"any Executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the [federal] Government (including the Executive Office of the President), or any independent regulatory agency." 5 U.S.C. § 552a(1) (incorporating 5 U.S.C. § 552(f) (2006), which in turn incorporates 5 U.S.C. § 551(1) (2006)).
Comment:
The Privacy Act -- like the Freedom of Information Act (FOIA), 5 U.S.C. § 552 -- applies only to a federal "agency." See OMB Guidelines, 40 Fed. Reg. 28,948, 28,950-51 (July 9, 1975), available at http://www.whitehouse.gov/omb/assets/omb/inforeg/implementation_guidelines.pdf; 120 Cong. Rec. 40,408 (1974), reprinted in Source Book at 866, available at http://www.loc.gov/rr/frd/Military_Law/pdf/LH_privacy_act-1974.pdf (indicating intent that Act apply to Postal Service, Postal Rate Commission, and government corporations or government-controlled corporations); 120 Cong. Rec. 36,967 (1974), reprinted in Source Book at 958, available at http://www.loc.gov/rr/frd/Military_Law/pdf/LH_privacy_act-1974.pdf (indicating intent that term "agency" be given "its broadest statutory meaning," and, giving example of Department of Justice as an "agency," recognizing propriety of subsection (b)(1) "need to know" disclosures between its various components); see also, e.g., In re Sealed Case, 551 F.3d 1047, 1049-50 (D.C. Cir. 2009) (concluding that "the Privacy Act's definition of agency includes federally recognized National Guard units at all times" and not solely when the unit is on active federal duty); United States v. Jackson, 381 F.3d 984, 989-90 (10th Cir. 2004) (citing Ehm, infra, and holding that Amtrak is not an "agency"); NLRB v. USPS, 841 F.2d 141, 144 n.3 (6th Cir. 1988) (Postal Service is an "agency" because it is an "independent establishment of the executive branch"); Ehm v. Nat'l R.R. Passenger Corp., 732 F.2d 1250, 1252-55 (5th Cir. 1984) (Amtrak held not to constitute a "Government-controlled corporation"); Thompson v. Dep't of State, 400 F. Supp. 2d 1, 21-22 (D.D.C. 2005) (finding Foreign Service Grievance Board to be an "agency" because it "consists of members appointed exclusively by an executive department, administers federal statutes, promulgates regulations, and adjudicates the rights of individuals"); Mumme v. U.S. Dep't of Labor, 150 F. Supp. 2d 162, 169 (D. Me. 2001) ("[A] claimant bringing a Privacy Act claim must bring suit against a particular agency, not the entire United States."), aff'd, No. 01-2256 (1st Cir. June 12, 2002). But cf. Shannon v. Gen. Elec. Co., 812 F. Supp. 308, 313, 315 n.5 (N.D.N.Y. 1993) ("no dispute" that GE falls within definition of "agency" subject to requirements of Privacy Act where, pursuant to contract, it operated Department of Energy-owned lab under supervision, control, and oversight of Department and where by terms of contract GE agreed to comply with Privacy Act).
With regard to the White House, all but one of the courts that have considered the issue have held that those components of the Executive Office of the President whose sole function is to advise and assist the President are not "agencies" for purposes of the Privacy Act. Compare Dale v. Executive Office of the President, 164 F. Supp. 2d 22, 25-26 (D.D.C. 2001); Trulock v. DOJ, No. 00-2234, slip op. at 7 (D.D.C. Sept. 18, 2001); Tripp v. Executive Office of the President, 200 F.R.D. 140, 142-46 (D.D.C. 2001), appeal dismissed per curiam, No. 01-5189, 2001 WL 1488614 (D.C. Cir. Oct. 17, 2001); Broaddrick v. Executive Office of the President, 139 F. Supp. 2d 55, 60 (D.D.C. 2001), aff'd per curiam, No. 01-5178 (D.C. Cir. May 1, 2002); Flowers v. Executive Office of the President, 142 F. Supp. 2d 38, 41-43 (D.D.C. 2001); Jones v. Executive Office of the President, 167 F. Supp. 2d 10, 13-20 (D.D.C. 2001); Sculimbrene v. Reno, 158 F. Supp. 2d 26, 35-36 (D.D.C. 2001); Schwarz v. U.S. Dep't of Treasury, 131 F. Supp. 2d 142, 147-48 (D.D.C. 2000), summary affirmance granted, No. 00-5453 (D.C. Cir. May 10, 2001); Falwell v. Executive Office of the President, 113 F. Supp. 2d 967, 968-70 (W.D. Va. 2000); and Barr v. Executive Office of the President, No. 99-CV-1695, 2000 WL 34024118, at *3 (D.D.C. Aug. 9, 2000), with Alexander v. FBI, 971 F. Supp. 603, 606-07 (D.D.C. 1997) (although recognizing that the definition of "agency" under the Privacy Act is the same as in the FOIA and that courts have interpreted that definition under the FOIA to exclude the President's immediate personal staff and units within the Executive Office of the President whose sole function is to advise and assist the President, nevertheless rejecting such limitation with regard to "agency" as used in the Privacy Act due to "the very different purposes the two statutes serve"), petition for permission to appeal from interlocutory order denied, No. 97-8059 (D.C. Cir. Oct. 10, 1997), subsequent related decision, 193 F.R.D. 1 (D.D.C. 2000), mandamus denied per curiam sub nom. In re: Executive Office of the President, 215 F.3d 20, 24-25 (D.C. Cir. 2000) (stating that the White House "remains free to adhere to the position that the Privacy Act does not cover members of the White House Office"). In fact, the Court of Appeals for the D.C. Circuit has observed that "Congress did not inadvertently omit the Offices of the President and Vice President from the Privacy Act's disclosure requirements." Wilson v. Libby, 535 F.3d 697, 708 (D.C. Cir. 2008).
Note also that federal entities outside of the executive branch, such as a federal district court, see Cobell v. Norton, 157 F. Supp. 2d 82, 86 & n.6 (D.D.C. 2001), a grand jury, see Standley v. DOJ, 835 F.2d 216, 218 (9th Cir. 1987); United States v. Richardson, No. 3:2001-10, 2007 U.S. Dist. LEXIS 77, at *3 (W.D. Pa. Jan. 3, 2007), a probation office, see United States v. Bullard, 337 F. App'x 215, 216 n.1 (3d Cir. 2009) (per curiam); Fuller-Avent v. U.S. Prob. Office, 226 F. App'x 1, 2 (D.C. Cir. 2006); Schwartz v. DOJ, No. 95-6423, 1996 WL 335757, at *1 (2d Cir. June 6, 1996); Kyles v. Kaufman, No. 08-4169, 2008 WL 4906141, at *1 (D.S.D. Nov. 14, 2008); Harrell v. BOP, No. 99-1619, slip op. at 6 (W.D. Okla. Mar. 5, 2001), aff'd on other grounds sub nom. Harrell v. Fleming, 285 F.3d 1292 (10th Cir. 2002); Callwood v. Dep't of Prob. of the V.I., 982 F. Supp. 341, 343 (D.V.I. 1997), or a federal bankruptcy court, see In re Adair, 212 B.R. 171, 173 (Bankr. N.D. Ga. 1997), are not subject to the Act. Similarly, the Smithsonian Institution, although having many "links" with the federal government, "is not an agency for Privacy Act purposes." Dong v. Smithsonian Inst., 125 F.3d 877, 879-80 (D.C. Cir. 1997); see also Dodge v. Trs. of Nat'l Gallery of Art, 326 F. Supp. 2d 1, 10-11 (D.D.C. 2004) (finding that "the National Gallery is a Smithsonian Museum" and explaining that "Smithsonian Museums . . . are not subjected to the limitations of the Privacy Act because they do not fall within the definition of an 'agency'").
State and local government agencies are not covered by the Privacy Act. See, e.g., Spurlock v. Ashley County, 281 F. App'x 628, 629 (8th Cir. 2008); Schmitt v. City of Detroit, 395 F.3d 327, 331 (6th Cir. 2005); Perez-Santos v. Malave, 23 F. App'x 11, 12 (1st Cir. 2001) (per curiam); Dittman v. California, 191 F.3d 1020, 1026, 1029 (9th Cir. 1999); Ortez v. Washington County, Or., 88 F.3d 804, 811 (9th Cir. 1996); Brown v. Kelly, No. 93-5222, 1994 WL 36144, at *1 (D.C. Cir. Jan. 27, 1994) (per curiam); Monk v. Teeter, No. 89-16333, 1992 WL 1681, at *2 (9th Cir. Jan. 8, 1992); Davidson v. Georgia, 622 F.2d 895, 896 (5th Cir. 1980); Study v. United States, No. 3:08cv493, 2009 WL 2340649, at *2 (N.D. Fla. July 24, 2009); Rouse v. City of New York, No. 08CV7419, 2009 WL 1532054, at *13 (S.D.N.Y. June 2, 2009); Banda v. Camden County Bd. of Chosen Freeholders, No. 08-5115, 2009 WL 1561442, at *2 (D.N.J. May 29, 2009); Willis v. DOJ, 581 F. Supp. 2d 57, 67-68 (D.D.C. 2008); Barickman v. Bumgardner, No. 1:07CV134, 2008 WL 2872712, at *3 (N.D. W. Va. July 22, 2008); Gero v. Vt. Dep't of Corr., No. 1:07-CV-145, 2008 WL 2439891, at *1 (D. Vt. June 16, 2008); Walsh v. Krantz, No. 1:07-CV-0616, 2008 WL 2329130, at *5 (M.D. Pa. June 4, 2008); Dewille v. Ohio, No. 3:07cv3888, 2008 WL 440384, at *1 (N.D. Ohio Feb. 13, 2008); Sturkey v. Ozmint, No. 8:07-1502, 2008 WL 373610, at *1 (D.S.C. Feb. 7, 2008); Allen v. Woodford, No. 05-1104, 2007 WL 309945, at *9 (E.D. Cal. Jan. 30, 2007); Lawson v. Baxter, No. 4:06-CV-109, 2006 WL 3004069, at *3 (W.D. Mich. Oct. 20, 2006); Gabbard v. Hall County, No. 7:06-CV-37, 2006 U.S. Dist. LEXIS 56662, at *4-5 (M.D. Ga. Aug. 14, 2006); Brandt v. La Grange, No. 2:06 CV 1, 2006 WL 2120383, at *3 (E.D. Mo. July 27, 2006); Pitts v. Perkins Local Sch. Bd. of Educ., No. 1:05-CV-2226, 2006 WL 1050675, at *1 (N.D. Ohio Apr. 19, 2006); Fetzer v. Cambria County Human Servs., 384 F. Supp. 2d 813, 816 (W.D. Pa. 2005); Cassidy v. Rubitschun, No. 105-CV-350, 2005 WL 1335148, at *5 (W.D. Mich. June 2, 2005); Villa v. Vill. of Elmore, No. 3:02CV7357, 2002 WL 31728970, at *5 (N.D. Ohio Dec. 3, 2002), appeal dismissed sua sponte as untimely, No. 03-3034 (6th Cir. Mar. 28, 2003); Daniel v. Safir, 175 F. Supp. 2d 474, 481 (E.D.N.Y. 2001) (although characterizing claims as under FOIA, dismissing Privacy Act claims against local agency), aff'd, 42 F. App'x 528 (2d Cir. 2002); Atamian v. Ellis, No. 00-797, 2001 WL 699016, at *3 (D. Del. June 19, 2001), aff'd, 35 F. App'x 356 (3d Cir. 2002) (unpublished table decision); Lampkin v. N.Y. City Dep't of Prob., No. 00 Civ. 7165, 2001 WL 210362, at *2 (S.D.N.Y. Feb. 28, 2001); Markun v. Hillsborough County Dep't of Corr., No. 97-208, 1999 WL 813949, at *1 (D.N.H. Sept. 17, 1999); McClain v. DOJ, No. 97 C 0385, 1999 WL 759505, at *2 (N.D. Ill. Sept. 1, 1999), aff'd, 17 F. App'x 471 (7th Cir. 2001); Ferguson v. Ala. Criminal Justice Info. Ctr., 962 F. Supp. 1446, 1446-47 (M.D. Ala. 1997); Williams v. District of Columbia, No. 95CV0936, 1996 WL 422328, at *2-3 (D.D.C. July 19, 1996); Martinson v. Violent Drug Traffickers Project, No. 95-2161, 1996 WL 411590, at *1-2 (D.D.C. July 11, 1996), summary affirmance granted, No. 96-5262 (D.C. Cir. Sept. 22, 1997); Mamarella v. County of Westchester, 898 F. Supp. 236, 237-38 (S.D.N.Y. 1995); Connolly v. Beckett, 863 F. Supp. 1379, 1383-84 (D. Colo. 1994); MR by RR v. Lincolnwood Bd. of Educ., Dist. 74, 843 F. Supp. 1236, 1239-40 (N.D. Ill. 1994), aff'd sub nom. Rheinstrom v. Lincolnwood Bd. of Educ., Dist. 74, No. 94-1357, 1995 U.S. App. LEXIS 10781 (7th Cir. May 10, 1995); Malewich v. USPS, No. 91-4871, slip op. at 19 (D.N.J. Apr. 8, 1993), aff'd, 27 F.3d 557 (3d Cir. 1994) (unpublished table decision); Shields v. Shetler, 682 F. Supp. 1172, 1176 (D. Colo. 1988); Ryans v. N.J. Comm'n, 542 F. Supp. 841, 852 (D.N.J. 1982). But cf. Reno v. United States, No. 4-94CIV243, 1995 U.S. Dist. LEXIS 12834, at *6 (W.D.N.C. Aug. 14, 1995) (holding national guard to be a state entity in case decided prior to In re Sealed Case, 551 F.3d 1047, 1049-50 (D.C. Cir. 2009), which held that all federally recognized national guard units, whether on active status or not, are "agencies"). Additionally, neither federal funding nor regulation converts such entities into covered agencies. See St. Michaels Convalescent Hosp. v. California, 643 F.2d 1369, 1373 (9th Cir. 1981); Adelman v. Discover Card Servs., 915 F. Supp. 1163, 1166 (D. Utah 1996). The Act likewise does not apply to tribal entities. See Stevens v. Skenandore, No. 99-2611, 2000 WL 1069404, at *1 (7th Cir. Aug. 1, 2000) (no right of action against tribal officials under Privacy Act).
Similarly, private entities are not subject to the Act. See Chimarev v. TD Waterhouse Investor Servs., No. 03-7916, 2004 WL 1013320, at *2 (2d Cir. May 6, 2004); McLeod v. VA, 43 F. App'x 70, 71 (9th Cir. 2002); Sharwell v. Best Buy, No. 00-3206, 2000 WL 1478341, at *2 (6th Cir. Sept. 26, 2000); Sutton v. Providence St. Joseph Med. Ctr., 192 F.3d 826, 844 (9th Cir. 1999); Mitchell v. G.E. Am. Spacenet, No. 96-2624, 1997 WL 226369, at *1 (4th Cir. May 7, 1997); Gilbreath v. Guadalupe Hosp. Found., 5 F.3d 785, 791 (5th Cir. 1993); Lucido v. Mueller, No. 08-15269, 2009 WL 3190368, at *5-6 (E.D. Mich. Sept. 29, 2009); Lengerich v. Columbia Coll., 633 F. Supp. 2d 599, 607-08 (N.D. Ill. 2009); Shi v. Cent. Ariz. Coll., No. 08-80131, 2008 WL 4001795, at *1 (N.D. Cal. Aug. 27, 2008); Wilson v. Benedict Coll., No. 3:05-3614, 2006 WL 2433794, at *4-5 (D.S.C. Aug. 21, 2006); McCullough v. BOP, No. 05CV374, 2006 WL 667166, at *1 (D.D.C. Mar. 15, 2006); Piper v. R.J. Corman R.R. Group, No. 05-CV-104, 2005 WL 1523566, at *8 (E.D. Ky. June 28, 2005); Locke v. MedLab/Gen. Chem., No. 99-2137, 2000 WL 127111 (E.D. Pa. Feb. 3, 2000); Payne v. EEOC, No. 99-270, slip op. at 2-3 (D.N.M. July 7, 1999), aff'd, No. 00-2021, 2000 WL 1862659, at *2 (10th Cir. Dec. 20, 2000); Davis v. Boston Edison Co., No. 83-1114-2, 1985 U.S. Dist. LEXIS 23275 (D. Mass. Jan. 21, 1985); Friedlander v. USPS, No. 84-773, slip op. at 5-6 (D.D.C. Oct. 16, 1984); Marshall v. Park Place Hosp., 3 Gov't Disclosure Serv. (P-H) ¶ 83,088, at 83,057 (D.D.C. Feb. 25, 1983); see also Bybee v. Pirtle, No. 96-5077, 1996 WL 596458, at *1 (6th Cir. Oct. 16, 1996) (appellant did not state claim under Privacy Act because it does not apply to individuals who refused to hire him due to his failure to furnish his social security number or fill out W-4 forms for income tax purposes); Steadman v. Rocky Mountain News, No. 95-1102, 1995 U.S. App. LEXIS 34986, at *4 (10th Cir. Dec. 11, 1995) (Privacy Act claims "cannot be brought against defendant because defendant is not a governmental entity"); United States v. Mercado, No. 94-3976, 1995 U.S. App. LEXIS 2054, at *3-4 (6th Cir. Jan. 31, 1995) (appellant's retained defense counsel is not an "agency"). Additionally, neither federal funding nor regulation renders such private entities subject to the Act. See Burch v. Pioneer Credit Recovery, Inc., 551 F.3d 122, 125 (2d Cir. 2008); Unt v. Aerospace Corp., 765 F.2d 1440, 1448 (9th Cir. 1985); Huertas v. U.S. Dep't of Educ., No. 08-3959, 2009 WL 3165442, at *5 (D.N.J. Sept. 28, 2009); United States v. Haynes, 620 F. Supp. 474, 478-79 (M.D. Tenn. 1985); Dennie v. Univ. of Pittsburgh Sch. of Med., 589 F. Supp. 348, 351-52 (D.V.I. 1984), aff'd, 770 F.2d 1068 (3d Cir. 1985) (unpublished table decision); see also United States v. Miller, 643 F.2d 713, 715 n.1 (10th Cir. 1981) (finding that definition of "agency" does not encompass national banks); Boggs v. Se. Tidewater Opportunity Project, No. 2:96cv196, 1996 U.S. Dist. LEXIS 6977, at *5-9 (E.D. Va. May 22, 1996) (rejecting plaintiff's argument concerning entity's acceptance of federal funds and stating that "[i]t is well settled that the Administrative Procedures [sic] Act, 5 U.S.C. § 551 . . . applies only to Federal agencies").
An exception to this rule, however, is the social security number usage restrictions, contained in section 7 of the Privacy Act, which do apply to federal, state, and local government agencies. (Section 7, part of Pub. L. No. 93-579, can be found at 5 U.S.C. § 552a note (Disclosure of Social Security Number).) This special provision is discussed below under "Social Security Number Usage."
A civil action under the Privacy Act is properly filed against an "agency" only, not against an individual, a government official, an employee, or the United States. See, e.g., Weinberger v. Grimes, No. 07-6461, 2009 WL 331632, at *8 (6th Cir. Feb. 10, 2009); Alexander v. Washington Gas Light Co., No. 06-7040, 2006 WL 3798858, at *1 (D.C. Cir. Aug. 24, 2006); Martinez v. BOP, 444 F.3d 620, 624 (D.C. Cir. 2006); Pennyfeather v. Tessler, 431 F.3d 54, 55 (2d Cir. 2005); Connelly v. Comptroller of the Currency, 876 F.2d 1209, 1215 (5th Cir. 1989); Petrus v. Bowen, 833 F.2d 581, 582-83 (5th Cir. 1987); Schowengerdt v. Gen. Dynamics Corp., 823 F.2d 1328, 1340 (9th Cir. 1987); Hewitt v. Grabicki, 794 F.2d 1373, 1377 & n.2 (9th Cir. 1986); Unt, 765 F.2d at 1447; Brown-Bey v. United States, 720 F.2d 467, 469 (7th Cir. 1983); Windsor v. The Tennessean, 719 F.2d 155, 159-60 (6th Cir. 1983); Bruce v. United States, 621 F.2d 914, 916 n.2 (8th Cir. 1980); Parks v. IRS, 618 F.2d 677, 684 (10th Cir. 1980); Truesdale v. DOJ, No. 08-1862, 2009 WL 3088824, at *7 (D.D.C. Sept. 29, 2009); Jackson v. BOP, No. 08-408, 2009 WL 3080343, at *2 (D.D.C. Sept. 28, 2009); Goodwin v. Omaha Hous. Auth., No. 8:09CV205, 2009 WL 2581549, at *3 (D. Neb. Aug. 17, 2009); Capobianco v. Geithner, No. 09-1656, 2009 WL 2370443, at *1 n.3 (E.D. Pa. July 28, 2009); Walker v. Gambrell, 647 F. Supp. 2d 529, 536 (D. Md. 2009); Flanory v. Bonn, No. 2:08-cv-108, 2009 WL 33472, at *2 (W.D. Mich. Jan. 5, 2009); Jennings v. BOP, No. 081475, 2008 WL 3983115, at *1 (D.D.C. Aug. 26, 2008); Arsendorf v. Everson, No. 07-2703, 2008 WL 2229745, at *4 (S.D. Tex. May 27, 2008); Rainge-El v. Brill, No. 05-01831, 2008 WL 511760, at *9 (D. Colo. Feb. 22, 2008); Lewis v. Frazier, No. 07-0961, 2007 WL 2894255, at *1 (E.D. Cal. Oct. 3, 2007); Banks v. Partyka, No. 07-0331, 2007 WL 2693180, at *3 (W.D. Okla. Sept. 11, 2007); Joseph v. Cole, No. 5:07-CV-225, 2007 WL 2480171, at *1 (M.D. Ga. Aug. 27, 2007); Al-Beshrawi v. Arney, No. 5:06CV2114, 2007 WL 1245845, at *4 (N.D. Ohio Apr. 27, 2007); Kemp v. Grippen, 06-C-0076, 2007 WL 870123, at *6 (E.D. Wis. Mar. 20, 2007); Cummings v. Malone, No. 06-5442, 2006 WL 3694592, at *3 (D.N.J. Dec. 12, 2006); Thomas v. Ashcroft, No. 3:CV-05-0090, 2006 WL 860136, at *4 (M.D. Pa. Mar. 30, 2006); Corey v. McNamara, 409 F. Supp. 2d 1225, 1229 (D. Nev. 2006), aff'd, 265 F. App'x 555 (9th Cir. 2008); Afshar v. Everitt, No. 04-1104, 2005 WL 2898019, at *3 (W.D. Mo. Oct. 31, 2005); Swartz v. IRS, No. 05-72215, 2005 WL 3278026, at *4 (E.D. Mich. Oct. 26, 2005); Fetzer v. Cambria County Human Servs., 384 F. Supp. 2d 813, 816 (W.D. Pa. 2005); Benham v. Rice, No. 0301127, 2005 WL 691871, at *4 (D.D.C. Mar. 24, 2005); House v. Gutierrez, No. Civ.A. 04-1796, 2005 WL 405449, at *1 (D.D.C. Feb. 18, 2005); Burns v. Potter, 334 F. Supp. 2d 13, 20-21 (D. Mass. 2004); Buckles v. Indian Health Serv., 268 F. Supp. 2d 1101, 1102 (D.N.D. 2003); Stokes v. Barnhart, 257 F. Supp. 2d 288, 299 (D. Me. 2003); Mandel v. OPM, 244 F. Supp. 2d 146, 153 (E.D.N.Y. 2003), aff'd on other grounds, 79 F. App'x 479 (2d Cir. 2003); Mumme v. U.S. Dep't of Labor, 150 F. Supp. 2d 162, 169 (D. Me. 2001), aff'd, No. 01-2256 (1st Cir. June 12, 2002); Payne v. EEOC, No. 99-270, slip op. at 2 (D.N.M. July 7, 1999), aff'd, No. 00-2021, 2000 WL 1862659, at *2 (10th Cir. Dec. 20, 2000); Armstrong v. BOP, 976 F. Supp. 17, 23 (D.D.C. 1997), summary affirmance granted, No. 97-5208, 1998 WL 65543 (D.C. Cir. Jan. 30, 1998); Claasen v. Brown, No. 94-1018, 1996 WL 79490, at *3-4 (D.D.C. Feb. 16, 1996); Lloyd v. Coady, No. 94-5842, 1995 U.S. Dist. LEXIS 2490, at *3-4 (E.D. Pa. Feb. 28, 1995), upon consideration of amended complaint, 1995 U.S. Dist. LEXIS 6258, at *3 n.2 (E.D. Pa. May 9, 1995); Hill v. Blevins, No. 3-CV-92-0859, slip op. at 4-5 (M.D. Pa. Apr. 12, 1993), aff'd, 19 F.3d 643 (3d Cir. 1994) (unpublished table decision); Malewich, No. 91-4871, slip op. at 19; Sheptin v. DOJ, No. 91-2806, 1992 U.S. Dist. LEXIS 6221, at *5-6 (D.D.C. Apr. 30, 1992); Williams v. McCausland, 791 F. Supp. 992, 1000 (S.D.N.Y. 1992); Mittleman v. U.S. Treasury, 773 F. Supp. 442, 450 (D.D.C. 1991); Stephens v. TVA, 754 F. Supp. 579, 580 n.1 (E.D. Tenn. 1990); B.J.R.L. v. Utah, 655 F. Supp. 692, 696-97 (D. Utah 1987); Dennie, 589 F. Supp. at 351-53; Gonzalez v. Leonard, 497 F. Supp. 1058, 1075-76 (D. Conn. 1980). See also Bavido v. Apfel, 215 F.3d 743, 747 (7th Cir. 2000) (finding that Social Security Administration Commissioner was not proper party defendant, but that SSA had waived any objection as to naming of proper party agency defendant); Gordon v. Gutierrez, No. 1:06cv861, 2006 WL 3760134, at *3 (E.D. Va. Dec. 14, 2006) ("[C]ourts have consistently declined to imply a Bivens-style right of action against individual officers for conduct that would be actionable under the Privacy Act."); cf. Stewart v. FBI, No. 97-1595, 1999 U.S. Dist. LEXIS 21335, at *15-22 (D. Or. Dec. 10, 1999) (magistrate's recommendation) (actions of two Air Force officers assigned to other agencies were not attributable to Air Force; neither were their actions attributable to State Department, because although they both physically worked at embassy and ambassador had supervisory responsibility over all executive branch agency employees, neither reported to State Department or ambassador), adopted, 2000 U.S. Dist. LEXIS 2954 (D. Or. Mar. 15, 2000). One court also noted, though, that while of course a Privacy Act action "must be maintained against an agency," it is "unaware of any authority which requires the Plaintiffs to specifically name, either as an individual defendant or within the body of a complaint, each and every agency employee who may have contributed to an alleged Privacy Act violation." Buckles v. Indian Health Serv., 305 F. Supp. 2d 1108, 1112 (D.N.D. 2004).
Some courts have held that the head of an agency, if sued in his or her official capacity, can be a proper party defendant under the Privacy Act. See Hampton, No. 93-0816, slip op. at 8, 10-11 (D.D.C. June 30, 1995); Jarrell v. Tisch, 656 F. Supp. 237, 238 (D.D.C. 1987); Diamond v. FBI, 532 F. Supp. 216, 219-20 (S.D.N.Y. 1981), aff'd, 707 F.2d 75 (2d Cir. 1983); Nemetz v. Dep't of the Treasury, 446 F. Supp. 102, 106 (N.D. Ill. 1978); Rowe v. Tennessee, 431 F. Supp. 1257, 1264 (M.D. Tenn. 1977), vacated on other grounds, 609 F.2d 259 (6th Cir. 1979); see also Walker v. Gambrell, 647 F. Supp. 2d at 536 (construing pro se plaintiff's suit against Treasury secretary "as a suit against the Department of the Treasury" partly because "pleadings of pro se plaintiffs are to be construed liberally"). Further, leave to amend a complaint to substitute a proper party defendant ordinarily is freely granted where the agency is on notice of the claim. See, e.g., Reyes v. Supervisor of DEA, 834 F.2d 1093, 1097 (1st Cir. 1987); Petrus v. Bowen, 833 F.2d at 583. But cf. Doe v. Rubin, No. 95-CV-75874, 1998 U.S. Dist. LEXIS 14755, at *9 (E.D. Mich. Aug. 10, 1998) (granting summary judgment for defendant where plaintiff had named Secretary of the Treasury as sole defendant and had filed no motion to amend).
Note that a prosecution enforcing the Privacy Act's criminal penalties provision, 5 U.S.C. § 552a(I) (see "Criminal Penalties" discussion, below), would of course properly be filed against an individual. See Stone v. Def. Investigative Serv., 816 F. Supp. 782, 785 (D.D.C. 1993) ("Under the Privacy Act, this Court has jurisdiction over individually named defendants only for unauthorized disclosure in violation of 5 U.S.C. § 552a(I)."); see also Hampton v. FBI, No. 93-0816, slip op. at 8, 10-11 (D.D.C. June 30, 1995) (citing Stone).
"a citizen of the United States or an alien lawfully admitted for permanent residence." 5 U.S.C. § 552a(a)(2).
Comment:
Compare this definition with the FOIA's much broader "any person" definition (5 U.S.C. § 552(a)(3) (2006)). See, e.g., Fares v. INS, No. 94-1339, 1995 WL 115809, at *4 (4th Cir. 1995) (per curiam) ("[Privacy] Act only protects citizens of the United States or aliens lawfully admitted for permanent residence."); Raven v. Panama Canal Co., 583 F.2d 169, 170-71 (5th Cir. 1978) (same as Fares, and comparing "use of the word 'individual' in the Privacy Act, as opposed to the word 'person,' as more broadly used in the FOIA"); Cudzich v. INS, 886 F. Supp. 101, 105 (D.D.C. 1995) (A plaintiff whose permanent resident status had been revoked "is not an 'individual' for the purposes of the Privacy Act. . . . Plaintiff's only potential access to the requested information is therefore under the Freedom of Information Act.").
Deceased individuals do not have any Privacy Act rights, nor do executors or next-of-kin. See OMB Guidelines, 40 Fed. Reg. 28,948, 28,951 (July 9, 1975), available at http://www.whitehouse.gov/omb/assets/omb/inforeg/implementation_guidelines.pdf; see also Monk v. Teeter, No. 89-16333, 1992 WL 1681, at *2 (9th Cir. Jan. 8. 1992); Crumpton v. United States, 843 F. Supp. 751, 756 (D.D.C. 1994), aff'd on other grounds sub nom. Crumpton v. Stone, 59 F.3d 1400 (D.C. Cir. 1995).
Corporations and organizations also do not have any Privacy Act rights. See St. Michaels Convalescent Hosp. v. California, 643 F.2d 1369, 1373 (9th Cir. 1981); OKC v. Williams, 614 F.2d 58, 60 (5th Cir. 1980); Dresser Indus. v. United States, 596 F.2d 1231, 1237-38 (5th Cir. 1980); Cell Assocs. v. NIH, 579 F.2d 1155, 1157 (9th Cir. 1978); Stone v. Exp.-Imp. Bank of the United States, 552 F.2d 132, 137 n.7 (5th Cir. 1977); Falwell v. Executive Office of the President, 158 F. Supp. 2d 734, 736, 739 n.3 (W.D. Va. 2001); Comm. in Solidarity v. Sessions, 738 F. Supp. 544, 547 (D.D.C. 1990), aff'd on other grounds, 929 F.2d 742 (D.C. Cir. 1991); United States v. Haynes, 620 F. Supp. 474, 478-79 (M.D. Tenn. 1985); Utah-Ohio Gas & Oil, Inc. v. SEC, 1 Gov't Disclosure Serv. (P-H) ¶ 80,038, at 80,114 (D. Utah Jan. 9, 1980); see also OMB Guidelines, 40 Fed. Reg. at 28,951, available at http://www.whitehouse.gov/omb/assets/omb/inforeg/implementation_guidelines.pdf. But cf. Recticel Foam Corp. v. DOJ, No. 98-2523, slip op. at 11-15 (D.D.C. Jan. 31, 2002) (issuing novel ruling that corporation had standing to bring action under Administrative Procedure Act to enjoin agency from disclosing investigative information about company; "[T]he fact that Congress did not create a cause of action for corporations under the Privacy Act does not necessarily mean that Recticel's interests do not fall within the 'zone of interests' contemplated by that Act. It is sufficient for a standing analysis that Plaintiffs' interests 'arguably' fall within the zone of interests contemplated by the statute."), appeal dismissed, No. 02-5118 (D.C. Cir. Apr. 25, 2002).
The OMB Guidelines suggest that an individual has no standing under the Privacy Act to challenge agency handling of records that pertain to him solely in his "entrepreneurial" capacity. OMB Guidelines, 40 Fed. Reg. at 28,951, available at http://www.whitehouse.gov/omb/assets/omb/inforeg/implementation_guidelines.pdf (quoting legislative history and stating that it "suggests that a distinction can be made between individuals acting in a personal capacity and individuals acting in an entrepreneurial capacity (e.g., as sole proprietors) and that th[e] definition [of 'individual'] (and, therefore, the Act) was intended to embrace only the former"). However, there is a split of authority concerning OMB's personal/entrepreneurial distinction as applied to an individual. Compare Shermco Indus. v. Sec'y of the U.S. Air Force, 452 F. Supp. 306, 314-15 (N.D. Tex. 1978) (accepting distinction), rev'd & remanded on other grounds, 613 F.2d 1314 (5th Cir. 1980), and Daniels v. FCC, No. 77-5011, slip op. at 8-9 (D.S.D. Mar. 15, 1978) (same), with Rice v. United States, 245 F.R.D. 3, 5-6 (D.D.C. 2007) (rejecting distinction without referencing OMB Guidelines and observing that "the line between personal and business information is blurred for farmers, ranchers, and other family-owned businesses"); Scarborough v. Harvey, 493 F. Supp. 2d 1, 15 n.28 (D.D.C. 2007) (rejecting distinction); Henke v. Dep't of Commerce, No. 94-189, 1995 WL 904918, at *2 (D.D.C. May 26, 1995) (same), vacated & remanded on other grounds, 83 F.3d 1453 (D.C. Cir. 1996); Henke v. U.S. Dep't of Commerce, No. 94-0189, 1996 WL 692020, at *2-3 (D.D.C. Aug. 19, 1994) (same), aff'd on other grounds, 83 F.3d 1445 (D.C. Cir. 1996); Metadure Corp. v. United States, 490 F. Supp. 1368, 1373-74 (S.D.N.Y. 1980) (same); Fla. Med. Ass'n v. HEW, 479 F. Supp. 1291, 1307-11 (M.D. Fla. 1979) (same); and Zeller v. United States, 467 F. Supp. 487, 496-99 (E.D.N.Y. 1979) (same). Cf. St. Michaels Convalescent Hosp., 643 F.2d at 1373 (stating that "sole proprietorships[] are not 'individuals' and thus lack standing to raise a claim under the Privacy Act").
Privacy Act rights are personal to the individual who is the subject of the record and cannot be asserted derivatively by others. See, e.g. Parks v. IRS, 618 F.2d 677, 684-85 (10th Cir. 1980) (union lacks standing to sue for damages to its members); Word v. United States, 604 F.2d 1127, 1129 (8th Cir. 1979) (criminal defendant lacks standing to allege Privacy Act violations regarding use at trial of medical records concerning third party); Dresser Indus., 596 F.2d at 1238 (company lacks standing to litigate employees' Privacy Act claims); Research Air, Inc. v. Kempthorne, 589 F. Supp. 2d 1, 11 (D.D.C. 2008) (individual's attorney has no Privacy Act rights to request documents relating to client absent the client's consent); Sirmans v. Caldera, 27 F. Supp. 2d 248, 250 (D.D.C. 1998) (plaintiffs "may not object to the Army's failure to correct the records of other officers"); Shulman v. Sec'y of HHS, No. 94 CIV. 5506, 1997 WL 68554, at *1, 3 (S.D.N.Y. Feb. 19, 1997) (plaintiff had no standing to assert any right that might have belonged to former spouse), aff'd, No. 96-6140 (2d Cir. Sept. 3, 1997); Harbolt v. DOJ, No. A-84-CA-280, slip op. at 2 (W.D. Tex. Apr. 29, 1985) (prisoner lacks standing to assert Privacy Act claims of other inmates regarding disclosure of their records to him); Abramsky v. U.S. Consumer Prod. Safety Comm'n, 478 F. Supp. 1040, 1041-42 (S.D.N.Y. 1979) (union president cannot compel release of records pertaining to employee's termination); Attorney Gen. of the United States v. Irish N. Aid Comm., No. 77-700, 1977 U.S. Dist. LEXIS 13581, at *12 (S.D.N.Y. Oct. 7, 1977) (committee lacks standing to sue in representative capacity). But see Nat'l Fed'n of Fed. Employees v. Greenberg, 789 F. Supp. 430, 433 (D.D.C. 1992) (union has associational standing because members whose interests union seeks to represent would themselves have standing), vacated & remanded on other grounds, 983 F.2d 286 (D.C. Cir. 1993).
Note, however, that the parent of any minor, or the legal guardian of an incompetent, may act on behalf of that individual. See 5 U.S.C. § 552a(h); see also Gula v. Meese, 699 F. Supp. 956, 961 (D.D.C. 1988); cf. Maldonado Guzman v. Massanari, No. 00-2410, slip op. at 6-7 (D.P.R. Aug. 10, 2001) (holding that plaintiff had no avenue of relief in obtaining information about his emancipated daughter under Privacy Act because he did not provide documentation required by agency regulations to verify any relationship as her legal guardian), subsequent related opinion sub nom. Maldonado Guzman v. SSA, 182 F. Supp. 2d 216 (D.P.R. 2002). The OMB Guidelines note that subsection (h) is "discretionary and that individuals who are minors are authorized to exercise the rights given to them by the Privacy Act or, in the alternative, their parents or those acting in loco parentis may exercise them in their behalf." OMB Guidelines, 40 Fed. Reg. at 28,970, available at http://www.whitehouse.gov/omb/assets/omb/inforeg/implementation_guidelines.pdf; see also OMB Guidelines, 40 Fed. Reg. 56,741, 56,742 (Nov. 21, 1975), available at http://www.whitehouse.gov/omb/assets/omb/inforeg/implementation1974.pdf (noting that "[t]here is no absolute right of a parent to have access to a record about a child absent a court order or consent").
"maintain, collect, use or disseminate." 5 U.S.C. § 552a(a)(3).
Comment:
This definition embraces various activities with respect to records and has a meaning much broader than the common usage of the term. See OMB Guidelines, 40 Fed. Reg. 28,948, 28,951 (July 9, 1975), available at http://www.whitehouse.gov/omb/assets/omb/inforeg/implementation_guidelines.pdf; see also, e.g., Albright v. United States, 631 F.2d 915, 918-20 (D.C. Cir. 1980) (analyzing scope of term "maintain" in context of subsection (e)(7) challenge to record describing First Amendment-protected activity and stating that "the Act clearly prohibits even the mere collection of such a record, independent of the agency's maintenance, use or dissemination of it thereafter").
"any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph." 5 U.S.C. § 552a(a)(4).
Comment:
To qualify as a Privacy Act "record," the information must identify an individual. Compare Reuber v. United States, 829 F.2d 133, 142 (D.C. Cir. 1987) (letter reprimanding individual sent to and disclosed by agency was "record" because it clearly identified individual by name and address), with Robinson v. U.S. Dep't of Educ., No. 87-2554, 1988 WL 5083, at *1 (E.D. Pa. Jan. 20, 1988) (letter describing individual's administrative complaint was not "record" because it did not mention his name). See also Albright v. United States, 631 F.2d 915, at 920 (D.C. Cir. 1980) (subsection (e)(7) case holding that a videotape of a meeting constituted a "record" and stating that "[a]s long as the tape contains a means of identifying an individual by picture or voice, it falls within the definition of a 'record' under the Privacy Act"); Fleming v. U.S. R.R. Ret. Bd., No. 01 C 6289, 2002 WL 252459, at *2 (N.D. Ill. Feb. 21, 2002) (citing Robinson and holding that a summary of an investigation of plaintiff that was disclosed in a semi-annual report to Congress did not identify plaintiff and thus did not constitute a "record" because disclosure "would have identified plaintiff only to an individual who had other information that would have caused that individual to infer from the report that plaintiff was the subject of the investigation"); cf. Cacho v. Chertoff, No. 06-00292, 2006 WL 3422548, *6 n.3 (D.D.C. Nov. 28, 2006) (declining to decide "the novel issue of whether a disclosure of the absence of information from a system of records can constitute the disclosure of a record"; however, given that plaintiff deliberately did not report his health problems, "accepting plaintiff's characterization of his failure to report them as itself constituting a record that is afforded protection by the Privacy Act would stretch the meaning of the statute beyond its intended purpose").
The OMB Guidelines state that the term "record" means "any item of information about an individual that includes an individual identifier," OMB Guidelines, 40 Fed. Reg. 28,948, 28,951 (July 9, 1975), available at http://www.whitehouse.gov/omb/assets/omb/inforeg/implementation_guidelines.pdf (emphasis added), and "'can include as little as one descriptive item about an individual,'" id. at 28,952 (quoting legislative history appearing at 120 Cong. Rec. 40,408, 40,883 (1974), reprinted in Source Book at 866, 993, available at http://www.loc.gov/rr/frd/Military_Law/pdf/LH_privacy_act-1974.pdf.
Several courts of appeals have articulated tests for determining whether an item qualifies as a "record" under the Privacy Act, resulting in different tests for determining "record" status:
(1) Consistent with the OMB Guidelines, the Courts of Appeals for the Second and Third Circuits have broadly interpreted the term "record." See Bechhoefer v. DEA, 209 F.3d 57 (2d Cir. 2000); Quinn v. Stone, 978 F.2d 126 (3d Cir. 1992). The Third Circuit held that the term "record" "encompass[es] any information about an individual that is linked to that individual through an identifying particular" and is not "limited to information which taken alone directly reflects a characteristic or quality." Quinn v. Stone, 978 F.2d at 133 (out-of-date home address on roster and time card information held to be records covered by Privacy Act). The Second Circuit, after analyzing the tests established by the other courts of appeals, adopted a test "much like the Third Circuit's test." Bechhoefer, 209 F.3d at 60. The Second Circuit did so for three reasons: First, it found the Third Circuit's test to be "most consistent with the 'broad terms' . . . of the statutory definition," id.; second, it found the Third Circuit's test to be the only one consistent with the Supreme Court's decision in DOD v. FLRA, 510 U.S. 487, 494 (1994), which held that federal civil service employees' home addresses qualified for protection under the Privacy Act, Bechhoefer, 209 F.3d at 61; and, finally, it found the Third Circuit's test to be supported by the legislative history of the Privacy Act and by the guidelines issued by OMB, id. at 61-62. Emphasizing that "the legislative history makes plain that Congress intended 'personal information' . . . to have a broad meaning," the Second Circuit held that the term "record" "has 'a broad meaning encompassing,' at the very least, any personal information 'about an individual that is linked to that individual through an identifying particular.'" Id. at 62 (quoting Quinn and holding that letter containing Bechhoefer's name and "several pieces of 'personal information' about him, including his address, his voice/fax telephone number, his employment, and his membership in [an association]," was record covered by Privacy Act).
Other courts have also applied a broad interpretation of the term "record." See, e.g., Williams v. VA, 104 F.3d 670, 673-74 (4th Cir. 1997) (citing Quinn, inter alia, and stating that "[w]hether the Tobey court's distinction [(discussed below)] be accepted, the legislative history of the Act makes it clear that a 'record' was meant to 'include as little as one descriptive item about an individual,'" and finding that "draft" materials qualified as "records" because they "substantially pertain to Appellant," "contain 'information about' [him], as well as his 'name' or 'identifying number,'" and "do more than merely apply to him" (quoting legislative history, Source Book at 866)); Unt v. Aerospace Corp., 765 F.2d 1440, 1449-50 (9th Cir. 1985) (Ferguson, J., dissenting) (opining that majority's narrow interpretation of term "record" (discussed below) "is illogical, contrary to the legislative intent, and defies the case laws' consistent concern with the actual effect of a record on a person's employment when assessing that record's nature or subject"); Sullivan v. USPS, 944 F. Supp. 191, 196 (W.D.N.Y. 1996) (finding that disclosure to job applicant's employer of fact that applicant had applied for employment with Postal Service constituted disclosure of "record" under Privacy Act; although no other information was disclosed from application, rejecting Postal Service's attempt to distinguish between disclosing fact of record's existence and disclosing information contained in record, as applicant's name was part of information contained in application and Postal Service disclosed that particular applicant by that name had applied for employment).
(2) The Courts of Appeals for the Ninth and Eleventh Circuits have limited Privacy Act coverage by adopting a narrow construction of the term "record" -- requiring that in order to qualify, the information "must reflect some quality or characteristic of the individual involved." Boyd v. Sec'y of the Navy, 709 F.2d 684, 686 (11th Cir. 1983) (per curiam) (although stating narrow test, finding that memorandum reflecting "Boyd's failure to follow the chain of command and his relationship with management" qualified as Privacy Act record); accord Unt v. Aerospace Corp., 765 F.2d 1440, 1448-49 (9th Cir. 1985) (letter written by employee -- containing allegations of mismanagement against corporation that led to his dismissal -- held not his "record" because it was "about" corporation and reflected "only indirectly on any quality or characteristic" of employee).
(3) The Courts of Appeals for the District of Columbia and Fifth Circuits have taken another approach to interpreting the term "record." See Pierce v. Dep't of Air Force, 512 F.3d 184, 188 (5th Cir. 2007); Tobey v. NLRB, 40 F.3d 469, 471 (D.C. Cir. 1994). The D.C. Circuit held that in order to qualify as a "record," the information "must both be 'about' an individual and include his name or other identifying particular." Tobey, 40 F.3d at 471. Examining the Third Circuit's statement in Quinn that information could qualify as a record "'if that piece of information were linked with an identifying particular (or was itself an identifying particular),'" the D.C. Circuit rejected the Third Circuit's interpretation "[t]o the extent that . . . [it] fails to require that information both be 'about' an individual and be linked to that individual by an identifying particular." Id. On the other hand, the D.C. Circuit rejected "as too narrow the Ninth and Eleventh Circuits' definitions" in Unt and Boyd, and stated that: "So long as the information is 'about' an individual, nothing in the Act requires that it additionally be about a 'quality or characteristic' of the individual." Tobey, 40 F.3d at 472. Ultimately, the D.C. Circuit, "[w]ithout attempting to define 'record' more specifically than [necessary] to resolve the case at bar," held that an NLRB computer system for tracking and monitoring cases did not constitute a system of records, because its files contained no information "about" individuals, despite the fact that the case information contained the initials or identifying number of the field examiner assigned to the case. Id. at 471-73. Although the court recognized that the case information could be, and apparently was, used in connection with other information to draw inferences about a field examiner's job performance, it stated that that "does not transform the [computer system] files into records about field examiners." Id. at 472-73. See also Hatfill v. Gonzalez, 505 F. Supp. 2d 33, 35-39 (D.D.C. 2007) (concluding that information in news articles and reports concerning plaintiff's suspected involvement in criminal activity were "records"); Scarborough v. Harvey, 493 F. Supp. 2d 1, 15-16 (D.D.C. 2007) (documents naming individual plaintiffs and describing their involvement in allegedly criminal activities were "about" plaintiffs and therefore were not excluded from definition of "records," even if these activities were undertaken in connection with plaintiffs' businesses); Leighton v. CIA, 412 F. Supp. 2d 30, 38-39 (D.D.C. 2006) (finding that information contained in a magazine column," which did not name plaintiff contractor or contain an identifier but did state that "the CIA is looking at contractors and suspended two in June for talking to the press," was not "about" plaintiff); Roberts v. DOJ, 366 F. Supp. 2d 13, 26 (D.D.C. 2005) (finding that FBI director's public response to IG report investigating plaintiff's allegations of FBI wrongdoing was not "about" plaintiff; rather, it was an examination of the "validity of public allegations of misconduct lodged against [the FBI]"); Henke v. U.S. Dep't of Commerce, No. 94-0189, 1996 WL 692020, at *3 (D.D.C. Aug. 19, 1994) (holding that names of four reviewers who evaluated grant applicant's proposal are applicant's "records" under Privacy Act), aff'd on other grounds, 83 F.3d 1445 (D.C. Cir. 1996).
Agreeing with Tobey, the Fifth Circuit concluded that information must both be "about" an individual and contain an identifying particular assigned to that individual to qualify as a "record." See Pierce, 512 F.3d at 188. In Pierce, the Fifth Circuit explained that "[a]lthough the Privacy Act protects more than just documents that contain a person's name, it does not protect documents that do not include identifying particulars." Id. at 187. In determining whether a "final response letter" and "summary report of investigation" containing only "duty titles" constituted "records," the court concluded that in that case, where the duty titles did "not pertain to one and only one individual," they did not qualify as "identifying particulars" and thus, did not qualify as records under the Act. Id. at 187-88. However, the court also recognized, that "where duty titles pertain to one and only one individual . . . duty titles may indeed be 'identifying particulars' as that term is used in the definition of 'record' in the Privacy Act." Id.
Several other courts have limited Privacy Act coverage by applying narrow constructions of the term "record." See e.g., Counce v. Nicholson, No. 3:06cv00171, 2007 WL 1191013, at *15 (M.D. Tenn. Apr. 18, 2007) (concluding that "email contain[ing] information regarding a potential presentation on bullying that [plaintiff's] supervisors directed her to submit for their review" was not a "record"); Lapka v. Chertoff, No. 05-C-668, 2006 WL 3095668, at *6-7 (N.D. Ill. Oct. 30, 2006) (citing Unt and explaining that "[u]nder the Privacy Act, records that are generated in response to a complaint are not records about the complainant but rather are considered records about the accused"); Tripp v. DOD, 193 F. Supp. 2d 229, 236 (D.D.C. 2002) (citing Tobey and stating that salary information for position for which plaintiff had applied "is not 'about' plaintiff -- the fact that she could receive that salary had she been chosen for the position does not convert this into information 'about' plaintiff"); Voinche v. CIA, No. 98-1883, 2000 U.S. Dist. LEXIS 14291, at *8, 11-12 (D.D.C. Sept. 27, 2000) (citing Tobey and Fisher, infra, and finding that records regarding plaintiff's administrative appeal concerning a prior access request and the case files of plaintiff's prior Freedom of Information Act litigation, "while identifying plaintiff by name, are not 'about' the plaintiff, but rather are 'about' the administrative appeal and prior litigation under the FOIA"); Hassell v. Callahan, No. 97-0037-B, slip op. at 3-5 (W.D. Va. Aug. 7, 1997) (finding that public sign-up sheet that asked for name of claimant and name of his representative for disability benefits did not constitute "record"; stating that "this court is not inclined to lump the name of a person's representative within the same category as information regarding his medical or financial history"); Fisher v. NIH, 934 F. Supp. 464, 466-67, 469-72 (D.D.C. 1996) (following Tobey and finding that information in database about articles published in scientific journals that contained bibliographic information including title of article and publication, name and address of author, and summary of article and also included annotation "[scientific misconduct -- data to be reanalyzed]," provides "information 'about' the article described in each file and does not provide information 'about' [the author]," even though information "could be used to draw inferences or conclusions about [the author]"; "The fact that it is possible for a reasonable person to interpret information as describing an individual does not mean the information is about that individual for purposes of the Privacy Act."), summary affirmance granted, No. 96-5252 (D.C. Cir. Nov. 27, 1996); Wolde-Giorgis v. United States, No. 94-254, slip op. at 5-6 (D. Ariz. Dec. 9, 1994) (citing Unt with approval and holding that Postal Service claim form and information concerning estimated value of item sent through mail was "not a 'record' within the meaning of the [Privacy Act]" because it "disclosed no information about the plaintiff" and did not reflect any "'quality or characteristic' concerning the plaintiff"), aff'd, 65 F.3d 177 (9th Cir. 1995) (unpublished table decision); Doe v. DOJ, 790 F. Supp. 17, 22 (D.D.C. 1992) (applying Nolan, infra, and alternatively holding that "names of agents involved in the investigation are properly protected from disclosure"); Ingerman v. IRS, No. 89-5396, slip op. at 6 (D.N.J. Apr. 3, 1991) ("An individual's social security number does not contain his name, identifying number or other identifying particular. . . . [A] social security number is the individual's identifying number, and therefore, it cannot qualify as a record under . . . the Privacy Act."), aff'd, 953 F.2d 1380 (3d Cir. 1992) (unpublished table decision); Nolan v. DOJ, No. 89-A-2035, 1991 WL 36547, at *10 (D. Colo. Mar. 18, 1991) (names of FBI special agents and other personnel held not requester's "record" and therefore "outside the scope of the [Privacy Act]"), aff'd, 973 F.2d 843 (10th Cir. 1992); Shewchun v. U.S. Customs Serv., No. 87-2967, 1989 WL 7351, at *1 (D.D.C. Jan. 11, 1989) (letter concerning agency's disposition of plaintiff's merchandise "lacks a sufficient informational nexus with [plaintiff] (himself, as opposed to his property) to bring it within the definition of 'record'"); Blair v. U.S. Forest Serv., No. A85-039, slip op. at 4-5 (D. Alaska Sept. 24, 1985) ("Plan of Operation" form completed by plaintiff held not his "record" as it "reveals nothing about his personal affairs"), appeal dismissed, No. 85-4220 (9th Cir. Apr. 1, 1986); Windsor v. A Fed. Executive Agency, 614 F. Supp. 1255, 1260-61 (M.D. Tenn. 1983) (record includes only sensitive information about individual's private affairs), aff'd, 767 F.2d 923 (6th Cir. 1985) (unpublished table decision); Cohen v. U.S. Dep't of Labor, 3 Gov't Disclosure Serv. (P-H) ¶ 83,157, at 83,791 (D. Mass. Mar. 21, 1983) (record includes only "personal" information); AFGE v. NASA, 482 F. Supp. 281, 282-83 (S.D. Tex. 1980) (determining that sign-in/sign-out sheet was not "record" because, standing alone, it did not reveal any "substantive information about the employees"); Houston v. U.S. Dep't of the Treasury, 494 F. Supp. 24, 28 (D.D.C. 1979) (same as Cohen); see also Drake v. 136th Airlift Wing, Tex. Air Nat'l Guard, No. 3:98-CV-1673D, 1998 WL 872915, at *1-2 (N.D. Tex. Nov. 30, 1998) (stating that list of names of witnesses is not record, as it "does not include personal information regarding any particular individual"), aff'd, 209 F.3d 718 (5th Cir. 2000) (unpublished table decision); Benson v. United States, No. 80-15-MC, slip op. at 4 (D. Mass. June 12, 1980) (permitting withholding of OPM investigator's name where identities of informants were properly excised under subsection (k)(5)); cf. Topuridze v. FBI, No. 86-3120, 1989 WL 11709, at *2 (D.D.C. Feb. 6, 1989) (citing Unt with approval and holding that letter written about requester, authored by third party, cannot be regarded as third party's record; it "does not follow that a document reveals some quality or characteristic of an individual simply by virtue of the individual having authored the document"), reconsideration denied sub nom. Topuridze v. USIA, 772 F. Supp. 662, 664-65 (D.D.C. 1991) (after in camera review, although reaffirming that "[i]n order to be about an individual a record must 'reflect some quality or characteristic of the individual involved,'" stating that document "may well be 'about' the author," as it discussed author's family status, employment, and fear of physical retaliation if letter were disclosed to plaintiff, and ultimately ruling that it need not reach issue of whether or not letter was "about" author and denying reconsideration on ground that letter was without dispute about subject/plaintiff).For a further illustration of conflicting views concerning the meaning of the term "record" in the subsection (d)(1) access context, compare Voelker v. IRS, 646 F.2d 332, 334 (8th Cir. 1981) (requiring agency to provide individual with access to his entire record, even though some information in that record "pertained" only to third party), with Sussman v. U.S. Marshals Serv., 494 F.3d at 1121 n.9 ("As the consent requirement . . . is one of the most important, if not the most important, provisions in the Privacy Act, the prohibition must take precedence.") (citations and internal quotation marks omitted), Nolan v. DOJ, No. 89-A-2035, 1991 WL 36547, at *3 (D. Colo. Mar. 18, 1991), aff'd, 973 F.2d 843 (10th Cir. 1992), and DePlanche v. Califano, 549 F. Supp. 685, 693-98 (W.D. Mich. 1982). These important cases are further discussed below under "Individual's Right of Access."
One district court, in a case concerning the Privacy Act's subsection (b)(3) routine use exception, has held that a plaintiff may choose which particular "item of information" (one document) contained within a "collection or grouping of information" disclosed (a prosecutive report indicating a potential violation of law) to denominate as a "record" and challenge as wrongfully disclosed. Covert v. Harrington, 667 F. Supp. 730, 736-37 (E.D. Wash. 1987), aff'd on other grounds, 876 F.2d 751 (9th Cir. 1989). Purporting to construe the term "record" narrowly, the district court in Covert ruled that the Department of Energy's routine use -- 47 Fed. Reg. 14,333 (Apr. 2, 1982) (permitting disclosure of relevant records where "a record" indicates a potential violation of law) -- did not permit its Inspector General to disclose personnel security questionnaires to the Justice Department for prosecution because the questionnaires themselves did not reveal a potential violation of law on their face. 667 F. Supp. at 736-37. Covert is discussed further under "Conditions of Disclosure to Third Parties," "Agency Requirements," and "Civil Remedies," below.
Note also that purely private notes -- such as personal memory refreshers -- are generally regarded as not subject to the Privacy Act because they are not "agency records." See Johnston v. Horne, 875 F.2d 1415, 1423 (9th Cir. 1989); Bowyer v. U.S. Dep't of the Air Force, 804 F.2d 428, 431 (7th Cir. 1986); Boyd v. Sec'y of the Navy, 709 F.2d 684, 686 (11th Cir. 1983) (per curiam); Harmer v. Perry, No. 95-4197, 1998 WL 229637, at *3 (E.D. Pa. Apr. 28, 1998), aff'd, No. 98-1532 (3d Cir. Jan. 29, 1999); Sherwin v. Dep't of Air Force, No. 90-34-CIV-3, slip op. at 2-7 (E.D.N.C. Apr. 15, 1992), aff'd, 37 F.3d 1495 (4th Cir. 1994) (unpublished table decision); Glass v. U.S. Dep't of Energy, No. 87-2205, 1988 WL 118408, at *1 (D.D.C. Oct. 29, 1988); Mahar v. Nat'l Parks Serv., No. 86-0398, slip op. at 16-17 (D.D.C. Dec. 23, 1987); Kalmin v. Dep't of the Navy, 605 F. Supp. 1492, 1494-95 (D.D.C. 1985); Machen v. U.S. Army, No. 78-582, slip op. at 4 (D.D.C. May 11, 1979); see also OMB Guidelines, 40 Fed. Reg. at 28,952, available at http://www.whitehouse.gov/omb/assets/omb/inforeg/implementation_guidelines.pdf ("Uncirculated personal notes, papers and records which are retained or discarded at the author's discretion and over which the agency exercises no control or dominion (e.g., personal telephone lists) are not considered to be agency records within the meaning of the Privacy Act."); cf. FOIA Update, Vol. V, No. 4, at 3 ("OIP Guidance: 'Agency Records' vs. 'Personal Records'") (analyzing concepts of agency records and personal records under FOIA), available at http://www.justice.gov/oip/foia_updates/Vol_V_4/page5.htm.
However, in Chapman v. NASA, 682 F.2d 526, 529 (5th Cir. 1982), the Court of Appeals for the Fifth Circuit, relying on the fair recordkeeping duties imposed by subsection (e)(5), ruled that private notes may "evanesce" into records subject to the Act when they are used to make a decision on the individual's employment status well after the evaluation period for which they were compiled. See also Lawrence v. Dole, No. 83-2876, slip op. at 5-6 (D.D.C. Dec. 12, 1985) ("[a]bsent timely incorporation into the employee's file, the private notes may not be used as a basis for an adverse employment action"); Thompson v. Dep't of Transp. U.S. Coast Guard, 547 F. Supp. 274, 283-84 (S.D. Fla. 1982) (timeliness requirement of subsection (e)(5) is met where private notes upon which disciplinary action is based are placed in a system of records "contemporaneously with or within a reasonable time after an adverse disciplinary action is proposed"); cf. Risch v. Henderson, 128 F. Supp. 2d 437, 441 (E.D. Mich. 1999) (stating that "another person's witnessing of a personal note converts it to a Level 2 -- Supervisor's Personnel Record, and therefore it is properly maintained under the Privacy Act" in a system of records in accordance with the agency manual). But cf. Sherwin, No. 90-34-CIV-3, slip op. at 2-7 (E.D.N.C. Apr. 15, 1992) (distinguishing Chapman and finding that notes of telephone conversations between two of plaintiff's supervisors concerning plaintiff were not "agency 'records'" because plaintiff was "well aware of the general content" of notes, "essence" of notes was incorporated in agency's records, "private notes played no role" in plaintiff's discharge, and although some of notes were shared between two supervisors, "they remained personal notes at all times").
Note that publicly available information, such as newspaper clippings or press releases, can constitute a "record." See Clarkson v. IRS, 678 F.2d 1368, 1372 (11th Cir. 1982) (permitting subsection (e)(7) challenge to agency's maintenance of newsletters and press releases); Krieger v. DOJ, 529 F. Supp. 2d 29, 51 (D.D.C. 2008) (same as to copies of plaintiff's speech announcements and publicly filed court complaint); Murphy v. NSA, 2 Gov't Disclosure Serv. (P-H) ¶ 81,389, at 82,036-37 (D.D.C. Sept. 29, 1981) (same as to newspaper clippings); see also OMB Guidelines, 40 Fed. Reg. 56,741, 56,742 (Nov. 21, 1975), available at http://www.whitehouse.gov/omb/assets/omb/inforeg/implementation1974.pdf ("Collections of newspaper clippings or other published matter about an individual maintained other than in a conventional reference library would normally be a system of records."); cf. Gerlich v. DOJ, No. 08-1134, 2009 WL 2959884, at *9-12 (D.D.C. Sept. 16, 2009) (concluding without discussing that "printouts" of "Internet searches regarding [job] candidates' political and ideological affiliations" constituted "records"); Fisher, 934 F. Supp. at 469 (discussing difference between definition of "record" for purposes of FOIA and statutory definition under Privacy Act and rejecting argument, based on FOIA case law, that "library reference materials" are not covered by Privacy Act).
One court has relied on non-Privacy Act case law concerning grand jury records to hold that a grand jury transcript, "though in possession of the U.S. Attorney, is not a record of the Justice Department within the meaning of the Privacy Act." Kotmair v. DOJ, No. S 94-721, slip op. at 1 (D. Md. July 12, 1994) (citing United States v. Penrod, 609 F.2d 1092, 1097 (4th Cir. 1979), for above proposition, but then confusingly not applying same theory to analysis of FOIA accessibility), aff'd, 42 F.3d 1386 (4th Cir. 1994) (unpublished table decision).
The Privacy Act -- like the FOIA – does not require agencies to create records that do not exist. See DeBold v. Stimson, 735 F.2d 1037, 1041 (7th Cir. 1984); Perkins v. IRS, No. 86-CV-71551, slip op. at 4 (E.D. Mich. Dec. 16, 1986); see also, e.g., Villanueva v. DOJ, 782 F.2d 528, 532 (5th Cir. 1986) (rejecting argument that the FBI was required to "find a way to provide a brief but intelligible explanation for its decision . . . without [revealing exempt information]"). But compare May v. Dep't of the Air Force, 777 F.2d 1012, 1015-17 (5th Cir. 1985) (singularly ruling that "reasonable segregation requirement" obligates agency to create and release typewritten version of handwritten evaluation forms so as not to reveal identity of evaluator under exemption (k)(7)), with Church of Scientology W. United States v. IRS, No. CV-89-5894, slip op. at 4 (C.D. Cal. Mar. 5, 1991) (FOIA decision rejecting argument based upon May, and holding that agency is not required to create records).
"a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual." 5 U.S.C. § 552a(a)(5).
Comment:
The OMB Guidelines explain that a system of records exists if: (1) there is an "indexing or retrieval capability using identifying particulars [that is] built into the system"; and (2) the agency "does, in fact, retrieve records about individuals by reference to some personal identifier." OMB Guidelines, 40 Fed. Reg. 28,948, 28,952 (July 9, 1975), available at http://www.whitehouse.gov/omb/assets/omb/inforeg/implementation_guidelines.pdf. The Guidelines state that the "is retrieved by" criterion "implies that the grouping of records under the control of an agency is accessed by the agency by use of a personal identifier; not merely that a capability or potential for retrieval exists." Id. (emphasis added).
It is important to note that by its very terms the statute includes as personal identifiers items beyond the perhaps most commonly used name and social security number. As the Court of Appeals for the District of Columbia Circuit pointed out when considering a "photo file":
Recall that a system of records is "a group of any records . . . from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual." 5 U.S.C. § 552a(a)(5) (emphasis added). The term "record" includes "any item . . . about an individual . . . that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph." Id. § 552a(a)(4) (emphasis added). Under the Act's plain language, then, a "system of records" may be a group of any records retrieved by an identifying particular such as a photograph. In other words, the personal identifier may be the photograph itself.
Maydak v. United States, 363 F.3d 512, 519-20 (D.C. Cir. 2004) (remanding case to district court to determine whether prisons' compilation of photographs constitutes system of records). But see Ingerman v. IRS, No. 89-5396, slip op. at 6 (D.N.J. Apr. 3, 1991) ("An individual's social security number does not contain his name, identifying number, or other identifying particular. . . . [A] social security number is the individual's identifying number, and therefore, it cannot qualify as a record under . . . the Privacy Act."), aff'd, 953 F.2d 1380 (3d Cir. 1992) (unpublished table decision).
The D.C. Circuit also addressed the "system of records" definition in Henke v. U.S. Department of Commerce, 83 F.3d 1453 (D.C. Cir. 1996), and noted that "the OMB guidelines make it clear that it is not sufficient that an agency has the capability to retrieve information indexed under a person's name, but the agency must in fact retrieve records in this way in order for a system of records to exist." Id. at 1460 n.12; see also Chang v. Dep't of the Navy, 314 F. Supp. 2d 35, 41 (D.D.C. 2004) ("[A]n agency's failure to acknowledge that it maintains a system of records will not protect the agency from statutory consequences if there is evidence that the agency in practice retrieves information about individuals by their names or personal identifiers. . . . [H]owever, mere retrievability -- that is, the capability to retrieve -- is not enough.").
The highly technical "system of records" definition is perhaps the single most important Privacy Act concept, because (with some exceptions discussed below) it makes coverage under the Act dependent upon the method of retrieval of a record rather than its substantive content. See Baker v. Dep't of the Navy, 814 F.2d 1381, 1384 (9th Cir. 1987) (noting the "overwhelming support for using a record's method of retrievability to determine the scope of accessibility"); Shannon v. Gen. Elec. Co., 812 F. Supp. 308, 321 (N.D.N.Y. 1993) (method of retrieval rather than substantive content controls determination of whether record is in a system of records); see also Krieger v. DOJ, 529 F. Supp. 2d 29, 44-46 (D.D.C. 2008) ("That several of the documents do not fit th[e] description [of the label used to retrieve them] does not mean that [an agency employee] has intentionally evaded the provisions of the Privacy Act, as an agency employee seeking to find records relating to [plaintiff] would have to individually review each document to locate records associated with him -- hardly a characterization of an actual practice of retrieval by name. . . . Because the agency's press releases are actually retrieved by date and not by individual identifier, they cannot be characterized as included within a system of records.") (internal quotation marks omitted); Lee v. DOJ, No. 04-1013, 2007 WL 2852538, *9-10 (W.D. Pa. Sept. 27, 2007) (concluding that plaintiff's wrongful disclosure claim must fail because record at issue was "retrieved by the name of the fugitive," not by plaintiff's name); Artz v. United States, No. 3:05-CV-51, 2007 WL 1175512, at *5 (D.N.D. April 20, 2007) (although report named plaintiffs, it was not contained in a "system of records" because it was retrieved by date, not by plaintiffs' names); Lee v. Geren, 480 F. Supp. 2d 198, 207 (D.D.C. Mar. 29, 2007) (citing Henke and finding that record was not maintained in a system of records because record was retrieved by log number that was "unrelated to specific individuals"); Smith v. Henderson, No. C-99-4665, 1999 WL 1029862, at *5 (N.D. Cal. Oct. 29, 1999) (applying Henke and finding that "locked drawer containing a file folder in which [were] kept . . . notes or various other pieces of paper relating to special circumstances hires" did not constitute a system of records because the agency "did not utilize the drawer to systematically file and retrieve information about individuals indexed by their names"), aff'd sub nom. Smith v. Potter, 17 F. App'x 731 (9th Cir. 2001); Crumpton v. United States, 843 F. Supp. 751, 755-56 (D.D.C. 1994) (although records disclosed to press under FOIA contained information about plaintiff, they were not retrieved by her name and therefore Privacy Act did not apply), aff'd on other grounds sub nom. Crumpton v. Stone, 59 F.3d 1400 (D.C. Cir. 1995). Indeed, a major criticism of the Privacy Act is that it can easily be circumvented by not filing records in name-retrieved formats. See Privacy Commission Report at 503-04 & n.7, available at http://epic.org/privacy/ppsc1977report. A recognition of this potential for abuse has led some courts to relax the "actual retrieval" standard in particular cases (examples in cases cited below). Moreover, certain subsections of the Act (discussed below) have been construed to apply even to records not incorporated into a "system of records."
Even in the context of computerized information, district courts that have considered the issue have held that retrievability alone is insufficient to satisfy the system of records "retrieved by" requirement. See Krieger, 529 F. Supp. 2d at 42-44, 45-46 (finding that plaintiff "offers no facts suggesting that [emails] would have been indexed by name, or that an electronic folder existed that grouped emails related to him by name or other identifier" and noting that "a search function does not a system of records make"); Chang, 314 F. Supp. 2d at 41 (applying Henke, rejecting plaintiff's assertion that document was retrievable by searching within the computer files of the relevant officers, and stating that "[p]laintiff's assertion that it is 'technically possible' to retrieve the [document] by searching for [plaintiff's] name is insufficient to meet the requirement that the data was retrieved in such a manner"); Fisher v. NIH, 934 F. Supp. 464, 472-73 (D.D.C. 1996) (applying Henke and stating: "[T]he primary practice and policy of the agency [during the time of the alleged disclosures] was to index and retrieve the investigatory files by the name of the institution in which the alleged misconduct occurred, rather than by the name of the individual scientist accused of committing the misconduct. The fact that it was possible to use plaintiff's name to identify a file containing information about the plaintiff is irrelevant."), summary affirmance granted, No. 96-5252 (D.C. Cir. Nov. 27, 1996); Beckette v. USPS, No. 88-802, slip op. at 19-22 (E.D. Va. July 3, 1989) (Although the plaintiff demonstrated that the agency "could retrieve . . . records by way of an individual's name or other personal identifier," that fact "does not make those records a Privacy Act system of records. The relevant inquiry is whether the records or the information they contain are [in fact] retrieved by name or other personal identifier.").
Indeed, the issue in Henke was whether or not computerized databases that contained information concerning technology grant proposals submitted by businesses constituted a "system of records" as to individuals listed as the "contact persons" for the grant applications, where the agency had acknowledged that "it could theoretically retrieve information by the name of the contact person." Id. at 1457-58. The D.C. Circuit looked to Congress's use of the words "is retrieved" in the statute's definition of a system of records and focused on whether the agency "in practice" retrieved information. Id. at 1459-61. The court held that "in determining whether an agency maintains a system of records keyed to individuals, the court should view the entirety of the situation, including the agency's function, the purpose for which the information was gathered, and the agency's actual retrieval practice and policies." Id. at 1461. Regarding the purpose for which the information was gathered, the court drew a distinction between information gathered for investigatory purposes and information gathered for administrative purposes. Id. at 1461. The court stated that where information is compiled about individuals "primarily for investigatory purposes, Privacy Act concerns are at their zenith, and if there is evidence of even a few retrievals of information keyed to individuals' names, it may well be the case that the agency is maintaining a system of records." Id. Applying this test, the D.C. Circuit determined that the agency did "not maintain a system of records keyed to individuals listed in the contact person fields of its databases" because the agency's "purpose in requesting the name of a technical contact [was] essentially administrative and [was] not even necessary for the conduct of the [program's] operations," nor was there "any evidence that the names of contact persons [were] used regularly or even frequently to obtain information about those persons." Id. at 1456, 1461-62.
Several courts have followed Henke insofar as it calls on them to "view the entirety of the situation, including the agency's function, the purpose for which the information was gathered, and the agency's actual retrieval practice and policies" in determining "whether an agency maintains a system of records keyed to individuals." Id. at 1461. See Maydak, 363 F.3d at 520 (quoting Henke and remanding case to district court to determine whether prisons' compilation of photographs constitutes system of records and instructing district court to "take into account 'the entirety of the situation, including the agency's function, the purpose for which the information was gathered, and the agency's actual retrieval practices and policies'"); Pippinger v. Rubin, 129 F.3d 519, 526-27 (10th Cir. 1997) (finding approach in Henke "instructive" and holding that under "a properly 'narrow' construction of 5 U.S.C. § 552a(a)(5)," an IRS database containing an "abstraction" of information from two existing Privacy Act systems did not constitute a new system of records because it could be "accessed only by the same users, and only for the same purposes, as those published in the Federal Register for the original 'system[s] of records'"); Sussman v. U.S. Marshals Serv., No. 03-610, 2009 WL 3068188, at *3 (D.D.C. Sept. 25, 2009) ("Given the function of the Marshals Service, Privacy Act concerns are at their zenith. . . . [T]he Marshals Service's declarations do not establish a record that sufficiently explains the purpose for which all of the information on Sussman was gathered, or its actual retrieval practice and policies for the information maintained in various locations on Sussman[.]"), on remand from 494 F.3d 1106 (D.C. Cir. 2007); Koenig v. Dep't of Navy, No. 05-35, 2005 WL 3560626, at *4 (S.D. Tex. Dec. 29, 2005) ("[A]lthough neither party presented any evidence regarding where or in what manner the request for medical leave was kept, common sense and experience in an office setting lead to the conclusion that the record was most likely either kept in a file with the plaintiff's name on it, or entered into her leave record, which also would have been accessible by her name or social security number."); Doe v. Veneman, 230 F. Supp. 2d 739, 752 (W.D. Tex. 2002) (quoting language from Henke regarding "even a few retrievals," and determining that noninvestigatory information "f[e]ll within the ambit of the Privacy Act" where information could "be retrieved by personal identifiers" and information was maintained in "single data repository from which more than 200 different types of reports [we]re generated," all from the raw data entered into the system), aff'd in pertinent part, rev'd & remanded on other grounds, 380 F.3d 807 (5th Cir. 2004); Walker v. Ashcroft, No. 99-2385, slip op. at 17-18 (D.D.C. Apr. 30, 2001) (alternative holding) (applying Henke and finding no evidence that the FBI "independently collected, gathered or maintained" a document containing plaintiff's prescription drug information given to the FBI by a state investigator, or that the FBI "could, in practice, actually retrieve the record by reference to [plaintiff's] name"), summary affirmance granted on other grounds, No. 01-5222, 2002 U.S. App. LEXIS 2485 (D.C. Cir. Jan. 25, 2002); Alexander v. FBI, 193 F.R.D. 1, 6-8 (D.D.C. 2000) (applying Henke and finding that the agency maintained a system of records, considering the "purpose for which the information was gathered and the ordinary retrieval practices and procedures"), mandamus denied per curiam sub nom. In re: Executive Office of the President, 215 F.3d 20 (D.C. Cir. 2000); But cf. Williams v. VA, 104 F.3d 670, 674-77 & n.4 (4th Cir. 1997) (although remanding case for further factual development as to whether records were contained within system of records, and noting that it was "express[ing] no opinion on the Henke court's rationale when applied to circumstances where a plaintiff seeks to use retrieval capability to transform a group of records into a 'system of records,' as in Henke," nevertheless finding the "narrow Henke rationale . . . unconvincing" in circumstances before the court where there "appear[ed] to exist already a formal system of records," where "published characteristics of the agency's formal system of records ha[d] not kept current with advances in and typical uses of computer technology," and where record was "poorly developed" on such point).
Note also that the "practice of retrieval by name or other personal identifier must be an agency practice to create a system of records and not a 'practice' by those outside the agency." McCready v. Nicholson, 465 F.3d 1, 13 (D.C. Cir. 2006) (holding that agency's public Web site, which was not used by agency personnel to retrieve information by personal identifier, did not constitute a "system of records") (internal quotation marks omitted). See also Yonemoto v. VA, No. 06-00378, 2007 WL 1310165, at *5-6 (D. Haw. May 2, 2007) ("[I]t was not the agency, but the public who caused [information contained in e-mails] to be retrieved. Just because an agency is capable of retrieving the information, and just because it does so to comply with a FOIA request, does not mean that the information is maintained in a Privacy Act 'system of records.'"), appeal dismissed as moot, 305 F. App'x 333 (9th Cir. 2008); Freeman v. EPA, No. 02-0387, 2004 WL 2451409, at *11-12 (D.D.C. Oct. 25, 2004) (explaining that because an agency's search for records pursuant to a FOIA request "will normally trigger a search beyond the narrow confines of a Privacy Act system of records," it is not conclusive as to whether any responsive records would be "retrieved by [plaintiff's] name or some other identifying particular assigned to the individual" (internal quotation marks omitted)).
1. Disclosure: Subsection (b)With varying degrees of clarity, the courts generally have ruled that a disclosure in violation of subsection (b) does not occur unless the plaintiff's record was actually retrieved by reference to his name or personal identifier. See, e.g., Doe v. VA, 519 F.3d 456, 461 (8th Cir. 2008) ("'[T]he only disclosure actionable under section 552a(b) is one resulting from the retrieval of the information initially and directly from the record contained in the system of records.'" (quoting Olberding v. DOD, 709 F.2d 621, 622 (8th Cir. 1983))); Krueger v. Mansfield, No. 06C3322, 2008 WL 2271493, at *7 (N.D. Ill. May 30, 2008) (unless a record is contained in a system of records, its disclosure does not fall within the Privacy Act's prohibition); Bechhoefer v. DOJ, 179 F. Supp. 2d 93, 95-101 (W.D.N.Y. 2001) (finding that the disclosed record "never became part of a system of records" where DEA agent had "stuck it in his desk drawer along with a number o[f] other miscellaneous documents, and later retrieved it from that drawer, from his own memory and personal knowledge of where he kept it"; noting, too, that plaintiff's claim that agent may have looked at plaintiff's name on record to retrieve it from drawer "confuses retrieving a document with identifying the document. If one is looking for a letter from a particular person, one will probably look at the name on the letter in order to identify it as the letter being sought. If that letter is in a stack of unrelated, miscellaneous documents, however, it cannot be said to be contained within a group of records organized in such a fashion that information can be retrieved by an individual's name."), aff'd, 312 F.3d 563, 567-68 & n.1 (2d Cir. 2002) (affirming on ground that "an assortment of papers excluded from the agency's formal files because they are deemed not relevant to the agency's mission and left in a desk drawer are not part of the agency's system of records, to which the obligations of the Act apply," and accordingly finding no need to consider agency's further argument concerning single instance of retrieval by individual's name); Barhorst v. Marsh, 765 F. Supp. 995, 999-1000 (E.D. Mo. 1991) (claim under subsection (b) dismissed on alternative grounds where record retrieved by job announcement number, not by individual's name; noting that "'mere potential for retrieval' by name or other identifier is insufficient to satisfy the 'system of records' requirement" (quoting Fagot v. FDIC, 584 F. Supp. 1168, 1175 (D.P.R. 1984), aff'd in part & rev'd in part, 760 F.2d 252 (1st Cir. 1985) (unpublished table decision))); cf. Corey v. McNamara, 265 F. App'x 555, 556 (9th Cir. 2008) (finding that plaintiff "offered no evidence to counter the USPS' evidence that [plaintiff's] documentation, the disclosure of which forms the basis of [his] federal action, is not part of the USPS 'system of records'"); Smith v. BOP, No. 05-1824, 2006 WL 950372, at *3 (D. Md. Apr. 11, 2006) (dismissing claim for improper disclosure of letter plaintiff sent to her inmate husband because claim related to "a single item of correspondence," and explaining that "the court can find no basis in the Privacy Act for the conclusion that the Act's elaborate record-keeping and notice requirements apply in such circumstances"). But see Wall v. IRS, No. 1:88-CV-1942, 1989 U.S. Dist. LEXIS 9427, at *4-7 (N.D. Ga. July 5, 1989) (because agency official retrieved applicant's folder by name from file maintained under vacancy announcement number, records were kept within "system of records" and thus subsection (b) was applicable).
Nevertheless, information taken from a protected record and subsequently incorporated into a record that is not maintained in a system of records can itself become a protected record. See e.g., Jacobs v. Nat'l Drug Intelligence Ctr., 423 F.3d 512, 516-519 (5th Cir. 2005) (ruling that disclosure of executive summary, which was not retrieved by plaintiff's name but was created from information in a system of records that was so retrieved, was from a system of records); see also Bartel v. FAA, 725 F.2d 1403, 1407-09 (D.C. Cir. 1984) (finding that letters that did not qualify as covered "records," but that communicated sensitive information contained in report of investigation, which was a "record" maintained in a "system of records," triggered disclosure provisions of the Act; "[A]n absolute policy of limiting the Act's coverage to information physically retrieved from a record would make little sense in terms of [the Privacy Act's] underlying purpose."); Chang v. Dep't of the Navy, 314 F. Supp. 2d 35, 41 (D.D.C. 2004) (although it was undisputed that the documents at issue (a press release and "information paper" containing details of plaintiff's non-judicial punishment) were not retrieved from a system of records, nonetheless looking beneath the press release and "information paper" and finding that information from a system of records had been disclosed, because the "underlying documents, from which the documents were compiled, were contained in a system of records"). Similarly, the Court of Appeals for the First Circuit has held that "the unauthorized disclosure by one agency of protected information obtained from a record in another agency's system is a prohibited disclosure under the Act, unless the disclosure falls within the statutory exceptions." Orekoya v. Mooney, 330 F.3d 1, 6-7 (1st Cir. 2003). In Orekoya, the First Circuit, although ultimately affirming the district court on other grounds, disagreed with the district court's determination that such a disclosure was not a violation of the Privacy Act, and it stated that the language of the Privacy Act "does not support the view that an agency may immunize itself from liability by obtaining information from a different agency's system of records and then saying its further unauthorized disclosure is protected because its own system of records was not the original source." Id.
Several courts have stated that the first element a plaintiff must prove in a wrongful disclosure suit is that the information disclosed is a record within a system of records. See Quinn v. Stone, 978 F.2d 126, 131 (3d Cir. 1992); Walker v. Gambrell, 647 F. Supp. 2d 529, 536 (D. Md. 2009); Doe v. U.S. Dep't of Treasury, No. 05-0690, 2009 WL 1949119, at *5 (D.D.C. July 8, 2009); Armstrong v. Geithner, 610 F. Supp. 2d 66, 70-71 (D.D.C. 2009); Shutte v. IRS, No. 08-CV-2013, 2008 WL 2114920, at *2 (N.D. Iowa May 19, 2008); Kinchen v. USPS, No. 90-1180, slip op. at 5 (W.D. Tenn. June 17, 1994); Hass v. U.S. Air Force, 848 F. Supp. 926, 932 (D. Kan. 1994); Swenson v. USPS, No. S-87-1282, 1994 U.S. Dist. LEXIS 16524, at *14-15 (E.D. Cal. Mar. 10, 1994); see also Davis v. Runyon, No. 96-4400, 1998 WL 96558, at *4-5 (6th Cir. Feb. 23, 1998) (affirming district court's dismissal of Privacy Act wrongful disclosure claim where appellant had failed to allege any facts as to whether "'information' was a 'record' contained in a 'system of records,'" whether it was "disclos[ed] within the meaning of the Act," whether disclosure had "adverse effect," or whether disclosure was "willful or intentional"); Doe v. U.S. Dep't of the Interior, No. 95-1665, slip op. at 2-5 (D.D.C. Mar. 11, 1996) (alleged disclosure that plaintiff was HIV positive and had been treated for AIDS-related illnesses was not violation of Privacy Act because "[w]hile it appears to be true that some breach in confidentiality occurred . . . plaintiff cannot show that the breach stemmed from an improper disclosure of plaintiff's personnel records"); Mittleman v. U.S. Dep't of the Treasury, 919 F. Supp. 461, 468 (D.D.C. 1995) ("statement of general provisions of law" that was "not a disclosure of information retained in the [agency's] records on plaintiff . . . does not implicate the general nondisclosure provisions of the Privacy Act"), aff'd in part & remanded in part on other grounds, 104 F.3d 410 (D.C. Cir. 1997). But cf. Doe v. USPS, 317 F.3d 339, 342-43 (D.C. Cir. 2003) (ruling that genuine issues of material fact as to whether plaintiff's supervisor told co-workers about his HIV status and whether supervisor learned of that status from plaintiff's Privacy Act-protected Family and Medical Leave Act form precluded summary judgment for agency on plaintiff's claim for wrongful disclosure even though "evidence of retrieval [wa]s purely circumstantial"; "[B]ecause plaintiffs can rarely produce direct evidence that the government has disclosed confidential information obtained from their private records, requiring such evidence would eviscerate the protections of the Privacy Act.").
In fact, the Court of Appeals for the First Circuit has held that a complaint that fails to allege a disclosure from a "system of records" is facially deficient. Beaulieu v. IRS, 865 F.2d 1351, 1352 (1st Cir. 1989); see also Mumme v. U.S. Dep't of Labor, 150 F. Supp. 2d 162, 175 (D. Me. 2001), aff'd, No. 01-2256 (1st Cir. June 12, 2002); Whitson v. Dep't of the Army, No. SA-86-CA-1173, slip op. at 8-12 (W.D. Tex. Feb. 25, 1988); Bernson v. ICC, 625 F. Supp. 10, 13 (D. Mass. 1984). However, other courts, including the Court of Appeals for the District of Columbia Circuit, have not held pleadings in Privacy Act cases to such a strict standard. See Krieger v. Fadely, 211 F.3d 134, 136-37 (D.C. Cir. 2000) (holding that complaint that alleged wrongful disclosure of records "subject to protection under the Privacy Act" thereby "alleged the essential elements of [plaintiff's] claim and put the government on notice," and that "[n]othing more was required to survive a motion to dismiss for failure to state a claim"; "If his lawsuit went forward, there would come a time when [plaintiff] would have to identify the particular records [defendant] unlawfully disclosed. But that point surely was not as early as the pleading stage."); Tripp v. DOD, 219 F. Supp. 2d 85, 89-91 (D.D.C. 2002) (where complaint "alleged that during a specific time period a specific defendant repeatedly released information about plaintiff to the press and public that is contained in a Privacy Act system of records, including but not limited to the contents of plaintiff's security forms and other personnel files," following Krieger to hold that Federal Rule of Civil Procedure 8 "does not require plaintiff to plead facts to further elaborate which records were released, by which DOD officials, to which members of the press or public, or on which specific dates"); Tripp v. DOD, 193 F. Supp. 2d 229, 237 (D.D.C. 2002) (following Krieger and "the liberal pleading standard permitted by the Federal Rules of Civil Procedure"); Johnson v. Rinaldi, No. 1:99CV170, 2001 U.S. Dist. LEXIS 9833, at *16-18 (M.D.N.C. Apr. 13, 2001) (stating that the "Federal Rules of Civil Procedure require only that the complaint put Defendants on notice" and that the plaintiff "need not use the exact words 'record' or 'system of records' or state facts sufficient to show that the documents in dispute meet those legal definitions"); cf. Sterling v. United States, 798 F. Supp. 47, 49 (D.D.C. 1992) (individual is "not barred from stating a claim for monetary damages [under (g)(1)(D)] merely because the record did not contain 'personal information' about him and was not retrieved through a search of indices bearing his name or other identifying characteristics"), subsequent related opinion, Sterling v. United States, 826 F. Supp. 570, 571-72 (D.D.C. 1993), summary affirmance granted, No. 93-5264 (D.C. Cir. Mar. 11, 1994).
Thus, it has frequently been held that subsection (b) is not violated when a dissemination is made on the basis of knowledge acquired independent of ctual retrievala from an agency's system of records (such as a disclosure purely from memory), regardless of whether the identical information also happens to be contained in the agency's systems of records. The leading case articulating the "actual retrieval" and "independent knowledge" concepts is Savarese v. HEW, 479 F. Supp. 304, 308 (N.D. Ga. 1979), aff'd, 620 F.2d 298 (5th Cir. 1980) (unpublished table decision), in which the court ruled that for a disclosure to be covered by subsection (b), "there must have initially been a retrieval from the system of records which was at some point a source of the information." 479 F. Supp. at 308. In adopting this stringent "actual retrieval" test, the court in Savarese reasoned that a more relaxed rule could result in excessive governmental liability, or an unworkable requirement that agency employees "have a pansophic recall concerning every record within every system of records within the agency." Id.
There are numerous subsection (b) cases that follow Savarese and apply the "actual retrieval" and "independent knowledge" concepts in varying factual situations. See, e.g., Doe v. VA, 519 F.3d 456, 460-63 (8th Cir. 2008); Kline v. HHS, 927 F.2d 522, 524 (10th Cir. 1991); Manuel v. VA Hosp., 857 F.2d 1112, 1119-20 (6th Cir. 1988); Thomas v. U.S. Dep't of Energy, 719 F.2d 342, 344-46 (10th Cir. 1983); Olberding v. DOD, 564 F. Supp. 907, 913 (S.D. Iowa 1982), aff'd per curiam, 709 F.2d 621 (8th Cir. 1983); Boyd v. Sec'y of the Navy, 709 F.2d 684, 687 (11th Cir. 1983) (per curiam); Doyle v. Behan, 670 F.2d 535, 538-39 & n.5 (5th Cir. 1982) (per curiam); Hanley v. DOJ, 623 F.2d 1138, 1139 (6th Cir. 1980) (per curiam); Doe v. U.S. Dep't of Treasury, No. 05-0690, 2009 WL 1949119, at *8-9 (D.D.C. July 8, 2009); Balbinot v. United States, 872 F. Supp. 546, 549-51 (C.D. Ill. 1994); Coakley v. U.S. Dep't of Transp., No. 93-1420, 1994 U.S. Dist. LEXIS 21402, at *2-3 (D.D.C. Apr. 7, 1994); Swenson, No. S-87-1282, 1994 U.S. Dist. LEXIS 16524, at *19-22 (E.D. Cal. Mar. 10, 1994); Gibbs v. Brady, 773 F. Supp. 454, 458 (D.D.C. 1991); McGregor v. Greer, 748 F. Supp. 881, 885-86 (D.D.C. 1990); Avant v. USPS, No. 88-T-173-S, slip op. at 4-5 (M.D. Ala. May 4, 1990); Howard v. Marsh, 654 F. Supp. 853, 855 (E.D. Mo. 1986); Krowitz v. USDA, 641 F. Supp. 1536, 1545 (W.D. Mich. 1986), aff'd, 826 F.2d 1063 (6th Cir. 1987) (unpublished table decision); Blanton v. DOJ, No. 82-0452, slip op. at 4-5 (D.D.C. Feb. 17, 1984); Sanchez v. United States, 3 Gov't Disclosure Serv. (P-H) ¶ 83,116, at 83,708-09 (S.D. Tex. Sept. 10, 1982); Golliher v. USPS, 3 Gov't Disclosure Serv. (P-H) ¶ 83,114, at 83,703 (N.D. Ohio June 10, 1982); Thomas v. U.S. Dep't of the Navy, No. C81-0654-L(A), slip op. at 2-3 (W.D. Ky. Nov. 4, 1982), aff'd, 732 F.2d 156 (6th Cir. 1984) (unpublished table decision); Balk v. U.S. Int'l Commc'ns Agency, No. 81-0896, slip op. at 2-4 (D.D.C. May 7, 1982), aff'd, 704 F.2d 1293 (D.C. Cir. 1983) (unpublished table decision); Johnson v. U.S. Dep't of the Air Force, 526 F. Supp. 679, 681 (W.D. Okla. 1980), aff'd, 703 F.2d 583 (Fed. Cir. 1981) (unpublished table decision); Carin v. United States, 1 Gov't Disclosure Serv. (P-H) ¶ 80,193, at 80,491-92 (D.D.C. Aug. 5, 1980); Jackson v. VA, 503 F. Supp. 653, 655-57 (N.D. Ill. 1980); King v. Califano, 471 F. Supp. 180, 181 (D.D.C. 1979); Greene v. VA, No. C-76-461-S, slip op. at 6-7 (M.D.N.C. July 3, 1978); see also Drapeau v. United States, No. Civ. 04-4091, 2006 WL 517646, at *6-7 (D.S.D. Mar. 1, 2006) (agency employees who disclosed information regarding plaintiff's dismissal for rules violation did not obtain that information from record in system of records but rather from employee who had observed violation); Finnerty v. USPS, No. 03-558, 2006 WL 54345, at *11-13 (D.N.J. Jan. 9, 2006) ("The fact that the memorandum documenting [a witness'] observations may have been simultaneously circulated to recipients and directed to a file and thereafter maintained as a 'record' in a 'system of records' does not change the fact that [the witness'] source of the information was his own observation, and not a retrieval of information from a system of records."); Krieger v. Fadely, 199 F.R.D. 10, 13 (D.D.C. 2001) (ruling that discovery request seeking all communications that supervisor had with anyone, irrespective of any relation between communication and Privacy Act-protected record, was overbroad, and stating that Privacy Act "does not create a monastic vow of silence which prohibits governmental employees from telling others what they saw and heard merely because what they saw or heard may also be the topic of a record in a protected file"); Fisher v. NIH, 934 F. Supp. 464, 473-74 (D.D.C. 1996) (plaintiff failed to demonstrate that individuals who disclosed information learned it from investigatory file or through direct involvement in investigation), summary affirmance granted, No. 96-5252 (D.C. Cir. Nov. 27, 1996); Viotti v. U.S. Air Force, 902 F. Supp. 1331, 1338 (D. Colo. 1995) ("Section 552a(b) contemplates a 'system of records' as being the direct or indirect source of the information disclosed" and although agency employee admitted disclosure of information to press "based on personal knowledge," plaintiff "was obligated to come forward with some evidence indicating the existence of a triable issue of fact as to the identity of the 'indirect' source" of disclosure to press), aff'd, 153 F.3d 730 (10th Cir. 1998) (unpublished table decision); Mittleman, 919 F. Supp. at 469 (although no evidence indicated that there had been disclosure of information about plaintiff, even assuming there had been, information at issue would not have been subject to restrictions of Privacy Act because "it was a belief . . . derived from conversations . . . and which was acquired independent from a system of records"); Doe v. U.S. Dep't of the Interior, No. 95-1665, slip op. at 4-5 (D.D.C. Mar. 11, 1996) (where plaintiff could "not show that the breach [in confidentiality] stemmed from an improper disclosure of [his] records," stating further that "[t]his is especially true in light of the fact that several other employees knew of, and could have told . . . of, plaintiff's illness"); Stephens v. TVA, 754 F. Supp. 579, 582 (E.D. Tenn. 1990) (comparing Olberding and Jackson and noting "confusion in the law with respect to whether the Privacy Act bars the disclosure of personal information obtained indirectly as opposed to directly from a system of records"); cf. Rice v. United States, 166 F.3d 1088, 1092 n.4 (10th Cir. 1999) (in action for wrongful disclosure in violation of tax code, noting that plaintiff similarly had no Privacy Act claim for IRS's disclosure in press releases of information regarding plaintiff's criminal trial and conviction because information disclosed was procured by agency public affairs officer through review of indictment and attendance at plaintiff's trial and sentencing); Smith v. Henderson, No. C-96-4665, 1999 WL 1029862, at *6-7 (N.D. Cal. Oct. 29, 1999) (although finding no evidence of existence of written record retrieved from system of records, finding further that alleged disclosure was made from information "obtained independently of any system of records"), aff'd sub nom. Smith v. Potter, 17 F. App'x 731 (9th Cir. 2001).
However, the Court of Appeals for the District of Columbia Circuit, in Bartel v. FAA, 725 F.2d 1403, 1408-11 (D.C. Cir. 1984), held that the "actual retrieval" standard is inapplicable where a disclosure is undertaken by agency personnel who had a role in creating the record that contains the released information. In other words, the "independent knowledge" defense is not available to such agency personnel. See id. This particular aspect of Bartel has been noted with approval by several other courts. See Manuel, 857 F.2d at 1120 & n.1; Longtin v. DOJ, No. 06-1302, 2006 WL 2223999, at *3 (D.D.C. Aug. 3, 2006) (following Bartel and finding that requested disclosure of records concerning third-party criminal case by official who had role in creating records would violate Privacy Act, and therefore denying plaintiff's "Touhy" request); Stokes v. SSA, 292 F. Supp. 2d 178, 181 (D. Me. 2003) ("[A]gency employees who . . . create or initiate records are not shielded from the Privacy Act merely because they do not have to consult or retrieve those records before disclosing the information that they contain."); Pilon v. DOJ, 796 F. Supp. 7, 12 (D.D.C. 1992) (denying agency's motion to dismiss or alternatively for summary judgment where information "obviously stem[med] from confidential Department documents and oral statements derived therefrom"); Kassel v. VA, 709 F. Supp. 1194, 1201 (D.N.H. 1989); Cochran v. United States, No. 83-216, slip op. at 9-13 (S.D. Ga. July 2, 1984), aff'd, 770 F.2d 949 (11th Cir. 1985); Fitzpatrick v. IRS, 1 Gov't Disclosure Serv. (P-H) ¶ 80,232, at 80,580 (N.D. Ga. Aug. 22, 1980), aff'd in part, vacated & remanded in part, on other grounds, 665 F.2d 327 (11th Cir. 1982); cf. Doe v. U.S. Dep't of Treasury, No. 05-0690, 2009 WL 1949119, at *7-8 (D.D.C. July 8, 2009) (declining to apply Bartel exception where IRS employee disclosed information about investigation, which he had acquired from a press release and from his own involvement in investigation, because he did not "institute" investigation, did not have a "primary role in creating and using" the information, and did not acquire the information from a "record-related role"); Armstrong v. Geithner, 610 F. Supp. 2d 66, 71 (D.D.C. 2009) (where disclosed information from a co-employee's complaint led to an investigation of plaintiff, Bartel does not apply if the co-employee was not involved in investigation and if disclosure was not a product of investigation); Krieger v. DOJ, 529 F. Supp. 2d 29, 48 (D.D.C. 2008) (distinguishing Bartel, and finding no wrongful disclosures); Carlson v. GSA, No. 04-C-7937, 2006 WL 3409150, at *3-4 (N.D. Ill. Nov. 21, 2006) (supervisor's email detailing employee's settlement of his wrongful termination claims was a "'communication' of a protected 'record'" even though supervisor, who conducted investigation that resulted in the settlement, "compiled the email from his own memory"). But cf. Abernethy v. IRS, 909 F. Supp. 1562, 1570 (N.D. Ga. 1995) (holding that alleged statements made to other IRS employees that plaintiff was being investigated pertaining to allegations of EEO violations, assuming they were in fact made, did not violate the Act "because information allegedly disclosed was not actually retrieved from a system of records" even though individual alleged to have made such statements was same individual who ordered investigation), aff'd per curiam, No. 95-9489 (11th Cir. Feb. 13, 1997).
In particular, the Court of Appeals for the Ninth Circuit held that an Administrative Law Judge for the Department of Health and Human Services violated the Privacy Act when he stated in an opinion that one of the parties' attorneys had been placed on a Performance Improvement Plan (PIP) while he was employed at HHS -- despite the fact that there was no actual retrieval by the ALJ -- because, as the creator of the PIP, the ALJ had personal knowledge of the matter. Wilborn v. HHS, 49 F.3d 597, 600-02 (9th Cir. 1995). The Ninth Circuit noted the similarity of the facts to those of Bartel and held that "'independent knowledge,' gained by the creation of records, cannot be used to sidestep the Privacy Act." Id. at 601. Additionally, it rejected the lower court's reasoning that not only was there no retrieval, but there was no longer a record capable of being retrieved because as the result of a grievance action, all records relating to the PIP had been required to be expunged from the agency's records and in fact were expunged by the ALJ himself. Id. at 599-602. The Ninth Circuit found the district court's ruling "inconsistent with the spirit of the Privacy Act," and stated that the "fact that the agency ordered expungement of all information relating to the PIP makes the ALJ's disclosure, if anything, more rather than less objectionable." Id. at 602.
The Court of Appeals for the Eighth Circuit, however, has twice taken a narrow view of the "actual retrieval" standard. In a per curiam decision in Olberding v. U.S. Department of Defense, 709 F.2d 621 (8th Cir. 1983), the court ruled that information orally disclosed by a military psychiatrist to the plaintiff's commanding general, revealing the results of the plaintiff's examination -- which had not yet been put in writing -- was not retrieved from a "record." Id. at 621 (adopting reasoning of trial court, which found that the conversation took place before the report was written, 564 F. Supp. 907, 910 (S.D. Iowa 1982)). Subsequently, in Doe v. Department of Veterans Affairs, 519 F.3d 456 (8th Cir. 2008), the court ruled that there was no actual retrieval from a record where a VA physician revealed an employee's HIV status and marijuana use to a union representative because the physician recalled the information exclusively from discussions during employee's medical appointments, not from any subsequent review of his medical notes. Id. at 459-62. Although the court purported to distinguish Bartel and Wilborn, id. at 462-63, Judge Hanson stated in his concurring opinion that were he not bound by Olberding, he would adopt a "scrivener's exception" in order to "justify an exception to the general retrieval rule, particularly where 'a mechanical application of the rule would thwart, rather than advance, the purpose of the Privacy Act.'" Id. at 464-65 (quoting Wilborn, 49 F.3d at 600).
2. Access and Amendment: Subsections (d)(1) and (d)(2)One of Congress's underlying concerns in narrowly defining a "system of records" appears to have been efficiency -- i.e., a concern that any broader definition would require elaborate cross-references among records and/or burdensome hand-searches for records. See OMB Guidelines, 40 Fed. Reg. at 28,957, available at http://www.whitehouse.gov/omb/assets/omb/inforeg/implementation_guidelines.pdf; see also Baker v. Dep't of the Navy, 814 F.2d 1381, 1385 (9th Cir. 1987); Carpenter v. IRS, 938 F. Supp. 521, 522-23 (S.D. Ind. 1996).
Consistent with OMB's guidance, numerous courts have held that, under subsection (d)(1), an individual has no Privacy Act right of access to his record if it is not indexed and retrieved by his name or personal identifier. See Bettersworth v. FDIC, 248 F.3d 386, 391-92 (5th Cir. 2001); Gowan v. U.S. Dep't of the Air Force, 148 F.3d 1182, 1191 (10th Cir. 1998); Williams v. VA, 104 F.3d 670, 673 (4th Cir. 1997); Henke v. U.S. Dep't of Commerce, 83 F.3d 1453, 1458-62 (D.C. Cir. 1996); Manuel v. VA Hosp., 857 F.2d 1112, 1116-17 (6th Cir. 1988); Baker, 814 F.2d at 1383-84; Cuccaro v. Sec'y of Labor, 770 F.2d 355, 360-61 (3d Cir. 1985); Wren v. Heckler, 744 F.2d 86, 89 (10th Cir. 1984); McCready v. Principi, 297 F. Supp. 2d 178, 188 (D.D.C. 2003), rev'd in part on other grounds sub nom. McCready v. Nicholson, 465 F.3d 1 (D.C. Cir. 2006); Springmann v. U.S. Dep't of State, No. 93-1238, slip op. at 9 n.2 (D.D.C. Apr. 21, 1997); Fuller v. IRS, No. 96-888, 1997 WL 191034, at *3-5 (W.D. Pa. Mar. 4, 1997); Carpenter, 938 F. Supp. at 522-23; Quinn v. HHS, 838 F. Supp. 70, 76 (W.D.N.Y. 1993); Shewchun v. U.S. Customs Serv., No. 87-2967, 1989 WL 7351, at *2 (D.D.C. Jan. 11, 1989); Bryant v. Dep't of the Air Force, No. 85-4096, slip op. at 4 (D.D.C. Mar. 31, 1986); Fagot v. FDIC, 584 F. Supp. 1168, 1174-75 (D.P.R. 1984), aff'd in part & rev'd in part, 760 F.2d 252 (1st Cir. 1985) (unpublished table decision); Grachow v. U.S. Customs Serv., 504 F. Supp. 632, 634-36 (D.D.C. 1980); Smiertka v. U.S. Dep't of the Treasury, 447 F. Supp. 221, 228 (D.D.C. 1978), remanded on other grounds, 604 F.2d 698 (D.C. Cir. 1979); see also OMB Guidelines, 40 Fed. Reg. at 28,957 (giving examples).
Likewise, with regard to amendment, several courts have ruled that where an individual's record is being maintained allegedly in violation of subsection (e)(1) or (e)(5), the individual has no Privacy Act right to amend his record, under subsection (d)(2), if it is not indexed and retrieved by his name or personal identifier. See Baker, 814 F.2d at 1384-85 ("the scope of accessibility and the scope of amendment are coextensive"); Seldowitz v. Office of the IG of the U.S. Dep't of State, No. 99-1031, slip op. at 19-23 (E.D. Va. June 21, 2002), aff'd per curiam, No. 02-1850, 2004 WL 193130 (4th Cir. Feb. 3, 2004); Pototsky v. Dep't of the Navy, 717 F. Supp. 20, 22 (D. Mass. 1989) (following Baker), aff'd per curiam, 907 F.2d 142 (1st Cir. 1990) (unpublished table decision); see also Clarkson v. IRS, 678 F.2d 1368, 1376-77 (11th Cir. 1982) (although finding that subsections (e)(1) and (e)(5) apply only to records contained in a system of records, "find[ing] it both necessary and appropriate to construe the plain meaning of the language of subsections (d)(2) and (d)(3) to authorize the amendment or expungement of all records which are maintained in violation of subsection (e)(7)"). But cf., e.g., McCready v. Nicholson, 465 F.3d 1, 10-12 (D.C. Cir. 2006) (holding that subsection (g)(1)(C), the civil remedy provision for violations of subsection (e)(5), "applies to any record, and not [just] any record within a system of records" (internal quotation marks omitted)), discussed, below, under "Other Aspects."
However, with respect to access under subsection (d)(1), and amendment under subsection (d)(2), several courts have cautioned that an agency's purposeful filing of records in a non-name-retrieved format, in order to evade those provisions, will not be permitted. See, e.g., Pototsky v. Dep't of the Navy, No. 89-1891, slip op. at 2 (1st Cir. Apr. 3, 1990) (per curiam); Baker, 814 F.2d at 1385; Kalmin v. Dep't of the Navy, 605 F. Supp. 1492, 1495 n.5 (D.D.C. 1985); see also Manuel, 857 F.2d at 1120 ("The Court does not want to give a signal to federal agencies that they should evade their responsibility to place records within their 'system of records' in violation of the [Act].").
Following the rationale of the Fifth Circuit Court of Appeals in Chapman v. NASA, 682 F.2d 526, 529 (5th Cir. 1982), several courts have recognized a subsection (e)(5) duty to incorporate records into a system of records (thus making them subject to access and amendment) where such records are used by the agency in taking an adverse action against the individual. See MacDonald v. VA, No. 87-544-CIV-T-15A, slip op. at 2-5 (M.D. Fla. Feb. 8, 1988); Lawrence v. Dole, No. 83-2876, slip op. at 5-6 (D.D.C. Dec. 12, 1985); Waldrop v. U.S. Dep't of the Air Force, 3 Gov't Disclosure Serv. (P-H) ¶ 83,016, at 83,453 (S.D. Ill. Aug. 5, 1981); Nelson v. EEOC, No. 83-C-983, slip op. at 6-11 (E.D. Wis. Feb. 14, 1984); cf. Manuel, 857 F.2d at 1117-19 (no duty to place records within system of records where records "are not part of an official agency investigation into activities of the individual requesting the records, and where the records requested do not have an adverse effect on the individual"). But cf. Horowitz v. Peace Corps, 428 F.3d. 271, 280-81 (D.C. Cir. 2005) (denying plaintiff access to draft Administrative Separation Report (ASR) that was not in "system of records" where "Peace Corps's regulations dictate that an ASR should not be maintained in the agency's records if a volunteer resigns prior to an official decision to administratively separate him" and "the Peace Corps's manual states that an ASR should not even be completed if a volunteer resigns before such a decision is made" and since plaintiff "resigned before any final decision was made, the report was never completed and pursuant to the procedure specified by the manual was not maintained in the Peace Corps's official files"; "[n]or has [plaintiff] shown that [the agency] nevertheless placed the draft ASR in a 'system of records'" as the draft ASR was stored in Peace Corps's Country Director's safe and plaintiff "has not shown that files in the safe are, in practice, retrieved by individuals' names"); Gowan v. Dep't of the Air Force, No. 90-94, slip op. at 7, 11, 13, 16, 30, 33 (D.N.M. Sept. 1, 1995) (although ultimately finding access claim moot, stating that "personal notes and legal research" in file "marked 'Ethics'" that was originally kept in desk of Deputy Staff Judge Advocate but that was later given to Criminal Military Justice Section and used in connection with court martial hearing were not in system of records for purposes of either Privacy Act access or accuracy lawsuit for damages), aff'd, 148 F.3d 1182, 1191 (10th Cir. 1998) (concluding that "the word 'Ethics' was not a personal identifier" and stating that it did "not find the district court's rulings regarding those documents to be clearly erroneous").
3. Other AspectsThe "system of records" threshold requirement is not necessarily applicable to all subsections of the Act. See OMB Guidelines, 40 Fed. Reg. at 28,952, available at http://www.loc.gov/rr/frd/Military_Law/pdf/LH_privacy_act-1974.pdf (system of records definition "limits the applicability of some of the provisions of the Act") (emphasis added). But see Privacy Commission Report at 503-04, available at http://epic.org/privacy/ppsc1977report (assuming that definition limits entire Act); cf. Henke v. U.S. Dep't of Commerce, 83 F.3d 1453, 1459 (D.C. Cir. 1996) ("[T]he determination that a system of records exists triggers virtually all of the other substantive provisions of the Privacy Act."); McCready v. Principi, 297 F. Supp. 2d 178, 185 (D.D.C. 2003) ("For almost all circumstances, the Act extends only to those records that are in a 'system of records' which is a specific term of art."), aff'd in part & rev'd in part sub nom. McCready v. Nicholson, 465 F.3d 1 (D.C. Cir. 2006).
Primarily, in Albright v. United States, 631 F.2d 915, 918-20 (D.C. Cir. 1980), the Court of Appeals for the District of Columbia Circuit held that subsection (e)(7) -- which restricts agencies from maintaining records describing how an individual exercises his First Amendment rights -- applies even to records not incorporated into a system of records. Albright involved a challenge on subsection (e)(7) grounds to an agency's maintenance of a videotape -- kept in a file cabinet in an envelope that was not labeled by any individual's name -- of a meeting between a personnel officer and agency employees affected by the officer's job reclassification decision. Id. at 918. Relying on both the broad definition of "maintain," 5 U.S.C. § 552a(a)(3), and the "special and sensitive treatment accorded First Amendment rights," the D.C. Circuit held that the mere collection of a record regarding those rights could be a violation of subsection (e)(7), regardless of whether the record was contained in a system of records retrieved by an individual's name or personal identifier. Id. at 919-20; see also Maydak v. United States, 363 F.3d 512, 516, 518-19 (D.C. Cir. 2004) (reaffirming holding in Albright).
Albright's broad construction of subsection (e)(7) has been adopted by several other courts. See MacPherson v. IRS, 803 F.2d 479, 481 (9th Cir. 1986); Boyd v. Sec'y of the Navy, 709 F.2d 684, 687 (11th Cir. 1983); Clarkson, 678 F.2d at 1373-77; Fagot, 584 F. Supp. at 1175; Gerlich v. DOJ, No. 08-1134, 2009 WL 2959884, at *9-11 (D.D.C. Sept. 16, 2009). Further, the Court of Appeals for the Eleventh Circuit in Clarkson, 678 F.2d at 1375-77, held that, at least with respect to alleged violations of subsection (e)(7), the Act's amendment provision (subsection (d)(2)) also can apply to a record not incorporated into a system of records. However, Judge Tjoflat's concurring opinion in Clarkson intimated that something more than a bare allegation of a subsection (e)(7) violation would be necessary in order for an agency to be obligated to search beyond its systems of records for potentially offensive materials. Id. at 1378-79.In McCready v. Nicholson, 465 F.3d 1, 10-12 (D.C. Cir. 2006), the D.C. Circuit went even further and held that the terms of subsection (g)(1)(C) -- the judicial remedy provision for subsection (e)(5) violations -- "[do] not incorporate or otherwise refer to the Act's definition of a 'system of records' found in § 552a(a)(5)." The Court of Appeals stated that the "distinction between a claim that requires a system of records and a claim under § 552a(g)(1)(C) that does not require a system of records makes perfect sense." Id. Unlike other types of Privacy Act claims, which are shielded by the system of records definition in order to avoid "costly fishing expeditions," the Court of Appeals reasoned, subsection (g)(1)(C) claims do not implicate "[t]his legitimate concern with preserving an agency's resources" because "an individual and an agency already have identified the record at issue, that record is therefore easily retrieved, and the only issue is the accuracy of the record." Id. See also Gerlich, 2009 WL 2959884, at *12 (relying on McCready v. Nicholson to conclude that the system of records requirement did not apply to plaintiffs' claim under subsections (e)(5) and (g)(1)(C)).
Some district courts have similarly extended the coverage of other Privacy Act provisions to records that are not maintained in a system of records. See Connelly v. Comptroller of the Currency, 673 F. Supp. 1419, 1424 (S.D. Tex. 1987) (construing "any record" language contained in 5 U.S.C. § 552a(g)(1)(C) to permit a damages action arising from an allegedly inaccurate record that was not incorporated into a system of records), rev'd on other grounds, 876 F.2d 1209 (5th Cir. 1989); Reuber v. United States, No. 81-1857, slip op. at 5 (D.D.C. Oct. 27, 1982) (relying on Albright for proposition that subsections (d)(2), (e)(1)-(2), (e)(5)-(7), and (e)(10) all apply to a record not incorporated into a system of records), partial summary judgment denied (D.D.C. Aug. 15, 1983), partial summary judgment granted (D.D.C. Apr. 13, 1984), subsequent decision (D.D.C. Sept. 6, 1984), aff'd on other grounds, 829 F.2d 133 (D.C. Cir. 1987); cf. Fiorella v. HEW, 2 Gov't Disclosure Serv. (P-H) ¶ 81,363, at 81,946 n.1 (W.D. Wash. Mar. 9, 1981) (noting that subsections (e)(5) and (e)(7) "are parallel in structure and would seem to require the same statutory construction").
However, the Court of Appeals for the District of Columbia Circuit has declined to extend the holding in Albright to certain other subsections of § 552a(e). See Maydak v. United States, 363 F.3d 512, 517-19 (D.C. Cir. 2004). In Maydak, the Court of Appeals held that in accordance with the OMB Guidelines, the requirements contained in subsections (e)(1), (2), (3), and (10) are "triggered only if the records are actually incorporated into a system of records." Id. The D.C. Circuit explained that it reached a different conclusion as to subsection (e)(7) in Albright because of "'Congress'[s] own special concern for the protection of First Amendment rights,'" id. at 518 (quoting Albright, 631 F.2d at 919), and it went on to state that "at least in comparison to the other subsections at issue, subsection 552a(e)(7) proves the exception rather than the rule," id. at 519. See also Gerlich, 2009 WL 2959884, at *12-13 ("[S]ubsections (e)(1), (e)(2), (e)(6), (e)(9), and (e)(10) . . . only apply to records that are contained within a 'system of records.'"); Krieger v. DOJ, 529 F. Supp. 2d 29, 50-56 (D.D.C. 2008) (finding that subsections (e)(1), (4), (6), (9), and (10) apply only to records contained in a system of records); cf. Thompson v. Dep't of State, No. 03-2227, 400 F. Supp. 1, 12 (D.D.C. 2005) (following Maydak and observing that "[i]t is not at all clear that subsection (e)(2) applies where the requested information never becomes part of [the] system"), aff'd 210 F. App'x 5 (D.C. Cir. 2006).
Other courts have also declined to follow Albright and have limited the applicability of the Privacy Act requirements that are contained in subsections other than (e)(7) to records that are maintained in a system of records. See, e.g., Gowan v. U.S. Dep't of the Air Force, 148 F.3d 1182, 1192 (10th Cir. 1998) (holding that appellant "ha[d] no § 552a(e)(5) cause of action" for maintenance of report that was not maintained in system of records); Clarkson, 678 F.2d at 1377 (declining to extend Albright rationale to subsections (e)(1) and (e)(5)); Bettersworth v. FDIC, No. A-97-CA-624, slip op. at 10 (W.D. Tex. Feb. 1, 2000) (magistrate's recommendation) (recognizing holding in Connelly, but noting that both subsections (d)(1) and (g)(1)(C) contain same "system of records" language, and stating that court is "unpersuaded that Congress intended any other meaning than what has previously been applied"), adopted (W.D. Tex. Feb. 17, 2000), aff'd on other grounds, 248 F.3d 386 (5th Cir. 2001); Felsen v. HHS, No. CCB-95-975, slip op. at 61-62, 65 (D. Md. Sept. 30, 1998) (granting defendants summary judgment on alternative ground that subsection (e)(2) is inapplicable to records not included in system of records); Barhorst, 765 F. Supp. at 999-1000 (dismissing, on alternative grounds, Privacy Act claims under subsections (b), (e)(1)-(3), (e)(5)-(6), and (e)(10) because of finding that information was not in system of records; information was retrieved by job announcement number, not by name or other identifying particular).
Albright and its progeny establish that the "system of records" limitation on the scope of the Act is not uniformly applicable to all of the statute's subsections. As is apparent from the above discussion, there has been some uncertainty about which particular subsections of the statute are limited to records contained in a "system of records."
Go to Table of Contents ||
Previous Section Policy Objectives ||
Next Section Conditions of Disclosure to Third Parties