Oct. 29, 2013) (“Even if the Privacy Act were to apply to court records, it appears that the BOP has complied with the statutory requirements because there is no indication that the BOP’s files contain anything but true copies of the judgment and orders issued by the district court and the PSR as generated by the United States Probation Office.”); Doe v. DOJ, 660 F. Supp. 2d 31, 43 (D.D.C. 2009) (“[P]laintiff’s complaint objects to inaccurate ‘conclusions drawn by lay employees’ that were based on accurate records. . . .  Thus, plaintiff objects not to erroneous . . . records but to misinterpretation of the records by DOJ employees, for which there is no remedy under the Privacy Act.”); Davidson v. Daniels, No. 07-960, 2007 WL 3232608, at *2 (D. Or. Oct. 28, 2007) (“Respondent has no authority to alter court judgments.  The correction of judgments i[s] the providence of the court.”); Turner, 447 F. Supp. at 1212-13 (stating that rating “is a highly subjective process which requires the opinions and judgments of military professionals” and denying plaintiff’s request, which was “in essence” that the court “determine de novo ‘a fair and accurate’ rating as to the ‘quality’ of his service”). 

The D.C. Circuit and a few district courts have found that agencies satisfy the subsection (e)(5) requirement by maintaining verifiable information; in the atypical case where information conflicts or the truth is not readily attainable, courts have assessed whether agencies maintained records in a fair and reasonable manner.

In determining what steps an agency must take in order to satisfy the accuracy standard of subsection (e)(5), the Court of Appeals for the District of Columbia Circuit has looked to whether the information at issue is capable of being verified.  In Doe v. United States, 821 F.2d 694, 697-701 (D.C. Cir. 1987), the D.C. Circuit, sitting en banc, in a seven-to-four decision, held that the inclusion in a job applicant’s record of both the applicant’s and agency interviewer’s conflicting versions of an interview (in which only they were present) satisfies subsection (e)(5)’s requirement of maintaining reasonably accurate records.  In rejecting the argument that the agency and reviewing court must themselves make a credibility determination of which version of the interview to believe, the D.C. Circuit ruled that subsections (e)(5) and (g)(1)(C) “establish as the record-keeper’s polestar, ‘fairness’ to the individual about whom information is gathered,” and that “the ‘fairness’ criterion does not demand a credibility determination in the atypical circumstances of this case.”  Id. at 699 (emphasis added); see also Harris v USDA, 124 F. 3d 197 (6th Cir. 1997) (unpublished table decision) (ruling that agency “reasonably excluded” information from the plaintiff’s record where there was “substantial evidence that the [information] was unreliable,” and in the absence of “verifiable information which contradicted its investigators’ records,” the agency “reasonably kept and relied on the information gathered by its investigators when it terminated plaintiff”); Graham, 857 F. Supp. at 40 (asserting that agency was under no obligation to resolve whether hearsay contained in report was true, so long as that information was characterized as hearsay); Doe v. FBI, No. 91-1252, slip op. at 6-7 (D.N.J. Feb. 27, 1992) (following Doe v. United States, 821 F.2d at 699, and holding that FBI fulfilled its obligations under Privacy Act by including plaintiff’s objections to statements contained in FBI polygrapher’s memorandum and by verifying to extent possible that polygraph was properly conducted).

Subsequently, the D.C. Circuit held that in a “typical” case, where the records at issue are “not ambivalent” and the facts described therein are “susceptible of proof,” the agency and reviewing court must determine accuracy as to each filed item of information.  Strang v. U.S. Arms Control & Disarmament Agency, 864 F.2d 859, 866 (D.C. Cir. 1989).  In order to “assure fairness” and render the record “complete” under subsection (e)(5), an agency may even be required to include contrary or qualifying information.  See Strang v. U.S. Arms Control & Disarmament Agency, 920 F.2d 30, 32 (D.C. Cir. 1990); Kassel v. VA, 709 F. Supp. 1194, 1204-05 (D.N.H. 1989).

Adhering to its holding in Strang, the D.C. Circuit later held:

Sellers, 959 F.2d at 312.  It is worth noting that Sellers was solely a subsection (e)(5)/(g)(1)(C) case; the system of records at issue was exempt from access under subsection (d).  See also McCready v. Nicholson, 465 F.3d 1, 19 (D.C. Cir. 2006) (citing Sellers and Doe v. United States and remanding because court “fail[ed] to see how [plaintiff’s] presence at a meeting is not a ‘fact’ capable of verification and why the [agency] need not correct that fact or show that it took reasonable steps to verify its accuracy”); Martinez v. BOP, 444 F.3d 620, 624 (D.C. Cir. 2006) (dicta) (explaining that BOP had contacted U.S. Parole Commission and U.S. Probation Office and was advised that BOP’s records were accurate); Toolasprashad v. BOP, 286 F.3d 576, 583 (D.C. Cir. 2002) (citing Sellers and Doe v. United States and remanding so that “typicality issue” may be resolved and so that agency can prove inmate had “significant documented history of harassing and demeaning staff members”); Griffin v. Parole Comm’n, No. 97-5084, 1997 U.S. App. LEXIS 22401, at *3-5 (D.C. Cir. July 16, 1997) (citing Doe v. United States and Deters, and finding itself presented with “typical” case in which information was capable of verification; therefore vacating district court opinion that had characterized case as “atypical”), vacated & remanded No. 96-0342, 1997 U.S. Dist. LEXIS 2846 (D.D.C. Mar. 11, 1997); Deters, 85 F.3d at 658-59 (quoting Sellers and Doe v. United States, and although finding itself presented with “an atypical case because the ‘truth’ . . . is not readily ascertainable . . . assum[ing] without concluding that the Commission failed to maintain Deters’s records with sufficient accuracy,” because Commission had “not argued that this was an atypical case”); Hutton v. VA, No. 1:12CV190, 2013 WL 1331191, at *2 (M.D.N.C. Mar. 29, 2013) (“Because Plaintiff concedes in his Complaint that he was at one time a disabled veteran, there is no plausible basis for believing that the information that he seeks to have removed from his VA record, specifically, the ‘label’ of being a disabled veteran in the past, constitutes false or inaccurate information.”); Lopez v. Huff, 508 F. Supp. 2d 71, 77-78 (D.D.C. 2007) (finding that “BOP satisfied its [Privacy Act] obligations by contacting the appropriate [U.S. Probation Office] to verify the accuracy of the challenged information”); Brown v. Prob. Office, No. 03-872, 2005 WL 2284207, at *3 (E.D. Tex. Aug. 15, 2005) (concluding that BOP’s maintenance of inmate’s presentence report satisfied subsection (e)(5) because BOP “took affirmative steps to verify the information by contacting the state court and the probation officer who prepared the [report]”); Blazy, 979 F. Supp. at 20-21 (citing Sellers and Doe v. United States, and finding that alleged inaccuracies were either nonexistent, corrected, or “unverifiable opinions of supervisors, other employees and/or informants”); Bayless v. Parole Comm’n, No. 94CV0686, 1996 WL 525325, at *5 (D.D.C. Sept. 11, 1996) (citing Sellers and Doe v. United States, and finding itself presented with an “atypical” case because “truth concerning plaintiff[‘]s culpability in the conspiracy and the weight of drugs attributed to him involves credibility determinations of trial witnesses and government informants and, therefore, is not ‘clearly provable’”); Webb, 880 F. Supp. at 25 (finding that record at issue contained “justified statements of opinion, not fact” and “[c]onsequently, they were not ‘capable of being verified’ as false and cannot be considered inaccurate statements” (quoting Sellers, 959 F.2d at 312, and citing Doe v. United States, 821 F.2d at 699)); Thomas v. Parole Comm’n, No. 94-0174, 1994 WL 487139, at *4-6 (D.D.C. Sept. 7, 1994) (discussing Doe v. United States, Strang, and Sellers, but finding that Parole Commission “verified the external ‘verifiable’ facts”; further holding that plaintiff should not be allowed to use Privacy Act “to collaterally attack the contents of his presentence report,” as he “originally had the opportunity to challenge the accuracy . . . before the judge who sentenced him”); Linneman, No. 89-505, slip op. at 11-22 (D.D.C. July 13, 1992) (applying Sellers and Doe v. United States to variety of items of which plaintiff sought amendment).

The D.C. Circuit has stated that subsection (e)(5) only requires an agency to address the accuracy of a record before using it to make a determination about an individual if the agency has no duty to amend the record pursuant to the Privacy Act’s amendment provisions.

The D.C. Circuit has noted that where “an agency has no subsection (d) duty to amend, upon request, it is not clear what residual duty subsection (e)(5) imposes when an individual challenges the accuracy of a record.”  Deters, 85 F.3d at 658 n.2.  The court questioned whether subsection (e)(5) would still require an agency to amend or expunge a record upon the individual’s request, or whether the agency merely must “address the accuracy of the records at some point before using it to make a determination of consequence to the individual.”  Id.  Although stating that the Sellers opinion was “not entirely clear on this point,” the D.C. Circuit reasoned that “the language of subsection (e)(5) . . . suggests the latter course.”  Id. (citing OMB 1975 Guidelines, 40 Fed. Reg. at 28,964 https://www.justice.gov/paoverview_omb-75).  The court stated that subsection (e)(5) suggests that an agency has “no duty to act on an [individual’s] challenge and verify his record until the agency uses the record in making a determination affecting his rights, benefits, entitlements or opportunities,” 85 F.3d at 660; see also Bayless, 1996 WL 525325, at *6 n.19 (quoting Deters and determining that agency “fulfilled its requisite duty by ‘addressing’ plaintiff’s allegations prior to rendering a parole determination”); cf. Bassiouni v. FBI, No. 02-8918, 2003 WL 22227189, at *5 (N.D. Ill. Sept. 26, 2003) (holding that agency’s denial of request to amend alleged inaccurate records about plaintiff was in and of itself a “determination” under subsection (e)(5)), aff’d on other grounds, 436 F.3d 712 (7th Cir. 2006).

The Ninth Circuit Court of Appeals has held that an agency can comply with the subsection (e)(5) requirement by simply including a complainant’s rebuttal statements with the complainant’s records.

The Court of Appeals for the Ninth Circuit has held that an agency can comply with subsection (e)(5) by simply including a complainant’s rebuttal statement with an allegedly inaccurate record.  Fendler v. BOP, 846 F.2d 550, 554 (9th Cir. 1988) (subsections (e)(5) and (g)(1)(C) lawsuit); see also Graham, 857 F. Supp. at 40 (citing Fendler and holding that where individual disputes accuracy of information that agency has characterized as hearsay, agency satisfies subsection (e)(5) by permitting individual to place rebuttal in file); cf. Harris, 124 F.3d at 197 (holding that although exclusion of information from appellant’s record due to unreliability of information was reasonable, it was “notabl[e]” that the appellant had not contested the district court’s finding that the agency “did not prevent him from adding to the file his disagreement with the [agency] investigators’ conclusions”).  Fendler thus appears to conflict with both Doe v. United States and Strang, as well as with the D.C. Circuit’s earlier decision in Vymetalik v. FBI, 785 F.2d 1090, 1098 n.12 (D.C. Cir. 1986) (noting that subsection (d)(2) “guarantees an individual the right to demand that his or her records be amended if inaccurate” and that mere inclusion of rebuttal statement was not “intended to be [the] exclusive [remedy]”).

The Fifth Circuit and several other courts have held that to satisfy the subsection (e)(5) “timeliness” requirement, agencies must incorporate notes into a record at the time the records are used by the agency to make a determination about the individual.

In Chapman v. NASA, 682 F.2d 526, 528-30 (5th Cir. 1982), the Court of Appeals for the Fifth Circuit recognized a “timely incorporation” duty under subsection (e)(5).  It ruled that a supervisor’s personal notes “evanesced” into Privacy Act records when they were used by the agency to effect an adverse disciplinary action, and that such records must be placed into the employee’s file “at the time of the next evaluation or report on the employee’s work status or performance.”  Id. at 529.  In reversing the district court’s ruling that such notes were not records within a system of records, the Fifth Circuit noted that such incorporation ensures fairness by allowing employees a meaningful opportunity to make refutatory notations, and avoids an “ambush” approach to maintaining records.  Id.; see also Thompson v. DOT U.S. Coast Guard, 547 F. Supp. 274, 283-84 (S.D. Fla. 1982) (explaining Chapman).  Chapman’s “timely incorporation” doctrine has been followed in several other cases.  See, e.g., MacDonald v. VA, No. 87-544-CIV-T-15A, slip op. at 2-5 (M.D. Fla. Feb. 8, 1988) (stating that the counseling memorandum used in preparation of proficiency report “became” part of VA system of records); Lawrence v. Dole, No. 83-2876, slip op. at 5-6 (D.D.C. Dec. 12, 1985) (finding that notes not incorporated in timely manner cannot be used as basis for adverse employment action); cf. Hudson v. Reno, 103 F.3d 1193, 1205-06 & n.9 (6th Cir. 1997) (distinguishing facts in Chapman and holding that supervisor’s “notes about [p]laintiff’s misconduct which were kept in a locked drawer and labeled the ‘First Assistant’s’ files do not fall within th[e system of records] definition,” as they “were not used to make any determination with respect to [p]laintiff”); Manuel v. VA, 857 F.2d 1112, 1117-19 (6th Cir. 1988) (finding no duty to place records within system of records where records “are not part of an official agency investigation into activities of the individual requesting the records, and where the records requested do not have an adverse effect on the individual”); Magee v. United States, 903 F. Supp. 1022, 1029-30 (W.D. La. 1995) (finding plaintiff’s file kept in a supervisor’s desk, separate from other employee files, because of plaintiff’s concerns about access to it and with plaintiff’s acquiescence, did “not fall within the proscriptions of maintaining a ‘secret file’ under the Act”), aff’d, 79 F.3d 1145 (5th Cir. 1996) (unpublished table decision).

The subsection (e)(5) requirement does not require agencies to maintain only the most recent information, but requires agencies to preserve records where the agency “reasonably foresees” use of the record.

Turning to the “timeliness” requirement of subsection (e)(5)’s “accuracy, relevance, timeliness, and completeness” standard, “timeliness” does not require that agency records contain only information that is “hot off the presses.”  White v. OPM, 787 F.2d 660, 663 (D.C. Cir. 1986) (rejecting argument that use of year-old evaluation violates Act, as it “would be an unwarranted intrusion on the agency’s freedom to shape employment application procedures”); see also Beckette v. USPS, No. 88-802, slip op. at 12-14 (E.D. Va. July 3, 1989) (stating that “[a]ll of the record maintenance requirements of subsection 552a(e)(5), including timeliness, concern fairness,” and finding that as to records regarding “restricted sick leave,” “[w]iping the . . . slate clean after an employee has remained off the listing for only six months is not required to assure fairness to the individual”; also finding that maintenance of those records for six months after restricted sick leave had been rescinded “did not violate the relevancy requirement of subsection 552a(e)(5)”). 

Agencies have a duty to preserve records where investigation and future litigation is “reasonably foreseeable.”  See Gerlich v. DOJ, 659 F. Supp. 2d 1 (D.D.C. 2009), aff’d in part, rev’d in part & remanded, on other grounds, 711 F.3d 161 (D.C. Cir. 2013) (holding that summary judgment was inappropriately granted under subsections (e)(5) and (e)(7) claims and concluding “in light of the destruction of appellants’ records, that a permissive spoliation inference was warranted because the senior Department officials had a duty to preserve the annotated applications and internet printouts given that Department investigation and future litigation were reasonably foreseeable”).  Agencies do not need to keep records indefinitely, however.  The Court of Appeals for the Fourth Circuit has held that subsection (e)(5) is “not violated by the destruction of [a] record” that is destroyed “pursuant to [agency] records retention policy.”  Vaughn v. Danzig, 18 F. App’x 122, 124-25 (4th Cir. 2001) (per curiam) (finding that where Navy maintained record at issue in its files “at the time of the adverse action,” the subsequent routine destruction of record was proper and, indeed, plaintiff “cited no authority” to show that “the Privacy Act requires that records be maintained in perpetuity”). Cf. Hunt v. VA, 888 F. Supp. 2d 48, 54 (D.D.C. 2012) (“Since plaintiff has not identified an agency record subject to testing for accuracy, the Court must deny his motion for summary judgment because he has not proffered any probative evidence of a Privacy Act violation.”), aff’d, 739 F.3d 706 (D.C. Cir. 2014); Cottrell v. Vilsack, 915 F. Supp. 2d 81, 91 (D.D.C. 2013) (finding plaintiff had no subsection (e)(5) claim, stating that “[t]he Privacy Act does not require that [agencies] maintain computerized records of unapproved [agency program] applications”).

In addition to its accuracy and timeliness requirements, subsection (e)(5) requires agencies to reasonably maintain only records that are “relevant” to an agency determination about the individual.

Regarding the “relevance” prong of the “accuracy, relevance, timeliness, and completeness” standard, the District Court of the District of Columbia found that the inclusion of irrelevant documents in job candidates’ records was an appropriate basis for a subsection (e)(5) claim.  See Gerlich v. DOJ, 659 F. Supp. 2d at 16.  The plaintiffs, who had applied to work for the Justice Department, alleged that two members of the selection committee had taken the plaintiffs’ political and ideological associations into account in deselecting them for interviews.  Id. at 6.  Specifically, the plaintiffs alleged that one official “conducted Internet searches regarding candidates’ political and ideological affiliations, printed out such information when it revealed liberal associations and then attached the printouts and her own handwritten comments to the candidates’ applications in support of her recommendations to deselect them.”  Id.  The court noted that “[m]ost ‘adverse determination’ claims hinge on inaccurate or incomplete records.”  Id. at 15.  Here, however, the plaintiffs alleged that “irrelevant records (i.e., the records of their First Amendment activities) led to an adverse determination against them (i.e., deselection by the Screening Committee).”  Id.  The court rejected the Department’s argument that the plaintiffs’ failure to allege any inaccuracy was grounds for dismissal of plaintiffs’ (e)(5) claim:  “By the plain language of (g)(1)(C), relevance stands on equal footing with accuracy, timeliness and completeness as a basis for pursuing money damages for an adverse determination.”  Id. at 15-16.  The court concluded that “plaintiffs have met their pleading burden with respect to their subsection (e)(5) claim” because they alleged “that they suffered an adverse determination (deselection/non-hiring), that DOJ maintained irrelevant records (regarding plaintiffs’ First Amendment activities) which undermined the fairness of the hiring process, that DOJ’s reliance on those records (or the reliance of its employees . . .) proximately caused the adverse determination, and that DOJ (again, through its employees . . .) acted intentionally or willfully in maintaining such records.”  Id. at 16.

For a further discussion of subsection (e)(5), see OMB 1975 Guidelines, 40 Fed. Reg. at 28,964-65, https://www.justice.gov/paoverview_omb-75.

 

F. 5 U.S.C. § 552a(e)(6) - Review Records Prior to Dissemination

“Each agency that maintains a system of records shall –

. . .

(6) prior to disseminating any record about an individual to any person other than an agency, unless the dissemination is made pursuant to [the subsection (b)(2) required FOIA disclosure exception], make reasonable efforts to assure that such records are accurate, complete, timely, and relevant for agency purposes.”  5 U.S.C. § 552a(e)(6).

Comment:

Prior to disseminating records, agencies must review them for accuracy, relevance, timeliness, and completeness.

Agencies are required to make a reasonable effort to review records prior to their dissemination.  See NTEU v. IRS, 601 F. Supp. 1268, 1272 (D.D.C. 1985); see also Stewart v. FBI, No. 97-1595, slip op. at 4 (D. Or. Mar. 12, 1999) (holding (e)(6) was violated where agency failed to establish that it conducted reasonable efforts to ensure accuracy of information “of a factual nature” that was “capable of being verified”), withdrawn by stipulation as part of settlement, No. 97-1595, 2000 WL 739253 (D. Or. May 12, 2000); Gang v. Civil Serv. Comm’n, No. 76-1263, slip op. at 2-5 (D.D.C. May 10, 1977) (holding provision violated where agency failed to review personnel file to determine relevance and timeliness of dated material concerning political activities before disseminating it to Library of Congress).

Statements of opinion or judgment generally are not covered by the subsection (e)(6) requirement.

The District Court for the District of Columbia has held that an agency was not liable under subsection (e)(6) for damages for the dissemination of information that plaintiff had claimed was inaccurate but that the court determined consisted of statements of opinion and subjective evaluation that were not subject to amendment.  Webb v. Magaw, 880 F. Supp. 20, 25 (D.D.C. 1995); see also Pontecorvo v. FBI, No. 00-1511, slip op. at 20 (D.D.C. Sept. 30, 2001) (finding that “if the information gathered and contained within an individual’s background records is the subjective opinion of witnesses, it is incapable of being verified as false and cannot constitute inaccurate statements under the Privacy Act”); cf. Bhatia v. Office of the U.S. Attorney, N. Dist. of Cal., No. C 09-5581, 2011 WL 1298763, at *6-7 (N.D. Cal. Mar. 29, 2011) (holding plaintiff failed to state a claim under § 552a(e)(6) because “the documents cited by [plaintiff do] not establish that the allegations in the pending criminal indictment are inaccurate”), aff’d, 507 F. App’x 649 (9th Cir. 2013); Doe v. DOJ, 660 F. Supp. 2d 31, 43 (D.D.C. 2009) (concluding that “[b]ecause plaintiff has failed to show that there was an ‘error in the records,’ . . . he cannot succeed under . . . (e)(6)”). 

Some courts have utilized the “intentional and willful” standard for damages suits in assessing agency compliance with the subsection (e)(6) requirement.

Other district courts considering claims under subsection (e)(6), have taken into account the requirements of causation and intentional and willful wrongdoing in Privacy Act damages actions, discussed below.  Guccione v. Nat’l Indian Gaming Comm’n, No. 98-CV-164, 1999 U.S. Dist. LEXIS 15475, at *14-19 (S.D. Cal. Aug. 5, 1999).  The court found that an administrative hearing concerning inconsistencies in plaintiff’s employment application “smacked generally of reprimand even though no talismanic phrases akin to reprimand were used,” and that therefore “there was no ‘intentional’ or ‘willful’ misconduct in the [agency’s] use of the term reprimand,” nor was there sufficient causation where the recipients of the information also had reviewed the transcript of the administrative hearing and could draw their own conclusions.  Id. at *16-19; see also Conyers v. VA, No. 16-CV-00013, 2018 WL 1867106, at *11 (E.D. N.Y. Jan. 29, 2018) (holding plaintiff failed to state a claim under section 552a(e)(6) because plaintiff failed to “set forth allegations that the Department personnel with whom he had contact dealt, acted, or failed to act, in such a ‘patently egregious and unlawful [manner]’ so as to have ‘known the conduct . . .[was] unlawful.’ Plaintiff, at best, alleges ‘administrative error’ for which the Privacy Act does not provide relief” (internal citations omitted); Kelley v. FBI, No. 13-0825 (ABJ), 2014 WL 4523650 (D.D.C. Sept. 15, 2014) (holding plaintiff failed to state a claim upon which damages can be granted because the allegations “did not rise to the level of the flagrant and obvious disregard”).

The subsection (e)(6) requirement does not apply to intra- or inter-agency disclosures.

By its terms, this provision does not apply to intra- or inter-agency disclosures, see Lamb v. Milennium Challenge Corp., 228 F. Supp. 3d 28 (D.D.C.  2017) (holding “[t]he statutory language makes clear that [section 552a(e)(6)] does not apply when information is disclosed within the agency or to another agency.” (internal citations omitted)); see also Elhelbawy v. Pritzker, No. 14-cv-01707-CBS, 2015 WL 5535246 (D. Colo. Sept. 21, 2015); Singh v. DHS, No. 1:12-cv-00498, 2013 WL 1704296, at *22-23 (E.D. Cal. Apr. 19, 2013); Thompson v. State, 400 F. Supp. 2d 1, 21-22 (D.D.C. 2005), or to mandatory FOIA disclosures, see Smith v. United States, 817 F.2d 86, 87 (10th Cir. 1987); Kassel v. VA, 709 F. Supp. 1194, 1205 & n.5 (D.N.H. 1989); see also OMB 1975 Guidelines, 40 Fed. Reg. at 28,965, https://​www.justice.gov/paoverview_omb-75.

The subsection (e)(6) requirement is not superseded by regulations governing the National Practitioners’ Data Bank promulgated in accordance with the Health Care Quality Improvement Act.

In addition, the District Court for the District of Columbia has concluded that regulations promulgated by the Department of Health and Human Services pursuant to the Health Care Quality Improvement Act, which concern collection and dissemination of information contained in the National Practitioners’ Data Bank, do not supersede the more stringent protections provided by subsection (e)(6) of the Privacy Act.  Doe v. Thompson, 332 F. Supp. 2d 124, 129-32 (D.D.C. 2004).

 

G. 5 U.S.C. § 552a(e)(7) - Record Describing The Exercise of Rights Guaranteed by the First Amendment

Each agency that maintains a system of records shall --

. . .

(7) maintain no record describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual about whom the record is maintained or unless pertinent to and within the scope of an authorized law enforcement activity.”  5 U.S.C. § 552a(e)(7).

Comment:

Generally, agencies are prohibited from maintaining records about individuals’ First Amendment activities.  The OMB 1975 Guidelines advise agencies determining whether a particular activity constitutes exercise of a right guaranteed by the First Amendment to “apply the broadest reasonable interpretation.”  40 Fed. Reg. at 28,965, https://www.justice.gov/paoverview​_omb-75; see also 120 Cong. Rec. at 40,406, reprinted in Source Book at 860.

Records do not need to be in a system of records to be covered by the subsection (e)(7) requirement, but must meet the definition of a “record” in accordance with the Privacy Act.

The record at issue need not be within a system of records to violate subsection (e)(7).  See Maydak v. United States, 363 F.3d 512, 516-20 (D.C. Cir. 2004); MacPherson v. IRS, 803 F.2d 479, 481 (9th Cir. 1986); Boyd v. Sec’y of the Navy, 709 F.2d 684, 687 (11th Cir. 1983) (per curiam); Clarkson v. IRS, 678 F.2d 1368, 1373-77 (11th Cir. 1982); Albright v. United States, 631 F.2d 915, 918-20 (D.C. Cir. 1980); Gerlich v. DOJ, 659 F. Supp. 2d 1, 13-15 (D.D.C. 2009), aff’d in part, rev’d in part & remanded, on other grounds, 711 F.3d 161 (D.C. Cir. 2013); McCready v. Principi, 297 F. Supp. 2d 178, 187 (D.D.C. 2003), aff’d in part & rev’d in part on other grounds sub nom. McCready v. Nicholson, 465 F.3d 1 (D.C. Cir. 2006). See also the discussion under “Definitions, System of Records, Protections for Records not within a System of Records,” above. 

That said, the information at issue must meet the “record” definition under the Privacy Act for subsection (e)(7) to be applicable.  See e.g., Houghton v. State, 875 F. Supp. 2d 22, 31-32 (D.D.C. 2012) (finding that transcripts containing reference to plaintiff’s work were not “about” plaintiff, and therefore, not record under Privacy Act to implicate application of subsection (e)(7)); Iqbal v. FBI, No. 3:11-cv-369, 2012 WL 2366634, at *5 (M.D. Fla. June 21, 2012)  (finding allegation in complaint that stated “the agents [took] notes to aid the creation of official reports” sufficient to “satisfy the requirement that the agency maintain[ed] a record” in order to invoke application of subsection (e)(7)).

The record must implicate the individual’s First Amendment rights to be within the scope of the subsection (e)(7) requirement.

The record at issue “must implicate an individual’s First Amendment rights.”  Boyd, 709 F.2d at 684; accord Banks v. Garrett, 901 F.2d 1084, 1089 (Fed. Cir. 1990); see also Elnashar v. DOJ, 446 F.3d 792, 794-95 (8th Cir. 2006) (explaining that plaintiff “failed to identify how his First Amendment rights were implicated” when FBI contacted him “to determine whether he had expertise with chemical weapons”); Reuber v. United States, 829 F.2d 133, 142-43 (D.C. Cir. 1987) (noting threshold requirement that record itself must describe First Amendment-protected activity); Gerlich, 659 F. Supp. 2d at 13-15 (same); Pototsky v. Navy, 717 F. Supp. 20, 22 (D. Mass. 1989) (same), aff’d, 907 F.2d 142 (1st Cir. 1990) (unpublished table decision). 

Thus, subsection (e)(7) is not triggered unless the record describes First Amendment-protected activity.  See, e.g., Maydak, 363 F.3d at 516 (finding “it obvious that photographs of prisoners visiting with family, friends, and associates depict the exercise of associational rights protected by the First Amendment”); England v. Comm’r, 798 F.2d 350, 352-53 (9th Cir. 1986) (finding record identifying individual as having “tax protester” status does not describe how individual exercises First Amendment rights); Iqbal, 2012 WL 2366634, at *5 (holding allegation that FBI “agents were monitoring [plaintiff] during prayer and later commented on those prayers” was “sufficient (if barely so) to support an inference that the notes maintained by the FBI implicated [plaintiff’s] exercise of his First Amendment rights.”); Jacobs v. NSA, No. 19-CV-3439, 2019 WL 7168626, at *1 (D.D.C. Dec. 24, 2019) (finding no violation where the plaintiff’s “[c]omplaint contains no factual allegations from which the Court could conclude that the NSA illegally recorded protected speech”); Kvech v. Holder, No. 10-cv-545, 2011 WL 4369452, at *6 (D.D.C. Sept. 19, 2011) (citing Maydak and finding argument that “the non-marital, non-familial relationship between [plaintiff] and the detective is not the type protected as freedom of expression under the First Amendment” to be “contrary to precedent”); Ramey v. Marshals Serv., 755 F. Supp. 2d 88, 97-98 (D.D.C. 2010) (“[Plaintiff’s] statements to the Chief Judge were made in the course of her duties as a [court security officer] and receive no First Amendment protection.”); Gerlich, 659 F. Supp. 2d at 13 (holding that plaintiff job applicants “met their pleading burden” where they alleged that agency official “conducted Internet searches regarding applicants’ political and ideological affiliations” and “either created printouts of such information or made written comments on the applications throughout the process concerning the liberal affiliations of candidates”); Krieger v. DOJ, 529 F. Supp. 2d 29, 51-52 (D.D.C. 2008) (finding that documents announcing speeches to be given by plaintiff and complaints filed by plaintiff against his former law firm described how plaintiff exercises First Amendment rights); Weeden v. Frank, No. 1:91CV0016, slip op. at 7-8 (N.D. Ohio Apr. 10, 1992) (asserting that to read subsection (e)(7) as requiring a privacy waiver for the agency to even file plaintiff’s request for religious accommodation is “a broad and unreasonable interpretation of subsection (e)(7)”; however, agency would need to obtain waiver to collect information in order to verify plaintiff’s exercise of religious beliefs), aff’d, 16 F.3d 1223 (6th Cir. 1994) (unpublished table decision).  Cf. Hartley v. Wilfert, 918 F. Supp. 2d 45, 54-56 (D.D.C. 2013) (concluding that Secret Service officer’s “actions here did not involve the sort of collection of information contemplated by the Act; instead, his words were merely a threat to intimidate [plaintiff] from continuing in her speech” where officer informed demonstrator that if she remained on sidewalk in front of White House she would have to provide certain items of information about herself and would be “added to the Secret Service list” and “considered one of the crazies who protest in front of the White House”).

Agencies are permitted to maintain a record describing how any individual exercises rights guaranteed by the First Amendment if the agency is authorized by statute to maintain that record.

Assuming that the challenged record itself describes activity protected by the First Amendment, subsection (e)(7) is violated unless maintenance of the record fits into one of the enumerated exceptions.  Specifically, agencies may maintain record describing how any individual exercises rights guaranteed by the First Amendment “expressly authorized by statute.”  See, e.g., Abernethy v. IRS, 909 F. Supp. 1562, 1570 (N.D. Ga. 1995) (finding IRS “authorized by statute” to maintain copies of documents relevant to processing of plaintiff’s requests under FOIA and Privacy Act, which both “provide implied authorization to federal agencies to maintain copies for their own records of the documents which are released to requesters under those Acts”), aff’d per curiam, No. 95-9489 (11th Cir. Feb. 13, 1997); Hass v. Air Force, 848 F. Supp. 926, 930-31 (D. Kan. 1994) (finding agency’s maintenance of FOIA and Privacy Act requests “cannot logically violate the Privacy Act”); OMB 1975 Guidelines, 40 Fed. Reg. at 28,965, https://www.justice.gov/paoverview_omb-75 (Immigration and Nationality Act); cf. Abernethy, 909 F. Supp. at 1570 (finding maintenance of documents in congressional communications files “does not violate the Privacy Act” because IRS “must respond to Congressional inquiries” and maintenance was necessary to carry out that responsibility (citing Internal Revenue Manual 1 (15) 29, Chapter 500, Congressional Communications)); Gang v. U.S. Civil Serv. Comm’n, No. 76-1263, slip op. at 5-7 & n.5 (D.D.C. May 10, 1977) (recognizing that 5 U.S.C. § 7311, which prohibits individual from holding position with federal government if he advocates – or is member of organization that he knows advocates – overthrow of government, may be read together with subsection (e)(7) as permitting maintenance of files relating to membership in such groups, but ruling that “it cannot fairly be read to permit wholesale maintenance of all materials relating to political beliefs, association, and religion”; nor does 5 U.S.C. § 3301, which authorizes President to ascertain fitness of federal applicants for employment as to character, provide authorization for maintenance of such information).

Agencies are permitted to maintain record describing how any individual exercises rights guaranteed by the First Amendment with the expressed consent of the individual on whom the record pertains.

 Agencies may also maintain record describing how any individual exercises rights guaranteed by the First Amendment if “expressly authorized  . . . by the individual about whom the record is maintained.”  See Abernethy, 909 F. Supp. at 1570 (“Plaintiff authorized the maintenance of the documents at issue by submitting copies to various components of the Defendant IRS.”); OMB 1975 Guidelines, 40 Fed. Reg. at 28,965, https://www.justice.gov/paoverview_omb-75 (“volunteered” information is properly maintained); see also Radford v. SSA, No. 81-4099, slip op. at 4-5 (D. Kan. July 11, 1985) (finding plaintiff’s publication of contents of offending record does not constitute “express authorization”); Murphy v. NSA, 2 Gov’t Disclosure Serv. (P-H) ¶ 81,389, at 82,036 (D.D.C. Sept. 29, 1981) (asserting consent to maintain may be withdrawn); cf. Weeden v. Frank, No. 93-3681, 1994 WL 47137, at *2 (6th Cir. Feb. 16, 1994) (finding reasonable Postal Service’s procedure requiring individual to expressly waive subsection (e)(7) Privacy Act rights to allow agency to collect information regarding employee’s exercise of religious beliefs so that accommodation could be established).

Agencies are permitted to maintain a record describing how any individual exercises rights guaranteed by the First Amendment that are pertinent to and within the scope of an authorized law enforcement activity; the circuits are split on the appropriate standard by which to determine if a record is pertinent to and within the scope of an authorized law enforcement activity.

Finally, agencies may maintain record describing how any individual exercises rights guaranteed by the First Amendment “pertinent to and within the scope of an authorized law enforcement activity.”

The Third, Sixth, and D.C. Circuit Courts of Appeals have adopted a “relevance” standard to assess whether information is within the scope of the “law enforcement activity” exception.  See Patterson v. FBI, 893 F.2d 595, 602-03 (3d Cir. 1990) (affirming dismissal of student’s subsection (e)(7) claim, and concluding that a standard of “relevance” to a lawful law enforcement activity is “more consistent with Congress’s intent and will prove to be a more manageable standard than employing one based on ad-hoc review”);  Jabara v. Webster, 691 F.2d 272, 279-80 (6th Cir. 1982) (holding that FBI’s overseas surveillance records were “relevant to an authorized criminal investigation or to an authorized intelligence or administrative one”); Sieverding v. U.S. Dep’t of Justice, 693 F. Supp. 2d 93, 105 (D.D.C. 2010), aff’d, No. 13-5060, 2013 WL 6801184 (D.C. Cir. Dec. 11, 2013), aff'd, No. 13-5060, 2013 WL 6801184 (D.C. Cir. Dec. 11, 2013) (to be excepted from 5 U.S.C. § 552a(e)(7), records need only be “relevant to an authorized criminal investigation or to an authorized intelligence or administrative one.”  Nagel v. HEW, 725 F.2d 1438, 1441 n.3 (D.C. Cir. 1984) (quoting Jabara, 691 F.2d at 280).

The Courts of Appeals for the Eleventh and the Ninth Circuits adopted narrower standards, however.  See MacPherson v. IRS, 803 F.2d at 482-85 (ruling ruled that applicability of exception could be assessed only on “individual, case-by-case basis” and that “hard and fast standard” was inappropriate, but concluding that agency appropriately maintained notes and purchased tapes of tax protester’s speech as “necessary to give the [IRS and Justice Department] a complete and representative picture of the events,” notwithstanding that no investigation of specific violation of law was involved and no past, present, or anticipated illegal conduct was revealed or even suspected); Clarkson v. IRS, 678 F.2d at 1374-75 (Eleventh Circuit quoted with approval standard set forth by district court decision in Jabara (subsequently vacated and remanded by Sixth Circuit) and held that exception does not apply if record is “unconnected to any investigation of past, present or anticipated violations of statutes [the agency] is authorized to enforce”). 

The circuits also are split on how long a record describing an individual’s First Amendment activities continue to be “pertinent” to an authorized law enforcement investigation.

The circuits have generally interpreted the law enforcement exception broadly and concluded that it applies to closed investigative files.  For example, the Court of Appeals for the District of Columbia Circuit interpreted the law enforcement exception in a closed investigation and concluded that, because “[m]aterials may continue to be relevant to a law enforcement activity long after a particular investigation undertaken pursuant to that activity has been closed,” “[i]nformation that was pertinent to an authorized law enforcement activity when collected does not later lose its pertinence to that activity simply because the information is not of current interest (let alone ‘necessity’) to the agency.”  J. Roderick MacArthur Found. v. FBI, 102 F.3d 600, 602-03 (D.C. Cir. 1996).  The panel majority held that the Privacy Act does not require an agency to expunge records when they are no longer pertinent to a current law enforcement activity.  Id. at 605; see also Afifi v. Lynch, 101 F. Supp. 3d 90, 107 (D.D.C. 2015) (finding that closed investigation of plaintiff did not render FBI records invalid under section (e)(7) because records may permit “the FBI to verify or evaluate any new intelligence received, assess the reliability of other sources, and ensure accountability regarding how the FBI responded to the information it received”); Bassiouni v. FBI, 436 F.3d 712, 724-25 (7th Cir. 2006) (rejecting plaintiff’s argument in national security context that FBI must be “currently involved in law enforcement investigation” for exception to apply, concluding that FBI was not required “to purge, on a continuous basis, properly collected information with respect to individuals that the agency has good reason to believe may be relevant on a continuing basis in the fulfillment of the agency’s statutory responsibilities”).

The Court of Appeals for the Seventh Circuit addressed the law enforcement exception in the context of national security and reached a conclusion similar to that in MacArthur.  See Bassiouni v. FBI, 436 F.3d at 723-25.  At issue in Bassiouni was whether the law enforcement exception covered the FBI’s maintenance of records pertaining to a law professor who once presided over two Arab-American associations.  436 F.3d at 724.  The court found that records maintained by the FBI for the purpose of national security (specifically, intelligence related to international terrorism) was within subsection (e)(7)’s law enforcement activity exception even though the FBI was not at the time involved in a law enforcement activity or investigation.  Id. at 723-25.  The court reached its decision based on the FBI’s assertion that it needed to maintain the records because (1) the FBI had amended its investigative activities to make protection of the United States against terrorist attack its top priority, (2) the FBI anticipated “that it [would] continue to receive information about [the plaintiff]” owing to “the nature of these investigative activities” and “the breadth of [the plaintiff’s] contacts with the Middle East,” and (3) “the records [were] important for evaluating the continued reliability of [the FBI’s] intelligence sources.”  Id. at 724.  The court opined that these purposes “fall within ‘authorized law enforcement activity’ conducted by the FBI,” noting that “the realm of national security belongs to the executive branch, and we owe considerable deference to that branch’s assessment in matters of national security.”  Id.

Other courts have taken a similar approach in the national security context.  Palmieri v. United States, 896 F.3d 579, 585-86 (D.C. Cir. 2018) (holding that Naval Criminal Investigative Service did not violate subsection (e)(7) when it assembled records concerning a government contractor’s exercise of his First Amendment activities, including his associations and travel with Syrian nationals, and quoting Maydak, 363 F.3d at 517, to conclude that “law enforcement activities” is “interpreted . . . broadly to include an authorized criminal, intelligence, or administrative investigation”) (internal citation and quotation marks omitted).

The Ninth Circuit, however, recently held that “unless a record is pertinent to an ongoing authorized law enforcement activity, an agency may not maintain it under § (e)(7) of the Privacy Act.”  Garris v. FBI, 937 F.3d at 1288 (9th Cir. 2019).  As the term “maintain” is defined by the Privacy Act to include both maintain and collect, the court strictly interpreted subsection (e)(7) to read that the record at issue must be pertinent to an authorized law enforcement activity both at the time of collection and at the time of maintenance.  Id. at 1295.  The court further found that its interpretation was consistent with its findings and holding in MacPherson, 803 F.2d at 481-84, which upheld the maintenance of MacPherson’s public speeches on tax protests, and also Becker v. IRS, 34 F.3d 398, 409 (7th Cir. 1994), where the 7th Circuit held that the IRS did not sufficiently justify the maintenance of documents in Becker’s files.  Id. at 1296.  The court in Garris also relied on Bassiouni, at 724-25, which concluded that the FBI’s continued maintenance of records describing Bassiouni’s First Amendment activities did not violate § (e)(7) of the Privacy Act, because “the act ha[d] no separate and distinct maintenance requirement, but rather  . . . the records were of continuing relevance to an authorized law enforcement activity.”  Id.

Finally, the Ninth Circuit in Garris distinguished the D.C. Circuit’s decision in J. Roderick MacArthur Found., 102 F.3d 600, finding that the verb “maintain” is “pertinent to and within the scope of an authorized law enforcement activity” exception, and not just to the record itself.  Id. at 1297.  The court in Garris reasoned that first, “the ‘pertinent to ... an authorized law enforcement activity’ clause does not modify only the noun ‘record,’ because the noun ‘record’ cannot be divorced from the verb ‘maintain’; second, the D.C. Circuit majority’s reading also requires reading into the text words not written by Congress, that is, by inserting the record is before ‘pertinent to and within the scope of an authorized law enforcement activity,’ rather than relying on the word “maintain” at the beginning of the (e)(7), which is a term explicitly defined in the Privacy Act; and third, Congress demonstrated its ability to limit certain provisions of the Privacy Act to only to collection, and not maintenance, as shown in subsections (e)(2), (k)(2), and (k)(5).  Id. at 1297-98.  Although the investigation into Garris had concluded, the court found that the retention of the FBI memo on Garris could still be pertinent to an unauthorized law enforcement activity.  Id. at 1298.  The court concluded though that the FBI memo and threat assessment herein did not reveal a threat to national security, any direct nexus to terrorism, or a threat of compromising current FBI investigations, and did not show was relevant to a broader authorized law enforcement activity that might require its maintenance.  Id.  In closing, the court in Garris stated the following:

Id. at 1300; see also Becker v. IRS, 34 F.3d at 407-09 (adopting strict application of law enforcement exception by ordering IRS to expunge information in closed investigative file because court determined after in camera inspection that it could not “be helpful in future enforcement activity;” court, however, appeared to confusingly engraft the timeliness requirement of subsection (e)(5) onto subsection (e)(7) and to confuse access under subsection (k)(2) with  requirements of subsection (e)(7)); cf. J. Roderick MacArthur Found. v. FBI, 102 F.3d 600, 607 (D.C. Cir. 1996) (Tatel, J., dissenting) (opining in favor of requirement that information be maintained only if pertinent to current law enforcement activity). 

Courts have upheld the subsection (e)(7) law enforcement exception in numerous and varied law enforcement contexts.

The courts have upheld the law enforcement exception’s applicability in a variety of contexts.  See Doe v. FBI, 936 F.2d 1346, 1354-55, 1360-61 (D.C. Cir. 1991) (holding that appellant was foreclosed from obtaining relief because he had “not suffered any adverse effect,” and (e)(7) was not violated because law enforcement exception applied to FBI records concerning investigation of appellant’s “unauthorized possession of an explosive device” and reported advocacy of “violent overthrow of the Government”); Wabun-Inini v. Sessions, 900 F.2d 1231, 1245-46 (8th Cir. 1990) (discussing FBI maintenance of photographs seized with probable cause); Jochen v. VA, No. 88-6138, slip op. at 6-7 (9th Cir. Apr. 5, 1989) (discussing VA evaluative report concerning operation of VA facility and job performance of public employee that contained remarks by plaintiff); Nagel v. HEW, 725 F.2d 1438, 1441 & n.3 (D.C. Cir. 1984) (citing Jabara with approval and holding that records describing statements made by employees while at work were properly maintained “for evaluative or disciplinary purposes”); Smith v. B A Blackmon Warden FCI Marianna, No. 5:18cv40, 2019 WL 3047081, at *7 (N.D. Fla. May 21, 2019) (holding that incident reports prepared as part of Bureau of Prison’s inmate disciplinary process, which is clearly central to BOP’s law enforcement mission in maintaining security and good order within institutions, falls within scope of its authorized law enforcement activity as permitted by subsection (e)(7)); Falwell v. Exec. Office of the President, 158 F. Supp. 2d 734, 742-43 (W.D. Va. 2001) (holding that FBI did not violate subsection (e)(7) by maintaining document entitled “The New Right Humanitarians” in its files, “because the document pertained to and was within the scope of a duly authorized FBI counterintelligence investigation” of Communist Party USA); Abernethy, 909 F. Supp. at 1566, 1570 (holding that maintenance of documents that quoted plaintiff on subject of reverse discrimination were “relevant to and pertinent to authorized law enforcement activities” in file pertaining to EEO complaint, that documents were kept due to belief that conflict of interest might exist through plaintiff’s representation of complainant and, citing Nagel, that maintenance was “valid” in files concerning possible disciplinary action against plaintiff); Maki v. Sessions, No. 1:90-CV-587, 1991 U.S. Dist. LEXIS 7103, at *27-28 (W.D. Mich. May 29, 1991) (holding that, although plaintiff claimed FBI investigation was illegal, uncontested evidence was that plaintiff was subject of authorized investigation by FBI); Kassel v. VA, No. 87-217-S, slip op. at 27-28 (D.N.H. Mar. 30, 1992) (citing Nagel and Jabara, inter alia, and holding that information about plaintiff’s statements to media fell within ambit of administrative investigation); Pacheco v. FBI, 470 F. Supp. 1091, 1108 n.21 (D.P.R. 1979) (“[A]ll investigative files of the FBI fall under the exception.”); AFGE v. Schlesinger, 443 F. Supp. 431, 435 (D.D.C. 1978) (stating reasonable steps agencies take to prevent conflicts of interest are within exception); see also Scott v. Conley, 937 F. Supp. 2d 60, 80-82 (D.D.C. 2013) (dismissing former federal prisoner’s subsection (e)(7) claim based on BOP’s maintenance of records of his phone calls and other communications after his release as plaintiff never alleged facts to suggest BOP’s maintenance lacked a law enforcement purpose when collected and noting that “the passage of time does not cause records to lose their relevance to law enforcement activity”); Felsen v. HHS, No. 95-975, slip op. at 68-72 (D. Md. Sept. 30, 1998) (finding no violation of subsection (e)(7) where report was relevant to authorized law enforcement activity of HHS and also was related to possible past violation of statute that HHS is empowered to enforce). 

Courts have not upheld the subsection (e)(7) law enforcement exception where agencies failed to demonstrate a link between the records and an authorized law enforcement investigation.

However, some courts have not upheld the use of this exception where there does not appear to be a link between the records and an investigation.  See Garcia v. Pompeo, No. 1:18-CV-01822, 2020 WL 134865, at *10 (D.D.C. Jan. 13, 2020) (denying State’s motion to dismiss where the agency did not provide “any affidavits or declarations that would give the court insight into the purpose for which the information about Plaintiff was collected and maintained,” and whether the information was “connected to a security certification investigation” such that it fell within the law enforcement exception); Patel v. Bureau of Prisons, 125 F. Supp. 3d 44, 58-59 (D.D.C. 2015) (finding that law enforcement exception did not apply to memorandum documenting prisoner’s letter to local news station complaining about preferential inmate treatment absent evidence regarding how the alleged memorandum was actually prepared, maintained, or used); Iqbal v. DOJ, No. 3:11-cv-369-J-37, 2013 WL 5421952, at *4 (M.D. Fla. Sept. 26, 2013) (finding “unclear how records of [p]laintiff’s religious practices might relate to [offense regarding fraud and false statements]”); Maydak, 363 F.3d at 516-17 (remanding to district court to determine whether portions of BOP’s declarations stating that certain institutions maintained and reviewed “photographs of prisoners visiting with family, friends and associates” for “investigative and informative value” is consistent with subsection (e)(7)’s law enforcement exception); Levering v. Hinton, No. 2:07-CV-989, 2008 WL 4425961, at *8 (S.D. Ohio Sept. 25, 2008) (refusing to apply law enforcement exception to maintenance of “running record of practically all of Plaintiff’s speech at work”).

Finally, even if records are found to be maintained in violation of subsection (e)(7), it does not follow that those records must be disclosed.  See Bassiouni v. CIA, 392 F.3d. 244, 247-48 (7th Cir. 2004); see also Irons v. Bell, 596 F.2d 468, 470-71 & n.4 (1st Cir. 1979).

 

H. 5 U.S.C. § 552a(e)(8) - Notice of Court Disclosure

“Each agency that maintains a system of records shall --

. . .

(8) make reasonable efforts to serve notice on an individual when any record on such individual is made available to any person under compulsory legal process when such process becomes a matter of public record.”  5 U.S.C. § 552a(e)(8).

Comment:

This provision becomes applicable when subsection (b)(11) “court order” disclosures occur.  See, e.g., Robinett v. State Farm Mut. Auto. Ins. Co., No. 02-0842, 2002 WL 31498992, at *3-4 (E.D. La. Nov. 7, 2002), aff’d per curiam, 83 F. App’x 638 (5th Cir. 2003); Moore v. USPS, 609 F. Supp. 681, 682 (E.D.N.Y. 1985); see also OMB 1975 Guidelines, 40 Fed. Reg. at 28,965, https://www.justice.gov/​paoverview_omb-75.  By its terms, it requires notice not prior to the making of a legally compelled disclosure, but rather at the time that the process becomes a matter of public record.  See Kassel v. VA, No. 87-217-S, slip op. at 30 (D.N.H. Mar. 30, 1992); see also Moore, 609 F. Supp. at 682 (stating that the Privacy Act “§ 552a(e)(8) does not speak of advance notice of release”); cf. Mangino v. Army, No. 94-2067, 1994 WL 477260, at *11-12 (D. Kan. Aug. 24, 1994) (citing Moore for proposition that subsection (e)(8) does not require advance notice, although finding no allegation that disclosure at issue was made “under compulsory legal process”).

 

I. 5 U.S.C. § 552a(e)(9) - Rules of Conduct

“Each agency that maintains a system of records shall --

. . .

(9) establish rules of conduct for persons involved in the design, development, operation, or maintenance of any system of records, or in maintaining any record, and instruct each such person with respect to such rules and the requirements of this section, including any other rules and procedures adopted pursuant to this section and the penalties for noncompliance.”  5 U.S.C. § 552a(e)(9).

Comment:

Courts have given agencies deference on the manner by which they develop, and instruct their employees on, their rules of conduct to satisfy the subsection (e)(9) requirement.

Pursuant to this provision, agencies are required to establish rules of conduct governing the maintenance of systems of records but have broad latitude to determine what those rules of conduct will be so long as the rules are “reasonable.”  “[A]gencies have broad discretion to [choose] among alternative methods of securing their records commensurate with their needs, objectives, procedures, and resources” and “[c]ivil liability is reserved for those lapses that constitute an extraordinary departure from standards of reasonable conduct.”  Convertino v. DOJ, 769 F. Supp. 2d 139, 153 (D.D.C. 2011) (quoting Kostyu v. United States, 742 F. Supp. 413, 417 (E.D. Mich.1990)), rev’d and remanded on other grounds, 684 F.3d 93 (D.C. Cir. 2012) (reversing district court’s summary judgment and ruling that district court committed abuse of discretion in denying appellant’s motion to stay summary judgment to allow for further discovery).

In Convertino, the court concluded that the Privacy Act “only requires that each covered employee understand the proper handling of systems of records over which he or she has responsibility as well as records that he or she is responsible for maintaining” and “[j]ust because certain DOJ employees did not associate their knowledge and training regarding records system management with the words ‘Privacy Act’ does not mean that they were not, in fact, properly instructed in records system management.”  Convertino v. DOJ, 769 F. Supp. 2d at 153-54; see also Doe v. DOJ, 660 F. Supp. 2d 31, 43 (D.D.C. 2009) (“[A]lthough plaintiff suggests that DOJ violated (e)(9) by failing to formally train [an agency employee], the Privacy Act does not specify how the agency must ‘instruct’ its personnel, and plaintiff has provided no support for his suggestion that listing rules and requirements on the Internet is inappropriate.” (citations omitted)); Fleury v. USPS, No. 00-5550, 2001 WL 964147, at *2 (E.D. Pa. Aug. 21, 2001) (finding that plaintiff’s “proof” that confidential information did not reach the intended recipient “would not establish that defendant failed to instruct supervisors and managers regarding Privacy Act requirements in violation of” 552a(e)(9)); but see Ciralsky v. CIA, 689 F. Supp. 2d 141, 159 (D.D.C. 2010) (denying DIA’s motion for summary judgment because if CIA handled plaintiffs records as alleged “it can be plausibly inferred that the CIA did not properly establish rules of conduct for and provide instruction to the responsible Agency employees as required by § 552a(e)(9)”).

For additional discussion of this provision, see OMB 1975 Guidelines, 40 Fed. Reg. at 28,965, https://www.justice.gov/paoverview_omb-75.

 

J. 5 U.S.C. § 552a(e)(10) Establish Safeguards

“Each agency that maintains a system of records shall --

. . .

(10) establish appropriate administrative, technical, and physical safeguards to insure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity which could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained.”  5 U.S.C. § 552a(e)(10).

Comment:

Some, but not all, courts have deferred to agencies on the manner by which they promulgate rules or implement administrative, technical, or physical safeguards to satisfy the subsection (e)(10) requirement.

This provision may come into play when documents are allegedly “leaked” or an agency allegedly fails to adequately safeguard documents.  See, e.g., Pilon v. DOJ, 796 F. Supp. 7, 13 (D.D.C. 1992) (stating that because subsection (e)(10) is more specific than subsection (b), it governs with regard to allegedly inadequate safeguards that resulted in disclosure); Kostyu v. United States, 742 F. Supp. at  414-17 (finding alleged lapses in IRS document-security safeguards were not willful and intentional); cf. Paige v. DEA, 665 F.3d 1355, 1361 (D.C. Cir. 2012) (finding that even though plaintiff did not raise subsection (e)(10) claim at district court and finding no violation of subsection (b), stating “the widespread circulation of the accidental discharge video demonstrates the need for every federal agency to safeguard video records with extreme diligence in this internet age of iPhones and YouTube with their instantaneous and universal reach; DEA’s treatment of the video-recording – particularly the creation of so many different versions and copies – undoubtedly increased the likelihood of disclosure and, although not an abuse of a system of records, is far from a model of agency treatment of private data”).

Although section (e)(10) requires agencies to enact appropriate safeguards, “the Act does not prescribe specific technical standards, leaving the agencies to manage their own information security.”  Atkins v. Mabus, No. 12CV1390, 2014 WL 2705204, at *5,*7 (S.D. Cal. June 13, 2014) (finding plaintiff’s evidentiary showing regarding “appropriateness” of agency’s safeguards sufficient to withstand summary judgment, but ultimately granting summary judgment for agency because plaintiff failed to demonstrate willful or intentional failure to safeguard), rev’d & remanded on other grounds, 654 F. App’x 878 (9th Cir. 2016). 

Similarly, where an agency has made efforts to promulgate rules or enact safeguards, the courts have generally relied on those steps as a sufficient agency defense.  Dick v. Holder, 67 F. Supp. 3d 167, 186 (D.D.C. 2014) (granting motion to dismiss on basis that “DOJ, and by extension the FBI, has ‘promulgated extensive regulations . . . that safeguard its Privacy Act-protected records” and plaintiff “failed to identify any rule or safeguard that was breached or that should have been in place but was not” (quoting Doe v. DOJ, 660 F. Supp. 2d 31, 43 (D.D.C. 2009))); Thompson v. State, 400 F. Supp. 2d 1, 23 (D.D.C. 2005) (concluding that “a reasonable jury could not find that this failure amounted to a reckless disregard of plaintiff’s rights” where agency kept record “in a sealed envelope that was addressed to [plaintiff] and clearly marked ‘To Be Opened Only by Addressee,’” but did not “take the further precaution of keeping confidential information in a locked file cabinet” (internal quotation marks omitted)), aff’d, 210 F. App’x 5 (D.C. Cir. 2006) (unpublished tabled decision); see also Conyers v. VA, No. 16CV00013, 2018 WL 1867106, at *11 (E.D.N.Y. Jan. 29, 2018) (magistrate’s recommendation) (dismissing for failure to state claim because plaintiff “fail[ed] to identify any specific rule or regulation that the [VA] failed to develop or implement”) (citing Doe, 660 F. Supp. 2d at 43), adopted, (E.D.N.Y. Feb. 26, 2018); Delaittre v. Berryhill, No. C15-1905, 2017 WL 6310483, at *3, *5 (W.D. Wash. Dec. 11, 2017) (non-Privacy Act case rejecting plaintiff’s motion to lift confidentiality designations of documents citing agency’s obligations under (e)(10)).  Another district court has held that conclusory allegations predicated on the fact that confidential information was forwarded to an unintended recipient are not sufficient to establish a subsection (e)(10) violation.  See Fleury v. USPS, No. 00-5550, 2001 WL 964147, at *2 (E.D. Pa. Aug. 21, 2001).

Courts have found that repeated warnings of information security risks that go unheeded can be evidence of a willful or intentional failure to safeguard systems of records in accordance with the subsection (e)(10) requirement.

Even so, however, the agency’s authority is not without limits.  For example, repeated warnings of information security risks that go unheeded are evidence of a willful or intentional failure to safeguard.  Compare In re OPM Data Sec. Breach Litig., 928 F.3d 42, 64 (D.C. Cir. 2019) (OPM’s decision “to continue operating in the face of [] repeated and forceful [information security] warnings, without implementing even the basic steps needed to minimize the risk of a significant data breach, is precisely the type of willful failure to establish appropriate safeguards that makes out a claim under the Privacy Act.”) and AFGE v. Hawley, 543 F. Supp. 2d 44, 52 (D.D.C. 2008) (finding that plaintiff’salleged “recurring, systemic, and fundamental deficiencies in [defendant’s] information security,” as demonstrated in an Office of Inspector General report, “if proven, would support a finding that defendants were warned of the deficiencies in their information security but failed to establish proper safeguards”), with Kelley v. FBI, 67 F. Supp. 3d 240, 263-64 (D.D.C. 2014) (finding that “citation of multiple [media] articles does not suffice to create an inference of intentional and willful failure to establish safeguards, especially since the entities involved already had several published safeguards in place.”).  One district court has found that disclosures that are the result of “official decisions” by an agency “cannot be the basis for a claim under subsection (e)(10).”  Chasse v. DOJ, No. 1:98-CV-207, slip op. at 16-17 (D. Vt. Jan. 14, 1999) (magistrate’s recommendation), adopted, (D. Vt. Feb. 9, 1999), aff’d on other grounds sub nom. Devine v. United States, 202 F.3d 547 (2d Cir. 2000). 

Additionally, another district court held that a genuine issue of material fact existed as to whether the VA intentionally or willfully violated subsection (e)(10) by failing to install “patches” on its computer system to allow tracing of a user’s access to the social security numbers of certain employees.  See Schmidt v. VA, 218 F.R.D. 619, 634-35 (E.D. Wis. 2003). 

To establish that an agency violated the subsection (e)(10) requirement, an individual must establish an adverse effect and causation between the agency’s violation and the established adverse effect.

In order to state a claim under the Privacy Act for a violation of this subsection, plaintiffs must allege that an agency’s failure to comply “ha[d] an adverse effect” on him and establish a “causal connection between the agency violation and the adverse effect.”  Lugo v. DOJ, 214 F. Supp. 3d 32, 41 (D.D.C. 2016), citing Doe v. DOJ, 660 F. Supp. 2d 31, 49 (D.D.C. 2009) (quoting Mandel v. OPM, 244 F. Supp. 2d 146, 153 (E.D.N.Y. 2003)), aff’d sub nom. Lugo v. DOJ, No. 16-5297, 2018 WL 1896491 (D.C. Cir. Apr. 3, 2018); accord Albright v. United States, 732 F.2d 181, 186 (D.C. Cir. 1984); see also 5 U.S.C. § 552a(g)(1)(D). 

For a further discussion of this provision, see OMB 1975 Guidelines, 40 Fed. Reg. at 28,966, https://www.justice.gov/paoverview_omb-75, and “Civil Remedies, 5 U.S.C. § 552a(g)(1)(D) - Damages Lawsuits for Failure to Comply with Other Privacy Act Provisions” section, below.

 

K. 5 U.S.C. § 552a(e)(11) Publish New or Intended Use

“Each agency that maintains a system of records shall --

. . .

(11) at least 30 days prior to publication of information under paragraph (4)(D) of this subsection [routine uses], publish in the Federal Register notice of any new use or intended use of the information in the system, and provide an opportunity for interested persons to submit written data, views, or arguments to the agency.”  5 U.S.C. § 552a(e)(11).

Comment:

For a discussion of this provision, see OMB 1975 Guidelines, 40 Fed. Reg. at 28,966, https://www.justice.gov/paoverview_omb-75.

 

Next Section: Agency Rules