The general rule under the Privacy Act is that an agency cannot disclose a record contained in a system of records unless the individual to whom the record pertains gives prior written consent to the disclosure. There are twelve exceptions to this general rule.
“No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains [subject to 12 exceptions].” 5 U.S.C. § 552a(b).
Under the Privacy Act’s disclosure provision, agencies generally are prohibited from disclosing records by any means of communication – written, oral, electronic, or mechanical – without the written consent of the individual, subject to twelve exceptions.
Federal officials handling personal information are “bound by the Privacy Act not to disclose any personal information and to take certain precautions to keep personal information confidential.” Big Ridge, Inc. v. Fed. Mine Safety & Health Review Comm’n, 715 F.3d 631, 650 (7th Cir. 2013); see also, e.g., Navy, Navy Exch., Naval Training Station, Naval Hosp. v. FLRA, 975 F.2d 348, 350 (7th Cir. 1992) (noting that “Privacy Act generally prohibits the federal government from disclosing personal information about an individual without the individual’s consent”).
A “disclosure” can be by any means of communication – written, oral, electronic, or mechanical. See OMB 1975 Guidelines, 40 Fed. Reg. at 28,953, Bartel v. FAA, 725 F.2d 1403, 1409 (D.C. Cir. 1984) (concluding that “an absolute policy of limiting the Act’s coverage to information physically retrieved from a record would make little sense in terms of its underlying purpose” and that Privacy Act “forbids nonconsensual disclosure of records “by any means of communication”); see also, e.g., Speaker v. HHS Ctrs. for Disease Control & Prevention, 623 F.3d 1371, 1382 n.11 (11th Cir. 2010) (“Numerous courts have held that the Privacy Act protects against improper oral disclosures.”); Jacobs v. Nat’l Drug Intelligence Ctr., 423 F.3d 512, 517-19 (5th Cir. 2005) (rejecting argument that “the [Privacy Act] only protects against the disclosure of a physical document that is contained in a system of records,” and holding that “damaging information . . . taken from a protected record and inserted into a new document, which was then disclosed without the plaintiff’s consent,” violated subsection (b) because “the new document is also a protected record”); Orekoya v. Mooney, 330 F.3d 1, 6 (1st Cir. 2003) (“The Privacy Act prohibits more than dissemination of records themselves, but also ‘nonconsensual disclosure of any information that has been retrieved from a protected record’” (quoting Bartel v. FAA, 725 F.2d at 1408)); Boyd v. United States, 932 F. Supp. 2d 830, 835 (S.D. Ohio 2013) (“[w]hile the term ‘disclosure’ is not defined by the statute, it has been interpreted broadly”); Cloonan v. Holder, 768 F. Supp. 2d. 154, 163 (D.D.C. 2011) (citing Bartel, 725 F.2d at 1408); Chang v. Navy, 314 F. Supp. 2d 35, 41 n.2 (D.D.C. 2004) (citing Bartel, 725 F.2d at 1408).
OMB guidelines, and some, but not all, courts have advised that disclosures can occur by either transferring a record or simply “granting access” to a record.
Further, a disclosure under the Privacy Act “may be either the transfer of a record or the granting of access to a record.” OMB 1975 Guidelines, 40 Fed. Reg. at 28953 (July 9, 1975), see also Wilkerson v. Shinseki, 606 F.3d 1256, 1268 (10th Cir. 2010) (interpreting disclosure under the Privacy Act “liberally to include not only the physical disclosure of the records, but also the accessing of private records”). Regarding actionability, however, the United States Court of Appeals for the District of Columbia Circuit has required that a record actually be retrieved. Armstrong v. Geithner, 608 F.3d 854, 857 (D.C. Cir. 2010) (quoting Bartel, 725 F.2d at 1408, and holding that, to be actionable, “a disclosure generally must be the result of someone having actually retrieved the ‘record’ from that ‘system of records’; the disclosure of information is not ordinarily a violation ‘merely because the information happens to be contained in the records’”); Lambert v. United States, No. 3:15-CV-147-PLR-HBG, 2016 WL 632461, at *4-5 (E.D. Tenn. Feb. 17, 2016). But see Atkins v. Mabus, No. 12CV1390-GPC, 2014 WL 2705204, at *4-8 (S.D. Cal. June 13, 2014) (holding unauthorized access not actionable under Privacy Act, even though plaintiff’s declaration provided support for conclusion that defendant’s employees individually improperly accessed plaintiff’s private medical data); Cacho v. Chertoff, No. 06-00292(ESH), 2006 WL 3422548, at *5 (D.D.C. Nov. 28, 2006) (“[A] plaintiff cannot establish a prima facie claim under the Privacy Act simply by showing that the agency official who disclosed a protected record should never have accessed the record in the first place.”); Smith v. VA, No. CIV-06-865-R, 2007 WL 9711018 (W.D. Okla. Sept. 12, 2007) (dismissing claim of improper disclosure under subsection (b) in spite of evidence suggesting agency’s employee had unauthorized access to plaintiff’s personnel file, because agency had complied with all safeguards of Privacy Act, and had not acted intentionally or willfully to disclose, defined as “to ‘open up,’ ‘to expose to view,’ or ‘to make known, . . . especially to reveal in words’” (citations omitted)).
A disclosure of information from a non-record source does not violate the Privacy Act’s disclosure provision.
The disclosure of information “acquired from non-record sources – such as observation, office emails, discussions with co-workers and the ‘rumor mill’– does not violate the Privacy Act . . . even if the information disclosed is also contained in agency records.” Lambert v. United States at *5 (quoting Cloonan, 768 F. Supp. 2d. at 164); Thompson v. BOP, No. 1:10-CV-00578-JOF, 2012 WL 13072105, at *5 (N.D. Ga. Jan. 20, 2012) (For “a disclosure to be covered by section 552a(b), there must have initially been a retrieval from the system of records which was at some point a source of the information.” (citations omitted)); Savage v. Geren, No. CV-08-S-2189-NE, 2010 WL 11519448, at *13 (N.D. Ala. Nov. 15, 2010) (“[T]he Privacy Act does not prohibit disclosure of information or knowledge obtained from other sources other than ‘records.’. In particular, it does not prevent federal employees or officials from talking – even gossiping – about anything of which they have non-record-based knowledge.” (citations omitted)).
For further discussion of the meaning of “disclosure” of records, see the “Definitions, Systems of Records and Disclosures under Subsection (b)” section above.
In one case in which a plaintiff sought relief for alleged wrongful disclosure of items seized during the execution of a search warrant, the court found, “Appellant has failed to show that evidence seized during a search conducted in a criminal investigation constitutes records that are “contained in a system of records” under the Privacy Act. Matter of Search of 2122 21st Rd. N. Arlington, Virginia, No. 1:17-CR-00236, 2018 WL 534161, at *4 (E.D. Va. Jan. 23, 2018), aff’d sub nom. U.S. v. Search of 2122 21st Rd. N. Arlington, Virginia, 735 F. App’x 66 (4th Cir. 2018). Id. at *4.
Plaintiffs maintain the burden of demonstrating that a disclosure by an agency occurred.
A plaintiff has the burden of demonstrating that a “disclosure” by the agency has occurred. See, e.g., Askew v. United States, 680 F.2d 1206, 1209-11 (8th Cir. 1982); Zerilli v. Smith, 656 F.2d 705, 715-16 (D.C. Cir. 1981); Boyd v. United States, 932 F. Supp. 2d 830, 835 (S.D. Ohio 2013); cf. Hernandez v. Johnson, 514 F. App’x 492, 500 (5th Cir. 2013) (holding that “disclosure is not actionable because it identified [plaintiff] only by his first name and neither recipient knew who ‘Jaime’ was”); Luster v. Vilsack, 667 F.3d 1089, 1097-98 (10th Cir. 2011) (rejecting appellant’s contentions that “mere transmission of the documents to a fax machine at which unauthorized persons might have viewed the documents constitutes a prohibited disclosure” and that “the possibility that a record might be revealed to unauthorized readers by negligent or reckless transmission is sufficient to constitute a prohibited disclosure under the Act’”); Whyde v. Rockwell Int’l Corp., 101 F. App’x 997, 1000 (6th Cir. 2004) (“[T]he fact that [a company] somehow came into possession of documents that might have been included in plaintiff’s personnel file . . . gives rise only to a metaphysical doubt as to the existence of a genuine issue of material fact.”); Brown v. Snow, 94 F. App’x 369, 372 (7th Cir. 2004) (ruling that district court grant of summary judgment was proper where no evidence was found that record was disclosed, and stating that “burden is on the plaintiff at the summary judgment stage to come forward with specific evidence”); Lennon v. Rubin, 166 F.3d 6, 10-11 (1st Cir. 1999) (where agency employee testified that, despite memorandum indicating otherwise, she had disclosed information only within agency, and where plaintiff responded that whether his file was reviewed by other individuals is question of fact he “want[ed] decided by a fact finder, ‘not an affidavit,’” finding such “arguments misapprehend [plaintiff’s] burden at the summary judgment stage”); Russell v. Potter, No. 3:08-CV-2272, 2011 WL 1375165, at *9 (N.D. Tex. Mar. 4, 2011) (holding that plaintiff cannot prove disclosure violation where “the only agency involved, the Postal Service, received rather than ‘disclosed’ the information in question”); Collins v. FBI, No. 10-cv-03470, 2011 WL 1627025, at *7 (D.N.J. Apr. 28, 2011) (dismissing claim and stating that plaintiff’s “conclusory allegations” of unlawful disclosure, “without identifying or describing who acted against Plaintiff or what the person did, is insufficient”); Roggio v. FBI, No. 08-4991, 2009 WL 2460780, at *2 (D.N.J. Aug. 11, 2009) (concluding that plaintiffs “fail[ed] to allege sufficient facts supporting that the FBI, as opposed to some other law enforcement body, disclosed [one plaintiff’s] rap sheet” on the Internet, where plaintiffs “base[d] their allegation on . . . the mere fact that [a particular Internet] posting contained some expunged information”), reconsideration denied, No. 08-4991, 2009 WL 2634631 (D.N.J. Aug. 26, 2009); Walia v. Chertoff, No. 06-cv-6587, 2008 WL 5246014, at *11 (E.D.N.Y. Dec. 17, 2008) (concluding that plaintiff failed to make out prima facie case under subsection (b) of Privacy Act because plaintiff alleged merely that records were accessible to other individuals in office, rather than that they were actually disclosed); Buckles v. Indian Health Serv., 310 F. Supp. 2d 1060, 1068 (D.N.D. 2004) (finding that plaintiffs failed to “prove, by a preponderance of the evidence, that IHS disclosed protected information” where plaintiffs did not “have personal knowledge that [the memorandum was disclosed]” and witnesses at trial denied disclosing or receiving memorandum); Meldrum v. USPS, No. 5:97CV1482, slip op. at 11 (N.D. Ohio Jan. 21, 1999) (finding lack of evidence that disclosure occurred where plaintiff alleged that, among other things, file had been left in unsecured file cabinet), aff’d per curiam, No. 99-3397, 2000 WL 1477495, at *2 (6th Cir. Sept. 25, 2000). But cf. Speaker, 623 F.3d at 1386 (finding plaintiff’s complaint sufficient to survive summary judgment because he “need not prove his case on the pleadings” but rather “must merely provide enough factual material to raise a reasonable inference, and thus a plausible claim, that the [Ctrs. for Disease Control & Prevention] was the source of the disclosures”); Ciralsky v. CIA, 689 F. Supp. 2d 141, 156-57 (D.D.C. 2010) (concluding that plaintiff’s allegation of CIA disclosure to unidentified government officials, who were unrelated to handling of plaintiff’s case, was “not unacceptably vague” and need not include identities of alleged recipients for CIA to “understand Plaintiff’s charge”); Tolbert-Smith v. Chu, 714 F. Supp. 2d 37, 43 (D.D.C. 2010) (ruling that plaintiff had stated claim for relief under Privacy Act where plaintiff “pled that a member of [agency] management placed records referring and relating to her disability on a server accessible by other federal employees and members of the public”).
Direct evidence that an agency disclosed a record is generally not required, but plaintiffs must produce more than mere speculation or conjecture.
Circumstantial evidence may be sufficient to prove an unauthorized disclosure occurred, although courts generally require corroborating evidence, rather than mere speculation or conjecture. Because “plaintiffs can rarely produce direct evidence that the government has disclosed confidential information obtained from their private records, requiring such evidence would eviscerate the protections of the Privacy Act.” Speaker v. HHS Ctrs. for Disease Control & Prevention, No. 1:09-CV-1137-WSD, 2012 WL 13071495, at * 20 (N.D. Ga. Mar. 14, 2012) (citing Doe v. USPS, 317 F.3d 339, 343 (D.C. Cir. 2003); Drennon-Gala v. Holder, No. 1:08-CV-3210-JEC, 2011 WL 1225784 (N.D. Ga. Mar. 30, 2011).
At least one court has held that there will be an “adverse inference” against an agency that destroys evidence in order to undermine the plaintiff’s ability to prove that a disclosure occurred.
One district court has concluded that when an agency destroys evidence in order to undermine the plaintiff’s ability to prove that a disclosure occurred, there will be an adverse inference against the agency. See Beaven v. DOJ, No. 03-84, 2007 WL 1032301, at *17 (E.D. Ky. Mar. 30, 2007) (concluding that “whether by use of the adverse inference” or “by a preponderance of the evidence” standard, “officials who inspected the folder found evidence that an inmate had tampered with it,” and finding that “disclosure” occurred in violation of Privacy Act), aff’d in part, rev’d in part & remanded, on other grounds, 622 F.3d 540 (6th Cir. 2010).
Many, but not all, courts have held that a disclosure does not occur if the disclosure is to a person who was already aware of the information.
Many, but not all, courts have held that a “disclosure” under the Privacy Act does not occur if the communication is to a person who is already aware of the information. See, e.g., Hoffman v. Rubin, 193 F.3d 959, 966 (8th Cir. 1999) (finding no Privacy Act violation where agency disclosed same information in letter to journalist that plaintiff himself had previously provided to journalist; plaintiff “waiv[ed], in effect, his protection under the Privacy Act”); Quinn v. Stone, 978 F.2d 126, 134 (3d Cir. 1992) (dictum); Kline v. HHS, 927 F.2d 522, 524 (10th Cir. 1991); Hollis v. Army, 856 F.2d 1541, 1545 (D.C. Cir. 1988); Reyes v. DEA, 834 F.2d 1093, 1096 n.1 (1st Cir. 1987); Schowengerdt v. Gen. Dynamics Corp., 823 F.2d 1328, 1341 (9th Cir. 1987); Pellerin v. VA, 790 F.2d 1553, 1556 (11th Cir. 1986); FDIC v. Dye, 642 F.2d 833, 836 (5th Cir. 1981); Ash v. United States, 608 F.2d 178, 179 (5th Cir. 1979); Mudd v. Army, No. 2:05-cv-137, 2007 WL 4358262, at *5 (M.D. Fla. Dec. 10, 2007) (finding no “disclosure” because by time agency posted statement on its web site, plaintiff had been quoted in newspaper saying he received letter of admonishment, another newspaper article had referred to letter, and plaintiff had testified before Congress regarding letter; also finding no “disclosure” of report because at time agency provided link to report on its web site, “the entire [report] had been the subject of a press release and news conference by a separate and independent agency . . . and had been released to the media by the same”); Schmidt v. VA, 218 F.R.D. 619, 630 (E.D. Wis. 2003) (“defin[ing] the term ‘disclose’ to mean the placing into the view of another information which was previously unknown”); Barry v. DOJ, 63 F. Supp. 2d 25, 26-28 (D.D.C. 1999); Sullivan v. USPS, 944 F. Supp. 191, 196 (W.D.N.Y. 1996); Loma Linda Cmty. Hosp. v. Shalala, 907 F. Supp. 1399, 1404-05 (C.D. Cal. 1995) (commenting that policy underlying Privacy Act protecting confidential information from disclosure not implicated by release of information health care provider had already received through patients’ California “Medi-Cal” cards); Viotti v. Air Force, 902 F. Supp. 1331, 1337 (D. Colo. 1995), aff’d, 153 F.3d 730 (10th Cir. 1998) (unpublished table decision); Abernethy v. IRS, 909 F. Supp. 1562, 1571 (N.D. Ga. 1995), aff’d per curiam, No. 95-9489 (11th Cir. Feb. 13, 1997); Kassel v. VA, 709 F. Supp. 1194, 1201 (D.N.H. 1989); Krowitz v. USDA, 641 F. Supp. 1536, 1545 (W.D. Mich. 1986), aff’d, 826 F.2d 1063 (6th Cir. 1987) (unpublished table decision); Owens v. MSPB, No. 3-83-0449-R, slip op. at 2-3 (N.D. Tex. Sept. 14, 1983) (mailing of agency decision affirming employee’s removal to his former attorney held not “disclosure” because “attorney was familiar with facts of [employee’s] claim” and “no new information was disclosed to him”); Golliher v. USPS, 3 Gov’t Disclosure Serv. ¶ 83,114, at 83,702 (N.D. Ohio June 10, 1982); King v. Califano, 471 F. Supp. 180, 181 (D.D.C. 1979); Harper v. United States, 423 F. Supp. 192, 197 (D.S.C. 1976); cf. Pippinger v. Rubin, 129 F.3d 519, 532-33 (10th Cir. 1997) (finding no evidence that disclosure “could possibly have had ‘an adverse effect’” on plaintiff where recipient “had been privy to every event described in [plaintiff’s] records at the time the event occurred”); Leighton v. CIA, 412 F. Supp. 2d 30, 39 (D.D.C. 2006) (citing Hollis and expressing doubt as to whether disclosure at issue “has presented any new information to those in the intelligence community”); Jones v. Runyon, 32 F. Supp. 2d 873, 876 (N.D. W. Va. 1998) (although finding disclosure to credit reporting service valid under routine use exception, concluding information disclosed was already in possession of recipient and other courts had held that Privacy Act is not violated in such cases), aff’d, 173 F.3d 850 (4th Cir. 1999) (unpublished table decision).
However, the Court of Appeals for the District of Columbia Circuit clarified that some disseminations of protected records to individuals with prior knowledge of their existence or contents are “disclosures” under the Privacy Act. Pilon v. DOJ, 73 F.3d 1111, 1117-24 (D.C. Cir. 1996). In Pilon, the D.C. Circuit held that the Justice Department’s transmission of a Privacy Act-protected record to a former employee of the agency constituted a “disclosure” under the Privacy Act, even though the recipient had come “into contact with the [record] in the course of his duties” while an employee. Id. The court’s “review of the Privacy Act’s purposes, legislative history, and integrated structure convince[d it] that Congress intended the term ‘disclose’ to apply in virtually all instances to an agency’s unauthorized transmission of a protected record, regardless of the recipient’s prior familiarity with it.” Id. at 1124.
In an earlier case, Hollis v. Army, 856 F.2d 1541 (D.C. Cir. 1988), the D.C. Circuit had held that the release of a summary of individual child-support payments previously deducted from plaintiff’s salary and sent directly to his ex-wife, who had requested it for use in pending litigation, was not an unlawful disclosure under the Privacy Act as she already knew what had been remitted to her. Id. at 1545. In Pilon, the D.C. Circuit reconciled its opinion in Hollis by “declin[ing] to extend Hollis beyond the limited factual circumstances that gave rise to it,” 73 F.3d at 1112, 1124, and holding that:
[A]n agency’s unauthorized release of a protected record does constitute a disclosure under the Privacy Act except in those rare instances, like Hollis, where the record merely reflects information that the agency has previously, and lawfully, disseminated outside the agency to the recipient, who is fully able to reconstruct its material contents.
Id. at 1124; cf. Osborne v. USPS, No. 94-30353, slip op. at 2-4, 6-11 (N.D. Fla. May 18, 1995) (assuming without discussion that disclosure of plaintiff’s injury-compensation file to retired employee who had prepared file constituted “disclosure” for purposes of Privacy Act).
Courts are split over whether a disclosure occurs if the information disclosed is publicly available or was previously published.
Courts have also split over whether the disclosure of information that is readily accessible to the public constitutes a “disclosure” under the Privacy Act. The Court of Appeals for the Fifth Circuit, along with several district courts, has concluded that there is no “disclosure” in the release of previously published or publicly available information under the Privacy Act, regardless of whether the particular persons who received the information were aware of the previous publication. FDIC v. Dye, 642 F.2d at 836; Banks v. Butler, No. 5:08cv336, 2010 WL 4537902, at *6 (S.D. Miss. Sept. 23, 2010); Drennon-Gala v. Holder, No. 1:08-CV0321G, 2011 WL 1225784, at *8 (N.D. Ga. Mar. 30, 2011); Mudd v. Army, 2007 WL 4358262, at *5 (finding no “disclosure” where, inter alia, agency had posted statement on its web site, newspapers had referred to letter, plaintiff had testified before Congress regarding letter, and the entire report had been released to the press and in a news conference by another agency); Smith v. Cont’l Assurance Co., No. 91-C-0963, 1991 WL 164348, at *5 (N.D. Ill. Aug. 22, 1991); King, 471 F. Supp. at 181; cf. Sierra Pac. Indus. v. USDA, No. 11-1250, 2012 WL 245973, at *4 (E.D. Cal. Jan. 25, 2012) (finding that Privacy Act did not require sealing documents where “substance of the information . . . [was] already in the public record in one form or another”).
The Third, Ninth, Tenth, and D.C. Circuits, however, have held that the release of information that is “merely readily accessible to the public” does constitute a disclosure under subsection (b). See, e.g., Quinn v. Stone, 978 F.2d 126, 134 (3d Cir. 1992) (holding that “[t]o define disclosure so narrowly as to exclude information that is readily accessible to the public would render superfluous the detailed statutory scheme of twelve exceptions to the prohibition on disclosure”); see also Gowan v. Air Force, 148 F.3d 1182, 1193 (10th Cir. 1998) (“adopt[ing] the Third Circuit’s reasoning [in Quinn] and hold[ing] that an agency may not defend a release of Privacy Act information simply by stating that the information is a matter of public record”); Scarborough v. Harvey, 493 F. Supp. 2d 1, 15-16 n.29 (D.D.C. 2007) (agreeing with Quinn and concluding that “the unqualified language of the Privacy Act,” which protects individual’s “criminal . . . history,” does not exclude information that is readily accessible to public); cf. Wright v. FBI, 241 F. App’x 367, 369 (9th Cir. 2007) (noting that “issue of whether a Privacy Act claim can be based on a defendant’s disclosure of information previously disclosed to the public is a matter of first impression,” and directing district court to stay proceedings until plaintiff “obtains from the district court . . . an order defining the scope of his claims and, potentially, stating that court’s position on whether the Privacy Act applies to information previously disclosed to the public”); Pilon v. DOJ, 796 F. Supp. 7, 11-12 (D.D.C. 1992) (rejecting argument that information was already public and therefore could not violate Privacy Act where agency had republished statement that was previously publicly disavowed as false by agency).
The D.C. Circuit’s opinions in Hollis and Pilon, both discussed above, provide some insight into its view of whether the release of information that is already available to the public constitutes a “disclosure” under the Privacy Act. In Hollis, issued in 1988, the D.C. Circuit had recognized in dictum that other courts had held that the release of previously published material did not constitute a disclosure, and suggested that it might take that approach. Hollis, 856 F.2d at 1545. The court had held that a disclosure did not violate the Privacy Act because the recipient of the information already was aware of it, but that “[o]ther courts have echoed the sentiment that when a release consists merely of information to which the general public already has access, or which the recipient of the release already knows, the Privacy Act is not violated.” However, the D.C. Circuit’s subsequent holding in 1996 in Pilon appears to foreclose such a possibility. In Pilon, the D.C. Circuit held that even under the narrow Hollis interpretation of “disclose,” the agency would not be entitled to summary judgment because it had “failed to adduce sufficient evidence that [the recipient of the record] remembered and could reconstruct the document’s material contents in detail at the time he received it.” 73 F.3d at 1124-26. Nevertheless, the D.C. Circuit in Pilon noted that “[t]his case does not present the question of whether an agency may . . . release a document that has already been fully aired in the public domain through the press or some other means” but that “the Privacy Act approves those disclosures that are ‘required’ under the [FOIA] . . . and that under various FOIA exemptions, prior publication is a factor to be considered in determining whether a document properly is to be released.” Id. at 1123 n.10; see also Barry v. DOJ, 63 F. Supp. 2d 25, 27-28 (D.D.C. 1999) (distinguishing Pilon and finding no disclosure where agency posted Inspector General report on Internet website, after report had already been fully released to media by Congress and had been discussed in public congressional hearing, even though some Internet users might encounter report for first time on website). Furthermore, though, and consistent with the D.C. Circuit’s note in Pilon, one might argue that to say that no “disclosure” occurs for previously published or public information is at least somewhat inconsistent with the Supreme Court’s decision in DOJ v. Reporters Comm. for Freedom of the Press, 489 U.S 749, 762-71 (1989), which held that a privacy interest can exist, under the FOIA, in publicly available – but “practically obscure” – information, such as a criminal history record. Cf. Finley v. NEA, 795 F. Supp. 1457, 1468 (C.D. Cal. 1992) (alleged disclosure of publicly available information states claim for relief under Privacy Act; recognizing Reporters Comm.).
The United States Court of Appeals for the Fourth Circuit has issued contradictory unpublished decisions on the issue of whether release of publicly available information constitutes a disclosure. Compare Lee v. Dearment, 966 F.2d 1442 (4th Cir. 1992) (unpublished table case) (upholding district court’s determination that “the Act does not prohibit disclosure of information which is already open to the public, or if the receiver already knew of it” (citing Hollis v. Army, 856 F.2d at 1545)), and Dye, 642 F.2d at 836, with Doe v. Herman, No. 297CV00043, 1999 WL 1000212, at *11 (W.D. Va. Oct. 29, 1999) (magistrate’s recommendation) (agreeing with Quinn v. Stone, 798 F.2d at 134, in dictum and concluding that discussion of social security numbers at public hearing did not free agency to disclose those numbers), adopted in pertinent part & rev’d in other part (W.D. Va. July 24, 2000), aff’d in part, rev’d in part & remanded, on other grounds sub nom. Doe v. Chao, 306 F.3d 170 (4th Cir. 2002) (finding that plaintiff had not established “actual damages” from disclosure), aff’d, 540 U.S. 614 (2004).
The Ninth Circuit has applied the “single publication rule,” in which the court limits aggregate, unauthorized disclosures to only one cause of action, where an agency disclosed records on an agency web page.
On a related point, the Ninth Circuit held in a subsection (b) case that the “single publication rule” applies to postings on an agency’s web site such that “the aggregate communication can give rise to only one cause of action.” See Oja v. Army Corps of Eng’rs, 440 F.3d 1122, 1130-33 (9th Cir. 2006) (affirming summary judgment for Army Corps which had posted employees’ personal information on its public website). However, the court also ruled that with regard to “the same private information at a different URL address [within the same Web site] . . . that disclosure constitutes a separate and distinct publication – one not foreclosed by the single publication rule – and [the agency] might be liable for a separate violation of the Privacy Act.” Id. at 1133-34.
A public filing of records with a court during the course of litigation constitutes a disclosure.
The fact that “a court is not defined as an ‘agency’ or as a ‘person’ for purposes of [the Privacy Act],” (see Definitions, infra), indicates the Act was “not designed to interfere with access to information by the courts.” 120 Cong. Rec. 36,967 (1974), reprinted in Source Book at 958-59. Even so, the public filing of records with a court, during the course of litigation, does constitute a subsection (b) disclosure. See Laningham v. Navy, No. 83-3238, slip op. at 2-3 (D.D.C. Sept. 25, 1984), summary judgment granted (D.D.C. Jan. 7, 1985), aff’d per curiam, 813 F.2d 1236 (D.C. Cir. 1987); Citizens Bureau of Investigation v. FBI, No. 78-60, slip op. at 2-3 (N.D. Ohio Dec. 14, 1979). Accordingly, any such public filing must be undertaken with written consent or in accordance with either the subsection (b)(3) routine use exception or the subsection (b)(11) court order exception, both discussed below. See generally Krohn v. DOJ, No. 78-1536, slip op. at 3-11 (D.D.C. Mar. 19, 1984) (finding violation of Privacy Act where agency’s disclosure of records as attachments to affidavit in FOIA lawsuit “did not fall within any of the exceptions listed in Section 552a”), reconsideration granted & vacated in nonpertinent part (D.D.C. Nov. 29, 1984) (discussed below).
The Privacy Act disclosure provision does not require heightened discovery requirements.
Often during the course of litigation, an agency will be asked to produce Privacy Act-protected information pursuant to a discovery request by an opposing party. The Privacy Act “does not create a qualified discovery privilege” or “any other kind of privilege or bar that requires a party to show actual need as a prerequisite to invoking discovery,” and courts generally consider whether to allow discovery under “the usual discovery standards” of the Federal Rules of Civil Procedure.” Laxalt v. McClatchy, 809 F.2d 885, 888 (D.C. Cir. 1987); see also Weahkee v. Norton, 621 F.2d 1080, 1082 (10th Cir. 1980); Garraway v. Ciufo, No. 117CV00533DADGSAPC, 2020 WL 1263562, at *8 (E.D. Cal. Mar. 16, 2020); Pennsylvania v. Navient Corp., 348 F. Supp. 3d 394, 398 (M.D. Pa. 2018); Ala. & Gulf Coast Ry. v. United States, No. CA 10-0352, 2011 WL 1838882, at *3 (S.D. Ala. May 13, 2011); Golez v. Potter, No. 09-cv-965, 2011 WL 6002612, at *1-2 (S.D. Cal. Nov. 29, 2011) (“The exceptions allowed in the Privacy Act of 1974 are not applicable here. . . . Accordingly, the Privacy Act . . . precludes the [agency] from complying with Plaintiff’s discovery request.”); Forrest v. United States, No. 95-3889, 1996 WL 171539, at *2 (E.D. Pa. Apr. 11, 1996); Ford Motor Co. v. United States, 825 F. Supp. 1081, 1083 (Ct. Int’l Trade 1993); Clavir v. United States, 84 F.R.D. 612, 614 (S.D.N.Y. 1979); cf. Baldrige v. Shapiro, 455 U.S. 345, 360-62 (1982) (finding that Census Act confidentiality provisions create a privilege against disclosure of raw census data in discovery because they “embody explicit congressional intent to preclude all disclosure”).
Agencies may affirmatively disclose Privacy Act-protected records during litigation, so long as the disclosure is made in accordance with the Privacy Act’s disclosure provision
Although courts have unanimously held that the Privacy Act does not create a privilege against discovery, an agency can disclose Privacy Act-protected records if permitted by the Act. The most appropriate method of disclosure in this situation may be pursuant to a subsection (b)(11) court order. See generally Doe v. DiGenova, 779 F.2d 74 (D.C. Cir. 1985); Doe v. Stephens, 851 F.2d 1457 (D.C. Cir. 1988) (both discussed below under subsection (b)(11)). Indeed, the courts that have rejected the Privacy Act as a discovery privilege have referenced subsection (b)(11)’s allowance for court-ordered disclosures. See Laxalt, 809 F.2d at 888-89; Weahkee, 621 F.2d at 1082; Garraway v. Ciufo, No. 117CV00533DADGSAPC, 2020 WL 1263562, at *8 (E.D. Cal. Mar. 16, 2020) (records that might otherwise be protected by the Act may still be discovered through litigation if ordered by a court); Lightsey v. Potter, No. 1:04-CV-3110-ODE, 2006 WL 8431955 (N.D. Ga. July 27, 2006); Hernandez v. United States, No. 97-3367, 1998 WL 230200, at *2-3 (E.D. La. May 6, 1998); Forrest, 1996 WL 171539, at *2; Ford Motor Co., 825 F. Supp. at 1082-83; Clavir, 84 F.R.D. at 614; cf. Alford v. Todco, No. CIV-88-731E, slip op. at 4-5 (W.D.N.Y. June 12, 1990) (ordering production of records and concluding that “[e]ven assuming the Privacy Act supplies a statutory privilege . . . the plaintiff has waived any such privilege by placing his physical condition at issue”); Tootle v. Seaboard Coast Line R.R., 468 So. 2d 237, 239 (Fla. Dist. Ct. App. 1984) (recognizing that privacy interests in that case “must give way to the function of the discovery of facts” and that subsection (b)(11) provides the mechanism for disclosure).
When an agency wishes to make an affirmative disclosure of information during litigation it may either rely on a routine use permitting such disclosure or seek a court order. Because the Privacy Act does not constitute a statutory privilege, agencies need not worry about breaching or waiving such a privilege when disclosing information pursuant to subsections (b)(3) or (b)(11). Cf. Mangino v. Army, No. 94-2067, 1994 WL 477260, at *5-6 (D. Kan. Aug. 24, 1994) (finding that disclosure to court was appropriate pursuant to agency routine use and stating that to extent Privacy Act created privilege, such privilege was waived by plaintiff when he placed his records at issue through litigation); Lemasters v. Thomson, No. 92 C 6158, 1993 U.S. Dist. LEXIS 7513, at *3-8 (N.D. Ill. June 3, 1993) (same finding as in Mangino, despite fact that “court ha[d] not located” applicable routine use). See also Vaughan v. Ky. Army Nat’l, No. 3:12-33, 2013 WL 1856418, at *4 (E.D. Ky. May 1, 2013) (finding that routine use disclosure to Department of Justice was appropriate for purposes of defending agency against claims pertaining to plaintiff’s records at issue in litigation). For further discussions of disclosures during litigation, see “Conditions of Disclosure to Third Parties,” subsections “5 U.S.C. § 552a(b)(3) - Routine Uses” and “5 U.S.C. § 552a(b)(11) - Court Order,” below.
Agencies are not prohibited from disclosing to an individual his own record in response to a “first party” access request pursuant to the Privacy Act’s access provisions.
By its own terms, subsection (b) does not prohibit an agency from releasing to an individual his own record, contained in a system of records retrieved by his name or personal identifier, in response to his “first-party” access request under subsection (d)(1). Cf. Weatherspoon v. Provincetowne Master Owners Ass’n, No. 08-cv-02754, 2010 WL 936109, at *3 (D. Colo. Mar. 15, 2010) (finding that even though records were maintained by Veterans Administration (“VA”), where plaintiff had been ordered in discovery to produce her mental health records in her emotional distress suit, there would be no improper disclosure to an ‘unauthorized party’ because “the VA will disclose Plaintiff’s mental health records to her, so that she can transmit copies of them to defense counsel”). However, as is discussed below under “Individual’s Right of Access,” the courts have split as to whether a disclosure occurs when the record is disclosed to the individual who is the subject of the record where the record is also about another individual and is “dually retrieved.”
Subsection (b) also explicitly authorizes disclosures made with the prior written consent of the individual. See, e.g., Taylor v. Potter, No. 02-1552, 2004 WL 422664, at *1-2 (D. Del. Mar. 4, 2004) (finding it to be “clear from the documents attached to Plaintiff’s complaint that she provided prior written consent . . . for her medical records to be disclosed”); Scherer v. Hill, No. 02-2043, 2002 U.S. Dist. LEXIS 17872, at *6-8 (D. Kan. Sept. 17, 2002) (finding plaintiff’s argument that agency violated his privacy by sending photographs of his skin condition to United States Attorney rather than directly to him to be “frivolous,” as “[h]e specifically asked the ‘US Attorney and the Veterans Administration’ to produce the photographs” in his motion to compel, and “Privacy Act does not prohibit the consensual disclosure of photographs or documents by an agency”); cf. Stokes v. SSA, 292 F. Supp. 2d 178, 181 (D. Me. 2003);(finding that statement directed at subject of record “did not become the kind of ‘disclosure’ for which the Privacy Act requires written consent merely because [a third party] overheard it,” especially given that individual consented to interview in third party’s presence and thereby, in accordance with the agency regulation, “affirmatively authorized [third party’s] presence during this discussion”; “The Privacy Act does not prevent an agency employee from discussing the contents of a protected record with the person to whom the record pertains.”).
Agencies cannot be held liable for disclosures that individuals make themselves.
Additionally, although it may seem self-evident, the fact pattern in one case caused a court to explicitly hold that an agency cannot be sued for disclosures that an individual makes himself. Abernethy v. IRS, 909 F. Supp. 1562, 1571 (N.D. Ga. 1995) (describing that plaintiff had informed employees that he was being removed from his position as their supervisor and disclosed reason for his removal).
While “written consent” under the Privacy Act is not defined, courts have held that “implied consent” is not sufficient.
The Act does not define the “written consent” needed to permit disclosure under the Privacy Act. Implied consent, however, is insufficient. See Taylor v. Orr, No. 83-0389, 1983 U.S. Dist. LEXIS 20334, at *6 n.6 (D.D.C. Dec. 5, 1983) (addressing alternative argument, stating that: “Implied consent is never enough” as the Act’s protections “would be seriously eroded if plaintiff’s written submission of [someone’s] name were construed as a voluntary written consent to the disclosure of her [medical] records to him”); cf. Milton v. DOJ, 783 F. Supp. 2d 55, 59 (D.D.C. 2011) (rejecting, in context of Freedom of Information Act claim, plaintiff’s argument that his privacy waiver to permit BOP to monitor his telephone calls impliedly extended to any party who accepted his calls; “[A] protected privacy interest can be waived only by the person whose interest is affected, . . . and [plaintiff] has not produced Privacy Act waivers from the individuals with whom he spoke on the telephone.”); Baitey v. VA, No. 8:CV89-706, slip op. at 5 (D. Neb. June 21, 1995) (concluding that “at a minimum, the phrase ‘written consent’ necessarily requires either (1) a medical authorization signed by [plaintiff] or (2) conduct which, coupled with the unsigned authorization, supplied the necessary written consent for the disclosure”). But cf. Pellerin v. VA, 790 F.2d 1553, 1556 (11th Cir. 1986) (applying doctrine of “equitable estoppel” to bar individual from complaining of disclosure of his record to congressmen “when he requested their assistance in gathering such information”) (distinguished in Swenson v. USPS, 890 F.2d 1075, 1077-78 (9th Cir. 1989)); Del Fuoco v. O’Neill, No. 8:09-CV-1262, 2011 WL 601645, at *10 (M.D. Fla. Feb. 11, 2011) (Where regulation mandated that DOJ furnish plaintiff’s termination letter to MSPB, noting that it was plaintiff’s appeal to MSPB that triggered the disclosure, “which did not require Plaintiff’s consent, which is implied by virtue of his appeal.”); Jones v. Army Air Force Exchange Serv. (AAFES), No. 3:00-CV-0535, 2002 WL 32359949, at *5 (N.D. Tex. Oct. 17, 2002) (referring to plaintiff’s claim that AAFES disclosed protected information to congressional offices in violation of Privacy Act, and finding plaintiff to be “estopped from asserting such a claim because AAFES released the information pursuant to congressional office inquiries that were initiated at Plaintiff’s request”).
OMB guidelines suggest, and courts have generally approved of, written consent that states the general purposes for, or types of recipients to, which disclosures may be made; the scope of an agency’s permitted disclosures is then defined by the terms on which the individual provided written consent.
The OMB 1975 Guidelines caution that “the consent provision was not intended to permit a blanket or open-ended consent clause, i.e., one which would permit the agency to disclose a record without limit,” and that, “[a]t a minimum, the consent clause should state the general purposes for, or types of recipients [to,] which disclosure may be made.” 40 Fed. Reg. at 28,954,. See also Perry v. FBI, 759 F.2d 1271, 1276 (7th Cir. 1985) (upholding disclosure because release was “not so vague or general that it is questionable whether [plaintiff] knew what he was authorizing or whether the [agency] knew what documents it could lawfully release”), rev’d en banc on other grounds, 781 F.2d 1294 (7th Cir. 1986).
Courts generally have approved disclosures made with consent where the consent was broad enough to cover the disclosure. See Elnashar v. DOJ, 446 F.3d 792, 795 (8th Cir. 2006) (observing that plaintiff’s signed release “authoriz[ing] representatives of [human rights organization] to obtain and examine copies of all documents and records contained by the [FBI] . . . pertaining to [plaintiff]” constituted consent for FBI to disclose “that it had records which were responsive to the request for records and that records were contained in the ‘PENTBOMB’ investigation”); United States v. Rogers, No. 10-00088, 2010 WL 5441935, at *1 (S.D. Ala. Dec. 28, 2010) (concluding that “if defendant is willing to make a written request to the BOP for his own records and give written consent for their release to his defense counsel, the Court sees no reason why a[] [court] order is necessary”); Roberts v. DOT, No. 02-CV-4414, 2006 WL 842401, at *8, *2 (E.D.N.Y. Mar. 28, 2006) (maintaining that plaintiff’s signed SF 171, which “explicitly stated that [plaintiff] ‘consent[ed] to the release of information about [his] ability and fitness for Federal employment,’” authorized disclosure of plaintiff’s medical records by agency who previously employed him to employing agency to assist in “assist determining whether the employee is capable of performing the duties of the new position”); Thomas v. VA, 467 F. Supp. 458, 460 n.4 (D. Conn. 1979) (holding consent was adequate because it was both agency- and record-specific); cf. Tarullo v. Def. Contract Audit Agency, 600 F. Supp. 2d 352, 360-61 (D. Conn. 2009) (concluding that “the forms themselves put the Plaintiff on notice that they (and hence their contents) would be disclosed . . . . Yet, the Plaintiff supplied his SSN. As a result, he voluntarily disclosed his SSN.”); Wiley v. VA, 176 F. Supp. 2d 747, 751-56 (E.D. Mich. 2001) (concluding that plaintiff’s written release for employment application that broadly authorized employer to corroborate and obtain information about plaintiff’s background constituted valid consent under Privacy Act to authorize disclosure of all 466 pages of plaintiff’s VA claims file in connection with union grievance proceeding, even though release was signed eight years prior to disclosure”).
On the other hand, courts have found consent clauses with narrower terms than the eventual disclosure to be inadequate to authorize that disclosure. See Schmidt v. Air Force, No. 06-3069, 2007 WL 2812148, at *8 (C.D. Ill. Sept. 30, 2007) (issuance of press release and posting of complete text of plaintiff’s reprimand on agency website was outside scope of plaintiff’s signed waiver, which was limited to “a press release announcing the conclusion of the case”); Fattahi v. ATF, 186 F. Supp. 2d 656, 660 (E.D. Va. 2002) (consent providing that information on application “may be disclosed to members of the public in order to verify the information on the application when such disclosure is not prohibited by law” was “a mere tautology: plaintiff consented to no more than that ATF may disclose information except in cases where that disclosure is prohibited”); Doe v. Herman, No. 297CV00043, 1999 WL 1000212, at *9 (W.D. Va. Oct. 29, 1999) (magistrate’s recommendation) (rejecting argument that when plaintiffs provided their social security numbers for purpose of determining eligibility for and amount of benefits payable, they consented to use of those numbers as identifiers on multi-captioned hearing notices sent to numerous other individuals and companies as well as to publication of numbers in compilations of opinions), adopted in pertinent part & rev’d in other part, (W.D. Va. July 24, 2000), aff’d in part, rev’d in part & remanded, on other grounds sub nom. Doe v. Chao, 306 F.3d 170 (4th Cir. 2002), aff’d, 540 U.S. 614 (2004); AFGE v. U.S. R.R. Ret. Bd., 742 F. Supp. 450, 457 (N.D. Ill. 1990) (SF-86 “release form” held overbroad and contrary to subsection (b)); and Doe v. GSA, 544 F. Supp. 530, 539-41 (D. Md. 1982) (stating that authorization, which was neither record- nor entity-specific, was insufficient under GSA’s own internal interpretation of Privacy Act); cf. Taylor, No. 83-0389, 1983 U.S. Dist. LEXIS 20334, at *6 n.6 (D.D.C. Dec. 5, 1983) (addressing alternative argument, stating: “It is not unreasonable to require that a written consent to disclosure address the issue of such disclosure and refer specifically to the records permitted to be disclosed.”).
One California district court has held that courts cannot create new disclosure exceptions based on state policy.
One district court has declined to “recognize a new exception to [subsection (b) of the Privacy Act] based on California public policy to protect persons investigating acts of child abuse.” Stafford v. SSA, 437 F. Supp. 2d 1113, 1121 (N.D. Cal. 2006). In Stafford, a Social Security Administration (“SSA”) employee disclosed to California Child Protective Services “the precise diagnosis of mental illness on which the SSA had made its determination that [the suspected child abuser] was disabled and thus eligible for benefits.” Id. at 1116. The suspect brought a subsection (b)/(g)(1)(D) claim against the agency, and the agency argued that the court should recognize a new exception because “[t]he public interest in detecting and eradicating child abuse is so strong that under California state law, malicious acts or acts taken without probable cause by investigators such as [the Child Protective Services employee] are immunized.” Id. at 1121. The court explained that “Congress enacted the Privacy Act as a limitation on the sharing of private information among government agencies to further what it determined was an important public policy” and stated that “[t]he Court cannot create an exception to a federal statute based on state policy.” Id.
As discussed in detail above, the general rule under the Privacy Act is that, without an individual’s written consent, records about that individual maintained in a system of records cannot be disclosed. There are, however, a number of exceptions to that general rule, or conditions under which information can be disclosed without consent. Of the twelve exceptions discussed in this section, the most significant and frequently litigated exceptions are the “need to know” exception, disclosures required under FOIA, and the “routine use” exception. The twelve exceptions are discussed here in turn.
Other than disclosures under subsection (b)(2) of the Privacy Act (see “Conditions of Disclosure to Third Parties, 5 U.S.C. § 552a(b)(2) - Required FOIA Disclosure” discussion, below), disclosures under the following exceptions are permissive, not mandatory. See OMB 1975 Guidelines, 40 Fed. Reg. at 28,953,
“No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains unless the disclosure would be –
(1) to those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties.” 5 U.S.C. § 552a(b)(1).
The “need to know” disclosure exception authorizes intra-agency disclosures.
The “need to know” exception authorizes the intra-agency disclosure of a record for necessary, official purposes. See OMB 1975 Guidelines, 40 Fed. Reg. 28,948. 28,950-01, 28,954 (July 9, 1975). The Privacy Act’s legislative history indicates an intent “to give the term ‘agency’ its broadest statutory meaning,” and to permit “need to know” disclosures between components of large agencies. See 120 Cong. Rec. 36,967 (1974), reprinted in Source Book at 958 (recognizing propriety of “need to know” disclosures between DOJ components); see also Dick v. Holder, 67 F. Supp. 3d 167, 177-178 (D.D.C. 2014) (stating that “552a(b)(1) does not authorize disclosure outside the ‘agency,’ which this Court has defined broadly to include sharing between component agencies underneath the umbrella of the [Department], not just the specific agency that originally held the information, such as the FBI in this instance”); Sussman v. Marshals Serv., 808 F. Supp. 2d 192, 196-204 (D.D.C. 2011) (recognizing that “[a]lthough the [Marshals Service] and FBI may themselves be considered agencies, they are also components of DOJ, which is itself an agency,” under the statutory meaning of the term, and that disclosures between them “qualify as intra-agency disclosures”); Lora v. DOJ, No. 00-3072, slip op. at 14-15 (D.D.C. Apr. 9, 2004) (finding plaintiff’s argument that Privacy Act violation occurred when INS, then component of DOJ, released documents to DOJ prosecutor to be without merit); Walker v. Ashcroft, No. 99-2385, slip op. at 18-20 & n.6 (D.D.C. Apr. 30, 2001) (alternative holding) (finding that disclosures from FBI field office to FBI headquarters, and from FBI to DOJ prosecutors, were “proper under the ‘need to know’ exception”; “FBI employees and federal prosecutors are considered employees of the same agency, namely the Department of Justice.”), summary affirmance granted, No. 01-5222, 2002 WL 335530 (D.C. Cir. Jan. 25, 2002); cf. Lennon v. Rubin, 166 F.3d 6, 10 (1st Cir. 1999) (finding that district court correctly granted summary judgment to agency where plaintiff alleged discrimination because, despite memorandum indicating intent to distribute information to task force that included individuals from outside agency, agency employee testified that she only gave information to member who was agency employee, and recipient employee declared that she had never given information to other task force members); Freeman v. EPA, No. 02-0387, 2004 WL 2451409, at *4-5 (D.D.C. Oct. 25, 2004) (finding that disclosure of plaintiffs’ drug testing schedules and results by EPA OIG to an EPA-hired DOD investigator did not violate Privacy Act because “according to the OMB 1975 Guidelines, an agency that hires a member of another agency to serve in a temporary task force or similar, cross-designated function can share otherwise protected information with that hired person and still satisfy exception (b)(1)”); OMB 1975 Guidelines, 40 Fed. Reg. at 28,954. (“Movement of records between personnel of different agencies may in some instances be viewed as intra-agency disclosures if that movement is in connection with an inter-agency support agreement”).
Courts generally focus on whether the agency employee receiving the information had a need for the record in the performance of the employee’s duties.
It is the employee receiving the information - not the employee making the disclosure - who must have the “need to know.” So long as “the persons to whom disclosure is made are employees of the agency that maintains the records” and “those employees have a need for access,” disclosure under this subsection “is not limited to the employees responsible for maintaining the records.” See, e.g., Coburn v. Potter, 329 F. App’x 644, 646 (7th Cir. 2009); Cacho v. Chertoff, No. 06-00292, 2006 WL 3422548, *4-7 (D.D.C. Nov. 28, 2006) (finding plaintiff’s argument alleging improper access of information irrelevant to (b)(1) analysis; “What matters then is the ‘need to know’ of the agency official who received the disclosure, not the authority of the agency official who made the disclosure.”); Gill v. DOD, 92 M.S.P.R. 23, 31-32 (2002) (finding disclosure to EEO counselor of other employees’ records appeared to fall within (b)(1) exception, where appellant provided records at request of EEO counselor who was investigating appellant’s claim that she was disparately treated).
Some courts have found the “need to know” disclosure exception to apply to contractors who serve the function of agency employees.
Although subsection (b)(1) permits disclosure only to “those officers and employees of the agency which maintains the record,” some courts have upheld disclosures to contractors who serve the function of agency employees. See Mount v. USPS, 79 F.3d at 532-34 (concluding disclosure of plaintiff’s medical files to “a physician under contract with the USPS” who had “responsibilities for making employment and/or disciplinary decisions regarding plaintiff” had some basis in need to know exception); Gard v. Dep’t of Educ., 789 F. Supp. 2d 96, 110 (D.D.C. 2011) (finding permissible intra-agency disclosure to “‘occupational medicine consultant’ under contract with” agency for purposes of evaluating employee’s risk to coworkers); Ciralsky v. CIA, 689 F. Supp. 2d 141, 155 (D.D.C. 2010) (finding permissible intra-agency disclosures to private contractors hired to investigate certain allegations, including plaintiff’s); Sutera v. TSA, 708 F. Supp. 2d 304, 318 (E.D.N.Y. 2010) (finding permissible intra-agency disclosure where medical sample was sent to outside laboratory because “[f]or testing purposes a private laboratory is necessarily treated as part of the agency”); Coakley v. DOT, No. 93-1420, 1994 WL 16953072, at *1-2 (D.D.C. Apr. 7, 1994) (holding that independent contractor serving as EEO investigator for employee’s EEO complaint “must be considered an employee of DOT for Privacy Act purposes” and that DOT’s disclosure to that contractor “in connection with an official agency investigation . . . must be considered an intra-agency communication under the Act”); Hulett v. Navy, No. TH 85-310-C, slip op. at 3-4 (S.D. Ind. Oct. 26, 1987) (discussing disclosure of medical and personnel records to contractor/psychiatrist for purpose of assisting him in performing “fitness for duty” examination), aff’d, 866 F.2d 432 (7th Cir. 1988) (unpublished table decision); cf. Gill v. DOD, 92 M.S.P.R. at 32 n.7 (noting that EEO counselor to whom disclosure was made “was employed by a contractor, rather than directly by the agency [and] . . . was performing an administrative function for which the agency was responsible,” and stating further that “[i]t is clear that, for particular purposes, the Privacy Act provides that any government contractor and any employee of such contractor shall be considered an employee of an agency” (citing 5 U.S.C. § 552a(m))). Another court, however, has held to the contrary on facts nearly identical to those in Hulett. Taylor v. Orr, No. 83-0389, 1983 U.S. Dist. LEXIS 20334, at *7-10 (D.D.C. Dec. 5, 1983).
Courts generally have found intra-agency disclosures regarding personnel or employment matters as authorized disclosures under the “need to know” disclosure exception.
The cases are replete with examples of proper intra-agency “need to know” disclosures. By far the most frequent “need to know” disclosure that the courts have deemed appropriate is for the purpose of investigating alleged employee misconduct or making disciplinary determinations. See, e.g., Pippinger v. Rubin, 129 F.3d 519, 529-31 (10th Cir. 1997) (discussing supervisor’s disclosure of identity of person being investigated to staff members assisting in investigation, and to agency attorney defending agency’s actions in related MSPB proceeding against another individual); Mount v. USPS, 79 F.3d 531, 533-34 (6th Cir. 1996) (discussing disclosure of information in plaintiff’s medical records to other employees “with responsibilities for making employment and/or disciplinary decisions regarding plaintiff”; “In light of the questions surrounding plaintiff’s mental stability, each had at least an arguable need to access the information in plaintiff’s medical records.”); Covert v. Harrington, 876 F.2d 751, 753-54 (9th Cir. 1989) (discussing disclosure of security questionnaires to Inspector General for purpose of detecting fraud); Daly-Murphy v. Winston, 837 F.2d 348, 354-55 (9th Cir. 1988) (discussing disclosure of letter suspending doctor’s clinical privileges to participants in peer-review proceeding); Lukos v. IRS, No. 86-1100, 1987 WL 36354, at *1-2 (6th Cir. Feb. 12, 1987) (discussing disclosure of employee’s arrest record to supervisor for purpose of evaluating his conduct and to effect discipline); Howard v. Marsh, 785 F.2d 645, 647-49 (8th Cir. 1986) (discussing disclosure of employee’s personnel records to agency attorney and personnel specialist for purpose of preparing response to discrimination complaint); Hernandez v. Alexander, 671 F.2d 402, 410 (10th Cir. 1982) (discussing disclosure of employee’s EEO files to personnel advisors for purpose of determining whether personnel action should be taken against employee); Grogan v. IRS, 3 Gov’t Disclosure Serv. (P-H) ¶ 82,385, at 82,977-78 (4th Cir. Mar. 22, 1982) (discussing disclosure of questionable income tax returns prepared by professional tax preparer while he was IRS employee to IRS examiners for purpose of alerting them to possible irregularities); Code v. Esper, 285 F. Supp. 3d 58, 70-71 (D.D.C. 2017) (concluding that Army investigative unit did not violate Privacy Act by disclosing investigative report finding plaintiff committed certain crimes to Defense Finance and Accounting Service for purposes of official debt collecting duties), rev’d and remanded on other grounds sub nom. Code v. McCarthy, 959 F.3d 406 (D.C. Cir. 2020); Lewis v. SSA, No. 9:14-CV-31, 2015 WL 9664967, at *6 (E.D. Tex. Dec. 7, 2015) (discussing disclosure of report containing allegations about plaintiff by SSA employee who had duty “to ‘report threats and harassment against the agency’” to DHS), adopted by 2016 WL 81577 (E.D. Tex. Jan. 1, 2016); Drennon-Gala v. Holder, No. 1:08-CV-321G, 2011 WL 1225784, at *5 (N.D. Ga. Mar. 30, 2011) (discussing disclosure of plaintiff’s workers compensation file to agency officials investigating allegations “directly related to misconduct involving [plaintiff’s] worker’s compensation claim”); Doe v. DOJ, 660 F. Supp. 2d 31, 45-46 (D.D.C. 2009) (discussing disclosure of plaintiff AUSA’s mental state to DOJ security personnel, who “needed . . . to assess his trustworthiness and make related personnel decisions about his eligibility for security clearance,” to acting U.S. Attorney and division chief, who “[a]s plaintiff’s supervisors . . . were responsible for ensuring that the [office] was operating safely,” and to EOUSA attorney, who was “entitled to access the records because he represented DOJ in various pending disciplinary matters against plaintiff at the time” (internal quotation marks omitted)); Gamble v. Army, 567 F. Supp. 2d 150, 156 (D.D.C. 2008) (discussing disclosure to plaintiff’s commanding officer of past allegations of sexual misconduct by plaintiff in context of investigation of new allegations of same); Roberts v. DOJ, 366 F. Supp. 2d 13, 26-28 (D.D.C. 2005) (finding disclosure of results of investigation by OPR to FBI was “expressly permitted” because FBI referred matter to OPR for investigation and because FBI had duty to respond to plaintiff’s complaints; dismissing claim because “OPR was entitled to share information regarding the results of its investigation” with agency that was subject of its investigation); Buckles v. Indian Health Serv., 305 F. Supp. 2d 1108, 1111 (D.N.D. 2004) (finding disclosure of employees’ medical records by employer’s health facility to risk management team – due to concerns that employees were illegally receiving prescription drugs – was proper because it conformed with facility’s protocol to discuss issues of potential wrongdoing with upper management); Abernethy v. IRS, 909 F. Supp. 1562, 1570-71 (N.D. Ga. 1995) (“[Investigatory] panel’s review of Plaintiff’s performance appraisals was not a violation of the Privacy Act because the members had a need to know the contents of the appraisals.”); (finding that member of panel that recommended that plaintiff be removed from management in response to EEO informal class complaint “had a need to know the contents of the [EEO] complaint file”), aff’d per curiam, No. 95-9489, 108 F.3d 343 (11th Cir. Feb. 13, 1997) (unpublished table decision); Harry v. USPS, 867 F. Supp. 1199, 1206 (M.D. Pa. 1994) (discussing disclosure from one internal subdivision of Postal Service to another – the Inspection Service (Inspector General) – which was conducting investigation), aff’d sub nom. Harry v. USPS, 60 F.3d 815 (3d Cir. 1995) (unpublished table decision).
Similarly, where an employee has a “need to know” certain information for personnel or employment determinations, the courts have found disclosure appropriate. Tran v. Treasury, 351 F. Supp. 3d 130, 138-140 (D.D.C. 2019) (discussing disclosure of performance appraisal to managers who were considering plaintiff’s detail request), aff’d 798 F. App’x. 649, 649-650 (D.C. Cir. 2020) (“As to the need for the record, every employee who accessed Tran’s performance appraisal needed to know whether Tran had the requisite skillset for a detail, in order to perform properly his or her duty to evaluate Tran as a prospective detailee. Tran’s performance appraisal contained information relevant to that inquiry.”); Lamb v. Millennium Challenge Corp., 228 F. Supp. 3d 28, 37 (D.D.C. 2017) (noting no allegation that disclosure occurred “for any reason unrelated to the agency’s security check and suitability determination”); Sutera v. TSA, 708 F. Supp. 2d at 318 (concluding, despite plaintiff’s assertion that agency’s “statement that he failed a drug test violated the Privacy Act,” that “[TSA Disciplinary Review Board] officials, the Medical Review Officer, and the deciding official are all agency employees responsible for making employment decisions regarding plaintiff” and “[t]heir communications are within the Privacy Act’s ‘need-to-know’ exception”); Thompson v. State, 400 F. Supp. 2d 1, 20 (D.D.C. 2005) (finding disclosure of investigative report to agency’s Office of Civil Rights to determine “whether plaintiff’s supervisor was promoting plaintiff’s career to the detriment of the office and other employees because of a romantic relationship” was “relevant to the agency’s compliance with EEO regulations”); Hanna v. Herman, 121 F. Supp. 2d 113, 123-24 (D.D.C. 2000) (finding disclosure of information about plaintiff’s demotion to supervisor in another office of agency was covered by “need to know” exception), summary affirmance granted sub nom. Hanna v. Chao, No. 00-5433 (D.C. Cir. Apr. 11, 2001); Magee v. USPS, 903 F. Supp. 1022, 1029 (W.D. La. 1995) (discussing disclosure of employee’s medical report following fitness-for-duty examination to Postmaster of Post Office where employee worked to determine whether employee could perform essential functions of job and to Postmaster’s supervisor who was to review Postmaster’s decision), aff’d per curiam, 79 F.3d 1145 (5th Cir. 1996).
Courts generally have found intra-agency disclosures of records for national security purposes to be authorized disclosures under the “need to know” disclosure exception.
The courts also have concluded that an agency employee has a “need to know” information that could affect national security. See, e.g., Bigelow v. DOD, 217 F.3d 875, 876-78 (D.C. Cir. 2000) (describing review of plaintiff’s personnel file by immediate supervisor in connection with supervisor’s “continuing duty to make sure that [plaintiff] was worthy of trust” because of “a need to examine the file in view of the doubts that had been raised in his mind about [plaintiff] and [plaintiff’s] access to the country’s top secrets”); Britt v. Naval Investigative Serv., 886 F.2d 544, 549 n.2 (3d Cir. 1989) (noting propriety of disclosure of investigative report to commanding officer “since the Reserves might need to reevaluate Britt’s access to sensitive information or the level of responsibility he was accorded”); Williams v. Reilly, 743 F. Supp. 168, 175 (S.D.N.Y. 1990) (discussing employee’s admission of drug use disclosed by Naval Investigative Service to plaintiff’s employer, Defense Logistics Agency, for purposes of revoking employee’s security clearance).
Courts generally have found intra-agency disclosures of records to perform administrative duties to be authorized disclosures under the “need to know” disclosure exception.
Disclosure has been deemed appropriate where an employee has a “need to know” information to perform an administrative duty. See Hudson v. Reno, 130 F.3d 1193, 1206-07 (6th Cir. 1997) (discussing disclosure of plaintiff’s performance evaluation to individual who typed it originally, for retyping), abrogated on other grounds by Pollard v. E.I. du Pont de Nemours & Co., 532 U.S. 843 (2001); Cornelius v. McHugh, No. 3:14-cv-00234, 2015 WL 4231877, at *4-6 (D.S.C. July 13, 2015) (discussing disclosure of background check information related to plaintiff’s job duties to agency employees who needed information for performance of their duties); Middlebrooks v. Mabus, No. 1:11cv46, 2011 WL 4478686, at *6-7 (E.D. Va. Sept. 23, 2011) (discussing disclosure to “small group of senior employees” who were “required ‘to perform their job of legal oversight for the agency’” and “determine proper compliance with disclosure regulations”); Shayesteh v. Raty, No. 02:05-CV-85TC, 2007 WL 2317435, at *4-5 (D. Utah Aug. 7, 2007) (finding that disclosure to law enforcement officer within agency fit within need to know exception because “record clearly shows that the purpose for the disclosures in this instance was to pursue forfeiture of funds . . . a task which is clearly within [employees’] duties as federal law enforcement officers”); Schmidt v. VA, 218 F.R.D. 619, 631 (E.D. Wis. 2003) (“VA personnel need to have access to the entire [social security number] of persons accessible through the [Computerized Patient Records System] to avoid misidentification.”).
Courts generally have found intra-agency disclosures of records to provide medical treatment or assess medical expenses as authorized disclosures under the “need to know” disclosure exception.
Courts also have allowed disclosure under the “need to know” exception where the information is needed to provide medical treatment or expenses for medical treatment. McKinley v. United States, No. 3:14-CV-01931, 2015 WL 4663206, at *8 (D. Or. Aug. 5, 2015) (“The information contained in McKinley’s treatment, counseling, and psychotherapy notes was collected in an effort to provide her medical treatment, and the records were disclosed to other VA health professionals for that same purpose.”); Marquez v. Johnson, No. 11-cv-545, 2012 WL 6618238, at *11 (D. Colo. Dec. 19, 2012) (finding that disclosure by plaintiff’s supervisor to staff that plaintiff was out on leave due to “cancer scare” was based on their need for information in performance of their duties), aff’d, 545 Fed. App’x 735, 740 (10th Cir. 2013) (“[Plaintiff] did not allege [that leave information] was revealed to the entire staff . . . . Nor does [plaintiff] dispute [agency’s] position that the disclosure was necessary to an investigator regarding [plaintiff’s] claim for medical and therapy expenses.”); Khalfani v. VA, No. 94-CV-5720, 1999 WL 138247, at *7-8 (E.D.N.Y. Mar. 10, 1999) (discussing disclosure of plaintiff’s medical records within VA so that his supervisor could document his request for medical leave and determine level of work he could perform).
Courts generally have found that intra-agency disclosures to employees that do not have a need for the record in the performance of their duties are outside the scope of the “need to know” disclosure exception.
On the other hand, intra-agency disclosures to recipients who do not need the information to perform their duties are improper. See, e.g., Parks v. IRS, 618 F.2d 677, 680-81 & n.1 (10th Cir. 1980) (holding plaintiffs had viable claim for disclosure of names of employees who did not purchase savings bonds for solicitation purposes); Dick v. Holder, 67 F. Supp. 3d at 177-178 (finding “need to know” exception did not authorize “Be on the Lookout” alert to law enforcement officers outside DOJ or within agency “without any showing of why each employee needed to receive the information”); Carlson v. GSA, No. 04-C-7937, 2006 WL 3409150, at *3-4 (N.D. Ill. Nov. 21, 2006) (explaining that supervisor’s e-mail to employees providing reasons for plaintiff’s termination does not fall within need to know exception because supervisor “encouraged [employees] to share [the e-mail] without restriction” and “express[ed] his personal satisfaction with [employee’s] termination”); MacDonald v. VA, No. 87-544-CIV-T-15A, slip op. at 8-9 (M.D. Fla. July 28, 1989) (holding disclosure of counseling memorandum in “callous attempt to discredit and injure” employee is improper); Koch v. United States, No. 78-273T, slip op. at 1-2 (W.D. Wash. Dec. 30, 1982) (holding letter of termination posted in agency’s entrance hallway is improper); Smigelsky v. USPS, No. 79-110-RE, slip op. at 3-4 (D. Or. Oct. 1, 1982) (holding that publication of employees’ reasons for taking sick leave is improper); Fitzpatrick v. IRS, 1 Gov’t Disclosure Serv. (P-H) ¶ 80,232, at 80,580 (N.D. Ga. Aug. 22, 1980) (holding disclosure of fact that employee’s absence was due to “mental problems” is improper; “quelling rumors and gossip [and] satisfying curiosity is not to be equated with a need to know”), aff’d in part, vacated & remanded in part, on other grounds, 665 F.2d 327 (11th Cir. 1982); see also Walia v. Napolitano, 986 F. Supp. 2d 169, 187 (E.D.N.Y. 2013) (finding that plaintiff “adequately allege[d] that the disclosure regarding his EEO complaint was not on a ‘need to know’ basis for the employees to perform their duties”); Bigelow v. DOD, 217 F.3d 875, 879 (D.C. Cir. 2000) (Tatel, J., dissenting) (interpreting DOD regulations to find that supervisor did not have official need to review personnel security file of individual he supervised); Boyd v. Snow, 335 F. Supp. 2d 28, 38-39 (D.D.C. 2004) (denying summary judgment where there are “serious questions” as to whether plaintiff’s rebuttal statement to her performance evaluation was disclosed to certain personnel in plaintiff’s office pursuant to “need to know”); Vargas v. Reno, No. 99-2725, slip op. at 3, 12-13 (W.D. Tenn. Mar. 31, 2000) (denying summary judgment where insufficient evidence that disclosure of plaintiff’s file to Inspector General agent investigating another employee was based on agent’s “need to know”); cf. Berry v. Henderson, No. 99-283-P-C, 2000 WL 761896, at *1, 3 (D. Me. May 8, 2000) (finding that agency’s examination of personnel and medical records within its possession in connection with its defense in Title VII case did not satisfy subsection (b)(1)).
“No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains unless the disclosure would be –
(2) required under section 552 of this title [the Freedom of Information Act].” 5 U.S.C. § 552a(b)(2)
As a function of the required FOIA disclosure exception, the Privacy Act never prohibits a disclosure that the FOIA requires.
The Privacy Act never prohibits a disclosure that the Freedom of Information Act actually requires. See News-Press v. DHS, 489 F.3d 1173, 1189 (11th Cir. 2007) (“The net effect of the interaction between the two statutes is that where the FOIA requires disclosure, the Privacy Act will not stand in its way, but where the FOIA would permit withholding under an exemption, the Privacy Act makes such withholding mandatory upon the agency.”); Greentree v. U.S. Customs Serv., 674 F.2d 74, 79 (D.C. Cir. 1982) (stating subsection (b)(2) “represents a Congressional mandate that the Privacy Act not be used as a barrier to FOIA access”). See also Burwell v. EOUSA, 210 F. Supp. 3d 33, 36 (D.D.C. 2016) (“Privacy Act specifically exempts from its nondisclosure provisions documents that are otherwise required to be disclosed under the FOIA, see 5 U.S.C. §552a(b)(2), and EOUSA processed plaintiff’s request under the FOIA.”); Sikes v. United States, 987 F. Supp. 2d 1355, 1372 n.14 (S.D. Ga. 2013) (finding that because FOIA required disclosure of list of names of individuals invited to ceremony at which Navy officer was sworn in as Chief of Naval Operations, Privacy Act did not bar disclosure); Woods v. DOJ, 968 F. Supp. 2d 115, 120-21 (D.D.C. 2013) (finding that “defendant properly considered plaintiff’s request in light of the FOIA, [and thus] any issue arising under the Privacy Act is essentially moot”); Plunkett v. DOJ, 924 F. Supp. 2d 289, 306-07 (D.D.C. 2013) (“[T]he Privacy Act does not bar disclosure of documents that are otherwise required to be disclosed under the FOIA . . . and defendant properly reviewed and released responsive records under the FOIA.”).
Thus, if an agency is in receipt of a FOIA request for information about an individual that is contained in a system of records and that is not properly withholdable under any FOIA exemption, then it follows that the agency is “required under Section 552 of this title” to disclose the information to the FOIA requester. This would be a required subsection (b)(2) disclosure. However, if a FOIA exemption – typically, Exemption 6 (personnel and medical files) or Exemption 7(C) (law enforcement information that could be an invasion of personal privacy) – applies to a Privacy Act-protected record, the Privacy Act prohibits an agency from making a “discretionary” FOIA release because that disclosure would not be “required” by the FOIA within the meaning of subsection (b)(2). See, e.g., DOD v. FLRA, 510 U.S. 487, 502 (1994); Big Ridge, Inc. v. Fed. Mine Safety and Health Review Comm’n, 715 F.3d 631, 651 (7th Cir. 2013); Navy v. FLRA, 975 F.2d 348, 354-56 (7th Cir. 1992); Andrews v. VA, 838 F.2d 418, 422-24 & n.8 (10th Cir. 1988); Roble v. DOJ, 311 F. Supp. 3d 161, 163-64 (D.D.C. 2018); Ecological Rights Found. v. FEMA, No. 16-cv-05254, slip op. at 14-16 (N.D. Cal. Nov. 30, 2017); Jett v. FBI, 139 Akmal v. United States, No. C12-1499, 2014 WL 906231, at *3 (W.D. Wash. Mar. 7, 2014); Robbins v. HHS, No. 1:95-cv-3258, slip op. at 2-9 (N.D. Ga. Aug. 13, 1996), aff’d, 120 F.3d 275 (unpublished table decision) (11th Cir. July 8, 1997); Kassel v. VA, 709 F. Supp. 1194, 1199-1200 (D.N.H. 1989); Howard v. Marsh, 654 F. Supp. 853, 855-56 (E.D. Mo. 1986), aff’d, 855 F.2d 855 (8th Cir. 1988) (unpublished table decision); Fla. Med. Ass’n v. HEW, 479 F. Supp. 1291, 1305-07 (M.D. Fla. 1979), vacated, 947 F. Supp. 2d 1325 (M.D. Fla. 2013); Providence Journal Co. v. FBI, 460 F. Supp. 762, 767 (D.R.I. 1978), rev’d on other grounds, 602 F.2d 1010 (1st Cir. 1979); Phila. Newspapers, Inc. v. DOJ, 405 F. Supp. 8, 10 (E.D. Pa. 1975); see also OMB 1975 Guidelines, 40 Fed. Reg. at 28,954.
After DOJ v. Reporters Comm. for Freedom of the Press, the FOIA is less likely to require disclosure of Privacy Act-protected records.
In DOJ v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 762-75 (1989), the Supreme Court significantly expanded the breadth of FOIA Exemptions 6 and 7(C). The Court ruled that a privacy interest may exist in publicly available information – such as the criminal history records there at issue – where the information is “practically obscure.” Id. at 764-71. Even more significantly, the Court held that the identity of the FOIA requester, and any socially useful purpose for which the request was made, are not to be considered in evaluating whether the “public interest” would be served by disclosure. Id. at 771-75. The Court determined that the magnitude of the public interest side of the balancing process can be assessed only by reference to whether disclosure of the requested records directly advances the “core purpose” of the FOIA – to shed light on the operations and activities of the government. Id. at 774-75.
In light of Reporters Comm., personal information of the sort protected by the Privacy Act is less likely to be “required” to be disclosed under the FOIA, within the meaning of subsection (b)(2). Specifically, where an agency determines that the only “public interest” that would be furthered by a disclosure is a nonqualifying one under Reporters Comm. (even where it believes that disclosure would be in furtherance of good public policy generally), it may not balance in favor of disclosure under the FOIA and therefore disclosure will be prohibited under the Privacy Act – unless authorized by another Privacy Act exception or by written consent. See, e.g., DOD v. FLRA, 510 U.S. at 497-502 (declining to “import the policy considerations that are made explicit in the Labor Statute into the FOIA Exemption 6 balancing analysis” and, following the principles of Reporters Comm., holding that home addresses of bargaining unit employees are covered by FOIA Exemption 6 and thus that Privacy Act “prohibits their release to the unions”); Schwarz v. INTERPOL, 48 F.3d 1232 , at 1-2 & n.2 (10th Cir. Feb. 28, 1995) (balancing under Reporters Comm. and holding that individual clearly has protected privacy interest in avoiding disclosure of his whereabouts to third parties; disclosure of this information would not “contribute anything to the public’s understanding of the operations or activities of the government”; and thus any information was exempt from disclosure under FOIA Exemption 7(C) and does not fall within Privacy Act exception (b)(2)); FLRA v. Commerce, 962 F.2d 1055, 1059 (D.C. Cir. 1992) (asserting that Privacy Act prohibits disclosure of identities of individuals who received outstanding or commendable personnel evaluations, as such information falls within FOIA Exemption 6); Doe v. Veneman, 230 F. Supp. 2d 739, 748-52 (W.D. Tex. 2002) (finding that in reverse FOIA lawsuit where information regarding government program for protection of livestock using livestock-protection collars already had been released, no personally identifying information about particular ranchers and farmers participating in program “could shed any further light on the workings of the [program],” that information thus was protected by FOIA Exemption 6, and disclosure was prohibited by Privacy Act), aff’d in part, rev’d in part, on other grounds, 380 F.3d 807 (5th Cir. 2004); Fort Hall Landowners Alliance, Inc. v. BIA, No. CV-99-00052-E-BLW, slip op. at 7-14 (D. Idaho Mar. 17, 2000) (finding document that “contains only names and addresses . . . does not provide information shedding light on how the BIA is performing its duties,” and that “[h]aving determined that disclosure of the information is not required by FOIA . . . the Privacy Act prohibits disclosure of the information”); Burke v. DOJ, No. 96-1739, 1999 WL 1032814, at *3-5 (D.D.C. Sept. 30, 1999) (stating that “Privacy Act prohibits the FBI from disclosing information about a living third party without a written privacy waiver, unless FOIA requires disclosure,” and upholding FBI’s refusal to confirm or deny existence of investigative records related to third parties in response to FOIA request) (emphasis in original); see also FOIA Update, Vol. X, No. 2, at 3, http://www.justice.gov/oip/foia_updates/Vol_X_2/page3.html. As a result of Reporters Comm., agencies depend more on the subsection (b)(3) routine use exception to make compatible disclosures of records that are no longer required by the FOIA to be disclosed. See, e.g., USDA v. FLRA, 876 F.2d 50, 51 (8th Cir. 1989); see also FLRA v. Treasury, 884 F.2d 1446, 1450 & n.2 (D.C. Cir. 1989).
Note that President Barack Obama’s FOIA policy on openness in government, see Memorandum for the Heads of Executive Departments and Agencies, Subject: Freedom of Information Act (Jan. 21, 2009), https://www.justice.gov/paoverview_agfoia, is inapplicable to information covered by the Privacy Act that also falls under one or more of the FOIA exemptions. See U.S. Dep’t of Justice, Off. of Info. Pol’y, OIP Guidance: President Obama’s FOIA Memorandum and Attorney General Holder’s FOIA Guidelines (April 17, 2009), https://www.justice.gov/oip/blog/foia-post-2009-creating-new-era-open-government (“For information falling within Exemptions 6 and 7(C), if the information is also protected by the Privacy Act of 1974, it is not possible to make a discretionary release, as the Privacy Act contains a prohibition on disclosure of information not ‘required’ to be released under the FOIA.”).
The D.C. Circuit has held that the required FOIA disclosure exception cannot be invoked unless an agency actually has a FOIA request in hand; not all courts agree.
The Court of Appeals for the District of Columbia Circuit significantly limited the utility of subsection (b)(2) as a defense by holding that subsection (b)(2) cannot be invoked unless an agency actually has a FOIA request in hand. Bartel v. FAA, 725 F.2d 1403, 1411-13 (D.C. Cir. 1984); see also Chang v. Navy, 314 F. Supp. 2d 35, 41-42 (D.D.C. 2004) (citing Bartel, and noting that defendant agency conceded that it “had no FOIA request in hand”). In one case prior to Bartel, it similarly had been held that subsection (b)(2) was not available as a defense for the disclosure of information in the absence of a FOIA request. Zeller v. United States, 467 F. Supp. 487, 503 (E.D.N.Y. 1979) (finding subsection (b)(2) inapplicable to the “voluntary re-release” of a prior press release (that had been made prior to the effective date of the Privacy Act) as “nothing in the FOIA appears to require such information to be released in the absence of a request therefor”).
Other courts have not followed the rule in Bartel, however, and do not require agencies to have a FOIA request in hand to raise a (b)(2) defense. See Cochran v. United States, 770 F.2d 949, 957-58 & n.14 (11th Cir. 1985) (applying subsection (b)(2) – in absence of written FOIA request – because requested records would not be withholdable under any FOIA exemption); Jafari v. Navy, 728 F.2d 247, 249-50 (4th Cir. 1984) (same); Russo v. United States, 576 F. Supp. 2d 662, 671-72 (D.N.J. 2008) (alternative holding) (expressing reluctance to follow Bartel because subsection (b)(2)’s conditional language of “would be” rather than “is” “casts serious doubt upon Plaintiff’s argument that the exception only applies where the agency is faced with a written FOIA request”); Mudd v. Army, No. 2:05-cv-137, 2007 WL 4358262, at *6 (M.D. Fla. Dec. 10, 2007) (agreeing with agency that “under the circumstances of this case, the balance of plaintiff’s privacy against the public’s right to disclosure weighs in favor of public disclosure, and that the FOIA exception was applicable even without a formal FOIA request”).
However, because the D.C. Circuit is the jurisdiction of “universal venue” under the Privacy Act -- i.e., any Privacy Act lawsuit for wrongful disclosure could be filed within that judicial circuit -- see 5 U.S.C. § 552a(g)(5) -- its holding in Bartel is of paramount importance. See FOIA Update, Vol. V, No. 3, at 2, http://www.justice.gov/oip/foia_updates/Vol_V_3/page2.htm (discussing Bartel). Note also, though, that the Bartel decision left open the possibility that certain types of information “traditionally released by an agency to the public” might properly be disclosed even in the absence of an actual FOIA request. 725 F.2d at 1413 (dictum). Reacting to Bartel, OMB issued guidance indicating that records that have “traditionally” been considered to be in the public domain, and those that are required to be disclosed to the public – such as names and office telephone numbers of agency employees – can be released without waiting for an actual FOIA request. Memorandum from Robert P. Bedell, Deputy Administrator, Office of Information and Regulatory Affairs, for the Senior Agency Officials for Information Resource Management, Privacy Act Guidance – Update (May 24, 1985) [hereinafter OMB Bedell Memo], https://www.justice.gov/paoverview_omb-85 (“Records which have traditionally been considered to be in the public domain and are required to be disclosed to the public, such as many of the final orders and opinions of quasi-judicial agencies, press releases, etc. may be released under this provision without waiting for a specific Freedom of Information Act request”); see also OMB Call Detail Guidance, https://www.justice.gov/paoverview_omb-87-cd (applying Bartel to “call detail” programs); OMB 1975 Guidelines, 40 Fed. Reg. at 28,954.
The District Court for the District of Columbia twice has applied this public domain aspect of Bartel. In Tripp v. DOD, 193 F. Supp. 2d 229, 236 (D.D.C. 2002), the D.C. District Court held that “the names, titles, salaries, and salary-levels of public employees are information generally in the public domain” and thus that they are not prohibited from disclosure under subsection (b)(2). In Chang v. Navy, 314 F. Supp. 2d at 42, the District Court found that the Privacy Act was not violated where the Navy disclosed information to the media about plaintiff’s nonjudicial punishment, because the information was “releasable” under the FOIA, and the Navy had asserted that it “traditionally releases information that would be releasable under the FOIA to the press without a formal FOIA request,” and was able to point to a Navy regulation to that effect. Id; see also Russo, 576 F. Supp. 2d at 670-73 (D.N.J. 2008) (alternative holding) (concluding disclosure of active duty military status did not violate Privacy Act because “duty status is the sort of public-domain information traditionally released to the public in the absence of a FOIA request”).
For further analysis of the interplay between the FOIA and the Privacy Act, see “Individual’s Right of Access” section below, particularly the “FOIA/Privacy Act Interface Examples: Access” subsection.
“No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains unless the disclosure would be --
. . .
(3) for a routine use as defined in subsection (a)(7) of this section and described under subsection (e)(4)(D).” 5 U.S.C. § 552a(b)(3).
Subsection (a)(7) defines the term “routine use” to mean “with respect to the disclosure of a record, the use of such record for a purpose which is compatible with the purpose for which it was collected.”
Subsection (e)(4)(D) requires Federal Register publication of “each routine use of the records contained in the system, including the categories of users and the purpose of such use.”
The routine use disclosure exception is broad and was designed to allow disclosures other than intra-agency disclosures.
The routine use exception, because of its potential breadth, is one of the most controversial provisions in the Act. See Privacy Commission Report, at 517-18, https://www.justice.gov/paoverview_ppsc. The trend in recent cases is toward a narrower construction of the exception. The White House directed the OMB to issue additional guidance regarding the routine use exception in an executive memorandum on privacy sent to the heads of executive departments and agencies in 1998. Memorandum on Privacy and Personal Information in Federal Records, 34 Weekly Comp. Pres. Doc. 870 (May 14, 1998), https://www.justice.gov/paoverview_pmppifr. See also U.S. Dep’t of Justice, Off. of Info. Pol’y, President Issues Privacy Act-Related Memorandum to All Federal Agencies, in FOIA Update, Vol. XIX, No. 2, at 1, https://www.justice.gov/oip/blog/foia-update-president-issues-privacy-act-related-memorandum-all-federal-agencies (providing summary of executive memorandum).
The routine use exception “was developed to permit other than intra-agency disclosures”; therefore “[i]t is not necessary . . . to include intra-agency transfers in the portion of the system notice covering routine uses.” OMB 1975 Guidelines, 40 Fed. Reg. at 56,742 (Dec. 4, 1975). But see O’Donnell v. DOD, No. 04-00101, 2006 WL 166531, at *8 n.8 (E.D. Pa. Jan. 20, 2006) (on motion to dismiss, disagreeing with plaintiff that “routine use” should be defined as “the disclosure of a record outside of [DOD]” and explaining that “the ‘routine use’ exception specifically states that disclosure is allowed ‘for a routine use as defined in subsection (a)(7) of [the Act]’”); cf. Shayesteh v. Raty, No. 02:05-CV-85TC, 2007 WL 2317435, at *5 (D. Utah Aug. 7, 2007) (concluding that disclosures were proper under subsection (b)(1) and explaining that purpose of disclosures was compatible with purpose of collection under subsection (b)(3)).
The routine use disclosure exception requires an agency to: (1) publish the routine use to provide constructive notice; and (2) disclose records only when compatible with the purpose for which the record was collected; some courts also have required agencies to provide actual notice in accordance with subsection (e)(3)(C).
An agency must meet two requirements for a proper routine use disclosure under this exception: (1) an agency must publish the routine use in the Federal Register to provide constructive notice; and (2) the disclosure of the record must be compatible with the purpose for which the record was collected. See, e.g., Britt v. Naval Investigative Serv., 886 F.2d 544, 547-50 (3d Cir. 1989); Brunotte v. Johnson, 892 F. Supp. 2d 199, 207 (D.D.C. 2012); Shannon v. Gen. Elec. Co., 812 F. Supp. 308, 316 (N.D.N.Y. 1993).
The Court of Appeals for the Ninth Circuit has added a third requirement for this exception, which the Court of Appeals for the District of Columbia Circuit subsequently adopted: actual notice at the time the information is collected from the individual of the purpose(s) for which the information will be used. See 5 U.S.C. § 552a(e)(3)(C); Covert v. Harrington, 876 F.2d 751, 754-56 (9th Cir. 1989) (discussed below); USPS v. Nat’l Ass’n of Letter Carriers, 9 F.3d 138, 146 (D.C. Cir. 1993).
a. Federal Register Constructive Notice
Before relying on the routine use disclosure exception, an agency must publish in the Federal Register each routine use, including the categories of users and the purpose of such use.
The notice requirement of the routine use exception “is intended to serve as a caution to agencies to think out in advance what uses [they] will make of information.” 120 Cong. Rec. 40,881 (1974), reprinted in Source Book at 987. Indeed, a routine use could be deemed facially invalid if it fails to satisfy subsection (e)(4)(D), and specify “the categories of users and the purpose of such use.” See Britt, 886 F.2d at 547-48 (dictum) (suggesting that routine use, 50 Fed. Reg. 22,802-03 (May 29, 1985) (permitting disclosure to “federal regulatory agencies with investigative units” is overbroad because it “does not provide adequate notice to individuals as to what information concerning them will be released and the purposes of such release); cf. Krohn v. DOJ, No. 78-1536, slip op. at 4-7 (D.D.C. Mar. 19, 1984) (“[T]o qualify as a ‘routine use,’ the agency must . . . publish in the Federal Register . . . ‘each routine use of the records contained in the system, including the categories of users and the purpose of such use.’”), reconsideration granted & vacated in non-pertinent part, (D.D.C. Nov. 29, 1984) (discussed below).
The scope of the routine use disclosure exception is limited to the published terms of the claimed routine use.
It is well settled that the “scope of [a] routine use[ ] is confined by the published definition.” Doe v. Naval Air Station, Pensacola, Fla., 768 F.2d 1229, 1231 (11th Cir. 1985); see also Parks v. IRS, 618 F.2d 677, 681-82 (10th Cir. 1980); Tran v. Treasury, 351 F. Supp. 3d 130, 137 (D.D.C. 2019); Local 2047, AFGE v. Def. Gen. Supply Ctr., 423 F. Supp. 481, 484-86 (E.D. Va. 1976), aff’d, 573 F.2d 184 (4th Cir. 1978). In other words, a particular disclosure is unauthorized if it does not fall within the clear terms of the routine use. See, e.g., Swenson v. USPS, 890 F.2d 1075, 1078 (9th Cir. 1989) (stating that, consistent with Federal Register notice, “[d]isclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual”); Tijerina v. Walters, 821 F.2d 789, 798 (D.C. Cir. 1987) (VA’s unsolicited letter notifying state board of bar examiners of possible fraud did not qualify for Privacy Act’s routine use exception because the published routine use only permitted disclosure based upon official request of state agency and no such request was made); Doe v. DiGenova, 779 F.2d 74, 86 (D.C. Cir. 1985) (holding routine use exception inapplicable to VA psychiatric report because published routine use allowed referral of records to law enforcement officials only when records themselves indicated violation of law, and record itself did not “indicate[ ] . . . a potential violation of law”); Tran, 351 F. Supp. 3d at 137 (holding that routine use allowing disclosure to “a Federal . . . agency . . .[of] information relevant or necessary to hiring or retaining an employee . . . or other benefit” did not permit intra-agency disclosure of plaintiff’s performance evaluation in connection with plaintiff’s detail request); Shearson v. DHS, No. 1:06 CV 1478, 2012 WL 398444, at *3 (N.D. Ohio Feb. 6, 2012) (finding, where published routine use required agency first to be “aware of an indication of a violation or potential violation of” law and individual alleged that she had no criminal record, plaintiff “fairly alleges that defendants did not meet the ‘routine use’ exception because the disclosing agency could not have been aware of any wrongful behavior”); Cooper v. FAA, No. 3:07-cv-01383, slip op. at 14-15 (N.D. Cal. Aug. 22, 2008) (concluding that “when DOT-OIG sent the name, social security number, date of birth and gender of approximately 45,000 pilots to SSA-OIG, it was not because those records indicated a violation or potential violation of the law,” as required by language of DOT routine use), rev’d on other grounds, 596 F.3d 538 (9th Cir. 2010), rev’d on other grounds, 131 S. Ct. 3025 (2012); Bechhoefer v. DOJ, 179 F. Supp. 2d 93, 101-02 (W.D.N.Y. 2001) (finding, that where letter was collected by agency due to its initial interest in investigating plaintiff’s allegations of illegal drug activity by local law enforcement agency and was disclosed to that agency’s investigator, whose interest was in investigating possible unlawful, non-drug-related activity by plaintiff himself, such disclosure was not proper pursuant to routine use providing for disclosure to state and local law enforcement because “it is difficult to see how [the] disclosure could be said to have been compatible with the purpose for which the letter was collected”), aff’d on other grounds, 312 F.3d 563 (2002), cert. denied sub nom. Bechhoefer v. DEA, 539 U.S. 514 (2003); Kvech v. Holder, No. 10-cv-545, 2011 WL 4369452, at *3-4 (D.D.C. Sept. 19, 2011) (ruling that dismissal was not warranted where “record does not contain any evidence regarding precisely what information was disclosed . . . and the extent to which the disclosures fell inside or outside the confines of” the routine use); Pontecorvo v. FBI, No. 00-1511, slip op. at 13-15 (D.D.C. Sept. 30, 2001) (denying agency summary judgment and ordering discovery to determine whether agency “overstepped [the] explicit restrictions” contained in its routine use); Vargas v. Reno, No. 99-2725, slip op. at 3, 12-13 (W.D. Tenn. Mar. 31, 2000) (stating that routine use exception did not apply to disclosure of plaintiff’s record to DOJ Inspector General agent conducting investigation of another employee because record was “‘owned’ by the Office of Personnel Management”; “The mere existence of an investigation at a facility is not sufficient to allow an investigating agent access to the records of every employee who is employed at that facility.”); Greene v. VA, No. C-76-461-S, slip op. at 3-6 (M.D.N.C. July 3, 1978) (holding routine use exception inapplicable to VA’s disclosure of medical evaluation to state licensing bureau because routine use permitted disclosure only to facilitate VA decision); see also Covert v. Harrington, 667 F. Supp. 730, 736-39 (E.D. Wash. 1987), aff’d on other grounds, 876 F.2d 751 (9th Cir. 1989).
When interpreting a claimed routine use, courts have generally deferred to agency interpretation.
An agency’s construction of its routine use should be entitled to deference. See Air Force v. FLRA, 104 F.3d 1396, 1402 (D.C. Cir. 1997) (according great deference to OPM’s interpretation of its routine use); FLRA v. Treasury, 884 F.2d 1446, 1455-56 (D.C. Cir. 1989) (“For purposes of determining the scope of OPM’s routine use notice . . . an official OPM interpretation would be entitled to great deference.”); Makowski v. United States, 27 F. Supp. 3d 901, 912 (N.D. Ill. 2014) (deferring to, and finding reasonable, agencies’ interpretation and application of Enhanced Border Security Act because Court found statute ambiguous as to what it required FBI to do upon receiving plaintiff’s fingerprints, thus finding publication requirement of FBI’s routine use exception to have been met); Radack v. DOJ, 402 F. Supp. 2d 99, 106 n.7 (D.D.C. 2005) (“The court must grant ‘great deference’ to agency interpretations of routine uses.”); cf. Stafford, 437 F. Supp. 2d at 1119 (relying on SSA regulations for proposition that “SSA generally would consider a use to be compatible if it relates to determining eligibility for needs-based income maintenance . . . or related medical benefits for low-income people” and concluding that SSA’s disclosure of child abuse suspect’s “precise medical diagnosis to [California Child Protective Services] . . . was not compatible with the purpose for which the information was collected”). But see NLRB v. USPS, 790 F. Supp. 31, 33 (D.D.C. 1992) (rejecting Postal Service’s interpretation of its own routine use).
b. Compatibility
The term “compatible” is not defined in the Privacy Act, and agencies must assess, on a case-by-case basis, when a disclosure is compatible in accordance with the routine use disclosure exception.
The precise meaning of the term “compatible” is uncertain and must be assessed on a case-by-case basis. According to OMB, the “compatibility” concept encompasses (1) functionally equivalent uses and (2) other uses that are necessary and proper. OMB Call Detail Guidance, 52 Fed. Reg. at 12,993, https://www.justice.gov/paoverview_omb-87-cd.
In Britt, an early, leading case on “compatibility,” the Court of Appeals for the Third Circuit ruled that the Naval Investigative Service’s gratuitous disclosure of records, describing a then-pending criminal investigation of a Marine Corps reservist, to that individual’s civilian employer (the Immigration and Naturalization Service) was not “compatible” with the “case-specific purpose for collecting” such records. 886 F.2d at 547-50. Holding that the employment/suitability purpose for disclosure was incompatible with the criminal law enforcement purpose for collection, the Third Circuit deemed significant that “[t]here is nothing in the record suggesting that the [Immigration and Naturalization Service] was conducting its own criminal investigation of the same activity or any other activity” by the subject and that the records at issue concerned “merely a preliminary investigation with no inculpatory findings.” Id. at 549-50. Employing especially broad language, the Third Circuit pointedly condemned the agency’s equating of “compatibility” with mere “relevance” to the recipient entity, observing that “[t]here must be a more concrete relationship or similarity, some meaningful degree of convergence, between the disclosing agency’s purpose in gathering the information and in its disclosure.” Id. (citing Covert, 876 F.2d at 755 (dictum)); see also Chichakli v. Tillerson, 882 F.3d 229, 233-34 (D.C. Cir. 2018) (holding that purpose of collection of plaintiff’s identifying information by State Department and Office of Foreign Assets Control was to investigate whether to designate plaintiff for economic sanctions and implement sanctions, which was “precisely aligned” with purpose of disclosure – to implement sanctions by making information public); Townsend v. United States, 236 F. Supp. 3d 280, 318 (D.C. Cir. 2017); Mazaleski v. Truesdale, 562 F.2d 701, 713 n.31 (D.C. Cir. 1977) (dictum); Ames v. DHS 153 F. Supp. 3d 342, 347 (D.D.C. 2016) (citing Britt and finding that DHS OIG had prepared report on plaintiff to determine whether plaintiff had committed misconduct in national security position, and its purpose in disclosing report to plaintiff’s new agency was precisely same, to prevent misconduct by plaintiff at another national security agency), aff’d 861 F.3d 238 (D.C. Cir. 2017); accord Swenson, 890 F.2d at 1078; cf. Quinn v. Stone, 978 F.2d 126, 139 (3d Cir. 1992) (Nygaard, J., dissenting) (concluding that disclosure was authorized by routine use because disclosure was compatible with one of purposes for collection, even if not compatible with main purpose for collection).
The Court of Appeals for the D.C. Circuit interpreted the term “compatibility” in considering a routine use that provided for disclosure to labor organizations as part of the collective bargaining process. The court stated that “common usage” of the word would require simply that “a proposed disclosure would not actually frustrate the purposes for which the information was gathered.” USPS, 9 F.3d at 144. The D.C. Circuit recognized the “far tighter nexus” required by the Third and Ninth Circuits in Britt and Swenson, which is consistent with the legislative history, but stated:
Whatever the merit of the decisions of prior courts that have held …that a finding of a substantial similarity of purpose might be appropriate in the non-labor law context in order to effectuate congressional intent, the compatibility requirement imposed by section 552a(a)(7) cannot be understood to prevent an agency from disclosing to a union information as part of the collective bargaining process.
Id. at 145. In a concurring opinion, Judge Williams agreed with the disposition of the case, but noted that he did not share the “belief that the meaning of ‘compatible’ . . . may depend on the identity of the entity to which information is being disclosed.” Id. at 147 n.1 (Williams, J., concurring). Rather, seeing “no conflict between the purposes for which the information was collected and those for which it will be disclosed,” he found the disclosure to be compatible without further inquiry. Id. at 146-47. But cf. Pontecorvo v. FBI, No. 00-1511, slip op. at 10-11 (D.D.C. Sept. 30, 2001) (recognizing the D.C. Circuit’s holding in USPS case, but finding “the test articulated by the Third and Ninth circuits to be controlling” in the non-labor law context).
OMB guidelines, and some courts, have found that routine use disclosures to law enforcement agencies in the context of investigations or prosecutions, or when the record indicates a possible violation of law, are “compatible” disclosures under the routine use disclosure exception.
Two examples of “compatible” routine uses frequently occur in the law enforcement context. First, in the context of investigations or prosecutions, law enforcement agencies routinely may share law enforcement records with one another. See OMB 1975 Guidelines, 40 Fed. Reg. at 28,955. (“Records in law enforcement systems may also be disclosed for law enforcement purposes when that disclosure has properly been established as a ‘routine use’; e.g., . . . transfer by a law enforcement agency of protective intelligence information to the Secret Service.”); see also, e.g., 28 U.S.C. § 534 (2018) (requiring Attorney General to exchange criminal records with “authorized officials of the Federal Government . . . , the States . . . , Indian tribes, cities, and penal and other institutions”).
Second, agencies routinely may disclose to law enforcement agencies for purposes of investigation or prosecution any records indicating a possible violation of law (regardless of the purpose for collection) if the head of the law enforcement agency specifically requests the record in writing from the agency that maintains the record. See OMB 1975 Guidelines, 40 Fed. Reg. at 28,953, 28,955, (remarks of Congressman Moorhead); 120 Cong. Rec. 36,967, 40,884 (1974), reprinted in Source Book at 957-58, 995; see also, e.g., 28 U.S.C. § 535(b) (2018) (requiring agencies of executive branch to report expeditiously to U.S. Attorney General “[a]ny information, allegation, matter, or complaint” relating to crimes involving government officers and employees).
These compatible use disclosures to law enforcement agencies have been criticized on the ground that they circumvent the more restrictive requirements of subsection (b)(7). See Privacy Commission Report, at 517-18, https://www.justice.gov/paoverview_ppsc; see also Britt, 886 F.2d at 548 n.1 (dictum); Covert, 667 F. Supp. at 739, 742 (dictum). They never have been challenged successfully on that basis, however. Indeed, courts routinely have upheld disclosures made pursuant to such routine uses. See, e.g., Bansal v. Pavlock, 352 F. App’x 611, 613-14 (3d Cir. 2009) (upholding disclosure of detainee’s recorded telephone conversations by Marshals Service to government case agent, who disclosed recording to interpreter, who disclosed recording to second interpreter); Weinberger v. Grimes, No. 07-6461, 2009 WL 331632, at *8 (6th Cir. Feb. 10, 2009) (stating that BOP routine use “includes disclosure to federal law enforcement agencies for ‘court-related purposes’ including ‘civil court actions’”); Shearson v. Holder, 865 F. Supp. 2d 850, 870 (N.D. Ohio 2011) (ruling that FBI “dissemination of watchlist information to CBP officers to facilitate their border security responsibilities” fell within published routine use to agencies “engaged in terrorist screening”); Ray v. DHS, No. H-07-2967, 2008 WL 3263550, at *12-13 (S.D. Tex. Aug. 7, 2008) (discussing disclosure by OIG of results of investigation concerning plaintiff’s SF 85P to U.S. Attorney’s Office was proper because it was covered by published routine use); Freeman v. EPA, No. 02-0387, 2004 WL 2451409, at *6-7 (D.D.C. Oct. 25, 2004) (concluding that “disclosure [by DOD investigator hired by EPA] of the plaintiff’s records concerning drug testing schedules and test results to AUSA . . . for the purposes of [AUSA’s] investigation of potentially criminal activity is a disclosure that is ‘compatible with the purpose for which [those records were] collected’”); Nwangoro v. Army, 952 F. Supp. 394, 398 (N.D. Tex. 1996) (finding disclosure by Military Police of financial records obtained in ongoing criminal investigation to foreign customs officials likewise involved in investigation of possible infractions of foreign tax and customs laws was “permitted by the ‘routine use’ exception and d[id] not constitute a violation of the Privacy Act”); Little v. FBI, 793 F. Supp. 652, 655 (D. Md. 1992) (finding that disclosure did not violate Privacy Act prohibition because it was made pursuant to routine use that allows disclosure of personnel matters to other government agencies when directly related to enforcement function of recipient agency), aff’d on other grounds, 1 F.3d 255 (4th Cir. 1993).
The courts have found, however, that a disclosure does not fall within a compatible routine use if the agency is not sharing with a law enforcement agency in the context of an investigation or prosecution, there is no possible violation of law, or the law enforcement agency head has not specifically requested the record in writing. For example, a disclosure is not compatible if it is made to agencies other than the appropriate ones. See Dick v. Holder, 67 F. Supp. 3d 167, 179 (D.D.C. 2014) (holding that FBI’s disclosure of information to law enforcement agencies was not compatible with routine use because information “was not disseminated just to ‘appropriate Federal, State, or local agenc[ies]’”).
Similarly, disclosures are not compatible with a routine use if the record does not reveal a potential violation of law. In Covert, 667 F. Supp. at 736-39, the District Court for the Eastern District of Washington held that a routine use permitting the Department of Energy’s Inspector General to disclose to the DOJ relevant records when “a record” indicates a potential violation of law did not permit the disclosure of personnel security questionnaires submitted by the plaintiffs because such questionnaires, on their face, did not reveal potential violations of law. The court rejected the agency’s argument that disclosure was proper because each questionnaire was disclosed as part of a prosecutive report that (when viewed as a whole) did reveal a potential violation of law. Id. at 736-37. Further, the court found that the Inspector General’s disclosure of the questionnaires to the DOJ (for a criminal fraud prosecution) was not compatible with the purpose for which they originally were collected by the Department of Energy (for a security-clearance eligibility determination), notwithstanding the fact that the Inspector General subsequently acquired the questionnaires – on an intra-agency “need to know” basis pursuant to 5 U.S.C. § 552a(b)(1) – for the purpose of a fraud investigation. Id. at 737-39.
On cross-appeals, a divided panel of the Court of Appeals for the Ninth Circuit affirmed the district court’s judgment on other grounds. Covert, 876 F.2d at 754-56. The panel majority held that the Department of Energy’s failure to provide actual notice of the routine use on the questionnaires at the time of original collection, under subsection (e)(3)(C), precluded the Department of Energy from later invoking that routine use under subsection (b)(3). Id. at 755-56; see also Puerta v. HHS, No. 99-55497, 2000 WL 863974, at *1-2 (9th Cir. June 28, 2000) (following Covert but finding that agency had provided notice of routine use on form used to collect information), aff’g No. EDCV 94-0148, slip op. at 7 (C.D. Cal. Jan. 5, 1999); USPS, 9 F.3d at 146 (citing Covert with approval and remanding case for factual determination as to whether subsection (e)(3)(C) notice was given); Stafford, 437 F. Supp. 2d at 1119-20 (adhering to Covert and finding that SSA notified plaintiff of potential uses “on three occasions when collecting her information,” even though these notifications were non-specific references to the Federal Register); Pontecorvo, No. 00-1511, slip op. at 12 (D.D.C. Sept. 30, 2001) (stating that agency must comply with subsection (e)(3)(C) “in order to substantiate an exception for ‘routine use’”). Prior to Covert, no other court had required actual notice. See the additional discussion under “5 U.S.C. § 552a(e)(3) - Notice Requirements,” below.
Since Krohn v. DOJ, agencies have narrowed the scope of their routine use disclosures during legal proceedings, disclosing only records “arguably relevant to the litigation.”
Although initially agencies published broad routine uses, they have been narrowed since the District Court for the District of Columbia issued its decision in Krohn v. DOJ, No. 78-1536, slip op. at 4-7 (D.D.C. Mar. 19, 1984). In Krohn, the court invalidated an FBI routine use allowing for “dissemination [of records] during appropriate legal proceedings,” finding that such a routine use was impermissibly “vague” and was “capable of being construed so broadly as to encompass all legal proceedings.” In response to Krohn, OMB issued guidance to agencies in which it suggested a model routine use – employing a “relevant and necessary to the litigation” standard – to permit the public filing of protected records with a court. OMB Bedell Memo, https://www.justice.gov/paoverview_omb-85. Many agencies, including the DOJ, have adopted “post-Krohn” routine uses designed to authorize the public filing of relevant records in court. See, e.g., 66 Fed. Reg. 36,593, 36,594 (July 12, 2001) (routine use [number 7] applicable to records in DOJ’s “Civil Division Case File System”); 63 Fed. Reg. 8,666, 8,667-68 (Feb. 20, 1998) (routine uses [letters “o” and “p”] applicable to records in U.S. Attorney’s Office’s “Civil Case Files”).
The “post-Krohn” routine uses, such as the ones cited above that employ an “arguably relevant to the litigation” standard, have withstood challenges in the courts. See, e.g., Jackson v. FBI, No. 02-C-3957, 2007 WL 2492069, at *8 (N.D. Ill. Aug. 28, 2007) (allowing U.S. Attorney’s filing in court of plaintiff’s unsuccessful application for FBI employment during pendency of plaintiff’s Title VII suit because application was “at the very heart of his civil suit”); Russell v. GSA, 935 F. Supp. 1142, 1145-46 (D. Colo. 1996) (finding disclosure in public pleadings of information regarding investigation of plaintiff was permissible under routine use providing for disclosure in proceeding before court where agency is party and records are determined “to be arguably relevant to the litigation”); Osborne v. USPS, No. 94-30353, slip op. at 6-9 (N.D. Fla. May 18, 1995) (holding on alternative ground that disclosure of plaintiff’s injury-compensation file to retired employee who had prepared file and who had been subpoenaed by plaintiff and was expecting to be deposed on matters documented in file was proper pursuant to routine use providing for disclosures “incident to litigation” and “in a proceeding before a court” because “deposition was a proceeding before [the] Court”); Sheptin v. DOJ, No. 91-2806, 1992 U.S. Dist. LEXIS 6221, at *6-7 (D.D.C. Apr. 30, 1992) (finding no wrongful disclosure where agency routine uses permit use of presentence report during course of habeas proceeding). Such challenges could arise from an argument that the routine use does not satisfy the “compatibility” requirement of subsection (a)(7) of the Act, cf. Britt, 886 F.2d at 547-50 (holding mere “relevance” to recipient entity is improper standard for “compatible” routine use disclosure).
Courts generally have held that routine use disclosures to further an investigation or enabled the receiving or disclosing agency to fulfill its mission are “compatible” disclosures under the routine use disclosure exception.
The courts generally have found that disclosing information is pursuant to a compatible routine use when the information furthered an investigation or enabled either agency to fulfill its mission. See, e.g., Taylor v. United States, 106 F.3d 833, 836-37 (8th Cir. 1997) (finding routine use exception applied to disclosure of federal taxpayer information collected for purpose of federal tax administration to state tax officials for purpose of state tax administration), aff’g Taylor v. IRS, 186 B.R. 441, 446-47, 453-54 (N.D. Iowa 1995); Alphin v. FAA, No. 89-2405, 1990 WL 52830, at *1 (4th Cir. Apr. 13, 1990) (finding routine use exception applied to disclosure of enforcement investigation final report to subject’s customers); Hastings v. Judicial Conference of the United States, 770 F.2d 1093, 1104 (D.C. Cir. 1985) (finding routine use exception applied to disclosure of criminal investigative records to judicial committee investigating judge); United States v. Miller, 643 F.2d 713, 715 (10th Cir. 1981) (determining that records submitted by individual to parole officer became part of DOJ files and DOJ’s use in criminal investigation constitutes routine use); Lugo v. DOJ, 214 F. Supp. 3d 32 (D.D.C. 2016) (finding “directly on point” routine use providing “a record relating to a person held in custody . . . after . . . conviction . . . may be disseminated” to a state parole authority”), aff’d Lugo v. DOJ, 2018 WL 1896491 (D.C. Cir. 2018); Lewis v. SSA, 2015 WL 9664967 (E.D. Tex. 2015) (finding routine use permitted disclosure to law enforcement agency out of concern for safety of SSA employees); Makowski v. United States, 27 F. Supp. 3d 901, 909-912 (N.D. Ill. 2014) (determining that FBI’s disclosure of fingerprints of foreign-born U.S. citizen’s fingerprints upon arrest to DHS pursuant to the Enhanced Border Security and Visa Entry Reform Act of 2002 is “compatible with the published purposes for which the FBI collected [the fingerprint data]” and its routine use that “permits disclosures ‘[t]o such recipients and under such circumstances and procedures as are mandated by Federal statute or treaty’”); Middlebrooks v. Mabus, No. 1:11cv46, 2011 WL 4478686, at *7 (E.D. Va. Sept. 23, 2011) (finding disclosure of personnel records about plaintiff, a nurse, to state nursing board, HHS, and other healthcare reporting entities fell within routine use); Alexander v. FBI, 691 F. Supp. 2d 182, 191 (D.D.C. 2010) (finding routine use exception applied to disclosure of individuals’ background reports to White House to determine trustworthiness for granting White House access), aff’d, 456 F. App’x 1 (D.C. Cir. 2011); Lucido v. Mueller, No. 08-15269, 2009 WL 3190368, at *5-6 (E.D. Mich. Sept. 29, 2009) (finding routine use exception applied to FBI’s disclosure of plaintiff’s arrest and indictment on white-collar crimes to financial self-regulatory body where disclosure was required by federal law), aff’d, 427 F. App’x 497 (6th Cir. 2011); Contursi v. USPS, No. 98CV112, slip op. at 2-3 (S.D. Cal. July 6, 1999) (discussing disclosure to county agency in response to its request in connection with investigation of employee), aff’d, 238 F.3d 428 (9th Cir. 2000) (unpublished table decision); Jones v. Runyon, 32 F. Supp. 2d 873, 876 (N.D. W. Va. 1998) (discussing disclosure to credit reporting service of information about plaintiff when requesting employment reports in course of routine investigation of possible workers’ compensation fraud), aff’d, 173 F.3d 850 (4th Cir. 1999) (unpublished table decision); Choe v. Smith, No. C-87-1764R, slip op. at 10-11 (W.D. Wash. Apr. 20, 1989) (discussing INS’s disclosure to its informant during investigation “to elicit information required by the Service to carry out its functions and statutory mandates”), aff’d, 935 F.2d 274 (9th Cir. 1991) (unpublished table decision); Kimberlin v. DOJ, 605 F. Supp. 79, 82-83 (N.D. Ill. 1985) (discussing BOP’s disclosure of prisoner’s commissary account record to probation officer), aff’d, 788 F.2d 434 (7th Cir. 1986); Burley v. DEA, 443 F. Supp. 619, 623-24 (M.D. Tenn. 1977) (analyzing transmittal of DEA records to state pharmacy board); Harper v. United States, 423 F. Supp. 192, 198-99 (D.S.C. 1976) (analyzing IRS’s disclosure of plaintiff’s identity to other targets of investigation); but cf. Sussman v. Marshals Serv., 494 F.3d 1106, 1122-23 (D.C. Cir. 2007) (vacating grant of summary judgment to Marshals Service because plaintiff’s allegations that agents were “‘yelling and screaming [their allegations and theories in an effort to intimidate]’ suggests disclosures went beyond what was ‘necessary to obtain information or cooperation’” within terms of published routine use).
Courts have generally held that routine use disclosures to process an individual’s application for a benefit, program participation, or a position are “compatible” disclosures under the routine use disclosure exception.
Similarly, the courts have concluded that where an individual is applying for a benefit, program, or position, an agency may disclose information during the application process as a compatible routine use. Puerta v. HHS, No. 99-55497, 2000 WL 863974, at *1-2 (9th Cir. June 28, 2000) (finding routine use exception permitted disclosure of plaintiff’s grant proposal to qualified expert who was member of peer review group for evaluation of proposal), aff’g No. EDCV 94-0148, slip op. at 7 (C.D. Cal. Jan. 5, 1999); Budik v. United States, 949 F.Supp.2d 14, 29 (D.D.C. Mar. 7, 2013) (holding that disclosure of plaintiff’s military performance assessment form for medical personnel by United States Army was compatible with use for which it was collected, “namely to ‘manage credentials and privileges of health care providers in the Military Health System’”), aff’d, 2013 WL 6222903 (D.C. Cir. Nov. 19, 2013); Reed v. Navy, 910 F. Supp. 2d 32, 42-43 (D.D.C. 2012) (finding disclosures made in process of investigating allegations against plaintiff and his truthfulness about those allegations for purpose of assessing plaintiff’s fitness for duty as police officer fell within defendant’s “requesting information” routine use, whereby records may be disclosed to federal, state, and local authorities if necessary to evaluate plaintiff’s fitness for duty); Doe v. DOJ, 660 F. Supp. 2d 31, 47-48 (D.D.C. 2009) (discussing disclosure of information regarding employee’s mental state, collected for purpose of coordinating his reasonable accommodation request, to state unemployment commission and to contractor to determine employee’s eligibility for benefits); Benham v. Rice, No. 0301127, 2005 WL 691871, at *5-6 (D.D.C. Mar. 24, 2005) (discussing disclosure of agency employee’s transfer request to AUSA, who had represented agency in prior discrimination suit brought by employee against agency, so that AUSA “could attempt to settle the pending litigation with [the employee]”); Fattahi v. ATF, 186 F. Supp. 2d 656, 661-64 (E.D. Va. 2002) (discussing disclosure of fact that plaintiff had applied for federal firearms license to condominium association’s counsel for purposes of determining whether firearms dealer could operate out of plaintiff’s specific residential unit), aff’d, 328 F.3d 176, 181 (4th Cir. 2003) (agreeing with district court “that ATF’s routine use must be given ‘a practical reading’ such that disclosures are in accordance with the routine use when they are ‘reasonably necessary to verify pertinent information, [and] not just [when] verification cannot conceivably be obtained by any other means’”); Mumme v. Labor, 150 F. Supp. 2d 162, 174 (D. Me. 2001) (disclosure to agency’s examining physician from investigation file detailing possible health care fraud by former government worker who was being examined regarding continuing eligibility for disability benefits), aff’d, No. 01-2256 (1st Cir. June 12, 2002); Blazy v. Tenet, 979 F. Supp. 10, 26 (D.D.C. 1997) (discussing CIA’s disclosure of information about employee to FBI while FBI was investigating employee’s application for FBI employment), summary affirmance granted, No. 97-5330, 1998 WL 315583 (D.C. Cir. May 12, 1998); Magee v. USPS, 903 F. Supp. 1022, 1029 (W.D. La. 1995) (discussing disclosure of employee’s medical records to clinical psychologist hired by agency to perform fitness-for-duty examination on employee), aff’d, 79 F.3d 1145 (5th Cir. 1996) (unpublished table decision); McNeill v. IRS, No. 93-2204, 1995 U.S. Dist. LEXIS 2372, at *6 (D.D.C. Feb. 7, 1995) (discussing disclosure of IRS personnel records to prospective federal agency employer); but cf. Brunotte v. Johnson, 892 F. Supp. 2d 199, 207 (D.D.C. 2012) (finding “unclear on the current record” whether disclosure to prospective employer of plaintiff’s prior “alleged travel reimbursement infractions” to “see if [p]laintiff had perpetrated another fraud by submitting false employment application information” was “compatible with the purpose for which the information was collected”).
Courts have generally held that routine use disclosures to other parties in litigation are “compatible” disclosures under the routine use exception.
The courts also have determined that disclosure to other parties in litigation constitutes a compatible routine use. Burnett v. DOJ, 213 F. App’x 526, 528 (9th Cir. 2006) (applying routine use exception to disclosure to criminal defendant, against whom plaintiff was to testify, of prior ruling that plaintiff was not credible); Pippinger v. Rubin, 129 F.3d 519, 531-32 (10th Cir. 1997) (finding routine use exception applied to disclosure of plaintiff’s personnel information to MSPB in deposition testimony in another individual’s related MSPB proceeding, and to other individual, his attorney, and court reporter in conjunction with MSPB proceeding); Mount v. USPS, 79 F.3d 531, 534 (6th Cir. 1996) (finding routine use exception applied to disclosure of plaintiff’s medical information to union official representing him in administrative action in which his mental health was central issue); (ElHelbawy v. Holder, 2015 WL 5676987 (D. Colo. 2015) (concluding that agency was authorized to disclose information from plaintiff’s discrimination claim based on routine use permitting disclosure of information “to another federal agency, to a court, or to a party in litigation before a court or in an administrative proceeding being conducted by a federal agency when the government is a party to the judicial or administrative proceeding”); Feathers v. United States, 2015 WL 5263056 (N.D. Calif. 2015) (finding that routine use provided records may be used in proceedings involving federal securities laws in which SEC is party permitted disclosure in SEC case alleging violations of federal securities laws); Mandel v. OPM, 244 F. Supp. 2d 146, 152 (E.D.N.Y. 2003) (alternative holding) (discussing disclosure of information about plaintiff – including summary of charges, supporting information, and copy of OPM’s investigation – to his former supervisors in connection with their testimony at plaintiff’s MSPB hearing following determination that plaintiff was unsuitable for federal employment due to prior employment record and failure to disclose history), aff’d on other grounds, 79 F. App’x 479 (2d Cir. 2003); Lachenmyer v. Frank, No. 88-2414, slip op. at 4 (C.D. Ill. July 16, 1990) (holding disclosure of investigative report to persons at arbitration hearing is proper under routine use permitting disclosure of “record relating to a case or matter” in “hearing in accordance with the procedures governing such proceeding or hearing”).
The Act’s legislative history recognizes the “compatibility” of a routine use invoked to publicly file records in court. See 120 Cong. Rec. at 40,884, reprinted in Source Book at 858, 995, (routine use appropriate where Justice Department “presents evidence [(tax information from IRS)] against the individual” in court).
Courts have generally held that routine use disclosures to Congress are “compatible” disclosures under the routine use disclosure exception.
Disclosures to Congress also have been deemed compatible routine uses by the courts. See Gowan v. Air Force, 148 F.3d 1182, 1187, 1194 (10th Cir. 1998) (stating disclosure of information regarding individual to Members of Congress in response to inquiries made pursuant to individual’s letters requesting assistance was compatible and thus “would likely be protected under the routine use exception”); Feldman v. CIA, 797 F. Supp. 2d 29, 38-39 (D.D.C. 2011) (finding disclosure to Congressional oversight committee complies with statutory reporting requirements); Chang v. Navy, 314 F. Supp. 2d 35, 45-46 (D.D.C. 2004) (discussing disclosure to Members of Congress for purposes of responding to constituent inquiries where, if constituent is other than record subject, only information releasable under FOIA could be disclosed); Harry v. USPS, 867 F. Supp. 1199, 1206-07 (M.D. Pa. 1994) (discussing disclosure of documents regarding individual’s employment history, including details of settlement agreement, in response to congressional inquiries “made at the prompting of that individual”), aff’d sub nom. Harry v. USPS, Marvin T. Runyon, 60 F.3d 815 (3d Cir. 1995) (unpublished table decision).
c. Actual Notice
The Ninth and D.C. Circuits also require that an agency give actual notice to an individual at the time the information is collected in accordance with the notice requirements of subsection (e)(3)(C). Covert, 876 F.2d at 754-756; USPS v. Nat’l Ass’n of Letter Carriers, 9 F.3d at 140; accord Puerta v. HHS, No. 99-55497, 2000 WL 863974, at *1-2 (9th Cir. June 28, 2000), aff’g No. EDCV 94-0148, slip op. at 7 (C.D. Cal. Jan. 5, 1999); cf. Stafford v. SSA, 437 F. Supp. 2d 1113, 1119-20 (N.D. Cal. 2006) (adhering to Covert and finding that SSA notified plaintiff of potential uses “on three occasions when collecting her information”; explaining that notice need not “anticipate and list every single potential permutation of a routine use in order to invoke this exception”; and stating, “The Court is not persuaded that Congress intended to place such an impractical burden on federal agencies, which would in effect severely curtail the very exception that Congress sought to carve out in the interest of practicality.”). The Court of Appeals for the D.C. Circuit cited this aspect of Covert with approval and remanded a case for determination of whether (e)(3)(C) notice was provided, stating that “[a]lthough the statute itself does not provide, in so many terms, that an agency’s failure to provide employees with actual notice of its routine uses would prevent a disclosure from qualifying as a ‘routine use,’ that conclusion seems implicit in the structure and purpose of the Act.” USPS v. Nat’l Ass’n of Letter Carriers, 9 F.3d at 146; see also Minshew v. Donley, 911 F. Supp. 2d 1043, 1073 (D. Nev. 2012) (“While a report to a non-federal employer falls within a routine use, Air Force has failed to respond to [plaintiff’s] argument that OPM did not inform [plaintiff] on the form which OPM used to collect the information, or on a separate form provided to [plaintiff], that [plaintiff’s] federal employer may make unsolicited disclosures to private employers regarding the circumstances surrounding [plaintiff’s] separation from federal employment.”). But cf. Thompson v. State, 400 F. Supp. 2d 1, 16-17 (D.D.C. 2005) (discussed below under Agency Requirements, “5 U.S.C. § 552a(e)(3) - Inform Individuals when Asking to Collect Information”).
d. Additional Routine Use Matters
Some, but not all, courts of appeals have required agencies to invoke the routine use disclosure exception to disclose certain records to unions.
Four courts have required an agency to invoke a routine use to permit disclosure to unions of names of employees on the theory that refusal to so disclose was an unfair labor practice under the National Labor Relations Act. See NLRB v. USPS, No. 92-2358, 1994 WL 47743, at *3-4 (4th Cir. Feb. 16, 1994); NLRB v. USPS, 888 F.2d 1568, 1572-73 (11th Cir. 1989); NLRB v. USPS, 841 F.2d 141, 144-45 & n.3 (6th Cir. 1988); NLRB v. USPS, 790 F. Supp. 31, 33 (D.D.C. 1992); see also USPS v. Nat’l Ass’n of Letter Carriers, 9 F.3d at 141-46 (holding that “if the Postal Service could disclose the information under [its routine use] then it must disclose that information, because in the absence of a Privacy Act defense the arbitrator’s award must be enforced,” but remanding case for determination as to whether proper (e)(3)(C) notice was given before requiring invocation of routine use); FLRA v. Navy, 966 F.2d 747, 761-65 (3d Cir. 1992) (alternative holding) (en banc) (holding that release to union of home addresses of bargaining unit employees pursuant to routine use was required under Federal Service Labor-Management Relations Act). But cf. NLRB v. USPS, 660 F.3d 65, 70-72 (1st Cir. 2011) (ruling that USPS routine use for disclosure “[a]s required by applicable law . . . to a labor organization” did not require automatic disclosure of aptitude tests to union because National Labor Relations Act did not require that disclosure, but instead NLRB was required to balance “the interests of the Union in the information against the privacy interests of the employees”).
In addition, the Court of Appeals for the District of Columbia Circuit, in Air Force v. FLRA, granted enforcement of a Federal Labor Relations Authority decision requiring the Air Force to disclose to a union a disciplinary letter that was issued to a bargaining unit employee’s supervisor. 104 F.3d 1396, 1399, 1401-02 (D.C. Cir. 1997). The court held that the Federal Labor-Management Relations Statute required disclosure of the letter; that because the “Union’s request f[ell] within the Act’s ‘routine use’ exception, the Privacy Act d[id] not bar disclosure”; and that the union therefore was entitled to disclosure of the letter. Id. at 1401-02.
The D.C. Circuit has held that the routine use disclosure exception does not permit disclosures solely based on a federal subpoena, as such disclosures are not permitted under the court order disclosure exception.
The D.C. Circuit concluded that a routine use for complying with a subpoena was inconsistent with the Privacy Act. See Doe v. Stephens, 851 F.2d 1457, 1465-67 (D.C. Cir. 1988) (holding that a VA routine use – permitting disclosure of records “in order for the VA to respond to and comply with the issuance of a federal subpoena” – was invalid under the Administrative Procedure Act because it was inconsistent with the Privacy Act as interpreted in Doe v. DiGenova, 779 F.2d at 78-84, which had found that disclosures pursuant to subpoenas were not permitted by the subsection (b)(11) court-order exception). But cf. Osborne v. USPS, No. 94-30353, slip op. at 6-9 (N.D. Fla. May 18, 1995) (holding on alternative ground that disclosure of plaintiff’s injury-compensation file to retired employee who had prepared file and who had been subpoenaed by plaintiff and was expecting to be deposed on matters documented in file was proper pursuant to routine use that “specifically contemplates that information may be released in response to relevant discovery and that any manner of response allowed by the rules of the forum may be employed”).
Notwithstanding the required FOIA disclosure and the consumer reporting agency disclosure exceptions, the Privacy Act disclosure provision does not provide for nonconsensual disclosures that are governed by other statutes, and agencies should rely on the routine use disclosure exception for such disclosures.
The Privacy Act does not provide for nonconsensual disclosures that are governed by other statutes except for the FOIA (subsection (b)(2)) and the Debt Collection Act (subsection (b)(12)). See, e.g., 42 U.S.C. § 653 (2018) (establishing “Parent Locator Service” and requiring agencies to comply with requests from HHS for addresses and places of employment of absent parents “[n]otwithstanding any other provision of law”). Recognizing this difficulty, the OMB 1975 Guidelines advise that “disclosures, which are in effect congressionally mandated ‘routine uses,’” should be deemed “routine uses” under subsections (e)(11) and (e)(4)(D). 40 Fed. Reg. at 28,954, ; cf. Zahedi v. DOJ, No. 10-694, 2011 WL 1872206, at *5-6 (D. Or. May 16, 2011) (holding that plaintiff’s claim for improper dissemination “fails both because the disclosure was authorized by [foreign-intelligence sharing] statute and because the dissemination falls within [agency’s] published routine uses”).
“No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains unless the disclosure would be –
(4) to the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of Title 13.” 5 U.S.C. § 552a(b)(4).
“No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains unless the disclosure would be –
(5) to a recipient who has provided the agency with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable.” 5 U.S.C. § 552a(b)(5).
OMB guidelines suggest that the statistical research disclosure exception is intended to reduce the likelihood that agencies utilize statistical records to “reconstruct” individually identifiable records.
The term “statistical record” is defined in the Act as a record that is not used in making individual determinations. 5 U.S.C. § 552a(a)(6). One might question whether this exception to subsection (b) is anomalous, because the information to be released is arguably not a “record,” see 5 U.S.C. § 552a(a)(4), or a “disclosure,” see 5 U.S.C. § 552a(b), as it is not identifiable to any individual. The OMB 1975 Guidelines, however, provide a plausible explanation, stating, “[o]ne may infer from the legislative history and other portions of the Act that an objective of this provision is to reduce the possibility of matching and analysis of statistical records with other records to reconstruct individually identifiable records.” 40 Fed. Reg. at 28,954, https://www.justice.gov/paoverview_omb-75.
“No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains unless the disclosure would be –
(6) to the National Archives and Records Administration as a record which has sufficient historical or other value to warrant its continued preservation by the United States Government, or for evaluation by the Archivist of the United States or the designee of the Archivist to determine whether the record has such value.” 5 U.S.C. § 552a(b)(6).
For a discussion of this provision, see OMB 1975 Guidelines, 40 Fed. Reg. at 28,955.
“No agency shall disclose any record which is contained in a system of records …except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless the disclosure would be—
(7) to another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency which maintains the record specifying the particular portion desired and the law enforcement activity for which the record is sought.” 5 U.S.C. § 552a(b)(7).
The law enforcement request disclosure exception allows certain disclosures, upon written request, to another agency or instrumentality for civil or criminal law enforcement purposes.
This provision allows agencies to disclose records to federal law enforcement agencies and, “upon receipt of a written request, [to] disclose a record to another agency or unit of State or local government for a civil or criminal law enforcement activity.” OMB 1975 Guidelines, 40 Fed. Reg. at 28,955.
A request for records under the subsection (b)(7) exception must be for civil or criminal law enforcement purposes. See United States v. Collins, 596 F.2d 166, 169 (6th Cir. 1979) (holding, among other reasons, disclosure of reports authored by someone suspected of fraud satisfied criminal law enforcement activity disclosure condition); SEC v. Dimensional Entm’t Corp., 518 F. Supp. 773, 774-75, 777 (S.D.N.Y. 1981) (finding disclosure was proper because SEC asked Parole Commission to release transcript in question for purpose of assisting SEC with its attempt to secure injunctive relief against defendant after SEC presented evidence that defendant will likely continue his unlawful activity).
While the head of the agency or instrumentality must generally make the written request for the law enforcement request disclosure exception, agencies may, when necessary, delegate this responsibility to officials no lower than the “section chief” level.
The request must be submitted in writing and generally must be from the head of the agency or instrumentality. See Doe v. DiGenova, 779 F.2d 74, 85 (D.C. Cir. 1985) (concluding that VA’s disclosure of veteran’s medical records in response to federal grand jury subpoena was not authorized because federal grand jury subpoena is issued by federal prosecutors, not head of an agency); Doe v. Naval Air Station, 768 F.2d 1229, 1233 (11th Cir. 1985) (“[E]xemption (b)(7) requires a written request for disclosure by the head of the agency making such request to the agency which maintains the record.”); see also Reyes v. Supervisor of DEA, 834 F.2d 1093, 1095 (1st Cir. 1987) (noting the record lacked an indication that FBI, United States Probation Office, AUSA, and BOP made a written request for records); Stafford v. SSA, 437 F. Supp. 2d 1113, 1121 (N.D. Cal. 2006) (finding improper disclosure because head of local agency did not request disclosed information from SSA in writing).
Record-requesting authority may be delegated to lower-level agency officials when necessary, but not below the “section chief” level. The Department of Justice has delegated record-requesting authority to the “head of a component or a United States Attorney, or either’s designee.” 28 C.F.R. § 6.40(c) (2014); cf. Lora v. INS, No. 2:02cv756, 2002 WL 32488472, at *2 (E.D. Va. Oct. 8, 2002) (applying subsection (b)(7) to disclosure of information from INS file upon request from Assistant United States Attorney), aff’d per curiam, 61 F. App’x 80 (4th Cir. 2003).
“No agency shall disclose any record which is contained in a system of records…except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless the disclosure would be—
(8) to a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if upon such disclosure notification is transmitted to the last known address of such individual.” 5 U.S.C. § 552a(b)(8).
Under this exception, agencies may disclose records under emergency conditions that affect an individual’s health or safety. See Schwarz v. INTERPOL, No. 94-4111, 1995 WL 94664, at *1 n.3 (10th Cir. Feb. 28, 1995) (finding unsubstantiated allegations alone do not constitute “showing of compelling circumstances”); Stafford v. SSA, 437 F. Supp. 2d 1113, 1121 (N.D. Cal. 2006) (holding that SSA did not satisfy health and safety exception because agency did not provide plaintiff requisite notice after disclosing that plaintiff received disability benefits to state child protective services to investigate possible child abuse); Schwarz v. Treasury, 131 F. Supp. 2d 142, 146-47 (D.D.C. 2000) (citing and agreeing with Schwarz v. INTERPOL), aff’d, No. 00-5453, 2001 WL 67463 (D.C. Cir. May 10, 2001); DePlanche v. Califano, 549 F. Supp. 685, 703-04 (W.D. Mich. 1982) (emphasizing emergency nature of exception to be used “where consent cannot be obtained because of time and distance and instant action is required” and noting that “this subsection was intended to apply only to such valid life and death situations as an airplane crash or epidemic”).
OMB guidelines, in apparent conflict with the text of the health or safety disclosure exception, states that the individual on whom the record pertains “need not necessarily be the individual whose health or safety is at peril.”
According to OMB 1975 Guidelines, the individual about whom records are disclosed “need not necessarily be the individual whose health or safety is at peril; e.g., release of dental records on several individuals in order to identify an individual who was injured in an accident.” 40 Fed. Reg. at 28,955 (unsubstantiated allegations that fail to be “compelling circumstances” also fail to justify the release of records to an individual who requested disclosure but who is not the subject of the records). This construction, while sensible as a policy matter, appears to conflict with the actual wording of subsection (b)(8), although the wording of this provision is not precise.
“No agency shall disclose any record which is contained in a system of records…except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless the disclosure would be—
(9) to either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee.” 5 U.S.C. § 552a(b)(9).
The congressional disclosure exception does not authorize the disclosure of a record to an individual Member of Congress acting on his or her own behalf, or on behalf of a constituent.
This exception allows for disclosure of records to Congress but does not authorize the disclosure of a Privacy Act-protected record to an individual Member of Congress acting on his or her own behalf or on behalf of a constituent. See OMB 1975 Guidelines, 40 Fed. Reg. at 28,955, OMB Supplementary Guidance, 40 Fed. Reg. at 56,742, https://www.justice.gov/paoverview_omb-75-supp; see also Swenson v. USPS, 890 F.2d 1075, 1077 (9th Cir. 1989) (determining disclosure was improper when subject of records USPS disclosed to congressman did not request disclosure); Lee v. Dearment, No. 91-2175,1992 WL 119855, at *2 (4th Cir. June 3, 1992); cf. Chang v. Navy, 314 F. Supp. 2d 35, 45-47 (D.D.C. 2004) (discussing subsection (b)(9) and parties’ dispute as to whether disclosure was allowable because it involved committee inquiry or not allowable because it involved constituent inquiry, but ultimately finding disclosure was proper pursuant to routine use permitting disclosure to Members of Congress making inquiries on behalf of constituents). See generally U.S. Dep’t of Justice, Off. of Info. Pol’y, OIP Guidance: Congressional Access Under FOIA, in FOIA Update, Vol. V, No. 1, at 3-4, http://www.justice.gov/oip/foia_updates/Vol_V_1/page3.htm (interpreting counterpart provision of FOIA).(interpreting counterpart provision of FOIA).
The Second Circuit has held that an agency may disclose records consistent with the congressional disclosure exception, even if the agency knew or reasonably should have known that the information would subsequently become public.
The Court of Appeals for the Second Circuit in Devine v. United States, held that the unsolicited disclosure of an Inspector General letter to a congressional subcommittee chairman and member fell “squarely within the ambit of § 552a(b)(9),” and rejected the appellant’s argument that subsection (b)(9) should not apply if the government agency knew or should have known that the information would eventually be released to the public. 202 F.3d 547, 551-53 (2d Cir. 2000).
“No agency shall disclose any record which is contained in a system of records…except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless the disclosure would be—
(10) to the Comptroller General, or any of his authorized representatives, in the course of the performance of the duties of the G[overnment] Account[ability] Office.” 5 U.S.C. § 552a(b)(10).
“No agency shall disclose any record which is contained in a system of records…except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless the disclosure would be—
(11) pursuant to the order of a court of competent jurisdiction.” 5 U.S.C. § 552a(b)(11).
The Privacy Act does not prohibit the disclosure of relevant records during discovery when disclosed consistent with the Privacy Act’s disclosure provision; agencies frequently utilize the court order disclosure exception during discovery.
Subsection (b)(11) permits a court of competent jurisdiction to order disclosure of Privacy Act protected information that would otherwise be prohibited from disclosure without prior written consent of the individual to whom the record pertains.
As a general proposition, the Privacy Act does not act as a shield against discovery of relevant records that are otherwise protected under the Privacy Act, and the records may become discoverable through litigation if ordered by a court. Laxalt v. McClatchy, 809 F.2d 885 (D.C. Cir. 1987). The essential point of this exception is that the Privacy Act “cannot be used to block the normal course of court proceedings, including court-ordered discovery.” Clavir v. United States, 84 F.R.D. 612, 614 (S.D.N.Y. 1979); see also, Garraway v. Ciufo, No. 1:17-cv-00533, 2020 WL 1263562 (E.D. Cal. Mar. 16, 2020); Dawson v. Great Lakes Edu. Loan Services, Inc., No. 15-cv-475-JDP, 2018 WL 9539117 (W.D. Wis. Nov. 29, 2018); Adams v. Sotelo, No. 3:16-cv-02161, 2018 WL 30199288, at *2 (S.D. Cal. June 18, 2018); Ayers v. Lee, No. 14cv542-BGS, 2017 WL 2472840, at *3 (S.D. Cal. Jun. 8, 2017); Tidwell v. Brennan, No. 1:14-cv-553, 2015 WL 40922771 (S.D. Ohio July 6, 2015); United States v. Revland, No. 5:06–HC–2212, 2011 WL 7665381, at *1 (E.D.N.C. Nov. 30, 2011); Vinzant v. United States, No. 2:06-cv-10561, 2010 WL 2674609, at *7 (E.D. La. June 30, 2010) (stating that where defendant agency objected to disclosing Privacy Act records requested in discovery, “the ‘court order exception’ to the Privacy Act will preclude any future liability for disclosure, thereby alleviating the government’s concern and nullifying its objection”); SEC v. Gowrish, No. 09-05883 SI, 2010 WL 1929498, at *2 (N.D. Cal. May 12, 2010); In re Katrina Canal Breaches Consol. Litig., No. 05-4182, 2007 WL 1959193, at *6 (E.D. La. June 27, 2007); Rogers v. England, 246 F.R.D. 1, 3 n.6 (D.D.C. Mar. 15, 2007); B & H Towing, No. 6:05-cv-00233, 2006 WL 1728044, at *5 (S.D. W. Va. June 23, 2006); Martin v. United States, 1 Cl. Ct. 775, 780-82 (Cl. Ct. Mar. 17, 1983).
The court order disclosure exception does not, itself, confer federal jurisdiction or create a right of action to obtain a court order.
Nor does this exception confer federal jurisdiction or create a right of action to obtain a court order for the disclosure of records. See Sheetz v. Marti, No. 10-10844, 2010 WL 2034775, at *1 (D. Mass. May 19, 2010) (stating that “in the absence of federal question jurisdiction . . . , diversity jurisdiction . . . , or some other statutory grant of jurisdiction, this court lacks authority to issue a subpoena” against federal agency for records plaintiff sought in connection with his divorce proceedings); Haydon Bros. Contracting, Inc. v. SSA, No. 7:11-96, 2012 WL 38608, at *2-4 (E.D. Ky. Jan. 9, 2012) (stating that where plaintiff was seeking (b)(11) order to require agency to disclose third party’s records, “the Privacy Act permits disclosure of an individual’s records pursuant to a court order, it does not provide expressly for a private right of action to obtain such an order,” and “implying a civil remedy. . .is not consistent with the legislative scheme of the Privacy Act.”); see also Bryant v. SSA, No. 14CV5764, 2015 WL 6758094, at *4 (S.D.N.Y. Nov. 5, 2015).
Relevant case law focuses on two aspects of the court order disclosure exception: what constitutes an “order of a court,” and what constitutes a court of “competent jurisdiction.”
This (b)(11) court order exception – like the subsection (b)(3) routine use exception – has generated a great deal of uncertainty due to its lack of guidance on what constitutes an “order of a court” and a “court of competent jurisdiction.” Unfortunately, neither the Act’s legislative history nor the OMB 1975 Guidelines shed light on either of these meanings or illuminate whether there are specific requirements one must meet to rely on this exception. The relevant case law below provides guidance on both prongs of this exception, however: 1) the meaning of “order of a court” and 2) when a court has “competent jurisdiction.” See 120 Cong. Rec. at 36,959, reprinted in Source Book at 936, OMB 1975 Guidelines, 40 Fed. Reg. at 28,955, https://www.justice.gov/paoverview_omb-75.
a. Meaning of “Court Order”
i. Judge Approved
Courts have generally interpreted the court order disclosure exception to require the “order of a court” to be specifically approved by a judge.
To constitute a court order under subsection (b)(11), a judge must approve the order. In Doe v. DiGenova, 779 F.2d 74, 77-85 (D.C. Cir. 1985), the D.C. Circuit decisively ruled that a subpoena routinely issued by a court clerk – such as a federal grand jury subpoena – is not a “court order” within the meaning of this exception because it is not “specifically approved” by a judge. Cf. Ricoma v. Standard Fire Ins. Co., No. 5:12-CV-18, 2013 WL 1164499, at *1 n.2 (E.D.N.C. Mar. 20, 2013) (finding proposed subpoena deficient on other grounds and discussing request for subpoena to be signed by judge in accordance with subsection (b)(11)); Hoffman v. Astrue, No. 3:10-CV-00214, 2011 WL 195617, at *4 (W.D. Ky. Jan. 18, 2011) (ruling that agency need not comply with state court subpoena to disclose records because all 12 exceptions under Privacy Act are “inapposite”).
Prior to Doe v. DiGenova, the courts were split on this point. Compare Bruce v. United States, 621 F.2d 914, 916 (8th Cir. 1980) (dictum) (finding subpoena is not court order), and Stiles v. Atlanta Gas Light Co., 453 F. Supp. 798, 800 (N.D. Ga. 1978) (finding that Privacy Act will prevent disclosure of subpoenaed documents unless “the court specifically orders them produced pursuant to section 552a(b)(11)”), with Adams v. United States Lines, No. 80-0952, slip op. at 2-3 (E.D. La. Mar. 16, 1981) (finding subpoena is court order). Cf. Moore v. USPS, 609 F. Supp. 681, 682 (E.D.N.Y. 1985) (finding subpoena is court order where it is required to be approved by judge under state law).
Note that an agency cannot avoid the result in Doe v. DiGenova by relying on a routine use that seeks to authorize disclosure pursuant to a subpoena. See Doe v. Stephens, 851 F.2d 1457, 1465-67 (D.C. Cir. 1988) (discussed in detail above under exception, “5 U.S.C. 552a(b)(3) - Routine Uses”).
ii. Standards for Issuance of a Court Order
Because the Privacy Act’s court order disclosure exception contains no standard that governs the issuance of a court order, courts have relied on a number of considerations, with varying degrees of clarity.
Under the Privacy Act’s subsection (b)(11) exception, there is no standard governing the issuance of a “court order.” Unlike other federal privacy-related or confidentiality statutes, subsection (b)(11) contains no standard governing the issuance of an order authorizing the disclosure of otherwise protected Privacy Act information. See, e.g., 42 U.S.C. § 290dd-2 (2018) (listing “good cause” factors to be weighed by court in evaluating applications for orders permitting disclosure of records pertaining to substance abuse); 20 U.S.C. § 1232g(b)(2)(B) (prohibiting disclosure unless, inter alia, “information is furnished in compliance with a judicial order, or pursuant to any lawfully issued subpoena, upon condition that parents and the students are notified of all such orders or subpoenas in advance of the compliance therewith by the educational institution or agency”).
However, there are a number of considerations that the courts have used, with varying degrees of clarity, to assess whether a “court order” was issued. These considerations include:
a) Qualified Discovery Privilege
The Privacy Act does not create heightened discovery requirements.
Some courts have held, for example, that because the Privacy Act does not itself create a qualified discovery “privilege,” a showing of “need” is not a prerequisite to initiating discovery of protected records. See Laxalt v. McClatchy, 809 F.2d 885, 888-90 (D.C. Cir. 1987); see also Weahkee v. Norton, 621 F.2d 1080, 1082 (10th Cir. 1980) (noting that objection to discovery of protected records “does not state a claim of privilege”); CFPB v. Navient Corp., No. 3:17-CV-101, 2018 WL 3824367 (M.D. Pa. Aug. 10, 2018) (agreeing “with the numerous courts that have found that the Privacy Act does not create a qualified discovery privilege); Bowden-Walker v. Wal-Mart, No. 3:14-cv-917, 2015 WL 13450672 (S.D. Miss. July 22, 2015); Ala. & Gulf Coast Ry., LLC v. United States, No. CA 10-0352, 2011 WL 1838882, at *3-5 (S.D. Ala. May 13, 2011) (citing Laxalt in determining relevance of personnel files); Bosaw v. NTEU, 887 F. Supp. 1199, 1215-17 (S.D. Ind. 1995) (citing Laxalt with approval, although ultimately determining that court did not have jurisdiction to rule on merits of case); Ford Motor Co. v. United States, 825 F. Supp. 1081, 1083 (Ct. Int’l Trade 1993) (“[T]he Privacy Act does not establish a qualified discovery privilege that requires a party seeking disclosure under 5 U.S.C. § 552a(b)(11) to prove that its need for the information outweighs the privacy interest of the individual to whom the information relates.”); Clavir v. United States, 84 F.R.D. 612, 614 (“[It] has never been suggested that the Privacy Act was intended to serve as a limiting amendment to . . . the Federal Rules of Civil Procedure.”); cf. Baldrige v. Shapiro, 455 U.S. 345, 360-62 (1981) (holding that Census Act constitutes statutorily created discovery “privilege” because it precludes all disclosure of raw census data despite need demonstrated by litigant).
b) Relevance
The D.C. Circuit has held that the only test for discovery of records is a “relevance” standard, in accordance with the Federal Rules of Civil Procedure.
The D.C. Circuit’s decision in Laxalt v. McClatchy establishes that the only test for discovery of Privacy Act-protected records is “relevance” under Rule 26(b)(1) of the Federal Rules of Civil Procedure. 809 F.2d at 888-90; see also, e.g., Pa. v. Navient Corp., 348 F. Supp. 3d 394, 398 (M.D. Pa. 2018) (ordering production of all disputed records and requiring parties to resolve potential burden, scope and relevancy issues related to production of records); Ali v. Gilead Science, Inc., No. 18-cv-00677, 2018 WL 3629818, at *2 (N.D. Cal. July 31, 2018) (citing Laxalt and noting that “the Privacy Act does not protect information from disclosure in litigation pursuant to a valid discovery request”); Ali v. eBay, Inc., No. 17-cv-06589, 2018 WL 3368389 (N.D. Cal. July 10, 2018); Needham & Co., LLC, No. 15 Civ. 2487, 2017 WL 2779800, at *1 (S.D.N.Y. June 6, 2017); Meyer v. United States, No. 16-2411, 2017 WL 735750, at *4 (D. Kan. Feb. 24, 2017) (citing Laxalt and noting that requested information “is not only relevant to this action, it is potentially essential” and thereby, required to be disclosed, but parties were encouraged to address further privacy issues through protective order); Jackson v. Safeco Insurance Co. of Ill, No. CV 14–162, 2014 WL 12658918 (D. Mont. Dec. 19, 2014); Riascos-Hurtado v. United States, No. 09-CV-0003, 2011 U.S. Dist. LEXIS 28008, at *1 (E.D.N.Y. Mar. 17, 2011) (citing Laxalt and granting plaintiff’s motion to compel production of background investigation of former agency employee, which was “relevant to the action and may be relied upon by Plaintiffs in opposing the Government’s motion” to dismiss); Buechel v. United States, No. 08-132, 2010 WL 3310243, at *1 (S.D. Ill. Aug. 19, 2010); R.T. Vanderbilt Co. v. United States, No. 95-283, 2010 WL 2706282, at *6 (Fed. Cl. July 8, 2010); SEC v. Gowrish, No. C 09-05883, 2010 WL 1929498, at *2 (N.D. Cal. May 12, 2010); Stiward v. United States, No. 05-1926, 2007 WL 2417382, at *1 (E.D. La. Aug. 24, 2007); Ezell v. Potter, No. 2:01 CV 637, 2006 WL 1094558, at *2 (N.D. Ind. Mar. 16, 2006); Hassan v. United States, No. C05-1066C, 2006 WL 681038, at *2 (W.D. Wash. Mar. 15, 2006); Snyder v. United States, No. 02-0976, 2003 WL 21088123, at *2-3 (E.D. La. May 12, 2003); Lynn v. Radford, No. 99-71007, 2001 WL 514360, at *3 (E.D. Mich. Mar. 16, 2001); Anderson v. Cornejo, No. 97 C 7556, 2001 WL 219639, at *3 (N.D. Ill. Mar. 6, 2001); Hernandez v. United States, No. 97-3367, 1998 WL 230200, at *2-3 (E.D. La. May 6, 1998); Forrest v. United States, No. 95-3889, 1996 WL 171539, at *2 (E.D. Pa. Apr. 11, 1996); Bosaw, 887 F. Supp. at 1216-17 (citing Laxalt with approval, although ultimately determining that court did not have jurisdiction to rule on merits of case); Ford Motor Co., 825 F. Supp. at 1083-84; Mary Imogene Bassett Hosp. v. Sullivan, 136 F.R.D. 42, 49 (N.D.N.Y. 1991); O’Neill v. Engels, 125 F.R.D. 518, 520 (S.D. Fla. 1989); Broderick v. Shad, 117 F.R.D. 306, 312 (D.D.C. 1987); In re Grand Jury Subpoenas Issued to USPS, 535 F. Supp. 31, 33 (E.D. Tenn. 1981); Christy v. United States, 68 F.R.D. 375, 378 (N.D. Tex. 1975).
c) Balancing Need for Information and Potential Harm
Other courts have assessed court orders by balancing the potential harm to the affected party from disclosure without restrictions and the requesting party’s need for the record.
Courts have also assessed whether orders should be granted by balancing the potential harm to the affected party from disclosure without restrictions and the need of the requesting party for the particular information. See Perry v. State Farm Fire & Cas. Co., 734 F.2d 1441, 1447 (11th Cir. 1984) (asserting that requests for court orders “should be evaluated by balancing the need for the disclosure against the potential harm to the subject of the disclosure”); Pearlstein v. BlackBerry Ltd., No. 19-mc-91091, 2019 WL 6117145 (D. Mass. Nov. 18, 2019) (concluding that compelling disclosure without notice, and without consideration of privacy interests of named individuals, ran afoul of privacy interests of individuals in nondisclosure of documents); Romeo v. Israel, No. 13-CV-61411, 2016 WL 3646858, at *2-6 (S.D. Fla. June 28, 2016) (balancing need for disclosure of information with potential harm to subjects of disclosure and determining that information was relevant, but in order to protect interests of individuals in case, documents would be reviewed in camera and only produced what is relevant to matter); Abidor v. Johnson, No. 10-CV-4059, 2016 WL 3102017, at *7 (E.D. N.Y. June 2, 2016); Verrill v. Battelle Energy All., No. 4:12-cv-00628, 2013 WL 5816632, at *2 (D. Idaho Oct. 28, 2013) (finding that either standard of “relevancy” or standard “balancing the need for the disclosure against the potential harm to the subject of the disclosure” was met and that harm to third-parties is limited since request is “narrowly circumscribed to involve only their performance reviews and documents pertaining to any investigation surrounding their termination” and that protective order would ensure confidentiality of information); Hall v. Hous. Auth. of Cnty. of Marin, No. 12-04922, 2013 WL 5695813, at *3 (N.D. Cal. Oct. 18, 2013) (finding that plaintiffs’ need for information to support claim seeking relief under 42 U.S.C. § 1983 for alleged violations of the U.S. Housing Act “outweighs any privacy interests, especially in light of the Protective Order and other steps, such as redaction, that can be taken to reduce privacy concerns”); Gutierrez v. Benavides, 292 F.R.D. 401, 404-06 (S.D. Tex. 2013) (finding that “in determining whether to grant a protective order, the court must balance the requesting party’s need for the information against the injury that might result if uncontrolled disclosure if compelled” and “[t]hrough this balancing process, courts should afford due weight to the affected party’s privacy interest”; and determining that personnel records of federal employees other than “‘records indicating official misconduct, abuse of power, or constitutional violations’ are to be protected from public disclosure”); Am. Modern Select Ins. Co. v. Sutherland, No. CV-12-S-1681, 2013 WL 1767827, at *2-3 (N.D. Ala. Apr. 18, 2013) (granting limited order for production of documents as plaintiff, an insurance company, “had a clear need for some of the documents in order to properly develop its arson defense,” which outweighed any potential harm to defendant, especially considering limited scope of order); United States v. Meyer, No. 2:11-cr-43, 2011 U.S. Dist. LEXIS 94270, at *1 (M.D. Fla. Aug. 23, 2011) (granting order after “balanc[ing] the need for disclosure against the potential harm from disclosure”); In re Becker v. Becker, No. 09-70173, 2010 WL 3119903, at *4 (Bnkr. W.D. Tex. Aug. 6, 2010) (ruling that although court was “authorized to order discovery of confidential records, it must balance the public interest in avoiding harm from disclosure against the benefits of providing relevant evidence”); Newman, No. 81-2480, slip op. at 3 (D.D.C. Sept. 13, 1982) (evaluating “legitimacy” of discovery requests and “need” for records as factors governing issuance of court order); cf. Hounshel v. Battelle Energy Alliance, LLC, No. 4:11-CV-00635, 2013 WL 5375833, at *2 (D. Idaho Sept. 24, 2013) (finding that “[r]esolution of a privacy objection requires a balancing of the need for the information sought against the privacy right asserted” and granting limited order allowing plaintiff access to third-party mental health records of employees of defendant); Ibrahim v. DHS, No. 06-00545, 2013 WL 1703367, at 6 (N.D. Cal. Apr. 19, 2013) (ordering disclosure under protective order and stating that “government may redact documents only to remove information relating to third parties who are private individuals and who are unrelated to plaintiff and her claims (relating to her challenge of being placed on government watch lists”). But cf. FDK Am., Inc. v. United States, 973 F. Supp. 2d 1315, 1318 (Ct. Int’l Trade Apr. 4, 2014) (holding motion for protective order in abeyance pending plaintiff’s certification of identity of third party who had control of documents plaintiff sought; subsequent determination of whether third-party provides consent, or was located outside territorial jurisdiction of the court).
iii. Limiting Discovery with Protective Order
Courts have held that a protective order limiting discovery under the Federal Rules of Civil Procedure is a proper procedural device for protecting records under the court order disclosure exception.
It is important to note that a protective order limiting discovery under Rule 26(c) of the Federal Rules of Civil Procedure (based, if appropriate, upon a court’s careful in-camera inspection) is a proper procedural device for protecting particularly sensitive Privacy Act-protected records when subsection (b)(11) court orders are sought. See Laxalt, 809 F.2d at 889-90; see also, e.g., Noble v. City of Fresno, No. 116CV01690DADBAM, 2017 WL 5665850, at *5 (E.D. Cal. Nov. 27, 2017) (stating that Defendant’s concerns could be assuaged by “tightly drawn” protective order specifying specific access and uses of information); Upstate Shredding, LLC v. Northeastern Ferrous, Inc., No. 3:12-CV-1015, 2016 WL 865299, at *16-17 (N.D.N.Y. Mar. 2, 2016) (upholding protective order issued to protect Privacy Act information that was violated and awarding fees associated with filing motion to enforce protective order); Minshew v. Donley, No. 2:10-CV-01593, 2013 WL 12410940, at *2 (D. Nev. Mar. 19, 2013) (permitting “redaction of exhibits containing [p]laintiff’s personal identification including her address and social security number” in documents that were to be unsealed because “public interest in such information is outweighed by the privacy concerns in revealing information”); SEC v. Kovzan, No. 11-2017, 2013 WL 647300, at *5 (D. Kan. Feb. 21, 2013) (noting that Privacy Act was not intended to limit Federal Rules of Civil Procedure and stating “this court typically approves protective orders directing the release of information coming within the protections of the Privacy Act”); Nguyen v. Winter, 756 F. Supp. 2d 128, 129 (D.D.C. 2010) (stating that “[p]ersonnel files cannot be produced without a Privacy Act protective order”); Buechel v. United States, 2010 WL 3310243, at *3-4 (S.D. Ill. Aug. 19, 2010) (issuing protective order to address defendant’s concern that “institutional safety militates against disclosure of information regarding exposure to MRSA within [Federal correctional institution]”); SEC v. Gowrish, 2010 WL 1929498, at *3 (ordering production of Privacy Act-protected documents, but fashioning protective order permitting redaction of information which if disclosed “may compromise any ongoing, unrelated criminal investigation,” while simultaneously requiring submission of unredacted copies for in-camera review); United States v. Chromatex, Inc., No. 91-1501, 2010 WL 2696759, at *10 (M.D. Pa. July 6, 2010) (ordering disclosure in camera to “allow the court to determine whether a protected order pursuant to the Privacy Act may properly be issued”); Sattar v. Gonzales, No. 07-cv-02698, 2009 WL 2207691, at *1-2 (D. Colo. July 20, 2009) (granting defendants’ motion for protective order where plaintiff sought discovery of documents that defendants claimed were protected by Act); Lopez v. Chula Vista Police Dep’t, No. 07 CV 01272, 2008 WL 8178681, at *1 (S.D. Cal. Oct. 21, 2008) (issuing (b)(11) protective order to govern disclosure of Privacy Act records concerning ongoing investigations that may reveal confidential informant and investigatory techniques and methods); In re Katrina Canal Breaches Consol. Litig., No. 05-4182, 2007 WL 1959193, at *6 (E.D. La. June 27, 2007) (ordering that subsection (b)(11) of Privacy Act allowed disclosure of materials containing “sensitive personal information” as long as they were designated as confidential pursuant to “Master Protective Order”); Boudreaux v. United States, No. 97-1592, 1999 WL 499911, at *1-2 (E.D. La. July 14, 1999) (recognizing relevancy of subsection (b)(11) to court’s resolution of dispute over motion to compel responses to production of documents subject to Privacy Act, but ordering in-camera review of documents so that legitimacy of agency objections may be determined “in the considered and cautious manner contemplated by the Privacy Act”); Gary v. United States, No. 3:97-cv-658, 1998 WL 834853, at *4 (E.D. Tenn. Sept. 4, 1998) (finding that while third party’s personnel file may contain relevant information, disclosure of that file must be made pursuant to protective order); Bosaw, 887 F. Supp. at 1216-17 (citing Laxalt with approval, although ultimately determining that court did not have jurisdiction to rule on merits of case); Clymer v. Grzegorek, 515 F. Supp. 938, 942 (E.D. Va. 1981); cf. Brown v. Narvais, No. CIV-06-228-F, 2009 WL 2230774, at *3 (W.D. Okla. July 22, 2009) (recommending that parties agree to protective order to protect privacy interests of subject of information where plaintiff served subpoena on BOP seeking disclosure of Privacy Act-protected information); Forrest, 1996 WL 171539, at *2-3 (ordering parties to “explore the possibility of entering into a voluntary confidentiality agreement regarding protecting the privacy interests of those individuals affected by disclosure”); Loma Linda Cmty. Hosp. v. Shalala, 907 F. Supp. 1399, 1405 (C.D. Cal. 1995) (“Even if release of the data . . . had unexpectedly included information not already known to [the recipient], a confidentiality order could have been imposed to protect the privacy interests in issue.”); Williams v. McCausland, No. 90 Civ. 7563, 1992 WL 309826, at *3-4 (S.D.N.Y. Oct. 15, 1992) (directing parties to agree on and execute appropriate protective stipulation for information sought in discovery that, under Privacy Act’s subsection (b)(2) standard, would not be required to be disclosed under FOIA). But cf. Jacobs v. Schiffer, 204 F.3d 259, 264-66 & n.5 (D.C. Cir. 2000) (recognizing superiority of First Amendment rights and observing that there is “critical distinction between disclosures in the attorney-client context and public disclosures,” and pointing to attorney’s “willingness to enter into a protective order” as relevant to balancing of “the employee’s interests in communication with the government’s interests in preventing communication” where information that employee wished to disclose to his private attorney was covered by Privacy Act).
In some instances, it even may be appropriate for a court to entirely deny discovery. See, e.g., Farnsworth v. Proctor & Gamble Co., 758 F.2d 1545, 1546-48 (11th Cir. 1985) (affirming lower court’s holding that keeping study participants’ names private outweighs appellant’s discovery interests); In re Becker, 2010 WL 3119903, at *4 (noting that hardship to defendants’ privacy rights would be severe where plaintiff failed to establish relevance for requested disclosure); Weems v. Corr. Corp. of Am., No. CIV-09-443, 2010 WL 2640114, at *2 (E.D. Okla. June 30, 2010); Oslund v. United States, 125 F.R.D. 110, 114-15 (D. Minn. 1989); cf. Padberg v. McGrath-McKenchnie, No. 00-3355, 2007 WL 2295402, at *2 (E.D.N.Y. Aug. 9, 2007) (declining to decide “whether a court may ever order a government agency to disclose social security numbers despite the provisions of [the Social Security Act],” and refusing to order disclosure of social security numbers of class members who have not submitted claim forms pursuant to settlement agreement); Barnett v. Dillon, 890 F. Supp. 83, 88 (N.D.N.Y. 1995) (declining to order disclosure of FBI investigative records protected by Privacy Act to arrestees despite their assertion that records were essential to proper prosecution and presentment of claims in their civil rights lawsuit).
iv. Court Orders for Publicly Filing Protected Records with Courts
Agencies may affirmatively disclose Privacy Act-protected records during litigation, so long as the disclosure is made in accordance with the Privacy Act’s disclosure provision.
As noted above, the Act’s legislative history indicates that a court is not a “person” or “agency” within the meaning of subsection (b), and that the Act was “not designed to interfere with access to information by the courts.” 120 Cong. Rec. at 36,967, reprinted in Source Book at 958-59.
However, when an agency publicly files protected records with a court during the course of litigation without consent of the subject of the records, by definition the disclosure constitutes a subsection (b) disclosure. See Laningham v. Navy, No. 83-3238, slip op. at 2-3 (D.D.C. Sept. 25, 1984), summary judgment granted (D.D.C. Jan. 7, 1985), aff’d per curiam, 813 F.2d 1236 (D.C. Cir. 1987) (concluding that because court had issued an order allowing the Navy to file documents, Navy had “grounds for believing its actions lawful” pursuant to section 552a(b)(11)). Thus, such public filing is proper only if it is undertaken pursuant to: (1) the subsection (b)(3) routine use exception (previously discussed), or (2) the subsection (b)(11) court order exception.
Where the routine use exception is unavailable, an agency should obtain a subsection (b)(11) court order permitting such public filing. Cf. DiGenova, 779 F.2d at 85 n.20 (“This is not to say that a prosecutor, a defendant, or a civil litigant, cannot submit an in camera ex parte application for a [subsection (b)(11)] court order.”). However, in light of Laningham, agencies should take care to apprise the court of the Privacy Act-related basis for seeking the order. In Laningham, the district court ruled that the government’s nonconsensual disclosure of plaintiff’s “disability evaluation” records to the United States Claims Court was improper – even though such records were filed only after the agency’s motion for leave to file “out of time” was granted. Id. The court held that subsection (b)(11) applies only when “for compelling reasons, the court specifically orders that a document be disclosed,” and it rejected the agency’s argument that the exception applies whenever records happen to be filed with leave of court. Id. at 4.
The Court of Veterans Appeals has issued a “standing order” that permits the Secretary of Veterans Affairs to routinely file relevant records from veterans’ case files.
One unique solution to the problem of filing Privacy Act-protected records in court is illustrated by In re A Motion for a Standing Order, in which the Court of Veterans Appeals issued a “standing order” permitting the Secretary of Veterans Affairs to routinely file relevant records from veterans’ case files in all future proceedings with that court. 1 Vet. App. 555, 558-59 (Ct. Vet. App. 1990) (per curiam); cf. Perkins v. United States, No. 99-3031, 2001 WL 194928, at *3 (D.D.C. Feb. 21, 2001) (order) (authorizing parties to seek admission into evidence at trial of any materials subject to the court’s stipulated protective order pursuant to subsection (b)(11)).
b. Meaning of “Competent Jurisdiction”
The D.C. Circuit has equated the term “competent jurisdiction” with “personal jurisdiction.”
One of the few Privacy Act decisions to mention this oft-overlooked “competent jurisdiction” requirement is Laxalt v. McClatchy. 809 F.2d at 890-91. In that case, the Court of Appeals for the District of Columbia Circuit appeared to equate the term “competent jurisdiction” with “personal jurisdiction” and noted that the requests for discovery of the nonparty agency’s records “were within the jurisdiction of the District Court for the District of Columbia” as “[n]either party contends that the District Court lacked personal jurisdiction over the FBI’s custodian of records.” Id.
Of course, where an agency is a proper party in a federal case, the district court’s personal jurisdiction over the agency presumably exists, and thus, court-ordered discovery of the agency’s records is proper under subsection (b)(11).
However, where a party seeks discovery of a nonparty agency’s records pursuant to a subpoena duces tecum issued under Rule 45 of the Federal Rules of Civil Procedure, Laxalt suggests that the district court issuing the discovery order must have personal jurisdiction over the nonparty agency in order to be regarded as a court of “competent jurisdiction” within the meaning of subsection (b)(11). See 809 F.2d at 890-91; cf. Mason v. S. Bend Cmty. Sch. Corp., 990 F. Supp. 1096, 1097-99 (N.D. Ind. 1997) (determining that SSA’s regulations “generally do not authorize the release of . . . records upon order of a court, even a federal court, in the absence of a special circumstance as defined by the statutes and regulations,” and thus, finding SSA not to be in contempt of court for failure to comply with prior order compelling SSA, a nonparty, to produce documents). But cf. Lohrenz v. Donnelly, 187 F.R.D. 1, 8-9 (D.D.C. 1999) (finding that nonparty agency made requisite showing of good cause for court to enter protective order without discussing jurisdiction over nonparty agency). The issue of whether personal jurisdiction exists in this situation is not always clear – particularly where the nonparty agency’s records are kept at a place beyond the territorial jurisdiction of the district court that issued the discovery order. Indeed, this very issue was apparently raised but not decided in Laxalt, 809 F.2d at 890-91 (finding it unnecessary to decide whether federal district court in Nevada would have had jurisdiction to order discovery of FBI records located in District of Columbia).
Some, but not all, courts have held that state courts lack “competent jurisdiction” when issuing state court orders for the disclosure of a nonparty federal agency’s records.
Likewise, the existence of “competent jurisdiction” is questionable whenever a state court orders the disclosure of a nonparty federal agency’s records because the doctrine of “sovereign immunity” will ordinarily preclude state court jurisdiction over a federal agency or official. See, e.g., Boron Oil Co. v. Downie, 873 F.2d 67, 70-71 (4th Cir. 1989) (holding state court subpoena constitutes “action” against United States and thus sovereign immunity applied even though EPA was not party in suit); Bosaw, 887 F. Supp. at 1210-17 (finding state court lacked jurisdiction to order federal officers to produce documents because government did not explicitly waive its sovereign immunity and, because federal court’s jurisdiction in this case was derivative of state court’s jurisdiction, federal court was likewise barred from ordering officers to produce documents); Sharon Lease Oil Co. v. FERC, 691 F. Supp. 381, 383-85 (D.D.C. 1988) (holding state court subpoena quashed as state court lacked jurisdiction to compel nonparty federal official to testify or produce documents absent waiver of sovereign immunity); see also Moore v. Armour Pharm. Co., 129 F.R.D. 551, 555 (N.D. Ga. 1990) (citing additional cases on point); cf. Louisiana v. Sparks, 978 F.2d 226, 235 n.15 (5th Cir. 1992) (noting that “[t]here is no indication that [subsection (b)(11)] evinces congressional intent to broadly waive the sovereign immunity of [federal] agencies . . . when ordered to comply with state court subpoenas”); Longtin v. DOJ, No. 06-1302, 2006 WL 2223999, at *2-3 (D.D.C. Aug. 3, 2006) (citing Sparks, rejecting plaintiff’s argument that subsection (b)(11) is a “sweeping waiver of sovereign immunity”, and concluding that “neither the Superior Court of the District of Columbia nor the Circuit Court for Prince George’s County, Maryland constitute[s] a ‘court of competent jurisdiction’ . . . to issue an order compelling a federal official to comply with a state court subpoena”).
Nevertheless, in Robinett v. State Farm Mut. Auto. Ins. Co., No. 02-0842, 2002 WL 31498992, at *3-4 (E.D. La. Nov. 7, 2002), aff’d per curiam, 83 F. App’x 638 (5th Cir. 2003), the district court looked to subsection (b)(11) and held that State Farm “properly obtained” an order from the state court for release of plaintiff’s medical records where “plaintiff’s medical condition was relevant to the litigation.” The court upheld the Department of Veterans Affairs’ “determination that plaintiff’s records were subject to release based on the court order.” In upholding the district court’s decision, the Court of Appeals for the Fifth Circuit specifically stated that the medical records were “released pursuant to the exception for orders of a court of competent jurisdiction contained in 5 U.S.C. § 552a(b)(11).” 83 F. App’x at 639; see also Moore v. USPS, 609 F. Supp. 681, 682 (E.D.N.Y. 1985) (assuming without explanation that state court subpoena, required by state law to be approved by judge, constituted proper subsection (b)(11) court order; issue of “competent jurisdiction” was not addressed).
In addition, at least one state court has ruled that it has “competent jurisdiction” to issue a subsection (b)(11) court order permitting the disclosure of a Privacy Act-protected record. Tootle v. Seaboard Coast Line R.R., 468 So. 2d 237, 239 (Fla. Dist. Ct. App. 1984); cf. Saulter v. Mun. Court for the Oakland-Piedmont Judicial Dist., 142 Cal. App. 3d 266, 275 (Cal. Ct. App. 1977) (suggesting that state court can order state prosecutor to subpoena federal records for purpose of disclosing them to criminal defendant in discovery).
Agencies that construe state court orders as providing authority to disclose under subsection (b)(11) should be aware that compliance with such an order might be taken by a court as acquiescence to the court’s jurisdiction, notwithstanding applicable principles of sovereign immunity.
“No agency shall disclose any record which is contained in a system of records…except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless the disclosure would be—
(12) to a consumer reporting agency in accordance with section 3711(e) of Title 31.” 5 U.S.C. § 552a(b)(12).