Overview of the Privacy Act: 2020 Edition

Civil Remedies

The Privacy Act provides for four separate and distinct civil causes of action.  See 5 U.S.C. § 552a(g).  Two civil causes of action provide for injunctive relief – amendment lawsuits under (g)(1)(A) and access lawsuits under (g)(1)(B).  The remaining two causes of action provide for compensatory relief in the form of monetary damages – damages lawsuits under (g)(1)(C) and (g)(1)(D).

 

  A. 5 U.S.C. § 552a(g)(1)(A) - Amendment Lawsuits

“Whenever any agency . . . makes a determination under subsection (d)(3) . . . not to amend an individual’s record in accordance with his request, or fails to make such review in conformity with that subsection . . . the individual may bring a civil action against the agency.”  5 U.S.C. § 552a(g)(1)(A).

Comment:

When an agency does not amend an individual’s record as requested or does not otherwise comply with the requirements of subsection (d)(3) -- which also establishes, e.g., time limits and notification requirements -- the Privacy Act specifically authorizes individuals to seek redress in federal court.  This section discusses the requirements for such amendment lawsuits.

 

1. Exhaustion of Administrative Remedies

Individuals must exhaust their administrative remedies prior to bringing amendment suits against an agency.

In order to pursue a civil action for amendment of a record, an individual must exhaust administrative remedies by making an amendment request to the agency and requesting administrative review.  See 5 U.S.C. § 552a(d)(2)-(3).  The requirement to make an amendment request to the agency and to seek administrative review before filing an action in civil court is jurisdictional in nature because it is imposed by the Act itself.  As explained in greater detail below under “5 U.S.C. § 552a(g)(1)(B) - Access Lawsuits,” it is important to note that the requirement to exhaust administrative remedies in Privacy Act access lawsuits is only jurisprudential in nature, as it is not imposed by the Act itself.

The exhaustion principle is well established in the Privacy Act case law in the amendment context.  Courts have consistently required the individual to file a request for amendment of his or her records, in conformity with the agency’s regulations, before commencing a subsection (g)(1)(A) lawsuit.  See, e.g., Quinn v. Stone, 978 F.2d 126, 137-38 (3d Cir. 1992); (per curiam); Nagel v. HEW, 725 F.2d 1438, 1441 (D.C. Cir. 1984); Hill v. Air Force, 795 F.2d 1067, 1069 (D.C. Cir. 1986); McKoy v. Spencer, No. 1:16-CV-01313, 2019 WL 400615, at *5-6 (D.D.C. Jan. 31, 2019); Otero v. DOJ, 292 F. Supp. 3d 245, 251-52 (D.D.C. 2018); Dick v. Holder, 67 F. Supp. 3d 167, 188-89 (D.D.C. 2014); Lowe v. Colvin, No. SA-13-CV-145, 2014 WL 690644, at *4-5 (W.D. Tex. Feb. 21, 2014); Olsen v. SSA, No. 10-CV-0474, 2013 WL 3190346, at *3 (E.D.N.Y. June 18, 2013); Hutton v. VA, No. 1:12CV190, 2013 WL 1331191, at *1-2 (M.D.N.C. Mar. 29, 2013); Jones v. Office of Worker’s Comp. Programs, No. 2:11-CV-2799, 2012 WL 5213148, at *3 (E.D. Cal. Oct. 22, 2012) (magistrate’s recommendation); Middlebrooks v. Mabus, No. 1:11cv46, 2011 WL 4478686, at *5 n.10 (E.D. Va. Sept. 23, 2011); Kvech v. Holder, No. 10-cv-545, 2011 WL 4369452, at *4 n.10 (D.D.C. Sept. 19, 2011); Washington v. Donley, 802 F. Supp. 2d 539, 553-54 (D. Del. 2011); Reitz v. USDA, No. 08-4131, 2010 WL 786586, at *10 (D. Kan. Mar. 4, 2010); Pototsky v. DHS, No. CV 07-144, 2009 WL 10695555, at *3 (D. Ariz. Jan. 15, 2009), aff’d, 368 F. App’x 832 (9th Cir. 2010); Watson v. Mineta, No. 4:05-CV-007, 2007 WL 3102196, at *2 (M.D. Ga. Oct. 23, 2007) (dicta); Brown v. DOJ, No. 02-2662, slip op. at 24-26 (D. Ala. June 21, 2005); Pontecorvo v. FBI, No. 00-1511, slip op. at 21-22 (D.D.C. Sept. 30, 2001); Murphy v. United States, 121 F. Supp. 2d 21, 28 (D.D.C. 2000), aff’d per curiam, 64 F. App’x 250 (D.C. Cir. 2003); M.K. v. Tenet, 99 F. Supp. 2d 12, 20 (D.D.C. 2000); Blazy v. Tenet, 979 F. Supp. 10, 18-19 (D.D.C. 1997), summary affirmance granted, No. 97-5330, 1998 WL 315583 (D.C. Cir. May 12, 1998); Olivares v. NASA, 882 F. Supp. 1545, 1552 (D. Md. 1995), aff’d, 103 F.3d 119 (4th Cir. 1996) (unpublished table decision); Gergick v. Austin, No. 89-0838-CV-W-2, 1992 U.S. Dist. LEXIS 7338, at *13-16 (W.D. Mo. Apr. 29, 1992), aff’d, No. 92-3210 (8th Cir. July 9, 1993); Simon v. DOJ, 752 F. Supp. 14, 23 n.6 (D.D.C. 1990), aff’d, 980 F.2d 782 (D.C. Cir. 1992); Campbell v. USPS, No. 86-3609, 1990 WL 36132, at *4 (E.D. La. Mar. 28, 1990); Green v. USPS, No. 88-0539, 1989 U.S. Dist. LEXIS 6846, at *6-7 (S.D.N.Y. June 19, 1989); and Ross v. USPS, 556 F. Supp. 729, 735 (N.D. Ala. 1983); cf. New-Howard v. Shinseki, No. 09-5350, 2012 WL 2362546, at *6 (E.D. Pa. June 21, 2012) (finding plaintiff’s amendment request “flawed [] as she asserts her claim against an entity that no longer has control of the documents” because at time plaintiff filed amendment request, she had filed Merit Systems Protection Board (MSPB) action, and thus, records that would “ordinarily be under the control of” OPM were “covered by the appropriate MSPB or [EEOC] system of records”). 

It also has been held that a plaintiff cannot “boot-strap” an access claim under (g)(1)(B) into a (g)(1)(A) amendment violation, even though the plaintiff argued that by denying her request for access the agency had prevented her from exercising her right to request amendment.  See Smith v. Cont’l Assurance Co., No. 91 C 0963, 1991 WL 164348, at *2 (N.D. Ill. Aug. 22, 1991); accord Mumme v. Labor, 150 F. Supp. 2d 162, 173 (D. Me. 2001), aff’d, No. 01-2256 (1st Cir. June 12, 2002); see also M.K., 99 F. Supp. 2d at 20 n.15 (holding that plaintiffs must exhaust administrative remedies by requesting amendment of records even though plaintiffs had argued that “they cannot ask the CIA[] to amend that which the CIA refuses to admit exists”).

In amendment suits, exhaustion of administrative processes generally includes exhaustion of administrative appeals.

In addition, many courts have required an individual to administratively appeal the agency’s denial of his or her amendment request before commencing a subsection (g)(1)(A) lawsuit.  See Jernigan v. Air Force, No. 97-35930, 1998 WL 658662, at *2 (9th Cir. Sept. 17, 1998); Dickson v. OPM, 828 F.2d 32, 40 (D.C. Cir 1987); Hewitt v. Grabicki, 794 F.2d 1373, 1377-78 (9th Cir. 1986); Clutter v. Perdue, No. H-18-310, 2019 WL 1589942, at *7 (S.D. Tex. Jan. 28, 2019); Conley v. United States, No. 2:10-cv-444, 2011 WL 1256611, at *7 (S.D. Ohio Mar. 31, 2011); Pearson v. DHS, No. 3:08-CV-1885-B, 2009 WL 4016414, at *8 (N.D. Tex. Nov. 17, 2009); Leighton v. CIA., 412 F. Supp. 2d 30, 34-35 (D.D.C. 2006); Finnerty v. USPS, No. 03-558, 2006 WL 54345, at *6-8 (D.N.J. Jan. 9, 2006); Hass v. Air Force, 848 F. Supp. 926, 930 (D. Kan. 1994); Freude v. McSteen, No. 4-85-882, slip op. at 4-5 (D. Minn. Oct. 23, 1985), aff’d, 786 F.2d 1171 (8th Cir. 1986) (unpublished table decision); and Beaver v. VA, No. 1-82-477, slip op. at 2 (E.D. Tenn. Apr. 6, 1983).  Cf. Williams v. Bezy, 97 F. App’x 573, 574 (6th Cir. 2004) (affirming district court’s dismissal of plaintiff’s subsection (e)(5) claim for failure to exhaust administrative remedies without specifically discussing whether claim was brought under subsection (g)(1)(A) or subsection (g)(1)(C)); Doe v. Goss, No. 04-2122, 2007 WL 106523, at *8 n.14 (D.D.C. Jan. 12, 2007) (“Plaintiff cannot circumvent the exhaustion requirement by styling his ‘equitable right’ as a constitutional claim where, as here, Congress has provided administrative machinery for the resolution of the statutory claim.”).  But cf. Duke v. United States, 305 F. Supp. 2d 478, 488 (E.D. Pa. 2004) (finding that “although plaintiff [had] not exhausted administrative remedies” court had “subject matter jurisdiction over this claim” because “this exhaustion requirement is not a jurisdictional requirement” but a “practical” one). 

An agency’s failure to meet its own deadlines does not exempt an individual from the exhaustion requirement; court jurisdiction exists, however, as soon as an agency fails to comply with the amendment provision’s administrative appeal time requirement.

Although subsection (d)(2)(A) requires an agency to “acknowledge in writing such receipt” of an amendment request within ten working days, subsection (d)(2)(B) merely requires an agency to “promptly” make the requested correction or inform the individual of its refusal to amend.  In construing this language, the Court of Appeals for the District of Columbia Circuit has held that “[t]he statute provides no exemption from administrative review when an agency fails, even by several months, to abide by a deadline, and none is reasonably implied.”  Dickson v. OPM, 828 F.2d 32, 40-41 (D.C. Cir. 1987) (requiring exhaustion of subsection (d)(3) administrative appeal remedy even when agency did not respond to initial amendment request for 90 days (citing Nagel, 725 F.2d at 1440-41)).  But see Schaeuble v. Reno, 87 F. Supp. 2d 383, 389-90 (D.N.J. 2000) (holding further exhaustion of administrative remedies is not required where plaintiff had requested amendment and agency had not responded for six months; stating that “[a] six month delay is not a ‘prompt’ response,” and that “[m]oreover, not only has the [agency] not indicated that it will make a final determination . . . by any certain date, the Privacy Act does not bind the [agency] to any definite timeframe for administrative action, which weighs in favor of waiving the exhaustion requirement”).

In contrast to subsection (d)(2)(B), subsection (d)(3) requires an agency to make a final determination on administrative appeal from an initial denial of an amendment request within 30 working days (unless, for good cause shown, the head of the agency extends this 30-day period).  Thus, court jurisdiction exists as soon as an agency fails to comply with the time requirements of subsection (d)(3); “[t]o require further exhaustion would not only contradict the plain words of the statute but also would undercut [C]ongress’s clear intent to provide speedy disposition of these claims.”  Diederich v. Army, 878 F.2d 646, 648 (2d Cir. 1989).

Individuals who are not informed of their right to administratively appeal an agency decision are treated as having “exhausted” administrative remedies.

After denying an amendment request, an agency must inform the complainant of the right to administratively appeal that denial or the complainant is not penalized for failing to exhaust his or her administrative remedies before filing a civil action.  In Harper v. Kobelinski, 589 F.2d 721 (D.C. Cir. 1978) (per curiam), and Liguori v. Alexander, 495 F. Supp. 641 (S.D.N.Y. 1980), the agencies denied amendment requests but failed to inform the plaintiffs of their rights to administratively appeal those decisions.  In light of the Act’s requirement that agencies inform complainants whose amendment requests have been denied of the available administrative remedies, 5 U.S.C. § 552a(d)(2)(B)(ii), the courts in Harper and Liguori refused to penalize the plaintiffs for their failures to exhaust.  Harper, 589 F.2d at 723; Liguori, 495 F. Supp. at 646-47; see also Germane v. Heckler, 804 F.2d 366, 369 (7th Cir. 1986) (discussing Harper and Liguori with approval); Mahar v. Nat’l Parks Serv., No. 86-0398, slip op. at 7-11 (D.D.C. Dec. 23, 1987) (same); cf. Ertell v. Army, 626 F. Supp. 903, 909-10 (C.D. Ill. 1986) (rejecting agency’s exhaustion defense where it first told employee, in response to his amendment request, that it had destroyed the record but later used same record against him, ruling that employee was not required to make new request or appeal initial action).

The D.C. Circuit has held that individuals must seek judicial review of adverse employment decisions under the Administrative Procedures Act prior to filing civil Privacy Act suit.

D.C. courts have held that civil suits may not be filed until the individual has sought judicial review under the Administrative Procedures Act (“APA”).  For example, in White v. U.S. Civil Serv. Comm’n, 589 F.2d 713, 715-16 (D.C. Cir. 1978) (per curiam), the D.C. Circuit held that, notwithstanding any exhaustion of administrative remedies, an amendment action is “inappropriate and premature” where the individual had not yet sought judicial review (under the APA) of adverse employment decisions, because granting Privacy Act relief “would tend to undermine the established and proven method by which individuals . . . have obtained review from the courts.”  Cf. Douglas v. Farmers Home Admin., No. 91-1969, 1992 U.S. Dist. LEXIS 9159, at *4-5 (D.D.C. June 26, 1992) (dismissing damages action under Privacy Act where plaintiff had not sought review under Administrative Procedure Act of allegedly inaccurate property appraisal).  But see Churchwell v. United States, 545 F.2d 59, 61 (8th Cir. 1976) (finding probationary employee could proceed with due process claim for hearing even though Privacy Act remedy was available to her because “the failure to pursue one particular remedy has [no] bearing on the viability of the other form of relief”).

 

2. Standard and Scope of Review

“In any suit brought under the provisions of subsection (g)(1)(A) of this section, the court may order the agency to amend the individual’s record in accordance with his request or in such other way as the court may direct.  In such a case the court shall determine the matter de novo.”  5 U.S.C. § 552a(g)(2)(A).

Comment:

After an individual exhausts his or her administrative remedies by making an amendment request to the agency and requesting administrative review pursuant to subsections (d)(2) and (d)(3), the individual may challenge the agency’s refusal to amend the individual’s record in federal district court.  In such amendment actions, brought under subsection (g)(1)(A), “the court may order the agency to amend the individual’s record in accordance with his request or in such other way as the court may direct,” and “may assess against the United States reasonable attorney fees and other litigation costs reasonably incurred” in any case in which the complainant has “substantially prevailed.”  5 U.S.C. § 552a(g)(2)(A), (B).

Amendment suits are reviewed in the federal courts de novo.

In a subsection (g)(1)(A) action, the court “shall determine the matter de novo.”  5 U.S.C. § 552a(g)(2)(A).  “De novo review does not contemplate that the court will substitute its judgment for the [agency’s], but rather that the court will undertake an independent determination of whether the amendment request should be denied.”  Nolan v. DOJ, No. 89-A-2035, 1991 WL 134803, at *3 (D. Colo. July 17, 1991), appeal dismissed in pertinent part on procedural grounds, 973 F.2d 843 (10th Cir. 1992); see also Doe v. United States, 821 F.2d 694, 697-98 (D.C. Cir. 1987) (holding that “[d]e novo means . . . a fresh, independent determination of ‘the matter’ at stake”).  The applicable standards in amendment lawsuits are accuracy, relevancy, timeliness, and completeness.  5 U.S.C. § 552a(d)(2)(B)(i).  But see Doe v. United States, 821 F.2d at 697 n.8, 699 (stating that “whether the nature of the relief sought is injunctive or monetary, the standard against which the accuracy of the record is measured remains constant” and “[t]hat standard is found in 5 U.S.C. § 552a(e)(5) and reiterated in 5 U.S.C. § 552a(g)(1)(C)”).  The burden of proof is on the individual.  See Mervin v. FTC, 591 F.2d 821, 827 (D.C. Cir. 1978) (per curiam); Thompson v. Coast Guard, 547 F. Supp. 274, 282 (S.D. Fla. 1982); OMB 1975 Guidelines, 40 Fed. Reg. at 28,969, https://www.justice.​gov​/paoverview_omb-75.

Individuals may not bring civil suit for an agency’s failure to amend records that do not exist.

“[A]n individual’s request for amendment must relate to an existing record that is maintained within one of the agency’s systems of records.”  Crummey v. SSA, 794 F. Supp. 2d 46, 58 (D.D.C. 2011), aff’d per curiam, No. 11-5231, 2012 WL 556317 (D.C. Cir. Feb. 6, 2012).  The plaintiff in Crummey – who “believe[d] that the Social Security Administration created a trust . . . when it assigned him a Social Security Number and a Social Security Card” – had “draft[ed] an agreement designed to reflect the alleged creation of the Trust.”  794 F. Supp. 2d at 49.  The plaintiff brought a subsection (g)(1)(A) claim seeking a court order requiring the SSA “to amend its records to add the Trust Agreement to the SSA’s Master Files, or to somehow incorporate its contents therein.”  Id. at 52.  The court reviewed the categories of records listed in the applicable system of records notice, see 75 Fed. Reg. 82,123 (Dec. 29, 2010), and determined that “[n]one of the information set forth in the Trust Agreement falls within this universe.” 794 F. Supp. 2d at 58.  “In short,” the court concluded, “the Trust Agreement and the information contained therein do not correspond to an ‘item, collection, or grouping’ of information in the Master Files,” and granted summary judgment to the SSA.  Id. at 59.

Once records have been amended, the amendment claim is moot.

Once a request for amendment is complied with and the identified records have been amended, the amendment claim is moot.  See, e.g., Conley, 2011 WL 1256611, at *7; Blanton v. Warden, No. 7:10-cv-00552, 2011 WL 1226010, at *2-3 (W.D. Va. Mar. 30, 2011); Garza v. Pearson, No. 5:08-cv-300, 2009 WL 2500116, at *1 (S.D. Miss. Aug. 13, 2009); Blazy v. Tenet, 979 F. Supp. 10, 19 (D.D.C. 1997), summary affirmance granted, No. 97-5330, 1998 WL 315583 (D.C. Cir. May 12, 1998).

There are several matters that are not subject to court review under the amendment provisions of the Privacy Act, including tax liability determinations, judicial and quasi-judicial decisions, and criminal convictions and sentences.

Tax liability determinations are not subject to court review under the Privacy Act.  In the Internal Revenue Code, Congress expressly removed the jurisdiction of the district courts under Privacy Act subsection (g) to order the amendment of IRS records concerning tax liability.  26 U.S.C. § 7852(e) (providing that subsection (g), as well as subsections (d)(2), (3) and (4), “shall not apply, directly or indirectly,” to any “determination of the existence or possible existence of liability (or the amount thereof) of any person for any tax, penalty, interest, fine, forfeiture, or other imposition or offense” to which title 26, United States Code, applies).  See, e.g., Schlabach v. IRS, 491 F. App’x 854, 854-55 (9th Cir. 2012); Gardner v. United States, 213 F.3d 735, 740-41 & n.5 (D.C. Cir. 2000); England v. Comm’r, 798 F.2d 350, 351-52 (9th Cir. 1986); Meyer v. Comm’r, No. 10-767, 2010 WL 4157173, at *8 (D. Minn. Sept. 27, 2010) (magistrate’s recommendation), adopted, 2010 WL 4134958, at *8 (D. Minn. Oct. 19, 2010); Gulden v. United States, No. 8:06-CV-2327-T-27MSS, 2007 WL 3202480, at *3 (M.D. Fla. Oct. 29, 2007); Singer v. IRS, No. 98-0024, 1998 U.S. Dist. LEXIS 13301, at *10-11 (E.D. Pa. Aug. 10, 1998); Chandler v. United States, No. 93-C-812A, 1994 WL 315759, at *1 (D. Utah Mar. 8, 1994); Fuselier v. IRS, No. 90-0300, slip op. at 1 (W.D. La. Oct. 25, 1990); Mallas v. Kolak, 721 F. Supp. 748, 751 (M.D.N.C. 1989), aff’d in part, vacated in nonpertinent part & remanded, on other grounds,  Mallas v. United States, 993 F.2d 1111 (4th Cir. 1993); Schandl v. Heye, No. 86-6219, slip op. at 2 (S.D. Fla. Sept. 30, 1986); Dyrdra v. Comm’r, No. 85-0-41, slip op. at 2 (D. Neb. Oct. 28, 1985); Conklin v. United States, No. 83-C-587, slip op. at 2-3 (D. Colo. Feb. 26, 1985); Green v. IRS, 556 F. Supp. 79, 80 (N.D. Ill. 1982), aff’d, 734 F.2d 18 (7th Cir. 1984) (unpublished table decision); see also Gardner v. United States, No. 96-1467, 1999 U.S. Dist. LEXIS 2195, at *18 (D.D.C. Jan. 29, 1999) (finding that by virtue of § 7852(e) the IRS is “exempt” from amendment provisions of Privacy Act), summary affirmance granted on other grounds, No. 99-5089, 1999 WL 728359 (D.C. Cir. Aug. 4, 1999) (per curiam). 

In addition, consistent with the OMB 1975 Guidelines, courts have routinely expressed disfavor toward litigants who attempt to invoke the subsection (g)(1)(A) amendment remedy as a basis for collateral attacks on judicial or quasi-judicial determinations recorded in agency records.  See 40 Fed. Reg. at 28,969, https://www.justice.gov/paoverview_omb-75; see also Jackson v. GSA, 729 F. App’x. 206, 209 (3d Cir. 2018) (per curiam) (citing Reinbold, infra, and denying expungement of “derogatory information,” where district court determined that records supported IRS’s determination that employment offer was rescinded based on fingerprint check); Sydnor v. OPM, 336 F. App’x 175, 180 (3d Cir. 2009) (concluding that “a collateral attack upon that which has been or could have been the subject of a judicial, quasi-judicial or administrative proceeding” lies “outside the scope of the Privacy Act”); Jones v. MSPB, 216 F. App’x 608, 609 (8th Cir. 2007) (affirming dismissal of amendment claim because “the statements accurately reflect administrative decisions”); Cooper v. Treasury, No. 05-0314, 2006 WL 637817, at *2-3 (11th Cir. Mar. 15, 2006) (finding law-of-the-case doctrine bars relitigation of claim under Privacy Act that had been decided against plaintiff in district court and affirmed by court of appeals); Reinbold v. Evers, 187 F.3d 348, 361 (4th Cir. 1999) (“[T]he Privacy Act does not allow a court to alter records that accurately reflect an administrative decision, or the opinions behind that administrative decision.”); Milhous v. EEOC, No. 97-5242, 1998 WL 152784, at *1 (6th Cir. Mar. 24, 1998) (“The Privacy Act may not be used to challenge unfavorable agency decisions[.]  It is intended solely to be used to correct factual or historical errors.”); Douglas v. Agric. Stabilization & Conservation Serv., 33 F.3d 784, 785 (7th Cir. 1994) (asserting that the “Privacy Act does not authorize relitigation of the substance of agency decisions” and that “the right response . . . is to correct the disposition under the Administrative Procedure Act”); Bailey v. VA, No. 94-55092, 1994 WL 417423, at *1 (9th Cir. Aug. 10, 1994) (finding that plaintiff may not use Privacy Act to collaterally attack grant or denial of benefits); Sugrue v. Derwinski, 26 F.3d 8, 11 (2d Cir. 1994) (finding that the Privacy Act may not be used “as a rhetorical cover to attack VA benefits determinations”); Geurin v. Army, No. 90-16783, 1992 WL 2781, at *2 (9th Cir. Jan. 6, 1992) (finding doctrine of res judicata bars relitigation of claims under Privacy Act that had been decided against plaintiff by United States Claims Court in prior action under 28 U.S.C. § 1491); Pellerin v. VA, 790 F.2d 1553, 1555 (11th Cir. 1986) (quoting Rogers v. Labor, 607 F. Supp. 697, 699 (N.D. Cal. 1985) that the Privacy Act “‘may not be employed as a skeleton key for reopening consideration of unfavorable federal agency decisions,’” and dismissing amendment lawsuit challenging VA disability benefits determination on the ground that veterans benefit statute limits judicial review of VA’s determinations); Hutton v. VA, No. 1:12CV190, 2013 WL 1331191, at *2 (explaining that even if plaintiff’s Privacy Act claim were properly before the court, “[p]laintiff seeks to alter records that, under the facts alleged, accurately reflect the administrative decisions made years ago”); New-Howard v. Shinseki, No. 09-5350, 2012 WL 2362546, at *7 (E.D. Pa. June 21, 2012) (“Plaintiff’s placement in the position of Office Automation Clerk and her placement in the FERS system may have been substantively incorrect, to the extent that such placement occurred, the records in her file accurately reflect what occurred in August 2005. As a result, the proper procedure for Plaintiff to employ in order to correct the error is to pursue the matter before the MSPB.”); Hardy v. McHugh, 692 F. Supp. 2d 76, 80-81 (D.D.C. 2010) (rejecting claim to correct Army memorandum of reprimand that included “implication that [plaintiff] intentionally misrepresented his educational credentials” because “the Army’s judgment is based on accurate facts” and because plaintiff “presents the same facts that have been considered by various Army boards and asks [the court] to substitute [its] judgment for theirs”); Jackson v. Labor, No. 2:06-CV-02157, 2008 WL 539925, at *4 (E.D. Cal. Feb. 25, 2008) (ruling that plaintiff may not bring amendment lawsuit under Privacy Act to re-litigate determination of Federal Employees’ Compensation Act benefits); Davenport v. Harvey, No. 06-CV-02669, slip op. at 8 (S.D. Cal. May 3, 2007) (rejecting claim “seek[ing] to alter factual findings and conclusion made by the [DOD Office of Hearings and Appeals] [administrative judge] as part of Plaintiff’s appeal of the denial of his security clearance”), aff’d in pertinent part, vacated in part, & remanded sub nom. Davenport v. McHugh, 372 F. App’x 820 (9th Cir. 2010); Lee v. Geren, 480 F. Supp. 2d 198, 209 (D.D.C. Mar. 29, 2007) (finding that plaintiff “is not seeking to correct any true errors in his records” but instead “is hoping that this Court will expunge all references in his records to an adverse personnel action that he could not challenge directly because the CSRA precludes such review”); Lechliter v. Army, No. 04-814, 2006 WL 462750, at *2-3 (D. Del. Feb. 27, 2006) (“To the extent that [plaintiff] is asking [the court] to alter the ultimate determination by the Department that he is not disabled, rather than to correct factual errors recited in his records, such relief is outside that provided by the Privacy Act.”); Levant v. Roche, 384 F. Supp. 2d 262, 270 (D.D.C. 2005) (concluding that plaintiff’s “true complaint is not about the accuracy of his records, but about the underlying decision [not to promote him to the rank of major general, which those records] reflect”); Byrnes v. MSPB, No. 04-742, 2005 WL 486156, at *2-3 (D.D.C. Mar. 2, 2005) (ruling that plaintiff could not collaterally attack “an inartfully drafted settlement agreement” terminating a lawsuit by seeking to amend agreement to include a provision requiring MSPB to “depublish” its prior decision); Bernard v. DOD, 362 F. Supp. 2d 272, 280-81 (D.D.C. 2005) (dismissing plaintiff’s amendment claim because plaintiff did not “seek to correct a factual or historical error” but rather challenged agency’s substantive judgments or decisions); Gowan v. Air Force, No. 90-94, slip op. at 26, 33 (D.N.M. Sept. 1, 1995) (commenting that “Privacy Act, unfortunately, may not be used as a collateral attack on the improper referral of charges [for court martial], nor may the Privacy Act be used as a method for the Court to oversee the activities of the armed services”), aff’d, 148 F.3d 1182 (10th Cir. 1998); Williams v. McCausland, 90 Civ. 7563, 1994 WL 18510, at *17 (S.D.N.Y. Jan. 18, 1994) (denying plaintiff’s request to supplement record of his administrative proceeding before MSPB because request “constitutes an attempt to contest the MSPB’s determination on the merits of his request for a stay of his removal”); Smith v. Cont’l Assurance Co., No. 91 C 0963, 1991 WL 164348, at *5 (N.D. Ill. Aug. 22, 1991) (finding that plaintiff cannot use Privacy Act to collaterally attack agency decision regarding her Federal Employees Health Benefit Act claim); Rowan v. USPS, No. 82-C-6550, 1984 U.S. Dist. LEXIS 17042, at *6 (N.D. Ill. May 2, 1984) (asserting that the Privacy Act is not “a means for all disgruntled governmental employees to have unflattering appraisals removed from their personnel files or shaded according to their own whims or preferences”); Leib v. VA, 546 F. Supp. 758, 762 (D.D.C. 1982) (“The Privacy Act was not intended to be and should not be allowed to become a ‘backdoor mechanism’ to subvert the finality of agency determinations.” (internal citation omitted)); Lyon v. United States, 94 F.R.D. 69, 72 (W.D. Okla. 1982) (asserting that a Privacy Act claim cannot be “a backdoor mechanism to subvert authority bestowed upon the Secretary of Labor to handle employee compensation claims” and stating that the FECA “provides the exclusive method of presenting compensation claims resulting from on-the-job injuries of federal employees”); Bashaw v. Treasury, 468 F. Supp. 1195, 1196-97 (E.D. Wis. 1979) (citing OMB 1975 Guidelines with approval and holding that amendment remedy is “neither a necessary nor an appropriate vehicle for resolving the merits of the plaintiff’s [discrimination] claims”); Kennedy v. Andrus, 459 F. Supp. 240, 242 (D.D.C. 1978) (noting that OMB 1075 Guidelines “clearly forbid collateral attack in the case of final judicial or quasi-judicial actions” and observing that “the same considerations would seem to apply to agency personnel actions, such as the reprimand here, for collateral attack under the Privacy Act could undermine the effectiveness of agency grievance systems”), aff’d, 612 F.2d 586 (D.C. Cir. 1980) (unpublished table decision); cf. Subh v. Army, No. 1:10cv433, 2010 WL 4961613, at *4 (E.D. Va. Nov. 30, 2010) (rejecting plaintiff’s attempt “to rewrite history to pretend that he correctly answered ‘yes’ to question 22 [on Standard Form 86, the ‘Questionnaire for National Security Positions’] when in fact he falsely answered ‘no’” because “[t]he Privacy Act plainly does not exist to allow applicants to obtain such a ‘do-over’ of their security forms in the guise of an administrative ‘correction’”); Doe v. HHS, 871 F. Supp. 808, 814-15 (E.D. Pa. 1994) (“[T]he specific reporting provisions encompassed in the [Health Care Quality Improvement] Act supersede[] any claims [plaintiff] might have under the Privacy Act.”), aff’d, 66 F.3d 310 (3d Cir. 1995) (unpublished table decision).

Criminal court convictions and sentences are generally not subject to civil amendment court review under the Privacy Act.  Federal prisoners frequently attempt to invoke the subsection (g)(1)(A) amendment remedy as a basis for a collateral attack on a conviction or the duration of a sentence.  Just as in the damages context – discussed in the “5 U.S.C. § 552a(g)(1)(C) - Damages Lawsuits for Failure to Assure Fairness in Agency Determination” section, below – courts have frequently ruled that unless the conviction or sentence has been invalidated in a prior proceeding, the prisoner’s exclusive remedy is a writ of habeas corpus.  See, e.g., Reeves v. BOP, 885 F. Supp. 2d 384, 389 (D.D.C. 2012) (“A civil action under the Privacy Act is not the proper means by which a federal prisoner may secure a reduction in the duration of his confinement.”); Crompton v. Kent, No. 12-cv-757, 2012 WL 5903088, at *3 (W.D. Wis. Nov. 26, 2012) (holding that a prisoner’s claim to  amend his presentence report cannot succeed because the individual defendants were immune and that BOP “cannot be ordered to amend plaintiff’s presentence report because it has no authority to take such an action”);  King v. Johns, No. 4:10cv1835, 2010 WL 4065405, at *1 (N.D. Ohio Oct. 14, 2010) (“[A] complaint seeking relief under . . . § 552a is not a permissible alternative to a petition for writ of habeas corpus if the plaintiff essentially challenges the legality of his confinement.”); Truesdale v. DOJ, 731 F. Supp. 2d 3, 11 (D.D.C. 2010) (dismissing Privacy Act claims because a ruling in plaintiff’s favor would impact the duration of his confinement, and should be brought in a petition for a writ of habeas corpus “not by way of a suit brought under the Privacy Act”); Davis v. United States, No. 09-1961, 2010 WL 2011549, at *1 n.1 (D. Md. May 18, 2010) (“[T]o the extent Petitioner believes that his sentence should be modified, such claims may only be made in the context of a habeas petition.”); Brown v. BOP, 498 F. Supp. 2d. 298, 303-04 (D.D.C. 2007) (“The Privacy Act is not the proper means by which a prisoner may collaterally attack his sentence absent a showing that his sentence has been invalidated in a prior proceeding.”); Forrester v. Parole Comm’n, 310 F. Supp. 2d 162, 168-70 (D.D.C. 2004) (concluding that reaching plaintiff’s Privacy Act claim seeking order to expunge information “would have a probabilistic impact on his confinement . . . and therefore plaintiff may only raise [such a claim] in a petition for a writ of habeas corpus”); Graham v. Hawk, 857 F. Supp. 38, 40-41 (W.D. Tenn. 1994) (“The Privacy Act is not a means of circumventing [habeas] exhaustion requirement.”), aff’d, 59 F.3d 170 (6th Cir. 1995) (unpublished table decision).  Similarly, the D.C. Circuit has concluded that the Privacy Act amendment provisions do not allow for amendment of military records: “The proper means by which to seek a change to military records is through a proceeding before the . . . Board for Correction of Military Records,” not under the Privacy Act.  Glick v. Army, No. 91-5213, 1992 WL 168004, at *1 (D.C. Cir. June 5, 1992) (per curiam); see also Cargill v. Marsh, 902 F.2d 1006, 1007-08 (D.C. Cir. 1990) (per curiam) (affirming dismissal of Privacy Act claim and concluding proper means to seek substantive change in military records is through proceeding before the Boards for Correction of Records); Walsh v. Hagee, 900 F. Supp. 2d 51, 60 (D.D.C. 2012) (“For [plaintiff] to obtain injunctive relief to amend his military record, he must proceed under 10 U.S.C. § 1552.”); Doe v. Navy, 764 F. Supp. 1324, 1327 (N.D. Ind. 1991) (“[P]laintiff is not free to choose to attempt amendment of his military records under the Privacy Act alone without resort to the records correction board remedy.”); cf. Hardy, 692 F. Supp. 2d at 80-81 (rejecting claim seeking correction of Army memorandum of reprimand including “implication that [plaintiff] intentionally misrepresented his educational credentials” because “the Army’s judgment is based on accurate facts” and because plaintiff “presents the same facts that have been considered by various Army boards and asks [the court] to substitute [its] judgment for theirs”); Walker v. United States, No. 93-2728, 1998 WL 637360, at *14 (E.D. La. Sept. 16, 1998) (citing Cargill and finding plaintiff’s claim “unavailing” to extent that he “is attempting to use the Privacy Act as a vehicle for his collateral attack on the Army’s allegedly improper failure to correct his military records”), aff’d, 184 F.3d 816 (5th Cir. 1999) (unpublished table decision).  But see Diederich v. Army, 878 F.2d 646, 647-48 (2d Cir. 1989) (holding that “Privacy Act claims were properly before the district court” and that plaintiff was not required to further exhaust administrative remedies before asserting claim for amendment of military records where his direct request to Army for correction had been stalled before appeals board for several months); see also Def. Priv. Bd., Advisory Opinions No. 4, Corrections of Military Records Under the Privacy Act, in Judge Advocate General’s School, U.S. Army, JA 235, Government Information Practices – Casebook, A-13 (March 2000), https://www.justice.gov/paoverview_ja-235 (affording review under Privacy Act for factual matters only but noting that challenges to judgmental decisions may be made to the Boards for Correction of Military or Naval Records).

Finally, several courts have ruled that statutes that provide other avenues of redress, such as the CSRA, can bar certain kinds of subsection (g)(1)(C) damages actions.  These cases are discussed below under “5 U.S.C. § 552a(g)(1)(C) - Damages Lawsuits for Failure to Assure Fairness in Agency Determination.” 

The courts are split as to whether records that are exempt from the Privacy Act’s access provision are also exempt from the Privacy Act’s amendment suits.

The Courts of Appeals for the Fifth, Seventh, and Ninth Circuits have concluded that records that are exempt from access under the Privacy Act are not subject to amendment suits.  The Court of Appeals for the Fifth Circuit held that a plaintiff had no right to amend the record at issue even though that record was only “exempt from the access requirements of the Act.”  Smith v. United States, 142 F. App’x 209, 210 (5th Cir. 2005) (per curiam) (emphasis added).  In other words, the court explained, “the scope of accessibility and the scope of amendment under the Privacy Act are coextensive.”  Id.  The plaintiff in Smith had sought to amend a report that was “prepared in response to [his Federal Tort Claims Act] claim.”  Id.  The Fifth Circuit explained that because this report “was prepared in reasonable anticipation of a civil suit or proceeding” within the meaning of the subsection (d)(5) exemption, “[t]he report is . . . also exempt from the amendment requirements of the Act.”  Id.  Thus, the court concluded, the amendment claim was “barred by exemption.”  Id.  Subsection (d)(5) is discussed below under “Ten Exemptions.”

The Smith court agreed with earlier cases in the Court of Appeals for the Ninth and Seventh Circuits.  The Ninth Circuit held that “Congress intended to provide the remedies of amendment or expungement only for records that are accessible under the Privacy Act.”  Baker v. Navy, 814 F.2d 1381, 1385 (9th Cir. 1987) (finding that plaintiff’s ability to access record under FOIA or because of personal knowledge of its existence, did not permit him to amend record because it was not contained in system of records as required for access by subsection (d)(1) of Privacy Act).  Similarly, the Seventh Circuit concluded that “you cannot amend a document if you don’t have access to it.”  Wentz v. DOJ, 772 F.2d 335, 338 (7th Cir. 1985) (alternative holding) (concluding that amendment was not appropriate because the record was exempt from access under subsection (d)(1), pursuant to subsection (j)(2)). 

The Courts of Appeals for the District of Columbia, First, and Fourth Circuits also have concluded that courts do not have jurisdiction under subsection (g)(1)(A) to order the amendment of records addressed by the Civil Service Reform Act’s (CSRA) comprehensive remedial scheme.  See Wills v. OPM, No. 93-2079, 1994 WL 22349, at *3-4 (4th Cir. Jan. 28, 1994) (alternative holding) (per curiam) (unpublished table decision) (finding jurisdiction was proper under CSRA where challenge to merits of statement on SF-50 was actually complaint regarding adverse employment decision); Vessella v. Air Force, No. 92-2195, 1993 WL 230172, at *2 (1st Cir. June 28, 1993) (citing Kleiman, infra, and holding that plaintiff could not “bypass the CSRA’s regulatory scheme” by bringing Privacy Act claim for same alleged impermissible adverse personnel practices that he challenged before MSPB, even though MSPB dismissed his claims as untimely); Kleiman v. Energy, 956 F.2d 335, 338 (D.C. Cir. 1992) (quoting Carducci v. Regan, 714 F.2d 171, 174 (D.C. Cir. 1983) and refusing to allow exhaustive remedial scheme of CSRA to be “impermissibly frustrated” by granting review of personnel decisions under the Privacy Act); see also Wonders v. McHugh, No. 1:12-CV-817, 2013 WL 1729928, at *6 (M.D. Ala. Apr. 4, 2013) (finding plaintiff’s claims about “personnel actions” fell within “CSRA’s general prohibition against prejudicial treatment” rather than under Privacy Act); Minshew v. Donley, 911 F. Supp. 2d 1043, 1067 (D. Nev. 2012) (explaining that CSRA preempts plaintiff’s Privacy Act claim: “[T]he CSRA is the exclusive means for federal employees to challenge prohibited personnel practices, a federal employee may not resort to other statutes to effectively challenge, review, reverse, or otherwise collaterally attack a decision falling within the scope of the CSRA”); Lee v. Geren, 480 F. Supp. 2d 198, 206, 208 (D.D.C. 2007) (following “the course set by [Kleiman]” by “evaluat[ing] the merits of plaintiff’s claims . . . in a way that does not do violence to the CSRA” but ultimately finding that “[t]here is simply nothing inaccurate about” plaintiff’s records).

 

3. Remedies

The Privacy Act allows for broad injunctive remedies in amendment suits, including expungement.

The Act provides for broad injunctive remedies, contemplating “expungement [of inaccuracies] and not merely redress by supplement.”  R.R. v. Army, 482 F. Supp. 770, 774 (D.D.C. 1980); see also Smith v. Nixon, 807 F.2d 197, 204 (D.C. Cir. 1986); Hobson v. Wilson, 737 F.2d 1, 65-66 (D.C. Cir. 1984), overruled in part on other grounds, Leatherman v. Tarrant Cnty. Narcotics Intel. & Coord. Unit, 507 U.S. 163 (1993).

Once an agency offers to destroy a record in response to an expungement request, the lawsuit is at an end, and the agency cannot be compelled to affirmatively determine and announce that the challenged record violated the Act.  See Reuber v. United States, 829 F.2d 133, 144-49 (D.C. Cir. 1987); see also Comm. in Solidarity v. Sessions, 929 F.2d 742, 745 n.2 (D.C. Cir. 1991); Metadure Corp. v. United States, 490 F. Supp. 1368, 1375 (S.D.N.Y. 1980).  But see Doe v. U.S. Civil Serv. Comm’n, 483 F. Supp. 539, 551 (S.D.N.Y. 1980).

The expungement remedy often is sought in cases asserting constitutional claims in addition to Privacy Act claims, such as claims for violation of the Fourth Amendment’s due process protections.  As the District of Columbia Circuit Court of Appeals has stated, “Congress’s provision of specific Privacy Act remedies does not bar” a plaintiff’s equitable Constitutional claims.  Abdelfattah v. DHS, 787 F.3d 524, 534 (D.C. Cir. 2015) (holding that “[w]e have repeatedly recognized a plaintiff may request expungement of agency records for both violations of the Privacy Act and the Constitution”); see Chastain v. Kelley, 510 F.2d 1232, 1235-38 (D.C. Cir. 1975); Doe v. Air Force, 812 F.2d 738, 740-41 (D.C. Cir. 1987) (explaining that expungement of records seized from plaintiff’s Air Force barracks may be “available as a remedy if it is determined that the retained copies and information were unconstitutionally obtained”); Fendler v. Parole Comm’n, 774 F.2d 975, 979 (9th Cir. 1985); Ezenwa v. Gallen, 906 F. Supp. 978, 986 (M.D. Pa. 1995); cf. Johnson v. Sessions, No. 92-201, 1992 WL 212408, at *2 (D.D.C. Aug. 19, 1992) (refusing to invoke equitable powers to expunge plaintiff’s arrest record because court did not have jurisdiction to order FBI to violate its own regulations which require FBI to wait for authorization from appropriate judicial authority before expunging arrest record); NTEU v. IRS, 601 F. Supp. 1268, 1273 (D.D.C. 1985) (“Although the [inherent equitable power to order the expungement of a record] is most frequently employed to vindicate express or implied constitutional or statutory rights . . . the remedy need not always be so limited.”). 

However, when such equitable remedies are requested pursuant solely to the doctrine of ancillary jurisdiction – “which recognizes federal courts’ jurisdiction over some matters (otherwise beyond their competence) that are incidental to other matters” – the courts generally have not permitted equitable expungement.  See Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 378 (1994).  Following Kokkonen, a number of circuits have found that Federal courts do not maintain “inherited” powers ancillary to its original action to hear requests for equitable expungement of records; jurisdiction must be grounded in the Constitution or by statute.  United States v. Wahi, 850 F.3d 296, 302 (7th Cir. 2017); Doe v. United States, 833 F.3d 192, 199 (2d Cir. 2016); United States v. Field, 756 F.3d 911, 916 (6th Cir. 2014); United States v. Coloian, 480 F.3d 47, 52 (1st Cir. 2007); United States v. Meyer, 439 F.3d 855, 862 (8th Cir. 2006); United States v. Dunegan, 251 F.3d 477, 479 (3d Cir. 2001); United States v. Sumner, 226 F.3d 1005, 1014 (9th Cir. 2000).

 

B. 5 U.S.C. § 552a(g)(1)(B) - Access Lawsuits

“Whenever any agency . . . refuses to comply with an individual request under subsection (d)(1) of this section [the individual may bring a civil action against the agency].”  5 U.S.C. § 552a(g)(1)(B). 

Comment:

Subsection (g)(1)(B) authorizes an individual to bring a civil suit against an agency that refuses to comply with the individual’s access request.  Sovereign immunity is not a defense in such cases.  See In re U.S. Office of Pers. Mgmt. Data Sec. Breach Litig., 928 F.3d 42, 61 (D.C. Cir. 2019) (noting that Privacy Act “provides . . . a waiver of sovereign immunity”); Braun v. USPS, No. 16-2079, 2017 WL 4325645, at *5 (D.D.C. Sept. 17, 2017) (concluding that Privacy Act access lawsuit is not barred by sovereign immunity, because Act is statutory waiver of such immunity).

 

1. Exhaustion of Administrative Remedies

Requesters must exhaust administrative remedies before filing access suits under subsection (g)(1)(B); unlike amendment suits under subsection (g)(1)(A), the exhaustion requirement in access suits is not jurisdictional.

Just as under the FOIA, a requester must comply with agency procedures and exhaust all available administrative remedies – through pursuit of an access request to the agency and, if that request is denied, through an administrative appeal – prior to bringing a subsection (g)(1)(B) action. 

The exhaustion requirement cannot be found in the language of the Privacy Act itself, and arises instead from jurisprudential exhaustion principles.  Thus, it is not jurisdictional.  Because “[t]he language in [subsections (d)(1) and (g)] does not expressly require exhaustion of particular administrative remedies,” there is no statutory requirement for exhaustion related to a request for access to records.  Taylor v. Treasury, 127 F.3d 470, 476 (5th Cir. 1997).  The Court of Appeals for the Fifth Circuit noted that, “[w]henever the Congress statutorily mandates that a claimant exhaust administrative remedies, the exhaustion requirement is jurisdictional because it is tantamount to a legislative investiture of exclusive original jurisdiction in the agency.”  Id. at 475.  However, in “the absence of a statutory requirement of exhaustion . . . the jurisprudential doctrine of exhaustion controls. . . .  The jurisprudential exhaustion doctrine is not jurisdictional in nature.”  Id. (citations omitted).  The Fifth Circuit concluded that the plaintiff’s “failure to exhaust administrative remedies did not constitute a jurisdictional bar to assertion of his claim [for access to records, but] . . .  application of the jurisprudential exhaustion doctrine in this case indicates that . . . [plaintiff’s] claims under the Privacy Act must be dismissed for failure to state a claim upon which relief can be granted.”  Id. at 476-77. 

The Courts of Appeals for the Third and Ninth Circuits also have recognized a jurisprudential exhaustion requirement in Privacy Act cases.  The Court of Appeals for the Third Circuit followed Taylor and stated, “To the extent exhaustion of administrative remedies is required, it is not a jurisdictional prerequisite.”  Wadhwa v. VA, 342 F. App’x 860, 862-63 (3d Cir. 2009) (per curiam) (citing Taylor, 127 F.3d at 475-76) (emphasis added).  Rather, courts have required plaintiffs seeking access to records to exhaust administrative remedies pursuant to the “jurisprudential exhaustion doctrine.”  See, e.g., id.  The Third Circuit “disagree[d] with the District Court’s conclusion that it lacks jurisdiction to entertain [plaintiff’s] claim [for access to records] under the Privacy Act because [plaintiff] failed to exhaust his administrative remedies.”  342 F. App’x at 862.  See also Buckley v. Schaul, 135 F. App’x 960, 960 (9th Cir. 2005) (holding that “even in the absence of an explicit exhaustion requirement, a district court may in its discretion require such exhaustion”). 

As noted above in the section entitled, “5 U.S.C. § 552a(g)(1)(A) - Amendment Lawsuits,” access lawsuits differ in this respect from amendment lawsuits.  See also, e.g., Kvech v. Holder, No. 10-cv-545, 2011 WL 4369452, at *8 (D.D.C. Sept. 19, 2011) (“While the Privacy Act requires that plaintiffs first resort to administrative remedies for denials of requests to amend records, . . . the statute does not contain a similar requirement with respect to an access claim.”).  Because subsection (d)(2) regarding amendment by its terms requires exhaustion, that requirement is jurisdictional in nature.  See 5 U.S.C. § 552a(d)(2); see also Quinn v. Stone, 978 F.2d 126, 137-38 (3d Cir. 1992) (“These provisions entail a requirement that the plaintiff exhaust her administrative remedies before she can take advantage of [subsection (g)(1)(A)]” (citing Dickson v. OPM, 828 F.2d 32, 40-41 (D.C. Cir. 1987))).  But see Singh v. DHS, No. 1:12cv00498, 2013 WL 1704296, at *10-12 (E.D. Cal. Apr. 19, 2013) (following Taylor, a Privacy Act access case, and finding exhaustion requirement for the plaintiff’s amendment claim as non-jurisdictional). 

Plaintiffs’ access requests must conform to agency regulations to exhaust administrative remedies.

Nearly all courts have concluded that plaintiffs fail to exhaust administrative remedies if their access requests do not conform to agency regulations.  See, e.g., Vaughn v. Danzig, 18 F. App’x 122, 125 (4th Cir. 2001) (per curiam) (affirming district court’s summary judgment for agency because plaintiff’s “telephonic request for the record before it was destroyed did not comply with the requirement for submitting a request under the Freedom of Information Act, Privacy Act, or Navy regulations implementing those statutes”); Taylor, 127 F.3d at 473-78 (upholding dismissal of plaintiff’s request because plaintiff’s “Privacy Act requests plainly did not comply with [agency] regulations because he did not list the systems that he wished to have searched, their location, and the business address of the systems officer”); Powell v. IRS, 317 F. Supp. 3d 266 (D.C.C. 2018) (concluding that plaintiff failed to exhaust all but one request because he did not comply with agency requirements to clearly mark request or to state that request was pursuant to statute), reconsidered in nonpertinent part, Powell v. IRS, No. CV 17-278, 2018 WL 10196621, at *1 (D.D.C. Sept. 12, 2018); Powell v. IRS, 255 F. Supp. 3d 33, 42 (D.D.C. 2017) (dismissing same plaintiff’s earlier suit because he referred only to FOIA in his initial request and failed to file any proper request under agency’s Privacy Act regulations); Haley v. SSA, No. JKB-14-3775, 2015 WL 3745618 (D. Md. June 11, 2015) (dismissing complaint because plaintiff did not mail request to proper office or properly identify records requested); Canada v. Soc. Sec. of Worcester Mass., No. 14-40041-TSH, 2014 U.S. Dist. LEXIS 198790, at *4-5 (D. Mass. 2014) (concluding that plaintiff failed to state cause of action because he did not allege that he had asked for document in question under agency’s Privacy Act regulations);  Godaire v. Napolitano, No. 3:10cv01266, 2010 WL 6634572, at *7 (D. Conn. Nov. 17, 2010); Ioane v. Comm’r of IRS, No. 3:09-CV-00243, 2010 WL 2600689, at *4 (D. Nev. Mar. 11, 2010); Sterrett v. Navy, No. 09-CV-2083, 2010 WL 330086, at *3-4 (S.D. Cal. Jan. 20, 2010); Gadd v. United States, No. 4:08CV04229, 2010 WL 60953, at *12 (E.D. Ark. Jan. 5, 2010), aff’d, 392 F. App’x 503 (8th Cir. 2010); Ramstack v. Army, 607 F. Supp. 2d 94, 102-03 (D.D.C. 2009); Willis v. DOJ, 581 F. Supp. 2d 57, 69-70 (D.D.C. 2008); Mulhern v. Gates, 525 F. Supp. 2d 174, 187 (D.D.C. 2007); Brown v. DOJ, No. 02-2662, slip op. at 20-24 (N.D. Ala. June 21, 2005); MacLeod v. IRS, No. 99-1088, 2001 U.S. Dist. LEXIS 9327, at *3-4 (S.D. Cal. June 4, 2001); Broaddrick v. Exec. Office of the President, 139 F. Supp. 2d 55, 61 (D.D.C. 2001), aff’d per curiam, No. 01-5178 (D.C. Cir. May 1, 2002); Scaife v. IRS, No. 02-1805, 2003 U.S. Dist. LEXIS 22661, at *8 (D.D.C. Nov. 20, 2003); Flowers v. Exec. Office of the President, 142 F. Supp. 2d 38, 44 (D.D.C. 2001); Walker v. Henderson, No. 98 C 3824, 1999 WL 39545, at *9 (N.D. Ill. Jan. 20, 1999), appeal voluntarily dismissed, No. 99-1615 (7th Cir. May 27, 1999); Reeves v. United States, No. 94-1291, 1994 WL 782235, at *2 (E.D. Cal. Nov. 16, 1994), aff’d, 108 F.3d 338 (9th Cir. 1997) (unpublished table decision); Taylor v. Def. Fin. & Accounting Servs., No. 2:12-2466, 2014 U.S. Dist. LEXIS 268, at *16-25 (E.D. Cal. Jan. 3, 2014); Fields v. IRS, No. 12-14753, 2013 WL 3353921, at *3 (E.D. Mich. July 3, 2013);  Cross v. Potter, No. 3:09-CV-1293, 2013 WL 1149525, at *9 (N.D.N.Y. Mar. 19, 2013); Guzman v. United States, No. S-93-1949, slip op. at 3-5 (E.D. Cal. Oct. 5, 1994); Hass v. Air Force, 848 F. Supp. 926, 930 (D. Kan. 1994); Gergick v. Austin, No. 89-0838-CV-W-2, 1992 U.S. Dist. LEXIS 7338, at *13-16 (W.D. Mo. Apr. 29, 1992), aff’d, No. 92-3210 (8th Cir. July 9, 1993); Wood v. IRS, No. 1:90-CV-2614, 1991 U.S. Dist. LEXIS 19707, at *8 (N.D. Ga. July 26, 1991); Searcy v. SSA, No. 91-C-26 J, slip op. at 8-11 (D. Utah June 25, 1991) (magistrate’s recommendation), adopted, (D. Utah Sept. 19, 1991), aff’d, No. 91-4181, 956 F.2d 278 (10th Cir. 1992) (unpublished table decision); Crooker v. Marshals Serv., 577 F. Supp. 1217, 1217-18 (D.D.C. 1983); Lilienthal v. Parks, 574 F. Supp. 14, 18 & n.7 (E.D. Ark. 1983); Gibbs v. Rauch, No. 77-59, slip op. at 2-3 (E.D. Ky. Feb. 9, 1978); Larsen v. Hoffman, 444 F. Supp. 245, 256 (D.D.C. 1977); cf. Banks v. DOJ, 605 F. Supp. 2d 131, 139 (D.D.C. 2009) (concluding that plaintiff failed to exhaust administrative remedies with respect to instant request because he did not pay record duplication fees for earlier request); Nurse v. Sec’y of the Air Force, 231 F. Supp. 2d 323, 331 (D.D.C. 2002) (“[W]hile the FOIA requires that a request must ‘[reasonably] describe’ the records, Privacy Act requests require greater specificity.”); but see Clutter v. Perdue, No. H-18-310, 2019 WL 1589942, at *7 (S.D. Tex. Jan. 28, 2019) (allowing plaintiff’s claim to proceed without explicitly considering his compliance with agency requirements because he sufficiently pled that he submitted a FOIA/Privacy Act request for records but that the request was not acknowledged and that records were not produced).

In access suits, plaintiffs generally must file an administrative appeal to exhaust administrative remedies.

The courts also generally have dismissed a plaintiff’s complaint for failure to exhaust administrative remedies if the plaintiff did not file an administrative appeal to an agency’s denial of the access request.  See Lopez v. NARA, 301 F. Supp. 3d 78, 90 (D.D.C. 2018) (dismissing plaintiff’s Privacy Act claim for failure to exhaust administrative remedies where plaintiff “never internally appealed NARA’s determination, and plaintiff never sent a proper request to CIA”); Kearns v. FAA, 312 F. Supp. 3d 97, 107 (D.D.C. 2018) (finding that because plaintiff “did not appeal the FAA’s determination regarding his November 2015 Privacy Act request, Kearns did not pursue the full extent of his administrative remedies”); Varad v. United States Dep’t of Treasury, No. 18-91338-RGS, 2018 WL 3849861, at *2 (D. Mass. Aug. 13, 2018) (dismissing plaintiff’s complaint because her access requests were submitted to agency less than 30 days ago, suggesting that requester had not yet filed or completed appeal); Barouch v. DOJ, 422 F. Supp. 2d 30, 67-68 (D.D.C. 2013); Yee v. Solis, No. C-08-4259, 2010 WL 1655816, at *14 (N.D. Cal. Apr. 22, 2010), aff’d on other grounds, No. 10-16376, 2012 WL 902895 (9th Cir. Mar. 19, 2012); Gadd, 2010 WL 60953, at *12; Bettweiser v. Lucas, No. 06-CIV-0142, 2007 WL 2601089, at *2 (D. Idaho Sept. 10, 2007); Clemmons v. DOJ, No. 06-00305, 2007 WL 1020796, at *5 (D.D.C. Mar. 30, 2007); Sussman v. DOJ, No. 03-3618, 2006 WL 2850608, at *5 (E.D.N.Y. Sept. 30, 2006); Glenn v. Rumsfeld, No. C 05-01787, 2006 WL 515626, at *6-7 (N.D. Cal. Feb. 28, 2006); Biondo v. Navy, 928 F. Supp. 626, 630-33 (D.S.C. 1995), aff’d, 86 F.3d 1148 (4th Cir. 1996) (unpublished table decision); Hass v. Air Force, 848 F. Supp. 926, 930 (D. Kan. 1994); cf. Ramstack, 607 F. Supp. 2d at 104 (holding defendant bears burden of proving affirmative defense of failure to exhaust administrative remedies).  But see Fischer v. FBI, No. 07-2037, 2008 WL 2248711, at *2 (D.D.C. May 29, 2008) (excusing failure to file administrative appeal where agency had previously remanded request on administrative appeal and requester apparently did not understand that he had to file second appeal after agency reprocessed the request); Mumme v. Labor, 150 F. Supp. 2d 162, 171 (D. Me. 2001) (refusing to “strictly apply formalistic procedural rules against [p]laintiff” because “[p]rocedural rules . . . cut both ways,” and it was not clear that agency’s response letter “included any written explanation of the partial grant of [p]laintiff’s appeal as required by [its] regulation”), aff’d, No. 01-2256 (1st Cir. June 12, 2002).

An agency’s failure to meet its own deadlines does not constructively exhaust an individual’s administrative remedies.

The Court of Appeals for the Fourth Circuit and several district courts have noted that an individual cannot “constructively exhaust” administrative remedies under the Privacy Act – i.e., deem that administrative remedies are exhausted where the agency failed to timely respond – because “the Privacy Act contains no equivalent to FOIA’s ‘constructive exhaustion’ provision [5 U.S.C. § 552(a)(6)(C)].”  Pollack v. DOJ, 49 F.3d 115, 116 n.1, 118-19 (4th Cir. 1995) (indicating that only FOIA claim was properly before district court because “Privacy Act contains no equivalent to FOIA’s ‘constructive exhaustion’ provision which . . . enabled the district court to review his FOIA request”); see also Kearns v. FAA, 312 F. Supp. 3d at 107 (D.D.C. 2018) (concluding that although plaintiff argued that he “‘constructively exhausted’ his Privacy Act claims, . . . the law is clear that such a route to exhaustion is not available under the statute”); Gadd, 2010 WL 60953, at *12 (citing Pollack and dismissing access claim for failure to exhaust administrative remedies); Barouch v. DOJ, 962 F. Supp. 2d at 68 (stating that no equivalent constructive exhaustion provision exists under Privacy Act and finding “that plaintiff failed to exhaust his administrative remedies with respect to his [Privacy Act] request to EOUSA” and accordingly, court lacked subject matter jurisdiction); Sussman v. DOJ, No. 03-3618, 2006 WL 2850608, at *5 (E.D.N.Y. Sept. 30, 2006) (“The Privacy Act . . . does not allow for ‘constructive exhaustion,’ and prohibits a requester from filing an action without having obtained a response from the agency.”); Anderson v. USPS, 7 F. Supp. 2d 583, 586 n.3 (E.D. Pa. 1998) (citing Pollack for proposition that “Privacy Act contains no section equivalent to the ‘constructive exhaustion’ provision of the FOIA,” but alternatively finding that access suit must be dismissed for failure to exhaust administrative remedies), aff’d, 187 F.3d 625 (3d Cir. 1999) (unpublished table decision); cf. Johnson v. FBI, No. 94-1741, slip op. at 6 (D.D.C. Aug. 31, 1995) (citing Pollack but determining that “since plaintiff has sought an action in equity, and has not exhausted his administrative remedies through administrative appeal . . . plaintiff is barred from seeking injunctive relief under the Privacy Act”). 

An agency’s failure to comply with its own regulations, however, can undercut an exhaustion defense.  See Jonsson v. IRS, No. 90-2519, 1992 WL 115607, at *1 (D.D.C. May 4, 1992); Haldane v. Comm’r, No. 90-654M, 1990 U.S. Dist. LEXIS 11612, at *4-6 (W.D. Wash. Aug. 23, 1990).

 

2. Standard and Scope of Review

Access suits are reviewed in the federal courts de novo.

The civil remedies subsection for access suits establishes parameters for such suits, including the standard of judicial review.  In civil actions for access, courts “shall determine the matter de novo.”  5 U.S.C. § 552a(g)(3)(A).  See Doe v. United States, 821 F.2d 694, 697-98 (D.C. Cir. 1987) (en banc); Barouch v. DOJ, 87 F. Supp. 3d 10, 32 (D.D.C. 2015).  Courts may review records in camera to determine whether any of the exemptions set forth in subsection (k) apply.  See 5 U.S.C. § 552a(g)(3)(A).  Furthermore, in Privacy Act access cases, courts may rely on agency affidavits or declarations to enter summary judgment in favor of the government, e.g., an affidavit describing search terms and type of search performed to demonstrate that agency conducted an adequate search.  Elgabrowny v. CIA, No. 17-CV-00066, 2019 WL 1440345 (D.D.C. Mar. 31, 2019) (citing Chambers v. Interior, 568 F. 3d 998, 1003 (D.C. Cir. 2009)).  For more detailed discussions of these topics, see “Individual’s Right of Access” section above and “Ten Exemptions, Seven Specific Exemption Rules Agencies May Promulgate” section below.

Once an agency provides the requested records, any pending access claim is moot.  

Several courts have recognized that jurisdiction to consider a Privacy Act access claim exists only if the government has failed to comply with a request for records; once a request is complied with and the responsive records have been disclosed, a Privacy Act access claim is moot.  See Jackson v. Shinseki, 526 F. App’x 814, 817 (10th Cir. 2013) (affirming district court’s decision that plaintiff’s claim was moot because “defendants had ‘provided [appellant] with copies of all responsive documents in their possession,’ thus agency was ‘discharg[ed]of their obligations under the Privacy Act’”); Campbell v. SSA, 446 F. App’x 477, 480 (3d Cir. 2011); Yonemoto v. VA, 305 F. App’x 333, 334 (9th Cir. 2008); Lovell v. Alderete, 630 F.2d 428, 430 (5th Cir. 1980) (dismissing both FOIA and Privacy Act claims as moot where “[e]ven though the information [plaintiff sought] was delivered late, [plaintiff] now has all of the information he requested”); Crummey v. SSA, 794 F. Supp. 2d 46, 61 (D.D.C. June 30, 2011), aff’d per curiam, No. 11-5231, 2012 WL 556317 (D.C. Cir. Feb. 6, 2012); Dickerson v. SSA, No. A-10-CA-795-SS, 2011 WL 1332426, at *4 (W.D. Tex. June 8, 2011); Sterrett, 2010 WL 330086, at *2-3; Jordan v. DOJ, No. 07-cv-02303, 2009 WL 2913223, at *26 (D. Colo. Sept. 8, 2009); Van Allen v. HUD, No. G-07-315, 2009 WL 1636303, at *1 (S.D. Tex. June 9, 2009); Falwell v. Exec. Office of the President, 158 F. Supp. 2d 734, 740 (W.D. Va. 2001); Mumme, 150 F. Supp. 2d at 171-72; Fisher v. FBI, 94 F. Supp. 2d 213, 216 (D. Conn. 2000) (finding that plaintiff’s claim was moot where agency provided material and that “[t]he fact that the records came after some delay is not necessarily tantamount to an improper denial of the records”); Jacobs v. Reno, No. 3:97-CV-2698-D, 1999 U.S. Dist. LEXIS 3104, at *14-15 (N.D. Tex. Mar. 11, 1999) (dismissing access claim as moot where plaintiff had received access to records and finding no eligibility for award of attorney fees and costs based on plaintiff’s assertion that his lawsuit may have caused agency to comply with Privacy Act when it would not otherwise have done so, “particularly when § 552a(d)(1) imposes no deadline for agency compliance and absent evidence of extended and unjustified delay”), aff’d, 208 F.3d 1006 (5th Cir. 2000) (unpublished table decision) Biondo, 928 F. Supp. at 631; Letscher v. IRS, No. 95-0077, 1995 WL 555476, at *1 (D.D.C. July 6, 1995); Polewsky v. SSA, No. 5:93-CV-200, slip op. at 9-10 (D. Vt. Mar. 31, 1995) (magistrate’s recommendation), adopted, (D. Vt. Apr. 13, 1995), aff’d, No. 95-6125, 1996 WL 110179, at *2 (2d Cir. Mar. 12, 1996); Smith v. Cont’l Assurance Co., No. 91 C 0963, 1991 WL 164348, at *3 (N.D. Ill. Aug. 22, 1991); cf. Riser v. State, No. 09-3273, 2010 WL 4284925, at *7 (S.D. Tex. Oct. 22, 2010) (dismissing claim “seek[ing] a declaratory judgment that the agencies’ earlier withholding of his records . . . was improper” as moot “because the documents have now been produced”); Yee, 2010 WL 1655816, at *14 (asserting that Privacy Act claim for access was moot where magistrate judge in prior order had found that agency complied with his order to produce the record at issue to plaintiff).

Some courts have required plaintiffs to allege that an agency’s failure to provide access was improper, not simply that the request was denied.

To maintain an access lawsuit under subsection (g)(1)(B), the plaintiff must allege not only that access was requested and denied, but also that the denial or failure to act on the request was improper.  See Camper v. NSA, No. 1:18-cv-01794-PWG, 2019 WL 3841940, at *5 (D. Md. Aug. 15, 2019) (holding that plaintiff failed to allege what was improper about agency’s stated legal grounds for denial, citing Singh v. DHS, No. 12-498-AWI, 2014 WL 67254, at *4 (E.D. Cal. Jan. 8, 2014), Biondo, 928 F. Supp. at 631 (D.S.C. 1995), and Bruan v. Agency, No. 15-18-H-DLC-JTJ, 2015 WL 12591720, at *1 (D. Mont. Oct. 30, 2015)); Fleischman v. Comm’r of Soc. Sec., No. 3:15-CV-897-J-PDB, 2016 WL 7474577 (M.D. Fla. Dec. 29, 2016); cf. Beach v. DHS, No. CV 08–00420–RGK, 2008 WL 11337801, at *2 (C.D. Cal. Sept. 2, 2008) (plaintiff sufficiently stated claim for relief under subsection (g)(1)(B) by alleging that agency refused to disclose documents after multiple requests).

Most courts have considered access to tax records under the Internal Revenue Code, rather than the Privacy Act.

The Court of Appeals for the District of Columbia Circuit has ruled that “the specific provisions of [26 U.S.C.] § 6103 rather than the general provisions of the Privacy Act govern the disclosure of . . . tax information” and that “individuals seeking ‘return information’ . . . must do so pursuant to § 6103 of the Internal Revenue Code, rather than the Privacy Act.”  Lake v. Rubin, 162 F.3d 113, 115-16 (D.C. Cir. 1998).  In reaching this conclusion, the D.C. Circuit looked to the legislative history of § 6103 and embraced an earlier ruling by the Court of Appeals for the Seventh Circuit, Cheek v. IRS, 703 F.2d 271, 272 (7th Cir. 1983) (per curiam), that similarly had held that § 6103 “displaces” the Privacy Act and shields tax return information from release to a first-party requester.  See also Kendrick v. Wayne Cnty., No. 10-13752, 2011 WL 2580675, at *1-2 (E.D. Mich. June 29, 2011); Paige v. IRS, No. 1P-85-64-C, slip op. at 3-4 (S.D. Ind. Jan. 13, 1986); cf. Maxwell v. O’Neill, No. 00-01953, 2002 WL 31367754, at *4 (D.D.C. Sept. 12, 2002) (“while [section] 6103 may supersede the Privacy Act, it does not supersede the FOIA”), aff’d, No. 04-5082 (D.C. Cir. May 27, 2005).  But cf. Sinicki v. Treasury, No. 97 CIV. 0901, 1998 WL 80188, at *3-5 (S.D.N.Y. Feb. 24, 1998) (finding Cheek unpersuasive in context of wrongful disclosure claim and denying motion to dismiss Privacy Act claim, stating that “the language, structure, purpose and legislative history of Section 6103 do not make manifest and clear a legislative intent to repeal the Privacy Act as it applies to tax return information”).

The Court of Appeals for the Ninth Circuit has interpreted 26 U.S.C. § 7852(e) to likewise prevent Privacy Act access to records pertaining to tax liability.  Jacques v. IRS, 972 F.2d 1339 (unpublished disposition), 1992 WL 185449, at *2 (9th Cir. Aug. 5, 1992); O’Connor v. United States, No. 89-15321, slip op. at 5 (9th Cir. June 4, 1991); see also Prince v. Comm’r, No. 98-17183, 1999 WL 511185, at *1 (9th Cir. July 15, 1999) (concluding that district court lacked subject matter jurisdiction over claim for attorney fees in Privacy Act suit for access to tax return records due to 26 U.S.C. § 7852(e)’s prohibition against application of subsection (g) of Privacy Act to determinations of tax liability); Hart v. United States, No. 00-2158, 2000 WL 1727737, at *1-2 (E.D. Pa. Sept. 27, 2000) (following Maxwell v. Rubin, infra, and dismissing access claim for lack of subject matter jurisdiction for records relating, “directly and indirectly, to tax disputes with the IRS concerning liability,” because although § 7852(e) does not exempt the IRS from the access provision, it does exempt it from the civil remedy provision), aff’d, 275 F.3d 35 (3d Cir. 2001) (unpublished table decision); Weiss v. Sawyer, 28 F. Supp. 2d 1221, 1227-28 (W.D. Okla. 1997) (applying 26 U.S.C. § 7852 to prevent apparent access claim); cf. Baker v. Matson, No. 98 M 1675, 1998 U.S. Dist. LEXIS 21312, at *8-9 (D. Colo. Dec. 7, 1998) (ruling that court had no jurisdiction over Privacy Act access claim) (magistrate’s recommendation), adopted, No. 98 M 1675, 1999 WL 521287 (D. Colo. Jan. 12, 1999).  The Ninth Circuit’s rationale differs from the rationale applied by the D.C. Circuit, however.  Cf. Lake v. Rubin, 162 F.3d at 114-16 (affirming judgments of district court “not on the jurisdictional rationale contained in” opinions in the Ninth Circuit based on § 7852, which the D.C. Circuit questioned, but instead on the basis of 26 U.S.C. § 6103, which provides the exclusive means by which individuals may obtain their tax records); Wood v. IRS, No. 1:90-CV-2614, 1991 U.S. Dist. LEXIS 19707, at *1, 8 (N.D. Ga. July 29, 1991) (denying plaintiff summary judgment on its Privacy Act claim for access to tax records, based on plaintiff’s failure to exhaust remedies, without addressing whether court had jurisdiction to review the claim in light of § 7852 or § 6103).

 

3. Remedies

Courts can order agencies to produce the requested records; monetary damages, however, are not available in access cases.

In access lawsuits, courts can enjoin the agency from withholding records and order their production to the individual.  See 5 U.S.C. § 552a(g)(3)(A); Kursar v. Transportation Sec. Admin., 581 F. Supp. 2d 7, 19 (D.D.C. 2008) (citing Doe v. Stephens, 851 F.2d 1457, 1463 (D.C. Cir. 1988)); Dick v. Holder, 67 F. Supp. 3d 167, 187 (D.D.C. 2014) (citing, inter alia, Kursar).

Lastly, damages are not recoverable in an access case.  See Benoist v. United States, No. 87-1028, slip op. at 3 (8th Cir. Nov. 4, 1987); Thurston v. United States, 810 F.2d 438, 447 (4th Cir. 1987); Kvech, 2011 WL 4369452, at *8 n.13; Brown v. DOJ, No. 02-2662, slip op. at 27 (D. Ala. June 21, 2005); Haddon v. Freeh, 31 F. Supp. 2d 16, 22 (D.D.C. 1998); Vennes v. IRS, No. 5-88-36, slip op. at 6-7 (D. Minn. Oct. 14, 1988) (magistrate’s recommendation), adopted, (D. Minn. Feb. 14, 1989), aff’d, No. 89-5136MN, 890 F.2d 419 (8th Cir. 1989) (unpublished table decision); Bentson v. Comm’r, No. 83-048-GLO-WDB, slip op. at 2 (D. Ariz. Sept. 14, 1984); see also Quinn v. HHS, 838 F. Supp. 70, 76 (W.D.N.Y. 1993) (citing Thurston in dictum).  But cf. Beattie v. Astrue, 845 F. Supp. 2d 184, 195 (D.D.C. 2012) (ruling that plaintiff “failed to make out a claim under the Privacy Act” because agency’s responses did not meet the intentional and willful standard); Robinson v. Watkins, No. 4:11cv89, 2011 WL 6029969, at *5 (E.D. Va. Oct. 13, 2011) (“The relief provided [under the Privacy Act] is that the plaintiff will be given access to the record, and for monetary damages if an agency’s persistent refusal to allow access is ‘intentional and willful.’”); Riser, 2010 WL 4284925, at *7 (“Plaintiff’s factual assertions about his repeated Privacy Act requests and the delay in receiving records are insufficient to raise an inference of willful or intentional withholding of records about him.”); Fischer v. DOJ, 723 F. Supp. 2d 104, 115 (D.D.C. 2010) (refusing to award damages on ground that agency “neither inappropriately withheld information nor acted in bad faith” where plaintiff sought damages pursuant to subsection (g)(1)(D) in connection with his access request).

C. 5 U.S. § 552a(g)(1)(C) - Damages Lawsuits for Failure to Assure Fairness in Agency Determination

“Whenever any agency . . . fails to maintain any record concerning any individual with such accuracy, relevance, timeliness, and completeness as is necessary to assure fairness in any determination relating to the qualifications, character, rights, or opportunities of, or benefits to the individual that may be made on the basis of such record, and consequently a determination is made which is adverse to the individual . . . the individual may bring a civil action against the agency.”  5 U.S.C. § 552a(g)(1)(C).

Comment:

Subsection (g)(1)(C) allows individuals to sue an agency for failure to maintain records with such “accuracy, relevance, timeliness, and completeness” as is necessary to assure fairness in agency determinations.

This section provides a civil remedy against an agency that does not maintain its records in accordance with the requirements of section (e)(5) of the Privacy Act.  The standard for maintaining records under this provision is identical to the standard under subsection (e)(5), which requires agencies to maintain records used in making determinations about individuals “with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the determination.”  See, e.g., Bettersworth v. FDIC, 248 F.3d 386, 390 n.3 (5th Cir. 2001) (explaining that the “statutory obligation” imposed by subsection (e)(5) “is made enforceable by substantively identical language in subsection 552a(g)(1)(C)”); Doe v. United States, 821 F.2d 694, 698 n.10 (D.C. Cir. 1987) (en banc) (concluding that agency record met accuracy standard although subsection (e)(5) “uses the phrase ‘reasonably necessary to assure fairness’ whereas subsection (g)(1)(C)] does not include the word ‘reasonably.’  We attribute no substantive significance, for the issue at hand, to the omission of the word ‘reasonably’ in § 552a(g)(1)(C).”); Gard v. Dep’t of Educ., 789 F. Supp. 2d 96, 106 (D.D.C. 2011) (explaining that claim alleging violation of subsection (e)(5) “is entirely duplicative” of claim alleging violation of subsection (g)(1)(C) because “[c]laims predicated upon violations of Section 552a(e)(5) . . . must be brought under 552a(g)(1)(C)”).

The key element of the standard – the necessity ‘to assure fairness in any determination’ – calls for a balanced judgment, one inherently involving a reasonableness criterion.  Edison v. Army, 672 F.2d 840, 843 (11th Cir. 1982) (concluding that although it “must be read in pari materia with subsection (e)(5),”  “[i]f the court determines that the agency has done what is reasonable in assuring the accuracy of the information, no more is required.”).

Assuming that an individual meets the requirements for establishing an agency’s failure to maintain a record concerning an individual with “accuracy, relevance, timeliness, and completeness,” “actual damages” sustained by the individual, but in no case less than $1000, are recoverable.  See 5 U.S.C. § 552a(g)(4)(A).  The meaning of “actual damages” and the $1000 minimum recovery provision are discussed below under “Principles Applicable to Damages Lawsuits, Actual Damages.”

 

1. Exhaustion of Administrative Remedies

Most courts have concluded that plaintiffs are not required to exhaust administrative remedies to obtain damages under (g)(1)(C).

Most courts have concluded that exhaustion of administrative remedies is not a prerequisite to a civil action for damages under subsection (g)(1)(C).  For example, in  Hewitt v. Grabicki, 794 F.2d 1373, 1379 (9th Cir. 1986), the Ninth Circuit contrasted subsection “(g)(1)(A) (action for order to amend record permitted when agency review resulted in denial of request or agency refused to review)” with subsection “(g)(1)(C) (permits action where agency’s failure to maintain proper records results in adverse determination against individual)” to conclude that “[e]xhaustion of administrative remedies is not a precondition to bringing an action for damages under the Privacy Act.”  Phillips v. Widnall, No. 96-2099, 1997 WL 176394, at *2-3 (10th Cir. Apr. 14, 1997); Hubbard v. EPA, 809 F.2d 1, 7 (D.C. Cir. 1986), vacated in nonpertinent part & reh’g en banc granted (due to conflict within circuit), 809 F.2d 1 (D.C. Cir. 1986), resolved on reh’g en banc sub nom. Spagnola v. Mathis, 859 F.2d 223 (D.C. Cir. 1988); Nagel v. HEW, 725 F.2d 1438, 1441 & n.2 (D.C. Cir. 1984); Johnson v. Air Force, No. CV F 09-0281, 2010 WL 1780231, at *6 (E.D. Cal. Apr. 30, 2010) (citing Hewitt), aff’d on other grounds, 465 F. App’x 644 (9th Cir. 2012); Reitz v. USDA, No. 08-4131, 2010 WL 786586, at *11 n.12 (D. Kan. Mar. 4, 2010); Murphy v. United States, 121 F. Supp. 2d 21, 28 (D.D.C. 2000), aff’d per curiam, 64 F. App’x 250 (D.C. Cir. 2003); M.K. v. Tenet, 99 F. Supp. 2d 12, 20 (D.D.C. 2000) (quoting Nagel); Gergick v. Austin, No. 89-0838-CV-W-2, 1992 U.S. Dist. LEXIS 7338, at *13-16 (W.D. Mo. Apr. 29, 1992), aff’d, No. 92-3210 (8th Cir. July 9, 1993).

A few other courts have found otherwise, however, requiring plaintiff to exhaust administrative remedies before bringing an (e)(5) claim under (g)(1)(C).  Moore v. Potter, No. 3:04-CV-1057, 2006 WL 2092277, at *8 (M.D. Fla. July 26, 2006); see, e.g., Olivares v. NASA, 882 F. Supp. 1545, 1546, 1552 (D. Md. 1995) (concluding that plaintiff’s failure to exhaust administrative remedies precludes damages claim under subsection (e)(5)), aff’d, 103 F.3d 119 (4th Cir. 1996) (unpublished table decision); Graham v. Hawk, 857 F. Supp. 38, 40 (W.D. Tenn. 1994) (stating that “[e]ach paragraph of 5 U.S.C. § 552a(g) . . . requires as a prerequisite to any action that the agency refuse an individual’s request to take some corrective action regarding his file”), aff’d, 59 F.3d 170 (6th Cir. 1995) (unpublished table decision).

A provision of the Prison Litigation Reform Act of 1996 (“PLRA”), 42 U.S.C. § 1997e(a) (2018), requires inmates to exhaust administrative remedies prior to bringing an “action . . . with respect to prison conditions,” which may include accuracy of records and requests for correction.  42 U.S.C. § 1997e(a).  However, when the inmate seeks remedies concerning accuracy pursuant to subsection (e)(5)/(g)(1)(C) and correction of records under (d)(2) in a system of records that maintains exemptions of (e)(5) and (d)(2), this provision of the PLRA has minimal practical effect.  See Barnett v. United States, 195 F. Supp. 3d 4, 8 (D.D.C. 2016) (any claims for correction of alleged erroneous information contained in an inmate’s central file, including presentence reports, fails because BOP has exempted its Inmate Central Record System from Privacy Act’s (e)(5) accuracy and (d)(2) amendment requirements under (j)(2), 28 C.F.R. § 16.97(j)).  But cf. McCulough v. BOP, No. 1:06-cv-00563, 2011 WL 3568800, at *3-4 (E.D. Cal. Aug. 12, 2011) (recommending dismissal of claim that “BOP violated the Privacy Act through its maintenance of inaccurate records and use of those records as the basis for decisions that adversely affected Plaintiff” on ground that plaintiff failed to satisfy exhaustion requirement of PLRA) (magistrate’s recommendation), adopted, 2011 WL 4373939 (E.D. Cal. Sept. 19, 2011).  For a discussion of the exhaustion requirement imposed by the PLRA on claims for damages brought by prisoners under subsection (g)(1)(D), see the discussion below under “5 U.S.C. § 552a(g)(1)(C) - Damages Lawsuits for Failure to Comply with Other Privacy Act Provisions.”

 

2. Elements of a Damages Claim

In a suit for damages under subsection (g)(1)(C), an individual has the burden of proving that: (1) he or she “has been aggrieved by an adverse determination”; (2) the agency “failed to maintain his or her records with the degree of accuracy necessary to assure fairness in the determination”; (3) the agency’s “reliance on the inaccurate records was the proximate cause of the adverse determination”; and (4) the agency “acted intentionally or willfully in failing to maintain accurate records.”  Deters v. U.S. Parole Comm’n, 85 F.3d 655, 657 (D.C. Cir. 1996). 

In most cases, courts have found that plaintiffs have not met one or more of these elements and, therefore, were not entitled to damages

 

a. First Element:  Aggrieved by Adverse Determination

Considering the first requirement for a damages suit under subsection (g)(1)(C), the courts often have concluded that the plaintiff was not “aggrieved” or that the agency action at issue did not constitute an “adverse determination.”  See, e.g., Bettersworth v. FDIC, 248 F.3d 386, 392-93 (5th Cir. 2001) (holding that Federal Reserve Bank letter informing company that its application was unlikely to be approved did not constitute “adverse determination” against plaintiff because there were “diverse grounds relied upon in the Reserve Bank’s letter,” entity applying was company, not plaintiff, and “informal oral or written statements made in the deliberative process about a particular administrative determination do not constitute the determination itself”); Jarrell v. Army Review Bd. Agency, No. 3:19-CV-00349, 2020 WL 2128612, at *3 (S.D. Ohio May 5, 2020), report and recommendation adopted sub nom. Jarrell v. Army Review Boards Agency, No. 3:19-CV-00349, 2020 WL 2909969 (S.D. Ohio June 3, 2020) (plaintiff did not establish that he was “aggrieved” by inaccuracy in brother’s record because under subsection 552a(g)(1)(C), “only ‘the individual’ with inaccurate records who has suffered an adverse determination may bring a § 552a(g)(1)(C) action”); Yusim v. SSA, 406 F. Supp. 3d 194, 196 (E.D.N.Y. 2018) (finding that SSA’s allegedly inaccurate listing of claimant’s application date for benefits did not violate his Privacy Act rights, where he did not claim that failure to maintain accurate records was done intentionally or willfully or that he suffered adverse determination); Melvin v. SSA, 126 F. Supp. 3d 584, 606 (E.D.N.C. 2015) (dismissing plaintiff’s (g)(1)(C) claim because there was “no adverse agency determination resulting from the SSA’s alleged failure to maintain the September 29, 2010, appeal letter” and no decision had been made by SSA with regard to plaintiff’s benefits); Scott v. Conley, 937 F. Supp. 2d 60, 78 (D.D.C. 2013) (dismissing plaintiff’s Privacy Act claim for failure to allege “some adverse effect,” because plaintiff “has not alleged facts to show that she has suffered or is suffering any adverse determination or effect because of BOP’s alleged failure to comply with the requirement that it collect only ‘relevant and necessary’ information”); Elliott v. BOP, 521 F. Supp. 2d 41, 56 (D.D.C. 2007) (“The fact that Plaintiff was kept at [a particular institution] during [the period during which plaintiff alleged that BOP relied upon inaccurate or incomplete medical records] does not mean that the BOP actually made a ‘determination’ to do so.”); Lee v. Geren, 480 F. Supp. 2d 198, 209-10 (D.D.C. Mar. 29, 2007) (concluding that “mere issuance of a notice of proposed termination does not constitute an ‘adverse determination’ under the Privacy Act” and that “[t]he only ‘adverse determination’ at issue in this case is plaintiff’s fourteen-day suspension,” where plaintiff received notice of proposed termination but was only suspended for two weeks); but see, e.g., Perry v. BOP, 371 F.3d 1304, 1305 (11th Cir. 2004) (relying on Ninth Circuit’s formulation of elements necessary for Privacy Act claim under (g)(1)(C) in Rose v. United States, 905 F.2d 1257, 1259 (9th Cir. 1990), and concluding plaintiffs had alleged necessary elements to state claim, vacating district’s court decision and remanding for district court to consider complaint under Privacy Act); Toolasprashad v. BOP, 286 F.3d 576, 583-86 (D.C. Cir. 2002) (holding that transfer of prisoner in alleged retaliation for exercise of his First Amendment rights constitutes assertion of “adverse determination” under Privacy Act, sufficient to “survive [agency’s] motion to dismiss”); Fleck v. VA OIG, No. CV 18-1452, 2020 WL 42842, at *6-8 (D.D.C. Jan. 3, 2020) (denying VA’s motion to dismiss where second agency’s decision not to hire plaintiff was adverse action, plaintiff sufficiently alleged factual inaccuracies in OIG report, and inaccuracies led to second agency’s failure to hire him).

b. Second Element:  Failure to Maintain Accurate, Relevant, Timely and/or Complete Records

Similarly, courts rarely have concluded that an agency failed to maintain accurate records.  See, e.g., Jones v. Luis, 372 F. App’x 967, 969-70 (11th Cir. 2010) (per curiam) (ruling that district court properly dismissed Privacy Act claim where plaintiff “does not allege any errors in the BOP’s record keeping” but rather merely “alleges that [a BOP official] misused the information in the records to make an adverse determination against” plaintiff);  Treadwell v. BOP, 32 F. App’x 519, 520-21 (10th Cir. 2002) (finding plaintiff’s claim that BOP erroneously based his security classification in part on nonviolent juvenile robbery offense does not amount to violation of Privacy Act where plaintiff agreed that conviction accurately appeared on his record but disagreed with way BOP used that information); Williams v. BOP, No. 94-5098, 1994 WL 676801, at *1 (D.C. Cir. Oct. 21, 1994) (asserting appellant did not establish either that agency “maintained an inaccurate record or that it made a determination adverse to him in reliance on inaccurate information capable of verification, the statutory prerequisites to maintaining an action pursuant to the Privacy Act”); Hadley v. Moon, No. 94-1212, 1994 WL 582907, at *1-2 (10th Cir. Oct. 21, 1994) (finding plaintiff must allege actual detriment or adverse determination in order to maintain claim under Privacy Act); Ashbourne v. Hansberry, No. 12-cv-01153302, 2015 WL 11303198, at *7-9 (D.D.C. Nov. 25, 2015) (finding that plaintiff failed to allege claim under subsection (g)(1)(C) since plaintiff did not present evidence of a single inaccurate record relied upon by agency when reviewing misleading information provided by plaintiff during pre-employment process), aff’d, 703 F. App’x. 3 (D.C. Cir. 2017); Doe v. Rogers, 139 F. Supp. 3d 120, 168 (D.D.C. 2015) (dismissing plaintiff’s (g)(1)(C) claim because “only agency ‘decision’ that arguably meets this definition [of an adverse agency determination] is the Secretarial Review Decision, but, again, the plaintiffs have not identified any inaccurate agency report that the Secretary relied on to reach that decision”); Cross v. Potter, No. 3:09-CV-1293, 2013 WL 1149525, at *9 (N.D.N.Y. Mar. 19, 2013) (dismissing plaintiff’s claim under § 552a(g)(1)(C) because “[t]he record of a criminal acquittal is not an inaccuracy within her record simply because [p]laintiff believes that the criminal charge was improperly brought against her”); Kvech v. Holder, No. 10-cv-545, 2011 WL 4369452, at *5-6 (D.D.C. Sept. 19, 2011) (although plaintiff “pled facts sufficient to show she was aggrieved by an adverse determination and the FBI acted intentionally,” she “failed to plead facts which might establish” (1) “FBI failed to ‘assure fairness’ by maintaining inaccurate records; and (2) reliance on the inaccurate records was the ‘proximate cause’ of the adverse determination”); Feldman v. CIA, 797 F. Supp. 2d 29, 44-47 (D.D.C. 2011) (dismissing plaintiff’s (g)(1)(C) claim because plaintiff failed to set forth that agency failed to maintain records with degree necessary to assure fairness in CIA director’s determination, and because plaintiff primarily focused on disagreement with interpretation of legal issues rather than factual errors); Hollins v. Cross, No. 1:09cv75, 2010 WL 1439430, at *5 (N.D. W. Va. Mar. 17, 2010) (“[B]ecause the plaintiff has failed to show that his [presentence investigation report] is actually erroneous, he cannot show that the BOP’s use of that document to make . . . administrative decisions, has had an adverse effect on him.”); Ramirez v. DOJ, 594 F. Supp. 2d 58, 66-67 (D.D.C. 2009) (dismissing plaintiff’s (g)(1)(C) complaint because plaintiff failed to show the records held by defendants were inaccurate), aff’d per curiam on other grounds, No. 10-5016, 2010 WL 4340408 (D.C. Cir. Oct. 19, 2010); Doe v. DOJ, 660 F. Supp. 2d 31, 43 (D.D.C. 2009) (concluding that plaintiff “failed to show that there was an error in the records” by objecting only to “misinterpretation of [accurate] records by DOJ employees, for which there is no remedy under the Privacy Act”); De la Cruz-Jimenez v. DOJ, 566 F. Supp. 2d 7, 9-10 (D.D.C. 2008) (finding that plaintiff failed to establish the threshold requirement of an inaccurate record, thus dismissing plaintiff’s (g)(1)(C) claim); but see, e.g., Perry, 371 F.3d at 1305 (finding plaintiffs had alleged necessary elements to state claim, vacating district’s court decision and remanding for district court to consider complaint under Privacy Act); Fleck v. VA OIG, 2020 WL 42842, at *6-8 (denying VA’s motion to dismiss where second agency’s decision not to hire plaintiff was adverse action, plaintiff sufficiently alleged factual inaccuracies in OIG report, and inaccuracies led to second agency’s failure to hire him); Ashbourne v. Hansberry, 302 F. Supp. 3d 338, 347 (D.D.C. 2018) (finding that plaintiff properly pled in her complaint that defendant DHS failed to maintain accurate records when it intentionally and deliberatively failed to verify facts in deciding to terminate plaintiff’s federal employment).

Most cases brought under (g)(1)(C) involve the “accuracy” standard, but the D.C. District Court allowed a case to proceed under the “relevance” component.

Although most litigation pursuant to sections (e)(5)/(g)(1)(C) of the Privacy Act arises from challenges to the accuracy component of the “accuracy, relevance, timeliness, and completeness” standard, the District Court for the District of Columbia has considered a claim alleging irrelevancy.  In Gerlich v. DOJ, the court noted that “[m]ost ‘adverse determination’ claims hinge on inaccurate or incomplete records.”  659 F. Supp. 2d 1, 15 (D.D.C. 2009), aff’d in part, rev’d in part, 711 F.3d 161, 163 (D.C. Cir. 2013).  Here, however, the plaintiffs alleged that “irrelevant records (i.e., the records of their First Amendment activities) led to an adverse [hiring] determination against them.”  Id.  In denying the Department’s motion to dismiss, the court stated:  “By the plain language of (g)(1)(C), relevance stands on equal footing with accuracy, timeliness and completeness as a basis for pursuing money damages for an adverse determination.”  Id. at 15-16 (holding that summary judgment was inappropriately granted under subsections (e)(5) and (e)(7) claims and concluding “in light of the destruction of appellants’ records, that a permissive spoliation inference was warranted because the senior Department officials had a duty to preserve the annotated applications and internet printouts given that Department investigation and future litigation were reasonably foreseeable”).  For a more complete discussion of Gerlich, see the discussion under “5 U.S.C. § 552a(e)(5) - Maintain Accurate, Relevant, Timely, and Complete Records” above.

 

c. Third element:  Proximate Cause

Courts commonly have dismissed an individual’s (g)(1)(c) suit if that individual did not meet the third requirement for such claims, i.e., that the agency’s reliance on inaccurate records was the proximate cause of the adverse determination.  See, e.g., Chambers v. Interior, 568 F.3d 998, 1007 (D.C. Cir. 2009) (dismissing plaintiff’s (g)(1)(C) claim because plaintiff failed to show specific adverse determination resulting from agency’s failure to maintain accurate records); Hutchinson v. CIA, 393 F.3d 226, 229-30 (D.C. Cir. 2005) (concluding that plaintiff failed to show that alleged inaccuracies proximately caused adverse determination because record demonstrates that she was dismissed for sustained poor performance spanning three years); Rogers v. BOP, 105 F. App’x 980, 983-84 (10th Cir. 2004) (plaintiff failed to state Privacy Act claim under (g)(1)(C) because he failed to show that inaccurate record caused his eligibility for parole, rather than his legal ineligibility); Gowan v. Air Force, 148 F.3d 1182, 1194 (10th Cir. 1998) (finding no adverse effect from Air Force’s informing Wyoming Bar of court-martial charges preferred against plaintiff where plaintiff himself later informed Wyoming Bar without knowing Air Force had already done so); Williams v. BOP, No. 94-5098, 1994 WL 676801, at *1 (D.C. Cir. Oct. 21, 1994) (asserting appellant did not establish either that agency “maintained an inaccurate record or that it made a determination adverse to him in reliance on inaccurate information capable of verification, the statutory prerequisites to maintaining an action pursuant to the Privacy Act”); Colley v. James, 254 F. Supp. 3d 45, 67 (D.D.C. 2017) (finding that plaintiffs did not establish that the Air Force violated Privacy Act by engaging in willful or intentional conduct because agency had corrected inaccurate information pertaining to their appeal and there was no indication that incorrect information had been relied upon as part of appeal); Gillman v. United States, No. 16-00001, 2017 WL 969180, at *4-5 (D. Hawaii March 13, 2017) (finding that plaintiff “failed to establish the existence of a genuine issue of material fact—namely, whether VA personnel acted intentionally or willfully in maintaining allegedly inaccurate medical records,” and failed to provide “evidence to show that the VA’s maintenance of allegedly inaccurate mental health records caused a required adverse determinationor actual damages”); Ashbourne, 2015 WL 11303198, at *7-9 (finding that plaintiff failed to allege claim under subsection (g)(1)(C) where plaintiff did not present evidence of  inaccurate record relied upon by agency when reviewing misleading information provided by plaintiff during pre-employment process); Doe v. Rogers, 139 F. Supp. 3d at 168 (dismissing plaintiff’s (g)(1)(C) claim because “only agency ‘decision’ that arguably meets this definition [of an adverse agency determination] is the Secretarial Review Decision, but, again, the plaintiffs have not identified any inaccurate agency report that the Secretary relied on to reach that decision”); Dick v. Holder, 67 F.Supp.3d 167, 183-186 (D.D.C. 2014) (notwithstanding that plaintiff’s claim (g)(1)(C) claim fails because alert FBI issued in response to statements made by plaintiff to agency personnel was exempt from Privacy Act’s maintenance requirements, dismissing claim because even if court accepted plaintiff’s security clearance suspension or mandatory fitness examination as adverse determinations, plaintiff failed to show alert was cause of adverse determinations); Singh v. DHS, No. 1:12-cv-00498, 2014 WL 67254, at *9-11 (E.D. Cal. Jan. 8, 2014) (dismissing plaintiff’s (g)(1)(C) and (g)(1)(D) claims because plaintiff did not allege “sufficient causal connection between the Government’s failure to document the alleged promise to [p]laintiff that he would not be deported in conjunction with his plea and the removal proceedings that were instituted as a result of his conviction”); Scott, 937 F. Supp. 2d at 78 (dismissing plaintiff’s Privacy Act claim for failure to allege “some adverse effect,” because plaintiff “has not alleged facts to show that she has suffered or is suffering any adverse determination or effect because of BOP’s alleged failure to comply with the requirement that it collect only ‘relevant and necessary’ information”); New-Howard v. Shinseki, No. 09-5350, 2012 WL 2362546, at *9 (E.D. Pa. June 21, 2012) (“Plaintiff presents absolutely no evidence of instances in which she was denied leave due to an absence of accrued leave” and “[a]s a consequence, Plaintiff can maintain no cause of action for damages on the basis of the failure to maintain records regarding her leave.”); Radakovic v. OPM, No. 11-10706, 2012 WL 1900037, at *3 (D. Mass. May 23, 2012) (“Plaintiff does not allege at the time of the ‘adverse determination’ . . . [agency] had any information available” because letter explaining reasons for plaintiff’s separation from former employer was not provided to agency until “two years and one month after plaintiff’s termination” and therefore plaintiff, “as a matter of law, does not allege a § 552a(g)(1)(C) violation.”), aff’d, No. 12-1934 (1st Cir. Apr 10, 2013); Kvech, 2011 WL 4369452, at *5-6 (although plaintiff “pled facts sufficient to show she was aggrieved by an adverse determination and the FBI acted intentionally,” she “failed to plead facts which might establish” (1) “FBI failed to ‘assure fairness’ by maintaining inaccurate records; and (2) reliance on the inaccurate records was the ‘proximate cause’ of the adverse determination.”); Conley v. United States, No. 2:10-cv-444, 2011 WL 1256611, at *6-7 (S.D. Ohio Mar. 31, 2011) (“[A]ny possible recovery under [(g)(1)(C)] is precluded because [plaintiff] has failed to adequately plead that an adverse determination resulted from any of the [agency’s] alleged violations of the Privacy Act.”); Ramey v. Marshals Serv., 755 F. Supp. 2d 88, 96-97 (D.D.C. 2010) (finding that plaintiff did not “set forth specific facts showing a genuine issue for trial on the question of whether the U.S. Marshals relied on inaccurate information in ordering Plaintiff's removal from the Twelfth Circuit Contract”); Reitz, 2010 WL 786586, at *11 (dismissing plaintiff’s (g)(1)(C) claim because plaintiff failed to show that mistake in Farm Service Agency’s records caused or led to the agency’s adverse determination); Krieger v. DOJ, 529 F. Supp. 2d 29, 49-50 (D.D.C. 2008) (explaining that even if former agency employee’s performance appraisal reports were missing from his file, he “has adduced no evidence that his missing [reports] were the proximate cause of his failure to obtain job offers”); Murphy v. United States, 167 F. Supp. 2d 94, 97-98 (D.D.C. 2001) (stating that although documents delayed plaintiff’s transfer and thus played a part in transfer process, plaintiff “has neither shown that they caused the transfer nor identified a genuine issue of fact that is material to the dispositive issue of causation”), aff’d per curiam, 64 F. App’x 250 (D.C. Cir. 2003); Schwartz v. DOJ, No. 94 CIV. 7476, 1995 WL 675462, at *7-8 (S.D.N.Y. Nov. 14, 1995) (finding alleged inaccuracy in presentence report “cannot have caused an adverse determination” where sentencing judge was made aware of error and stated that fact at issue was not material for sentencing, nor did any omission of additional facts in report result in plaintiff’s “not receiving a fair determination relating to his rights”), aff’d, 101 F.3d 686 (2d Cir. 1996) (unpublished table decision); Kellett v. United States, 856 F. Supp. 65, 70-71 (D.N.H. 1994) (concluding that factors plaintiff claimed were inaccurate were not proximate cause of agency determination where those factors “were not substantially relied on in rendering the decision” and that where officials “did not substantially rely on the inaccurate information,” plaintiff did not “establish intentional or willful conduct”), aff’d sub nom. Kellett v. U.S. Bureau of Prisons, 66 F.3d 306 (1st Cir. 1995) (unpublished table decision); but see, e.g., Perry, 371 F.3d at 1305 (finding plaintiffs had alleged necessary elements to state claim, vacating district’s court decision and remanding for district court to consider complaint under Privacy Act); Fleck v. VA OIG, 2020 WL 42842, at *6-8 (denying VA’s motion to dismiss where second agency’s decision not to hire plaintiff was adverse action, plaintiff sufficiently alleged factual inaccuracies in OIG report, and inaccuracies led to second agency’s failure to hire him); Makowski v. United States, 27 F. Supp. 3d 901, 914-15 (N.D. Ill. 2014) (“[Plaintiff] has linked the alleged Privacy Act violation with his alleged damages by stating that ICE issued an unlawful detainer against him because of its reliance on DHS’s inaccurate records, the detainer disqualified [plaintiff] from boot camp, [plaintiff] was not processed into boot camp until his father retained an attorney’s assistance to prompt ICE to cancel the detainer, and the delay in processing into boot camp caused [plaintiff] to remain incarcerated from May to July 2011, preventing him from seeking employment.”).

 

d. Fourth Element: Intentional or Willful Conduct

Finally, plaintiffs rarely have established that an agency intentionally or willfully failed to maintain accurate records.  See, e.g., Deters v. Parole Comm’n, 85 F.3d 655, 660 (D.C. Cir. 1996) (concluding that where Parole Commission informed plaintiff that it would consider his challenge and examine the accuracy of his records at parole hearing, no fact-finder could determine that agency “flagrantly disregarded” plaintiff’s Privacy Act rights and that “a violation (if any) could in no sense be deemed ‘patently egregious and unlawful.’”); Yusim, 406 F. Supp. 3d at 196 (finding that SSA’s allegedly inaccurate listing of claimant’s application date for benefits did not violate his Privacy Act rights, where he did not claim that failure to maintain accurate records was done intentionally or willfully or that he suffered adverse determination); Colley v. James, 254 F. Supp. 3d 45, 67 (D.D.C. 2017) (finding that plaintiffs did not establish that the Air Force violated Privacy Act by engaging in willful or intentional conduct because agency had corrected inaccurate information pertaining to their appeal and there was no indication that incorrect information had been relied upon as part of appeal); Ahuruonye v. Interior, 239 F. Supp. 3d 136, 143 (D.D.C. 2017) (finding that plaintiff “failed to meet his burden of demonstrating that the defendant intentionally or willfully failed to maintain his 2014 Within Grade Increase Notice in the format requested”); Gillman v. United States, 2017 WL 969180, at *4-5 (finding that plaintiff “failed to establish the existence of a genuine issue of material fact – namely, whether VA personnel acted intentionally or willfully in maintaining allegedly inaccurate medical records,” and failed to provide “evidence to show that the VA’s maintenance of allegedly inaccurate mental health records caused a required adverse determinationor actual damages”); Kellett, 856 F. Supp. at 70-71 (concluding that factors plaintiff claimed were inaccurate were not proximate cause of agency determination where those factors “were not substantially relied on in rendering the decision” and that where officials “did not substantially rely on the inaccurate information,” plaintiff did not “establish intentional or willful conduct”); but see Ashbourne v. Hansberry, 302 F. Supp. 3d at 347 (finding that plaintiff properly pled in her complaint that defendant DHS failed to maintain accurate records when it intentionally and deliberatively failed to verify facts in deciding to terminate plaintiff’s federal employment).  For additional discussion of the “intentional or willful” standard under 5 U.S.C. § 552a(g)(4) for damages actions, see discussion below under “Principles Applicable to Damages Lawsuits, Intentional or Willful Standard.”

 

3. Standard and Scope of Review

Courts review (g)(1)(C) lawsuits under the standards set out in that section, not de novo.

Unlike amendment lawsuits under subsection (g)(1)(A), courts do not review subsection (g)(1)(C) actions under a de novo standard.  Compare 5 U.S.C. § 552a(g)(2) with id. § 552a(g)(4).  Instead, the courts determine whether the standards for “accuracy, relevance, timeliness, and completeness” set forth in subsection (g)(1)(C) have been met.  See White v. OPM, 787 F.2d 660, 663 (D.C. Cir. 1986) (“In § 552a(g)(1)(C) . . . suits for damages, however, de novo review is not called for.  Rather, the reviewing court is to inquire whether the standard articulated in § 552a(g)(1)(C) has been met.”); see also Sellers v. BOP, 959 F.2d 307, 312-13 (D.C. Cir. 1992); Nolan v. DOJ, No. 89-A-2035, 1991 WL 134803, at *3 (D. Colo. July 17, 1991), appeal dismissed in pertinent part on procedural grounds, 973 F.2d 843 (10th Cir. 1992); Reitz, 2010 WL 786586, at *10; see also Doe v. United States, 821 F.2d 694, 712 (D.C. Cir. 1987) (en banc) (Mikva, J., joined by Robinson and Edwards, JJ., dissenting).

Plaintiffs cannot use subsection (g)(1)(C) lawsuits to collaterally attack agency determinations.

Just as in the amendment context (see “5 U.S.C. § 552a(g)(1)(A) - Amendment Lawsuits” discussion above), many courts have expressed disfavor toward litigants who attempt to invoke the subsection (g)(1)(C) damages remedy as a basis for collateral attacks on judicial and quasi-judicial agency determinations, such as those denying benefit and or detrimental employment decisions.  See, e.g., Taylor v. Def. Fin. & Accounting Servs., No. 2:12-2466, 2014 U.S. Dist. LEXIS 268, at *25 (E.D. Cal. Jan. 3, 2014) (finding that plaintiff cannot use claim under (g)(1)(C) and (g)(1)(D) to reopen determinations that plaintiff owed an overpay debt); Middlebrooks v. Mabus, No. 1:11cv46, 2011 WL 4478686, at *5 (E.D. Va. Sept. 23, 2011) (“Even if these claims were not untimely, . . . plaintiff’s challenge to the accuracy of her record is a veiled attempt to relitigate her discrimination claim, which is . . . beyond the scope of the [Privacy] Act” because “[t]he Act is a vehicle for correcting facts in agency records if those facts are erroneously recorded but not for altering records that reflect an administrative decision or assessments.”); Feldman, 797 F. Supp. 2d at 47 (dismissing Privacy Act claim because “plaintiff's inaccuracy claims, at their core, attempt to attack the judgment of a federal official, rather than to correct a factual or historical error in an official record that proximately caused an adverse determination”); Doe v. DOJ, 660 F. Supp. 2d at 42-43 (“[P]laintiff’s arguments that defendants lacked a basis to terminate him because his job did not require a security clearance or because they failed to follow the correct procedures . . . or that DOJ gave too much weight to his psychologist’s . . . letter are impermissible attacks on DOJ’s personnel decisions and administrative actions.”  (citations omitted)); Allmon v. BOP, 605 F. Supp. 2d 1, 7 (D.D.C. 2009) (ruling that prisoner may not “us[e] [a] Privacy Act suit as a means to effect his transfer to a less-secure facility”); Ray v. DHS, No. H-07-2967, 2008 WL 3263550, at *10-11 (S.D. Tex. Aug. 7, 2008) (“To the extent that [plaintiff’s] section 552a(g)(1)(C) claim seeks review of the TSA’s decision to suspend him indefinitely without pay based on his failure to disclose his previous offenses,” it must be dismissed because “[t]he Privacy Act . . . does not authorize relitigation of the substance of agency decisions.”); Brown v. Prob. Office, No. 03-872, 2005 WL 2284207, at *3 (E.D. Tex. Aug. 15, 2005) (magistrate’s recommendation) (rejecting plaintiff’s claim as essentially a “challeng[e to] the application of the classification guidelines, not the accuracy or completeness of the information”), adopted, No. 03-872 (E.D. Tex. Sept. 9, 2005); Compro-Tax v. IRS, No. H-98-2471, 1999 U.S. Dist. LEXIS 5972, at *11-12 (S.D. Tex. Apr. 9, 1999) (magistrate’s recommendation) (finding no intentional or willful agency action, and stating that “Privacy Act may not be used to collaterally attack a final agency decision as ‘inaccurate,’ or ‘incomplete’ merely because the individual contests the decision”), adopted, No. H–98–2471, 1999 WL 501014 (S.D. Tex. May 12, 1999); Douglas v. Farmers Home Admin., No. 91-1969, 1992 U.S. Dist. LEXIS 9159, at *2-3 (D.D.C. June 26, 1992) (applying principles of White v. U.S. Civil Serv. Comm’n, 589 F.2d 713 (D.C. Cir. 1978) (per curiam) (holding that (g)(1)(A) plaintiff was not entitled to bring Privacy Act damages action for allegedly inaccurate appraisal of his property where he had not sought judicial review under APA)); Castella v. Long, 701 F. Supp. 578, 584-85 (N.D. Tex. 1988) (holding “collateral attack on correctness of the finding supporting the discharge decision” is improper under Act), aff’d, 862 F.2d 872 (5th Cir. 1988) (unpublished table decision); Holmberg v. United States, No. 85-2052, slip op. at 2-3 (D.D.C. Dec. 10, 1985) (stating that Privacy Act “cannot be used to attack the outcome of adjudicatory-type proceedings by alleging that the underlying record was erroneous”); cf. Bhatia, 2011 WL 1298763, at *4-5 (dismissing as “unripe” plaintiff’s “attempt[] to collaterally attack the validity of the criminal indictment . . . under the guise of Privacy Act claims” because “[t]he validity or invalidity of the criminal charges contained in the indictment cannot be determined until the criminal action is finally resolved”), aff’d, 507 F. App’x 649 (9th Cir. 2013).  The OMB 1975 Guidelines, 40 Fed. Reg. at 28,969, https://www.justice.gov/paoverview_omb-75, also address this issue.

Similarly, subsection (g)(1)(C) lawsuits filed to attack a criminal conviction or sentence are not cognizable.

Federal prisoners frequently attempt to invoke the subsection (g)(1)(C) damages remedy as a basis for a collateral attack on a conviction or the duration of a sentence.  The Court of Appeals for the D.C. Circuit has explained that “such a claim is not cognizable” unless the conviction or sentence “has been invalidated in a prior proceeding.”  White v. Prob. Office, 148 F.3d 1124, 1125-26 (D.C. Cir. 1998) (per curiam).  In White, the D.C. Circuit held that a Privacy Act claim for damages could not be brought to “collaterally to attack” a federal prisoner’s sentence, stating that:  “Because a judgment in favor of [plaintiff] on his challenge to the legal conclusions in his presentence report would necessarily imply the invalidity of his sentence, which has not been invalidated in a prior proceeding, his complaint for damages under the Privacy Act must be dismissed.”  Id. at 1125-26.  See also, e.g., Aguiar v. DEA, 334 F. Supp. 3d 130, 146 (D.D.C. 2018) (finding plaintiff’s claims relating to accuracy of his GPS data not cognizable under Privacy Act because such claims were being used to collaterally attack his conviction and sentence); Lewis v. Parole Comm’n, 770 F. Supp. 2d 246, 249-51 (D.D.C. 2011) (dismissing claim that agency’s reliance on allegedly inaccurate information adversely affected plaintiff in parole hearings because “it is ‘probabilistic’ that the plaintiff’s claim, if successful, would result in a decreased sentence or a more favorable parole decision” and such claims must be brought in habeas); Cargill v. Prob. Office for the Middle Dist. of N.C., No. 10-0388, 2010 WL 917010, at *1 (D.D.C. Mar. 9, 2010) (citing White v. Prob. Office and stating that “plaintiff cannot maintain his Privacy Act claim for damages based on the premise that his sentence is unlawful unless he can also show that his sentence was invalidated by an appropriate court”); Skinner v. BOP, 584 F.3d 1093, 1098, 1101 (D.C. Cir. 2009) (explaining that federal inmate’s subsection (g)(1)(C) claim “is barred unless and until he successfully challenges the disciplinary hearing on which it is based through an action in habeas corpus”); Corley v. Parole Comm’n, 709 F. Supp. 2d 1, 5 (D.D.C. 2009) (“To the extent that this Privacy Act case is a disguised collateral attack on the plaintiff’s conviction and sentence by denying that an indictment ever issued or that a conviction was ever obtained . . . this court must dismiss the case.”); Brown v. BOP, 498 F. Supp. 2d. 298, 303-04 (D.D.C. 2007) (“The Privacy Act is not the proper means by which a prisoner may collaterally attack his sentence absent a showing that his sentence has been invalidated in a prior proceeding.”); Wattleton v. Lappin, 94 F. App’x 844, 845 (D.C. Cir. 2004) (per curiam) (“[S]uccess on [the] Privacy Act claim would, at a minimum, have a ‘probabilistic impact’ on the duration of [the prisoner’s] custody, [because] appellant is required to proceed by way of a habeas petition.”); Doyon v. DOJ, 304 F. Supp. 2d 32, 35 (D.D.C. 2004) (“A challenge to the professional judgment of [BOP] officials in assessing points for purposes of establishing a prisoner’s custody classification is not properly mounted by means of a Privacy Act suit.”); Razzoli v. BOP, 230 F.3d 371, 373, 376 (D.C. Cir. 2000) (holding that “habeas is indeed exclusive even when a non-habeas claim would have a merely probabilistic impact on the duration of custody” and, therefore, finding “not cognizable” prisoner’s claim that agency violated Privacy Act by relying on inaccurate information in postponing his eligibility for parole); Thomas v. Parole Comm’n, No. 94-0174, 1994 WL 487139, at *6 (D.D.C. Sept. 7, 1994) (stating that plaintiff should not be allowed to use Privacy Act “to collaterally attack the contents of his presentence report,” as he “originally had the opportunity to challenge the accuracy . . . before the judge who sentenced him”). 

Other courts outside the D.C. Circuit also have rejected these types of claims on similar grounds.  See, e.g., Whitley v. Hunt, 158 F.3d 882, 889-90 (5th Cir. 1998) (affirming district court’s conclusion that there was “no factual or legal basis” for claim that “prison officials abused their discretion by relying upon the sentence imposed against Whitley to determine his classification”; “Whitley is essentially claiming that his sentence itself was incorrectly entered.  That is an issue that should have been resolved on direct appeal from his criminal conviction”); Hurley v. BOP, No. 95-1696, 1995 U.S. App. LEXIS 30148, at *4 (1st Cir. Oct. 24, 1995) (stating that any alleged inaccuracy in plaintiff’s presentence report, which agency relied on, “should have been brought to the attention of the district court at sentencing; or, at the very least, on appeal from his conviction and sentence”); Wingo v. Farley, No. 4:12-CV-2072, 2013 WL 2151638, at *3 (N.D. Ohio May 16, 2013) (explaining that “Privacy Act is not the proper vehicle to challenge an agency’s opinions or judgments.  Rather, the Act ‘is intended to remedy factual or historical errors, and is not a vehicle for addressing the judgments of federal officials . . . reflected in records maintained by federal agencies.’”); Eubanks v. United States, No. 2:09cv126, 2010 WL 1141436, at *2 (N.D. W. Va. Jan. 12, 2010) (magistrate’s recommendation) (asserting that claim “seeking damages for the alleged miscalculation of [plaintiff’s] sentence should be dismissed” because his “sentence calculation has never been invalidated”), adopted, 2010 WL 1141437 (N.D. W. Va. Mar. 22, 2010), aff’d per curiam, 405 F. App’x 796 (4th Cir. 2010); Blanton v. Schultz, No. 105CV0001, 2005 WL 3507969, at *3 (E.D. Cal. Dec. 21, 2005) (finding that prisoner’s argument that BOP is using “false information” to assign prisoner less favorable custody and security classifications “is nothing more than an attempt to resurrect an otherwise improper [petition for writ of habeas corpus]”).

Courts often have found Privacy Act damages claims under subsection (g)(1)(C) precluded by other statutes.

As in the amendment context, 26 U.S.C. § 7852(e) (2018) (a provision of the Internal Revenue Code) also displaces the Privacy Act’s damages remedy for inaccurate records in matters concerning tax liability.  See, e.g., Risk v. United States, No. 07-60025, 2007 WL 9701106, at * 2 (finding that “plaintiffs’ reliance on the Privacy Act of 1974 is also misplaced since the Internal Revenue Code explicitly states that [(g)(1)(C)] is inapplicable in tax matters” (citing to 26 U.S.C. § 7852(e)); see also Ford v. United States, No. 91-36319, 1992 WL 387154, at *2 (9th Cir. Dec. 24, 1992); McMillen v. Treasury, 960 F.2d 187, 188 (1st Cir. 1991); Swartz v. IRS, No. 05-72215, 2006 WL 1374472, at *2 (May 18, 2006); Sherwood v. United States, No. 96-2223, 1996 WL 732512, at *9 (N.D. Cal. Dec. 9, 1996).

In Hubbard v. EPA, the leading D.C. Circuit case concerning the causation requirement of subsection (g)(1)(C), the D.C. Circuit’s finding of a lack of causation was heavily influenced by the Civil Service Reform Act’s (CSRA) jurisdictional bar to district court review of government personnel practices.   See 809 F.2d at 5.  Although the D.C. Circuit stopped short of holding that the CSRA’s comprehensive remedial scheme constitutes a jurisdictional bar to a subsection (g)(1)(C) action, it noted that “it would be anomalous to construe the pre-existing Privacy Act to grant the district court power to do indirectly that which Congress precluded directly:  ‘the Privacy Act was not intended to shield [federal] employees from the vicissitudes of federal personnel management decisions.’”  Id. (quoting Albright v. United States, 732 F.2d 181, 190 (D.C. Cir. 1984)); cf. Biondo v. Navy, No. 2:92-0184-18, slip op. at 21-23 (D.S.C. June 29, 1993) (finding, based upon Hubbard, “that the ‘collateral attack’ argument complements the causation requirement of the Privacy Act”).  The concurring opinion in Hubbard argued, however, that “[n]othing in the wording or legislative history of either Act” supports the majority’s “suggestion that serious consideration of a Privacy Act claim in the context of a federal personnel dispute somehow creates a potential conflict with the” (CSRA).  809 F.2d at 12-13 (Wald, J., concurring) (citing Molerio v. FBI, 749 F.2d 815, 826 (D.C. Cir. 1984), Albright, 732 F.2d at 188, and Borrell v. U.S. Int’l Commc’n Agency, 682 F.2d 981, 992-93 (D.C. Cir. 1982)).  That opinion also noted that circuit court precedents since the passage of the CSRA have, “without a hint of the majority’s caution, reviewed the Privacy Act claims of federal employees or applicants embroiled in personnel disputes.”  Id. 

Although Hubbard merely applied a strict causation test where a government personnel determination was being challenged, several more cases have gone further and construed the CSRA’s comprehensive remedial scheme to constitute a jurisdictional bar to subsection (g)(1)(C) damages lawsuits challenging federal employment determinations.  See Yu v. VA, 528 F. App’x 181, 184 (3d Cir. 2013) (affirming district court decision that VA’s actions that took place after plaintiff’s termination “are personnel decisions because they ‘occurred only as result of the employment relationship’ [plaintiff] had with the VA,” and therefore, preclude Privacy Act damages claims); Doe v. FDIC, 545 F. App’x 6, 8 (2d Cir. 2013) (stating that because “Doe’s Privacy Act claims fall within the definition of a ‘prohibited personnel action,’ the CSRA dictates that Doe may not pursue her claims in federal court”); Orsay v. DOJ, 289 F.3d 1125, 1128-31 (9th Cir. 2002); Phillips v. Widnall, No. 96-2099, 1997 WL 176394, at *3 (10th Cir. Apr. 14, 1997) (citing Henderson v. SSA, infra, to hold that claim concerning alleged inaccuracies and omissions in appellant’s employment file that formed basis of her claim for damages to remedy loss of promotion and other benefits of employment “is not a recognizable claim under the Privacy Act,” as “CSRA provides the exclusive remedial scheme for review of [appellant’s] claims related to her position”); Vessella v. Air Force, No. 92-2195, 1993 WL 230172, at *2 (1st Cir. June 28, 1993) (citing Hubbard and Henderson v. SSA, for the proposition that the Privacy Act “cannot be used . . . to frustrate the exclusive, comprehensive scheme provided by the CSRA”); Houlihan v. OPM, 909 F.2d 383, 384-85 (9th Cir. 1990) (per curiam); Henderson v. SSA, 908 F.2d 559, 560-61 (10th Cir. 1990), aff’g 716 F. Supp. 15, 16-17 (D. Kan. 1989)); Minshew v. Donley, 911 F. Supp. 2d 1043, 1067-68 (D. Nev. 2012) (explaining that CSRA preempts plaintiff’s Privacy Act claim because plaintiff “effectively seeks to achieve through a Privacy Act claim an interpretation of the settlement agreement [between plaintiff] and the Air Force which resolved the appeal of her removal pending before the MSPB . . . [plaintiff] thus must bring her claim before the MSPB, not this Court”); Doe v. FDIC, No. 11 Civ. 307, 2012 WL 612461, at *5 (S.D.N.Y. Feb. 27, 2012) (“To the extent [plaintiff] has alleged that the disclosures underlying her Privacy Act claims were personnel actions taken in response to her reporting violations of banking laws and regulations, the Court finds that these claims are precluded by the CSRA.”); Lim v. United States, No. 10-2574, 2011 WL 2650889, at *8 (D. Md. July 5, 2011) (“[W]hile labeled as a Privacy Act violation, [plaintiff] is ultimately challenging the basis for his discharge, a personnel decision which cannot be challenged outside the framework of the CSRA.”); Pippinger v. Sec’y of the Treasury, No. 95-CV-017, 1996 U.S. Dist. LEXIS 5485, at *15 (D. Wyo. Apr. 10, 1996) (citing Henderson and stating that to extent plaintiff challenges accuracy of his personnel records, court does not have jurisdiction “to review errors in judgment that occur during the course of an employment/personnel decision where the CSRA precludes such review”), aff’d sub nom. Pippinger v. Rubin, 129 F.3d 519 (10th Cir. 1997);  Barhorst v. Marsh, 765 F. Supp. 995, 999 (E.D. Mo. 1991); Barkley v. USPS, 745 F. Supp. 892, 893-94 (W.D.N.Y. 1990); McDowell v. Cheney, 718 F. Supp. 1531, 1543 (M.D. Ga. 1989); Tuesburg v. HUD, 652 F. Supp. 1044, 1049 (E.D. Mo. 1987); Edwards v. Baker, No. 83-2642, slip op. at 4-6 (D.D.C. July 16, 1986) (rejecting plaintiff’s Privacy Act challenge to an “employee performance appraisal system” on the grounds that “plaintiffs may not use that Act as an alternative route for obtaining judicial review of alleged violations of the CSRA”). 

Courts in other cases have declined to go that far.  See, e.g., Doe v. FBI, 718 F. Supp. 90, 100-01 n.14 (D.D.C. 1989) (rejecting contention that CSRA limited subsection (g)(1)(C) action), aff’d in part, rev’d in part & remanded, on other grounds, 936 F.2d 1346 (D.C. Cir. 1991); see also Halus v. Army, No. 87-4133, 1990 WL 121507, at *5 n.8 (E.D. Pa. Aug. 15, 1990) (finding that the “court may determine whether a Privacy Act violation caused the plaintiff damage (here, the loss of his job)”); Hay v. Sec’y of the Army, 739 F. Supp. 609, 612-13 (S.D. Ga. 1990) (quoting Rogers v. Labor, 607 F. Supp. 697, 699 (N.D. Cal 1985), and Hewitt v. Grabicki, 794 F.2d at 1379) (acknowledging that “Privacy Act ‘may not be employed as a skeleton key for reopening consideration of unfavorable federal agency decisions,’” but allowing Privacy Act claim to proceed because, where “agency acted in an ‘intentional or willful’ manner in failing to maintain accurate records, district court may award actual damages sustained by the individual as a result of an adverse determination based upon such records”).

To date, the D.C. Circuit has declined to rule that the CSRA bars a Privacy Act claim for damages.  See Kleiman v. Energy, 956 F.2d 335, 337-39 & n.5 (D.C. Cir. 1992) (holding that Privacy Act did not afford relief where plaintiff did not contest that record accurately reflected his assigned job title, but rather challenged his position classification – personnel decision judicially unreviewable under the CSRA – but noting that nothing in opinion “should be taken to cast doubt on Hubbard’s statement that ‘the Privacy Act permits a federal job applicant to recover damages for an adverse personnel action actually caused by an inaccurate or incomplete record’” (quoting Hubbard, 809 F.2d at 5)); Holly v. HHS, No. 88-5372, 1990 WL 13096, at *1 (D.C. Cir. Feb. 7, 1990) (declining to decide whether CSRA in all events precludes Privacy Act claim challenging federal employment determination; instead applying doctrine of “issue preclusion” to bar individual “from relitigating an agency’s maintenance of the challenged records” because arbitrator had previously found that no “[agency] manager acted arbitrarily, capriciously or unreasonably in determining [that plaintiff] was not qualified”);  Ahuruonye v. Interior, 312 F. Supp. 3d. 1, 14-15 (D.D.C. 2018) (acknowledging that Privacy Act should not be used to circumvent CSRA, but finding that Privacy Act permits federal job applicant or employee to recover damages for adverse personnel action actually caused by inaccurate or incomplete record); Gard v. Dep’t of Educ., 789 F. Supp. 2d 96, 106 (D.D.C. 2011) (citing and quoting Hubbard, but finding that plaintiff’s “claims must fail to the extent that he has not produced any evidence supporting a reasonable inference that a Privacy Act violation itself actually caused the adverse events of which he complains”); Peter B. v. CIA, 620 F. Supp. 2d 58, 76 (D.D.C. 2009) (explaining that if plaintiff “seeks to correct factually inaccurate records,” then his claim “would not be precluded by the CSRA,” but concluding that “[i]t is premature to determine whether [plaintiff] seeks to [do this], or if [plaintiff] disagrees with the [agency’s] judgments contained in his records”); Lee v. Geren, 480 F. Supp. 2d at 210-12 (following Hubbard and Kleiman and concluding that allegedly inaccurate documents produced during investigation of plaintiff did not actually cause his suspension but rather “merely memorialized” that determination and thus “had no independent effect of their own”); Doe v. Goss, No. 04-2122, 2007 WL 106523, at *8-9 (D.D.C. Jan. 12, 2007) (citing Hubbard and finding that CSRA did not preclude plaintiff’s accuracy claim or his “information-gathering” claim because plaintiff alleged actual causation with respect to both claims).  But see Holly v. HHS, No. 89-0137, slip op. at 1 (D.D.C. Aug. 9, 1991) (citing Kleiman for proposition that court lacks subject matter jurisdiction in Privacy Act damages action in which plaintiff challenges personnel action governed by CSRA), aff’d, 968 F.2d 92 (D.C. Cir. 1992) (unpublished table decision).

The Court of Appeals for the Ninth Circuit considered the interplay between the Privacy Act and a statute that broadly precludes judicial review of VA disability benefit decisions – 38 U.S.C. § 211(a) (later repealed, now see 38 U.S.C. § 511 (2018)) – and concluded that it barred a subsection (g)(1)(C) damages action.  Rosen v. Walters, 719 F.2d 1422, 1424-25 (9th Cir. 1983).  In Rosen, the plaintiff contended that the VA deliberately destroyed medical records pertinent to his disability claim, thereby preventing him from presenting all the evidence in his favor.  Id. at 1424.  The Ninth Circuit ruled that such a damages claim would “necessarily run counter to the purposes of § 211(a)” because it would require a determination as to whether “but for the missing records, Rosen should have been awarded disability benefits.”  Id. at 1425.  Further, it declined to find that the Privacy Act “repealed by implication” 38 U.S.C. § 211(a).  Id.; see also Demoruelle v. VA, No. 16-00562, 2017 WL 2836989, at *5 (D. Hawaii June 30, 2017) (dismissing plaintiff’s accuracy claims since court is precluded from having jurisdiction over claims that seek review of VA’s benefit decisions pursuant to 38 U.S.C. § 511(a) and consistent with Veterans for Common Sense v. Shinseki, 678 F.3d 1013 (9th Cir. 2012)); Thomas v. Principi, 265 F. Supp. 2d 35, 39-40 (D.D.C. 2003) (holding claim for failure to maintain accurate and complete records was barred by former 38 U.S.C. § 511 “because the injuries that allegedly resulted from defendants’ failure to maintain [plaintiff’s] records all ultimately concern the adverse benefits determination made by the [VA]”), aff’d in pertinent part, rev’d in part, 394 F.3d 970 (D.C. Cir. 2005); R.R. v. Army, 482 F. Supp. 770, 775-76 (D.D.C. 1980) (rejecting damages claim for lack of causation and noting that “[w]hat plaintiff apparently seeks to accomplish is to circumvent the statutory provisions making the VA’s determinations of benefits final and not subject to judicial review”); cf. Kaswan v. VA, No. 81-3805, 1988 WL 98334, at *12 (E.D.N.Y. Sept. 15, 1988) (stating that Privacy Act is “not available to collaterally attack factual and legal decisions to grant or deny veterans benefits”), aff’d, 875 F.2d 856 (2d Cir. 1989) (unpublished table decision); Leib v. VA, 546 F. Supp. 758, 761-62 (D.D.C. 1982) (“The Privacy Act was not intended to be and should not be allowed to become a ‘backdoor mechanism’ to subvert the finality of agency determinations.” (quoting Lyon v. United States, 94 F.R.D. 69, 72 (W.D. Okla. 1982))).  Relying on Rosen, the District Court for the District of Idaho similarly held that the statutory scheme regarding the awarding of retirement benefits and “Congress’s intent that OPM, MSPB and the Federal Circuit review decisions regarding the denial of disability retirement benefits” prohibited it from reviewing Privacy Act damages claim where plaintiff alleged that VA’s failure to maintain file resulted in his being denied disability retirement benefits by OPM.  Braun v. Brown, No. CV 97-0063-S, slip op. at 7-11 (D. Idaho June 22, 1998).

Several courts have held that the provision of the Federal Employees’ Compensation Act (FECA), 5 U.S.C. § 8116(c) (2018), that provides that the liability of the United States under FECA with respect to the injury of an employee is exclusive, operates to preclude a cause of action under the Privacy Act, and deprives the court of subject matter jurisdiction.  See, e.g., Vogrin v. ATF, No. 598CV117, 2001 WL 777427, at *7-8 (N.D. W. Va. Mar. 30, 2001), aff’d per curiam, No. 01-1491 (4th Cir. July 3, 2001).  The court ruled that FECA’s exclusivity provision “precludes a suit under the Privacy Act even if FECA does not provide benefits for all of the injuries that [the plaintiff] claims.”  Id. at *7; see also Scott v. USPS, No. 05-0002, 2006 WL 2787832, at *3-4 (D.D.C. Sept. 26, 2006) (explaining that “even though [plaintiff] was ultimately denied compensation under FECA based on a lack of competent medical evidence” and establishing that agency’s disclosure of records caused her alleged emotional injury, “that is immaterial to the issue of the Court’s jurisdiction”); Lyon v. United States, 94 F.R.D. 69, 72 (W.D. Okla. 1982) (finding Privacy Act claim cannot be “a backdoor mechanism to subvert authority bestowed upon the Secretary of Labor to handle employee compensation claims”; stating FECA “provides the exclusive method of presenting compensation claims resulting from on-the-job injuries of federal employees”); cf. Jackson v. Labor, No. 2:06-CV-02157, 2008 WL 539925, at *4 (E.D. Cal. Feb. 25, 2008) (ruling that plaintiff may not bring amendment lawsuit under Privacy Act to re-litigate determination of FECA benefits); Weber v. Henderson, 33 F. App’x 610, 612 (3d Cir. 2002) (holding that Privacy Act claim was barred by res judicata where plaintiff could have raised Privacy Act claim in prior suit when he brought claim against same defendants as cause of action under FECA).

The D.C. District Court has found that a Privacy Act claim is not precluded by the exclusivity of relief under Title VII of the Civil Rights Act.

The District Court for the District of Columbia concluded, however that a Privacy Act claim was not precluded by the exclusivity of relief under Title VII of the Civil Rights Act of 1964, 42 U.S.C. § 2000e (2018).  See Velikonja v. Mueller, 315 F. Supp. 2d 66, 77 (D.D.C. 2004) (noting that agency “failed to cite any cases in which a Privacy Act claim is precluded by Title VII” and that “the court is not aware of any”), subsequent opinion, 362 F. Supp. 2d 1, 13-19 (D.D.C. 2004) (finding no inaccuracies, adverse determination, or intentional or willful conduct), aff’d in part & rev’d in part sub nom. Velikonja v. Gonzales, 466 F.3d 122 (D.C. Cir. 2006) (affirming on ground of finding of no inaccuracies, adverse determination, or intentional or willful conduct).

The courts have split as to whether the (g)(1)(C) standards apply only to the receiving agency or to any agency.

In Perry v. FBI, 759 F.2d 1271, 1275-76 (7th Cir. 1985), reh’g en banc granted on other grounds, 769 F.2d 450 (7th Cir. 1985), the Court of Appeals for the Seventh Circuit, without discussing subsection (g)(1)(C), adopted a comparatively narrower construction of subsection (e)(5), holding that “when one federal agency sends records to another agency to be used by the latter in making a decision about someone, the responsibility for ensuring that the information is accurate, relevant, timely, and complete lies with the receiving agency – the agency making ‘the determination’ about the person in question – not the sending agency.”

Subsequently, however, in Dickson v. OPM, 828 F.2d 32, 36-40 (D.C. Cir. 1987), the D.C. Circuit held that a subsection (g)(1)(C) damages lawsuit is proper against any agency maintaining a record violating the standard of fairness mandated by the Act, regardless of whether that agency is the one making the adverse determination.  See also Blazy v. Tenet, 979 F. Supp. 10, 19 (D.D.C. 1997) (“The adverse determination need not be made by the agency that actually maintains the record so long as it flowed from the inaccurate record.”  (citing Dickson)), summary affirmance granted, No. 97-5330, 1998 WL 315583 (D.C. Cir. May 12, 1998); Doe v. U.S. Civil Serv. Comm’n, 483 F. Supp. 539, 556 (S.D.N.Y. 1980) (applying subsection (e)(5) to agency whose records were used by another agency in making determination about individual); R.R. v. Army, 482 F. Supp. at 773 (applying subsection (e)(5) to agency whose records were used by another agency in making determination about individual).  In so holding, the D.C. Circuit noted that “the structure of the Act makes it abundantly clear that [sub]section (g) civil remedy actions operate independently of the obligations imposed on agency recordkeeping pursuant to [sub]section (e)(5).”  Dickson, 828 F.2d at 38.  In Dickson, the D.C. Circuit distinguished Perry on the grounds that “[a]ppellant is not proceeding under [sub]section (e)(5), Perry does not discuss [sub]section (g)(1)(C), and the construction of (e)(5) does not migrate by logic or statutory mandate to a separate [sub]section on civil remedies.”  828 F.2d at 38; see also Doe v. FBI, 718 F. Supp. at 95 n.15 (noting conflict in cases but finding that Dickson’s holding obviated need “to enter that thicket”).

 

D. 5 U.S.C. § 552a(g)(1)(D) - Damages Lawsuits For Failure to Comply with Other Privacy Act Provisions

“Whenever any agency . . . fails to comply with any other provision of this section, or any rule promulgated thereunder, in such a way as to have an adverse effect on an individual . . . the individual may bring a civil action.”  5 U.S.C. § 552a(g)(1)(D).

Comment:

In addition to damages under subsection (g)(1)(C)’s “accuracy, relevance, timeliness, and completeness” standard, subsection (g)(1)(D) provides a “catch-all” remedies provisions that allows lawsuits for actual damages against an agency for failure to comply with “any other provision” of the Privacy Act, if there is an “adverse effect” on the individual.

 

1. Exhaustion of Administrative Remedy

Individuals are not required to exhaust administrative remedies before filing suit under subsection (g)(1)(D).

Exhaustion of administrative remedies is not a prerequisite to a civil action for damages under subsection (g)(1)(D).  Diederich v. Army, 878 F.2d 646, 648 (2d Cir. 1989); Nagel v. HEW, 725 F.2d 1438, 1441 & n.2 (D.C. Cir. 1984); McKoy v. Spencer, No. 16-1313, 2019 WL 400615, at *4 -5 (D.D.C. Jan. 31, 2019) (finding that while claim to amend record does require exhaustion of administrative remedies, damages claim stemming from improper disclosure of personnel records to third parties does not); Gergick v. Austin, No. 89-0838-CV-W-2, 1992 U.S. Dist. LEXIS 7338, at *13-16 (W.D. Mo. Apr. 29, 1992), aff’d, No. 92-3210 (8th Cir. July 9, 1993); Pope v. Bond, 641 F. Supp. 489, 500 (D.D.C. 1986).  But see Graham v. Hawk, 857 F. Supp. 38, 40 (W.D. Tenn. 1994) (stating that “[e]ach paragraph of 5 U.S.C. § 552a(g) . . . requires as a prerequisite to any action that the agency refuse an individual’s request to take some corrective action regarding his file”), aff’d, 59 F.3d 170 (6th Cir. 1995) (unpublished table decision).

The Prison Litigation Reform Act imposes additional procedural requirements on prisoners, however.

While “exhaustion is normally not required for damages actions under the Privacy Act,” note that 42 U.S.C. § 1997e(a) (2018), a provision of the Prison Litigation Reform Act of 1996 (“PLRA”), “imposes additional procedural requirements with respect to prisoners.”  Reid v. BOP, No. 04-1845, 2005 WL 1699425, at *3 (D.D.C. July 20, 2005).  Specifically, § 1997e(a) provides that “[n]o action shall be brought with respect to prison conditions under [any Federal law] by a prisoner confined in any jail, prison, or other correctional facility until such administrative remedies as are available are exhausted.”  42 U.S.C. § 1997e(a).  The Supreme Court “has read the exhaustion requirements [of § 1997e(a)] broadly to include ‘all inmate suits about prison life, whether they involve general circumstances or particular episodes, and whether they allege excessive force or some other wrong.’”  Reid, 2005 WL 1699425, at *3 (quoting Porter v. Nussle, 534 U.S. 516, 532 (2002)).  In McGee v. BOP, for example, the prisoner sued the BOP alleging unlawful disclosure.  118 F. App’x 471, 474 (10th Cir. 2004).  The Court of Appeals for the Tenth Circuit concluded that the prisoner “failed to exhaust his administrative remedies with respect to his Privacy Act claim” pursuant to § 1997e(a).  Id. at 475; see also Smith v. B A Blackmon Warden FCI Marianna, No. 5:18CV40, 2019 WL 3047081, at *6-7 (N.D. Fla. May 21, 2019) (magistrate recommendation) (finding prisoner’s claim under Privacy Act “must be a separate (non-habeas) filing subject to the PLRA, filing fee and other provisions”) adopted, 2019 WL 3037921 (N.D. Fla. 2019); Lugo-Vazquez v. Grondolsky, No. 08-986, 2010 WL 2287556, at *2-3 (D.N.J. June 2, 2010) (granting summary judgment to agency on Privacy Act claim because plaintiff failed to exhaust administrative remedies under § 1997e(a)); cf. Lee v. DOJ, 235 F.R.D. 274, 289-91 (W.D. Pa. 2006) (concluding that PLRA did not apply to allegation that “pertain[ed] to the disclosure of the [record] to a private bank, not to the means by which it was obtained,” because allegation “did not relate to prison life”).

 

2. Elements of a Subsection (g)(1)(D) Claim

In a suit for damages under subsection (g)(1)(D), an individual has the burden of proving that: (1) the information at issue is covered by the Privacy Act’s provisions; (2) the agency violated a provision of the Privacy Act not covered by the other civil remedies provisions; (3) the violation had an “adverse effect” on the plaintiff that was a “causal nexus” between the violation and the adverse effect; and (4) the violation was “willful or intentional.”  See, e.g., Quinn v. Stone, 978 F.2d 126, 131 (3d Cir. 1992); Pierce v. Air Force, 512 F.3d 184, 186 (5th Cir. 2007).  The third element of this cause of action, which is composed of two parts – “adverse effects” and “causation” – is discussed in detail, below.  As referenced below, analysis of the remaining elements can be found in other sections of this Overview. 

 

a. First Element: Information Covered by Privacy Act

Information is generally covered by the Privacy Act if it is a “record” maintained in a “system of records.”  See Quinn, 978 F.2d at 132 (concluding that information disclosed -- hunting roster and time card -- was information covered by Privacy Act because it “contained an identifying particular (the plaintiff's name) and was maintained within a system of records”).  Certain records, however, may be subject to the Privacy Act’s provisions, even if not maintained in a system of records.  See, e.g., McCready v. Nicholson, 465 F.3d 1 (D.C. Cir. 2006).  These issues are discussed in more detail above under the “Definitions” section.

 

b. Second Element: Catch-All Remedy Provision

Subsection (g)(1)(D) acts as a “catch-all remedy provision applicable if the agency ‘fails to comply with any other provision’ of the Privacy Act.”  E.g., Fazaga v. FBI, 965 F.3d 1015, 1063 (9th Cir. 2020) (claim based on an alleged violation of subsection (e)(7)); Sussman v. Marshals Serv., 494 F.3d 1106 (D.C. Cir. 2007) (claimed based on an alleged violation of subsection (b)). Plaintiffs must demonstrate that an agency’s action violated a Privacy Act provision not otherwise captured in subsections (g)(1)(A), (g)(1)(B), or (g)(1)(C) in order to successfully raise a claim under subsection (g)(1)(D).

 

c. Third Element: Adverse Effect had Causal Nexus to Violation

i. Adverse Effects

A complaint is subject to dismissal for failure to state a subsection (g)(1)(D) damages claim if no “adverse effect” is alleged.  See, e.g., Doe v. Chao, 540 U.S. 614, 624 (2004) (“‘[A]dverse effect’ acts as a term of art identifying a potential plaintiff who satisfies the injury-in-fact and causation requirements of Article III standing, and who may consequently bring a civil action without suffering dismissal for want of standing to sue.”); Hunt v. VA, 739 F.3d 706, 707 (D.C. Cir. 2014) (“The district court lacked subject matter jurisdiction over appellant’s Privacy Act claims for damages because the claims are based on the assertion ‘that the VA’s failure to maintain accurate and complete records adversely affected a veteran’s benefits determinations.’”); Hernandez v. Johnson, 514 F. App’x 492, 500 (5th Cir. 2013) (holding that “although [appellant] complained of damages dating back to 2008, he also indicated in his deposition that he was not aware of any of the disclosures until either 2010 or 2011,” and thus, “no reasonable jury could find that the adverse effects [appellant] suffered were caused by these disclosures”); Shearson v. DHS, 638 F.3d 498, 505-06 (6th Cir. 2011) (“[Plaintiff’s] request to pursue a claim under § 552a(e)(4) was properly denied because she failed to allege or show the requisite ‘adverse effect’ from Defendants’ alleged failure to provide notice specifically regarding the [system of records] at an earlier date.”); McCready v. Nicholson, 465 F.3d 1 (D.C. Cir. 2006) (remanding case for district court to determine whether plaintiff suffered “adverse effect” by being denied bonus); Quinn, 978 F.2d at 135 (“[T]he adverse effect requirement of (g)(1)(D) is, in effect, a standing requirement.”); Taylor v. FAA, 351 F. Supp. 3d 97, 103-4 (D.D.C. 2018) (finding no adverse effect from mere improper maintenance of Plaintiff’s name, address, and email address by the FAA); Wright v. United States, No. 4:17-CV-02101, 2018 WL 4854037, at *8 (N.D. Ala. Oct. 5, 2018) (dismissing Privacy Act claim as not satisfying standing requirements where no particularized injury regarding plaintiff’s own data being lost was alleged); Young v. Tryon, No. 12-CV-6251CJS, 2015 WL 309431, at *17 (W.D.N.Y. Jan. 23, 2015) (magistrate recommendation) (noting lack of actual damages where complaint only alleged disclosure of medical information caused plaintiff to be “very uncomfortable discussing his medical issues”) adopted, 2015 WL 554807 (Feb. 11, 2015); Dick v. Holder, 67 F. Supp. 3d 167, 182-3 (D.D.C. 2014 (finding agent failed to provide allegations plausibly suggesting causal link between disclosure warning and claimed adverse effects); Fletcher v. DOJ, 17 F. Supp. 3d 89, 95-96 (D.D.C. 2014) (stating in dicta that “[b]ecause the requested court documents might be available from the [court] where they originated [ ] plaintiff cannot show an adverse effect from the agency’s destruction of the copies of the same records”); Reed v. Navy, 910 F. Supp. 2d 32, 45 (D.D.C. 2012) (finding that disclosures did not cause plaintiff to be constructively discharged because “the causal link between the disclosures and plaintiff’s separation from [his employer] is broken by intervening events”); Mata v. McHugh, No. 10-cv-838, 2012 WL 2376285, at *6 (W.D. Tex. June 22, 2012) (granting summary judgement on Privacy Act claim where plaintiff failed to plead specific actual damages from disclosure of resume);  Raley v. Astrue, No. 2:11cv555, 2012 WL 2368609, at *7 (M.D. Ala. June 21, 2012) (“Plaintiff presents no evidence to establish that receiving someone else’s information did in fact adversely affect her.”); Hurt v. D.C. Court Servs. & Offender Supervision Agency, 827 F. Supp. 2d 16, 21 (D.D.C. 2011) (concluding that plaintiff did not show that alleged improper disclosure . . . resulted in his homelessness because “decision for him to leave [his] residence . . . was made before the alleged disclosure); Philippeaux v. United States, No. 10 Civ. 6143, 2011 WL 4472064, at *9 (S.D.N.Y. Sept. 27, 2011) (holding that plaintiff failed to allege that “any pertinent records have been removed” and, “[a]s a result, . . . he fails to adequately show that he was adversely affected by any disclosure”); Bhatia v. Office of the U.S. Attorney, N. Dist. of Cal., No. C 09-5581, 2011 WL 1298763, at *4 (N.D. Cal. Mar. 29, 2011) (finding that plaintiff who was “wrongly indicted” lacked standing because he “cannot show, at this juncture, that he was injured by the return of the criminal indictment” because “those charges are currently pending”); Mauldin v. Napolitano, No. 10-12826, 2011 WL 3113104, at *3 (E.D. Mich. July 26, 2011); Conley v. United States, No. 2:10-cv-444, 2011 WL 1256611, at *7 (S.D. Ohio Mar. 31, 2011); Shope v. Navy, No. 1:CV-09-2400, 2010 WL 2766638, at *3 (M.D. Pa. July 13, 2010); Sieverding v. DOJ, 693 F. Supp. 2d 93, 106 (D.D.C. 2010), aff’d per curiam, No. 10-5149, 2010 WL 4340348 (D.C. Cir. Oct. 19, 2010); Ciralsky v. CIA, 689 F. Supp. 2d 141, 155-56 (D.D.C. 2010); Sutera v. TSA, 708 F. Supp. 2d 304, 318-19 (E.D.N.Y. 2010); Goodwin v. Johnson, No. 8:10CV40, 2010 WL 1500872, at *3 (D. Neb. Apr. 14, 2010); Doe v. DOJ, 660 F. Supp. 2d 31, 49 (D.D.C. 2009); Baker v. United States, No. 5:05-221, 2006 WL 1635634, at *4 (E.D. Ky. June 8, 2006) (finding that plaintiff failed to allege any adverse effect resulting from disclosure to press of reasons for his medical discharge); Robinett v. State Farm Mut. Auto. Ins. Co., No. 02-0842, 2002 WL 31498992, at *4 (E.D. La. Nov. 7, 2002) (stating that “[e]ven if [agency’s] communication did not technically satisfy the notice requirement of [subsection (e)(8)], plaintiff was not adversely affected by a failure to receive notice after the records were disclosed,” because “plaintiff had no legal basis to prevent [agency] from releasing his records” and in fact knew of possible release and tried to prevent it), aff’d per curiam, 83 F. App’x 638 (5th Cir. 2003); Fort Hall Landowners Alliance, Inc. v. BIA, No. CV-99-00052-E, slip op. at 12 (D. Idaho Mar. 29, 2001); Hass v. Air Force, 848 F. Supp. 926, 932 (D. Kan. 1994); Swenson v. USPS, No. S-87-1282, 1994 U.S. Dist. LEXIS 16524, at *30 (E.D. Cal. Mar. 10, 1994); Green v. USPS, No. 88-0539, 1989 U.S. Dist. LEXIS 6846, at *6-8 (S.D.N.Y. June 19, 1989); Tracy v. SSA, No. 88-C-570-S, slip op. at 4-5 (W.D. Wis. Sept. 23, 1988); Crichton v. Cmty. Servs. Admin., 567 F. Supp. 322, 324 (S.D.N.Y. 1983) (finding mere maintenance of allegedly “secret file” insufficient to warrant damages where no showing of adverse effect); Church v. United States, 2 Gov’t Disclosure Serv. (P-H) ¶ 81,350, at 81,911 (D. Md. Jan. 5, 1981) (finding no adverse effect from failure to provide subsection (e)(3) notice); Harper v. United States, 423 F. Supp. 192, 196-97 (D.S.C. 1976); cf. Ashbourne v. Hansberry, 302 F. Supp. 3d 338, 347-48 (D.D.C. 2018) (finding plaintiff adequately pled adverse effect from purported falsification of her personnel records and then the use of those records to publicly terminate her); Babatu v. Dallas VA Med. Ctr., No. 3:11-CV-00533, 2014 WL 626515, at *9 (N.D. Tex. Feb. 18, 2014) (finding that plaintiff presented genuine disputes of material fact as to whether plaintiff was adversely affected due to “pecuniary loss in the form of lost work-study wages as a result of the disclosure of his information”); Banks v. Butler, No. 5:08CV336, 2010 WL 4537902, at *6 (S.D. Miss. Sept. 23, 2010) (magistrate’s recommendation) (asserting statements about plaintiff by staff members were “at most – innocuous statements of opinion, rather than disclosures of records and create no real adverse effect”), adopted, 2010 WL 4537909 (S.D. Miss. Nov. 2, 2010); Nunez v. Lindsay, No. 3:CV005-1763, 2007 WL 517754, at *1-2 (M.D. Pa. Feb. 12, 2007) (concluding that inmate lacked standing to bring Privacy Act claim against BOP based on prison’s “practice of photographing friends and family who chose to visit” him because “[a]ny invasion of privacy interests concerns the visitors, not the inmates”); Clark v. BOP, 407 F. Supp. 2d 127, 129-131 (D.D.C. 2005) (concluding that disclosure of inmate’s medical records to second inmate so that he could decipher word on first inmate’s chart presented triable issue of whether first inmate’s HIV status was disclosed, but dismissing claim because “plaintiff has not shown that the disclosure caused him to suffer an adverse effect or to sustain actual damages”).

“Adverse effects” include nonpecuniary and nonphysical harm as well as monetary loss.

An “adverse effect” includes not only monetary damages, but also nonpecuniary and nonphysical harm, such as mental distress, embarrassment, or emotional trauma.  See, e.g., Speaker v. HHS Ctrs. for Disease Control & Prevention, 623 F.3d 1371, 1382-83 (11th Cir. 2010); Doe v. Chao, 306 F.3d 170, 187 (4th Cir. 2002) (Michael, J., dissenting) (“The majority and I . . . also agree that emotional distress can qualify as an adverse effect.”), aff’d, 540 U.S. 614 (2004); Quinn, 978 F.2d at 135-36; Englerius v. VA, 837 F.2d 895, 897 (9th Cir. 1988); Albright v. United States, 732 F.2d 181, 186 (D.C. Cir. 1984); Usher v. Sec’y of HHS, 721 F.2d 854, 856 (1st Cir. 1983); Parks v. IRS, 618 F.2d 677, 682-83 & n.2 (10th Cir. 1980); Kvech v. Holder, No. 10-cv-545, 2011 WL 4369452, at *4 (D.D.C. Sept. 19, 2011); Rice v. United States, 245 F.R.D. 3, 5-6 (D.D.C. 2007); Lechliter v. Army, No. 04-814, 2006 WL 462750, at *5 (D. Del. Feb. 27, 2006); Schmidt v. VA, 218 F.R.D. 619, 632 (E.D. Wis. 2003); Romero-Vargas v. Shalala, 907 F. Supp. 1128, 1134 (N.D. Ohio 1995); cf. Tarullo v. Def. Contract Audit Agency, 600 F. Supp. 2d 352, 359 (D. Conn. 2009) (dismissing case where “the disclosures of [plaintiff’s] [social security number] had [no] adverse effect on [him] other than the displeasure he felt because these disclosures were against his wishes”); Clark v. BOP, 407 F. Supp. 2d 127, 131 (D.D.C. 2005) (“Nothing in the record . . . connects the alleged adverse effect, i.e., plaintiff’s maltreatment, with the disclosure at issue.”); Doyon v. DOJ, 304 F. Supp. 2d 32, 35 (D.D.C. 2004) (“[A]ssum[ing] without deciding that [BOP’s] decision ‘to restrict [plaintiff] from a transfer and many Institutional programs’ . . . is an adverse determination,” but finding the claim to have been rendered moot.).  But see Ferguson v. Alderson Federal Prison Camp, No. 1:18-00180, 2018 WL 7820739, at *6 (S.D. W.Va., Oct. 18, 2018) (finding conclusory statement of adverse effect from alleged loss of outside medical records by prison resulting in “wounded feelings” and “mental anguish” failed to allege any actual damage or adverse consequence); Risch v. Henderson, 128 F. Supp. 2d 437, 441 (E.D. Mich. 1999) (stating that even assuming that there had been a violation of the Privacy Act for the maintenance of alleged “secret files,” because plaintiff claimed only “extreme mental anguish and mental concern and worry,” she had “failed to demonstrate [an] ‘adverse effect’”), aff’d sub nom. Risch v. USPS, 244 F.3d 510 (6th Cir. 2001).

For a novel interpretation of “adverse effect,” see Bagwell v. Brannon, No. 82-8711, slip op. at 5-6 (11th Cir. Feb. 22, 1984), in which the Court of Appeals for the Eleventh Circuit found that no “adverse effect” was caused by the government’s disclosure of an employee’s personnel file during cross-examination while defending against the employee’s tort lawsuit, because the “employee created the risk that pertinent but embarrassing aspects of his work record would be publicized” and “disclosure was consistent with the purpose for which the information was originally collected.” 

“Adverse effect” is a separate element from “actual damages.”

The threshold showing of “adverse effect,” which typically is not difficult for a plaintiff to satisfy, should carefully be distinguished from the conceptually separate requirement of “actual damages,” discussed below.  See, e.g., Fort Hall Landowners Alliance, Inc. v. BIA, 407 F. Supp. 2d 1220, 1225 (D. Idaho 2006) (explaining that “[i]t is important not to confuse this standing requirement with the entirely separate element that requires proof of actual damages” and that “to satisfy the Privacy Act’s adverse effect and causation requirements, plaintiffs need not show actual damages from the disclosure, but must merely satisfy the traditional ‘injury-in-fact and causation requirements of Article III’”).  As one district court has explained, “[t]he requirement of an ‘adverse effect’ requires more” than a “statement of ‘damages’ [that] merely summarizes the alleged violations of law.”  Foncello v. Army, No. 04-604, 2005 WL 2994011, at *4 (D. Conn. Nov. 7, 2005). 

The distinct nature of these two elements is demonstrated by the Supreme Court’s review in FAA v. Cooper, 132 S. Ct. 1441 (2012), of an opinion by the Court of Appeals for the Ninth Circuit, Cooper v. FAA, 622 F.3d 1016 (9th Cir. 2010).  In Cooper, the Ninth Circuit, in construing the Privacy Act to allow for the recovery of nonpecuniary damages, reasoned that because “mental distress or emotional harm is sufficient to constitute an adverse effect,” a construction of the Act that allowed a plaintiff to establish standing for an injury that results in nonpecuniary harm, but that would not allow the plaintiff to seek actual damages for such a nonpecuniary injury would “frustrate the intent of Congress.”  Id. at 1021.  The Ninth Circuit majority further stated that “[i]n contrast, our opinion is true to the overall objective of the Act, allowing a plaintiff who demonstrates a nonpecuniary adverse effect to have the opportunity to recover nonpecuniary damages.”  Id.  However, on writ of certiorari a majority of the Supreme Court reversed the Ninth Circuit’s opinion and held that the Privacy Act does not authorize damages for nonpecuniary injuries such as mental or emotional distress.  The Supreme Court did not consider the separate issue of “adverse effect” in its ruling.  See FAA v. Cooper, 132 S. Ct. at 1453; see also, Fazaga v. FBI, 916 F.3d 1202, 1249 (9th Cir. 2019) (finding only damages and not injunctive relief available for Privacy Act violations of the catch-all provision at § 552a(g)(1)(D)); Coleman v. U.S., 912 F.3d 824, 836 (5th Cir. 2019) (affirming summary judgement on Privacy Act claim against plaintiff who did not offer any evidence of actual harm other than her own unsubstantiated allegations of emotional trauma); Richardson v. Bd. of Governors of Fed. Reserve Sys., 288 F. Supp. 3d 231, 236-37 (D.D.C. 2018) (finding claim that plaintiff suffered “adverse and harmful effects” insufficient where effects included “mental distress, emotional trauma, embarrassment, humiliation” that are not authorized under Privacy Act and where alleged “lost or jeopardized present and future financial opportunities” were not supported by sufficient facts to sustain claim of actual damages).

 

ii. Causation

A showing of causation – that the violation caused an adverse effect, and that the violation caused “actual damages,” as discussed below – is also required.  See, e.g., Beaven v. DOJ, 622 F. 3d 540, 558 (6th Cir. 2010); Sweeney v. Chertoff, 178 F. App’x 354, 357-58 (5th Cir. 2006); Mandel v. OPM, 79 F. App’x 479, 481-82 (2d Cir. 2003), aff’g 244 F. Supp. 2d 146, 153 (E.D.N.Y. 2003); Orekoya v. Mooney, 330 F.3d 1, 10 (1st Cir. 2003); Quinn, 978 F.2d at 135; Hewitt v. Grabicki, 794 F.2d 1373, 1379 (9th Cir. 1986); Albright, 732 F.2d at 186-87; Edison v. Army, 672 F.2d 840, 842, 845 (11th Cir. 1982); Lugo v. DOJ, 214 F. Supp. 3d. 32, 41 (D.D.C. 2016); Iqbal v. DOJ, No. 3:11-cv-369, 2013 U.S. Dist. LEXIS 138793, at *15 (M.D. Fla. Sept. 26, 2013); Colgan v. Mabus, No. 11cv2278, 2013 U.S. Dist. LEXIS 129215, at *7-8 (S.D. Cal. Sept. 10, 2013); Su v. NASA, No. 5:09-cv-02838, 2013 WL 1663608, at *6-7 (N.D. Cal. Apr. 17, 2013); Reed, 910 F. Supp. 2d at 45-46; Grant v. United States, No. 2:11-cv-00360, 2012 WL 5289309, at *8-9 (E.D. Cal. Oct. 23, 2012); York v. McHugh, 698 F. Supp. 2d 101, 108 (D.D.C. 2010); Mitchell v. VA, No. 1:07-cv-1015-TCB, 2008 WL 11432084, at *3 (N.D. Ga. June 12, 2008); Thompson v. State, 400 F. Supp. 2d 1, 14 (D.D.C. 2005); Harmer v. Perry, No. 95-4197, 1998 WL 229637, at *3 (E.D. Pa. Apr. 28, 1998), aff’d, No. 98-1532 (3d Cir. Jan. 29, 1999); Swenson, No. S-87-1282, 1994 U.S. Dist. LEXIS 16524, at *30 (E.D. Cal. Mar. 10, 1994); Connelly v. Comptroller of the Currency, No. H-84-3783, slip op. at 4 (S.D. Tex. June 3, 1991); Rodgers v. Army, 676 F. Supp. 858, 862 (N.D. Ill. 1988); Tuesburg v. HUD, 652 F. Supp. 1044, 1048 (E.D. Mo. 1987); Ely v. DOJ, 610 F. Supp. 942, 946 (N.D. Ill. 1985), aff’d, 792 F.2d 142 (7th Cir. 1986) (unpublished table decision).  But see Rickles v. Marsh, No. 3:88-100, slip op. at 8-9 (N.D. Ga. Jan. 10, 1990) (awarding minimum damages even in absence of causation).   

It also has been held that “[f]or there to be a causal link between the injury and the violation of the Act, the injury necessarily must be distinct and independent from the violation of the Act itself.”  Schmidt v. VA, 218 F.R.D. at 632; see also Doe v. Chao, 306 F.3d at 186 (Michaels, J., dissenting) (“The causal prong makes it especially clear that an adverse effect must be something distinct from the intentional and willful violation itself.  For if a violation of the Privacy Act was sufficient to constitute an adverse effect, there could be no question of whether the violation caused the adverse effect, and hence the causal prong would be superfluous.”); Quinn, 978 F.2d at 135 (stating that in addition to establishing an adverse effect sufficient to confer standing, “plaintiff must also allege a causal connection between the agency violation and the adverse effect”); cf. Doe v. Chao, 540 U.S. 614, 627 (2004) (“The ‘entitle[ment] to recovery’ necessary to qualify for the $1,000 minimum is not shown merely by an intentional or willful violation of the Act producing some adverse effect.”).  But cf. Romero-Vargas v. Shalala, 907 F. Supp. 1128, 1134-35 (N.D. Ohio 1995) (stating, prior to Supreme Court’s decision in Doe v. Chao, that “emotional distress caused by the fact that the plaintiff’s privacy has been violated is itself an adverse effect, and that statutory damages can be awarded without an independent showing of adverse effects”; stating further in memorandum on motion to alter or amend judgment that “[i]t is eminently reasonable to infer that plaintiffs suffered mental distress by the fact of knowing their personal information had been disclosed”). 

 

d. Fourth Element: Intentional or Willful Standard

In addition, an agency must be found to have acted in an “intentional or willful” manner in order for a damages action to succeed.  See 5 U.S.C. § 552a(g)(4).  This standard is discussed below under “Civil Remedies, Principles Applicable to Damages Lawsuits, Intentional or Willful Standard.”

 

3. Standard and Scope of Review

Certain statutes preempt the Privacy Act’s remedies for alleged violations of the Privacy Act’s disclosure provisions.

The issue of the Privacy Act’s applicability to disclosures of tax information has been analyzed by the Court of Appeals for the District of Columbia Circuit in Gardner v. United States, 213 F.3d 735 (D.C. Cir. 2000), aff’d, No. 96-1467, 1999 U.S. Dist. LEXIS 2195, at *14-17 (D.D.C. Jan. 29, 1999).  In Gardner, the D.C. Circuit concluded that the Internal Revenue Code preempts the Privacy Act for remedies for disclosures of tax information, holding that 26 U.S.C. § 6103 is “the exclusive remedy for a taxpayer claiming unlawful disclosure of his or her tax returns and tax information.”  213 F.3d at 741-42.  Similarly, although not going quite as far, the Court of Appeals for the Fifth Circuit had previously held that “[26 U.S.C.] § 6103 is a more detailed statute that should preempt the more general remedies of the Privacy Act, at least where . . . those remedies are in conflict.”  Hobbs v. United States, 209 F.3d 408, 412 (5th Cir. 2000) (finding § 6103 and the Privacy Act to be “in conflict” where disclosure fell within one of the exceptions in § 6103, and holding that “[t]o the extent that the Privacy Act would recognize a cause of action for unauthorized disclosure of tax return information even where § 6103 would provide an exception for the particular disclosure, § 6103 trumps the Privacy Act”).  Other courts, too, have found the provisions of the tax code to be exclusive as to wrongful disclosures of tax information.  See Ross v. United States, 460 F. Supp. 2d 139, 151 (D.D.C. 2006) (“[Section] 6103 is the exclusive remedy for a taxpayer claiming unlawful disclosure of his or her tax returns and information.”); Schwartz v. Kempf, No. 4:02-cv-198, 2004 U.S. Dist. LEXIS 2238, at *10-12 (W.D. Mich. Jan. 22, 2004) (citing Gardner and finding the provisions of the Privacy Act to be “trumped by the more specific provisions of the Internal Revenue Code found in 26 U.S.C. § 6103”); Berridge v. Heiser, 993 F. Supp. 1136, 1144-45 (S.D. Ohio 1997) (holding that 26 U.S.C. § 7431(a)(1), which provides a mechanism for the award of civil damages for unauthorized disclosure of tax return information (as defined in 26 U.S.C. § 6103), is the “exclusive remedy by which [plaintiff] may bring a cause of action for improper disclosure of return information”); Gov’t Nat’l Mortgage, Ass’n v. Lunsford, No. 95-273, 1996 U.S. Dist. LEXIS 1591, at *8 (E.D. Ky. Feb. 2, 1996) (dismissing Privacy Act claim for wrongful disclosure (presumably brought under subsection (g)(1)(D)) and stating that “26 U.S.C. § 7852(e) precludes the maintenance of Privacy Act damages remedies in matters concerning federal tax liabilities”).

Nevertheless, the Courts of Appeals for the Fourth and the Eighth Circuits, as well as the United States Tax Court, have readily applied the Privacy Act as well as the provisions of the tax code to disclosures of tax return information, with no discussion of the issue of preemption.  See, e.g., Scrimgeour v. IRS, 149 F.3d 318, 325-26 (4th Cir. 1998) (affirming denial of damages and finding that the agency had not acted with gross negligence under 26 U.S.C. § 7431 or greater than gross negligence under the Privacy Act for wrongful disclosure claims resting upon identical factual allegations); Taylor v. United States, 106 F.3d 833, 835-37 (8th Cir. 1997) (affirming finding that disclosures did not violate 26 U.S.C. § 6103 or Privacy Act); Stone v. Comm’r of IRS, No. 3812-97, 1998 WL 547043, at *3 (T.C. Aug. 31, 1998) (finding that disclosures did not violate either 26 U.S.C. § 6103 or Privacy Act).  In addition, one district court specifically considered the issue and arrived at the conclusion that the Privacy Act’s remedies are available for the wrongful disclosure of tax return information.  Sinicki v. Treasury, No. 97 CIV. 0901, 1998 WL 80188, at *3-5 (S.D.N.Y. Feb. 24, 1998) (denying motion to dismiss Privacy Act wrongful disclosure claim and stating that “the language, structure, purpose and legislative history of Section 6103 do not make manifest and clear a legislative intent to repeal the Privacy Act as it applies to tax return information”).

Several district courts have held that various sections of the Internal Revenue Code prevent their exercise of subject matter jurisdiction over Privacy Act claims brought under subsection (g)(1)(D) for alleged violations of other provisions of the Privacy Act.  See Welborn v. IRS, 218 F. Supp. 3d 64, 81 (D.D.C. 2016) (citing 26 U.S.C. §§ 6103(a), 7431 as preempting failure to safeguard and unauthorized disclosure claims under Privacy Act); Diamond v. IRS, No. CV 13-8042-GHK, 2014 WL 7883613, at *9, 115 A.F.T.R.2d 2015-319 (C.D. Cal. Nov. 14, 2014) (magistrate recommendation) (citing 26 U.S.C. § 6103 as superseding a Privacy Act claim for unauthorized disclosure of tax return), adopted, 2015 WL 64805, 115 A.F.T.R.2d 2015-328, 2015-1 USTCP 50,162 (C.D. Cal. Jan. 5, 2015); Schwartz v. Kempf, 2004 U.S. Dist. LEXIS 2238, at *10-12 (citing 26 U.S.C. § 7852(e), stating that “provisions of the Privacy Act do not apply, either directly or indirectly, to assessing the possibility of a tax liability,” where plaintiffs alleged that IRS violated Privacy Act by contacting persons regarding plaintiffs’ tax situation); Berridge v. Heiser, 993 F. Supp. 1136, 1145 (S.D. Ohio 1997) (holding that 26 U.S.C. § 7852(e) prevented it from exercising jurisdiction over plaintiff’s Privacy Act claims under subsections (e)(2), (e)(5), and (e)(6) related to tax liability); Estate of Myers v. United States, 842 F. Supp. 1297, 1302-04 (E.D. Wash. 1993) (dismissing Privacy Act subsection (g)(1)(D) damages claim and applying § 7852(e)’s jurisdictional bar to preclude subject matter jurisdiction to consider action against IRS for alleged violation of subsection (e)(3) concerning summons issued to assist in determination of foreign tax liability); cf. Smilde v. Richardson, Comm’r, No. 97-568, 1997 U.S. Dist. LEXIS 15050, at *6-7 (D. Minn. Aug. 28, 1997) (relying on limitation of Privacy Act applicability pursuant to sections 6103 and 7852(e), and finding that “Privacy Act does not support subject matter jurisdiction” to enjoin IRS from contracting out processing of tax returns), aff’d per curiam, 141 F.3d 1170 (8th Cir. 1998) (unpublished table decision); Trimble v. United States, No. 92-74219, 1993 WL 288295, at *1 (E.D. Mich. May 18, 1993) (citing 26 U.S.C. § 7852(e) for Privacy Act’s inapplicability and dismissing unspecified Privacy Act claim), aff’d, 28 F.3d 1214 (6th Cir. 1994) (unpublished table decision). 

Note also that some courts have held that the exclusivity provision of the Federal Employees’ Compensation Act, 5 U.S.C. § 8116(c) (2018), precludes a cause of action under the Privacy Act.  See, e.g., Smith v. Nicholson, 287 F. App’x 402, 403-05 (5th Cir. 2008) (per curiam) (discussing where Labor Secretary denied plaintiff’s FECA claim alleging that VA injured him by disclosing his records “not for lack of coverage, but for insufficient proof,” holding that “such a denial is conclusive as to FECA coverage”; “the Secretary found FECA applicable” and “[t]hat decision precludes any further action on [plaintiff’s] Privacy Act claim”); Richards v. CIA, 837 F. Supp. 2d 574, 579-580 (E.D. Va. 2011) (dismissing Privacy Act claim because “[t]he disclosures and the subsequent harm came exclusively in the context of [plaintiff’s] employment at the CIA” and stating that “absent a determination by the Secretary of Labor that FECA does not cover [plaintiff’s] Privacy Act claim, this Court has no jurisdiction to entertain the Privacy Act claim”); Carte v. United States, No. 2:07-0515, 2010 WL 3259420, at *7-8 (S.D. W. Va. Aug. 18, 2010) (concluding that “whether viewed as being precluded by a merits based DOL decision or a decision of lesser quantum leaving open the substantial question of whether [plaintiff’s] injuries, if any, were sustained while performing his duties, section 8116(c) bars a Privacy Act claim from being pursued in this action,” where plaintiff attempted to recover for injury allegedly caused by agency’s disclosure of his medical information by filing both FECA claim and Privacy Act claim); Vogrin v. ATF, No. 598CV117, 2001 WL 777427, at *7-8 (N.D. W. Va. Mar. 30, 2001) (ruling that FECA’s exclusivity provision “precludes a suit under the Privacy Act even if FECA does not provide benefits for all of the injuries that [the plaintiff] claims”), aff’d per curiam, 15 F. App’x 72 (4th Cir. 2001).

Similarly, it has been held that the Civil Service Reform Act deprives a court of subject matter jurisdiction over a Privacy Act claim brought under subsection (g)(1)(D).  See Henderson v. Air Force, No. 06-323, 2008 WL 4542761, at *2-3 (D. Ariz. Oct. 10, 2008), aff’d, 370 F. App’x 807 (9th Cir. 2010).  This issue is discussed more fully above in the section titled, “5 U.S.C. § 552a(g)(1)(C) - Damages Lawsuits for Failure to Assure Fairness in Agency Determinations.”

Subsection (g)(1)(D) suits cannot be used to collaterally attack agency determinations.

Consistent with case law under subsection (g)(1)(C), the District Court for the District of Columbia has stated that a plaintiff “cannot rely on any arguable violation of the Privacy Act” under (g)(1)(D) – in that case an alleged wrongful disclosure – to “collaterally attack” an agency personnel decision.  Hanna v. Herman, 121 F. Supp. 2d 113, 123-24 (D.D.C. 2000) (finding that MSPB did not err in refusing to address plaintiff’s Privacy Act argument, but, “assuming arguendo that [he] preserved [it],” discussing merits of plaintiff’s “Privacy Act defense to the demotion”), summary affirmance granted sub nom. Hanna v. Chao, No. 00-5433 (D.C. Cir. Apr. 11, 2001); Hinson-Gribble v. OPM, No. 5:16-CV-70-FL, 2017 WL 9480265, at *5 (E.D.N.C. July 11, 2017) (dismissing Privacy Act claim to extent that plaintiff seeks to obtain relief from substantive decisions made with respect to various benefits she contends are due her); Melvin v. VA, F. Supp. 3d 350, 357 (D.D.C. 2014) (finding Privacy Act provisions for amending records not designed to permit collateral attack upon that which has already been subject of a judicial or quasi-judicial action).  See also Cross, No. 3:09-CV-1293, 2013 WL 1149525, at *10 (N.D.N.Y. Mar. 19, 2013) (dismissing plaintiff’s damages claim for wrongful disclosure relating to her termination from United States Postal Service because she “does not articulate the disclosure of any specific information contained in a system of records”); Doe v. DOJ, 660 F. Supp. 2d at 50-51 (concluding that plaintiff’s subsection (b)/(g)(1)(D) claim against MSPB for refusing to allow him to proceed under pseudonym was “collateral attack” of that decision because plaintiff’s claim “attempts to achieve the same forbidden objective” as prototypical collateral attacks – “relitigating issues already decided by the ALJ”).

 

E. Principles Applicable to Damages Lawsuits

“In any suit brought under the provisions of subsection (g)(1)(C) or (D) of this section in which the court determines that the agency acted in a manner which was intentional or willful, the United States shall be liable to the individual in an amount equal to the sum of . . . actual damages sustained by the individual as a result of the refusal or failure, but in no case shall a person entitled to recovery receive less than the sum of $1,000.”  5 U.S.C. § 552a(g)(4).

 

1. Intentional or Willful Standard

Comment:

Damages suits under the Privacy Act require that the agency acted in an “intentional or willful” manner.

In order for there to be any liability in a subsection (g)(1)(C) or (g)(1)(D) damages lawsuit, the agency must have acted in an “intentional or willful” manner.  5 U.S.C. § 552a(g)(4).  The words “intentional” and “willful” in subsection (g)(4) do not have their vernacular meanings; instead, they are “terms of art.”  White v. OPM, 840 F.2d 85, 87 (D.C. Cir. 1988) (per curiam); see also Convertino v. DOJ, 769 F. Supp. 2d 139, 145-46 (D.D.C. 2011) (noting that “[s]tandards of intentionality and willfulness are anything but rare in the law” but explaining that “the Privacy Act’s intent or willfulness requirement is peculiar to the Act and must not be confused with less exacting standards parading under the same name from other common law or statutory sources” (citing White)), rev’d and remanded on other grounds, 684 F.3d 93 (D.C. Cir. 2012).  The Act’s legislative history indicates that this unique standard is “[o]n a continuum between negligence and the very high standard of willful, arbitrary, or capricious conduct,” and that it “is viewed as only somewhat greater than gross negligence.”  120 Cong. Rec. 40,406, reprinted in Source Book at 862.

While not requiring premeditated malice, see Parks v. IRS, 618 F.2d 677, 683 (10th Cir. 1980), cases analyzing subsection (g)(4) have held that, to meet the “intentional or willful” standard, the agency’s actions must be:

• So patently egregious and unlawful that anyone undertaking the conduct should have known it was unlawful.  E.g., Maydak v. United States, 630 F.3d 166, 179-83 (D.C. Cir. 2010); Sussman v. Marshals Serv., 494 F.3d 1106, 1122 (D.C. Cir. 2007); Laningham v. Navy, 813 F.2d 1236, 1242-43 (D.C. Cir. 1987) (per curiam); Albright v. United States, 732 F.2d 181, 189 (D.C. Cir. 1984); Wisdom v. HUD, 713 F.2d 422, 424-25 (8th Cir. 1983);
• Somewhat greater than gross negligence.  E.g., Coleman v. United States, 12 F.3d 824, 836-837 (5th Cir. 2019); Maydak, 630 F.3d at 179-83; Beaven v. DOJ, 622 F.3d 540, 547-53 (6th Cir. 2010); Powers v. Parole Comm’n, 296 F. App’x 86, 87 (D.C. Cir. 2008); Scrimgeour v. IRS, 149 F.3d 318, 326 (4th Cir. 1998); Rose v. United States, 905 F.2d 1257, 1260 (9th Cir. 1990); Britt v. Naval Investig. Service, 886 F.2d 544, 551 (3d Cir.1989); Andrews v. VA, 838 F.2d 418, 424-25 (10th Cir. 1988); Bruce v. United States, 621 F.2d 914, 917 (8th Cir. 1980); 
• In flagrant disregard of an indiviudal’s rights under the Privacy Act.  E.g., Lewis v. Mossbrooks, 788 F. App’x 455, 458 (9th Cir. 2019); Maydak, 630 F.3d at 179-83; Pippinger v. Rubin, 129 F.3d 519, 530 (10th Cir. 1997); Deters v. Parole Comm’n, 85 F.3d 655, 660 (D.C. Cir. 1996); Kellett v. BOP, 66 F.3d 306 (1st Cir. 1995) (per curiam) (unpublished table decision); Covert v. Harrington, 876 F.2d 751, 756-57 (9th Cir. 1989); or
• Without grounds for believing the agency’s actions to be lawful. E.g., Maydak, 630 F.3d at 179-83; Kellett, 66 F.3d at *3; Covert, 876 F.2d at 756-57; Albright, 732 F.2d at 189-90.

 

Negligence violations are insufficient to meet the “intentional or willful” standard.

A mere negligent or inadvertent violation of the Privacy Act is not enough to clear this formidable “intentional or willful” barrier for a plaintiff seeking damages.  See, e.g., Lewis v. Mossbrooks, 788 F. App’x at 458 (concluding that plaintiff’s complaint did not suggest that in failing to remove flag in his record, any VA employee “‘flagrantly disregard[ed]’ Lewis’ privacy rights or acted ‘without grounds for believing [their action] to be lawful,’ rather than negligently.” (citations omitted)); Campbell v. SSA, 446 F. App’x 477, 479, 481 (3d Cir. 2011) (upholding district court conclusion that “there was no record evidence to support an assertion of willful or intentional conduct” where district court found that plaintiff’s “assertion that his wife discovered some documents in her SSA file that should have been in his file, if true, established nothing more than negligence”); Maydak, 630 F.3d at 179-83 (holding that BOP did not intentionally or willfully commit Privacy Act violations because, among other reasons, records “were used only for legitimate law enforcement purposes” and notwithstanding court’s “critical discussion of the review and retention policies” in prior opinions, “BOP officials were still never placed on clear notice that their practices violated the Act”); Wilkerson v. Shinseki, 606 F.3d 1256, 1268 (10th Cir. 2010) (finding standard not met where VA physician accessed plaintiff’s medical records because physician testified that “he thought he could access the record so long as he had a ‘need to know’” and “given that [plaintiff’s] health records were relevant to whether he could continue working at the VA, [that] belief was reasonable”); Scrimgeour, 149 F.3d at 326 (finding plaintiff did not “demonstrate the higher standard of culpability required for recovery under the Privacy Act” where court had already determined that IRS’s release of his tax returns did not meet lower standard of gross negligence under provision of Internal Revenue Code); Deters, 85 F.3d at 660 (finding that Parole Commission did not “‘flagrantly disregard’” plaintiff’s privacy when it supplemented his file with rebuttal quantity of drugs attributed to him in presentence investigation report (PSI) and offered inmate hearing concerning accuracy of disputed report and concluding that “[e]ven if the Commission inadvertently or negligently violated [plaintiff’s] Privacy Act rights by not examining the accuracy of the PSI before preparing a preliminary assessment . . . such a violation (if any) could in no sense be deemed ‘patently egregious and unlawful’” (quoting Albright and Laningham, infra)); Dowd v. IRS, 776 F.2d 1083, 1084 (2d Cir. 1985) (per curiam) (holding “mere administrative error” in negligently destroying files was not predicate for liability); Chapman v. NASA, 736 F.2d 238, 242-43 (5th Cir. 1984) (per curiam) (holding standard not met where agency “reasonably could have thought” untimely filing of evaluations was proper; “before our previous opinion ‘timely’ had no precise legal meaning in this circuit”); Wisdom v. HUD, 713 F.2d 422, 424-25 (8th Cir. 1983) (finding no willful violation of Act where good faith release of loan default records is pursuant to unchallenged “Handbook”); Perry v. Block, 684 F.2d 121, 129 (D.C. Cir. 1982) (finding delayed disclosure of documents through administrative oversight was not intentional or willful); Bruce v. United States, 621 F.2d 914, 917 (8th Cir. 1980) (finding standard not met where agency relied on regulations permitting disclosure of records pursuant to subpoena, as there were “at that time no regulations or other authority to the contrary”); Brown v. Esper, No. 1:17-cv-02004-RM-STV 2019 WL 6893019 at *9 (Dec. 18, 2019) (“The fact that DHA employees were able to locate files pertaining to Plaintiff on the shared drive is not indicative of flagrant or egregious conduct rising to [willful or intentional conduct].  Nor does the fact that DHA employees received training on the Privacy Act mean that every alleged violation is intentional or willful.”); Yusim v. Office of Acting Commissioner of SSA, 406 F. Supp. 3d 194, 196 (E.D.N.Y. 2018) (finding defendant’s alleged “ignorance” insufficient to meet intentional or willful standard); Chesser v. FBI, No. 1:13cv129 (LO/IDD), 2017 WL 663348, at *6 (E.D. Va. Feb. 17, 2017) (finding that because defendant’s “letter informing plaintiff of the disclosure establishes that defendants believed their disclosure was legal pursuant to § 552a(b)(8),” plaintiff could not establish that defendants’ disclosure was intentional or willful); Hills v. Liberty Mut. Ins., No. 14–CV–0328S, 2015 WL 1243337 (W.D.N.Y Mar. 18, 2015) (“[T]o the extent, if any, that Plaintiff asserts that SSA employees should have discerned the true limited scope of the consent before disclosing Plaintiff's information, this allegation amounts to at best mere negligence or administrative error, which is insufficient to state a claim under the Privacy Act.”); Taylor v. Def. Fin. & Accounting Servs., No. 2:12-2466, 2014 WL 28820, at *9 (E.D. Cal. Jan. 3, 2014) (granting defendant’s summary judgment motion and finding that while “res ipsa loquitur is a viable theory of negligence, it cannot be used to prove intentional or willful conduct”); Williams v. United States, No. 12-00375, 2013 WL 3288306, at *11-15 (D. Haw. June 28, 2013) (finding that agency attempt[] to comply with [plaintiff’s] authorization” demonstrated intent to comply with Privacy Act and agency’s “attempts to remedy or mitigate the effects of the disclosure also show lack of willful or intentional agency action”); Reed v. Navy, 910 F. Supp. 2d 32, 44-45 (D.D.C. 2012) (explaining that even if agency employee “made any disclosures that crossed the line, the evidence does not support a conclusion that [agency employee] acted with ‘flagrant disregard’ for the Act”); Grant v. United States, No. 2:11-cv-00360, 2012 WL 5289309, at *10 (E.D. Cal. Oct. 23, 2012) (explaining that disclosure was not willful or intentional but inadvertent because “[b]efore sending out the . . . claim package, [defendant] redacted several mentions of plaintiff’s [medical] condition from the records in the claim package, but missed a few other references to plaintiff’s [medical condition], as well as certain references to certain medications that, unbeknownst to [defendant] at the time, were used to treat [plaintiff’s medical condition].”); McIntyre v. Fulwood, 892 F. Supp. 2d 209, 218 (D.D.C. 2012) (finding defendant’s actions were not intentional or willful because “‘[t]he Commission ceased reliance on the erroneous information,’ and has articulated a rational basis for its decision to deny Plaintiff parole”); Tungjunyatham v. Johanns, No. 1:06-cv-1764, 2009 WL 3823920, at *23 (E.D. Cal. Nov. 13, 2009) (finding standard not met “[i]n light of the two representatives’ established practice of communicating by [fax] in such a fashion” where agency representative faxed to office of plaintiff’s EEO representative records concerning plaintiff while latter representative was out of town and, as a result, “numerous agency employees had the chance to see the documents”), aff’d, Tungjunyatham v. Johanns, 500 F. App’x 686, 689 (9th Cir. 2012); Walker v. Gambrell, 647 F. Supp. 2d 529, 537-38 (D. Md. July 16, 2009) (alternative holding) (finding standard not met where plaintiff missed work due to miscarriage, her husband called agency to inform office of reason for plaintiff’s absence, employee who received call reacted in disruptive manner, and agency official sent e-mail to staff regarding miscarriage to inform it of reason for disruption; “disclosure may show negligence or a lack of tact and sensitivity; however, evidence of negligence is not sufficient to show that the agency acted willfully or intentionally”); Baptiste v. BOP, 585 F. Supp. 2d 133, 135 (D.D.C. 2008) (concluding that ICE’s failure to confirm receipt of faxed notice regarding plaintiff’s citizenship is no worse than negligence); Mulhern v. Gates, 525 F. Supp. 2d 174, 185-86 (D.D.C. 2007) (holding inadvertent disclosure “while attempting to assist plaintiff” not sufficient to satisfy standard); Elliott v. BOP, 521 F. Supp. 2d 41, 48 (D.D.C. 2007) (finding standard not met where BOP based plaintiff’s designation on inaccurate presentence report because “BOP was [not] aware of any potential inaccuracy in [that] report”), abrogated on other grounds, Williams v. United States District Court, District of Columbia, 806 F. Supp. 2d 44, 48 (D.D.C. 2011); Thompson v. State, 400 F. Supp. 2d 1, 12-13 (D.D.C. 2005) (finding standard not met in subsection (e)(2) claim where agency “assumed that it would be appropriate to correspond with [plaintiff’s doctor] about [plaintiff’s] medical condition” because “it was plaintiff’s doctor who made the first contact with the [agency], offering unsolicited medical information on plaintiff’s behalf”); Wiley v. VA, 176 F. Supp. 2d 747, 756-57 (E.D. Mich. 2001) (stating that even if agency violated Privacy Act by disclosing VA claims file to employer pursuant to broadly written release, agency’s actions were not “beyond grossly negligent,” as “reasonable minds clearly could differ on the scope of the release,” and thus agency’s reliance on it “cannot be deemed wholly groundless”); Porter v. USPS, No. CV595-30, slip op. at 10, 13, 21-22 (S.D. Ga. July 24, 1997) (concluding that Postal Service acted with “mere negligence” when it disclosed letter from plaintiff’s attorney written as response to plaintiff’s proposed termination to two union officials with belief that they had “a right and duty to know the disciplinary affairs of a fellow postal worker” even though plaintiff had not filed grievance through union and “had specifically instructed the management that he did not want anyone from the [union] representing his interests”), aff’d, 166 F.3d 352 (11th Cir. 1998) (unpublished table decision); Smith v. BOP, No. 94-1798, 1996 WL 43556, at *2 (D.D.C. Jan. 31, 1996) (finding standard not met where adverse determination had been rectified; the fact that certain forms were corrected immediately, even though another form may not have been, “indicates that BOP officials did not intend to maintain plaintiff’s records incorrectly”); Baitey v. VA, No. 8:CV89-706, slip op. at 8 (D. Neb. June 21, 1995) (finding standard not met where plaintiff failed to prove that VA acted in “flagrant or reckless disregard of [plaintiff’s] rights under the Privacy Act” when it disclosed his medical records in response to incomplete and unsigned medical authorization); Olivares v. NASA, 882 F. Supp. 1545, 1549-50 (D. Md. 1995) (finding NASA’s actions in contacting educational institutions to verify and correct discrepancies in plaintiff’s record, even assuming initial consent to contact those institutions was limited, were not even negligent and do not “come close” to meeting standard), aff’d, 103 F.3d 119 (4th Cir. 1996) (unpublished table decision); Stephens v. TVA, 754 F. Supp. 579, 582 (E.D. Tenn. 1990) (finding no damages where “some authority” existed for proposition that retrieval not initially and directly from system of records was not “disclosure,” and agency attempted to sanitize disclosed records); Blanton v. DOJ, No. 82-0452, slip op. at 6-8 (D.D.C. Feb. 17, 1984) (finding unauthorized “leak” of record not intentional or willful agency conduct); Krohn v. DOJ, No. 78-1536, slip op. at 3-7 (D.D.C. Nov. 29, 1984) (finding standard not met where agency relied in good faith on previously unchallenged routine use to publicly file records with court); Daniels v. St. Louis VA Reg’l Office, 561 F. Supp. 250, 252 (E.D. Mo. 1983) (finding mere delay in disclosure due in part to plaintiff’s failure to pay fees was not intentional or willful); Doe v. GSA, 544 F. Supp. 530, 541-42 (D. Md. 1982) (finding disclosure not “wholly unreasonable” where “some kind of consent” given for release of psychiatric records and where agency employees believed that release was authorized under GSA’s interpretation of its own guidelines, even though court concluded that such interpretation was erroneous).

In a number of other cases, courts have found that the plaintiff did not meet the “intentional or willful standard” without deciding whether the agency had violated the Privacy Act. 

In addition to cases in which the court held that a mere negligent or inadvertent violation of the Privacy Act was insufficient to meet the “intentional or willful standard,” additional cases have concluded that plaintiffs have failed to meet this high standard for a variety of other reasons.  See, e.g., Jacobs v. BOP, No. 12-5129, 2012 WL 6603085, at *1 (D.C. Cir. Dec. 17, 2012) (holding that “appellant has failed to demonstrate the Bureau violated the Act in an intentional or willful manner”); Luster v. Vilsack, 667 F.3d 1089, 1098 (10th Cir. 2011) (“[G]iven the lack of any authority in support of [plaintiff’s] contention that it is a violation of the Privacy Act to transmit confidential materials (all but one of which was covered by a transmittal cover sheet) to an unsecured fax machine, we agree with the district court that [plaintiff] has not demonstrated that any actual disclosure by [defendant] was willful and intentional.”); Puerta v. HHS, No. 99-55497, 2000 WL 863974, at *3 (9th Cir. June 28, 2000) (finding where agency, upon advice of its general counsel’s office, disclosed documents in response to grand jury subpoena, agency “may have intentionally produced [the] documents, but it does not necessarily follow that [it] intentionally violated . . . the Privacy Act”); Nathanson v. FDIC, No. 95-1604, 1996 U.S. App. LEXIS 3111, at *3-6 (1st Cir. Feb. 22, 1996) (per curiam) (affirming on grounds that disclosure was not intentional and willful because routine use “afforded reasonable grounds for belie[f] that [agency employee’s] conduct was lawful”); Scullion v. VA, No. 87-2405, slip op. at 4-8 (7th Cir. June 22, 1988) (holding no damages where agency relied upon apparently valid and unrevoked written consent to disclose records); Moskiewicz v. USDA, 791 F.2d 561, 564 (7th Cir. 1986) (noting that “elements of recklessness often have been a key characteristic incorporated into a definition of willful and intentional conduct”); Edison v. Army, 672 F.2d 840, 846 (11th Cir. 1982) (stating failure to prove agency acted “unreasonably” in maintaining records precludes finding intentional or willful conduct); Ahuruonye v. Interior, 2017 U.S. Dist. LEXIS 33207 (D.D.C. Mar. 8, 2017) (finding plaintiff had failed to demonstrate that defendant acted intentionally or willfully because plaintiff relied “exclusively upon speculative and conclusory statements”); Hurt v. D.C. Court Servs. & Offender Supervision Agency, 827 F. Supp. 2d 16, 21 (D.D.C. 2011) (finding standard not met where agency officials “believed that under [agency] policy they could disclose public information, such as the plaintiff’s conviction, to a third party without running afoul of the Privacy Act”); Alexander v. FBI, 691 F. Supp. 2d 182, 191 (D.D.C. 2010) (finding standard not met where agency disclosed records in response to “facially ordinary requests submitted according to unchallenged procedures that had been in place for thirty years” and “pursuant to its unchallenged regulations”), aff’d per curiam on other grounds, 456 F. App’x 1 (D.C. Cir. 2011); Trice v. Parole Comm’n, 530 F. Supp. 2d 213, 215 (D.D.C. 2008) (“Although plaintiff disagreed with the victim’s version of the circumstances surrounding the assault, he was able to provide his version of events at the revocation hearing.  Plaintiff therefore cannot demonstrate to a reasonable fact finder that the Commission acted with the requisite level of intent [by considering only plaintiff’s version.”); Armstrong v. BOP, 976 F. Supp. 17, 22 (D.D.C. 1997) (finding standard not met where BOP refused to amend prison records to incorporate favorable information from inmate’s prior incarceration in accordance with BOP guidelines), summary affirmance granted, Armstrong v. BOP, No. 97-5208, 1998 WL 65543, at *1 (D.C. Cir. Jan. 30, 1998); Harris v. USDA, No. 3:92CV-283-H, slip op. at 1-2, 4-5 (W.D. Ky. May 14, 1996) (finding standard not met where agency acted pursuant to Correspondence Management Handbook in maintaining supporting documentation for plaintiff’s 1975 suspension), aff’d, 124 F.3d 197 (6th Cir. 1997) (unpublished table decision); Sterling v. United States, 826 F. Supp. 570, 572 (D.D.C. 1993) (finding standard not met where agency’s “efforts both before and after the release of information . . . indicate a sensitivity to the potential harm the release might cause and represent attempts to avert that harm”), summary affirmance granted, No. 93-5264 (D.C. Cir. Mar. 11, 1994); cf. Iqbal v. DOJ, No. 3:11-cv-369-J-37, 2013 WL 3903642, at *5 (M.D. Fla. Sept. 26, 2013) (“[T]he Court previously held that Plaintiff could satisfy his burden to allege intentional and willful conduct by making allegations consistent with Rule 9(b). . . . Plaintiff has sufficiently met this standard.”); Stokes v. Barnhart, 257 F. Supp. 2d 288, 299-300 (D. Me. 2003) (citing Andrews, 838 F.2d at 424-25, and Albright, 732 F.2d at 189, and allowing plaintiff to amend complaint because agency employee’s belief “that her conduct violated any law or regulation… is not, and cannot be, determinative”).

For claims based on alleged violations of subsection 552a(b), several courts have required plaintiffs to identify the individual who disclosed the information in order to establish that the disclosure was “intentional or willful.”

In the context of a claim for disclosure in violation of subsection 552a(b), several courts have ruled that a plaintiff cannot show intentional or willful conduct without identifying the individual or individuals who disclosed the information.  See, e.g., Convertino v. DOJ, 769 F. Supp. 2d 139, 146 (D.D.C. 2011) (“To meet the Privacy Act’s high standard for a showing of willfulness or intentionality, [plaintiff] must know the leaker’s identity.  . . .  [L]acking any evidence of the leaker’s identity, no reasonable fact-finder could find that DOJ acted willfully or intentionally with regard to any leak in this case.”), rev’d and remanded on other grounds, 684 F.3d 93 (D.C. Cir. 2012) (reversing district court’s summary judgment and ruling that district court committed abuse of discretion in denying appellant’s motion to stay summary judgment to allow for further discovery to determine leaker’s identity); Paige v. DEA, 818 F. Supp. 2d 4, 14 (D.D.C. 2010) (“In order to prove that [agency] acted willfully and intentionally, it is essential that Plaintiff identify the source of the disclosure.”), aff’d, 665 F.3d 1355 (D.C. Cir. 2012); Convertino v. DOJ, No. 07-cv-13842, 2008 WL 4104347, at *7 (E.D. Mich. Aug. 28, 2008) (“To establish that the DOJ committed a willful or intentional violation, [plaintiff] must present evidence of the disclosing person’s state of mind, which requires him to identify and question those who perpetrated the allegedly improper disclosure.”); cf. Lee v. DOJ, 413 F.3d 53, 55, 60 (D.C. Cir. 2005) (upholding district court order “holding [journalists] in contempt of court for refusing to answer questions regarding confidential sources” because “[i]f [plaintiff] cannot show the identities of the leakers, [plaintiff’s] ability to show the other elements of the Privacy Act claim, such as willfulness and intent, will be compromised”); Hatfill v. Gonzales, 505 F. Supp. 2d 33, 43 (D.D.C. 2007) (granting motion to compel reporters to disclose identity of individuals who disclosed information protected by Privacy Act because “the identity of DOJ and FBI sources will be an integral component of the plaintiff’s attempt to prove the requisite agency mens rea”).

Several district courts have allowed cases to proceed because the plaintiff sufficiently alleged intentional or willful conduct.

Several district court decisions have found “intentional or willful” violations of the statute, or have otherwise allowed cases to proceed after finding that plaintiffs presented sufficient facts regarding an agency’s alleged intentional or willful conduct.  See, e.g., Ashbourne v. Hansberry, 302 F. Supp. 3d 338, 347-48 (D.D.C. Mar. 27, 2018) (“Accepting Ms. Ashbourne’s factual allegations as true and drawing all reasonable inferences in her favor, it is plausible that the DHS defendants are liable for a violation of  . . . the Privacy Act.”); Kelley v. FBI, 67 F. Supp. 3d 240, 258 (D.D.C 2014) (finding plaintiff “set forth sufficient facts about the alleged disclosure of information about plaintiffs to the media to overcome the low threshold at the motion to dismiss stage and create an inference of intentional and willful misconduct that allows” plaintiff’s first claim to proceed); Babatu v. Dallas VA Med. Ctr., No. 3:11-CV-00533, 2014 WL 626515, at *12 (N.D. Tex. Feb. 18, 2014) (considering “scope of employment . . . to the extent that it may be probative of whether [agency employee] acted intentionally or willfully in accessing and disclosing [plaintiff’s] information in [agency’s] database” and concluding that “an employee’s conduct, as well as the agency’s conduct, is relevant to the determination of whether a violation was intentional or willful”); Makowski v. United States, 27 F. Supp. 3d 901, 913 (N.D. Ill. 2014) (finding that plaintiff “has sufficiently pleaded facts to support his claim that DHS willfully violated its duty under the Privacy Act to maintain accurate records” in light of fact that agency did not update plaintiff’s citizenship status after being put on notice “not only that its record pertaining to [plaintiff’s] citizenship status was inaccurate, but also that this inaccuracy had the potential to contribute to an adverse immigration enforcement determination regarding [plaintiff] – as it did with the issuance of the 2009 detainer”); Minshew v. Donley, 911 F. Supp. 2d 1043, 1072 (D. Nev. 2012) (denying agency’s motion, as “[a] reasonable jury thus could find the [agency] acted in flagrant disregard of [plaintiff’s] rights by making an unsolicited disclosure of information contained within [plaintiff’s] OPF” to contractor “despite the fact that [contractor] did not request the information and indeed objected to the [agency’s] attempt to interfere with [plaintiff’s] placement”); Feldman v. CIA, 797 F. Supp. 2d 29, 40 (D.D.C. 2011) (finding that “plaintiff has adequately alleged intentional or willful conduct at this stage of the litigation” and denying agency’s motion to dismiss); McCullough v. BOP, No. 1:06-cv-00563, 2010 WL 5136133, at *6-7 (E.D. Cal. Dec. 6, 2010) (magistrate’s recommendation) (“Plaintiff’s allegation that [BOP] employees falsified reports and his central file and used those records to convict him of a rule violation is sufficient to state a cognizable claim against [BOP].”), adopted, 2010 WL 5476701 (E.D. Cal. Dec. 29, 2010); Tolbert-Smith v. Chu, 714 F. Supp. 2d 37, 43-44 (D.D.C. 2010) (declining to dismiss allegation that agency employee “placed records referring and relating to [plaintiff’s] disability on a server accessible by other federal employees and members of the public . . . to retaliate against her for filing an administrative complaint”); Doe v. Goss, No. 04-2122, 2007 WL 106523, at *12 (D.D.C. Jan. 12, 2007) (“If proven, Defendants’ calculated recording of false information pursuant to these allegedly sham investigations would certainly meet Deters’ definition of a willful or intentional conduct.”); Carlson v. GSA, No. 04-C-7937, 2006 WL 3409150, at *5 (N.D. Ill. Nov. 21, 2006) (discussing e-mail sent by agency employee’s supervisor to other agency personnel and to individuals outside agency regarding plaintiff’s termination settlement agreement, which included “unnecessary details concerning [employee’s] personal information” and which supervisor encouraged recipients to disseminate); Doe v. Herman, No. 297-CV-00043, 1999 WL 1000212, at *1, *13-14  (finding unnecessary the disclosure of claimant’s social security number on multi-captioned hearing form to twenty other claimants, coal companies, and insurance companies); Tomasello v. Rubin, No. 93-1326, slip op. at 17-19 (D.D.C. Aug. 19, 1997) (concerning disclosure to “60 Minutes” and all 4,500 ATF employees of details concerning plaintiff’s EEO complaint), aff’d on other grounds, 167 F.3d 612 (D.C. Cir. 1999); Porter, No. CV595-30, slip op. at 10, 13, 22-23 (S.D. Ga. July 24, 1997) (concerning disclosure by Postmaster to USPS personnel who had no “need to know” of plaintiff’s two-week suspension for impersonating a postal inspector); Romero-Vargas v. Shalala, 907 F. Supp. 1128, 1133-34 (N.D. Ohio 1995) (finding telephonic verification or non-verification of plaintiffs’ social security numbers provided by agency to their employers in violation of regulations and agency employee manual); Swenson v. USPS, No. S-87-1282, 1994 U.S. Dist. LEXIS 16524, at *33-45 (E.D. Cal. Mar. 10, 1994) (discussing disclosure to Members of Congress, who were seeking to assist constituent with complaint regarding rural mail delivery, of irrelevant information concerning plaintiff’s EEO complaints and grievances); Connelly v. Comptroller of the Currency, No. H-84-3783, slip op. at 25-27 (S.D. Tex. June 3, 1991) (addressing violation of subsection (e)(5) by disapproving of plaintiff’s appointment as president of new bank without first obtaining evaluations of prominent bankers who knew plaintiff); MacDonald v. VA, No. 87-544-CIV-T-15A, slip op. at 4, 7 (M.D. Fla. July 28, 1989) (discussing disclosure of “counseling memorandum” to plaintiff’s employer “with malicious intent and with the purpose to injure Plaintiff”); Fitzpatrick v. IRS, 1 Gov’t Disclosure Serv. (P-H) ¶ 80,232, at 80,580 (N.D. Ga. Aug. 22, 1980) (discussing disclosure to plaintiff’s co-workers and former co-worker that he had retired for “mental” reasons, even though purpose of disclosure was to “quell[] rumors and gossip”), aff’d in part, vacated & remanded in part, on other grounds, 655 F.2d 327 (11th Cir. 1982).

At least two courts of appeals, the Sixth and Ninth Circuits, have found intentional or willful Privacy Act violations.

At least two courts of appeals have found “intentional or willful” violations of the statute – the Court of Appeals for the Sixth Circuit and the Court of Appeals for the Ninth Circuit.  See Beaven v. DOJ, 622 F.3d 540, 547-53 (6th Cir. 2010); Louis v. Labor, 19 F. App’x 487, 488-89 (9th Cir. 2001); Wilborn v. HHS, 49 F.3d 597, 602-03 (9th Cir. 1995); Covert v. Harrington, 876 F.2d 751, 756-57 (9th Cir. 1989); cf. Oja v. Army Corps of Eng’rs, 440 F.3d 1122, 1136 (9th Cir. 2006) (concluding that “it was clear . . . that the [agency’s] disclosures were intentional or willful” where agency posted information about former employee on its Web site, but dismissing claim as untimely).

In Beaven, a group of BOP employees sued the agency for unlawful disclosure after a BOP investigator left an “employee roster” containing “sensitive personal information” on a desk in an area to which prisoners had access.  See 622 F.3d at 544-45.  The district court had “found that [the investigator’s] course of conduct resulted in a disclosure under the Privacy Act . . . and that his actions were ‘intentional or willful’ within the meaning of § 552a(g)(4), although his final act of leaving the folder unsecured was ‘inadvertent.’” 622 F.3d at 547; see also v. DOJ, No. 03-84, 2007 WL 1032301, at *2, 14-17 (E.D. Ky. Mar. 30, 2007)).  The Court of Appeals for the Sixth Circuit framed the “main issue” as “whether the requirement under § 552a(g)(4) that the district court find that ‘the agency acted in a manner which was intentional or willful’ requires the court to find that the final act that resulted in the disclosure was ‘intentional or willful’ or whether the court may find that the entire course of conduct that resulted in the disclosure was ‘intentional or willful.’”  Beaven, 622 F.3d at 547.  In holding the latter to be correct, the Sixth Circuit pointed out that “[n]o court has specifically interpreted § 552a(g)(4) in the light this panel must address” but observed, after reviewing the case law, that courts “determining whether a Privacy Act violation occurred have not differentiated between the final act and the course of action that results in the final act, but rather courts generally look to the entire course of conduct in context.”  Id. at 548-50.  The Sixth Circuit went on to conclude that “the facts in the instant case support[] the district court’s conclusion” and that the district court “did not commit clear error in finding that [the investigator’s] course of conduct was ‘willful.’”  Id. at 552.  The court noted that the investigator had “carried the folder, which he knew contain[ed] confidential and sensitive information, into an inmate-accessible work area for the purpose of carrying out his own investigative work should he need to call a . . . computer administrator at home.  Yet the roster [in the folder] not only listed the home telephone numbers of . . . computer administrators but also included detailed private and personal information related to all [of the prison facility] employees”; and that the roster was not marked “[Limited Official Use]-Sensitive,” as required by a BOP Program Statement, among other violations of BOP policy.  Id.  The Court stated that the investigator’s “need for some of the information . . . did not provide a legitimate basis for him to have the entire contents of the folder with him at the time” and that his “course of conduct that resulted in his leaving the unmarked folder in an inmate-accessible area . . . could properly be viewed as ‘the intentional or willful failure of the agency to abide by the Act.’”  Id. at 552-53.  See also Downie v. City of Middleburg Hts., 301 F.3d 688, 697-99 (6th Cir. 2002) (citing Toolasprashad, infra, and stating that “[w]hile the Privacy Act does not provide a separate damages remedy for the intentional or willful creation, maintenance, or dissemination of false records in retaliation for an individual’s First Amendment rights, we believe that retaliation on any basis clearly constitutes intentional or willful action”).

In Louis, the plaintiff had sought reconsideration of the denial of his claim for Federal Employees Compensation benefits by the Department of Labor.  See 19 F. App’x at 488.  In denying the plaintiff’s request for reconsideration, the Department indicated that it had considered the entirety of its prior decision, including a portion of that prior decision that impermissibly relied on a memorandum that had been the subject of prior litigation by the plaintiff.  See id.; see also Louis v. Labor, No. C99-5195, slip op. at 1-2 (W.D. Wash. Oct. 15, 1999), aff’d in part, rev’d in part & remanded, Louis v. Labor, 19 F. App’x 487 (9th Cir. 2001); Louis v. Labor, No. C97-5521 (W.D. Wash. Feb. 27, 1998) (magistrate’s recommendation), adopted, (W.D. Wash. Mar. 23, 1998); Louis v. VA, No. C95-5606 (W.D. Wash. Oct. 31, 1996).  Yet, the district court in a prior action had ordered that the agency “destroy all but one known copy of the document” and that it “maintain that single copy in a sealed envelope to be revealed to no person, agency, or entity.”  Louis v. Labor, No. C97-5521, slip op. at 3 (W.D. Wash. Feb. 27, 1998).  The Ninth Circuit ruled that the Department of Labor violated the Privacy Act when it failed “to maintain its records in such a way as to indicate to the claims examiner that it could not rely on [that memorandum] in reviewing Louis’ request for reconsideration.”  19 F. App’x at 489.  The court stated that the agency’s “disregard of both the district court’s prior decision rendering reliance on [the memorandum] impermissible and its own assurance that it would annotate the memo in its files ‘to reflect that it is not to be considered in any future action related to Dr. Louis’ claim’ constitutes a willful failure on the part of the government to abide by its obligations, and proximately resulted in the government’s refusal to reconsider its earlier decision, thereby adversely affecting [plaintiff].”  Id.

In Wilborn, an attorney who had been employed by the Department of Health and Human Services sought Privacy Act damages for an Administrative Law Judge’s disclosure of adverse personnel information about him in an opinion 49 F.3d at 599-602.  The court ruled that the “uncontroverted facts plainly establish that the ALJ disclosed the information . . . without any ground for believing it to be lawful and in flagrant disregard of the rights of Wilborn under the Privacy Act.”  Id. at 602.  The Ninth Circuit noted that not only was the ALJ personally familiar with the Privacy Act and had advised his staff concerning the Act’s disclosure prohibition, but further, that the ALJ had been informed by an agency attorney that the language at issue was “inappropriate and should not be included in the decision.”  Id.  Particularly troubling in this case was the additional fact that all information pertaining to the adverse personnel record was required to be, and in fact had been, removed from the system of records by the ALJ as a result of a grievance action filed by the plaintiff.  Id.

In Covert, the Ninth Circuit ruled that the Department of Energy Inspector General’s routine use disclosure of prosecutive reports, showing possible criminal fraud, to the Justice Department violated subsection (e)(3)(C) because, at the time of their original collection by another component of the agency, portions of those reports – consisting of personnel security questionnaires submitted by the plaintiffs – did not provide actual notice of the routine use.  876 F.2d 751, 754-57 (9th Cir. 1989).  The Ninth Circuit held that the failure to comply with subsection (e)(3)(C) was “greater than grossly negligent” even though the Inspector General was relying on statutes, regulations, and disclosure practices that appeared to permit disclosure, and no prior court had ever suggested that noncompliance with subsection (e)(3)(C) would render a subsequent subsection (b)(3) routine use disclosure improper.  Compare id. at 756-57, with Chapman, 736 F.2d at 243, Wisdom, 713 F.2d at 424-25, and Bruce, 621 F.2d at 917.

The D.C. Circuit has found that plaintiffs submitted sufficient evidence to establish that complaint alleging “willful or intentional” data breach could proceed.

The Court of Appeals for the District of Columbia Circuit has not gone as far as the Sixth and Ninth Circuits in finding an “intentional or willful” violation of the statute.  It did find, however, that the plaintiff had submitted sufficient evidence that a motion to dismiss was not appropriate.  See In re OPM Data Security Breach, 928 F.3d 42, 63–64 (D.C. Cir. 2019) (finding Plaintiff’s complaint “clears that hurdle by plausibly and with specificity alleging that OPM was willfully indifferent to the risk that acutely sensitive private information was at substantial risk of being hacked”); Toolasprashad v. BOP, 286 F.3d 576, 584 (D.C. Cir. 2002) (remanding case where district court had found that record would not support finding of intentional and willful action, and stating that, “[i]f proven, retaliatory fabrication of prison records would certainly meet [our] definition [as articulated in Deters] of a willful or intentional Privacy Act violation”).

Although only a few courts have addressed the issue, they have split over whether the Privacy Act limits recovery of damages under state law or the Federal Tort Claims Act for negligent disclosure.

The Court of Appeals for the Third Circuit has held that the Privacy Act – with its stringent “greater than gross negligence” standard for liability – does not indicate a congressional intent to limit an individual’s right under state law to recover damages caused by the merely negligent disclosure of a psychiatric report.  See O’Donnell v. United States, 891 F.2d 1079, 1083-87 (3d Cir. 1989) (Federal Tort Claims Act (“FTCA” case).  But see Hager v. United States, No. 86-3555, slip op. at 7-8 (N.D. Ohio Oct. 20, 1987) (finding Privacy Act preempts FTCA action alleging wrongful disclosure); cf. Doe v. DiGenova, 642 F. Supp. 624, 629-30, 632 (D.D.C. 1986) (holding state law/FTCA claim preempted by Veterans’ Records Statute, 38 U.S.C. §§ 3301-3302 (renumbered as 38 U.S.C. §§ 5701-5702 (2018))), aff’d in pertinent part, rev’d in part & remanded sub nom. Doe v. Stephens, 851 F.2d 1457 (D.C. Cir. 1988). 

 

2. Actual Damages

“In any suit brought under the provisions of subsection (g)(1)(C) or (D) . . . in which the court determines that the agency acted in a manner which was intentional or willful, the United States shall be liable to the individual [for] actual damages sustained by the individual . . . but in no case shall a person entitled to recovery receive less than the sum of $1,000.”  5 U.S.C. § 552a(g)(4)(A).

Comment:

The Supreme Court has held that plaintiffs must show actual damages to be “entitled to recovery” of the $1,000 minimum.

In issuing its first purely Privacy Act decision in the history of the Act, the Supreme Court considered a decision by the Court of Appeals for the Fourth Circuit in which a divided panel held that in order to be entitled to a statutory minimum damages award for violation of the Privacy Act, a complainant must prove actual damages.  Doe v. Chao, 540 U.S. 614 (2004), aff’g Doe v. Chao, 306 F.3d 170, 177-79 (4th Cir. 2002).  Recognizing that the Fourth Circuit’s opinion in Doe v. Chao “conflicted with the views of other Circuits,” the Supreme Court granted certiorari.  540 U.S. at 618 (citing Orekoya v. Mooney, 330 F.3d 1, 7-8 (1st Cir. 2003); Wilborn v. HHS, 49 F.3d 597, 603 (9th Cir. 1995); Waters v. Thornburgh, 888 F.2d 870, 872 (D.C. Cir. 1989); Johnson v. IRS, 700 F.2d 971, 977, and n.12 (5th Cir. 1983); Fitzpatrick v. IRS, 665 F.2d 327, 330-31 (11th Cir. 1982) (awarding statutory minimum $1,000 damages, but denying recovery beyond the statutory minimum because “appellant proved only that he suffered a general mental injury”). The majority conducted “a straightforward textual analysis,” looked to the Privacy Act’s legislative history, and ultimately, in a 6 to 3 decision, concluded that the Fourth Circuit’s view was correct.  Id. at 620-29.  The Court held that to meet the “entitle[ment] to recovery” language of subsection (g)(4)(A) to qualify for the $1,000 minimum, showing “merely . . . an intentional or willful violation of the Act producing some adverse effect” is insufficient; “[the statute guarantees $1,000 only to plaintiffs who have suffered some actual damages.”  Id. at 627; deLeon v. Wilkie, No. CV 19-1250 (JEB), 2020 WL 210089, at *8 (D.D.C. Jan. 14, 2020) (finding plaintiff did not suffer actual damages where his complaint was “devoid of allegations that either incident — i.e., the disclosure of his personnel records or of his pending disciplinary action — caused him to suffer any actual damages”); Clutter v. Perdue, No. H-18-310, 2019 WL 1589942, at *8 (S.D. Tex. Jan. 28, 2019) (dismissing subsection (g)(1)(D) claim for failure to plead in detail actual damages from unspecified Privacy Act violation); Taylor v. FAA, 351 F. Supp. 3d 97, 105-06 (D.D.C. 2018) (finding that because plaintiff’s complaint “made no allegation whatsoever of pecuniary or economic harm caused by the alleged Privacy Act violation, the court is foreclosed from granting the $1,000 statutory award he seeks”); Otero v. DOJ, 292 F. Supp. 3d 245, 253-54 (D.D.C. 2018), aff’d sub nom. Otero v. DOJ, No. 18-5080, 2019 WL 4565497 (D.C. Cir. Sept. 4, 2019) (granting agency summary judgment where court “identifies no support for an award of damages – actual or otherwise – arising from a purported violation of the Privacy Act”); Chichackli v. Kerry, 203 F. Supp. 3d 48, 57-58 (D.D.C. 2016) (dismissing Privacy Act claim, in part, by finding plaintiff failed to demonstrate “concrete and quantifiable damages” when pleading that several fraudulent bank accounts were established in his name, fraudulent income tax returns were filed under his social security number, and credit cards were issued using his personal information where actual sum of damages was “still undiscovered” and damages were “in an amount unknown at this time”); Welborn v. IRS, 218 F. Supp. 3d 64, 82-83 (D.D.C. 2016) (dismissing Privacy Act damages claim due to failure to plead actual damages where plaintiff class alleged false tax returns were filed, future e-filing of taxes was prohibited, lost time was spent dealing with ramifications of fraud, and there was heightened risk of further identity theft); Pinkney v. VA, No. 1:07-CV-00142, 2008 WL 4272749, at *5-6 (S.D. Ohio Sept. 11, 2008) (stating that “the Supreme Court in Doe v. Chao carefully reviewed the statutory language and legislative history and held that the minimum guarantee goes only to victims who prove some actual damages”).  As a result, the court abrogated any prior case law that suggests that anything less than actual damages is sufficient to entitle an individual to an award of the statutory minimum $1,000 damages. 

The District of Columbia Circuit Court of Appeals has considered in detail whether plaintiff’s incurred costs constitute “actual damages.”  The Court of Appeals, in In re OPM Data Sec. Breach Litig., reversed the district court’s decision dismissing a case involving a data breach that resulted in the disclosure of the sensitive information of more than 20 million government employees. 928 F.3d 42 (D.C. Cir. 2019).  The court concluded that numerous expenses that plaintiffs had alleged in its compliant incurred as a result of the breach constituted actual damages, including legal fees to close fraudulent accounts, unauthorized charges on a utility bill, credit protection and/or credit repair services, new credit card accounts fraudulently opened in plaintiffs’ names, loans taken out in plaintiffs’ names that became delinquent, false tax returns filed using plaintiffs’ information that led to delays in receiving federal and state tax refunds and the forgone time value of that money, and the time plaintiffs’ took off work to resolve the fraudulent tax return filing and to close a fraudulently opened account.  Id. at 64-66.  Thus, the court determined that the plaintiffs adequately alleged actual damages. 

After years of differing opinions in the circuits, in 2004, the United States Supreme Court limited “actual damages” to pecuniary or monetary damages, abrogating earlier cases that had found to the contrary.

Although Doe v. Chao settled the issue of whether actual damages are required to recover either the statutory minimum or damages beyond the minimum, and that actual damages include out-of-pocket expenses, the Supreme Court did not rule explicitly on the issue of whether nonpecuniary damages for mental injury – such as emotional trauma, anger, fear, or fright – satisfy the definition of actual damages.  Doe v. Chao, 540 U.S. at 627 n.12 (noting division among Courts of Appeals on “the precise definition of actual damages,” and stating “[t]hat issue is not before us, however”).  Until the Supreme Court answered this question eight years later in FAA v. Cooper, 566 U.S. 284 (2012), discussed below, lower courts were divided on the issue.  Compare, e.g., Jacobs v. Nat’l Drug Intelligence Ctr., 548 F.3d 375, 378 (5th Cir. 2008), Johnson v. IRS, 700 F.2d at 974-80 (finding nonpecuniary damages recoverable), and Parks v. IRS, 618 F.2d 677, 682-83, 685 (10th Cir. 1980) (stating that plaintiffs had “alleged viable claims for damages” where only alleged adverse effect was “psychological harm”), with Fanin v. VA, 572 F.3d 868, 872 (11th Cir. 2009) (following Fitzpatrick in requiring pecuniary losses), cert. denied sub nom. Perkins v. VA, 130 S. Ct. 1755 (2010), Hudson v. Reno, 130 F.3d 1193, 1207 n.11 (6th Cir. 1997) (citing plaintiff’s failure to show “actual damages” as additional basis for affirming district court decision and stating that “the weight of authority suggests that actual damages under the Privacy Act do not include recovery for ‘mental injuries, loss of reputation, embarrassment or other non-quantifiable injuries’” (citing Fitzpatrick)), DiMura v. FBI, 823 F. Supp. 45, 47-48 (D. Mass. 1993) (finding that “‘actual damages’ does not include emotional damages”).  See generally Doe v. Chao, 306 F.3d at 181-82 (finding that plaintiff had “utterly failed to produce evidence sufficient to permit a rational trier of fact to conclude that he suffered any ‘actual damages,’” and thus stating that “we need not reach the issue of whether the term ‘actual damages’ as used in the Act encompasses damages for non-pecuniary emotional distress” where plaintiff “did not produce any evidence of tangible consequences stemming from his alleged angst over the disclosure of his [social security number]” to corroborate his “conclusory allegations” of emotional distress); id. at 198 n.13 (Michael, J., dissenting) (stating that “the majority’s holding commits this circuit to the position that the term ‘actual damages’ includes at least emotional distress that would qualify as ‘demonstrable’ under [Price v. City of Charlotte, 93 F.3d 1241 (4th Cir. 1996)]”).

In Cooper, the Supreme Court settled this confusion by interpreting actual damages to be “limited to proven pecuniary or economic harm.”  566 U.S. at 299.  The plaintiff in Cooper had alleged that the agency’s “unlawful disclosure . . . of his confidential medical information, including his HIV status, had caused him ‘humiliation, embarrassment, mental anguish, fear of social ostracism, and other severe emotional distress,’” but he “did not allege any pecuniary or economic loss.”  Id. at 289.  In framing the issue, the Court stated:  “Because respondent seeks to recover monetary compensation from the Government for mental and emotional harm, we must decide whether the civil remedies provision of the Privacy Act waives the Government’s sovereign immunity with respect to such a recovery.”  Id. at 291.  The Court explained that any ambiguities in the scope of the waiver must be construed “in favor of the sovereign.”  Id.  In reaching its conclusion, the Court first observed that “‘actual damages’ is a legal term of art” that has a “chameleon-like quality” because its “precise meaning . . . ‘changes with the specific statute in which it is found.’”  Id. at 289-290.  The Court also picked up on its observation in Doe v. Chao, see 540 U.S. at 625-26, that the civil remedies provision “‘parallels’ the remedial scheme for the common-law torts of libel per quod and slander, under which plaintiffs can recover ‘general damages’” – which “cover ‘loss of reputation, shame, mortification, injury to the feelings and the like and need not be alleged in detail and require no proof’” – “but only if they prove ‘special harm’ (also known as ‘special damages’)” – which “are limited to actual pecuniary loss, which must be specially pleaded and proved.”  Cooper, 566 U.S., at 295.  “This parallel,” the Court reasoned, “suggests the possibility that Congress intended the term ‘actual damages’ in the Act to mean special damages.  The basic idea is that Privacy Act victims, like victims of libel per quod or slander, are barred from any recovery unless they can first show actual – that is, pecuniary or material – harm.”  Id. at 296.  Finally, the Court placed considerable emphasis on the fact that the Privacy Protection Study Commission (discussed above under “Introduction, Privacy Protection Study Commission”), which Congress established “to consider, among its other jobs, ‘whether the Federal Government should be liable for general damages,’” recommended that general damages be allowed; however, Congress “never amended the Act to include them.”  Id. at 297.  After Cooper, any prior case law suggesting that actual damages are not limited to proven pecuniary or economic harm has been abrogated.  See also Gause v. DOD, 676 F. App’x 316, 318 (5th Cir. 2017) (concluding that plaintiff did not allege actual damages because “mental and emotional distress . . . do not meet the Supreme Court’s definition of actual damages under the Privacy Act” and plaintiff did not provide sufficient factual enhancement to establish “‘lost or jeopardized present or future financial opportunities,’” or “how the disclosure of his records has caused their loss”); Freeman v. Fed. Bureau of Prisons, No. 19-CV-02569 (CKK), 2020 WL 4673412, at *4 (D.D.C. Aug. 12, 2020) (internal citations omitted) (finding plaintiff’s assertion that “improper disclosure has ‘caused and continue[s] to cause [him] to suffer and sustain intentional infliction of emotional distress’ insufficient in damages suit” because “Privacy Act does not allow a claim for damages based on . . . emotional harm”); Martinez v. Stackley, No. CV 16-00475 HG-RLP, 2018 WL 1093810, at *13 (D. Haw. Feb. 28, 2018), aff’d sub nom. Martinez v. Spencer, 771 F. App’x 403 (9th Cir. 2019) (indicating that damages under Privacy Act is “limited to proven pecuniary or economic harm”); Gonzalez v. Agriculture, No. 17-24171-CIV, 2018 WL 5071395, at *7 (S.D. Fla. Aug. 29, 2018) (dismissing plaintiff’s complaint because plaintiff did not show “that his removal from [the union] caused him to suffer actual damages”); Richardson v. Bd. of Governors of Fed. Reserve Sys., 288 F. Supp. 3d 231, 236–37 (D.D.C. 2018), aff’d, No. 18-5063, 2018 WL 4103305 (D.C. Cir. Aug. 15, 2018) (concluding that because plaintiff’s “allegations of harm rely on claims of emotional harm and other non-pecuniary alleged damages” they were insufficient to state a claim under the Privacy Act); Glass v. DOJ, 279 F. Supp. 3d 279, 281 (D.D.C. 2017), aff’d sub nom. Glass v. DOJ, No. 18-5030, 2018 WL 5115524 (D.C. Cir. Sept. 19, 2018) (concluding that plaintiff’s “vague description of the harms allegedly sustained as a result of Defendant’s disclosure cannot support a demand for actual damages that must be ‘limited to proven pecuniary or economic harm’”); Palmieri v. United States, 72 F. Supp. 3d 191, 213 (D.D.C. 2014), aff’d, 896 F.3d 579 (D.C. Cir. 2018) (noting that “[a]lthough gossip may cause an adverse effect, it does not constitute actual damages”); Gause, 676 F. App’x at 318 (concluding that “mental and emotional distress plaintiff alleges he suffered do not meet the Supreme Court’s definition of actual damages under the Privacy Act”); Patwardhan v. United States, No. 13-0076, 2014 U.S. Dist. LEXIS 36226, at *31 (C.D. Cal. Mar. 18, 2014) (finding profit and loss statements from consecutive years to be mere speculation that does not show actual damages); Makowski v. United States, 27 F. Supp. 3d 901, 914 (N.D. Ill. 2014) (finding it “reasonable to infer that the seventy days of unnecessary incarceration cost [plaintiff] prospective employment opportunities,” and that “[l]oss of economic opportunity is pecuniary harm”); Corbett v. TSA, 968 F. Supp. 2d 1171, 1188 (S.D. Fla. 2012) (dismissing plaintiff’s Privacy Act claims because he “alleges no actual damages separate and apart from the statutory violations themselves . . . [and] are thus insufficient to entitle him to any monetary award”); Grant v. United States, No. 2:11-cv-00360, 2012 WL 5289309, at *8 (E.D. Cal. Oct. 23, 2012) (finding plaintiff’s claim for $5 million in general damages “as a result of ‘mental distress, emotional trauma, embarrassment, humiliation, grief, anxiety, worry, mortification, show indignity, and ordeal’” not cognizable under the Privacy Act under Cooper) (citing Cooper, 132 S. Ct. at 1446, 1451-53, 1456). 

Prior to Doe v. Chao and Cooper, the issue of what needs to be shown in order to recover damages under subsection (g)(4)(A) had historically engendered some inconsistent and confusing case law.  See, e.g., Orekoya v. Mooney, 330 F.3d 1, 7-8 (1st Cir. 2003) (holding that “statutory damages [of $1,000], if not actual damages, are available to individuals who suffer adverse effects from intentional and willful violations of the [Privacy Act] and that provable emotional distress may constitute an adverse effect”); Wilborn v. HHS, 49 F.3d 597, 603 (9th Cir. 1995) (finding no need to remand to district court for determination of amount of damages because plaintiff had limited damages sought to statutory minimum); Quinn v. Stone, 978 F.2d 126, 135 (3d Cir. 1992) (stating that subsection (g)(1)(D) “gives an individual adversely affected by any agency violation of the Act a judicial remedy whereby the individual may seek damages”); Waters v. Thornburg, 888 F.2d 870, 872 (D.C. Cir. 1989) (stating that to obtain relief under the Privacy Act plaintiff must establish that (1) the agency violated a provision of the Act; “(2) the violation of the Act was ‘intentional or willful,’” and “(3) this action had an ‘adverse effect’ on the plaintiff” and that “[i]f these three factors are satisfied, the plaintiff is entitled to the greater of $1,000 or the actual damages sustained”); Johnson v. IRS, 700 F.2d 971, 977 & n.12, 986 (5th Cir. 1983) (recognizing entitlement to statutory minimum for proven physical and mental injuries even if “actual damages” were interpreted to include only pecuniary harm, but going on to hold that “actual damages” includes “proven mental and physical injuries”); Fitzpatrick v. IRS, 665 F.2d 327, 329-31 (11th Cir. 1982) (awarding statutory minimum $1,000 damages, but denying recovery beyond the statutory minimum because “appellant proved only that he suffered a general mental injury”).  See generally OMB Guidelines, 40 Fed. Reg. 28,948, at 28,970, https://www.justice.gov/paover​view_omb-75 (stating that “[a]ctual damages or $1,000, whichever is greater,” are recoverable (emphasis added)).

 

3. Limits on Injunctive Relief for Damages Claims

Unlike amendment and access claims under subsections (g)(1)(A) and (g)(1)(B), injunctive relief is not available in damages claims under subsections (g)(1)(C) or (g)(1)(D).

It is well settled that injunctive relief as provided for in the Privacy Act is available only under subsections (g)(1)(A) (amendment) and (g)(1)(B) (access) – both of which, incidentally, require exhaustion – and that injunctive relief is not available under subsections (g)(1)(C) or (g)(1)(D).  See, e.g., Doe v. Chao, 540 U.S. at 635 (Ginsburg, J., dissenting); McLeod v. VA, 43 F. App’x 70, 71 (9th Cir. 2002) (quoting Cell Assocs. v. NIH, infra); Locklear v. Holland, No. 98-6407, 1999 WL 1000835, at *1 (6th Cir. Oct. 28, 1999); Risley v. Hawk, 108 F.3d 1396, 1397 (D.C. Cir. 1997) (per curiam); Doe v. Stephens, 851 F.2d at 1463; Hastings v. Judicial Conference of the United States, 770 F.2d 1093, 1104 (D.C. Cir. 1985); Edison, 672 F.2d at 846; Hanley v. DOJ, 623 F.2d 1138, 1139 (6th Cir. 1980) (per curiam); Parks, 618 F.2d at 684; Cell Assocs. v. NIH, 579 F.2d 1155, 1161-62 (9th Cir. 1978); Halliburton v. Labor, No. 17-CV-01045-MJW, 2018 WL 1256509, at *3 (D. Colo. Mar. 12, 2018) (dismissing 5 U.S.C. § 552a(g)(1)(D) claim where only a failure to produce disputed records was pleaded which is remedied solely by injunctive relief under 5 U.S.C. § 552a(g)(1)(B)); Makowski v. United States, 27 F. Supp. 3d 901, 915 (N.D. Ill. 2014); Kursar v. TSA, 581 F. Supp. 2d 7, 19 (D.D.C. 2008), aff’d per curiam, on other grounds, 442 F. App’x 565 (D.C. Cir. 2011); Tarullo v. Def. Contract Audit Agency, 600 F. Supp. 2d 352, 358 (D. Conn. 2009); AFGE v. HUD, 924 F. Supp. 225, 228 n.7 (D.D.C. 1996), rev’d on other grounds, 118 F.3d 786 (D.C. Cir. 1997); Houston, 494 F. Supp. at 29; see also Word v. United States, 604 F.2d 1127, 1130 (8th Cir. 1979) (no “exclusionary rule” for subsection (b) violations; “No need and no authority exists to design or grant a remedy exceeding that established in the statutory scheme.”); Shields v. Shetler, 682 F. Supp. 1172, 1176 (D. Colo. 1988) (Act “does not create a private right of action to enjoin agency disclosures”); 120 Cong. Rec. at 40,406, reprinted in Source Book at 862,  cf. New-Howard v. Shinseki, No. 09-5350, 2012 WL 2362546, at *8 (E.D. Pa. June 21, 2012) (“To the extent that Plaintiff seeks to enjoin Defendant from using the allegedly altered records in the course of further litigation, the statute in question does not authorize the relief requested.”).  But see Fla. Med. Ass’n v. HEW, 479 F. Supp. 1291, 1299 & n.8 (M.D. Fla. 1979) construing subsection (g)(1)(D) to confer jurisdiction to enjoin agency’s disclosure of Privacy Act-protected record.  However, courts have recognized the availability of equitable relief under the Administrative Procedure Act for claims governed by the Privacy Act (see the discussion above under “Civil Remedies”).

Given the well-settled law that injunctive relief is not available for Privacy Act damages claims, it would seem clear that injunctive relief is not available for any damages claim, but the D.C. Circuit has suggested that there may be an exception for subsection (e)(7) damages claims.  In Haase v. Sessions, 893 F.2d 370, 373-75 (D.C. Cir. 1990), the D.C. Circuit, in dictum, suggested that its decision in Nagel v. HEW, 725 F.2d 1438, 1441 (D.C. Cir. 1984), could be read to recognize the availability of injunctive relief to remedy a subsection (e)(7) violation, under subsection (g)(1)(D); see also Becker v. IRS, 34 F.3d 398, 409 (7th Cir. 1994) (finding that the IRS had not justified maintenance of documents under subsection (e)(7), and stating that “the documents should be expunged”); Scott v. Conley, 937 F. Supp. 2d 60, 81-82 (D.D.C. 2013) (dismissing plaintiff’s subsection (e)(7) claim on other grounds, but stating “[a]lthough the Circuit did not explicitly decide the question in Haase, its language suggests that injunctive relief for (e)(7) violations under (g)(1)(D) would be available”); but see Wabun-Inini v. Sessions, 900 F.2d 1234, 1245 (8th Cir. 1990); Clarkson v. IRS, 678 F.2d 1368, 1375 n.11 (11th Cir. 1982); Comm. in Solidarity v. Sessions, 738 F. Supp. 544, 548 (D.D.C. 1990), aff’d, 929 F.2d 742 (D.C. Cir. 1991); see also Socialist Workers Party v. Attorney Gen., 642 F. Supp. 1357, 1431 (S.D.N.Y. 1986) (in absence of exhaustion, only damages remedy, rather than injunctive relief, is available for violation of subsection (e)(7)).  The D.C. Circuit’s view in Haase is somewhat difficult to reconcile with the structure of subsection (g) and with the case law mentioned above.

 

4. Additional Considerations for Damages Claims

Plaintiffs are not entitled to the minimum recovery for each individual copy of a document that is disclosed.

The Court of Appeals for the District of Columbia Circuit has ruled that a plaintiff was not entitled to $1,000 for each copy of a letter that was disclosed in violation of the Privacy Act to 4500 individuals.  See Tomasello v. Rubin, 167 F.3d 612, 617-18 (D.C. Cir. 1999).  The D.C. Circuit stated that “[w]hile it may be linguistically possible to read the language [of § 552a(g)(4)] so as to forbid the aggregation of several more-or-less contemporaneous transmissions of the same record into one ‘act[]’ or ‘failure [to comply with the Privacy Act],’ the result [sought in this case] shows that such a reading defies common sense.”  Id. at 618.  In reaching its determination “that each letter disclosure was not independently compensable,” the D.C. Circuit also reasoned that as a waiver of sovereign immunity, subsection (g)(4) “must be construed strictly in favor of the sovereign, and not enlarge[d] . . . beyond what the language requires.”  Id. (quoting United States v. Nordic Vill., Inc., 503 U.S. 30, 34 (1992)); cf. Siddiqui v. United States, 359 F.3d 1200, 1201-03 (9th Cir. 2004) (finding that disclosure of tax information by IRS agent to 100 people in one room at one time constituted one act of disclosure for purposes of determining statutory damages under Internal Revenue Code).

One court has allowed a plaintiff to recover mitigation costs for certain Privacy Act claims.

One district court has applied the doctrine of mitigation to certain Privacy Act claims, holding that “an individual whose information is disclosed in violation of the Privacy Act may recover for costs incurred to prevent harm from that disclosure.”  Beaven v. DOJ, No. 03-84, 2007 WL 1032301, at *8 (E.D. Ky. Mar. 30, 2007) (concluding that “plaintiffs’ out-of-pocket expenses [incurred in monitoring their financial information] to protect themselves from potential harm were caused by the instant Privacy Act violation”), aff’d in part, rev’d in part & remanded, on other grounds, 622 F. 3d 540 (6th Cir. 2010).

There is a circuit court split as to whether an individual can file a damages action when an agency destroys a Privacy Act record.

There is a split of authority on the issue of whether destruction of a Privacy Act record gives rise to a damages action.  Compare Tufts v. Air Force, 793 F.2d 259, 261-62 (10th Cir. 1986), with Rosen v. Walters, 719 F.2d 1422, 1424 (9th Cir. 1983), and Waldrop v. Air Force, 3 Gov’t Disclosure Serv. (P-H) ¶ 83,016, at 83,453 (S.D. Ill. Aug. 5, 1981).  See also Vaughn v. Danzig, 18 F. App’x 122, 124-25 (4th Cir. 2001) (per curiam) (finding no Privacy Act violation where record of nonjudicial punishment was maintained in files of plaintiff’s military unit at time of his discharge, but later was destroyed pursuant to records retention policy; “Although [plaintiff] seems to argue that the Privacy Act requires that records be maintained in perpetuity, he has cited no authority for that proposition”; “[A]gencies are not required to retain records on the possibility that a . . . Privacy Act request may be submitted.”); Dowd v. IRS, 776 F.2d 1083, 1084 (2d Cir. 1985) (per curiam) (declining to decide issue).  Cf. Beaven, 2007 WL 1032301, at *16-17 (applying adverse inference because agency “destroyed the [records] intentionally and in bad faith” and concluding that “[t]he inference is conclusive as to disclosure, and the defendants’ conduct therefore constitutes a violation of the Privacy Act”), aff’d, 622 F. 3d 540.

 

F. Principles Applicable to All Privacy Act Civil Actions

The Privacy Act does not provide relief from federal criminal prosecution, cannot be used to collaterally attack a conviction or sentence, and is not a defense to a summons.

Several courts have stated that the civil remedies provided in the Privacy Act do not provide for any relief in the course of a federal criminal prosecution.  See, e.g., Heck v. Humphrey, 512 U.S. 477, 486-87 (1994) (finding that claims for unlawful actions that would render convictions or sentences invalid are precluded unless there has been reversal on direct appeal, expungement, invalidation, or issuance writ of habeas corpus); United States v. Bressler, 772 F.2d 287, 293 (7th Cir. 1985) (“[E]ven if the defendant had made a sustainable argument [under 5 U.S.C. § 552a(e)(3)], the proper remedy is a civil action under Section 552a(g)(1) of the Privacy Act, not dismissal of the indictment.”); United States v. Bell, 734 F.2d 1315, 1318 (8th Cir. 1984) (asserting that even if appellant’s (e)(3) argument was sufficiently raised at trial, “it cannot be a basis for reversing his conviction”); United States v. Gillotti, 822 F. Supp. 984, 989 (W.D.N.Y. 1993) (“[T]he appropriate relief for a violation of Section 552a(e)(7) is found in the statute and allows for damages as well as amendment or expungement of the unlawful records. . . .  [T]here is nothing in the statute itself, nor in any judicial authority, which suggests that its violation may provide any form of relief in a federal criminal prosecution.”); cf. United States v. Moreno-Nevarez, No. 13-CR-0841, 2013 U.S. Dist. LEXIS 143900, at *10-14 (S.D. Cal. Oct. 2, 2013) (finding that “[r]egardless of the merits of Defendant’s contentions regarding possible violations of the Privacy Act, he has not presented grounds for suppressing the information in his criminal case” and “[t]he Privacy Act explicitly creates remedies for individuals harmed by violations of the statute”).

A plaintiff cannot use the Privacy Act to challenge a conviction or sentence.  See Skinner v. DOJ & BOP, 584 F.3d 1093, 1101 (D.C. Cir. 2009) (affirming dismissal of damages claim under Privacy Act because claim is not cognizable unless plaintiff first secures relief through writ of habeas corpus); Leventhal v. Rios, No. 0: 17–CV–05441, 2018 WL 3130682, at *3 (D. Minn. May 16, 2018) (indicating Privacy Act claim not cognizable under 28 U.S.C. § 2241 writ of habeas corpus petition); Hill v. Smoot, 308 F. Supp. 3d 14, 22 (D.D.C. 2018) (“‘absent a showing that the plaintiff’s conviction or sentence has been invalidated, . . . the plaintiff cannot recover damages’ for the alleged one-month he spent in custody following his arrest for a parole violation” (quoting Johnson v. United States, 590 F. Supp. 2d 101, 108–09 (D.D.C. 2008))); Semrau v. ICE, No. 5:13–cv–188, 2014 WL 4626708, at *5-*6 (S.D. Miss. Sept. 12, 2014) (finding claim that agency failed to maintain accurate records about plaintiff to extent that they supported his guilty verdict and deportation was collateral attack on verdict and barred by law).

Several courts also have found that failure to comply with the Privacy Act is not a proper defense to certain enforcement summons, such as a summons issued by the Internal Revenue Service (IRS).  See, e.g., United States v. McAnlis, 721 F.2d 334, 337 (11th Cir. 1983) (holding that compliance with 5 U.S.C. § 552a(e)(3) is not prerequisite to enforcement of an IRS summons); United States v. Berney, 713 F.2d 568, 572 (10th Cir. 1983) (stating that Privacy Act “contains its own remedies for noncompliance”); United States v. Harris, 172 F.3d 54, at *2 (7th Cir. 1998) (unpublished table decision) (citing McAnlis and Berney and rejecting “irrelevant argument that . . . the Privacy Act . . . guarantee[s] [appellant] answers to his questions before he has to comply with the IRS summons”); Reimer v. United States, 43 F. Supp. 2d 232, 237 (N.D.N.Y. 1999) (rejecting argument to quash summons because, inter alia, “the disclosure requirements in 5 U.S.C. § 552a(e)(3) are not applicable to summons issued pursuant to 26 U.S.C. §§ 7602, 7609”); see also Phillips v. United States, 178 F.3d 1295, at *2 (6th Cir. 1999) (unpublished table decision) (holding Privacy Act notice requirements inapplicable to issuance of IRS summons, as 26 U.S.C. § 7852(e) “plainly states that the provisions of the Privacy Act do not apply, directly or indirectly, to assessing the possibility of a tax liability”); cf. Huene v. Treasury, No. 11-2110, 2012 WL 3027815, at *1 (E.D. Cal. July 24, 2012) (finding court “lacks jurisdiction over plaintiff’s claim on the basis of 26 U.S.C. § 7852(e), which renders certain provisions of the Privacy Act inapplicable to the determination of the existence of tax-related liability”); Estate of Myers v. United States, 842 F. Supp. 1297, 1300-02 (E.D. Wash. 1993) (recognizing applicability of subsection (e)(3) to IRS summons, and possibility “that a summons may be judicially enforceable yet not meet the disclosure requirements of the Privacy Act”). 

Mandamus relief is not an appropriate remedy for a Privacy Act violation.

“Because the Privacy Act provides its own remedy for an agency’s improper refusal to process a proper request for information, [plaintiff] is not entitled to mandamus relief.”  Kotmair v. Netsch, No. 93-490, 1993 U.S. Dist. LEXIS 10781, at *5 (D. Md. July 21, 1993); see also Harris v. BOP, No. 13-1144, 2013 U.S. Dist. LEXIS 106619, at *1 (D.D.C. July 23, 2013) (“Judicial review of an agency’s failure to amend records is available exclusively under the Privacy Act.”); Christian v. Army, No. 11-0276, 2011 WL 345945, at *1 (D.D.C. Jan. 31, 2011) (rejecting plaintiff’s attempt “to correct his military records via a writ of mandamus” on ground that Privacy Act “provides an adequate remedy for addressing plaintiff’s claims”); Carrick v. Spencer, No. 3:02MC95-V, 2003 U.S. Dist. LEXIS 11706, at *3-4 (W.D.N.C. June 6, 2003) (magistrate’s recommendation) (denying petition for writ of mandamus as “the Privacy Act establishes a procedure for filing suit in federal court if an agency refuses to comply with a request” and petitioner has not “shown, or attempted to show, that this procedure is inadequate to obtain the relief requested”), adopted, 2003 U.S. Dist. LEXIS 17189 (W.D.N.C. Sept. 2, 2003); cf. Graham v. Hawk, 857 F. Supp. 38, 41 (W.D. Tenn. 1994) (“[R]emedies under the Privacy Act [for alleged inaccuracy] preclude plaintiff’s entitlement to mandamus, even though his claim under that act is substantively meritless.”), aff’d, 59 F.3d 170 (6th Cir. 1995) (unpublished table decision).  

The Privacy Act does not preclude individuals from seeking remedies under the Federal Tort Claims Act.

On the other hand, the United States Court of Appeals for the Third Circuit considered civil remedies for Privacy Act violations under the Federal Tort Claims Act (“FTCA”) and held that the Privacy Act “does not limit the remedial rights of persons to pursue whatever remedies they may have” under the FTCA for privacy violations consisting of record disclosures.  O’Donnell v. United States, 891 F.2d 1079, 1084-85 (3d Cir. 1989); see also Stephens v. United States, No. 0:16-149-BHH-PJG, 2016 WL 11200987, at *2-3 (D.S.C. Dec. 9, 2016) (magistrate’s recommendation) (following O’Donnell), adopted in pertinent part & rev’d in other part (D.S.C. Jan. 19, 2017); Rosado-Montes v. United States, 8 F. Supp. 3d 55, 63 (D.P.R. 2014) (quoting O’Donnell and permitting FTCA claim against VA employees who accessed plaintiff’s medical records to proceed notwithstanding the Privacy Act); Beaven v. DOJ, No. 03-84, 2007 WL 1032301, at *21-25 (E.D. Ky. Mar. 30, 2007) (assuming jurisdiction over claims of invasion of privacy brought under FTCA and based on conduct held to violate Privacy Act, but determining that plaintiffs failed to prove elements of those claims), aff’d in part, rev’d in part & remanded, on other grounds, 622 F.3d 540 (6th Cir. 2010); cf. Alexander v. FBI, 691 F. Supp. 2d 182 (D.D.C. 2010) (implicitly recognizing that local or state common law tort and FTCA are alternative causes of action to Privacy Act, but finding that plaintiffs had not met specific requirements to prevail on those causes of action), aff’d on other grounds, 456 F. App’x 1 (D.C. Cir. 2011). 

Alleged violations of the Privacy Act, however, cannot be the sole basis of a FTCA claim.  Coleman v. United States, 912 F.3d 824, 835-36 (5th Cir. 2019); Burroughs v. Abrahamson, 964 F. Supp. 2d 1268, 1272 (D. Or. 2013) (explaining that “[b]ecause plaintiff’s Privacy Act claim is rooted in federal rather than state law, and because Oregon has no analogous law, plaintiff cannot allege a claim under the FTCA for negligent violation of the Privacy Act”); Tripp v. United States, 257 F. Supp. 2d 37, 45 (D.D.C. 2003) (dismissing plaintiff’s claim under the FTCA for negligent disclosure of private information, as plaintiff could point to no “duty analogous to that created by the federal Privacy Act under local law to state a claim upon which relief [could] be granted”); Fort Hall Landowners Alliance, Inc. v. BIA, No. 99-052, 2001 U.S. Dist. LEXIS 27315,  at *20 (D. Idaho Mar. 28, 2001) (finding that “the alleged breach of a duty not to disclose personal information” was “pre-empted by the Privacy Act”); Hager v. United States, No. 86-3555, slip op. at 7-8 (N.D. Ohio Oct. 20, 1987) (“Because the Privacy Act does have its own enforcement mechanism” for plaintiff’s claims relating to disclosure of confidential information, “it preempts the FTCA.”). 

The Court of Appeals for the District of Columbia Circuit has held that the Feres doctrine, which holds that “the [g]overnment is not liable under the Federal Tort Claims Act for injuries to servicemen where the injuries arise out of or are in the course of activity incident to service,” does not apply to the Privacy Act.  Cummings v. Navy, 279 F.3d 1051, 1053-58 (D.C. Cir. 2002) (quoting Feres v. United States, 340 U.S. 135, 146 (1950), and concluding that “without regard to the identity of the plaintiff or the agency she is suing, the [Privacy Act] plainly authorizes injunctive relief . . . and monetary relief,” which remains “the best evidence of congressional intent” that Feres doctrine “does not extend to Privacy Act lawsuits brought by military personnel against the military departments”); see also Chang v. Navy, No. 01-5240, 2002 WL 1461859, at *1 (D.C. Cir. July 8, 2002) (citing Cummings to vacate district court opinion that held suit barred by Feres doctrine); Colon v. United States, 320 F. Supp. 3d 733, 742 (D. Md. 2018); Gamble v. Army, 567 F. Supp. 2d 150, 155 n.9 (D.D.C. 2008) (concluding that Feres “does not extend to Privacy Act lawsuits brought by military personnel against the military departments”). 

In an earlier decision, however, the Court of Appeals for the Eighth Circuit had held that the plaintiff’s Privacy Act claims were barred under the Feres doctrine.  See Uhl v. Swanstrom, 79 F.3d 751, 755-56 (8th Cir. 1996); cf. Dickson v. Wojcik, 22 F. Supp. 3d 830, 839 (W.D. Mich. 2014) (citing Uhl favorably and finding that “[w]hile there are cases finding that Feres generally does not bar a Privacy Act claim, see, e.g., Cummings, the Sixth Circuit has not ruled on the question”); Walsh v. United States, No. 1:05-CV-0818, 2006 WL 1617273, at *5 (M.D. Pa. June 9, 2006) (comparing, in dicta, Uhl and Cummings and noting that “[t]here is a split of authority on whether the Feres doctrine bars Privacy Act claims”), aff’d on other grounds, 328 F. App’x 806 (3d Cir. 2009), cert. denied, 558 U.S. 996 (2009).  The Cummings opinion did not reference Uhl, the only other appellate decision on this issue.

The Privacy Act’s remedies generally preclude monetary damages for constitutional violations of government officials under Bivens v. Six Unknown Named Agents of Federal Bureau of Narcotics.

Several courts have held that the Privacy Act’s remedies preclude an action seeking monetary damages directly under the Constitution from individual government officials under Bivens v. Six Unknown Named Agents of Federal Bureau of Narcotics, 403 U.S. 388 (1971).  See Fazaga v. FBI, 965 F.3d 1015, 1057-1058 (9th Cir. 2020) (holding that the Privacy Act and the Religious Freedom Restoration Act “taken together, provide an alternative remedial scheme for some, but not all, of Plaintiffs’ First and Fifth Amendment Bivens claims”); Liff v. Off. of Inspector Gen. for  Labor, 881 F.3d 912, 918-924 (D.C. Cir. 2018) (“The Privacy Act represents Congress’s legislative judgment about the appropriate remedies with respect to the accuracy, fairness, and use of government information, and the judicial system is not in a position to revise that scheme by recognizing an additional constitutional remedy” for claims that government officials disseminated information that harmed plaintiff’s reputation); Wilson v. Libby, 535 F.3d 697, 707 (D.C. Cir. 2008) (concluding that Privacy Act’s comprehensive remedial scheme precludes Bivens claim even though that scheme does not necessarily provide plaintiffs with full relief); Abuhouran v. SSA, 291 F. App’x 469, at *2 (3d Cir. Aug. 4, 2008) (per curiam) (unpublished decision); Chung v. DOJ, 333 F.3d 273, 274 (D.C. Cir. 2003) (affirming district court’s dismissal of plaintiff’s Bivens claims “because . . . they are encompassed within the remedial scheme of the Privacy Act”); Downie v. City of Middleburg Hts., 301 F.3d 688, 696 (6th Cir. 2002) (agreeing with district court that “because the Privacy Act is a comprehensive legislative scheme that provides a meaningful remedy for the kind of wrong [plaintiff] alleges that he suffered, we should not imply a Bivens remedy”); see also Chesser v. Chesser, 600 F. App’x 900, 901 (4th Cir. 2015) (unpublished opinion) (citing Wilson and Downie);  Bloch v. Exec. Off. of the President, 164 F. Supp. 3d 841, 860 n.26 (E.D. Va. 2016); Powerturbine, Inc. v. United States, No. 3:14–cv–0435–CAB–BLM, 2014 WL 12160753, at *7-9 (S.D. Cal. Dec. 15, 2014) (“Allowing a Bivens remedy for Powerturbine here would effectively recognize a right for corporations that Congress explicitly did not give individuals in the Privacy Act – the ability to sue government employees.”); Lewis v. Parole Comm’n, 770 F. Supp. 2d 246, 251-52 (D.D.C. 2011); Hurt v. D.C. Court Servs., 612 F. Supp. 2d 54, 56 (D.D.C. 2009), aff’d in pertinent part per curiam sub nom. Hurt v. Cromer, No. 09-5224, 2010 WL 604863, at *1 (D.C. Cir. Jan. 21, 2010), rev’d in part on other grounds & remanded per curiam, 2010 WL 8753255 (D.C. Cir. June 11, 2010); Sudnick v. DOD, 474 F. Supp. 2d 91, 100 (D.D.C. 2007); Hatfill v. Ashcroft, 404 F. Supp. 2d 104, 116-17 (D.D.C. 2005); Clark v. BOP, 407 F. Supp. 2d 127, 131 (D.D.C. 2005); Newmark v. Principi, 262 F. Supp. 2d 509, 518-19 (E.D. Pa. 2003); Fares v. INS, 29 F. Supp. 2d 259, 262 (W.D.N.C. 1998), aff’d per curiam, 11 F. App’x 137 (4th Cir. 2001) (unpublished decision); Sullivan v. USPS, 944 F. Supp. 191, 195-96 (W.D.N.Y. 1996); Blazy v. Woolsey, No. 93-2424, 1996 WL 43554, at *1 (D.D.C. Jan. 31, 1996), subsequent decision sub nom. Blazy v. Tenet, 979 F. Supp. 10, 27 (D.D.C. 1997), summary affirmance granted, No. 97-5330, 1998 WL 315583 (D.C. Cir. May 12, 1998); Williams v. VA, 879 F. Supp. 578, 585-87 (E.D. Va. 1995); Mittleman v. Treasury, 773 F. Supp. 442, 454 (D.D.C. 1991); cf. Royer v. BOP, No. 1:10-cv-0146, 2010 WL 4827727, at *5 (E.D. Va. Nov. 19, 2010) (stating that plaintiff’s Bivens claims “may simply collapse into [his] Privacy Act claims, at least insofar as they merely repeat the allegations that the BOP has maintained inaccurate records about [his] affiliation with terrorist groups”); Patterson v. FBI, 705 F. Supp. 1033, 1045 n.16 (D.N.J. 1989) (discussing the extent to which First Amendment claim involves damages resulting from maintenance of records; “such an action is apt to be foreclosed by the existence of the Privacy Act”), aff’d, 893 F.2d 595 (3d Cir. 1990).  But see Hartley v. Wilfert, 918 F. Supp. 2d 45, 55-56 (D.D.C. 2013) (allowing plaintiff’s First Amendment claim under Bivens to move forward because “the conduct here strays so far afield from the compass of the Privacy Act that it cannot be said that Congress ever contemplated the sort of claim here being covered by the statute”; defendant’s “actions here did not involve the sort of collection of information contemplated by the Act, instead, his words were merely a threat to intimidate [plaintiff] from continuing in her speech, just as ‘I will arrest you if you continue to protest’ or ‘I will take a picture of you for my book of crazy protesters’ would deter a person from speaking”); see also Alexander, 971 F. Supp. at 610-11 (agreeing with outcome in Blazy and Mittleman, supra, but concluding that their logic does not extend to prohibit recovery under local law for torts committed by individuals who, although government employees, were acting outside scope of their employment; holding that “Privacy Act does not preempt the common law invasion of privacy tort”).

Courts have differed as to whether plaintiffs are entitled to additional remedies beyond those available under the Privacy Act, particularly where other statutes are also applicable.

The Supreme Court has addressed Administrative Procedure Act (“APA”) judicial review equitable relief issues for claims governed by the Privacy Act.  See 5 U.S.C. §§ 701-706 (2018).  The Court stated that “[t]he Privacy Act says nothing about standards of proof governing equitable relief that may be open to victims of adverse determinations or effects, although it may be that this inattention is explained by the general provisions for equitable relief within the [APA].”  Doe v. Chao, 540 U.S. 614, 619 n.1 (2004); cf. OMB 1975 Guidelines, 40 Fed. Reg. at 28,949, https://www.justice.gov/paoverview_omb-75  (stating in its Civil Remedies section that “[a]n individual may seek judicial review under other provisions of the Administrative Procedure Act”).  Indeed, under the APA, the D.C. Circuit enjoined the Veterans Administration from disclosing medical records about an individual pursuant to a routine use that “would permit routine disclosure pursuant to a grand jury subpoena,” stating the disclosure would “circumvent the mandates of the Privacy Act.”  Doe v. Stephens, 851 F.2d 1457, 1466-67 (D.C. Cir. 1988) (furthering the principle of “avoiding constitutional questions if at all possible” where the plaintiff did “not premise his claim for equitable relief on the APA,” but the court considered the claim under the APA rather than resolving the plaintiff’s constitutional claims); see also Fla. Med. Ass’n v. Dep’t of Health, Edu. & Welfare, 947 F. Supp. 2d 1325, 1351-56 (M.D. 2013) (vacating 1979 permanent injunction prohibiting public disclosure of reimbursements paid to Medicare providers that would individually identify some providers, as no longer based on good law under Privacy Act; noting in dicta agency’s final action to disclose information may be reviewed under APA); Arruda & Beaudoin v. Astrue, No. 11-10254, 2013 WL 1309249, at *14-15 (D. Mass. Mar. 27, 2013) (dismissing plaintiff’s claim alleging that SSA’s failure to timely respond to its request for information was not an agency action to be reviewed under APA, because APA provides no relief other than what is provided by the Privacy Act); Recticel Foam Corp. v. DOJ, No. 98-2523, slip op. at 9 (D.D.C. Jan. 31, 2002), appeal dismissed, No. 02-5118 (D.C. Cir. Apr. 25, 2002) (holding that court had jurisdiction under APA to enjoin FBI from disclosing investigative records in order to prevent future violation of subsection (b) of Privacy Act); Doe v. Herman, No. 97-0043, 1998 WL 34194937, at *4-7 (W.D. Va. Mar. 18, 1998) (invoking APA to issue preventative injunction in response to Privacy Act claim); cf. Haase v. Sessions, 893 F.2d 370, 374 n.6 (D.C. Cir. 1990) (stating in dicta that “[i]t is not at all clear to us that Congress intended to preclude broad equitable relief (injunctions) to prevent (e)(7) violations . . . [a]nd in the absence of such an explicit intention, by creating a general cause of action (under (g)(1)(D)) for violations of the Privacy Act, Congress presumably intended the district court to use its inherent equitable powers”); Rice v. United States, 245 F.R.D. 3, 7 (D.D.C. 2007) (noting that “there is some authority for awarding [declaratory] relief under the APA” for claims arising under Privacy Act); Doe v. Veneman, 230 F. Supp. 2d 739, 752 (W.D. Tex. 2002) (enjoining release of records in system of records, through “reverse FOIA” action, because release would violate the FOIA and Privacy Act), aff’d in part & rev’d in part on other grounds, 380 F.3d 807 (5th Cir. 2004). 

However, courts in other cases have refused to allow claims brought under the APA where the relief sought is expressly provided by the Privacy Act.  See, e.g., Harrison v. BOP, 248 F. Supp. 3d 172, 181-182 (D.D.C. 2017); Westcott v. McHugh, 39 F. Supp. 3d 21, 33 (D.D.C. 2014) (holding that “plaintiff cannot bring an APA claim to obtain relief for an alleged Privacy Act violation,” and, citing Mittleman, supra, holding that plaintiff’s APA claim simply restates plaintiff’s Privacy Act claims); Echols v. Morpho Detection, Inc., No. C 12-1581, 2013 WL 1501523, at *2-3 (N.D. Cal. Apr. 11, 2013) (finding that “[p]laintiff does not provide any authority that demonstrates that he is required to make a greater showing in order to achieve relief under the Privacy Act or that adequate relief is not available under that Act” where plaintiff attempted to challenge agency’s finding of his ineligibility to work under both Privacy Act and APA); Wilson v. McHugh, 842 F. Supp. 2d 310, 320 (D.D.C. 2012) (“To the extent [plaintiff] relies on the Privacy Act and believes the Privacy Act provides him a legal remedy, . . . [plaintiff] cannot seek review in this Court under the APA.”); Tripp v. DOD, 193 F. Supp. 2d 229, 238-40 (D.D.C. 2002) (holding that “plaintiff can not bring an independent APA claim predicated on a Privacy Act violation”); Schaeuble v. Reno, 87 F. Supp. 2d 383, 393-94 (D.N.J. 1998); Mittleman, 773 F. Supp. at 449 (finding that plaintiff’s APA claim for failure to follow agency regulations and to provide plaintiff with hearing or other opportunity to rebut allegations against her in various government reports “is, in part, simply a restatement of her Privacy Act claims . . . [for which] Congress has provided plaintiff with statutory schemes and remedies through which she may seek relief”).

In considering whether plaintiffs had a cause of action under the Declaratory Judgment Act (“DJA”), the D.C. District Court was recently “unconvinced” that plaintiffs were precluded from obtaining declaratory relief under the DJA “[b]ecause the Privacy Act provides for injunctive relief in specific situations.”  Morinville v. U.S. Patent and Trademark Office, 442 F. Supp. 3d 286, 295 (Feb. 26, 2020).  In Morinville, the plaintiffs filed numerous claims addressing the Patent and Trademark Office’s former “Sensitive Application Warning System” (SAWS), including a claim under the DJA requesting that the court declare that SAWS violated the Privacy Act.  Id. at 289.  In assessing the defendant’s arguments in its motion to dismiss, the court found none of the purportedly supportive cases analogous to the situation, stating that “the Declaratory Judgment Act explicitly carves out several claims for which parties may not seek relief, and the Privacy Act is not among those carve-outs.”  Id. at 295–96; see also 28 U.S.C. § 2201.  Ultimately, the court held that “relief under the [DJA] may be unnecessary, and the Court, in its discretion, may dismiss this claim.  However, at the motion to dismiss stage, the Court is not prepared to say that Plaintiffs’ [DJA] claim is duplicative of their Privacy Act claims or otherwise unnecessary or inappropriate.”  Morinville, 442 F. Supp. 3d at 296; cf. Schaeuble v. Reno, 87 F. Supp. 2d at 393 (“Assuming that the Court does have discretion, because Plaintiff, in good faith, tried to exhaust his administrative remedies, and it was Defendants’ own failure to comport with the Privacy Act and its regulations that impeded Plaintiff’s efforts to obtain administrative relief or exhaust his administrative remedies, the Court declines to withhold exercising its authority under the [DJA].”).

The District Court for the District of Columbia has analyzed the relationship between the Privacy Act and the Health Care Quality Improvement Act (“HCQIA”), Pub. L. No. 99-660, 100 Stat. 3784, which “protect[s] patients from incompetent physicians by establishing a database to collect information related to professional competence or conduct which could adversely affect the health or welfare of patients.”  Doe v. Thompson, 332 F. Supp. 2d 124, 125 (D.D.C. 2004).  In Doe, a dentist filed a subsection (g)(1)(B) claim against the Department of Health and Human Services.  Id. at 127.  However, “instead of reviewing the plaintiff’s request pursuant to the Privacy Act, the [Department] responded by informing the plaintiff that the sole administrative remedy available to him was the procedures promulgated by the [Department]” pursuant to HCQIA.  Id.  The court concluded that because the procedures promulgated by the Department pursuant to HCQIA “provide less protection than the procedures required by the Privacy Act,” the Department “must adhere to the requirements of the Privacy Act when considering a dispute to a record” in the database established by HCQIA.  Id. at 130, 132-33.

The D.C. District Court also has analyzed the relationship between the Privacy Act and the Health Insurance Portability and Accountability Act (“HIPAA”), 42 U.S.C. § 1320d-1320d-8 (2018), which “prohibits both the improper disclosure of individually identifiable health information and the improper acquisition of such information.”  Cacho v. Chertoff, No. 06-00292, 2006 WL 3422548, *2 (D.D.C. Nov. 28, 2006).  In Cacho, the plaintiff brought a Privacy Act claim against the Department of Homeland Security “on the theory that [a Department employee] improperly accessed [the plaintiff’s] medical record.”  Id. at *5.  The court dismissed this claim on the ground that it “would be inconsistent with both HIPAA and the Privacy Act’s plain language” to “recognize under the Privacy Act a private right of action that Congress has expressly denied under HIPAA.”  Id.

In addition, the District Court for the District of Columbia has dismissed a plaintiff’s Privacy Act claim where the Attorney General invoked the State Secrets Privilege.  Edmonds v. DOJ, 323 F. Supp. 2d 65, 80-82 (D.D.C. 2004), aff’d, 161 F. App’x 6 (D.C. Cir. 2005) (unpublished opinion).  The court explained that “because the . . . documents related to the plaintiff’s employment, termination and security review that comprise the system of records are privileged, and because the plaintiff would be unable to depose witnesses whose identities are privileged or to otherwise identify through discovery the individual or individuals who purportedly released the privileged information, the plaintiff is . . . unable to proceed with her Privacy Act claims.”  Id. at 81.

Courts may order expungement as equitable relief in actions under the Privacy Act or for Constitutional violations.

Several courts, including the Unites States Court of Appeals for the District of Columbia Circuit, have held that a court may order equitable relief in the form of the expungement of records either in an action under the Privacy Act or in a direct action under the Constitution.  See, e.g., Abdelfattah v. DHS, 787 F.3d 524, 284-285 (D.C. Cir. 2015); Doe v. Air Force, 812 F.2d 738, 741 (D.C. Cir. 1987); Smith v. Nixon, 807 F.2d 197, 204 (D.C. Cir. 1986); Hobson v. Wilson, 737 F.2d 1, 65-66 (D.C. Cir. 1984), overruled in part on other grounds, Leatherman v. Tarrant Cnty. Narcotics Intel. & Coord. Unit, 507 U.S. 163 (1993); Ezenwa v. Gallen, 906 F. Supp. 978, 986 (M.D. Pa. 1995); cf. Shearson v. Holder, 725 F.3d 588, 595 (6th Cir. 2013) (refusing to entertain plaintiff’s argument that court should “use its equitable powers to expunge all the government records held by the Terrorist Screening Center that supported its placement of [plaintiff] in the terrorist databases” as court had no information about what those documents hold; affirming district court and finding it reasonable for plaintiff to exhaust administrative remedies under Traveler Redress Program); Dickson v. OPM, 828 F.2d 32, 41 (D.C. Cir. 1987) (suggesting that it is not resolved “whether as a general proposition the Privacy Act defines the scope of remedies available under the Constitution”); Clarkson v. IRS, 678 F.2d 1368, 1376 n.13 (11th Cir. 1982) (clarifying that court “[did] not intend to suggest that the enactment of the Privacy Act in any way precludes a plaintiff from asserting a constitutional claim for violation of his privacy or First Amendment rights.  Indeed, several courts have recognized that a plaintiff is free to assert both Privacy Act and constitutional claims.”).  See also the discussion of expungement of records under “5 U.S.C. § 552a(g)(1)(A) - Amendment Lawsuits,” above.

Finally, the courts have split over whether to grant class certifications in Privacy Act cases.  For cases in which courts granted class certifications for claims brought under the Privacy Act, see Calvillo Manriquez v. DeVos, Case No. 17-cv-07210-SK, 2018 WL 5316175 (N.D. Cal. Oct. 15, 2018); Rice v. United States, 211 F.R.D. 10, 14 (D.D.C. 2002); Fort Hall Landowners Alliance, Inc. v. BIA, No. 99-052, slip op. at 10 (D. Idaho Aug. 16, 2002); Baker v. Runyon, No. 96-2619, 1997 WL 232606, at *4 (N.D. Ill. May 2, 1997); and Ingerman v. IRS, No. 89-5396, 1990 WL 10029523, at *2 (D.N.J. July 16, 1990).  For cases in which courts denied class certifications for claims brought under the Privacy Act, see Doe v. Chao, 306 F.3d 170, 184 (4th Cir. 2002), aff’d on other grounds, 540 U.S. 614 (2004); Fort Hall Landowners Alliance, Inc. v. BIA, No. 99-052, 2007 WL 2187256, at *3 (D. Idaho July 16, 2007); Schmidt v. VA, 218 F.R.D. 619, 637 (E.D. Wis. 2003); and Lyon v. United States, 94 F.R.D. 69, 76 (W.D. Okla. 1982).  For cases involving multiple plaintiffs, see Covert v. Harrington, 876 F.2d 751, 752 (9th Cir. 1989); Andrews v. VA, 838 F.2d 418, 419 (10th Cir. 1988); Parks v. IRS, 618 F.2d 677, 679 (10th Cir. 1980); and Romero-Vargas v. Shalala, 907 F. Supp. 1128, 1131 (N.D. Ohio Oct. 13, 1995).

 

1. Attorney Fees and Costs

“The court may assess against the United States reasonable attorney fees and other litigation costs reasonably incurred in any case under this paragraph in which the complainant has substantially prevailed.”  5 U.S.C. § 552a(g)(2)(B), (g)(3)(B).

“[T]he United States shall be liable to the individual . . .[for] reasonable attorney fees as determined by the court.”  5 U.S.C. § 552a(g)(4)(B).   

Comment:

The Privacy Act is one of many federal statutes containing a “fee-shifting” provision allowing a prevailing plaintiff to recover attorney fees and costs from the government.  It allows for such fees in both amendment and access suits.  5 U.S.C. §§ 552a(g)(2)(B) (amendment), (g)(3)(B) (access).  The Privacy Act also allows for costs and attorney fees to be recovered in damages lawsuits, in addition to actual damages.  5 U.S.C. § 552a(g)(4)(B).

“Judgments, costs, and attorney’s fees assessed against the United States under [subsection (g) of the Privacy Act] would appear to be payable from the public funds rather than from agency funds.”  OMB 1975 Guidelines, 40 Fed. Reg. at 28,949, https://www.justice.gov/paoverview_omb-75 (citing 28 U.S.C. § 2414 (2018); 31 U.S.C. § 724a (later replaced during enactment of revised Title 31, but see 31 U.S.C. § 1304 (2018) (first sentence of former § 724a) and 39 U.S.C. § 409(e) (2018) (last sentence of former § 724a); and 28 U.S.C. § 1924 (2018)).

“5 U.S.C. § 552a(g)(1)(A) - Amendment Lawsuits,” “5 U.S.C. § 552a(g)(1)(B) - Access Lawsuits,” “5 U.S.C. § 552a(g)(1)(C) - Damages Lawsuits for Failure to Assure Fairness in Agency Determination,” “5 U.S.C. § 552a(g)(1)(D) - Damages Lawsuits for Failure to Comply with Other Privacy Act Provisions” are discussed in detail in separate sections above.

Pro se litigants, whether or not they are also attorneys, are not entitled to attorney fees for representing themselves.

The Supreme Court held that a pro se litigant who was also an attorney was not entitled to recover attorney fees under the fee-shifting provision of the statute authorizing attorney fees in civil rights suits against the government, 42 U.S.C. § 1988 (2018).  Kay v. Ehrler, 499 U.S. 432, 437 (1991); see also Gahagan v. USCIS, 911 F.3d 298, 305 (5th Cir. 2018) (overruling Cazalas v. DOJ, 709 F.2d 1051 (5th Cir. 1983), and recognizing and applying Kay when ruling that “pro se attorneys are ineligible for fee awards under FOIA”).  Although the Supreme Court in Kay did not expressly rule on the issue of the award of attorney fees to non-attorney pro se litigants, the Court recognized that “the Circuits are in agreement . . . that a pro se litigant who is not a lawyer is not entitled to attorney’s fees” and was “satisfied that [those cases so holding] were correctly decided.”  499 U.S. at 435. 

The Court’s rationale in Kay would seem to preclude an award of fees to any pro se Privacy Act litigant, as the Court observed that “awards of counsel fees to pro se litigants – even if limited to those who are members of the bar – would create a disincentive to employ counsel” and that “[t]he statutory policy of furthering the successful prosecution of meritorious claims is better served by a rule that creates an incentive to retain counsel in every such case.”  Id. at 438; see also Wilborn v. HHS, No. 91-538, slip op. at 14-16 (D. Or. Mar. 5, 1996) (rejecting argument that rationale in Kay should be construed as applying only to district court stage of litigation; “policy of the Privacy Act . . . would be better served by a rule that creates an incentive to retain counsel at all stages of the litigation, including appeals”), appeal voluntarily dismissed, No. 96-35569 (9th Cir. June 3, 1996); but cf. Smith v. O’Brien, No. 94-41371, 1995 WL 413052, at *2 (5th Cir. June 19, 1995) (per curiam) (citing Barrett v. Customs, infra, and stating:  “Pro se litigants are not entitled to attorney fees under either the FOIA or the Privacy Act unless the litigant is also an attorney”). 

Indeed, the Court of Appeals for the District of Columbia Circuit summarily affirmed a district court decision which held that a “nonattorney pro se litigant cannot recover attorney’s fees under the Privacy Act.”  Sellers v. BOP, No. 87-2048, 1993 U.S. Dist. LEXIS 787, at *1 (D.D.C. Jan. 26, 1993), summary affirmance granted, No. 93-5090, 1993 WL 301032 (D.C. Cir. July 27, 1993).  See also Smith v. O’Brien, 1995 WL 413052, at *2 (“Pro se litigants are not entitled to attorney fees under either the FOIA or the Privacy Act unless the litigant is also an attorney.”); Barrett v. Customs, 651 F.2d 1087, 1089 (5th Cir. 1981) (denying a non-attorney pro se litigant fees); Riser v. State, No. 09-3273, 2010 WL 4284925, at *8 (S.D. Tex. Oct. 22, 2010) (citing Barrett and Smith and denying non-attorney pro se plaintiff’s request for attorney fees); Westendorf v. IRS, No. 3:92-cv-761WS, 1994 WL 714011, at *2 (S.D. Miss. July 7, 1994) (citing Barrett and holding that non-attorney pro se plaintiff is not entitled to attorney fees because there was no evidence pro se plaintiff was an attorney), appeal dismissed, No. 94-60503, slip op. at 2-3 (5th Cir. Nov. 17, 1994) (stating that district court’s holding is correct under Barrett). 

The D.C. Circuit has further ruled, however, that a plaintiff’s pro se status does not preclude the recovery of fees for “consultations” with outside counsel.  Blazy v. Tenet, 194 F.3d 90, 94 (D.C. Cir. 1999); see also id. at 98-99 (Sentelle, J., concurring but “writ[ing] separately only to distance [him]self from the majority’s determination that a pro se litigant is entitled to recover counsel fees for consultations with attorneys not appearing or connected with appearances in the pro se litigation”).

The courts are split as to whether courts considering Privacy Act fee claims should consult FOIA cases.

The subsection (g)(2)(B) and (g)(3)(B) attorney fees provisions for amendment and access suits under the Privacy Act are similar to 5 U.S.C. § 552(a)(4)(E), the FOIA’s attorney fees provision.  Courts are split regarding whether a court may consult FOIA decisions concerning a plaintiff’s eligibility for attorney fees when assessing a plaintiff’s eligibility for attorney fees under the Privacy Act.  The D.C. Circuit has expressly ruled that the FOIA’s criteria for determining a plaintiff’s entitlement to attorney fees are inapplicable to a claim for fees under the Privacy Act.  Blazy, 194 F.3d at 95-97 (“Even a cursory examination of these factors makes it clear that they have little or no relevance in the context of the Privacy Act.”); see also Herring v. VA, No. 94-55955, 1996 WL 32147, at *5-6 (9th Cir. Jan. 26, 1996) (finding plaintiff to be “prevailing party” on access claim for her medical record with no mention or application of FOIA criteria); but see Sweatt v. Navy, 683 F.2d 420, 423 (D.C. Cir. 1982) (stating in dicta that cases construing whether plaintiffs had “substantially prevailed” for purposes of attorney fee provision in FOIA are apposite in Privacy Act context, although Blazy court distanced itself from this language). 

On the other hand, the Fourth, Fifth, and Tenth Circuit Courts of Appeals have held that the FOIA’s fee entitlement criteria apply to Privacy Act claims for attorney fees.  See Gowan v. Air Force, 148 F.3d 1182, 1194-95 (10th Cir. 1998) (applying the FOIA’s criteria and determining that plaintiff was not entitled to fees because his “suit was for his personal benefit rather than for the benefit of the public interest”); see also Reinbold v. Evers, 187 F.3d 348, 362 (4th Cir. 1999) (citing Gowan and stating in dicta that if determination is made that plaintiff substantially prevailed, court must evaluate FOIA factors to determine entitlement); Barrett v. Customs, 651 F.2d at 1088 (stating that FOIA’s guidelines apply to claims for attorney fees under Privacy Act).

Despite the evolution of the “catalyst” theory under the FOIA, the courts have not definitively ruled on its applicability in Privacy Act cases.

In the FOIA context, the Supreme Court held in 2001 that “the ‘catalyst theory’ is not a permissible basis for the award of attorney’s fees.”  Buckhannon Bd. & Care Home, Inc. v. W. Va. Dep’t of Health & Human Resources, 532 U.S. 598, 610 (2001).  In 2002, the D.C. Circuit followed that approach, holding that “in order for plaintiffs in FOIA actions to become eligible for an award of attorney’s fees, they must have ‘been awarded some relief by [a] court,’ either in a judgment on the merits or in a court-ordered consent decree.”  Oil, Chem. & Atomic Workers Int’l Union v. Energy, 288 F.3d 452, 455-56 (D.C. Cir. 2002) (quoting and applying Buckhannon).  This interpretation of Buckhannon was widely followed for years, with the result that plaintiffs were denied attorney fees in FOIA cases in which the agency voluntarily disclosed the records at issue.  See, e.g., Union of Needletrades, Indus. & Textile Employees v. INS, 336 F.3d 200, 206 (2d Cir. 2003); McBride v. Army, No. 06-4082, 2007 WL 1017328, at *3-4 (E.D. La. Mar. 30, 2007); Poulsen v. Customs & Border Prot., No. 06-1743, 2007 WL 160945, at *1 (N.D. Cal. Jan. 17, 2007); Landers v. Air Force, 257 F. Supp. 2d 1011, 1012 (S.D. Ohio 2003). 

However, Congress amended the FOIA in 2007 to explicitly provide for attorney fees under a “catalyst theory.”  See OPEN Government Act of 2007, Pub. L. No. 110-175, 121 Stat. 2524.  The FOIA now provides that a plaintiff is eligible to obtain attorney fees if records are obtained as a result of “(I) a judicial order, or an enforceable written agreement or consent decree; or (II) a voluntary or unilateral change in position by the agency, if the complainant’s claim is not insubstantial.”  5 U.S.C. § 552(a)(4)(E)(ii), as amended; see also Brayton v. Office of the U.S. Trade Representative, 641 F.3d 521, 525 (D.C. Cir. 2011) (“The purpose and effect of this law, which remains in effect today, was to change the ‘eligibility’ prong back to its pre-Buckhannon form.”); Davis v. DOJ, 610 F.3d 750, 752 (D.C. Cir. 2010) (“Congress enacted the OPEN Government Act of 2007 to establish that the catalyst theory applied in FOIA cases.”). 

Although there has not been significant litigation regarding the “catalyst theory” in Privacy Act fee cases, at least one case arising in the Fourth Circuit, which, as noted above, has explicitly adopted the FOIA criteria for determinations of entitlement to fees, applied the catalyst theory in the Privacy Act context.  Crockett v. VA, No. 7:17-CV-186, 2018 WL 1684284, at *4 (W.D. Va. Jan. 19, 2018), report and recommendation adopted Crockett v. VA, No. 7:17-CV-00186, 2018 WL 4550449 (W.D. Va. Sept. 21, 2018) (applying catalyst theory but ultimately concluding that plaintiff had “not produced evidence that his lawsuit was a catalyst for the VA’s production of his records” and, therefore, was not eligible to recover attorneys’ fees); cf. Reinbold v. Evers, 187 F.3d at 363 (recognizing without discussing catalyst theory in pre-OPEN Government Act case but upholding denial of fees where evidence showed that delay was result of staffing shortage rather than “that [plaintiff’s] lawsuit was a catalyst for the [agency’s] action”); Jacobs v. Reno, No. 3:97-CV-2698-D, 1999 WL 155708, at *4-5 (N.D. Tex. Mar. 11, 1999) (denying plaintiff’s request for attorney fees and costs, and stating without using “catalyst theory” terminology that plaintiff’s argument that his lawsuit caused agency “to comply with the Privacy Act when it would not otherwise have done so” was “too slim a reed on which to rest” his claim), aff’d, 208 F.3d 1006 (5th Cir. 2000) (unpublished table decision).

The impact of the OPEN Government Act in courts that have not tied the Privacy Act fee analysis to the FOIA is less clear, given that not many cases have addressed the issue.  The D.C. District Court applied the “catalyst theory” in a case in which the plaintiff sought fees under the FOIA along with the Privacy Act but ultimately concluded that the plaintiffs had not “substantially prevailed.”  Mobley v. DHS, 908 F. Supp. 2d 42, 45 (D.D.C. 2012); but see Sterrett v. Navy, No. 09-CV-2083-IEG POR, 2010 WL 330086, at *6 (S.D. Cal. Jan. 20, 2010) (applying different standards to Privacy Act and FOIA fee claims).

Although not explicitly addressed in the Privacy Act context, enhanced fees to compensate for risk in contingency fee arrangements generally are not permitted.

Under the FOIA, the D.C. Circuit had previously held that a fee enhancement as compensation for the risk in a contingency fee arrangement might be available in limited circumstances.  See, e.g., Weisberg v. DOJ, 848 F.2d 1265, 1272 (D.C. Cir. 1988).  The Supreme Court has clarified, however, that such enhancements are not available under statutes authorizing an award of reasonable attorney fees to a prevailing or substantially prevailing party.  City of Burlington v. Dague, 505 U.S. 557, 561-66 (1992) (prohibiting contingency enhancement in environmental fee-shifting statutes).  The Court further observed that case law “construing what is a ‘reasonable’ fee applies uniformly to all [federal fee-shifting statutes].”  Id.  In light of this observation, there seems to be little doubt that the same principle also prohibits fee enhancements under the Privacy Act.  Id. at 562; see also King v. Palmer, 950 F.2d 771, 775 (D.C. Cir. 1991) (en banc) (Silberman, C.J., concurring).

Courts appear to differ as to whether attorney fees and costs can be recovered even without a showing of “actual damages.”

The Fourth Circuit held in a damages lawsuit brought under the Privacy Act, that “[t]he face of [subsection (g)(4)] leaves no room for confusion on this point” and “does not require a showing of actual damages . . . in order to receive costs and reasonable attorney fees.”  Doe v. Chao, 435 F.3d 492, 495-96 (4th Cir. 2006).  The Fourth Circuit further explained that “the word ‘sum’ – as it is used in [subsection (g)(4)] – requires a court to fulfill the simple act of adding actual damages and fees and costs once the preceding elements of the statute are satisfied,” and therefore, plaintiff who establishes violation but does not recover damages is eligible for attorney fees.  Id.  In reaching its decision, the Fourth Circuit rejected the government’s argument that the Supreme Court had reached a contrary conclusion.  Id. at 497, citing Doe v. Chao, 540 U.S. at 625 n.9.  The Fourth Circuit Court of Appeals analyzed the Supreme Court’s footnote in Doe v. Chao and concluded that “in no place did the [Supreme Court] purport to interpret § 552a(g)(4)(B)”; instead, “The Supreme Court’s phrase . . . means nothing more than the obvious fact that the Government cannot be liable for actual damages if there are no actual damages.”  435 F.3d at 497. 

Although a subsequent decision of the District Court of the District of Columbia questioned the Court Circuit’s conclusion, it did so in dicta.  Rice v. United States, 245 F.R.D. 3, 7 n.6 (D.D.C. 2007) (“There is some question as to whether plaintiffs could recover costs and reasonable attorney fees under section 552a(g)(4) even without showing actual damages. . . As Judge Michael’s dissent in [Doe v. Chao, 435 F.3d at 507] points out, however, the Supreme Court’s [opinion in Doe v. Chao, 540 U.S. at 625 n.9] appears to foreclose such a recovery.”).

Attorney fees are only available in amendment cases if the plaintiff has exhausted administrative remedies; attorney fees are not available for administrative representation.

The D.C. Circuit has held that attorney fees are not available in a subsection (g)(1)(A) amendment case unless the plaintiff has exhausted his administrative remedies.  See Haase v. Sessions, 893 F.2d 370, 373-75 (D.C. Cir. 1990); Sterrett v. Navy, 2010 WL 330086, at *6 (relying on Haase in subsection (g)(1)(B) access case and concluding that “a fee award would be improper because Plaintiff failed to exhaust her administrative remedies”).

Attorney fees are not recoverable for services rendered at the administrative level.  See Kennedy v. Andrus, 459 F. Supp. 240, 244 (D.D.C. 1978), aff’d, 612 F.2d 586 (D.C. Cir. 1980) (unpublished table decision).

In addition to attorney fees, prevailing plaintiffs can also recover the costs of litigation.

Litigation costs (if reasonably incurred) can be recovered by all plaintiffs who substantially prevail.  See Parkinson v. Comm’r, No. 87-3219, 1988 WL 12121, at *3 (6th Cir. Feb. 17, 1988); Walker v. DOJ, No. 00-0106, slip op. at 5-6 (D.D.C. July 14, 2000); Young v. CIA, No. 91-527-A, slip op. at 2 (E.D. Va. Nov. 30, 1992), aff’d, 1 F.3d 1235 (4th Cir. 1993) (unpublished table decision).  Compare Herring, No. 94-55955, 1996 WL 32147, at *5-6 (finding that plaintiff was “a prevailing party with respect to her access claim” because “the VA did not provide her access to all her records until she filed her lawsuit”), with Abernethy v. IRS, 909 F. Supp. 1562, 1567-69 (N.D. Ga. 1995) (“[T]he fact that records were released after the lawsuit was filed, in and of itself, is insufficient to establish Plaintiff’s eligibility for an award of attorneys’ fees.”), aff’d per curiam, 108 F.3d 343 (11th Cir. Feb. 13, 1997) (unpublished table decision).  Further, the D.C. Circuit held that a pro se plaintiff’s claim for litigation costs under the Privacy Act is not limited by 28 U.S.C. § 1920 (governing litigation costs generally).  Blazy, 194 F.3d at 94-95 (following reasoning of Kuzma v. IRS, 821 F.2d 930 (2d Cir. 1987) (FOIA case)).

 

2. Jurisdiction and Venue

“An action to enforce any liability created under this section may be brought in the district court of the United States in the district in which the complainant resides, or has his principal place of business, or in which the agency records are situated, or in the District of Columbia. . .”  5 U.S.C. § 552a(g)(5).

Comment:

Federal district courts have exclusive jurisdiction over Privacy Act suits.

By its very terms, this section limits jurisdiction over Privacy Act matters to the federal district courts.  5 U.S.C. § 552a(g)(5).  Accordingly, the U.S. Court of Federal Claims does not have jurisdiction over Privacy Act claims.  See, e.g., Parker v. United States, 280 F. App’x 957, 958 (Fed. Cir. 2008) (affirming Court of Federal Claims’ determination that “the Court of Federal Claims is not the proper forum for such action. . . .  district courts have jurisdiction in matters under the Privacy Act”); Braun v. United States, 144 Fed. Cl. 560, 571 (2019) (“Any claims that plaintiff wishes to pursue under the Privacy Act can only be brought in a District Court, and cannot be brought in this court.”); Frazier v. United States, No. 16-1287C, 2016 WL 6583715, at *2 (Fed. Cl. Nov. 1, 2016), aff’d, 683 F. App’x 938 (Fed. Cir. 2017); Madison v. United States, 98 Fed. Cl. 393, 395 (Fed Cl. 2011); Treece v. United States, 96 Fed. Cl. 226, 232 (Fed. Cl. 2010); Addington v. United States, 94 Fed. Cl. 779, 784 (Fed. Cl. 2010); Stephanatos v. United States, 81 Fed. Cl. 440, 444 (Fed. Cl. 2008); Agee v. United States, 72 Fed. Cl. 284, 290 (Fed. Cl. 2006); Doe v. United States, 74 Fed. Cl. 794, 798 (Fed. Cl. 2006).  Likewise, neither the Merit Systems Protection Board nor the U.S. Tax Court has jurisdiction over Privacy Act claims.  See, e.g., Carell v. MSPB, 131 F. App’x 296, 299 (Fed. Cir. 2005); Martin v. Army, No. 00-3302, 2000 WL 1807419, at *2 (Fed. Cir. Dec. 8, 2000) (per curiam) (MSPB); Minnich v. MSPB, No. 94-3587, 1995 U.S. App. LEXIS 5768, at *3 (Fed. Cir. Mar. 21, 1995) (per curiam) (MSPB); Strickland v. Comm’r, No. 9799-95, 2000 WL 274077, at *1 (T.C. Mar. 14, 2000) (U.S. Tax Court).  Note, however, that final orders of the National Transportation Safety Board (NTSB) are reviewed in U.S. courts of appeals rather than district courts, even where the case in question involves the Privacy Act.  See Creed v. NTSB, 758 F. Supp. 2d 1, 4-8 (D.D.C. 2011) (holding that judicial review provision of Independent Safety Board Act, 49 U.S.C. § 1153(a), operates to give exclusive jurisdiction to appropriate U.S. Court of Appeals or Court of Appeals for the District of Columbia Circuit to review final orders of NTSB).

D.C. Circuit decisions carry great weight in Privacy Act matters.

Because the Privacy Act specifically provides for venue in the District of Columbia, the Privacy Act decisions of the Court of Appeals for the District of Columbia Circuit are of great importance.  Tyler v. U.S. BOP, 315 F. Supp. 3d 313, 315 n.1 (D.D.C. 2018), aff'd sub nom. Tyler v. BOP, No. 18-5187, 2019 WL 1752626 (D.C. Cir. Mar. 28, 2019) (“The venue provisions of both the Privacy Act and the FOIA identify the federal district court in the District of Columbia as a proper venue for such claims.”)

The text of the Privacy Act specifies the factors courts consider in making venue determinations.

Courts considering venue have weighed the factors specified in the statute:  the plaintiff’s place of residence, the plaintiff’s principal place of business, or the place where agency records are located.  See, e.g., Akutowicz v. United States, 859 F.2d 1122, 1126 (2d Cir. 1988) (finding “only proper venue for this action is the District of Columbia” where plaintiff resided and worked continuously in France and agency records were in D.C.); Shallow v. FBI, No. 1:19-CV-229, 2019 WL 2718493, at *2 (E.D. Va. June 27, 2019), aff'd, 788 F. App’x 189 (4th Cir. 2019) (transferring venue to District of Columbia where plaintiff’s mailing address was there and complaint made “no mention of Plaintiff having another residential address, a principal place of business, nor where the alleged agency records may be located”); Schneider v. Brennan, No. 15-CV-263-JDP, 2016 WL 29642, at *3 (W.D. Wis. Jan. 4, 2016) (transferring venue to district in which “relevant agency records” and employees involved in case were located); Doe v. Army, 99 F. Supp. 3d 159, 161 (D.D.C. 2015) (“Privacy Act cases may be brought where the plaintiff ‘resides, or has his principal place of business, or [where] the agency records are situated, or in the District of Columbia.’”); Echols v. Morpho Detection, Inc., No. C 12-1581, 2013 WL 1501523, at *6 (N.D. Cal. Apr. 11, 2013) (finding venue was improper because plaintiff resided and was employed in another district and records were in Washington, D.C. or Virginia, and finding that doctrine of pendent jurisdiction does not apply to special venue statutes like Privacy Act that specify proper venue); Budik v. United States, No. 09-3079, 2011 U.S. Dist. LEXIS 74655, at *4 (D. Md. July 11, 2011) (transferring Privacy Act claim to District of Columbia, where plaintiff resided and “where the records at issue were created and stored”; adding that “the United States District Court for the District of Columbia is surely more thoroughly vested in the complex issues surrounding suits brought against the United States under the Privacy Act than is this Court”); In re Dep’t of VA Data Theft Litig. v. Nicholson, 461 F. Supp. 2d 1367, 1368-69 (E.D. Ky. 2006) (explaining that District of Columbia “is a preferable transferee forum for this litigation” because it is “where likely relevant documents and witnesses may be found, inasmuch as many of the defendants are located in this district and the theft occurred in the Washington, D.C., metropolitan area”); Roberts v. DOT, No. 02-829, 2002 U.S. Dist. LEXIS 14116, at *1-2 (E.D. Pa. July 3, 2003) (transferring venue to Eastern District of New York, as “both plaintiff and the records are located within [that district]”); Troupe v. O’Neill, No. 02-4157, 2003 WL 21289977, at *3 (D. Kan. May 9, 2003) (transferring case to Northern District of Georgia as “agency records would be situated there”); Warg v. Reno, 19 F. Supp. 2d 776, 785 (N.D. Ohio 1998) (transferring case to District of Columbia in interest of justice where plaintiff resided in Maryland and records were located in Washington, D.C.); Finley v. NEA, 795 F. Supp. 1457, 1467 (C.D. Cal. 1992) (“[I]n a multi-plaintiff Privacy Act action, if any plaintiff satisfies the venue requirement of 5 U.S.C. § 552a(g)(5), the venue requirement is satisfied as to the remaining plaintiffs.”).

Although the Act specifies the D.C. District Court as an appropriate venue, that court at times has transferred cases elsewhere.

The District Court for the District of Columbia is always a proper venue, but the courts in the District of Columbia have transferred venue elsewhere when “private and public interest factors” make another jurisdiction “the more appropriate venue.”  See Doe v. Army, 99 F. Supp. 3d at 162; see also Hooker v. NASA, 961 F. Supp. 2d 295, 297 (D.D.C. 2013) (transferring venue to Maryland where plaintiff lived there, agency was headquartered there, and “other potential sources of proof, including records” and witnesses were in Maryland).

Similarly, in cases in which the plaintiff filed other claims in addition to a Privacy Act claim, the courts in the District of Columbia have often concluded that for purposes of judicial economy, the Privacy Act claim should be heard in the same jurisdiction as the other claims.  See, e.g., Valerino v. Holder, 20 F. Supp. 3d 203, 206 (D.D.C. 2013) (concluding that Privacy Act claim was appropriately heard with Title VII claim in the Eastern District of Virginia “in the interests of justice” because that is where “the relevant conduct occurred,” and “most of the witnesses are located”); Tildon v. Alexander, 587 F. Supp. 2d 242, 243 n.1 (D.D.C. 2008) (transferring multi-claim cause of action to Maryland, even though Privacy Act allowed venue in District of Columbia, because venue for other claims was Maryland and “judicial economy . . . will be served by transferring this action in its entirety”); Dehaemers v. Wynne, 522 F. Supp. 2d 240, 248-49 (D.D.C. 2007) (concluding that appropriate venue for plaintiff’s Title VII and Rehabilitation Act claims was Virginia and, although plaintiff’s Privacy Act claims were properly in District of Columbia, court would not assume pendant jurisdiction over other claims, and plaintiff could “pursue a single action in [Virginia] either by seeking a dismissal without prejudice of his Privacy Act claim, or by moving this Court to transfer his Privacy Act claim”);  Boers v. United States, 133 F. Supp. 2d 64, 65 (D.D.C. 2001) (transferring case under 28 U.S.C. § 1404(a) to plaintiff’s “home forum,” even though “venue is proper” in District of Columbia, given that “[a]ll the operative facts occurred in Arizona” and “it cannot be said that forcing a plaintiff to litigate in his home district will prejudice or burden the plaintiff in any way”), mandamus denied per curiam sub nom. In re Howard L. Boers, No. 01-5192 (D.C. Cir. Aug. 28, 2001).

Generally, for plaintiffs who are in prison, the jurisdiction where the plaintiff is incarcerated is the appropriate venue.

When the plaintiff is incarcerated, most courts have held that the appropriate venue under the Privacy Act is the jurisdiction where the plaintiff is incarcerated rather than the jurisdiction of his or her previous domicile.  See, e.g., Pinson v. DOJ, 74 F. Supp. 3d 283, 294 (D.D.C. 2014) (finding that because plaintiff “is currently incarcerated in Colorado, a large portion of the records and witnesses at issue are located in the state, and . . . because of possible transportation difficulties,” Privacy Act claim is more appropriately litigated in District of Colorado); United States v. Barrenechea, No. 94-0206, 2013 WL 3014141, at *2 (N.D. Cal. June 17, 2013) (“Given that Barrenechea is incarcerated in USP-Victorville, coupled with the fact that the challenged records are alleged to be located there, the Court notes that the Central District of California, not the Northern District, appears to be the appropriate venue for Barrenechea’s Privacy Act claims.”); United States v. Cornejo, No. 94-0206, 2013 WL 3052913, at *2 (N.D. Cal. June 17, 2013) (following Barrenechea); Royer v. BOP, No. 1:10-cv-0146, 2010 WL 4827727, at *4 (E.D. Va. Nov. 19, 2010) (“Royer’s domicile may well be in the Eastern District of Virginia.  However, in light of the fact that he is presently serving a 20-year sentence and is confined in a federal facility in Colorado, Royer has failed to set forth sufficient information establishing that he resides in this District for FOIA and Privacy Act purposes.”); Harton v. BOP, No. 97-0638, slip op. at 3, 6-7 (D.D.C. Nov. 12, 1997) (stating that “the fact that the Privacy Act provides for venue in the District of Columbia does not, by itself, establish that each and every Privacy Act claim involves issues of national policy,” and granting agency’s motion to transfer to the jurisdiction where plaintiff was incarcerated, as complaint focused primarily on issues specific to plaintiff); but see Pickard v. DOJ, No. C 10-05253, 2011 WL 2199297, at *2-3 (N.D. Cal. June 7, 2011) (acknowledging that some courts have interpreted comparable venue language under FOIA to “conclude that residence is where the now-incarcerated defendant was last domiciled” and “find[ing] more persuasive the cases holding that an individual resides where he is incarcerated, at least for purposes of FOIA and the Privacy Act,” but transferring case to jurisdiction where records were located).

One court has concluded that venue should be evaluated at the time the suit is filed.

Although apparently only one court has addressed the issue of whether venue should be considered at the time the suit was filed or at the time the cause of action arose, that court concluded that it would follow the general rule that “courts determine venue based on the facts at the time the suit was filed, not when the cause of action arose.”  Schneider v. Brennan, 2016 WL 29642, at *2 (indicating that court “has not found any decision specifically addressing this question in the context of a Privacy Act claim, but the general rule is widely followed,” and referencing Daughetee v. CHR Hansen, Inc., No. 09-cv-41, 2011 WL 1113868, at *4 (N.D. Iowa Mar. 25, 2011) (collecting cases)).

 

3. Statute of Limitations

“An action to enforce any liability created under this section may be brought . . . within two years from the date on which the cause of action arises, except that where an agency has materially and willfully misrepresented any information required under this section to be disclosed to an individual and the information so misrepresented is material to establishment of the liability of the agency to the individual under this section, the action may be brought at any time within two years after discovery by the individual of the misrepresentation.  Nothing in this section shall be construed to authorize any civil action by reason of any injury sustained as the result of a disclosure of a record prior to September 27, 1975.”  5 U.S.C. § 552a(g)(5).

Comment: 

Courts have split over whether the Privacy Act’s statement that suits “may be brought . . .  within two years” is jurisdictional.

The Second, Third, Sixth, Seventh, and Tenth Circuit Courts of Appeals and some district courts have held that the statute of limitations is jurisdictional in nature and have strictly construed it to be an “‘integral condition of the sovereign’s consent to be sued under the Privacy Act.’”  Bowyer v. Air Force, 875 F.2d 632, 635 (7th Cir. 1989) (quoting Diliberti v. United States, 817 F.2d 1259, 1262 (7th Cir. 1987)); accord Harrell v. Fleming, 285 F.3d 1292, 1293-94 (10th Cir. 2002); Weber v. Henderson, 33 F. App’x 610, 611 (3d Cir. 2002) (per curiam); Davis v. DOJ, 204 F.3d 723, 726 (7th Cir. 2000) (per curiam); Akutowicz v. United States, 859 F.2d 1122, 1126 (2d Cir. 1988); Davis v. Gross, No. 83-5223, 1984 U.S. App. LEXIS 14279, at *3-4 (6th Cir. May 10, 1984); Hussein v. Sessions, No. 16-cv-780, 2017 WL 1954767, at *4 (D. Minn. May 10, 2017), aff’d per curiam, 715 F. App’x 585 (8th Cir. 2018); Jagun v. Rodriguez, No. 15-2230, 2016 WL 4124225, at *8 (D. Md. Aug. 3, 2016); Doe v. FDIC, No. 11 Civ. 307, 2012 WL 612461, at *4 (S.D.N.Y. Feb. 27, 2012); Mauldin v. Napolitano, No. 10-12826, 2011 WL 3113104, at *2 (E.D. Mich. July 26, 2011); Bassiouni v. FBI, No. 02-8918, 2003 WL 22227189, at *2 (N.D. Ill. Sept. 26, 2003), aff’d on other grounds, 436 F.3d 712 (7th Cir. 2006); Logan v. United States, 272 F. Supp. 2d 1182, 1187 (D. Kan. 2003); Mangino v. Army, 818 F. Supp. 1432, 1437-38 (D. Kan. 1993), aff’d, 17 F.3d 1437 (10th Cir. 1994) (unpublished table decision).  Consequently, a plaintiff’s failure to file suit within the specified time period has been held to “[deprive] the federal courts of subject matter jurisdiction over the action.”  Diliberti, 817 F.2d at 1262.

However, the courts of appeals “have not unanimously adhered to the view that the Privacy Act’s statute of limitations is jurisdictional, such that a plaintiff’s failure to file a Privacy Act claim within the Privacy Act’s limitations period deprives a federal court of subject-matter jurisdiction over the claim.”  Carter v. DOD, No. 16-0786, 2017 WL 2271416, at *8 (D.N.M. Feb. 28, 2017).  The Courts of Appeals for the District of Columbia and Ninth Circuits, as well as other district courts, have concluded that there is a “rebuttable presumption” in favor of equitable tolling in Privacy Act cases.  The D.C. Circuit held that the “‘rebuttable presumption’ in favor of equitable tolling” in suits against the United States—the general rule announced in Irwin v. VA, 498 U.S. 89, 95 (1990)—applies to the Privacy Act.  Chung v. DOJ, 333 F.3d 273, 277 (D.C. Cir. 2003) (overruling Griffin v. Parole Comm’n, 192 F.3d 1081, 1082 (D.C. Cir. 1999) (per curiam)).  The D.C. Circuit concluded that “a Privacy Act claim for unlawful disclosure of personal information is sufficiently similar to a traditional tort claim for invasion of privacy to render the Irwin presumption applicable.”  Chung, 333 F.3d at 276-77. 

Although the D.C. Circuit appeared to limit its holding in Chung to “claim[s] for unlawful disclosure of personal information,” 333 F.3d at 277, the District Court for the District of Columbia has relied on Chung in considering equitable tolling in other types of Privacy Act claims without conducting the “similarity inquiry” articulated in Chung, 333 F.3d at 277, with respect to the individual claims.  See, e.g., Earle v. Holder, 815 F. Supp. 2d 176, 180 (D.D.C. 2011) (considering apparent (g)(1)(A) and (g)(1)(C) claim, and applying principle that statute of limitations is subject to equitable tolling “when the plaintiff ‘despite all due diligence . . . is unable to obtain vital information bearing on the existence of his claim’” (quoting Chung, 333 F.3d at 278)), aff’d per curiam, No. 11-5280, 2012 WL 1450574 (D.C. Cir. Apr. 20, 2012); Bailey v. Fulwood, 780 F. Supp. 2d 20, 23, 27-28 (D.D.C. 2011) (citing Kursar and Chung for proposition that Privacy Act statute of limitations “is not a jurisdictional bar,” but ultimately dismissing apparent (g)(1)(C) claim because “there is no reason in this case to toll the running of the statute of limitations”); Kursar v. TSA, 751 F. Supp. 2d 154, 165-69 (D.D.C. 2010) (finding (g)(1)(C) claim not equitably tolled by plaintiff’s MSPB action challenging employment termination), aff’d per curiam, 442 F. App’x 565 (D.C. Cir. 2011).

The Ninth Circuit also has adopted the Supreme Court’s rebuttable presumption approach from Irwin and held that Privacy Act claims brought under subsection (g)(1)(D) and based on alleged violations of subsections (e)(5) and (e)(6) “are sufficiently similar to traditional tort actions such as misrepresentation and false light to warrant the application of Irwin’s rebuttable presumption.”  Rouse v. State, 567 F.3d 408, 416 (9th Cir. 2009) (amended opinion) (citing Chung, 333 F.3d at 277).  Because the Ninth Circuit agreed with Chung that no aspect of the Privacy Act “militate[s] against tolling,” the court concluded that “the Irwin presumption has not been rebutted.”  Rouse, 567 F.3d at 416-17.  However, the court “decline[d] to decide whether equitable tolling is warranted on the facts of this case.”  Id. at 417.  See also Boyd v. United States, 932 F. Supp. 2d 830, 838 (S.D. Ohio 2013) (interpreting Irwin, the court held that “[i]n the absence of specific Congressional intent to the contrary, and considering the Privacy Act’s similarity to privacy actions in tort . . . the Privacy Act’s statute of limitations is a traditional statute of limitations”); Shearson v. Holder, 865 F. Supp. 2d 850, 867-68 (N.D. Ohio 2011) (noting the “split in the circuits as to whether the Privacy Act’s statute of limitations is jurisdictional in nature” but “agree[ing] with the courts that have adopted the Irwin approach and have held that Privacy Act claims are sufficiently similar to privacy tort claims to trigger the application of the Irwin rule”); Fort Hall Landowners All., Inc. v. BIA, No. 99-052, slip op. at 6-7 (D. Idaho Mar. 17, 2003) (citing Irwin and finding that the Privacy Act “does not use such language [of jurisdiction], and therefore does not present a jurisdictional bar”).  But see Gonzalez v. United States, No. 18-cv-21789, 2018 WL 7825025, at *4-5 & n.5 (S.D. Fla. Oct. 11, 2018) (noting circuit split and that Eleventh Circuit “has not spoken” on jurisdictional issue, and finding no need to decide the issue); Carter, 2017 WL 2271416, at *12  (stating that “in light of [Irwin], the Court agrees with the Ninth Circuit’s and the D.C. Circuit’s reasoning that it does not make sense to treat the Privacy Act’s statute of limitations as a jurisdictional bar” but dismissing claims for lack of subject-matter jurisdiction because “bound to follow faithfully” Tenth Circuit precedent).

 

a. Statute of Limitations in Amendment suits

For Privacy Act amendment suits, the statute of limitations period begins when the agency denies the plaintiff’s request to amend.

In a subsection (g)(1)(A) amendment suits, the limitations period begins when the agency denies the plaintiff’s request to amend.  See Englerius v. VA, 837 F.2d 895, 897-98 (9th Cir. 1988) (holding that the statute of limitations “commences at the time that a person knows or has reason to know that the request has been denied,” rather than as of the date of the request letter); see also Djenasevic v. EOUSA, 319 F. Supp. 3d 474, 482-83 (D.D.C. 2018) (dismissing amendment claims filed in 2016 on statute of limitations grounds because agency notified plaintiff of denial of request to amend records in 2011), aff’d per curiam, No. 18-5262, 2019 WL 5390964, at *1 (D.C. Cir. Oct. 3, 2019); Otero v. DOJ, 292 F. Supp. 3d 245, 253 (D.D.C. 2018) (holding that limitations period began when agency affirmed FBI’s decision to deny amendment of records), aff’d per curiam, No. 18-5080, 2019 WL 4565497 (D.C. Cir. Sept. 4, 2019); Kursar, 751 F. Supp. 2d at 167 (finding that “the statute of limitations for this claim began running when the TSA denied [plaintiff’s] amendment request”); Bassiouni, 2003 WL 22227189, at *3-4 (acknowledging distinction as to when claim arises among four distinct Privacy Act causes of actions and finding that in an amendment cause of action, a claim arises “when an individual knows or has reason to know that his request to amend has been denied”); Blazy v. Tenet, 979 F. Supp. 10, 18 (D.D.C. 1997) (citing Englerius and finding that claim for amendment of sexual harassment allegations in personnel file did not begin to run until employee discovered that FBI, where plaintiff had applied for employment, never received corrective letter from CIA, prior to which time plaintiff did not and could not have known of CIA’s failure to amend), summary affirmance granted, No. 97-5330, 1998 WL 315583, at *1 (D.C. Cir. May 12, 1998).  But see Campeau v. SSA, 575 F. App’x 35 (3d Cir. 2014) (per curiam) (finding that plaintiff was aware of his alleged injury after knowing SSA received his request and failed to acknowledge receipt “not later than 10 days (excluding [weekends and holidays]) after receipt,” as required by § 552a(d)(2)(A)); Wills v. OPM, No. 93-2079, slip op. at 2-3 (4th Cir. Jan. 28, 1994) (per curiam) (holding that cause of action triggers statute of limitations when plaintiff knows or should have known of alleged violation, which in this case was when plaintiff sent his first letter requesting amendment); Lee v. FBI, 172 F. Supp. 3d 304, 306-07 (D.D.C. 2016) (“Presumably Plaintiff knew or had reason to know that the Electronic Communication contained false or inaccurate information upon receipt of records from the FBI in response to his FOIA request.”); Alexander v. Mich. Adjutant Gen., 860 F. Supp. 2d 448, 456-57 (W.D. Mich. 2012) (ruling that limitations period began when plaintiff was terminated “approximately fifteen years prior to filing this action,” or “[g]iving plaintiff every benefit of the doubt” considering several “other dates that plaintiff could have claimed to have first ‘known,’” under any of which “plaintiff’s complaint would have been untimely”); cf. Foulke v. Potter, No. 10-CV-4061, 2011 WL 127119, at *3 n.4 (E.D.N.Y. Jan. 10, 2011) (holding plaintiff must amend complaint to plead Privacy Act amendment claim, but noting that claim would likely fail “[s]ince the documents which plaintiff seeks to have corrected were created in 2008, and plaintiff was clearly aware of the purported inaccuracies in such documents in 2008” where plaintiff never submitted an amendment request); Reitz v. USDA, No. 08-4131, 2010 WL 786586, at *9-10 (D. Kan. Mar. 4, 2010) (dismissing amendment claim where plaintiffs had not “specifie[d] any date for the alleged Privacy Act violations,” and working back from date of court filing, finding that plaintiffs had “not raised a material question of fact that any Privacy Act violation occurred” within two years prior); Evans v. United States, No. 99-1268, 2000 WL 1595748, at *2 (D. Kan. Oct. 16, 2000) (finding that “plaintiff neither knew nor had reason to know of the alleged error in his records until the receipt of information provided by those witnesses who claimed the [Equal Opportunity] Complaint Summary inaccurately reported their testimony,” which prompted him to request “reconsideration and reinvestigation” of information).  One district court “f[ound] it troubling that [a plaintiff] was aware of the existence of allegedly incorrect records in 2002, but waited until 2009 to request amendment of his records.”  Kursar, 751 F. Supp. 2d at 167 n.11.  “Nonetheless, the [c]ourt [was] not aware of any limitations period for seeking an amendment in a statute or otherwise compelled by binding case authority.”  Id. (adding that “an equitable defense such as laches may be applicable in this instance” but declining to “consider the defense as it was not raised by” defendant).

Courts generally have held that the agency’s initial denial begins the limitations period, rather than the date of an agency’s administrative appeal determination.

In determining what constitutes the agency’s denial, it has been held that the agency’s initial denial should govern, rather than the date of the agency’s administrative appeal determination.  See Quarry v. DOJ, 3 Gov’t Disclosure Serv. (P-H) ¶ 82,407, at 83,020-21 (D.D.C. Feb. 2, 1982); see also Singer v. OPM, No. 83-1095, slip op. at 2 (D.N.J. Mar. 8, 1984) (rejecting claim that limitations period began on date plaintiff’s appeal was dismissed as time-barred under agency regulation); cf. Shannon v. Gen. Elec. Co., 812 F. Supp. 308, 320 & n.10 (N.D.N.Y. 1993) (finding that cause of action for damages claim arose when plaintiff’s amendment request was partially denied and noting that “no caselaw can be found to support a finding that the pendency of the appeal has any affect upon the running of the statute of limitations”).

In cases “[w]here the agency has not issued an express denial of the request, the question [of] when a person learns of the denial requires a factual inquiry and cannot ordinarily be decided on a motion to dismiss.”  Englerius, 837 F.2d at 897; see also Jarrell v. USPS, 753 F.2d 1088, 1092 (D.C. Cir. 1985) (holding that issue of material fact existed and therefore summary judgment was inappropriate where agency contended that cause of action arose when it issued final denial of expungement request but requester argued that due to agency’s excision of certain parts of documents, he was unaware of information until later point in time); Conklin v. BOP, 514 F. Supp. 2d 1, 5 (D.D.C. 2007) (denying motion to dismiss as “the date on which plaintiff knew or had reason to know of the alleged Privacy Act violations is unclear”); Lechliter v. Army, No. 04-814, 2006 WL 462750, at *3-4 (D. Del. Feb. 27, 2006) (denying motion to dismiss because “[t]here does not appear to have been a final denial of [plaintiff’s] request” and “there [was], rather, some question regarding what was said” during a telephone call concerning status of request); cf. Bowles v. BOP, No. 08 CV 9591, 2010 WL 23326, at *3 (S.D.N.Y. Jan. 5, 2010) (stating that where “BOP failed to notify the Plaintiff one way or the other” of action on his administrative appeal, “[t]he troubling failure of the BOP to do their job and respond to Plaintiff’s claim, as well as the Plaintiff’s right to be made aware of these deadlines by those that maintain complete control over him are serious, factual questions that would need to be addressed before the statute of limitations issue could be resolved” but dismissing claim on other grounds without reaching these considerations).

 

b. Statute of Limitations in Access suits

For Privacy Act access suits, the statute of limitations period begins when the plaintiff knew, or should have known, of an agency’s failure to comply with the Privacy Act’s access provision.

Courts have enforced the statute of limitations against plaintiffs in subsection (g)(1)(B) access lawsuits where the plaintiff did not timely file after he or she knew or should have known of the violation.  See Melvin v. SSA, 126 F. Supp. 3d 584, 603 (E.D.N.C. 2015) (finding plaintiff’s access claim untimely because plaintiff was aware of violation, at the latest, when she filed response in prior action stating that agency failed to provide her medical records), aff’d per curiam, 686 F. App’x 230 (4th Cir. 2017); Zied v. Barnhart, 418 F. App’x 109, 113-14 (3d Cir. 2011) (per curiam) (concluding that plaintiff “knew of the agency’s alleged errors when defendant . . . sent her a letter that was unresponsive to her Privacy Act requests and she responded”); Willis v. DOJ, 581 F. Supp. 2d 57, 69 (D.D.C. 2008) (ruling that “[a]pplication of the tolling doctrine is inappropriate in this case” because plaintiff “had sufficient knowledge” to bring action within limitations period); Levant v. Roche, 384 F. Supp. 2d 262, 270 (D.D.C. 2005) (concluding that plaintiff knew or should have known that his access request was denied when Air Force issued final decision on his Privacy Act and FOIA requests for documents); Bernard v. DOD, 362 F. Supp. 2d 272, 278-79 (D.D.C. 2005) (determining that it was “clear from the administrative record that the plaintiff knew or should have known about his ability to request his medical records . . . when he alleged he was denied them in the hospital at that time”); Logan v. United States, 272 F. Supp. 2d 1182, 1187 (D. Kan. 2003) (finding that plaintiff’s access claim was untimely as claim arose “when [the agency] disclosed the records to Plaintiff”); McClain v. DOJ, No. 97-0385, 1999 WL 759505, at *4 (N.D. Ill. Sept. 1, 1999) (finding that action “would have accrued when [plaintiff] knew or should have known that his request for access to his IRS records had been denied,” which was more than nine years before he filed suit), aff’d on other grounds, 17 F. App’x 471 (7th Cir. 2001); Biondo v. Navy, 928 F. Supp. 626, 632, 634-35 (D.S.C. 1995) (stating that 1987 request “cannot serve as a basis for relief for a suit brought in 1992 because the Privacy Act has a two-year statute of limitations,” and making similar statements as to undocumented requests for information made in mid-80s and in 1976-77), aff’d, 86 F.3d 1148 (4th Cir. 1996) (unpublished table decision); Burkins v. United States, 865 F. Supp. 1480, 1496 (D. Colo. 1994) (holding cause of action “should not be time-barred” because it would have accrued when plaintiff knew his request for access had been denied); Mittleman v. Treasury, 773 F. Supp. 442, 448, 450-51 n.7 (D.D.C. 1991) (holding that plaintiff “cannot attempt to resurrect” claims barred by statute of limitations by making subsequent request more than three years after she had first received information and almost six months after complaint had been filed).

The only judicial discussion of the Supreme Court’s Irwin presumption of equitable tolling in the context of an access lawsuit is found in Rouse v. State, 548 F.3d 871, 876-77 (9th Cir. 2008), amended and superseded by 567 F.3d 408 (9th Cir. 2009).  Although the opinion was superseded (apparently on mootness grounds, see id. at 411 & n.1), the Ninth Circuit determined that the Irwin rebuttable presumption did not apply to an access claim because it “has no analog in private litigation.”  548 F.3d at 877-78.

Although the Privacy Act’s two-year statute of limitations applies in subsection (g)(1)(B) access lawsuits, the FOIA’s 6-year statute of limitations applies to the same access requests processed under FOIA.  See Spannaus v. DOJ, 824 F.2d 52, 55-56 (D.C. Cir. 1987) (concluding that 28 U.S.C. § 2401(a)’s six-year statute of limitations applies to FOIA actions), overruled on other grounds by Jackson v. Modly, 949 F.3d 763, 778 (D.C. Cir. 2020) (holding “that § 2401(a)’s time bar is nonjurisdictional and . . .  [o]ur decisions to the contrary, see, e.g., Spannaus, 824 F.2d at 55, are thus overruled.”), petition for cert. filed (July 10, 2020) (No. 20-19); FOIA Guide, Litigation Considerations at 13, https://www.justice.gov/oip/doj-guide-freedom-information-act-0 (recognizing six-year statute of limitations); see also H.R. Rep. No. 98-726, pt. 2, at 16-17 (1984), reprinted in 1984 U.S.C.C.A.N. 3741, 3790-91 (noting amendment of Privacy Act in 1984 to include subsection (t)(2) and stating:  “Agencies that had made it a practice to treat a request made under either [the Privacy Act or the FOIA] as if the request were made under both laws should continue to do so.”).

 

c. Statute of Limitations in Damages claims

For Privacy Act damages suits, the statute of limitations period begins when the plaintiff knew, or should have known, of an agency’s violation of the Privacy Act.

In damages claims, courts have deemed the statute of limitations to begin running at the time the plaintiff knew or should have known of the agencies Privacy Act violation.  See, e.g., Chichakli v. Tillerson, 882 F.3d 229, 234 (D.C. Cir. 2018); Powell v. Donahoe, 519 F. App’x 21, 23 (2d Cir. 2013) (finding cause of action accrued when plaintiff “had actual knowledge of the release of his records”); Jackson v. Shinseki, 526 F. App’x 814, 816 (10th Cir. 2013) (holding improper disclosure claims were untimely as “Plaintiff was admittedly aware of these disclosures when his wife ‘filed his military psychiatric records in a state divorce action’”); Burnam v. Marberry, 313 F. App’x 455, 456 (3d Cir. 2009) (per curiam) (“cause of action under the Privacy Act arises when the individual either knew or had reason to know of the alleged error in maintaining the individual’s records and the individual was harmed by the alleged error.”); Shehee v. DEA, No. 05-5276, 2006 U.S. App. LEXIS 15586, at *2 (D.C. Cir. June 14, 2006) (per curiam); Duncan v. EPA, 89 F. App’x 635, 635 (9th Cir. 2004); Williams v. Reno, No. 95-5155, 1996 WL 460093, at *1 (D.C. Cir. Aug. 7, 1996) (per curiam); Tijerina v. Walters, 821 F.2d 789, 797-98 (D.C. Cir. 1987); Smith v. United States, 142 F. App’x 209, 210 (5th Cir. 2005) (per curiam) (affirming that “under section 552a(g)(5) of the Privacy Act, . . . a cause of action accrues when the plaintiff knew or should have known of the alleged violation”); Green v. Westphal, 94 F. App’x 902, 904 (3d Cir. 2004) (“A cause of action arises under the Privacy Act when the individual knows or has reason to know of the alleged error in the individual’s record and the individual is harmed by the alleged error.”); Bergman v. United States, 751 F.2d 314, 316-17 (10th Cir. 1984) (holding that limitations period for damages action under subsection (g)(1)(C) commences at time three conditions are met: (1) an error was made in maintaining plaintiff’s records; (2) plaintiff was wronged by such error; and (3) plaintiff either knew or had reason to know of such error); Gonzalez, 2018 WL 7825025, at *5 (finding that plaintiff “pled with adequate plausibility that due to the Agencies’ improper management of records and misleading communications to third parties, Plaintiff was denied credit in December 2016 in violation of the Privacy Act, well within the Act’s two-year limitations period”); Conway v. Pompeo, No. 1:16-cv-1087, 2018 WL 8800525, at *6-7 (E.D. Va. Sept. 17, 2018) (finding plaintiff’s claim untimely because she knew of alleged violation, at the latest, when she filed second EEO grievance concerning “purported misprocessing of her retirement”), aff’d per curiam sub nom. Conway v. Haspel, 773 F. App’x 693 (4th Cir. 2019); Ashbourne v. Hansberry, 302 F. Supp. 3d 338, 347-48 (D.D.C. 2018) (denying motion to dismiss on statute of limitations grounds where defendants failed to “point to any specific allegation in the complaint that is timebarred”); Ricks v. United States, No. 17-cv-1016, 2018 WL 454455, at *5 (S.D. Cal. Jan. 17, 2018) (finding that plaintiff became aware of agency’s disclosure of his medical and private information outside of the limitations period); Sabatini v. Price, No. 17-cv-1597, 2018 WL 1449416, at *3 (S.D. Cal. Jan. 16, 2018) (inferring that plaintiff knew of the alleged violations in early 2013 because February 2013 letter indicated that plaintiff retained counsel regarding request for removal of report); Carter, 2017 WL 2271416, at *11 (holding statute of limitations began to run when plaintiff discovered entry of allegedly false entry in his medical history); Jagun v. Rodriguez, 2016 WL 4124225, at *8; Gonzalez-Lora v. DOJ, 169 F. Supp. 3d 46, 53 (D.D.C. 2016) (stating that “even if res judicata and collateral estoppel do not bar plaintiff’s claim, . . . allege[d] violations of . . . the Privacy Act arising from the DEA’s response to the 2000 FOIA request” are outside the two-year statute of limitations); Agelli v. Burwell, 164 F. Supp. 3d 69, 75-76 (D.D.C. 2016) (finding that limitations period began when plaintiff received email from agency on October 2, 2014, the date of inquiry notice, rather than on the date she claimed to have first read the email); Marley v. Donahue, 133 F. Supp. 3d 706, 718 (D.N.J. 2015) (finding that, although complaint did not provide basis for Privacy Act claim or identify improperly disclosed record, Privacy Act claim was untimely even if agency disclosed record on date of plaintiff’s resignation); Melvin, 126 F. Supp. 3d at 603 (finding plaintiff’s claims regarding false statements in evaluation accrued when she received a copy of the evaluation); Jarrell v. McDonald, No. 3:15-cv-187, 2015 WL 4720607, at *3-4 (S.D. Ohio Aug. 7, 2015) (finding plaintiff knew of errors in his military personnel file more than two years before filing where plaintiff had previously filed lawsuits relating to the records); Gibson v. Holder, No. 3:14cv641, 2015 WL 5635125, at *7 (magistrate’s recommendation) (finding that Privacy Act claims filed in 2014 were time-barred based on allegations in complaint that, in 1999, plaintiff obtained documents in his security investigation file that he described as “‘full of outright lies, blatant distortions of facts, . . . and a host of other irregularities’”), adopted, 2015 WL 5634596 (N.D. Fla. Sept. 23, 2015); Green v. Probation Office, No. 1:14 CV 2265, 2015 WL 2129521, at *2-3 (N.D. Ohio May 5, 2015) (finding “clearly plaintiff knew or had reason to know of the alleged violation as of 1995” when plaintiff sent letters and received response stating that presentence report could not be amended after the final version was filed with the court); Atkins v. Mabus, No. 12CV1390, 2014 WL 2705204, at *3-5 (S.D. Cal. June 13, 2014) (discussing statute of limitations for various claims of “inappropriate safeguards” to protect confidentiality of plaintiff’s medical condition and improper disclosure), rev’d and remanded on other grounds, 654 F. App’x 878 (9th Cir. 2016); Jarrell v. Nat’l Pers. Recs. Ctr., No. 3:11cv00434, 2013 WL 5346483, at *8-9 (recommending defendant’s summary judgment motion be granted as plaintiff’s claims were time-barred; “Because [plaintiff] raised his record-tampering allegations and claims in his June 1994 Complaint, there is no genuine dispute that by June 1994, [plaintiff] knew, or had reason to know, about the alleged records tampering of which he now complains.”) (magistrate’s recommendation), adopted, 2013 WL 5773930 (S.D. Ohio Oct. 24, 2013); Brockway v. VA Conn. Healthcare Sys., No. 3:10-CV-719, 2012 WL 2154263, at *13-14 (D. Conn. June 13, 2012) (dismissing claim as time-barred as plaintiff “was [] on notice that a possible disclosure of his VA medical records had occurred” when “a non-VA doctor” called “asking if [plaintiff] would like to receive psychotherapy from him” “well outside the requisite two-year statute of limitations”); Toolasprashad v. BOP, No. 09-0317, 2009 WL 3163068, at *2 (D.D.C. Sept. 29, 2009) (finding Privacy Act claim time-barred because plaintiff filed it more than two years after final agency action); cf. Bowyer v. Air Force, 875 F.2d 632, 636 (7th Cir. 1989) (applying stricter standard and holding that the limitations period begins to run when “‘plaintiff first knew or had reason to know that the private records were being maintained’” (quoting Diliberti v. United States, 817 F.2d 1259, 1262-64 (7th Cir. 1987)); Brunotte v. Johnson, 892 F. Supp. 2d 199, 206 (D.D.C. 2012) (explaining that because “Plaintiff became aware of the email disclosure [on March 10, 2006]; and, regardless of whether she knew or should have known that the email was disseminated to [others] in addition to the [individuals she was aware of], Plaintiff attained the necessary knowledge of an alleged Privacy Act violation on that date”); Leibenguth v. United States, No. 08-CV-6008, 2009 WL 3165846, at *3 (W.D.N.Y. Sept. 29, 2009) (concluding that plaintiff’s claim for damages “based on the VA’s failure to disclose his medical records in a timely fashion” was time-barred because he filed it more than two years after he became aware of denial of his claim for disability benefits).

Some courts have held that once the plaintiff knows or has reason to know of a record’s existence, even if based upon hearsay or rumors, the plaintiff has a “duty to inquire” into the matter – i.e., “two years from that time to investigate whether sufficient factual and legal bases existed for bringing suit.”  See Bowyer, 875 F.2d at 637; see also Diliberti, 817 F.2d at 1263-64 (stating that “[t]he hearsay and rumors which the plaintiff described in his affidavit were enough to put him on notice . . . and to impose upon him a duty to inquire into the veracity of those rumors”); Mangino, 818 F. Supp. at 1438 (quoting Diliberti).

Generally, the plaintiff knows or has reason to know of records in violation of the Privacy Act when the plaintiff suspects there is a violation rather than when the plaintiff actually possesses those records or when the government creates those records.  See Diliberti, 817 F.2d at 1262 (stating that “relevant fact is not when the plaintiff first had physical possession of the particular records, but rather when he first knew of the existence of the records”); see also Duncan, 89 F. App’x at 636 (reasoning that “a certainty, or testimony under oath, is not required to begin the running of the limitations period, but rather ‘what a reasonable person should have known’” (quoting Rose v. United States, 905 F.2d 1257, 1259 (9th Cir. 1990))). 

Generally, constructive notice of the possible violation triggers the statute of limitations for damages claims.

If the plaintiff has constructive notice of the possible violation, the statute of limitations is triggered.  See Diliberti, at 1262-63; see also Bowyer, 875 F. 2d at 636 (stating that when agency employee confirmed that agency maintained private records on plaintiff relating to previous conflict with his supervisor, he had sufficient notice of possibly erroneous records).  In the context of a damages action for wrongful disclosure, the D.C. Circuit rejected the government’s argument that the limitations period commenced when the contested disclosure occurred, and observed that such an unauthorized disclosure “is unlikely to come to the subject’s attention until it affects him adversely, if then.”  Tijerina, 821 F.2d at 797.  But cf. Hill v. N.Y. Post, No. 08 Civ. 5777, 2010 WL 2985906, at *3 (S.D.N.Y. July 29, 2010) (explaining that claim brought “against the unnamed BOP staff for revealing private information regarding [plaintiff] contained in his records . . . accrued . . . upon the publication of the articles describing [plaintiff’s] affair”).

Consistent with the constructive notice theory, other courts have similarly found that the statute of limitations began to run where the evidence or circumstances indicated that the plaintiff knew of the violation or had been affected by it.  See Jackson v. Shinseki, 526 F. App’x at 817 (holding that plaintiff was put “on notice of his … claim, that Defendants failed to maintain his medical records in a way to ensure the fairness of his discharge” when defendant informed him that agency did not “‘have a copy of [the] psychiatric evaluation’ from his private psychiatrist that led to his ability to return to work”); Zied, 418 F. App’x at 113-14 (ruling that plaintiff “knew of the harm caused by” alleged inaccuracies in her SSA records, at the very latest, “when her eligible child benefits were stopped”); Lockett v. Potter, 259 F. App’x 784, 787 (6th Cir. 2008) (“EEOC hearings that took place in March 2002 and April 2003, which addressed [plaintiff’s] complaints that the Postal Service’s manner of storing and disseminating his records violated the Privacy Act . . . demonstrate that he knew about the alleged Privacy Act violation more than two years before his March 2006 filing of his complaint.”); Harrell, 285 F.3d at 1293-94 (finding that the “limitations period began to run when [plaintiff] first became aware of the alleged errors in his presentence investigation reports” and that it was not “extended either by the government’s subsequent actions or by his receipt of documents allegedly corroborating his assertions of error”); Weber v. Henderson, 33 F. App’x at 612  (finding plaintiff “knew that the entire file had been lost . . . when he was informed by the defendants in writing that the record had been misplaced”); Seldowitz v. OIG of State, 238 F.3d 414, at *3 (4th Cir. 2000) (per curiam) (unpublished table case) (following Tijerina and finding that statute of limitations began to run when plaintiff “had actual knowledge of the alleged error,” even though he did not possess copy of them to make side-by-side comparison with annotated ones); Todd v. Holder, 872 F. Supp. 2d 1284, 1291 (N.D. Ala. 2012) (stating that [plaintiff] filed this action . . . approximately three and a half years after” alleged claims of wrongful disclosures to Office of Inspector General); Doe v. FDIC, No. 11 Civ. 307, 2012 WL 612461, at *5 (S.D.N.Y. Feb. 27, 2012) (dismissing claims for unlawful disclosure as time-barred where plaintiff had sent e-mail to her supervisor more than two years before filing suit in which she stated that agency had disclosed her medical information in possible violation of Privacy Act); Shearson, 865 F. Supp. 2d at 869 (concluding that “filings in [that case] demonstrate that Plaintiff should have known of alleged violations” at that time where plaintiff had submitted brief in prior case); Bailey v. Fulwood, 780 F. Supp. 2d 20, 27-28 (D.D.C. 2011) (concluding that plaintiff knew or should have known that agency had relied on a “subsequently dismissed” warrant in determining whether to grant him parole when plaintiff received “denial notice” that “specifically informed Plaintiff that [the agency’s] decision was partially based on” that warrant); Jones v. BOP, No. 5:09-cv-216, 2011 WL 554080, at *2 (S.D. Miss. Feb. 7, 2011) (reasoning that federal prisoner “must have known no later than 2006 that his [presentence investigation report] included the [disputed] charge” because “he began pursuing his administrative remedies with respect to the [report] in 2006”); Ramey v. USMS, 755 F. Supp. 2d 88, 97-98 (D.D.C. 2010) (dismissing as time-barred claim alleging violation of subsection (e)(7) “to the extent [it] encompasses the Defendant’s collection and maintenance of information regarding [contractor’s] 2003 investigation” of plaintiff, during which plaintiff was interviewed by contractor); Kursar, 751 F. Supp. 2d at 167-68 (“[P]laintiff knew, or should have known, of the purported inaccuracies by as early as April 25, 2002,” because he “received notification on April 25, 2002, that the TSA intended to terminate him for ‘submitting false or incorrect information on his employment application and Standard Form 86’” and because he “acknowledged receipt of this [notification]”); Reitz v. USDA, No. 08-4131, 2010 WL 786586, at *9, *11 (D. Kan. Mar. 4, 2010) (dismissing claims filed in 2008 because “[m]ost of the plaintiffs’ letters in the record allege continuing ill effects from [Privacy Act] violations occurring in 1997 or other dates before 2006”); Gard v. Dep’t of Educ., 691 F. Supp. 2d 93, 99 (D.D.C. 2010) (finding that plaintiff “became aware of the alleged violation” when he “expressed his belief that his . . . records had been destroyed in a declaration to the U.S. Office of Special Counsel”), summary affirmance granted per curiam, No. 11-5020, 2011 WL 2148585 (D.C. Cir. May 25, 2011); Ramirez v. DOJ, 594 F. Supp. 2d 58, 62-64 (D.D.C. 2009) (dismissing complaint filed in 2007 as time-barred because in 2004 plaintiff “notified the prosecutors, the probation officer, and the presiding judge at sentencing of inaccuracies in the [presentence investigation report]”), aff’d per curiam on other grounds, No. 10-5016, 2010 WL 4340408 (D.C. Cir. Oct. 19, 2010); Sims v. New, No. 08-cv-00794, 2009 WL 3234225, at *4 (D. Colo. Sept. 30, 2009) (concluding that clock began in April 2002 even though plaintiff did not receive letter containing inaccuracy until December 2005, where plaintiff learned of inaccuracy in April 2002 and was informed shortly thereafter that the inaccuracy was the basis for adverse determination); Joseph v. Cole, No. 5:07-CV-225, 2007 WL 2480171, at *2 (M.D. Ga. Aug. 27, 2007) (barring accuracy lawsuit where plaintiff inmate admitted that he knew of errors in his presentence report when it was adopted by court thirteen years prior to filing of suit); Ingram v. Gonzales, 501 F. Supp. 2d 180, 184-85 (D.D.C. 2007) (finding that prisoner’s claim accrued “when he discovered that the erroneous career offender finding [in his presentence report] was being used by BOP to determine his custody classification,” not at time of his sentencing); Counce v. Nicholson, No. 3:06cv00171, 2007 WL 1191013, at *14-15 (M.D. Tenn. Apr. 18, 2007) (barring subsection (b)/(g)(1)(D) claim where plaintiff first complained of Privacy Act violations to EEO counselor in November 2003 but did not file suit until February 2006); Kenney v. Barnhart, No. 05-426, 2006 WL 2092607, at *11-12 (C.D. Cal. July 26, 2006) (finding claim untimely because plaintiff filed it more than two years after he complained to SSA of inaccuracies in his credit reports, which were allegedly based on inaccuracies in SSA records); Peterson v. Tomaselli, No. 02 Civ. 6325, 2003 WL 22213125, at *8 (S.D.N.Y. Sept. 29, 2003) (finding that plaintiff’s claim arose when he “knew that the false documents existed”); Fort Hall Landowners All., Inc., No. 99-052, slip op. at 5 (finding that plaintiffs’ “claim accrued as soon as Plaintiffs either were aware, or should have been aware, of the existence of and source of injury, not when the Plaintiffs knew or should have known that the injury constituted a legal wrong”); Farrero, 180 F. Supp. 2d at 97 (finding that plaintiff should have known of potential violation when agency specifically informed him that it was maintaining certain documents regarding his alleged misconduct); Walker v. Ashcroft, No. 99-2385, 2001 U.S. Dist. LEXIS 27213, at *17 (D.D.C. Apr. 30, 2001) (“Contrary to Plaintiffs’ contention, the record establishes that Plaintiffs were aware of the FBI’s actions well before they received this report.”), summary affirmance granted per curiam, No. 01-5222, 2002 U.S. App. LEXIS 2485 (D.C. Cir. Jan. 25, 2002); Villescas v. Richardson, 124 F. Supp. 2d 647, 659 (D. Colo. 2000) (finding the statute of limitations began to run when plaintiff received declaration in another lawsuit describing disclosure of records, even though he did not receive actual documents); Armstrong v. BOP, 976 F. Supp. 17, 21-22 (D.D.C. 1997) (following Tijerina and finding plaintiff’s claim barred by statute of limitations where plaintiff had written letter more than two and one-half years earlier indicating that her prison file was lacking favorable information), summary affirmance granted per curiam, No. 97-5208, 1998 WL 65543 (D.C. Cir. Jan. 30. 1998); Nwangoro v. Army, 952 F. Supp. 394, 397-98 (N.D. Tex. 1996) (“[T]he limitations period commences not when the plaintiff first obtains possession of the particular records at issue, but rather when he first knew of their existence.”); Brown v. VA, No. 94-1119, 1996 WL 263636, at *1-2 (D.D.C. May 15, 1996) (holding Privacy Act claim barred by statute of limitations because plaintiff “knew or should have known that the Privacy Act may have been violated” when he submitted federal tort claim to VA concerning same matter “over two and a half years” before suit filed); Gordon v. DOJ, No. 94-2636, 1995 WL 472360, at *2 (D.D.C. Aug. 3, 1995) (finding statute of limitations ran from time of plaintiff’s receipt of letter from sentencing judge rejecting information contained in presentencing report, at which point plaintiff “knew or . . . should have known what became inaccuracies in his presentencing report”); Rice v. Quinlan, No. 94-1519, slip op. at 2-3 & n.1 (D.D.C. Dec. 30, 1994) (holding plaintiff knew of contents of presentence report at time he filed “Objection to Presentence Investigation Report,” at which time statute of limitations began to run), summary affirmance granted per curiam sub nom. Rice v. Hawk, No. 95-5027, 1995 WL 551148 (D.C. Cir. Aug. 2, 1995); Szymanski, 870 F. Supp. at 378-79 (citing Bergman and Tijerina, and stating that “[b]ecause plaintiff was given the opportunity to review the documents he now maintains contain incorrect information and waived that opportunity, the Court finds that he should have known about any errors at the time of this waiver” but that, additionally, plaintiff had complained about same information in his appeal to Parole Commission more than two years previously); Malewich v. USPS, No. 91-4871, slip op. at 21-22 (D.N.J. Apr. 14, 1993) (finding statute began to run when plaintiff was aware that file was being used in investigation of plaintiff and when he was notified of proposed termination of employment), aff’d, 27 F.3d 557 (3d Cir. 1994) (unpublished table decision); Mangino, 818 F. Supp. at 1437-38 (applying Bergman, Bowyer, and Diliberti, and finding that cause of action accrued on date of letter in which plaintiff indicated knowledge of records being used by agency as basis for revoking his security clearance, rather than upon his receipt of records); Ertell v. Army, 626 F. Supp. 903, 908 (C.D. Ill. 1986) (finding limitations period commenced when plaintiff “knew . . . that there had been negative evaluations in his file which ‘may explain why he is not being selected;’” rather than upon actual discovery of such records); cf. Doe v. NSA, No. 97-2650, 1998 WL 743665, at *1-3 (4th Cir. Oct. 23, 1998) (per curiam) (citing Rose and Diliberti, and holding that appellant’s wrongful disclosure claim was time-barred because in accordance with principles of agency law, Privacy Act action accrued from time her attorney received her records).

Some courts, however, have construed the beginning of the statute of limitations period from other points, including when an individual discovers the inaccuracy or mishandling of the record, receives a Privacy Act notice, or becomes aware that an apparently untimely complaint “relates back” to a timely one.

In contrast to the constructive notice theory adopted by many courts, some courts have suggested that the limitations period for a subsection (g)(1)(C) damages action would commence when a plaintiff actually receives his record – i.e., when he actually discovers the inaccuracy.  See Akutowicz v. United States, 859 F.2d 1122, 1126 (2d Cir. 1988) (noting that “the latest possible time before which [plaintiff] could commence his suit was . . . two years after his discovery of the alleged misrepresentation in his record (i.e., the date when he received a copy of his record from the Department of State”)); see also Rose v. United States, 905 F.2d 1257, 1259 (9th Cir. 1990) (holding that subsection (g)(1)(C) action accrued when plaintiff “became aware of the alleged mishandling of her records on . . . the date she received copy of her compensation file”); Lepkowski v. Treasury, 804 F.2d 1310, 1322-23 (D.C. Cir. 1986) (Robinson, J., concurring) (holding that subsection (g)(1)(C) action “accrued no later than the date upon which [plaintiff] received IRS’ letter . . . apprising him of destruction of the photographs and associated workpapers”); Middlebrooks v. Mabus, No. 1:11cv46, 2011 WL 4478686, at *4-5 (E.D. Va. Sept. 23, 2011) (finding that plaintiff “first learned of the alleged inaccuracies in her personnel record on . . . the date she received the Notice of her termination,” which “contained extensive factual recitals of the specific grounds for plaintiff’s termination”); Ciralsky v. CIA, 689 F. Supp. 2d 141, 158 (D.D.C. 2010) (concluding that statute of limitations “was triggered . . . when the CIA passed the [memorandum] and investigative file to Plaintiff” where claim was “based in whole or in part on the information contained in those documents”); Off v. U.S. Gov’ts, No. 2:09-CV-01525, 2010 WL 3862097, at *3 (D. Nev. Sept. 27, 2010) (“Because Plaintiff attached the SF-50 to at least one of the complaints he filed on November 12, 1998, Plaintiff knew or had reason to know of the allegedly incorrect SF-50 at that time.”), aff’d 472 F. App’x 789 (9th Cir. 2012); Brooks v. BOP, No. 04-0055, 2005 WL 623229, at *2 (D.D.C. Mar. 17, 2005) (barring claim where plaintiff inmate “has known of incorrect information in BOP records pertaining to him” since he received response from regional director, which “incorrectly stated that plaintiff had been found to have committed the more serious offense,” but plaintiff did not file suit until four years later); Harry v. USPS, 867 F. Supp. 1199, 1205 (M.D. Pa. 1994) (finding that although exact date when plaintiff should have known about alleged improper file maintenance was unclear, date of actual discovery was “sterling clear” – when plaintiff physically reviewed his files), aff’d, 60 F.3d 815 (3d Cir. 1995) (unpublished table decision); Shannon, 812 F. Supp. at 319-20 (finding causes of action arose when plaintiff learned of wrongs allegedly committed against him which was when he received documents that were allegedly inaccurate or wrongfully maintained); cf. Steele v. Cochran, No. 95-35373, 1996 WL 285651, at *1 (9th Cir. May 29, 1996) (citing Rose and holding that Privacy Act claim filed in 1994 was time-barred because plaintiff wrote letter to agency questioning validity of information disclosed to State Bar in 1991 and was formally informed by State Bar that he was denied admission in 1991).

One district court decision has also considered the statute of limitations in connection with a Privacy Act claim under subsection (e)(3) concerning the collection of information from individuals.  Darby v. Jensen, No. 94-S-569, 1995 U.S. Dist. LEXIS 7007, at *7-8 (D. Colo. May 15, 1995), aff’d 78 F.3d 597 (10th Cir. 1996) (unpublished table decision).  In that case, the court determined that the claim was time-barred, as more than two years had passed since the date upon which the plaintiff had received the request for information.  Id.

Several courts have considered whether a Privacy Act claim not apparently raised in the initial complaint filed within the limitations period could be found to “relate back” to the date of that earlier complaint under Rule 15(c) of the Federal Rules of Civil Procedure.  See Oja v. Army Corps of Eng’rs, 440 F.3d 1122, 1134-35 (9th Cir. 2006) (holding that amended complaint did not relate back to filing date of initial complaint because “[t]he fact that the language in the two disclosures is identical is inapposite because [plaintiff’s] claims . . . are based on the acts of disclosure themselves, each of which is distinct in time and place” where agency posted information pertaining to plaintiff on website in November 2000 and posted same information on second website in December 2000); Freeman v. EPA, No. 02-0387, 2004 WL 2451409, at *8-9 (D.D.C. Oct. 25, 2004) (concluding that even though “the new claim is similar in that it also involves disclosure of information . . . it is hardly conceivable that the defendants would have had notice regarding the new” claim, nor “does the new claim build on facts the plaintiffs previously alleged other than the very general factual context of the case,” and therefore, the claim fails to relate back); Fort Hall Landowners All., Inc., No. 99-052, slip op. at 13-15 (finding that Privacy Act wrongful disclosure claims first brought in amended and second amended complaints related back to original complaint); Tripp v. DOD, 219 F. Supp. 2d 85, 91-92 (D.D.C. 2002) (holding that plaintiff’s subsequent Privacy Act accounting claim was not barred by two-year statute of limitations because claim arose “out of the same conduct and occurrences alleged in the initial Complaint,” which dealt with improper disclosures of Privacy Act-protected records); cf. Yee v. Solis, No. C 08-4259, 2009 WL 5064980, at *2 (N.D. Cal. Dec. 23, 2009) (rejecting argument that motion for leave to amend complaint to add Privacy Act claim “should be denied because the proposed claim does not ‘relate [ ] back’ to plaintiff’s original claims” on ground that defendant “does not contend, let alone demonstrate, such additional claim is, in the absence of relation back, time-barred”), aff’d on other grounds, 472 F. App’x 471 (9th Cir. 2012).

 

d. Equitable Tolling of and Exceptions to Statute of Limitations

Equitable tolling applies in damages claims.

As discussed above, the D.C. Circuit has held that the rebuttable presumption in favor of equitable tolling that was established in Irwin applies to the Privacy Act’s statute of limitations for a damages claim for unlawful disclosure.  Chung v. DOJ, 333 F.3d 273, 276-77 (D.C. Cir. 2003).  Further, because the D.C. Circuit could find no reason to think that Congress did not intend to equitably toll the Privacy Act’s statute of limitations, it held that the government did not overcome this presumption.  Id. at 278.

For other cases involving equitable tolling, see Hammoud v. U.S. Att’y, No. 14-14398, 2015 WL 4756582, at *5 (E.D. Mich. Aug. 12, 2015 (holding equitable tolling not appropriate when statute of limitations ran in 2009 and plaintiff’s equitable tolling argument was based on attempts to contact agencies no earlier than 2012); Grethen v. Clarke, No. 2:13cv416, 2015 WL 3452020, at *2 (E.D. Va. March 13, 2015) (finding that plaintiff’s Privacy Act claim should not be tolled because pendency of plaintiff’s habeas action did not impact plaintiff’s Privacy Act claim); Boyd, 932 F. Supp. 2d at 838-840 (stating Sixth Circuit’s five factors for determining whether equitable tolling applies: “(1) lack of notice of the filing requirement; (2) lack of constructive knowledge of the filing requirement; (3) diligence in pursuing one’s rights; (4) absence of prejudice to the defendant; and (5) the plaintiff’s reasonableness in remaining ignorant of the particular legal requirement”; finding “[t]here is no question that [plaintiff’s] claim in this Court was brought outside the Privacy Act statute of limitations.  Since the Court finds four of the five equitable tolling factors favor equitable tolling . . . and that the fifth does not weigh significantly against it, [plaintiff’s] suit is not barred by the statute of limitations”); Padilla-Ruiz v. United States, 893 F. Supp. 2d 301, 306-09 (D.P.R. 2012) (finding equitable tolling “not a proper remedy to be employed in this case” as plaintiff “makes no connection . . .  between his request of documents and the requirement that he needed to file suit [within time period]”), aff’d in part, vacated in part, & remanded on other grounds, 593 F. App’x 1 (5th Cir. 2015); Doe v. Winter, No. 1:04-CV-2170, 2007 WL 1074206, at *10-11 (M.D. Pa. Apr. 5, 2007) (noting that equitable tolling doctrine has been recognized by Third Circuit but finding that plaintiff failed to provide evidence for its application); Cannon-Harper v. U.S. Postmaster Gen., No. 06-10520, 2006 WL 2975492, at *1 (E.D. Mich. Oct. 17, 2006) (declining to apply equitable tolling to statute of limitations for subsection (b)/(g)(1)(C) claim where plaintiff had initially filed claim in state court); Cooper v. BOP, No. 02-1844, 2006 WL 751341, at *3 (D.D.C. Mar. 23, 2006) (applying equitable tolling where court had sealed inmate’s presentence report because he “was unable to obtain vital information on the existence of his claim until he could review the [report]”); Freeman v. EPA, 2004 WL 2451409, at *9 (concluding that plaintiffs’ argument that they needed additional discovery to support their claim was “insufficient justification for this court to countenance any equitable adjustment to the statute of limitations”); Fort Hall Landowners All., Inc., No. 99-052, slip op. at 7 (holding that statute of limitations was not tolled based on facts before court). 

An exception to the two-year statute of limitations rule occurs when there is a material and willful misrepresentation by an agency.

In addition, the statute’s own terms provide an exception to the requirement that an action be brought within two years from when the cause of action arose.  5 U.S.C. § 552a(g)(5).  When an agency materially and willfully misrepresents information required by the statute to be disclosed to an individual, and the information so represented is material to establishing the liability of the agency, then the limitations period runs from the date upon which the plaintiff discovers the misrepresentation.  Id.; see also Ciralsky, 689 F. Supp. 2d at 154 (finding where plaintiff argued that “by allegedly denying [the plaintiff’s] request . . . for pertinent information confirming his suspicion . . . the CIA committed a material and willful misrepresentation of information required to be disclosed to Plaintiff and material to establishing the liability of the Agency to him.  . . .  Taking the factual allegations of the complaint as true, such misrepresentation delays the start of the limitations period.”); Lacey v. United States, 74 F. Supp. 2d 13, 15-16 (D.D.C. 1999) (concluding that defendants made material and willful misrepresentations to plaintiffs by telling them that they lacked evidence and should wait for agency to finish its own investigation of claim before bringing suit, which tolled statute of limitations until agency “confirmed that there was substance to plaintiffs’ claim of violations”); Burkins, 865 F. Supp. at 1496 (“Accepting Plaintiff’s claims of agency misrepresentation as true, the statute may have been tolled.”); Pope v. Bond, 641 F. Supp. 489, 500 (D.D.C. 1986) (holding that FAA’s actions constituted willful and material representation because of its repeated denials of plaintiff’s request for access, which “prevents the statute of limitations from running until the misrepresentation is discovered”); cf. Sabatini v. Price, No. 17-cv-01597, 2018 WL 1638258, at *4 (S.D. Cal. April 5, 2018) (finding no “exceptional circumstances” existed for exception for material and willful misrepresentations), aff’d sub nom. Sabatini v. Azar, 749 F. App’x 588 (9th Cir. 2019); United States v. Swecker, No. 4:09-cv-00013, 2015 WL 13309238, at *3-4 (S.D. Iowa Dec. 15, 2015) (finding defendants’ counterclaims of material and willful misrepresentation were undermined by the fact that the record contains forms signed by one of the defendants, and such defendant “cannot now claim that [she] was uninformed, or misled, about her Privacy Act Rights, when the form containing a statement of the agency's Privacy Act policy was signed by [her] three separate times”); Weber, 33 F. App’x at 612 (finding that even if court were to consider claim not properly raised on appeal, “[t]here is no evidence in the record to show that the failure to disclose [a memorandum that plaintiff claims would have avoided much of the pending litigation] was the result of willful misrepresentation”); Boyd, 932 F. Supp. 2d at 836 (“Even accepting. . . that [agency] did ‘willfully and materially misrepresent’ facts regarding the statute of limitations for [plaintiff’s] Privacy Act claim, such a claim remains outside the Privacy Act’s statute of limitations exception”; “In order for the exception to apply, the undisclosed information must be material to the establishment of liability under the Act.”); Sims v. New, 2009 WL 3234225, at *4-5 (concluding that “[e]ven if Defendants concealed the actual contents of the [letter at issue] from Plaintiffs [for more than three years], Defendants did not fraudulently conceal the facts giving rise to Plaintiffs’ claims” because plaintiff knew of inaccuracy contained in letter when he requested it); Leibenguth, 2009 WL 3165846, at *3 (“Because the alleged misrepresentation was made with respect to when a rehearing would be held, and did not pertain to information required to be disclosed under the Privacy Act, plaintiffs have failed to establish that the alternative statute of limitations period applies.”); Mudd v. Army, No. 2:05-cv-137, 2007 WL 4358262, at *7 (M.D. Fla. Dec. 10, 2007) (concluding that plaintiff failed to establish that “information allegedly undermining the accuracy of the [record] was materially and willfully misrepresented by the [agency], or that it was information required under the Privacy Act to be disclosed to plaintiff, or that the allegedly misrepresented information was material to establishment of the liability”); Doe v. Thompson, 332 F. Supp. 2d 124, 134 (D.D.C. 2004) (finding no material and willful misrepresentation where agency “notified the plaintiff about the record and its contents . . . when the record was first created” and “changed the record twice [at plaintiff’s request] in an effort to produce an accurate record”); Marin v. DOD, No. 95-2175, 1998 WL 779101, at *1-2 (D.D.C. Oct. 23, 1998) (denying defendants’ motion to dismiss on ground that claim was time-barred and accepting plaintiff’s claim regarding timing of agency misrepresentation), summary affirmance granted, No. 99-5102, 1999 WL 1006404 (D.C. Cir. Oct. 8, 1999) (per curiam); Munson, No. 96-CV-70920-DT, slip op. at 4-5 (E.D. Mich. July 2, 1996) (finding statement that agency could find no record of disclosure of report to state police but that it would check further “does not provide any evidence of a willful and material misrepresentation”).

Note that the Seventh Circuit has stated that this special relief provision is necessarily incorporated into tests, such as the one set forth in Bergman, which focus on when a plaintiff first knew or had reason to know of an error in maintaining the plaintiff’s records.  Diliberti, 817 F.2d at 1262 n.1; see also Malewich, No. 91-4871, slip op. at 25-27 (D.N.J. Apr. 14, 1993) (following Diliberti and precluding “the plaintiff from utilizing the discovery rule as a basis for extending the permissible filing date”).  The government argued to the D.C. Circuit in Tijerina v. Walters that subsection (g)(5) “makes sense only if Congress intended the normal statutory period to commence at the time of the alleged violation, regardless of whether the potential plaintiff is or should be aware of the agency’s action.”  See 821 F.2d at 797-98.  The D.C. Circuit, however, rejected that argument and stated:

Id. at 798. 

Continuing violations generally do not toll the statute of limitations period.

Additionally, it has been held that “[a] Privacy Act claim is not tolled by continuing violations.”  Davis v. DOJ, 204 F.3d 723, 726 (7th Cir. 2000); see also Bowyer, 875 F.2d at 638 (citing Bergman and Diliberti, and rejecting argument that continuing violation doctrine should toll statute of limitations); Diliberti, 817 F.2d at 1264 (citing Bergman for same proposition); Bergman, 751 F.2d at 316-17 (ruling that limitations period commenced when agency first notified plaintiff in writing that it would not reconsider his discharge or correct his job classification records and rejecting argument “that a new cause of action arose upon each and every subsequent adverse determination based on erroneous records”); Reitz, 2010 WL 786586, at *9-10 (dismissing as time-barred claims filed in 2008 “alleg[ing] continuing ill effects from violations occurring in 1997 or other dates before 2006” because “[a] new cause of action does not arise ‘upon each and every subsequent adverse determination based on erroneous records’” (quoting Harrell, 285 F.3d at 1293)); Blaylock v. Snow, No. 4:06-CV-142-A, 2006 WL 3751308, at *7 (N.D. Tex. Dec. 21, 2006) (ruling that “continuing violations do not toll the limitations period” in case involving several allegedly improper disclosures over course of three years); Thompson, 332 F. Supp. 2d at 132-33 (rejecting argument that “a new cause of action was created each time [the agency] disseminated [plaintiff’s] revised Report after [the agency] had been placed on notice of a potential problem and before it reviewed the revised Report for accuracy, relevance, completeness, and timeliness”); Jarrett v. White, No. 01-800, 2002 WL 1348304, at *6 (D. Del. June 17, 2002) (rejecting argument that continuing violation doctrine should toll statute of limitations), aff’d per curiam sub nom. Jarrett v. Brownlee, 80 F. App’x 107 (Fed. Cir. 2003); Malewich, No. 91-4871, slip op. at 23-25 (D.N.J. Apr. 14, 1993) (same); Shannon, 812 F. Supp. at 319-20 (stating that plaintiff “cannot revive a potential cause of action simply because the violation continued to occur; he can allege subsequent violations only if there are subsequent events that occurred in violation of the Privacy Act”); cf. Baker v. United States, 943 F. Supp. 270, 273 (W.D.N.Y. 1996) (citing Shannon with approval).  But cf. Burkins v. United States, 865 F. Supp. 1480, 1496 (D. Colo. 1994) (citing Bergman and viewing plaintiff’s harm as “continuing transaction”).

The Court of Appeals for the Ninth Circuit, in Oja v. Army Corps of Engineers, applied the single publication rule in a case involving a subsection (b) claim based on multiple postings to two agency websites of information pertaining to the plaintiff.  440 F.3d at 1130-33.  Under that rule, “the aggregate communication can give rise to only one cause of action . . . and result in only one statute of limitations period that runs from the point at which the original dissemination occurred.”  Id. at 1130.  The court rejected the argument that “the continuous hosting of private information on an Internet website [is] a series of discrete and ongoing acts of publication, each giving rise to a cause of action with its own statute of limitations.”  Id. at 1132.  Instead, the court held that the claim was time-barred because the plaintiff filed it more than two years from when plaintiff became aware of the first posting.  Id. at 1133.

Moreover, a plaintiff’s voluntary pursuit of administrative procedures should not toll the running of the statute of limitations, because no administrative exhaustion requirement exists before a damages action can be brought.  See Uhl v. Swanstrom, 876 F. Supp. 1545, 1560-61 (N.D. Iowa 1995), aff’d on other grounds, 79 F.3d 751 (8th Cir. 1996); see also Majied v. United States, No. 7:05CV00077, 2007 WL 1170628, at *3 (W.D. Va. Apr. 18, 2007); Molzen v. BOP, No. 05-2360, 2007 WL 779059, at *3 (D.D.C. Mar. 8, 2007); Mitchell v. BOP, No. 05-0443, 2005 WL 3275803, at *3 (D.D.C. Sept. 30, 2005); cf. Kursar, 751 F. Supp. 2d at 168-69 (holding that statute of limitations was not tolled by MSPB litigation regarding plaintiff’s termination); Christensen v. Interior, 109 F. App’x 373, 375 (10th Cir. 2004) (“[T]here is no basis for tolling the limitations period while Plaintiff pursued his administrative claim [under the Federal Tort Claims Act], because there is no administrative exhaustion requirement when a plaintiff seeks damages under the Privacy Act.”); Grethen v. Clarke, No. 2:13cv416, 2015 WL 3452020, at *2 (E.D. Va. Mar. 13, 2015) (dismissing Privacy Act claims as time-barred, noting that “pendency of the habeas action does not impact Plaintiff’s claims under the Privacy Act”).

Finally, one district court has applied a provision of the Servicemembers Civil Relief Act to toll the statute of limitations for a Privacy Act claim brought by an active duty member of the U.S. Marine Corps.  See Baker v. England, 397 F. Supp. 2d 18, 23-24 (D.D.C. 2005), aff’d on other grounds, 210 F. App’x 16 (D.C. Cir. 2006).  Under that statute, “[t]he period of a servicemember’s military service may not be included in computing any period limited by law, regulation, or order for the bringing of any action or proceeding in a court.”  50 U.S.C. § 3936 (formerly codified at 50 U.S.C. app. § 526(a)).

 

4. Jury Trial

There is no right to a jury trial under the Privacy Act.

Generally, the Seventh Amendment does not grant a plaintiff the right to trial by jury in actions against the federal government.  U.S. Const. amend. VII.  Under sovereign immunity principles, “the United States, as sovereign, ‘is immune from suit save as it consents to be sued … and the terms of its consent to be sued in any court define that court’s jurisdiction to entertain the suit.’”  Lehman v. Nakshian, 453 U.S. 156, 160 (1981) (citations omitted).  Further, a plaintiff has a right to a jury trial only when the right has been “unequivocally expressed” by Congress.  Id. 

The Privacy Act is silent on the right to a jury trial and, therefore, there is no right to a jury trial under the statute.  Every court to have considered the issue has ruled accordingly.  See e.g., Payne v. EEOC, No. 00-2021, 2000 WL 1862659, at *2 (10th Cir. Dec. 20, 2000) (holding that Privacy Act authorizes suit only against agencies, and even where United States “consents,” general rule is that Seventh Amendment does not grant plaintiff right to trial by jury); Harris v. USDA, No. 96-5783, 1997 WL 528498, at *3 (6th Cir. Aug. 26, 1997) (same); Buckles v. Indian Health Serv./Belcourt Serv. Unit, 268 F. Supp. 2d 1101, 1102-03 (D.N.D. 2003) (neither Privacy Act nor Freedom of Information Act permit suits against individuals and any tort claims against them are deemed actions against United States, and neither of these statutes provide right to jury trial); Stewart v. FBI, No. 97-1595, 1999 U.S. Dist. LEXIS 18773, at *7-9 (D. Or. Sept. 29, 1999) (plaintiff not entitled to jury trial on Privacy Act claims because “Privacy Act nowhere mentions the word ‘jury’”) (magistrate’s recommendation), adopted, No. 97-1595, 1999 U.S. Dist. LEXIS 18785 (D. Or. Nov. 24, 1999); Clarkson v. IRS, No. 8:88-3036-3K, 1990 U.S. Dist. LEXIS 6887, at *10  (D.S.C. May 10, 1990) (denying plaintiff’s demand for jury trial, “[u]nder settled principles of sovereign immunity,” plaintiff has this right only where Congress expressly grants it by statute), aff’d, 935 F.2d 1285 (4th Cir. 1991) (unpublished table decision); Calhoun v. Wells, No. 79-2337-2, 1980 WL 1638, at *1 n.2 (D.S.C. July 30, 1980) (considering request for damages under Privacy Act as “nonjury matters,” following district court’s order striking demand for jury trial, as “no such right exists under the Privacy Act”); Henson v. Army, No. 76-45-C5, 1977 U.S. Dist. LEXIS 16868, at *1 (D. Kan. Mar. 16, 1977) (agreeing with defendants that Privacy Act does not explicitly provide for jury trial and finding no such legislative intent).  But cf. Tomasello v. Rubin, No. 93-1326, slip op. at 3-5, 19 (D.D.C. Aug. 19, 1997) (noting that court was “guided by” advisory jury verdict in awarding Privacy Act damages in case also involving non-Privacy Act claims), aff’d, 167 F.3d 612, 616-17 (D.C. Cir. 1999) (recounting fact of advisory jury verdict as to Privacy Act claims). 

 

Next Section: Criminal Penalties