Overview of the Privacy Act: 2020 Edition

Ten Exemptions

The Privacy Act explicitly exempts, or allows agencies to exempt, certain categories of records, or information within a record, from certain Privacy Act provisions. One “special” exemption allows agencies to exempt from the Privacy Act’s access and amendment provisions information compiled in anticipation of civil litigation. Two “general” exemptions allow agencies to exempt certain records from all Privacy Act provisions except those specifically articulated as not subject to the general exemptions. Seven “specific” exemptions allow agencies to exempt certain records from Privacy Act provisions specifically articulated as subject to exemption.

A. 5 U.S.C. § 552a(d)(5) – Special Exemption for Information Compiled for Civil Action

“[N]othing in this [Act] shall allow an individual access to any information compiled in reasonable anticipation of a civil action or proceeding.” 5 U.S.C. § 552a(d)(5).

Comment:

Information compiled in anticipation of civil litigation is exempt from the Privacy Act’s access and amendment provisions.

The subsection (d)(5) provision is sometimes overlooked because it is not located with the other exemptions in sections (j) and (k). On its face, it is only an exemption from the access provisions of the Privacy Act, but by implication, it also operates as an exemption from the amendment provisions. See, e.g., Smith v. United States, 142 F. App’x 209, 210 (5th Cir. 2005) (per curiam) (holding that plaintiff had no right to amend record that was “prepared in response to [his] [Federal Tort Claims Act] claim” because it fell within coverage of the exemption to access in subsection (d)(5) and, therefore, was “also exempt from the amendment requirements of the Act” (emphasis added)).

Subsection (d)(5) shields from the Privacy Act’s general access provisions information that is compiled in anticipation of court proceedings or quasi-judicial administrative hearings. See 120 Cong. Rec. at 36,959-60, reprinted in Source Book, at 936-38. Courts have found little difficulty applying the plain language of subsection (d)(5). See e.g., Lewis v. U.S. Dep’t of Labor, 419 F.3d 970, 977 and n. 9 (9th Cir. 2005) (documents prepared in connection with anticipated civil litigation recognized as exempt); Martin v. Office of Special Counsel, MSPB, 819 F.2d 1181, 1188-89 (D.C. Cir. 1987) (finding that proceeding before MSPB is quasi-judicial and documents prepared in anticipation of MSPB hearing were properly withheld); Davidson v. United States, 264 F. Supp. 3d 97, 111 (D.D.C. 2017), aff’d sub nom. Davidson v. Dep’t of State, 728 F. App’x 7 (D.C. Cir. 2018) (exemption “unquestionably” protects from disclosure “documents prepared for actions in the district courts,” “documents prepared for quasi-judicial administrative proceedings,” and “documents prepared in connection with litigation to which the agency is a potential party or a potential material participant”) (internal citations omitted); Menchu v. HHS, No. 3:12-CV-1366, 2014 WL 1217128, at *4-5 (D. Or. Mar. 21, 2014) (finding that purpose and function of hearing before Departmental Appeals Board are same as for civil litigation, and that investigatory notes prepared by Office of Civil Rights were properly withheld); McCready v. Principi, 297 F. Supp. 2d 178, 189-90 (D.D.C. 2003), aff’d in part & rev’d in part on other grounds sub nom. McCready v. Nicholson, 465 F.3d 1 (D.C. Cir. 2006) (affirming decision that reports issued by U.S. Department of Veterans Affairs’ Inspector General critical of plaintiff were properly withheld because they could have led to adverse action against her); Nazimuddin v. IRS, No. 99-2476, 2001 WL 112274, at *3-4 (S.D. Tex. Jan 10, 2001) (finding that information prepared in anticipation of disciplinary action of plaintiff were properly withheld); see also OMB 1975 Guidelines, 40 Fed. Reg. at 28, 949, https://www.justice.gov/paoverview_omb-75 (indicating intent for “civil proceeding” term to cover “quasi-judicial and preliminary judicial steps”).

While the subsection (d)(5) exemption extends to any information prepared in reasonable anticipation of civil liberation, even if prepared by non-attorneys, the exemption is not as broad as FOIA Exemption 5.

Indeed, this Privacy Act provision has been held to be similar to the attorney work-product privilege. See, e.g., Martin v. Office of Special Counsel, 819 F.2d at 1187-89; Hernandez v. Alexander, 671 F.2d 402, 408 (10th Cir. 1982); Mobley v. CIA, 924 F. Supp. 2d 24, 60-62 (D.D.C. 2013). Furthermore, the attorney work-product privilege has been extended to information prepared by non-attorneys. See Varville v. Rubin, No. 3:96CV00629, 1998 U.S. Dist. LEXIS 14006, at *9-12 (D. Conn. Aug. 18, 1998) (citing Martin and Smiertka, infra, for proposition that courts “have interpreted the exemption in accordance with its plain language and have not read the requirements of the attorney work product doctrine into Exemption (d)(5),” and finding “the fact that the documents at issue were not prepared by or at the direction of an attorney is not determinative in deciding whether Exemption (d)(5) exempts the documents from disclosure”); see also Davidson v. State, 206 F. Supp. 3d 178, 194 (D.D.C. 2016) (finding that, in addition to communications with attorney, “exchanges among Department of State employees regarding legal developments in the lawsuit filed by Mr. Davidson” were properly exempted under (d)(5)); Blazy v. Tenet, 979 F. Supp. 10, 24 (D.D.C. 1997) (construing subsection (d)(5) to protect communications between CIA’s Office of General Counsel and members of plaintiff’s Employee Review Panel while panel was deciding whether to recommend retaining plaintiff), summary affirmance granted, No. 97-5330, 1998 WL 315583, at *1 (D.C. Cir. May 12, 1998); Smiertka v. Treasury, 447 F. Supp. 221, 227-28 (D.D.C. 1978) (construing subsection (d)(5) to cover documents prepared by and at direction of lay agency staff persons during period prior to plaintiff’s firing), remanded on other grounds, 604 F.2d 698 (D.C. Cir. 1979); see also Nazimuddin, 2001 WL 112274, at *3-4 (applying subsection (d)(5) to internal memorandum from anonymous informant to plaintiff’s supervisor prepared in anticipation of disciplinary action of plaintiff); Taylor v. Dep’t of Educ., No. 91 N 837, slip op. at 3, 6 (D. Colo. Feb. 25, 1994) (applying subsection (d)(5) to private citizen’s complaint letter maintained by plaintiff’s supervisor in anticipation of plaintiff’s termination); Gov’t Accountability Project v. Office of Special Counsel, No. 87-0235, 1988 WL 21394, at *5 (D.D.C. Feb. 22, 1988) (stating that subsection (d)(5) “extends to any records compiled in anticipation of civil proceedings, whether prepared by attorneys or lay investigators”); Crooker v. Marshals Serv., No. 85-2599, slip op. at 2-3 (D.D.C. Dec. 16, 1985) (stating that subsection (d)(5) protects information “regardless of whether it was prepared by an attorney”); Barrett v. Customs Serv., No. 77-3033, slip op. at 2-3 (E.D. La. Feb. 22, 1979) (applying subsection (d)(5) to “policy recommendations regarding plaintiff[’s] separation from the Customs Service and the possibility of a sex discrimination action”).

While this provision may be applied broadly to “any information” compiled in reasonable anticipation of a civil action or proceeding and is not limited to information prepared only by attorneys, it is not as broad as Exemption 5 of the FOIA, which shields inter- or intra-agency communications that would be privileged in litigation. 5 U.S.C. § 552(b)(5). For example, subsection (d)(5) of the Privacy Act does not incorporate the deliberative process privilege, which may be invoked by agencies to withhold records in response to FOIA requests. See, e.g., Savada v. DOD, 755 F. Supp. 6, 9 (D.D.C. 1991).

Agencies cannot waive their rights to invoke the subsection (d)(5) exemption.

In addition, the D.C. Circuit Court of Appeals has held that an agency cannot waive the applicability of subsection (d)(5). McCready, 297 F. Supp. 2d at 189-90 (concluding that “[s]ubsection (d)(5) states that ‘nothing in this section shall allow’ access to information compiled in anticipation of a civil action” and that “[s]ince ‘shall’ is a mandatory word,” the agency could not waive its right to invoke subsection (d)(5)); see also Louis v. U.S. Dep’t of Labor, 419 F.3d at 979 (finding that an individual has no right to even demand information exempted by subsection (d)(5)).

Agencies do not need to promulgate regulations to exempt information compiled for civil litigation in accordance with subsection (d)(5).

Unlike all of the other Privacy Act exemptions discussed below, subsection (d)(5) is entirely “self-executing,” inasmuch as it does not require an implementing regulation in order to be effective. Louis, 419 F.3d at 479 (“Unlike the section (k) exemptions, which require an agency to exempt a system from access through rulemaking, subsection (d)(5) is a self-executing exception to the general access granted to individuals in subsection (d)(1)”).

B. 5 U.S.C. § 552a(j) - Two General Exemptions for Central Intelligence Agency and Criminal Law Enforcement

“The head of any agency may promulgate rules, in accordance with the requirements (including general notice) of sections 553(b)(1), (2), and (3), (c), and (e) of this title, to exempt any system of records within the agency from any part of this section except subsections (b), (c)(1) and (2), (e)(4)(A) through (F), (e)(6), (7), (9), (10), and (11), and (i) if the system of records is –

(1) maintained by the Central Intelligence Agency; or

(2) maintained by an agency or component thereof which performs as its principal function any activity pertaining to the enforcement of criminal laws, including police efforts to prevent, control, or reduce crime or to apprehend criminals, and the activities of prosecutors, courts, correctional, probation, pardon, or parole authorities, and which consists of

(A) information compiled for the purpose of identifying individual criminal offenders and alleged offenders and consisting only of identifying data and notations of arrests, the nature and disposition of criminal charges, sentencing, confinement, release, and parole and probation status;

(B) information compiled for the purpose of a criminal investigation, including reports of informants and investigators, and associated with an identifiable individual; or

(C) reports identifiable to an individual compiled at any stage of the process of enforcement of the criminal laws from arrest or indictment through release from supervision.

At the time rules are adopted under this subsection, the agency shall include in the statement required under section 553(c) of this title, the reasons why the system of records is to be exempted from a provision of this section.”
5 U.S.C. § 552a(j).

Comment:

The Privacy Act allows agencies to exempt certain records in systems of records maintained by the CIA or criminal law enforcement agencies.

One district court has described subsection (j) as follows: “Put in the simplest terms, what Congress gave Congress can take away, which it did here by conferring on agencies the power to exempt certain records from the Privacy Act.” Williams v. Farrior, 334 F. Supp. 2d 898, 905 (E.D. Va. 2004). The court went on to explain that “Congress, at most, granted” an “inchoate right” to individuals. Id. “[B]y specifically granting agencies . . . the power to exempt certain records from the Privacy Act,” “Congress conditioned any right [an individual] might have to assert a Privacy Act claim on whether [a particular agency] exercises this power.” Id. Thus, “[w]hen [an agency] exercise[s] this exemption power, any inchoate claim [an individual] may once have had [is] extinguished.” Id.

For cases involving subsection (j)(1), which applies only to records maintained by the CIA, see Alford v. CIA, 610 F.2d 348, 348-49 (5th Cir. 1980); Mobley v. CIA, 924 F. Supp. 2d 24, 55-56 (D.D.C. 2013); Braun v. FBI, No. 18-cv-2145, 2019 WL 3343948, at *6 (D.D.C. July 25, 2019); Bassiouni v. CIA, No. 02-4049, 2004 U.S. Dist. LEXIS 5290, at *13-24 (N.D. Ill. Mar. 30, 2004), aff’d, 392 F.3d 244 (7th Cir. 2005); Pipko v. CIA, 312 F. Supp. 2d 669, 678-79 (D.N.J. 2004); Blazy v. Tenet, 979 F. Supp. 10, 23-25 (D.D.C. 1997), summary affirmance granted, No. 97-5330, 1998 WL 315583 (D.C. Cir. May 12, 1998).

1. Law Enforcement Components

Subsection (j)(2) applies to systems of records maintained by “an agency or component thereof which performs as its principal function any activity pertaining to the enforcement of criminal laws.” This threshold requirement is usually met by obvious law enforcement components such as the FBI, DEA, and ATF. In addition, several other Department of Justice components qualify to use the (j)(2) exemption, including:

the Federal Bureau of Prisons, see, e.g., Skinner v. BOP, 584 F.3d 1093, 1096 (D.C. Cir. 2009); White v. Prob. Office, 148 F.3d 1124, 1125 (D.C. Cir. 1998); Kellett v. BOP, No. 94-1898, 1995 WL 554647, at *3 (1st Cir. Sept. 18, 1995) (per curiam); Duffin v. Carlson, 636 F.2d 709, 711 (D.C. Cir. 1980);
the U.S. Attorney’s Office, see, e.g., Boyd v. EOUSA, 87 F. Supp. 3d 58, 87 (D.D.C. 2015); Watson v. DOJ, No. 12-2129, 2013 WL 4749916, at *3 (W.D. La. Sept. 3, 2013); Plunkett v. DOJ, 924 F. Supp. 2d 289, 306-07 (D.D.C. 2013);
the Office of the Pardon Attorney, see, e.g., Binion v. DOJ, 695 F.2d 1189, 1191 (9th Cir. 1983);
the Marshals Service, see, e.g., Barouch v. DOJ, 962 F. Supp. 2d 30, 68 n.21 (D.D.C. 2013); Boyer v. Marshals Serv., No. 04-1472, 2005 WL 599971, at *2-3 (D.D.C. Mar. 14, 2005); and
the U.S. Parole Commission, see, e.g., Fendler v. Parole Comm’n, 774 F.2d 975, 979 (9th Cir. 1985).

Outside of the Department of Justice, other entities that courts have found meet the threshold requirement include:

the Naval Criminal Investigative Service, “the criminal law enforcement investigative branch of the United States Navy,” see Palmieri v. U.S., 194 F. Supp. 3d 12, 22 (D.D.C. 2016);
the Criminal Investigation Division of the Internal Revenue Service, see Carp v. IRS, No. 00-5992, 2002 WL 443478 , at *6 (D.N.J. Jan. 28, 2002);
the U.S. Secret Service, a component of the Department of Homeland Security, see Arnold v. U.S. Secret Serv., 524 F. Supp. 2d 65, 66 (D.D.C. 2007);
the Postal Inspection Service, a U.S. Postal Service component, see Anderson v. USPS, 7 F. Supp. 2d 583, 586 n.3 (E.D. Pa. 1998), aff’d, 187 F.3d 625 (3d Cir. 1999) (unpublished table decision);
the Air Force Office of Special Investigations, see, e.g., Gowan v. Air Force, 148 F.3d 1182, 1189-90 (10th Cir. 1998); Butler v. Air Force, 888 F. Supp. 174, 179 (D.D.C. 1995), aff’d per curiam, No. 96-5111 (D.C. Cir. May 6, 1997); and
Inspector General’s Offices, see Seldowitz v. OIG, No. 00-1142, 2000 WL 1742098, at *4 (4th Cir. Nov. 13, 2000) (per curiam); Mumme v. Labor, 150 F. Supp. 2d 162, 172 (D. Me. 2001), aff’d, No. 01-2256 (1st Cir. June 12, 2002); Smith v. Treasury Inspector Gen. for Tax Admin., No. 11-2033, 2011 WL 6026040, at *2 (D. Md. Dec. 1, 2011), aff’d per curiam, 474 F. App’x 929 (4th Cir. 2012).

However, it has been held that the “principal” law enforcement function threshold requirement is not met where only one of the principal functions of the component maintaining the system is criminal law enforcement. See Alexander v. IRS, No. 86-0414, 1987 WL 13958, at *4 (D.D.C. June 30, 1987) (discussing IRS’s Internal Security Division’s “conduct investigation” system).

2. Compiled for Certain Law Enforcement Purposes

In order to exempt certain records under the subsection (j)(2) exemption, agencies must establish that the information is being compiled for one of the specifically enumerated criminal law enforcement purposes.

Once an agency has satisfied the threshold requirement of establishing that it is a law enforcement component, it must establish that the system of records at issue consists of information compiled for one of the criminal law enforcement purposes listed in subsection (j)(2)(A)-(C), e.g., to identify criminal offenders, for a criminal investigation, or compiled at any stage of the enforcement of the criminal laws. See, e.g., Mobley v. CIA, 806 F.3d 568, 586 (D.C. Cir. 2016) (finding that FBI’s records compiled for purpose of ascertaining facts and circumstances of U.S. citizen’s detention abroad satisfied legitimate law enforcement purpose); Jordan v. DOJ, 668 F. 3d 1188, 1201-02 (10th Cir. 2011) (affirming decision that prisoner’s request for psychological records and copied mail compiled during his incarceration were exempt under (j)(2)(C), which permits agencies to exempt reports identifiable to individual that have been compiled at any stage of enforcement, from arrest through release); Boyd, 87 F. Supp. 3d at 87 (finding that EOUSA properly applied exemption under (j)(2)(B) to withhold plaintiff’s criminal case files); Barouch v. DOJ, 87 F. Supp. 3d 10, 32 (D.D.C. 2015) (finding that ATF failed to establish record located in agent’s personal file qualified for (j)(2) exemption and remanding for further processing and clarification); Boehm v. FBI, 948 F. Supp. 2d 9, 18 n.2 (D.D.C. 2013) (finding defendants met their burden to show that Exemption (j)(2) applies to records compiled for “investiga[ting] child sex trafficking and drug violations”); Taccetta v. FBI, No. 10-6194, 2012 WL 2523075, at *5 (D.N.J. June 29, 2012) ( holding that “[a]ll records created by the FBI in its investigation of violations of criminal law are exempt from disclosure under the Privacy Act”); Smith v. Treasury Inspector Gen. for Tax Admin., 2011 WL 6026040, at *3 (rejecting argument that report of investigation “cannot be properly exempted because any claim that [plaintiff] violated a criminal law ceased to be ‘colorable’ once the AUSA declined to prosecute him” on ground that “whether or not an investigation is ‘criminal’ depends on what is being investigated and not the ultimate conclusion of the investigators or the decision of a prosecutor”), aff’d per curiam, 474 F. App’x 929 (4th Cir. 2012); Shearson v. DHS, No. 1:06 CV 1478, 2007 WL 764026, at *11 (N.D. Ohio Mar. 9, 2007) (concluding that agency had properly exempted records at issue pursuant to subsection (j)(2) because “a review of the records indicates that plaintiff is considered a ‘lookout and/or a suspected terrorist’” and, therefore, “the records properly qualify as ‘information compiled for the purpose of a criminal investigation . . . and associated with an identifiable individual’”), aff’d in pertinent part, rev’d in part, & remanded, on other grounds, 638 F. 3d 498 (6th Cir. 2011); Holz v. Westphal, 217 F. Supp. 2d 50, 54-56 (D.D.C. 2002) (finding subsection (j)(2) inapplicable to report of investigation even though report was maintained in exempt system of records, because agency’s operating regulations provided that underlying report was never within agency’s purview and therefore was not compiled for criminal law enforcement purpose); cf. Kates v. King, 487 F. App’x 704, 706 (3d Cir. 2012) (per curiam) (“Indeed, the BOP has exempted its central record system, where an inmate’s PSI is located,” which was used in plaintiff’s sentencing).

Agencies must publish the reasons for exempting each system of records under subsection (j); it is not clear whether the stated reason limits the scope of the subsection (j) exemption.

An important requirement of subsection (j) is that an agency must state in the Federal Register “the reasons why the system of records is to be exempted” from a particular subsection of the Act. 5 U.S.C. § 552a(j) (final sentence); see also 5 U.S.C. § 552a(k) (same). It is unclear whether an agency’s stated reasons for exemption – typically, a list of the adverse effects that would occur if the exemption were not available – limit the scope of the exemption when it is applied to specific records in the exempt system in particular cases. See Exner, 612 F.2d at 1206 (framing issue but declining to decide it). As discussed below, a confusing mass of case law in this area illustrates the struggle to give legal effect to this requirement.

Because of the broad scope of the subsection (j)(2) exemption, courts are deferential to agencies in access suits under this provision and are not authorized to review disputed information in camera.

Given the breadth of this law enforcement exemption, an agency’s burden of proof is generally less stringent than under the FOIA, at least in the access context. See Binion, 695 F.2d at 1192-93 (9th Cir. 1983) (referencing legislative history in support of “a broad exemption” because these records “contain particularly sensitive information” (quoting H.R. Rep. No. 1416, 93d Cong., 2d Sess. 18 (1974))). Indeed, several courts have observed that the Vaughn rationale requiring itemized indices of withheld records is inapplicable to Privacy Act cases where a general exemption has been established. Shapiro v. DEA, 721 F.2d 215, 218 (7th Cir. 1983), vacated as moot sub nom. DOJ v. Provenzano, 469 U.S. 14 (1984) (finding moot because Central Intelligence Information Act amended Privacy Act by providing that agency cannot rely on exemption in Privacy Act to withhold records accessible under FOIA); see also Campbell v. DOJ, 133 F. Supp. 3d 58, 69 (D.D.C. 2015) (concluding that DOJ Criminal Division system of records was exempted from access provisions of Privacy Act under (j)(2) law enforcement exemption but analyzing FOIA under provisions other than section 7 law enforcement exemptions); Schulze v. FBI, No. 1:05-CV-0180, 2010 WL 2902518, at *15 (E.D. Cal. July 22, 2010) (concluding that the (j)(2) “exemption is both categorical and enduring.”); Miller v. FBI, No. 77-C-3331, 1987 WL 18331, at *2 (N.D. Ill. Oct. 7, 1987).

Moreover, in access cases the Act does not grant courts the authority to review the information at issue in camera to determine whether subsection (j)(2)(A)-(C) is applicable. See 5 U.S.C. § 552a(g)(3)(A) (in camera review only where subsection (k) exemptions are invoked); see also Reyes v. DEA, 647 F. Supp. 1509, 1512 (D.P.R. 1986), vacated & remanded on other grounds, 834 F.2d 1093 (1st Cir. 1987). But see Exner v. FBI, 612 F.2d 1202, 1206-07 (9th Cir. 1980) (concluding that whether or not “district court had statutory authority to review any of [the] records with respect to which the government was claiming the (j)(2)(B) exemption . . . ” district court “did examine the documents and concluded that they were exempt”); Bailey v. BOP, 133 F. Supp. 3d 50, 57-58 (D.D.C. 2015) (declining to rule on BOP’s asserted (j)(2) exemption until it had a chance to review documents in camera). However, the lack of authority to review documents in camera under this provision may be an academic point in light of the FOIA’s grant of in camera review authority under 5 U.S.C. § 552(a)(4)(B).

Courts are divided as to whether published reasons for the exemption limit the scope of the exemption in access and amendment cases.

Most courts have permitted agencies to claim the subsection (j)(2) law enforcement exemption as a defense in access and/or amendment cases – some without regard to the specific records at issue or the regulation’s stated reasons for the exemption. For cases regarding access, see, e.g., Binion, 695 F.2d at 1192-93; Duffin, 636 F.2d at 711; Exner, 612 F.2d at 1204-07; Ryan v. DOJ, 595 F.2d 954, 956-57 (4th Cir. 1979); Bernegger v. EOUSA, 334 F. Supp. 3d 74, 94 (D.D.C. 2018); House v. DOJ, 147 F. Supp. 3d 197, 209 (D.D.C. 2016); Barouch, 962 F. Supp. 2d at 68 n. 21; Mobley v. CIA, 924 F. Supp. 2d at 66-67; Adionser v. DOJ, 811 F. Supp. 2d 284, 301 (D.D.C. 2011), aff’d per curiam, No. 11-5093, 2012 WL 5897172, at *1 (D.C. Cir. Nov. 5, 2012); Marshall v. FBI, 802 F. Supp. 2d 125, 133-34 (D.D.C. 2011); Vazquez v. DOJ, 764 F. Supp. 2d 117, 120 (D.D.C. 2011) (regarding access to accounting of disclosures); Murray v. BOP, 741 F. Supp. 2d 156, 162 (D.D.C. 2010); Blackwell v. FBI, 680 F. Supp. 2d 79, 91 (D.D.C. 2010); Holt v. DOJ, 734 F. Supp. 2d 28, 39 (D.D.C. 2010); Jordan v. DOJ, No. 07-cv-02303, 2009 WL 2913223, at *26-27 (D. Colo. Sept. 8, 2009); Maydak v. DOJ, 254 F. Supp. 2d 23, 34-35 (D.D.C. 2003) (regarding access to accounting of disclosures); Anderson v. Marshals Serv., 943 F. Supp. 37, 39-40 (D.D.C. 1996); Hatcher, 910 F. Supp. at 2-3; Whittle v. Moschella, 756 F. Supp. 589, 595-96 (D.D.C. 1991); Simon v. DOJ, 752 F. Supp. 14, 23 (D.D.C. 1990), aff’d, 980 F.2d 782 (D.C. Cir. 1992); Yon v. IRS, 671 F. Supp. 1344, 1347 (S.D. Fla. 1987); Stimac v. Treasury, 586 F. Supp. 34, 35-37 (N.D. Ill. 1984); Cooper v. DOJ, 578 F. Supp. 546, 547 (D.D.C. 1983); Stimac v. FBI, 577 F. Supp. 923, 924-25 (N.D. Ill. 1984); Turner v. Ralston, 567 F. Supp. 606, 607-08 (W.D. Mo. 1983), superseded by statute on other grounds, Central Intelligence Agency Information Act, Pub. L. No. 98-477, codified at 5 U.S.C. § 552a(t); Nunez v. DEA, 497 F. Supp. 209, 211 (S.D.N.Y. 1980); but see Campbell, 133 F. Supp. 3d at 69 (concluding that (j)(2) exemption applied only to system of records expressly exempted from access provisions by regulation).

For cases regarding amendment, see, e.g., Castaneda v. Henman, 914 F.2d 981, 986 (7th Cir. 1990); Wentz v. DOJ, 772 F.2d 335, 337-39 (7th Cir. 1985); Fendler, 774 F.2d at 979; Majid v. FBI, 245 F. Supp. 3d 63, 69-71 (D.D.C. 2017); Ford v. DOJ, 208 F. Supp. 3d 237, 246 (D.D.C. 2016); Abdelfattah v. DHS, 893 F. Supp. 2d 75, 81 (D.D.C. 2012); Bhatia v. Office of the U.S. Attorney, N. Dist. of Cal., No. C 09-5581, 2011 WL 1298763, at *6 (N.D. Cal. Mar. 29, 2011), aff’d, 507 F. App’x 649 (9th Cir. 2013); Study v. United States, No. 3:08cv493, 2010 WL 1257655, at *4 (N.D. Fla. Mar. 4, 2010); Davis v. BOP, No. 06-1698, 2007 WL 1830863, at *2 (D.D.C. June 26, 2007); Enigwe v. BOP, No. 06-457, 2006 WL 3791379, at *3 n.2 (D.D.C. Dec. 22, 2006); Cooper v. BOP, No. 02-1844, 2006 WL 751341, at *3 (D.D.C. Mar. 23, 2006); Fisher v. BOP, No. 05-0851, 2006 WL 401819, at *1 (D.D.C. Feb. 21, 2006); Aquino v. Stone, 768 F. Supp. 529, 530-31 (E.D. Va. 1991), aff’d, 957 F.2d 139 (4th Cir. 1992); Anderson v. DOJ, No. 87-5959, 1988 WL 50372, at *1 (E.D. Pa. May 16, 1988); Smith v. DOJ, No. 81-CV-813, 1983 U.S. Dist. LEXIS 10878, at *15-20 (N.D.N.Y. Dec. 13, 1983); and Varona Pacheco v. FBI, 456 F. Supp. 1024, 1034-35 (D.P.R. 1978).

For cases that discuss both access and amendment, see Donelson v. BOP, 82 F. Supp. 3d. 367, 372 (D.D.C. 2015); Shapiro, 721 F.2d at 217-18.

The Court of Appeals for the Seventh Circuit has gone so far as to hold that subsection (j)(2) “‘does not require that a regulation’s rationale for exempting a record from [access] apply in each particular case.’” Wentz, 772 F.2d at 337-38 (quoting Shapiro, 721 F.2d at 218). This appears also to be the view of the Court of Appeals for the First Circuit. See Irons v. Bell, 596 F.2d 468, 471 (1st Cir. 1979) (“None of the additional conditions found in Exemption 7 of the FOIA, such as disclosure of a confidential source, need be met before the Privacy Act exemption applies.”); see also Reyes, 647 F. Supp. at 1512 (noting that “justification need not apply to every record and every piece of a record as long as the system is properly exempted” and that “[t]he general exemption applies to the whole system regardless of the content of individual records within it”).

The Ninth and Seventh Circuits have construed subsection (j)(2) law enforcement exemption regulations to permit exemption of systems of records from provisions of the Act even where the stated reasons do not appear to be applicable in the particular case. See, e.g., Alexander v. United States, 787 F.2d 1349, 1351-52 & n.2 (9th Cir. 1986) (dismissing subsection (g)(1)(C) damages action – alleging violation of subsection (e)(5) – on ground that system of records was exempt from subsection (g) even though implementing regulation mentioned only “access” as rationale for exemption); Wentz, 772 F.2d at 336-39 (dismissing amendment action on ground that system of records was exempt from subsection (d) even though implementing regulation mentioned only “access” as rationale for exemption and record at issue had been disclosed to plaintiff). Note, however, that the Ninth Circuit significantly narrowed the breadth of its holding in Alexander. Fendler v. BOP, 846 F.2d at 550, 554 n.3 (9th Cir. 1988) (observing that agency in Alexander “had clearly and expressly exempted its system of records from both subsection (e)(5) and subsection (g) . . . [but that for] some unexplained reason, the Bureau of Prisons, unlike the agency involved in Alexander, did not exempt itself from [subsection] (e)(5)”).

Further, in Fendler, the court appears to have moved toward an earlier, narrow view stated in a concurring opinion in Exner, 612 F.2d at 1207-08 (construing subsection (j)(2)(B) as “coextensive” with FOIA Exemption 7 and noting that “reason for withholding the document was consistent with at least one of the adverse effects listed in the [regulation]”). Other courts support this narrow construction. See, e.g., Powell v. DOJ, 851 F.2d 394, 395 (D.C. Cir. 1988) (per curiam) (finding that agency’s regulation failed to specifically state any reason for exempting its system from amendment and that reasons stated for exempting it from access were limited, and thus (j)(2) does not permit an agency to refuse “disclosure or amendment of objective, noncontroversial information” such as race, sex, and correct addresses); Rosenberg v. Meese, 622 F. Supp. 1451, 1460 (S.D.N.Y. 1985) (ordering access to sentencing transcript contained in same exempt system of records on ground that proffered “reasons are simply inapplicable when the particular document requested is a matter of public record.”). Apparently, because the contents of the particular records at issue were viewed as innocuous – i.e., they had previously been made public – each court found that the agency had lost its exemption (j)(2) claim. Powell, 851 F.2d at 395; Rosenberg, 622 F. Supp. at 1460.

3. Additional Issues Relating to the Criminal Law Enforcement Exemption

Some courts have upheld agency regulations, consistent with the text of the subsection (j) exemption, to exempt their systems of records from the Privacy Act’s civil remedies provision.

The issue discussed above also has arisen when an agency’s regulation exempts its system of records from subsection (g) – the Privacy Act’s civil remedies provision. Oddly, the language of subsection (j) appears to permit this. See OMB 1975 Guidelines, 40 Fed. Reg. at 28,971, https://www.justice.gov/paoverview_omb-75.

However, in Tijerina v. Walters, 821 F.2d 789, 795-97 (D.C. Cir. 1987), the D.C. Circuit held that an agency cannot insulate itself from a wrongful disclosure damages action (see 5 U.S.C. § 552a(b), (g)(1)(D)) in such a manner. It construed the subsection (j) law enforcement exemption to permit an agency to exempt only a system of records – and not the agency itself – from other provisions of the Act. See 821 F.2d at 796-97. The result in Tijerina was influenced by the fact that subsection (j) by its terms does not permit exemption from the subsection (b) restriction-on-disclosure provision. Id. In Tijerina, the government argued that “subsection (g) is ‘conspicuously absent’ from the list” of specific provisions that are not eligible for exemption under (j)(2), and that that “omission demonstrates that Congress intended agencies to be able to elude civil liability for any violation of the Act,” including subsection (b)’s disclosure prohibition. Id. at 795. While the D.C. Circuit noted that “some other courts ha[d] indicated in dicta” to the contrary, “[h]aving considered the issue at length [in Tijerina], in which it [wa]s squarely presented, [the Court] declined to follow that view.” Id. (citing Kimberlin v. DOJ, 788 F.2d 434, 436 n.2 (7th Cir. 1986), and Ryan v. DOJ, 595 F.2d 954, 958 (5th Cir. 1979)). In ruling that the exemption does not operate in this manner the Court stated:

The Act’s statutory language, framework, and legislative history persuade us that the government is urging a completely anomalous use of the exemption provision that makes the Act a foolishness. The interpretation offered by the government would give agencies license to defang completely the strict limitations on disclosure that Congress intended to impose.

Tijerina, 821 F.2d at 797. See also Doe v. FBI, 936 F.2d 1346, 1351-52 (D.C. Cir. 1991) (explaining that “the touchstone for an agency’s liability to suit under the Act is the substantive obligation underlying the plaintiff’s claim” and holding that a cause of action under (g)(1)(A) could “not lie with regard to records that the agency has properly exempted from the Act’s amendment requirements,” because “Tijerina merely held that an agency cannot escape liability for violating non-exemptible Privacy Act obligations simply by exempting itself from the Act’s remedial provisions”).

The Court of Appeals for the Sixth Circuit has considered this issue as well and followed the approach taken by the D.C. Circuit’s Court of Appeals. See Shearson v. DHS, 638 F.3d 498 (6th Cir. 2011). Although the D.C. Circuit in Tijerina had characterized cases as dicta, the Sixth Circuit viewed those same cases as “implicat[ing] a Circuit split in authority,” and determined that the D.C. Circuit “expresses the better view . . . [that] an agency is permitted to exempt a system of records from the civil remedies provision if the underlying substantive duty is exemptible.” Id. at 503-04 (remanding claims brought under (b) and (e)(7)); Nakash v. DOJ, 708 F. Supp. 1354, 1358-65 (S.D.N.Y. 1988) (agreeing with Tijerina after extensive discussion of case law and legislative history). But see Saleh v. United States, No. 09-cv-02563, 2011 WL 2682803, at *6 (D. Colo. Mar. 8, 2011) (magistrate’s recommendation) (concluding that “Plaintiff has no private right of action pursuant to the Privacy Act with respect to the alleged dissemination of one of his grievances” because agency had exempted system of records from subsection (g) civil remedies), adopted in pertinent part, 2011 WL 2682728, at *1 (D. Colo. July 8, 2011).

While other courts have indicated that agencies may employ subsection (j)(2) to exempt their systems of records from the subsection (g) civil remedies provision, generally, these cases suggest that the regulation’s statement of reasons for exempting a system of records from the subsection (g) civil remedies provision itself constitutes a limitation on the scope of the exemption. See Fendler, 846 F.2d at 553-54 & n.3 (declining to dismiss subsection (g)(1)(C) damages action – alleging violation of subsection (e)(5) – on ground that agency’s “stated justification for exemption from subsection (g) bears no relation to subsection (e)(5)”); Alford v. CIA, 610 F.2d 348, 349 (5th Cir. 1980) (declining to decide whether agency may, by regulation, deprive district courts of jurisdiction to review decisions to deny access); Ryan v. DOJ, 595 F.2d 954, 957-58 (4th Cir. 1979) (dismissing access claim, but not wrongful disclosure claim, on ground that record system was exempt from subsection (g) because regulation mentioned only “access” as reason for exemption); Nakash, 708 F. Supp. at 1365 (alternative holding) (declining to dismiss wrongful disclosure action for same reason); Kimberlin v. DOJ, 605 F. Supp. 79, 82 (N.D. Ill. 1985), aff’d, 788 F.2d 434 (7th Cir. 1986); cf. Shearson v. DHS, 638 F.3d at 503 (holding that agency may not claim exemption from (g) civil remedies unless “the underlying substantive duty is exemptible,” and questioning “whether [the agency’s] efforts to exempt the system of records from § 552a(g) were procedurally adequate” because “[t]he agency’s stated justification for exempting the [system of records] from § 552a(g) is ambiguous regarding the extent to which the rule exempts the [system of records] from the civil-remedies provision”).

The Federal Bureau of Prisons has claimed the subsection (j)(2) exemption, among others, for many of its systems of records.

The Federal Bureau of Prisons has promulgated rules exempting a number of its systems of records – among them, notably, the Inmate Central Records System – from various subsections of the Act, including (d), (e)(5), and (g). See 28 C.F.R. § 16.97 (2012). Among the most frequently litigated Privacy Act claims are those brought by federal inmates against BOP based on one or more allegedly inaccurate records. In a typical case, an inmate sues BOP seeking amendment of or damages arising out of an allegedly inaccurate record contained in a BOP system of records – usually the Inmate Central Records System. Courts have consistently dismissed these claims on the ground that BOP has exempted the system of records containing the allegedly inaccurate record from the pertinent subsection of the Act. See, e.g., Kates v. King, 487 F. App’x 704, 706 (3d Cir. 2012) (per curiam); Blackshear v. Lockett, 411 F. App’x 906, 907-08 (7th Cir. 2011); Flores v. Fox, 394 F. App’x 170, 172 (5th Cir. 2010); Davis v. United States, 353 F. App’x 864, 864 (4th Cir. 2009) (per curiam); Skinner, 584 F.3d at 1096; Martinez v. BOP, 444 F.3d 620, 624 (D.C. Cir. 2006); Scaff-Martinez v. BOP, 160 F. App’x 955, 956 (11th Cir. 2005); Barbour v. Parole Comm’n, No. 04-5114, 2005 WL 79041, at *1 (D.C. Cir. Jan. 13, 2005); Williams v. BOP, 85 F. App’x 299, 306 n.14 (3d Cir. 2004); Locklear v. Holland, 194 F.3d 1313, 1313 (6th Cir. 1999); Duffin, 636 F.2d at 711; Lee v. English, No. 19-3029, 2019 WL 3891147, at *8 (D. Kan. Aug. 19, 2019); Hall v BOP, 132 F. Supp. 3d 60, 69 (D.D.C. 2015), aff'd, No. 15-5303, 2016 WL 6237817 (D.C. Cir. Sept. 1, 2016); Wingo v. Farley, No. 4:12-CV-2072, 2013 WL 2151638, at *3 (N.D. Ohio May 16, 2013); Andrews v. Castro, No. 3:CV-12-1518, 2012 U.S. Dist. LEXIS 178909, at *1-2 (M.D. Pa. Dec. 18, 2012), aff’d, 2013 WL 6579347, at *1 (M.D. Pa. Dec. 13, 2013); Anderson v. BOP, No. 12-1478, 2012 U.S. Dist. LEXIS 132716, at *1-2 (D.D.C. Sept. 7, 2012); Lange v. Taylor, 5:10-CT-3097, 2012 WL 255333, at *3 (E.D.N.C. Jan. 27, 2012); Earle v. Holder, 815 F. Supp. 2d 176, 181-83 (D.D.C. 2011), aff’d per curiam, No. 11-5280, 2012 WL 1450574, at *1 (D.C. Cir. Apr. 20, 2012); Thomas v. Caraway, No. 10-2031, 2011 WL 2416643, at *3 (D. Md. June 10, 2011); Blanton v. Warden, No. 7:10-cv-552, 2011 WL 1226010, at *3 (W.D. Va. Mar. 30, 2011); Keyes v. Krick, No. 09-cv-02380, 2011 WL 1100128, at *7 (D. Colo. Mar. 23, 2011); Davis v. United States, No. CIV-10-1136, 2011 WL 704894, at *5 (W.D. Okla. Jan. 4, 2011) (magistrate’s recommendation), adopted, 2011 WL 693639, at *1 (W.D. Okla. Feb. 18, 2011), aff’d, 426 F. App’x 648 (10th Cir. 2011); Cruel v. BOP, No. 2:09CV00189, 2010 WL 3655644, at*3 (E.D. Ark. Sept. 9, 2010); Banks v. BOP, No. 5:09cv147, 2010 WL 3737923, at *6 (S.D. Miss. Aug. 19, 2010) (magistrate’s recommendation), adopted, 2010 WL 3767112, at *1 (S.D. Miss. Sept. 17, 2010); Bowles v. BOP, No. 08 CV 9591, 2010 WL 23326, at *4-5 (S.D.N.Y. Jan. 5, 2010); Jackson v. DOJ, No. 09-0846, 2009 WL 5205421, at *4 (D. Minn. Dec. 23, 2009); but cf. Christoferson v. Thomas, 548 F. App’x 487, 488 (9th Cir. 2013) (noting that “inmates may sue under the federal Privacy Act in spite of the regulations that purport to block their claims”).

As discussed in detail above under subsection “5 U.S.C. § 552a(e)(5) - Maintain Accurate, Relevant, Timely, and Complete Records” of this Overview, it was not until 2002 that the BOP exempted many of its systems of records, including the Inmate Central Records System, from subsection (e)(5) pursuant to subsection (j)(2). See 28 C.F.R. § 16.97(j) (codifying 67 Fed. Reg. 51,754 (Aug. 9, 2002)). Thus, inmates’ subsection (e)(5)/(g)(1)(C) claims arising subsequent to August 9, 2002, should not succeed. See, e.g., Fisher v. BOP, No. 06-5088, 2007 U.S. App. LEXIS 5140, at *1 (D.C. Cir. Mar. 1, 2007) (per curiam).

Information that is exempt under subsection (j)(2) remains exempt, even if it is recompiled into a non-law enforcement record, so long as the purpose for which the agency claimed the subsection (j)(2) exemption remains.

Another important issue arises when information originally compiled for law enforcement purposes is recompiled into a non-law enforcement record. The D.C. Circuit confronted this issue in Doe v. FBI, 936 F.2d 1346 (D.C. Cir. 1991), and applied the principles of a Supreme Court FOIA decision concerning recompilation, FBI v. Abramson, 456 U.S. 615 (1982), to Privacy Act-protected records. It held that “information contained in a document qualifying for subsection (j) or (k) exemption as a law enforcement record does not lose its exempt status when recompiled in a non-law enforcement record if the purposes underlying the exemption of the original document pertain to the recompilation as well.” Doe v. FBI, 936 F.2d at 1356. Consistent with the U.S. Supreme Court’s decision in Abramson, the D.C. Circuit determined that recompilation does not change the basic “nature” of the information. Id.; accord OMB 1975 Guidelines, 40 Fed. Reg. at 28,971, https://www.justice.gov/paoverview_omb-75 (“The public policy which dictates the need for exempting records . . . is based on the need to protect the contents of the records in the system – not the location of the records. Consequently, in responding to a request for access where documents of another agency are involved, the agency receiving the request should consult the originating agency to determine if the records in question have been exempted.”). By the same token, law enforcement files recompiled into another agency’s law enforcement files may retain the exemption of the prior agency’s system of records. See Dupre v. FBI, No. 01-2431, 2002 WL 1042073, at *2 n.2 (E.D. La. May 22, 2002) (finding that Suspicious Activity Report maintained in exempt Department of the Treasury system of records remained exempt under that system of records when transferred to FBI for law enforcement purposes).

For subsection (g)(1)(B) access claims, courts have held that an agency can promulgate an exemption even after the date an individual makes a Privacy Act request; agencies need not raise the exemption in administrative proceedings before raising it in court.

In the context of a subsection (g)(1)(B) access claim, the District Court for the Northern District of California has ruled that an agency “is entitled to rely on exemptions promulgated after the dates on which [the plaintiff] made his Privacy Act requests.” Hasbrouck v. Customs & Border Prot., No. C 10-3793, 2012 WL 177563, at *3 (N.D. Cal. Jan. 23, 2012) (“‘[R]etroactivity’ simply is not implicated, because plaintiff’s claim in essence seeks prospective injunctive relief – an order requiring CBP to turn over information now. As such, this is one of the many circumstances in which ‘a court should apply the law in effect at the time it renders its decision,’ notwithstanding the happenstance that [plaintiff] made his Privacy Act requests before the current exemptions were promulgated.”).

Finally, note that in the context of a subsection (g)(1)(B) claim for access to records, some courts have recognized that “there is no requirement that an agency administratively invoke an exemption in order to later rely on it in federal court.” Barnard v. DHS, 598 F. Supp. 2d 1, 24 (D.D.C. 2009); see also, e.g., Cuban v. SEC, 744 F. Supp. 2d 60, 89-90 (D.D.C. 2010).

C. 5 U.S. § 552a(k) - Seven Specific Exemption Rules Agencies May Promulgate

“The head of any agency may promulgate rules, in accordance with the requirements (including general notice) of sections 553(b)(1), (2), and (3), (c), and (e) of this title, to exempt any system of records within the agency from subsections (c)(3), (d), (e)(1), (e)(4)(G), (H), and (I) and (f) of this section if the system of records is –

[The seven specific exemptions are discussed in order below.]

Comment:

Subsection (k) permits agencies to publish rules exempting certain systems of records from specific Privacy Act provisions.

As noted above, subsection (g)(3)(A) grants courts considering access claims the authority to “examine the contents of any agency records in camera to determine whether the records or any portion thereof may be withheld under any of the exemptions set forth in subsection (k) of this section.” 5 U.S.C. § 552a(g)(3)(A). Further, some courts have held that reasonable segregation of protected and unprotected information is required under the Act whenever a subsection (k) exemption is invoked so that the requested information can be disclosed without disclosing information that must be withheld. See, e.g., May v. Air Force, 777 F.2d 1012, 1015-17 (5th Cir. 1985) (concluding that concerns about releasing information about identity of source could “could be easily remedied” by typing document, putting it in third-party’s handwriting, or amalgamating information into one report); Nemetz v. Treasury, 446 F. Supp. 102, 105 (N.D. Ill. 1978).

The District Court for the District of Columbia has rejected the argument that an agency failed to comply with subsection (k) because the agency’s statement of reasons for exempting the system of records “appears only in the Federal Register, and not in the Code of Federal Regulations where the rule was eventually codified.” Nat’l Whistleblower Ctr. v. HHS, 849 F. Supp. 2d 13, 23 (D.D.C. 2012). The court first pointed out that “[s]ubsection (k)(2) requires only that an agency’s rule exempting investigative material comply with the Administrative Procedure Act’s requirement that ‘the agency shall incorporate in the rules adopted a concise general statement of their basis and purpose.’” Id. (quoting 5 U.S.C. § 553(c)). The court concluded that “§ 553(c) is satisfied when a statement of the rule’s basis and purpose is included in the preamble to the Final Rule appearing in the Federal Register.” Id.

1. 5 U.S.C. § 552a(k)(1) - FOIA Exemption 1, Classified Information

“The head of any agency may promulgate rules, in accordance with the requirements (including general notice) . . . to exempt any system of records . . . if the system of records is –

(1) subject to the provisions of section 552(b)(1) of this title.” 5 U.S.C. § 552a(k)(1).

Comment:

Subsection (k)(1) exempts classified information from certain Privacy Act provisions.

Subsection (k)(1) simply incorporates FOIA Exemption 1, which exempts classified information from disclosure. See 5 U.S.C. § 552(b)(1); Taylor v. NSA, 618 F. App’x 478, 482 (11th Cir. 2015); Mobley v. CIA, 924 F. Supp. 2d 24, 64-65 (D.D.C. 2013); Makky v. Chertoff, 489 F. Supp. 2d 421, 441 (D.N.J. 2007); Blum v. NSA, No. A-09-CA-769-SS, 2010 WL 11537459, at *4 (W.D. Tex. Apr. 12, 2010); Pipko v. CIA, 312 F. Supp. 2d 669, 677-78 (D.N.J. 2004); Bassiouni v. CIA, No. 02-4049, 2004 WL 1125919, at *4 (N.D. Ill. Mar. 30, 2004), aff’d on other grounds, 392 F.3d 244 (7th Cir. 2004); Snyder v. CIA, 230 F. Supp. 2d 17, 23 (D.D.C. 2003); Blazy v. Tenet, 979 F. Supp. 10, 23-25 (D.D.C. 1997), summary affirmance granted, No. 97-5330, 1998 WL 315583, at *1 (D.C. Cir. May 12, 1998); Laroque v. DOJ, No. 86-2677, 1988 WL 28334, at *2 (D.D.C. Mar. 16, 1988); see also OMB 1975 Guidelines, 40 Fed. Reg. at 28,972, https://www.justice.gov/paoverview_omb-75.

The exemption has been construed to permit the withholding of classified records from an agency employee with a security clearance who seeks only private access to records about himself. See Martens v. Commerce, No. 88-3334, 1990 U.S. Dist. LEXIS 10351, at *10-11 (D.D.C. Aug. 6, 1990) (the exemption is “based on the nature of the material, not the nature of the individual requester.”).

When responding to a request for access to records covered by this exemption, an agency may refuse to admit or deny the existence of responsive intelligence information, known as a “Glomar response,” and is not required to redact and disclose allegedly non-secret, non-exempt portions of classified documents. See Willis v. NSA, No. 17-cv-2038 (KBJ), 2019 WL 1924249 (D.D.C April 30, 2019) (“[T]his Court concludes that NSA’s Glomar response . . . is logically and plausibly rooted in national security concerns regarding the revelation of classified information . . . and, therefore, to the extent that Willis’s request sought NSA intelligence information about herself, NSA’s response does not violate the FOIA or the Privacy Act.”); Taylor v. NSA, 618 Fed. Appx. at 481-82; Office of Capital Collateral Counsel ex rel. Mordenti v. DOJ, 331 F.3d 799, 801 n. 3 (11th Cir. 2003) (citing Phillipi v. CIA, 546 F.2d 1008 (D.C. Cir. 1976) and finding that “[a] Glomar response neither confirms nor denies the existence of documents sought in the FOIA request. This term has its origin in a case involving a FOIA request for information on the GLOMAR EXPLORER submarine-retrieval ship.”).

2. 5 U.S.C. § 552a(k)(2) - Investigative Law Enforcement Materials

“The head of any agency may promulgate rules, in accordance with the requirements (including general notice) . . . to exempt any system of records . . . if the system of records is –
. . .
(2) investigatory material compiled for law enforcement purposes, other than material within the scope of subsection (j)(2) of this section: Provided, however, That if any individual is denied any right, privilege, or benefit that he would otherwise be entitled by Federal law, or for which he would otherwise be eligible, as a result of the maintenance of such material, such material shall be provided to such individual, except to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence, or, prior to the effective date of this section [September 27, 1975], under an implied promise that the identity of the source would be held in confidence. . .” 5 U.S.C. § 552a(k)(2).

Comment:

This exemption covers: (1) material compiled for criminal investigative law enforcement purposes, by nonprincipal function criminal law enforcement entities; and (2) material compiled for other investigative law enforcement purposes, by any agency.

The material must be compiled for some investigative “law enforcement” purpose, such as a civil investigation or a criminal investigation by a nonprincipal function criminal law enforcement agency. See OMB 1975 Guidelines, 40 Fed. Reg. at 28,972-73, https://www.justice.gov/paoverview_omb-75; see also, e.g., Montenegro v. FBI, No. 1:16CV1400, 2017 WL 2692613 (E.D. Va. June 22, 2017) (holding that U.S. Immigration and Customs Enforcement properly withheld information contained in Alien file, Index, and National File Tracking system); Gowan v. Air Force, 148 F.3d 1182, 1188-89 (10th Cir. 1998) (regarding fraud, waste, and abuse complaint to OIG); Menchu v. HHS, 965 F. Supp. 2d 1238, 1248 (D. Or. 2013) (discussing investigation by HHS Office for Civil Rights of discrimination complaint against health system), aff’d, 2014 WL 1217128, at * 1 (D. Or. Mar. 21, 2014); Berger v. IRS, 487 F. Supp. 2d 482, 497-98 (D.N.J. 2007) (discussing civil trust fund recovery penalty investigation), aff’d 288 F. App’x 829 (3d Cir. 2008); Melius v. Nat’l Indian Gaming Comm’n, No. 98-2210, 1999 U.S. Dist. LEXIS 17537, at *14-15, 18-19 (D.D.C. Nov. 3, 1999) (regarding law enforcement investigation into suitability of person involved in gaming contracts); Shewchun v. INS, No. 95-1920, slip op. at 3, 8-9 (D.D.C. Dec. 10, 1996) (regarding investigation into deportability pursuant to Immigration and Nationality Act), summary affirmance granted, No. 97-5044 (D.C. Cir. June 5, 1997); Viotti v. Air Force, 902 F. Supp. 1331, 1335 (D. Colo. 1995) (discussing inspector general’s fraud, waste, and abuse investigation into plaintiff’s travel records), aff’d, 153 F.3d 730 (10th Cir. 1998) (unpublished table decision); Jaindl v. State, No. 90-1489, slip op. at 3 (D.D.C. Jan. 31, 1991) (regarding non-principal function law enforcement agency assisting in apprehension of plaintiff by revoking his passport), summary affirmance granted, No. 91-5034 (D.C. Cir. Jan. 8, 1992); Barber v. INS, No. 90-0067C, slip op. at 6-9 (W.D. Wash. May 15, 1990) (discussing enforcement of Immigration and Nationality Act); Welsh v. IRS, No. 85-1024, slip op. at 2-3 (D.N.M. Oct. 21, 1986) (regarding taxpayer audit); Spence v. IRS, No. 85-1076, slip op. at 2 (D.N.M. Mar. 27, 1986) (regarding taxpayer audit); Nader v. ICC, No. 82-1037, 1983 U.S. Dist. LEXIS 11380, at *14 (D.D.C. Nov. 23, 1983) (discussing investigation to determine whether to bar attorney from practicing before ICC for knowingly submitting false, inaccurate, and misleading statements to agency); Heinzl v. INS, 3 Gov’t Disclosure Serv. (P-H) ¶ 83,121, at 83,725 (N.D. Cal. Dec. 18, 1981) (discussing investigation regarding possible deportation); Lobosco v. IRS, No. 77-1464, 1981 WL 1780, at *3 (E.D.N.Y. Jan. 14, 1981) (regarding taxpayer audit); but cf. Louis v. Labor, No. 03-5534, slip op. at 8 (W.D. Wash. Mar. 8, 2004) (finding that records compiled for purposes of Federal Employee Compensation Act claim were properly exempt based on stated reasons for exemption in agency’s regulation without discussing whether records were indeed compiled for investigative law enforcement purposes as is statutorily required).

In general, the subsection (k)(2) exemption does not apply to routine background security investigation files, but does apply to investigations of employees suspected of illegal activity.

In general, subsection (k)(2) does not include material compiled solely for the purpose of a routine background security investigation of a job applicant. See Vymetalik v. FBI, 785 F.2d 1090, 1093-98 (D.C. Cir. 1986) (noting applicability of narrower subsection (k)(5) to such material and ruling that “specific allegations of illegal activities” must be involved in order for subsection (k)(2) to apply); Bostic v. FBI, No. 1:94 CV 71, slip op. at 7-8 (W.D. Mich. Dec. 16, 1994) (following Vymetalik). The exemption of material compiled for employment or classified access that would identify a confidential source is addressed in subsection (k)(5) of the Privacy Act (discussed infra).

However, material compiled for the purpose of investigating agency employees for suspected violations of law can fall within subsection (k)(2). See Strang v. U.S. Arms Control & Disarmament Agency, 864 F.2d 859, 862-63 n.2 (D.C. Cir. 1989) (“Unlike Vymetalik, this case involves not a job applicant undergoing a routine check of his background and his ability to perform the job, but an existing agency employee investigated for violating national security regulations.”); Nazimuddin v. IRS, No. 99-2476, 2001 WL 112274, at *2, 4 (S.D. Tex. Jan. 10, 2001) (protecting identity of confidential source in document prepared in anticipation of disciplinary action resulting from investigation of employee’s alleged misuse of Lexis/Nexis research account); Croskey v. Office of Special Counsel, 9 F. Supp. 2d 8, 11 (D.D.C. 1998) (finding Office of Special Counsel Report of Investigation, which was developed to determine whether plaintiff had been fired for legitimate or retaliatory reasons, exempt from access and amendment provisions of Privacy Act pursuant to subsection (k)(2)), summary affirmance granted, No. 98-5346, 1999 WL 58614 (D.C. Cir. Jan. 12, 1999); Cohen v. FBI, No. 93-1701, slip op. at 4-6 (D.D.C. Oct. 3, 1995) (applying Vymetalik and finding that particular information within background investigation file qualified as “law enforcement” information “withheld out of a legitimate concern for national security,” thus “satisf[ying] the standards set forth in Vymetalik,” which recognized that “‘[i]f specific allegations of illegal activities were involved, then th[e] investigation might well be characterized as a law enforcement investigation’” and that “‘[s]o long as the investigation was “realistically based on a legitimate concern that federal laws have been or may be violated or that national security may be breached’ the records may be considered law enforcement records” (quoting Vymetalik, 785 F.2d at 1098, in turn quoting Pratt v. Webster, 673 F.2d 408, 421 (D.C. Cir. 1982))); see also Viotti, 902 F. Supp. at 1335 (concluding, “as a matter of law, that [Report of Inquiry] was compiled for a law enforcement purpose as stated in 5 U.S.C. § 552a(k)(2)” where “original purpose of the investigation . . . was a complaint to the [Inspector General] of fraud, waste and abuse,” even though “complaint was not sustained and no criminal charges were brought,” because “plain language of the exemption states that it applies to the purpose of the investigation, not to the result”); Mittleman v. Treasury, 919 F. Supp. 461, 469 (D.D.C. 1995) (finding that Inspector General’s report “pertain[ing] to plaintiff’s grievance against Treasury officials and related matters . . . falls squarely within the reach of exemption (k)(2)”), aff’d in part & remanded in part on other grounds, 104 F.3d 410 (D.C. Cir. 1997); Fausto v. Watt, 3 Gov’t Disclosure Serv. (P-H) ¶ 83,217, at 83,929-30 (4th Cir. June 7, 1983) (holding that investigation prompted by a “hotline” tip and conducted to avoid fraud, waste, and abuse qualified under (k)(2)); Frank v. DOJ, 480 F. Supp. 596, 597 (D.D.C. 1979).

Notwithstanding the general rule stated in Vymetalik, a few courts have found that an agency may rely on subsection (k)(2) to withhold materials from pre-employment background security investigation files. For example, in Doe v. DOJ, 790 F. Supp. 17, 19-21 (D.D.C. 1992), the court determined that, although subsection (k)(5) was “directly applicable,” subsection (k)(2) also applied to records of an FBI background check on a prospective Department of Justice attorney. It determined that the Department of Justice, as “the nation’s primary law enforcement and security agency,” had a legitimate law enforcement purpose in ensuring that “officials like Doe . . . be ‘reliable, trustworthy, of good conduct and character, and of complete and unswerving loyalty to the United States.’” Id. at 20 (quoting Exec. Order No. 10,450, 18 Fed. Reg. 2489 (Apr. 29, 1953)). Likewise, in Cohen v. FBI, No. 93-1701 (D.D.C. Oct. 3, 1995), the court found subsection (k)(2) to be applicable to one document in a prospective employee’s background investigation file because that document was “withheld out of a legitimate concern for national security” and it “satisfie[d] the standards set forth in Vymetalik,” which recognized that “‘[i]f specific allegations of illegal activities were involved, then th[e] investigation might well be characterized as a law enforcement investigation’” and that “‘[s]o long as the investigation was “realistically based on a legitimate concern that federal laws have been or may be violated or that national security may be breached” the records may be considered law enforcement records.’” Cohen, No. 93-1701, slip op. at 3-6 (D.D.C. Oct. 3, 1995) (quoting Vymetalik, 785 F.2d at 1098, in turn quoting Pratt, 673 F.2d at 421).

Similarly, subsection (k)(2) has been held in at least one case to apply to background investigations of prospective FBI/DEA special agents. See Putnam v. DOJ, 873 F. Supp. 705, 717 (D.D.C. 1995) (finding that subsection (k)(2) was properly invoked to withhold information that would reveal identities of individuals who provided information in connection with former FBI special agent’s pre-employment investigation).

Individuals are entitled to access investigative records used as a basis for denying their rights, privileges, or benefits.

Although the issue has not been the subject of much significant case law, the OMB 1975 Guidelines explain that the “Provided, however” provision of subsection (k)(2) means that “[t]o the extent that such an investigatory record is used as a basis for denying an individual any right, privilege, or benefit to which the individual would be entitled in the absence of that record, the individual must be granted access to that record except to the extent that access would reveal the identity of a confidential source.” 40 Fed. Reg. at 28,973, https://www.justice.gov/paoverview_omb-75; cf. Castillo v. DHS, No. 11-69, 2011 WL 13282126 (D.N.M. Nov. 22, 2011) (noting that, pursuant to subsection (k)(2), names of individuals confidentially interviewed during Citizenship and Immigration Services investigation into an allegedly sham marriage were being withheld by the agency); Jewett v. State, No. 11 cv 1852, 2013 WL 550077, at *10 (D.D.C. Feb. 14, 2013) (upholding agency’s reliance on subsection (k)(2) to withhold “a law enforcement report requesting assistance in locating and apprehending [plaintiff] in order to protect a confidential source’s identity”); Nazimuddin, 2001 WL 112274, at *4 (protecting identity of source under express promise of confidentiality pursuant to subsection (k)(2) without discussion of whether investigatory record was used to deny right, privilege, or benefit); Guccione v. Nat’l Indian Gaming Comm’n, No. 98-CV-164, 1999 U.S. Dist. LEXIS 15475, at *11-12 (S.D. Cal. Aug. 5, 1999) (approving agency invocation of subsection (k)(2) to protect third-party names of individuals who had not been given express promises of confidentiality where plaintiff did not contend any denial of right, privilege, or benefit).

The District Court for the District of Colorado has found that forced early retirement resulted in a loss of a benefit, right, or privilege for purposes of the subsection (k)(2) exemption.

A few decisions have discussed what constitutes a denial of a “right, privilege, or benefit” sufficient to require that the agency grant access to records otherwise exempt from access under subsection (k)(2). For example, in Viotti v. Air Force, 902 F. Supp. at 1335-36, the District Court for the District of Colorado determined that an Air Force Colonel’s forced early retirement “resulted in a loss of a benefit, right or privilege for which he was eligible – the loss of six months to four years of the difference between his active duty pay and retirement pay,” and “over his life expectancy . . . the difference in pay between the amount of his retirement pay for twenty-six years of active duty versus thirty years of active duty.” Id. The court found that “as a matter of law, based on [a report of inquiry, plaintiff] lost benefits, rights, and privileges for which he was eligible” and thus he was entitled to an unredacted copy of the report “despite the fact that [it] was prepared pursuant to a law enforcement investigation.” Id. It went on to find that “the ‘express’ promise requirement” of (k)(2) was not satisfied where a witness “merely expressed a ‘fear of reprisal.’” Id. (citing Londrigan v. FBI, 670 F.2d 1164, 1170 (D.C. Cir. 1981) (Londrigan I).

The District Court for the District of Oregon has found that that depriving an individual of the right to be present at, and seek medical services from, a health system facility resulted in a loss of a benefit, right, or privilege for purposes of the subsection (k)(2) exemption.

Likewise, the District Court for the District of Oregon held that subsection (k)(2) required access to interview notes compiled by the Office for Civil Rights of the Department of Health and Human Services in the course of its investigation of a discrimination complaint filed by the plaintiff against a health system. Menchu, 965 F. Supp. 2d at 1248. The notes concerned accusations made by an employee of the health system that the plaintiff had harassed her, which led the health system to bar the plaintiff from its facilities. Id. at 1241. The agency denied the plaintiff’s discrimination claim, upholding the health system’s decision to bar the plaintiff from its facilities. Id. at 1249. In rejecting the agency’s argument that its regulations – which were promulgated pursuant to subsection (k)(2) and which purported to exempt the notes from the Act’s access provisions – permitted it to withhold the notes, the Court reasoned that “the records created by the Agency during the investigation, and the continued maintenance of such material, deprived [the plaintiff] of ‘a right, privilege, or benefit that he would otherwise be entitled by Federal law’ – the right to be present on, pursue employment at, and seek medical services from, [the health system’s] facilities in a nondiscriminatory manner.” Id.

A number of courts have found that plaintiffs have failed to articulate a deprivation of a right or benefit in accordance with the subsection (k)(2) exemption.

In contrast, the District Court for the District of Columbia found no deprivation of rights or benefits that would require granting access to subsection (k)(2) records. Nat’l Whistleblower Ctr. v. HHS, 849 F. Supp. 2d 13, 24 (D.D.C. 2012). The plaintiffs in Nat’l Whistleblower Ctr. claimed to have suffered adverse employment actions as the result of the Office of Inspector General’s maintenance of certain investigative records to which they sought access. Id. The OIG disputed that any employment actions “occurred as a result of the maintenance” of its investigative file, especially as the results of its investigation found no misconduct. Id. The OIG maintained that any action taken by the FDA against plaintiffs “was at FDA’s discretion.” Id. The court agreed, stating: “In sum, OIG’s maintenance of its investigative files did not cause Plaintiffs to be denied rights or benefits; instead, FDA’s maintenance of its own investigative files resulted in any adverse employment actions suffered by Plaintiffs.” Id. See also, e.g., Gowan v. Air Force, 148 F.3d at 1189 (finding that individual was not entitled to access Inspector General complaint protected by subsection (k)(2), because “the charges in the complaint were deemed unworthy of further action”).

In Doe v. DOJ, 790 F. Supp. at 21 n.4, 22, the court determined that the disclosure requirement in subsection (k)(2) did not apply, on grounds that the plaintiff “ha[d] no entitlement to a job with the Justice Department.” The court, however, failed to discuss whether the denial of a federal job would amount to the denial of a “privilege” or “benefit.” See also Jaindl, No. 90-1489, slip op. at 2 n.1 (noting that “[b]ecause there is no general right to possess a passport,” application of (k)(2) was not limited in that case).

The limited right of access under the subsection (k)(2) exemption does not include the right to amend.

Even when applicable, the limited right to obtain access to records protected under subsection (k)(2) does not include the right to have such records amended. See 5 U.S.C. § 552a(k)(2) (requiring only that “material shall be provided to [the] individual except to the extent that disclosure of such material would reveal the identity of a [confidential source]” (emphasis added)). For example, the Court of Appeals for the Tenth Circuit, in affirming Viotti, supra, noted that subsection (k)(2)’s limiting exception applied only in the context of access requests and did not apply to limit the exemption’s applicability with regard to amendment requests. Viotti v. Air Force, 153 F.3d at 2 n.2; see also Gowan, 148 F.3d at 1189 (concluding that subsection (k)(2) did not require disclosure of the record to the subject individual, while separately observing that the record remained exempt from amendment under that subsection).

The Privacy Act does not impose a temporal limitation on the applicability of the subsection (k)(2) exemption.

Unlike with Exemption 7(A) of the Freedom of Information Act, 5 U.S.C. § 552(b)(7)(A) (2018), there is no temporal limitation on the scope of subsection (k)(2). See Irons v. Bell, 596 F.2d 468, 471 (1st Cir. 1979); Lobosco, 1981 WL 1780, at *4. But see Anderson v. Treasury, No. 76-1404, slip op. at 9-11 (D.D.C. July 19, 1977) (finding subsection (k)(2) inapplicable to investigatory report regarding alleged wrongdoing by IRS agent where investigation was closed and no possibility of any future law enforcement proceedings existed).

Records exempted under the subsection (k)(2) exemption should still be exempt if the records are subsequently added into non-law enforcement records.

Information that originally qualifies for subsection (k)(2) protection should retain that protection even if it subsequently is recompiled into a non-law enforcement record. See Doe v. FBI, 936 F.2d 1346, 1356 (D.C. Cir. 1991) (discussing under subsection (j)(2)); accord OMB 1975 Guidelines, 40 Fed. Reg. at 28,971, https://www.justice.gov/paoverview_omb-75.

Suits alleging an agency’s wrongful disclosure of records pursuant to a promise of confidentiality in accordance with the subsection (k)(2) exemption are unusual and have not prevailed.

Finally, two courts have ruled in favor of the agency in cases brought by individuals who allegedly provided information pursuant to a promise of confidentiality and sought damages resulting from disclosure of the information and failure to sufficiently protect their identities pursuant to subsection (k)(2). Bechhoefer v. DOJ, 934 F. Supp. 535, 538-39 (W.D.N.Y. 1996), vacated & remanded, 209 F.3d 57 (2d Cir. 2000) (finding that information at issue did qualify as “record” under Privacy Act); Sterling v. United States, 798 F. Supp. 47, 49 (D.D.C. 1992). In Sterling, the District Court for the District of Columbia stated that the plaintiff was “not barred from stating a claim for monetary damages [under (g)(1)(D)] merely because the record did not contain ‘personal information’ about him and was not retrieved through a search of indices bearing his name or other identifying characteristics,” 798 F. Supp. at 49, but in a subsequent opinion the court ultimately ruled in favor of the agency, having been presented with no evidence that the agency had intentionally or willfully disclosed the plaintiff’s identity. Sterling v. United States, 826 F. Supp. 570, 571-72 (D.D.C. 1993), summary affirmance granted, No. 93-5264 (D.C. Cir. Mar. 11, 1994). However, the District Court for the Western District of New York in Bechhoefer, when presented with an argument based on Sterling, stated that it did not “find the Sterling court’s analysis persuasive.” Bechhoefer, 934 F. Supp. at 538-39. Having already determined that the information at issue did not qualify as a record “about” the plaintiff, that court recognized that subsection (k)(2) “does not prohibit agencies from releasing material that would reveal the identity of a confidential source” but rather “allows agencies to promulgate rules to exempt certain types of documents from mandatory disclosure under other portions of the Act.” Id. The court went on to state that “plaintiff’s reliance on § 552a(k)(2) [wa]s misplaced,” and that subsection (k) was “irrelevant” to the claim before it for wrongful disclosure. Id. at 539.

3. 5 U.S.C. § 552a(k)(3) - Secret Service Records

“The head of any agency may promulgate rules, in accordance with the requirements (including general notice) . . . to exempt any system of records . . . if the system of records is –
. . .
(3) maintained in connection with providing protective services to the President of the United States or other individuals pursuant to section 3056 of Title 18. . .” 5 U.S.C. § 552a(k)(3).

Comment:

By its text, this exemption would apply to certain systems of records maintained by the United States Secret Service. For a discussion of this exemption, see OMB 1975 Guidelines, 40 Fed. Reg. at 28,973, https://www.justice.gov/paoverview_omb-75.

4. 5 U.S.C. § 552a(k)(4) - Statistical Records

Comment:

For a discussion of this exemption, see OMB 1975 Guidelines, 40 Fed. Reg. at 28,973, https://www.justice.gov/paoverview_omb-75.

5. 5 U.S.C. § 552a(k)(5) - Source-Identifying Investigatory Material Compiled for Determining Suitability, Eligibility, or Other Qualification

“The head of any agency may promulgate rules, in accordance with the requirements (including general notice) . . . to exempt any system of records . . . if the system of records is –
. . .
(5) investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for Federal civilian employment, military service, Federal contracts, or access to classified information, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence, or, prior to the effective date of this section [September 27, 1975], under an implied promise that the identity of the source would be held in confidence. . .” 5 U.S.C. § 552a(k)(5).

Comment:

Known as the “Erlenborn Amendment,” the subsection (k)(5) exemption is generally applicable to source-identifying materials in background employment and personnel-type investigative files.

This exemption is generally applicable to source-identifying material in background employment and personnel-type investigative files. See OMB 1975 Guidelines, 40 Fed. Reg. at 28,973-74, https://www.justice.gov/paoverview_omb-75; 120 Cong. Rec. at 40,884-85, reprinted in Source Book at 860, 996-97. The Court of Appeals for the District of Columbia Circuit has held that exemption (k)(5) is also applicable to source-identifying material compiled for determining eligibility for federal grants, stating that “the term ‘Federal contracts’ in Privacy Act exemption (k)(5) encompasses a federal grant agreement if the grant agreement includes the essential elements of a contract and establishes a contractual relationship between the government and the grantee.” Henke v. Commerce, 83 F.3d 1445, 1453 (D.C. Cir. 1996). In addition, exemption (k)(5) is applicable to information collected for continued as well as original employment. See Hernandez v. Alexander, 671 F.2d 402, 406 (10th Cir. 1982). In situations where “specific allegations of illegal activities” are being investigated, an agency may be able to invoke subsection (k)(2) – which is potentially broader in its coverage than subsection (k)(5). See, e.g., Vymetalik v. FBI, 785 at 1093-98.

Subsection (k)(5) – known as the “Erlenborn Amendment” – was among the most hotly debated of any of the Act’s provisions because it provides for absolute protection to those who qualify as confidential sources, regardless of the adverse effect that the material they provide may have on an individual. See 120 Cong. Rec. at 36,655-58, reprinted in Source Book at 908-19.

However, an agency cannot rely upon subsection (k)(5) to bar a requester’s amendment request, as the exemption applies only to the extent that disclosure of information would reveal the identity of a confidential source. See Vymetalik, 785 F.2d at 1096-98; see also Doe v. FBI, 936 F.2d at 1356 n.12 (noting that subsection (k)(5) would not apply where FBI refused to amend information that had already been disclosed to individual seeking amendment); Bostic, No. 1:94 CV 71, slip op. at 9 (W.D. Mich. Dec. 16, 1994) (holding that application of exemption (k)(5) in this access case is not contrary to, but rather consistent with, Vymetalik and Doe v. FBI because in those cases exemption (k)(5) did not apply because relief sought was amendment of records).

It should be noted that information that originally qualifies for subsection (k)(5) protection should retain that protection even if it subsequently is recompiled into a non-law enforcement record. See Doe v. FBI, 936 F.2d 1346, 1356 (D.C. Cir. 1991) (discussing under subsection (j)(2)); accord OMB 1975 Guidelines, 40 Fed. Reg. at 28,971, https://www.justice.gov/paoverview_omb-75.

Subsection (k)(5) is a narrow exemption, requiring an expressed promise of confidentiality after the effective date of the Privacy Act, and is limited to source-identifying material.

Even so, subsection (k)(5) is a narrow exemption in two respects. First, in contrast to Exemption 7(D) of the FOIA, 5 U.S.C. § 552(b)(7)(D) (2018), it requires an express promise of confidentiality for source material acquired after the effective date of the Privacy Act (September 27, 1975). See, e.g., Lamb v. Millennium Challenge Corp., 334 F.3d 204, 218 (D.D.C. 2018) (concluding that further information was needed to determine whether subsection (k)(5) applied, including whether promise of confidentiality was implied or “express,” as required by the subsection); Viotti v. Air Force, 902 F. Supp. at 1336 (finding that “‘express’ promise requirement” of subsection (k)(2) was not satisfied when witness “merely expressed a ‘fear of reprisal’”), aff’d, 153 F.3d 730 (10th Cir. 1998) (unpublished table decision).

For source material acquired prior to the effective date of the Privacy Act, an implied promise of confidentiality will suffice. See 5 U.S.C. § 552a(k)(5); cf. Londrigan v. FBI, 722 F.2d 840, 844-45 (D.C. Cir. 1983) (Londrigan II) (finding no “automatic exemption” for FBI background interviews prior to effective date of Privacy Act; inferring that interviewees were impliedly promised confidentiality where FBI showed that it had pursued “policy of confidentiality” to which interviewing agents conformed their conduct). See generally DOJ v. Landano, 508 U.S. 165 (1993) (setting standards for demonstrating implied confidentiality under FOIA Exemption 7(D)). Second, in contrast to the second clause of FOIA Exemption 7(D), subsection (k)(5) protects only source-identifying material, not all source-supplied material.

Of course, where source-identifying material is exempt from Privacy Act access under subsection (k)(5), it typically is exempt under the broader exemptions of the FOIA as well. See, e.g., Keenan v. DOJ, No. 94-1909, slip op. at 16-17 (D.D.C. Mar. 25, 1997), subsequent decision, slip op. at 5-7 (D.D.C. Dec. 16, 1997); Bostic v. FBI, No. 1:94 CV 71, slip op. at 8-9, 12-13 (W.D. Mich. Dec. 16, 1994); Miller v. United States, 630 F. Supp. 347, 348-49 (E.D.N.Y. 1986); Patton v. FBI, 626 F. Supp. 445, 446-47 (M.D. Pa. 1985), aff’d, 782 F.2d 1030 (3d Cir. 1986) (unpublished table decision); Diamond v. FBI, 532 F. Supp. 216, 232 (S.D.N.Y. 1981), aff’d, 707 F.2d 75 (2d Cir. 1983).

One court has held that subsection (k)(5) protects source-identifying material even where the identity of the source is known. See Volz v. DOJ, 619 F.2d 49, 50 (10th Cir. 1980). Another court has suggested to the contrary. Doe v. U.S. Civil Serv. Comm’n, 483 F. Supp. 539, 576-77 (S.D.N.Y. 1980) (holding the addresses of three named persons “not exempt from disclosure under (k)(5) . . . because they didn’t serve as confidential sources and the plaintiff already knows their identity”).

Subsection (k)(5) is not limited to those sources who provide derogatory comments, see Londrigan I, 670 F.2d at 1170; see also Voelker v. FBI, 638 F. Supp. 571, 572-73 (E.D. Mo. 1986). The exemption is not limited to information that would reveal the identity of the source in statements made by those confidential sources, but also protects information that would reveal the source’s identity in statements provided by third parties. See Haddon v. Freeh, 31 F. Supp. 2d 16, 21 (D.D.C. 1998). Also, the exemption’s applicability is not diminished by the age of the source-identifying material. See Diamond, 532 F. Supp. at 232-33.

Promises of confidentiality should not be automatic, and courts have suggested that agencies utilize the promise of confidentiality sparingly.

OMB’s policy guidance indicates that promises of confidentiality are not to be made automatically. OMB 1975 Guidelines, 40 Fed. Reg. at 28,974, https://www.justice.gov/paoverview_omb-75. Consistent with the OMB 1975 Guidelines, the Office of Personnel Management has promulgated regulations establishing procedures for determining when a pledge of confidentiality is appropriate. See 5 C.F.R. § 736.102 (2012); see also Larry v. Lawler, 605 F.2d 954, 961 n.8 (7th Cir. 1978) (suggesting that finding of “good cause” is prerequisite for granting of confidentiality to sources).

Nevertheless, the District Court for the District of Columbia has held that in order to invoke exemption (k)(5) for sources that were in fact promised confidentiality, it is not necessary that the sources themselves affirmatively sought confidentiality, nor must the government make a showing that the sources would not have furnished information without a promise of confidentiality. Henke v. Commerce, No. 94-0189, 1996 WL 692020, at *9-10 (D.D.C. Aug. 19, 1994). The court went on to state: “[T]he question of whether the reviewers expressed a desire to keep their identities confidential is wholly irrelevant to the Court’s determination of whether they were in fact given promises of confidentiality.” Id. at *10. On appeal, the Court of Appeals for the District of Columbia Circuit stated that while it “would not go quite that far,” as agencies “must use subsection (k)(5) sparingly,” agencies may make determinations that promises of confidentiality are necessary “categorically,” as “[n]othing in either the statute or the case law requires that [an agency] apply subsection (k)(5) only to those particular reviewers who have expressly asked for an exemption and would otherwise have declined to participate in the peer review process.” Henke v. Commerce, 83 F.3d at 1449.

6. 5 U.S.C. § 552a(k)(6) - Testing or Examination Materials

“The head of any agency may promulgate rules, in accordance with the requirements (including general notice) . . . to exempt any system of records . . . if the system of records is –
. . .
(6) testing or examination material used solely to determine individual qualifications for appointment or promotion in the Federal service the disclosure of which would compromise the objectivity or fairness of the testing or examination process. . .” 5 U.S.C. § 552a(k)(6).

Comment:

Courts generally have found that FOIA Exemption 2 reflects the same concerns and covers the same information as the testing and examination material exemption.

Material exempt from Privacy Act access under subsection (k)(6) is also typically exempt from FOIA access under FOIA Exemption 2 (exempting records “related solely to the internal personnel rules and practices of the agency”). See Kelly v. Census Bureau, No. C 10-04507, 2011 U.S. Dist. LEXIS 100279, at *6 (N.D. Cal. Sept. 7, 2011); Patton v. FBI, 626 F. Supp. 445, 447 (M.D. Pa. 1985) (finding that disclosure would give future applicants unfair advantage and would impair usefulness and value of system, while noting that FOIA Exemption 2 is broader in scope than Privacy Act subsection (k)(6)), aff’d, 782 F.2d 1030 (3d Cir. 1986); see also Robinett v. USPS, No. 02-1094, slip op. at 15 & n.2, 16-18 (E.D. La. July 24, 2002) (finding that information showing “how much [the agency] reduced [the plaintiff’s] application score because of [a traffic violation]” was “just the type of information that courts have found could compromise an agency’s evaluation process” and thus was exempt from disclosure under subsection (k)(6), and further, noting that although court did not need to address agency’s FOIA Exemption 2 argument “[i]n light of the Court’s finding that the information fits under another FOIA exemption,” FOIA Exemption 2 “has been read to reflect the same concerns and cover the same information as the exemption codified in Section 552a(k)(6)”).

The Ninth Circuit has found that the testing and examination material exemption applies to the agency’s test or examination, the minimum passing score, and the individual test scores.

Subsection (k)(6) applies not only to an agency’s test or examination, but also to the minimum passing score and individual test scores. See Rojas v. FAA, 941 F.3d 392, 403 (9th Cir. 2019) (holding that term “testing material” refers to “items needed to conduct a test or examination to determine an individual’s proficiency or knowledge”), aff’g in relevant part Rojas v. FAA, No. CV-15-1709-PHX-SMM, 2017 U.S. Dist. LEXIS 157661 (D. Ariz. Sept. 28, 2017) (applying both FOIA Exemption 2 and Privacy Act subsection (k)(6) where agency’s Biographical Assessment for hiring air traffic controllers continued to be significantly threatened by sophisticated applicant pool willing to compromise Assessment and overall hiring process, and knowledge of minimum passing score was restricted to limited number of FAA personnel).

For a further discussion of this provision, see OMB 1975 Guidelines, 40 Fed. Reg. at 28,974, https://www.justice.gov/paoverview_omb-75.

7. 5 U.S.C. § 552a(k)(7) - Source-Identifying Armed Services Promotion Material

“The head of any agency may promulgate rules, in accordance with the requirements (including general notice) . . . to exempt any system of records . . . if the system of records is –

. . . (7) evaluation material used to determine potential for promotion in the armed services, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the government under an express promise that the identity of the source would be held in confidence, or, prior to the effective date of this section [September 27, 1975], under an implied promise that the identity of the source would be held in confidence.” 5 U.S.C. § 552a(k)(7).

Comment:

For an example of the application of this exemption, see May v. Air Force, 777 F.2d 1012, 1015-17 (5th Cir. 1985). For a further discussion of this provision, see OMB 1975 Guidelines, 40 Fed. Reg. at 28,974, https://www.justice.gov/paoverview_omb-75.

Next Section: Disclosure of Social Secuirty Number

Updated October 22, 2022