INDIVIDUAL'S RIGHT OF ACCESS

"Each agency that maintains a system of records shall . . . upon request by any individual to gain access to his record or to any information pertaining to him which is contained in the system, permit him and upon his request, a person of his own choosing to accompany him, to review the record and have a copy made of all or any portion thereof in a form comprehensible to him, except that the agency may require the individual to furnish a written statement authorizing discussion of that individual's record in the accompanying person's presence."  5 U.S.C. § 552a(d)(1).

Comment:

The Privacy Act provides individuals with a means of access similar to that of the Freedom of Information Act.  The statutes do overlap, but not entirely.  See generally Greentree v. U.S. Customs Serv., 674 F.2d 74, 76-80 (D.C. Cir. 1982).  The FOIA is entirely an access statute; it permits "any person" to seek access to any "agency record" that is not subject to any of its nine exemptions or its three exclusions.  By comparison, the Privacy Act permits only an "individual" to seek access to only his own "record," and only if that record is maintained by the agency within a "system of records" -- i.e., is retrieved by that individual requester's name or personal identifier -- subject to ten Privacy Act exemptions (see the discussion of Privacy Act exemptions, below).  Thus, the primary difference between the FOIA and the access provision of the Privacy Act is in the scope of information accessible under each statute.

An individual's access request for his own record maintained in a system of records should be processed under both the Privacy Act and the FOIA, regardless of the statute(s) cited.  See 5 U.S.C. § 552a(t)(1) and (2) (prohibiting reliance on FOIA exemptions to withhold under Privacy Act, and vice versa); H.R. Rep. No. 98-726, pt. 2, at 16-17 (1984), reprinted in 1984 U.S.C.C.A.N. 3741, 3790-91 (regarding amendment of Privacy Act in 1984 to include subsection (t)(2) and stating:  "Agencies that had made it a practice to treat a request made under either [the Privacy Act or the FOIA] as if the request had been made under both laws should continue to do so."); FOIA Update, Vol. VII, No. 1, at 6, available at http://www.usdoj.gov/oip/foia_updates/Vol_VII_1/page5.htm ("FOIA Counselor Q & A"); see also Shapiro v. DEA, 762 F.2d 611, 612 (7th Cir. 1985) ("Congress intends that the courts construe the Privacy Act and the Freedom of Information Act separately and independently so that exemption from disclosure under the Privacy Act does not exempt disclosure under the Freedom of Information Act, and vice versa."); Blazy v. Tenet, 979 F. Supp. 10, 16 (D.D.C. 1997) (quoting subsection (t)(2) and stating that "[d]ocument requests therefore must be analyzed under both Acts"), summary affirmance granted, No. 97-5330, 1998 WL 315583 (D.C. Cir. May 12, 1998); Sussman v. DOJ, No. 03-3618, 2006 WL 2850608, at *4 (E.D.N.Y. Sept. 30, 2006) ("[A]n exemption under the FOIA is not a bar to release files under the Privacy Act and . . . a Privacy Act exemption is not a bar to release of files under the FOIA."); Brown v. DOJ, No. 02-2662, slip op. at 18 n.36 (D. Ala. June 21, 2005) (following Blazy and concluding that plaintiff's request must be analyzed under both FOIA and Privacy Act because "access to documents under these statutes [is] dissimilar"); Bogan v. FBI, No. 04-C-532-C, 2005 WL 1367214, at *6 (W.D. Wis. June 7, 2005) (explaining that if records are requested under both FOIA and Privacy Act, requester can gain access to those records by showing that they were accessible under either statute); Harvey v. DOJ, No. 92-176-BLG, slip op. at 8 (D. Mont. Jan. 9, 1996) ("Even though information may be withheld under the [Privacy Act], the inquiry does not end.  The agency must also process requests under the FOIA, since the agency may not rely upon an exemption under the [Privacy Act] to justify nondisclosure of records that would otherwise be accessible under the FOIA.  5 U.S.C. § 552a(t)(2)."), aff'd, 116 F.3d 484 (9th Cir. 1997) (unpublished table decision); cf. Wren v. Harris, 675 F.2d 1144, 1146 & n.5 (10th Cir. 1982) (per curiam) (construing pro se complaint to seek information under either Privacy Act or FOIA even though only FOIA was referenced by name); Hunsberger v. DOJ, No. 92-2587, slip op. at 2 n.2 (D.D.C. July 22, 1997) (system of records from which documents at issue were retrieved was exempt pursuant to Privacy Act exemption (j)(2); "[c]onsequently, the records were processed for release under the FOIA"); Kitchen v. FBI, No. 93-2382, slip op. at 7 (D.D.C. Mar. 18, 1996) (although all requested documents were exempt under Privacy Act, they "were also processed under FOIA in the interest of full disclosure"); Kitchen v. DEA, No. 93-2035, slip op. at 9 (D.D.C. Oct. 12, 1995) (same), appeal dismissed for failure to prosecute, No. 95-5380 (D.C. Cir. Dec. 11, 1996); Freeman v. DOJ, 822 F. Supp. 1064, 1066 (S.D.N.Y. 1993) (implicitly accepting agency's rationale that "because documents releasable pursuant to FOIA may not be withheld as exempt under the Privacy Act," it is proper for the agency not to distinguish between FOIA and Privacy Act requests when assigning numbers to establish the order of processing, and quoting Report of House Committee on Government Operations, H.R. Rep. No. 98-726, which was cited by the agency as "mandat[ing]" such practice); Pearson v. DEA, No. 84-2740, slip op. at 2 (D.D.C. Jan. 31, 1986) (same as Wren).

In addition, unlike the FOIA, see 5 U.S.C. § 552(a)(6)(A), the Privacy Act does not speak of a requester's right to administratively appeal any adverse determination that an agency makes on his access request.  However, because agencies should process an individual's access request under both statutes -- which includes processing the request through any administrative appeal -- there is no practical effect of this distinction.  See, e.g., 28 C.F.R. § 16.45 (2009) (Department of Justice Privacy Act regulation regarding appeals from denials of requests for access to records).

It should be noted that the Privacy Act -- like the FOIA – does not require agencies to create records that do not exist.  See DeBold v. Stimson, 735 F.2d 1037, 1041 (7th Cir. 1984); Harter v. IRS, No. 02-00325, 2002 WL 31689533, at *5 (D. Haw. Oct. 16, 2002); Perkins v. IRS, No. 86-CV-71551, slip op. at 4 (E.D. Mich. Dec. 16, 1986); see also, e.g., Villanueva v. DOJ, 782 F.2d 528, 532 (5th Cir. 1986) (rejecting argument that FBI was required to "find a way to provide a brief but intelligible explanation for its decision . . . without [revealing exempt information]").  But compare May v. Dep't of the Air Force, 777 F.2d 1012, 1015-17 (5th Cir. 1985) ("reasonable segregation requirement" obligates agency to create and release typewritten version of handwritten evaluation forms so as not to reveal identity of evaluator under exemption (k)(7)), with Church of Scientology W. United States v. IRS, No. CV-89-5894, slip op. at 4 (C.D. Cal. Mar. 5, 1991) (FOIA decision rejecting argument based upon May and holding that agency not required to create records).

In a recent case, the Court of Appeals for the District of Columbia Circuit was presented with the question of "whether [the agency] intentionally destroyed the [record sought] after [plaintiff] requested access to it."  Chambers v. U.S. Dep't of the Interior, 568 F.3d 998, 1000 (D.C. Cir. 2009).  The court of appeals reversed the district court's grant of summary judgment to the agency.  Id. at 1003-06.  However, the court of appeals did not give the district court any suggestion as to what action it should take were it to find on remand that the agency intentionally destroyed the records -- other than, perhaps, award the requester attorney fees and costs.  Id. at 1003-08 (confusingly stating that "the Privacy Act, like FOIA, requires" agency's search to be "reasonably calculated to uncover all relevant documents" and explaining that agency would not have met this standard if officials "deliberately destroyed [the record at issue] before completing the search in order to avoid providing the document to [plaintiff]").

For a discussion of the unique procedures involved in processing first-party requests for medical records, see the discussion below under 5 U.S.C. § 552a(f)(3).

Suppose John Q. Citizen writes to Agency:  "Please send to me all records that you have on me."

(1)  IF NO PRIVACY ACT EXEMPTION APPLIES

Result:  Mr. Citizen should receive access to his Privacy Act records where Agency can invoke no Privacy Act exemption.

The Agency cannot rely upon a FOIA exemption alone to deny Mr. Citizen access to any of his records under the Privacy Act.  See 5 U.S.C. § 552a(t)(1) (FOIA exemptions cannot defeat Privacy Act access); see also Martin v. Office of Special Counsel, 819 F.2d 1181, 1184 (D.C. Cir. 1987) ("If a FOIA exemption covers the documents, but a Privacy Act exemption does not, the documents must be released under the Privacy Act." (emphasis added)); Hoffman v. Brown, No. 1:96cv53-C, slip op. at 4 (W.D.N.C. Nov. 26, 1996) (agreeing with plaintiff that "no provision of the Privacy Act allows the government to withhold or redact records concerning [his] own personnel records" and ordering production of e-mail and other correspondence regarding plaintiff's employment), aff'd, 145 F.3d 1324 (4th Cir. 1998) (unpublished table decision); Viotti v. U.S. Air Force, 902 F. Supp. 1331, 1336-37 (D. Colo. 1995) ("If the records are accessible under the Privacy Act, the exemptions from disclosure in the FOIA are inapplicable."), aff'd, 153 F.3d 730 (10th Cir. 1998) (unpublished table decision); Savada v. DOD, 755 F. Supp. 6, 9 (D.D.C. 1991) (citing Martin for the proposition that "[i]f an individual is entitled to a document under FOIA and the Privacy Act, to withhold this document an agency must prove that the document is exempt from release under both statutes"); cf. Stone v. Def. Investigative Serv., 816 F. Supp. 782, 788 (D.D.C. 1993) ("[T]he Court must determine separately [from the FOIA] whether plaintiff is entitled to any of the withheld information under the Privacy Act."); Rojem v. DOJ, 775 F. Supp. 6, 13 (D.D.C. 1991) ("[T]here are instances in which the FOIA denies access and the Privacy Act compels release."), appeal dismissed for failure to timely file, No. 92-5088 (D.C. Cir. Nov. 4, 1992); Ray v. DOJ, 558 F. Supp. 226, 228 (D.D.C. 1982) (requester is entitled, under subsection (c)(3), to receive the addresses of private persons who requested information about him, as "defendant is unable to cite a specific [Privacy Act] exemption that justifies non-disclosure of this information"), aff'd, 720 F.2d 216 (D.C. Cir. 1983) (unpublished table decision). 

In other words, a requester is entitled to the combined total of what both statutes provide.  See Clarkson v. IRS, 678 F.2d 1368, 1376 (11th Cir. 1982); Wren v. Harris, 675 F.2d 1144, 1147 (10th Cir. 1982) (per curiam); Searcy v. SSA, No. 91-C-26 J, slip op. at 7-8 (D. Utah June 25, 1991) (magistrate's recommendation), adopted (D. Utah Sept. 19, 1991), aff'd, No. 91-4181 (10th Cir. Mar. 2, 1992); Whittle v. Moschella, 756 F. Supp. 589, 595 (D.D.C. 1991); Fagot v. FDIC, 584 F. Supp. 1168, 1173-74 (D.P.R. 1984), aff'd in part & rev'd in part, 760 F.2d 252 (1st Cir. 1985) (unpublished table decision); see also 120 Cong. Rec. 40,406 (1974), reprinted in Source Book at 861, available at http://www.loc.gov/rr/frd/Military_Law/pdf/LH_privacy_act-1974.pdf.  For access purposes, the two statutes work completely independently of one another.

(2) IF A PRIVACY ACT EXEMPTION APPLIES

Result:  Where a Privacy Act exemption applies, Mr. Citizen is not entitled to obtain access to his records under the Privacy Act.

But he may still be able to obtain access to his records (or portions thereof) under the FOIA.  See 5 U.S.C. § 552a(t)(2) (Privacy Act exemption(s) cannot defeat FOIA access); Martin, 819 F.2d at 1184 ("[I]f a Privacy Act exemption but not a FOIA exemption applies, the documents must be released under FOIA.") (emphasis added); Savada, 755 F. Supp. at 9 (citing Martin and holding that agency must prove that document is exempt from release under both FOIA and Privacy Act); see also Shapiro v. DEA, 762 F.2d 611, 612 (7th Cir. 1985); Grove v. CIA, 752 F. Supp. 28, 30 (D.D.C. 1990); Simon v. DOJ, 752 F. Supp. 14, 22 (D.D.C. 1990), aff'd, 980 F.2d 782 (D.C. Cir. 1992); Miller v. United States, 630 F. Supp. 347, 348-49 (E.D.N.Y. 1986); Nunez v. DEA, 497 F. Supp. 209, 211 (S.D.N.Y. 1980).  The outcome will depend upon FOIA exemption applicability.

(3) IF NO PRIVACY ACT EXEMPTION AND NO FOIA EXEMPTION APPLIES

Result:  The information should be disclosed.

(4) IF BOTH PRIVACY ACT AND FOIA EXEMPTIONS APPLY

Result:  The record should be withheld, unless the agency, after careful consideration, decides to disclose the record to the first-party requester as a matter of administrative discretion.  See Attorney General's Memorandum for Heads of Departments and Agencies, Subject:  The Freedom of Information Act (March 19, 2009), available athttp://www.justice.gov/ag/foia-memo-march2009.pdf (encouraging agencies "to make discretionary disclosures of information" when they may legally do so).  But remember:  When an individual requests access to his own record (i.e., a first-party request) that is maintained in a system of records, an agency must be able to invoke properly both a Privacy Act exemption and a FOIA exemption in order to withhold that record.

Rule:  ALL PRIVACY ACT ACCESS REQUESTS SHOULD ALSO BE TREATED AS FOIA REQUESTS.
Note also that Mr. Citizen's first-party request -- because it is a FOIA request as well -- additionally obligates Agency to search for any records on him that are not maintained in a Privacy Act system of records.  With respect to those records, only the FOIA's exemptions are relevant; the Privacy Act's access provision and exemptions are entirely inapplicable to any records not maintained in a system of records.

Comment:

A particularly troubling and unsettled problem under the Privacy Act arises where a file indexed and retrieved by the requester's name or personal identifier contains information pertaining to a third party that, if released, would invade that third party's privacy.

As a preliminary matter, it should be noted that this problem arises only when a requester seeks access to his record contained in a non-law enforcement system of records -- typically a personnel or background security investigative system -- inasmuch as agencies are generally permitted to exempt the entirety of their criminal and civil law enforcement systems of records from the subsection (d)(1) access provision pursuant to 5 U.S.C. § 552a(j)(2) and (k)(2).

The problem stems from the fact that unlike under the FOIA, see 5 U.S.C. § 552(b)(6), (7)(C), the Privacy Act (ironically) does not contain any exemption that protects a third party's privacy.  Cf. 5 U.S.C. § 552a(k)(5) (protecting only confidential source-identifying information in background security investigative systems).  The Privacy Act's access provision simply permits an individual to gain access to "his record or to any information pertaining to him" that is contained in a system of records indexed and retrieved by his name or personal identifier.  5 U.S.C. § 552a(d)(1). 

The only two courts of appeals to have squarely addressed this issue have reached different conclusions.  Compare Voelker v. IRS, 646 F.2d 332, 333-35 (8th Cir. 1981), withSussman v. U.S. Marshals Serv., 494 F.3d 1106, 1120-21 (D.C. Cir. 2007).

In Voelker v. IRS, the Court of Appeals for the Eighth Circuit held that where the requested information -- contained in a system of records indexed and retrieved by the requester's name -- is "about" that requester within the meaning of subsection (a)(4)'s definition of "record," all such information is subject to the subsection (d)(1) access provision.  646 F.2d at 334.  In construing subsection (d)(1), the Eighth Circuit noted that there is "no justification for requiring that information in a requesting individual's record meet some separate 'pertaining to' standard before disclosure is authorized [and i]n any event, it defies logic to say that information properly contained in a person's record does not pertain to that person, even if it may also pertain to another individual."  Id.  Relying on the importance of the access provision to the enforcement of other provisions of the Privacy Act, and the lack of any provision in the exemption portion of the statute to protect a third party's privacy, the Eighth Circuit rejected the government's argument that subsection (b) prohibited disclosure to the requester of the information about a third party.  Id. at 334-35.  A careful reading of Voelker reveals that the Eighth Circuit appeared to equate the term "record" with "file" for subsection (d)(1) access purposes.  Cf. Wren v. Harris, 675 F.2d 1144, 1147 (10th Cir. 1982) (per curiam) (reversing district court's judgment that FOIA Exemption 6 protected certain third-party information requested under the Privacy Act; stating "[o]n remand, should the district court find that the documents requested by Mr. Wren consist of 'his record' or 'any information pertaining to him,' and that they are 'records' contained in a 'system of records,' § 552a(a)(4), (5), (d)(1), then the court must grant him access to those documents as provided in § 552a(d)(1), unless the court finds that they are exempt from disclosure under [Privacy Act exemptions]"; "the [district] court's reliance on [FOIA Exemption 6] to withhold the documents would be improper if the court determines that the [Privacy Act] permits disclosure"); Henke v. U.S. Dep't of Commerce, No. 94-0189, 1996 WL 692020, at *4 (D.D.C. Aug. 19, 1994) (rejecting government's argument that information contained in one individual's records is exempt from the disclosure requirements of the Privacy Act simply because the same information is also contained in another individual's records, and further stating that it would "not create an exemption to the Privacy Act that [C]ongress did not see fit to include itself"), aff'd on other grounds, 83 F.3d 1445 (D.C. Cir. 1996); Ray v. DOJ, 558 F. Supp. 226, 228 (D.D.C. 1982) (ruling that requester was entitled to access, under subsection (c)(3), to addresses of private persons who had requested information about him because no Privacy Act exemption justified withholding such information, notwithstanding that agency's "concern about possible harrassment [sic] of these individuals may be legitimate."), aff'd, 720 F.2d 216 (D.C. Cir. 1983) (unpublished table decision).

Voelker's rationale was purportedly distinguished (but in actuality was rejected) in DePlanche v. Califano, 549 F. Supp. 685, 693-98 (W.D. Mich. 1982), a case involving a father's request for access to a social security benefits file indexed and retrieved by his social security number which contained the address of his two minor children.  In denying the father access to the children's address, the court reasoned that such third-party information, although contained in the father's file, was not "about" the father, and therefore by definition was not his "record" within the meaning of subsection (a)(4), nor was it information "pertaining" to him within the meaning of the subsection (d)(1) access provision.  Id. at 694-96.  In distinguishing Voelker, the court relied upon an array of facts suggesting that the father might harass or harm his children if their location were to be disclosed.  Id. at 693, 696-98. 
Other courts, too, have made findings that certain items of information, although contained in a file or document retrieved by an individual's name, did not qualify as Privacy Act records "about" that individual.  See Nolan v. DOJ, No. 89-A-2035, 1991 WL 36547, at *10 (D. Colo. Mar. 18, 1991) (names of FBI agents and other personnel held not requester's "record" and therefore "outside the scope of the [Privacy Act]"), aff'd, 973 F.2d 843 (10th Cir. 1992); Haddon v. Freeh, 31 F. Supp. 2d 16, 22 (D.D.C. 1998) (applying Nolan and Doe, infra, to hold that identities and telephone extensions of FBI agents and personnel were not "about" plaintiff and thus were properly withheld); Springmann v. U.S. Dep't of State, No. 93-1238, slip op. at 8 & n.1 (D.D.C. Apr. 21, 1997) (citing Nolan and holding that name of foreign official who provided information to State Department and names of foreign service officers (other than plaintiff) who were denied tenure were "not accessible to plaintiff under the Privacy Act because the identities of these individuals d[id] not constitute information 'about' plaintiff, and therefore [we]re not 'records' with respect to plaintiff under the Privacy Act"); Hunsberger v. CIA, No. 92-2186, slip op. at 3-4 (D.D.C. Apr. 5, 1995) (citing Nolan and holding that names of employees of private insurance company used by Director of Central Intelligence and Director's unique professional liability insurance certificate number maintained in litigation file created as result of plaintiff's prior suit against CIA Director were not "about" plaintiff and therefore were not "record[s]" within meaning of Privacy Act); Doe v. DOJ, 790 F. Supp. 17, 22 (D.D.C. 1992) (citing Nolan and alternatively holding that "names of agents involved in the investigation are properly protected from disclosure"); cf. Allard v. HHS, No. 4:90-CV-156, slip op. at 9-11 (W.D. Mich. Feb. 14, 1992) (citing DePlanche with approval and arriving at same result, but conducting analysis solely under FOIA Exemption 6), aff'd, 972 F.2d 346 (6th Cir. 1992) (unpublished table decision).

The District Court for the District of Columbia was confronted with a more complex version of this issue in Topuridze v. USIA, 772 F. Supp. 662 (D.D.C. 1991), reconsidering Topuridze v. FBI, No. 86-3120, 1989 WL 11709 (D.D.C. Feb. 6, 1989), when the subject of a letter requested access to it and the agencies withheld it to protect the author's privacy interests.  In Topuridze, the issue of access to third-party information in a requester's file was further complicated by the fact that the information was "retrievable" by both the requester's identifier and the third party's identifier, Topuridze v. FBI, No. 86-3120, 1989 WL 11709, at *1 (D.D.C. Feb. 6, 1989) -- the record was subject to "dual retrieval."  In apparent contradiction to the subsection (d)(1) access provision, subsection (b) prohibits the nonconsensual disclosure of an individual's record contained in a system of records indexed and retrieved by his name or personal identifier to any third party.  See 5 U.S.C. § 552a(b).  Because the letter was both the requester's and the third party's Privacy Act record, the government argued that subsection (b), though technically not an "exemption," nevertheless restricts first-party access under subsection (d)(1) where the record is about both the requester and the third-party author, and is located in a system of records that is "retrievable" by both their names.  See Topuridze v. FBI, No. 86-3120, 1989 WL 11709, at *1 (D.D.C. Feb. 6, 1989); Topuridze v. USIA, 772 F. Supp. at 665-66.  Although the court had previously ruled that the document was not about the author, see Topuridze v. FBI, No. 86-3120, 1989 WL 11709, at *2-3 (D.D.C. Feb. 6, 1989), on reconsideration it ruled that it need not reach that issue, finding that "[b]ecause the document is without dispute about the [requester], it must be released to him in any event."  772 F. Supp. at 665.  On reconsideration, the court embraced Voelker and rejected the government's argument that subsection (b) created a "dual record exemption" to Privacy Act access.  Id. at 665-66.

However, more recently, the Court of Appeals for the District of Columbia Circuit reached a result different than those reached in Voelker and Topuridze, although the court did not mention either of those cases.  See Sussman, 494 F.3d 1106.  The U.S. Marshals Service processed Sussman's subsection (d)(1) request "by searching for records indexed to his name" and found only one document.  No. Civ. A. 03-610, 2005 WL 3213912, at *1 (D.D.C. Oct. 13, 2005).  Sussman argued that the Marshals Service performed an inadequate search and identified a "Wanted Poster" that the Marshals Service had issued for Keith Maydak, which listed "Michael Sussman" as an alias for "Keith Maydak."  494 F.3d 1109.  The Marshals Service conducted a second search, "now taking into account Sussman's connections to Maydak."  Id. at 1110.  The second search yielded more than 800 pages of documents "relating to Sussman."  Id.  It is unclear whether the Marshals Service retrieved the second set of records by Maydak's name.  The district court stated that "the [Marshals Service] searched Keith Maydak's files for records related to or pertaining to [Sussman] or that mentioned [Sussman] by name."  2005 WL 3213912, at *2.  The Marshals service disclosed only some of these records to Sussman.  494 F.3d at 1110.  Sussman brought a subsection (d)(1) claim against the Marshals Service.  \sect sa0 Id.  The D.C. Circuit "interpret[ed] 5 U.S.C. § 552a(d)(1) to give parties access only to their own records, not to all information pertaining to them that happens to be contained in a system of records."  Id. at 1121.  The court explained that "[f]or an assemblage of data to qualify as one of Sussman's records, it must not only contain his name or other identifying particular but also be 'about' him."  Id.  Thus, the court held, "the Marshals Service must disclose to Sussman those materials -- and only those materials -- contained in records about him, the release of which would not violate 5 U.S.C. § 552a(b)."  Id.  In a footnote, the court explained that "[i]f certain materials pertain to both Sussman and other individuals, from whom the Marshals Service has received no written consent permitting disclosure, the Privacy Act would both require (5 U.S.C. § 552a(d)(1)) and forbid (id. § 552a(b)) their disclosure."  Id. n.9.  In such a situation, subsection (d)(1) must give way because "the consent requirement in § 552a(b) is one of the most important, if not the most important, provisions in the Privacy Act."  Id. n.9.  Sussman also brought a subsection (b)/(g)(1)(D) claim against the Marshals Service, alleging that the Marshals Service disclosed information about him in violation of subsection (b).  Id.  The Marshals Service conceded that "the materials [disclosed] were in a system of records."  Id. at 1123.  However, the Marshals Service argued that it did not violate subsection (b) because the information disclosed "was not maintained in a system of records retrievable by Sussman's name, but by Maydak's name."  Id.  Thus, the issue before the court was "whether an adversely affected individual can bring suit under § 552a(g)(1)(D) for the improper disclosure of another person's records."  Id.  The court concluded that subsection (g)(1)(D) "permit[s] claims predicated on § 552a(b) violations only by a person whose records are actually disclosed."  Id.  Thus, the court explained, "for his action to survive, Sussman must present evidence that materials from records about him, which the Marshals Service retrieved by his name, were improperly disclosed."  Id.; see also Anderson v. U.S. Dep't of the Treasury, No. 76-1404, slip op. at 13 (D.D.C. July 19, 1977) (presaging Sussman by finding name of third-party complainant in requester's file to be "about" complainant and, therefore, denying requester access to complainant's name).

The D.C. Circuit's opinion in Sussman seriously calls into question the validity of Topuridze, insofar as Topuridze could be read to require an agency to disclose to a requester "those materials . . . contained in records about him" even if the release of those materials would violate the subsection (b) rights of the non-requesting party.  See Sussman, 494 F.3d at 1121.  While Sussman controls in the D.C. Circuit, which has universal venue for Privacy Act matters, the holding in Voelker remains undisturbed in the Eighth Circuit. 

A requester need not state his reason for seeking access to records under the Privacy Act, but an agency should verify the identity of the requester in order to avoid violating subsection (b).  See OMB Guidelines, 40 Fed. Reg. 28,948, 28,957-58 (July 9, 1975), available at http://www.whitehouse.gov/omb/assets/omb/inforeg/implementation_guidelines.pdf; see also 5 U.S.C. § 552a(i)(1) (criminal penalties for disclosure of information to parties not entitled to receive it); 5 U.S.C. § 552a(i)(3) (criminal penalties for obtaining records about an individual under false pretenses); cf., e.g., 28 C.F.R. § 16.41(d) (2009) (Department of Justice regulation regarding verification of identity).

Also, although it has been observed that subsection (d)(1) "carries no prospective obligation to turn over new documents that come into existence after the date of the request," Crichton v. Cmty. Servs. Admin., 567 F. Supp. 322, 325 (S.D.N.Y. 1983), the D.C. Circuit has held that under the FOIA a date-of-request cut-off policy -- as opposed to a date-of-search cut-off policy
-- was unreasonable under the facts of that case.  Public Citizen v. Dep't of State, 276 F.3d 634, 644 (D.C. Cir. 2002).  See generally FOIA Post, "Use of 'Cut-Off' Dates for FOIA Searches," available at http://www.justice.gov/oip/foiapost/2004foiapost14.htm.

Go to Table of Contents || Previous Section Accounting of Certain Disclosures || Next Section Individual's Right of Amendment